@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/auth/services.d.ts

@@ -1,7 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { type RebasePgTable } from "../types.js";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
-export type { Role };
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, AccountAccessState, PendingEmailChange } from "@rebasepro/server";
 export interface AuthSchemaTables {
     users: RebasePgTable;
     refreshTokens: RebasePgTable;
@@ -38,6 +37,8 @@ export declare class UserService implements UserRepository {
     private db;
     private usersTable;
     private userIdentitiesTable;
+    /** Read by `getAccountAccessState`, to say whether one sign-in is still live. */
+    private refreshTokensTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
     private getQualifiedUsersTableName;
     /**
@@ -83,6 +84,11 @@ export declare class UserService implements UserRepository {
     updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
+    /**
+     * @see UserRepository.firstUserIds — an unordered `LIMIT` read of the
+     * primary key, not `listUsersPaginated`'s count and sort of every row.
+     */
+    firstUserIds(limit: number): Promise<string[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
     /**
      * Update user's password hash; `null` removes the password.
@@ -100,10 +106,6 @@ export declare class UserService implements UserRepository {
      * Find user by email verification token
      */
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    /**
-     * Get roles for a user from database (inline TEXT[] column)
-     */
-    getUserRoles(uid: string): Promise<Role[]>;
     /**
      * Get role IDs for a user
      */
@@ -116,12 +118,53 @@ export declare class UserService implements UserRepository {
      * Assign a specific role to new user (appends if not present)
      */
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
+    /**
+     * One read of what an access token is judged against: whether the account
+     * exists, its roles, and its revocation watermark. See
+     * `TokenRepository.getAccountAccessState`.
+     *
+     * The watermark is read only where the table declares it, as
+     * `RefreshTokenService.getTokensValidAfter` reads it — a table without the
+     * column has no watermark rather than an error on every request.
+     */
+    getAccountAccessState(uid: string, sessionId?: string): Promise<AccountAccessState | null>;
+    /**
+     * Whether the users table has `disabled_at`. `ensureAuthTablesExist` adds
+     * it to every auth table at boot, but the app's own drizzle object may
+     * predate it, so the database is asked — once — rather than the object.
+     */
+    private disabledColumn?;
+    private hasDisabledColumn;
+    /**
+     * Whether the users table has the address-change columns. Added at boot to
+     * every auth table, but the app's drizzle object never declares them, so
+     * the database is asked — once — as for `disabled_at`.
+     */
+    private emailChangeColumns?;
+    private hasEmailChangeColumns;
+    private requireEmailChangeColumns;
+    /** @see UserRepository.setPendingEmailChange */
+    setPendingEmailChange(uid: string, change: {
+        email: string;
+        tokenHash: string;
+    } | null): Promise<void>;
+    /** @see UserRepository.getPendingEmailChange */
+    getPendingEmailChange(uid: string): Promise<PendingEmailChange | null>;
+    /** @see UserRepository.findPendingEmailChange */
+    findPendingEmailChange(tokenHash: string): Promise<{
+        user: UserData;
+        change: PendingEmailChange;
+    } | null>;
+    /** @see UserRepository.applyPendingEmailChange — one write, held to the token. */
+    applyPendingEmailChange(uid: string, tokenHash: string): Promise<UserData | null>;
+    /** @see UserRepository.setUserDisabled */
+    setUserDisabled(uid: string, disabled: boolean): Promise<void>;
     /**
      * Get user with their roles
      */
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: Role[];
+        roles: string[];
     } | null>;
 }
 export declare class RefreshTokenService {
@@ -191,6 +234,12 @@ export declare class RefreshTokenService {
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
     deleteById(id: string, uid: string): Promise<void>;
+    /**
+     * Every token past its expiry, whoever holds it. `prune` clears a user's
+     * expired rows when that user refreshes; a session nobody comes back to
+     * is only ever cleared here.
+     */
+    deleteExpired(): Promise<void>;
 }
 /**
  * Password reset token service
@@ -235,6 +284,8 @@ export declare class MagicLinkTokenService {
     private getQualifiedTableName;
     createToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findValidByHash(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
+    /** Links and email codes past their expiry, used or not. */
+    deleteExpired(): Promise<void>;
     markAsUsed(tokenHash: string): Promise<void>;
 }
 /**
@@ -262,6 +313,10 @@ export declare class PostgresTokenRepository implements TokenRepository {
     findValidPasswordResetToken(tokenHash: string): Promise<PasswordResetTokenInfo | null>;
     markPasswordResetTokenUsed(tokenHash: string): Promise<void>;
     deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
+    /**
+     * @see TokenRepository.deleteExpiredTokens — reset links, magic links and
+     * email codes, and refresh tokens, each past its own expiry.
+     */
     deleteExpiredTokens(): Promise<void>;
     createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null>;
@@ -288,23 +343,30 @@ export declare class PostgresAuthRepository implements AuthRepository {
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    firstUserIds(limit: number): Promise<string[]>;
     updatePassword(id: string, passwordHash: string | null): Promise<void>;
     setEmailVerified(id: string, verified: boolean): Promise<void>;
     setVerificationToken(id: string, token: string | null): Promise<void>;
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    getUserRoles(uid: string): Promise<RoleData[]>;
     getUserRoleIds(uid: string): Promise<string[]>;
     setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     assignDefaultRole(uid: string, roleId: string): Promise<void>;
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: RoleData[];
+        roles: string[];
+    } | null>;
+    getAccountAccessState(uid: string, sessionId?: string): Promise<AccountAccessState | null>;
+    setUserDisabled(uid: string, disabled: boolean): Promise<void>;
+    setPendingEmailChange(uid: string, change: {
+        email: string;
+        tokenHash: string;
+    } | null): Promise<void>;
+    getPendingEmailChange(uid: string): Promise<PendingEmailChange | null>;
+    findPendingEmailChange(tokenHash: string): Promise<{
+        user: UserData;
+        change: PendingEmailChange;
     } | null>;
-    getRoleById(id: string): Promise<RoleData | null>;
-    listRoles(): Promise<RoleData[]>;
-    createRole(_data: CreateRoleData): Promise<RoleData>;
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
-    deleteRole(_id: string): Promise<void>;
+    applyPendingEmailChange(uid: string, tokenHash: string): Promise<UserData | null>;
     createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<boolean>;
     markRefreshTokenRotated(tokenHash: string): Promise<void>;
     revokeRefreshTokenSession(sessionId: string): Promise<void>;
@@ -383,6 +445,8 @@ export declare class MfaService implements MfaRepository {
      * share a single increment.
      */
     recordMfaChallengeAttempt(challengeId: string): Promise<number>;
+    /** Challenges past their five minutes, answered or not. */
+    deleteExpiredChallenges(): Promise<void>;
     verifyMfaChallenge(challengeId: string): Promise<void>;
     createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;

package/dist/{auth-users-columns-D2LBFrMH.js → auth-users-columns-C72EMoDJ.js}

@@ -62,6 +62,22 @@ var AUTH_USERS_COLUMNS = [
 		column: "tokens_valid_after",
 		type: "TIMESTAMP WITH TIME ZONE"
 	},
+	{
+		column: "disabled_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
+	{
+		column: "pending_email",
+		type: "TEXT"
+	},
+	{
+		column: "email_change_token",
+		type: "TEXT"
+	},
+	{
+		column: "email_change_sent_at",
+		type: "TIMESTAMP WITH TIME ZONE"
+	},
 	{
 		column: "created_at",
 		type: "TIMESTAMP WITH TIME ZONE",
@@ -113,4 +129,4 @@ function isAuthCollection(collection) {
 //#endregion
 export { isAuthCollection as i, authUsersColumnDefinition as n, authUsersColumnSql as r, AUTH_USERS_COLUMNS as t };
 
-//# sourceMappingURL=auth-users-columns-D2LBFrMH.js.map
+//# sourceMappingURL=auth-users-columns-C72EMoDJ.js.map

package/dist/{auth-users-columns-D2LBFrMH.js.map → auth-users-columns-C72EMoDJ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-users-columns-D2LBFrMH.js","names":[],"sources":["../src/schema/auth-users-columns.ts"],"sourcesContent":["/**\n * The one description of what an auth user table's columns must be.\n *\n * ## Why this exists\n *\n * Three different code paths create `rebase.users`, and before this module they\n * disagreed about it:\n *\n * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |\n * |------------------|-----------------------|-------------------------|--------------------------|\n * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |\n * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |\n * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |\n * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |\n *\n * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so\n * whichever ran first decided the table and the other two silently no-op'd.\n * Boot order therefore chose the constraints: a managed deploy (collection\n * tables first) got a users table whose `email` was nullable and whose\n * `email_verified` had no default, while the same project pushed from a\n * checkout got the strict one. In the same table, `is_anonymous` came out\n * `NOT NULL DEFAULT false` — because *that* column existed in only one of the\n * three lists, so its owner's definition won by default.\n *\n * A second consequence was drift in the other direction. The scaffold's\n * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and\n * builds its desired state from the collection alone, so the two columns only\n * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged\n * drift, and a push run after the server had booted once planned to DROP them.\n *\n * Both problems are the same problem: no single place said what this table is.\n * This is that place. Every creator asks here first and only then falls back to\n * the collection's own property definitions, so a column auth owns has one\n * definition regardless of who gets there first, and a column the developer\n * added to their users collection still behaves like any other field.\n *\n * ## What belongs here\n *\n * Only columns the auth services read or write. A developer's own additions to\n * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and\n * must NOT be listed — they are generated from the collection like every other\n * field, and listing them here would freeze a user's schema.\n *\n * `id` is deliberately absent: its type comes from the collection's id property\n * (uuid / increment / text) and each creator already derives it.\n *\n * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an\n * older runtime unable to work against a migrated table.\n */\n\n/**\n * A column auth owns.\n *\n * Structured rather than one SQL string because the same facts are needed in\n * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,\n * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a\n * table that already exists with the wrong shape. Parsing a string back apart\n * for the third of those is how the copies drifted in the first place.\n */\nexport interface AuthUsersColumn {\n    /** Physical column name. */\n    column: string;\n    /** Postgres type. */\n    type: string;\n    /** Default expression, verbatim, or absent for no default. */\n    default?: string;\n    /** Whether the column is NOT NULL. */\n    notNull?: boolean;\n}\n\n/**\n * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it\n * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.\n * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added\n * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted\n * table that already holds a longer row.\n */\nexport const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [\n    { column: \"email\", type: \"TEXT\", notNull: true },\n    { column: \"display_name\", type: \"TEXT\" },\n    { column: \"photo_url\", type: \"TEXT\" },\n    { column: \"roles\", type: \"TEXT[]\", default: \"'{}'\", notNull: true },\n    { column: \"password_hash\", type: \"TEXT\" },\n    { column: \"email_verified\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"email_verification_token\", type: \"TEXT\" },\n    { column: \"email_verification_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"is_anonymous\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"metadata\", type: \"JSONB\", default: \"'{}'\", notNull: true },\n    { column: \"tokens_valid_after\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"created_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true },\n    { column: \"updated_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true }\n];\n\nconst BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));\n\n/** Type + inline constraints, as they appear after the column name. */\nexport function authUsersColumnSql(spec: AuthUsersColumn): string {\n    return [\n        spec.type,\n        spec.default !== undefined ? `DEFAULT ${spec.default}` : \"\",\n        spec.notNull ? \"NOT NULL\" : \"\"\n    ].filter(Boolean).join(\" \");\n}\n\n/**\n * The auth-owned definition for a physical column name, or `undefined` when\n * auth does not own it.\n *\n * Callers pass the RESOLVED column name (after `columnName` mapping), because\n * that is the only name the three creators agree on: the scaffold's users\n * collection spells the property `displayName` and the column `display_name`.\n */\nexport function authUsersColumnDefinition(column: string): string | undefined {\n    const spec = BY_COLUMN.get(column);\n    return spec ? authUsersColumnSql(spec) : undefined;\n}\n\n/**\n * Whether a collection is an auth collection, i.e. whether the definitions in\n * this module apply to its table at all.\n *\n * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:\n * that one takes a `CollectionConfig`, this one is called from DDL code paths\n * that hold looser objects, and both spellings must accept `auth: true` as well\n * as `auth: { enabled: true }`.\n */\nexport function isAuthCollection(collection: unknown): boolean {\n    const auth = (collection as { auth?: unknown } | undefined)?.auth;\n    if (auth === true) return true;\n    return typeof auth === \"object\" && auth !== null && (auth as { enabled?: unknown }).enabled === true;\n}\n"],"mappings":";;;;;;;;;;AA6EA,IAAa,qBAAiD;CAC1D;EAAE,QAAQ;EAAS,MAAM;EAAQ,SAAS;CAAK;CAC/C;EAAE,QAAQ;EAAgB,MAAM;CAAO;CACvC;EAAE,QAAQ;EAAa,MAAM;CAAO;CACpC;EAAE,QAAQ;EAAS,MAAM;EAAU,SAAS;EAAQ,SAAS;CAAK;CAClE;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAkB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC7E;EAAE,QAAQ;EAA4B,MAAM;CAAO;CACnD;EAAE,QAAQ;EAA8B,MAAM;CAA2B;CACzE;EAAE,QAAQ;EAAgB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC3E;EAAE,QAAQ;EAAY,MAAM;EAAS,SAAS;EAAQ,SAAS;CAAK;CACpE;EAAE,QAAQ;EAAsB,MAAM;CAA2B;CACjE;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;CAC1F;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;AAC9F;AAEA,IAAM,YAAY,IAAI,IAAI,mBAAmB,KAAI,MAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;;AAGpE,SAAgB,mBAAmB,MAA+B;CAC9D,OAAO;EACH,KAAK;EACL,KAAK,YAAY,KAAA,IAAY,WAAW,KAAK,YAAY;EACzD,KAAK,UAAU,aAAa;CAChC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC9B;;;;;;;;;AAUA,SAAgB,0BAA0B,QAAoC;CAC1E,MAAM,OAAO,UAAU,IAAI,MAAM;CACjC,OAAO,OAAO,mBAAmB,IAAI,IAAI,KAAA;AAC7C;;;;;;;;;;AAWA,SAAgB,iBAAiB,YAA8B;CAC3D,MAAM,OAAQ,YAA+C;CAC7D,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,SAAS,YAAY,SAAS,QAAS,KAA+B,YAAY;AACpG"}
+{"version":3,"file":"auth-users-columns-C72EMoDJ.js","names":[],"sources":["../src/schema/auth-users-columns.ts"],"sourcesContent":["/**\n * The one description of what an auth user table's columns must be.\n *\n * ## Why this exists\n *\n * Three different code paths create `rebase.users`, and before this module they\n * disagreed about it:\n *\n * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |\n * |------------------|-----------------------|-------------------------|--------------------------|\n * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |\n * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |\n * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |\n * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |\n *\n * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so\n * whichever ran first decided the table and the other two silently no-op'd.\n * Boot order therefore chose the constraints: a managed deploy (collection\n * tables first) got a users table whose `email` was nullable and whose\n * `email_verified` had no default, while the same project pushed from a\n * checkout got the strict one. In the same table, `is_anonymous` came out\n * `NOT NULL DEFAULT false` — because *that* column existed in only one of the\n * three lists, so its owner's definition won by default.\n *\n * A second consequence was drift in the other direction. The scaffold's\n * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and\n * builds its desired state from the collection alone, so the two columns only\n * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged\n * drift, and a push run after the server had booted once planned to DROP them.\n *\n * Both problems are the same problem: no single place said what this table is.\n * This is that place. Every creator asks here first and only then falls back to\n * the collection's own property definitions, so a column auth owns has one\n * definition regardless of who gets there first, and a column the developer\n * added to their users collection still behaves like any other field.\n *\n * ## What belongs here\n *\n * Only columns the auth services read or write. A developer's own additions to\n * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and\n * must NOT be listed — they are generated from the collection like every other\n * field, and listing them here would freeze a user's schema.\n *\n * `id` is deliberately absent: its type comes from the collection's id property\n * (uuid / increment / text) and each creator already derives it.\n *\n * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an\n * older runtime unable to work against a migrated table.\n */\n\n/**\n * A column auth owns.\n *\n * Structured rather than one SQL string because the same facts are needed in\n * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,\n * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a\n * table that already exists with the wrong shape. Parsing a string back apart\n * for the third of those is how the copies drifted in the first place.\n */\nexport interface AuthUsersColumn {\n    /** Physical column name. */\n    column: string;\n    /** Postgres type. */\n    type: string;\n    /** Default expression, verbatim, or absent for no default. */\n    default?: string;\n    /** Whether the column is NOT NULL. */\n    notNull?: boolean;\n}\n\n/**\n * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it\n * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.\n * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added\n * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted\n * table that already holds a longer row.\n */\nexport const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [\n    { column: \"email\", type: \"TEXT\", notNull: true },\n    { column: \"display_name\", type: \"TEXT\" },\n    { column: \"photo_url\", type: \"TEXT\" },\n    { column: \"roles\", type: \"TEXT[]\", default: \"'{}'\", notNull: true },\n    { column: \"password_hash\", type: \"TEXT\" },\n    { column: \"email_verified\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"email_verification_token\", type: \"TEXT\" },\n    { column: \"email_verification_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"is_anonymous\", type: \"BOOLEAN\", default: \"FALSE\", notNull: true },\n    { column: \"metadata\", type: \"JSONB\", default: \"'{}'\", notNull: true },\n    { column: \"tokens_valid_after\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    // When an administrator switched the account off; NULL while it is on.\n    { column: \"disabled_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    // A self-service address change waiting for its link: the address, the\n    // hash of the token mailed to it, and when (it lives 24 hours).\n    { column: \"pending_email\", type: \"TEXT\" },\n    { column: \"email_change_token\", type: \"TEXT\" },\n    { column: \"email_change_sent_at\", type: \"TIMESTAMP WITH TIME ZONE\" },\n    { column: \"created_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true },\n    { column: \"updated_at\", type: \"TIMESTAMP WITH TIME ZONE\", default: \"NOW()\", notNull: true }\n];\n\nconst BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));\n\n/** Type + inline constraints, as they appear after the column name. */\nexport function authUsersColumnSql(spec: AuthUsersColumn): string {\n    return [\n        spec.type,\n        spec.default !== undefined ? `DEFAULT ${spec.default}` : \"\",\n        spec.notNull ? \"NOT NULL\" : \"\"\n    ].filter(Boolean).join(\" \");\n}\n\n/**\n * The auth-owned definition for a physical column name, or `undefined` when\n * auth does not own it.\n *\n * Callers pass the RESOLVED column name (after `columnName` mapping), because\n * that is the only name the three creators agree on: the scaffold's users\n * collection spells the property `displayName` and the column `display_name`.\n */\nexport function authUsersColumnDefinition(column: string): string | undefined {\n    const spec = BY_COLUMN.get(column);\n    return spec ? authUsersColumnSql(spec) : undefined;\n}\n\n/**\n * Whether a collection is an auth collection, i.e. whether the definitions in\n * this module apply to its table at all.\n *\n * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:\n * that one takes a `CollectionConfig`, this one is called from DDL code paths\n * that hold looser objects, and both spellings must accept `auth: true` as well\n * as `auth: { enabled: true }`.\n */\nexport function isAuthCollection(collection: unknown): boolean {\n    const auth = (collection as { auth?: unknown } | undefined)?.auth;\n    if (auth === true) return true;\n    return typeof auth === \"object\" && auth !== null && (auth as { enabled?: unknown }).enabled === true;\n}\n"],"mappings":";;;;;;;;;;AA6EA,IAAa,qBAAiD;CAC1D;EAAE,QAAQ;EAAS,MAAM;EAAQ,SAAS;CAAK;CAC/C;EAAE,QAAQ;EAAgB,MAAM;CAAO;CACvC;EAAE,QAAQ;EAAa,MAAM;CAAO;CACpC;EAAE,QAAQ;EAAS,MAAM;EAAU,SAAS;EAAQ,SAAS;CAAK;CAClE;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAkB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC7E;EAAE,QAAQ;EAA4B,MAAM;CAAO;CACnD;EAAE,QAAQ;EAA8B,MAAM;CAA2B;CACzE;EAAE,QAAQ;EAAgB,MAAM;EAAW,SAAS;EAAS,SAAS;CAAK;CAC3E;EAAE,QAAQ;EAAY,MAAM;EAAS,SAAS;EAAQ,SAAS;CAAK;CACpE;EAAE,QAAQ;EAAsB,MAAM;CAA2B;CAEjE;EAAE,QAAQ;EAAe,MAAM;CAA2B;CAG1D;EAAE,QAAQ;EAAiB,MAAM;CAAO;CACxC;EAAE,QAAQ;EAAsB,MAAM;CAAO;CAC7C;EAAE,QAAQ;EAAwB,MAAM;CAA2B;CACnE;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;CAC1F;EAAE,QAAQ;EAAc,MAAM;EAA4B,SAAS;EAAS,SAAS;CAAK;AAC9F;AAEA,IAAM,YAAY,IAAI,IAAI,mBAAmB,KAAI,MAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;;AAGpE,SAAgB,mBAAmB,MAA+B;CAC9D,OAAO;EACH,KAAK;EACL,KAAK,YAAY,KAAA,IAAY,WAAW,KAAK,YAAY;EACzD,KAAK,UAAU,aAAa;CAChC,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;AAC9B;;;;;;;;;AAUA,SAAgB,0BAA0B,QAAoC;CAC1E,MAAM,OAAO,UAAU,IAAI,MAAM;CACjC,OAAO,OAAO,mBAAmB,IAAI,IAAI,KAAA;AAC7C;;;;;;;;;;AAWA,SAAgB,iBAAiB,YAA8B;CAC3D,MAAM,OAAQ,YAA+C;CAC7D,IAAI,SAAS,MAAM,OAAO;CAC1B,OAAO,OAAO,SAAS,YAAY,SAAS,QAAS,KAA+B,YAAY;AACpG"}

package/dist/backup/backup-cli.d.ts

@@ -4,6 +4,20 @@
  * backup surface stays self-contained.
  */
 import arg from "arg";
+import type { StorageController } from "@rebasepro/server";
+import { BackupDestination } from "./pg-tools.js";
+/**
+ * The controller for an object-storage destination, or `null` for a local one.
+ *
+ * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the
+ * Backups panel's routes use — so the CLI and the panel read a bucket the same
+ * way. This file had its own copy, and the two had already drifted once
+ * (`S3_FORCE_PATH_STYLE` read as `=== "true"`, so a MinIO backup addressed the
+ * bucket as a host).
+ *
+ * Exported for its test.
+ */
+export declare function resolveStorageForDestination(dest: BackupDestination, env: Record<string, string | undefined>): Promise<StorageController | null>;
 export declare function backupCommand(rawArgs: string[]): Promise<void>;
 /** Parse a `rebase db restore …` line; the first positional is the backup. */
 export declare function parseRestoreLine(rawArgs: string[]): arg.Result<{

package/dist/backup/backup-service.d.ts

@@ -1,4 +1,5 @@
 import type { StorageController } from "@rebasepro/server";
+import { resolvePgBinary } from "./pg-binary.js";
 import { BackupDestination, type RowSecurityIdentity, VersionCompatibility } from "./pg-tools.js";
 import { BackupObject, RetentionOptions } from "./retention.js";
 /**
@@ -11,8 +12,7 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
+export { resolvePgBinary };
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */

package/dist/backup/pg-binary.d.ts

@@ -0,0 +1,5 @@
+export type PgTool = "pg_dump" | "pg_restore" | "pg_dumpall";
+/** The variable that points at `tool` when it is not on the PATH. */
+export declare function pgToolVariable(tool: PgTool): string;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: PgTool, env?: Record<string, string | undefined>): string | null;

package/dist/{backup-cli-24v4OlSp.js → backup-cli-aUfRv16h.js}

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
-import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { D as parseBackupDestination, P as withDatabaseName, T as globalsFileForDump, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-HQ9GC4tN.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
+import { A as parseDbNameFromUrl, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, O as parseBackupDestination, f as restoreDump, i as createDump, l as listBackups, m as validateDump, n as applyGlobals, o as discardPartialDump, p as uploadBackup, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-BTBB7RXn.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { r as parseDriverLine } from "./cli-flags-BglvpjHv.js";
-import { parseEnvBoolean } from "@rebasepro/types";
-import fs from "fs";
+import { r as parseDriverLine } from "./cli-flags-B-Dawocl.js";
 import path from "path";
+import fs from "fs";
 import os from "os";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
 //#region src/backup/backup-cli.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
@@ -19,30 +19,38 @@ function formatBytes(bytes) {
 	if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
+/** A web stream's chunks, for piping into a file. */
+async function* webChunks(stream) {
+	const reader = stream.getReader();
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) return;
+			yield value;
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
-* Build a StorageController for an object-storage destination from the same
-* `S3_*` env vars the backend uses. Returns `null` for local destinations.
+* The controller for an object-storage destination, or `null` for a local one.
+*
+* Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the
+* Backups panel's routes use — so the CLI and the panel read a bucket the same
+* way. This file had its own copy, and the two had already drifted once
+* (`S3_FORCE_PATH_STYLE` read as `=== "true"`, so a MinIO backup addressed the
+* bucket as a host).
+*
+* Exported for its test.
 */
 async function resolveStorageForDestination(dest, env) {
 	if (dest.kind === "local") return null;
-	if (dest.kind === "gcs") {
-		const { GCSStorageController } = await import("@rebasepro/server");
-		return new GCSStorageController({
-			type: "gcs",
-			bucket: dest.bucket
-		});
+	const { backupStorageFromEnv } = await import("@rebasepro/server");
+	try {
+		return backupStorageFromEnv(dest, env);
+	} catch (error) {
+		throw new BackupToolError(error instanceof Error ? error.message : String(error), "Set the same S3_* variables your backend uses for storage.");
 	}
-	if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) throw new BackupToolError("S3 destination requires S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY in the environment.", "Set the same S3_* variables your backend uses for storage.");
-	const { S3StorageController } = await import("@rebasepro/server");
-	return new S3StorageController({
-		type: "s3",
-		bucket: dest.bucket,
-		region: env.S3_REGION || "auto",
-		accessKeyId: env.S3_ACCESS_KEY_ID,
-		secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-		endpoint: env.S3_ENDPOINT,
-		forcePathStyle: parseEnvBoolean(env.S3_FORCE_PATH_STYLE)
-	});
 }
 function requireConnection() {
 	const conn = resolveConnectionString(process.env);
@@ -196,12 +204,12 @@ async function restoreCommand(rawArgs) {
 			if (!storage) throw new BackupToolError("Could not resolve storage for the given URL.");
 			const key = backupArg.replace(/^(s3|gs):\/\/[^/]+\//, "");
 			const bucket = backupArg.replace(/^(s3|gs):\/\/([^/]+)\/.*$/, "$2");
-			const file = await storage.getObject(key, bucket);
-			if (!file) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);
 			const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "rebase-restore-"));
 			localFile = path.join(tmpDir, path.basename(key));
-			fs.writeFileSync(localFile, Buffer.from(await file.arrayBuffer()));
 			cleanupTemp = true;
+			const object = storage.getObjectStream ? await storage.getObjectStream(key, { bucket }) : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });
+			if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);
+			await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));
 			const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);
 			if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString("utf-8");
 		} else {
@@ -409,4 +417,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-24v4OlSp.js.map
+//# sourceMappingURL=backup-cli-aUfRv16h.js.map

package/dist/backup-cli-aUfRv16h.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-cli-aUfRv16h.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { parseDriverLine } from \"../cli-flags\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/** Parse a `rebase db restore …` line; the first positional is the backup. */\nexport function parseRestoreLine(rawArgs: string[]) {\n    return parseDriverLine(RESTORE_FLAGS, rawArgs);\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;AAGA,SAAgB,iBAAiB,SAAmB;CAChD,OAAO,gBAAgB,eAAe,OAAO;AACjD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}

package/dist/{backup-service-HQ9GC4tN.js → backup-service-BTBB7RXn.js}

@@ -1,9 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
-import { A as resolveLocalBin, F as forLibpq, P as execa } from "./rls-bootstrap-sql-B8EclDyM.js";
-import fs from "fs";
+import { F as resolveLocalBin } from "./cli-errors-CaI4ntyD.js";
+import { o as execa, s as forLibpq } from "./rls-bootstrap-sql-RQUljnJ1.js";
 import path from "path";
+import fs from "fs";
 import os from "os";
 //#region src/backup/pg-tools.ts
 /**
@@ -320,6 +321,29 @@ function selectBackupsToPrune(backups, options) {
 	return toDelete.map((b) => b.key);
 }
 //#endregion
+//#region src/backup/pg-binary.ts
+/**
+* Where the PostgreSQL client tools are, without spawning them.
+*
+* Kept apart from `backup-service.ts`, which pulls in `execa` (ESM-only), so
+* `createBackupCron` can check for the tools when it is registered.
+*/
+var OVERRIDE_VARIABLE = {
+	pg_dump: "PG_DUMP_PATH",
+	pg_restore: "PG_RESTORE_PATH",
+	pg_dumpall: "PG_DUMPALL_PATH"
+};
+/** The variable that points at `tool` when it is not on the PATH. */
+function pgToolVariable(tool) {
+	return OVERRIDE_VARIABLE[tool];
+}
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+function resolvePgBinary(tool, env = process.env) {
+	const override = env[OVERRIDE_VARIABLE[tool]];
+	if (override && fs.existsSync(override)) return override;
+	return resolveLocalBin(tool);
+}
+//#endregion
 //#region src/backup/backup-logic.ts
 /**
 * Pure-ish orchestration for the backup/restore paths, kept free of `execa`
@@ -438,12 +462,6 @@ var BackupToolError = class extends Error {
 		this.name = "BackupToolError";
 	}
 };
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-function resolvePgBinary(tool, env = process.env) {
-	const overrideVar = tool === "pg_dump" ? env.PG_DUMP_PATH : tool === "pg_restore" ? env.PG_RESTORE_PATH : env.PG_DUMPALL_PATH;
-	if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
-	return resolveLocalBin(tool);
-}
 /** Run `<bin> --version` and extract the major version. */
 async function detectToolMajor(bin) {
 	try {
@@ -655,8 +673,7 @@ async function ensureDatabaseExists(adminConnectionString, dbName) {
 async function uploadBackup(storage, localFile, dest) {
 	const fileName = path.basename(localFile);
 	const key = joinStorageKey(dest.prefix, fileName);
-	const buffer = fs.readFileSync(localFile);
-	const file = new File([buffer], fileName, { type: "application/octet-stream" });
+	const file = new File([await fs.openAsBlob(localFile)], fileName, { type: "application/octet-stream" });
 	return {
 		key,
 		storageUrl: (await storage.putObject({
@@ -664,35 +681,50 @@ async function uploadBackup(storage, localFile, dest) {
 			key,
 			bucket: dest.bucket,
 			metadata: { "rebase-backup": "1" }
-		})).storageUrl
+		}, { uploadLimits: false })).storageUrl
 	};
 }
+/** Stats in flight at once while listing a local backup folder. */
+var LOCAL_STAT_CONCURRENCY = 32;
+/** `fn` over `items`, at most `limit` at a time; results in input order. */
+async function mapBounded(items, limit, fn) {
+	const results = new Array(items.length);
+	let next = 0;
+	const worker = async () => {
+		while (next < items.length) {
+			const i = next++;
+			results[i] = await fn(items[i]);
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+	return results;
+}
 /**
 * List existing backups at a destination. For local destinations reads the
 * directory; for object storage lists the prefix via the controller.
 */
 async function listBackups(dest, storage) {
 	if (dest.kind === "local") {
-		if (!fs.existsSync(dest.path)) return [];
-		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
-		return fs.readdirSync(dir).filter((f) => f.endsWith(".dump")).map((f) => {
-			const full = path.join(dir, f);
-			const stats = fs.statSync(full);
+		const stat = await fs.promises.stat(dest.path).catch(() => null);
+		if (!stat) return [];
+		const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);
+		const dumps = (await fs.promises.readdir(dir)).filter((f) => f.endsWith(".dump"));
+		const stats = await mapBounded(dumps, LOCAL_STAT_CONCURRENCY, (f) => fs.promises.stat(path.join(dir, f)));
+		return dumps.map((f, i) => {
+			const createdAt = parseBackupTimestamp(f) ?? stats[i].mtime;
 			return {
-				key: full,
-				createdAt: parseBackupTimestamp(f) ?? stats.mtime,
-				sizeBytes: stats.size
+				key: path.join(dir, f),
+				createdAt,
+				sizeBytes: stats[i].size
 			};
 		}).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
 	}
 	if (!storage) throw new BackupToolError(`Listing ${dest.kind} backups requires a configured storage backend.`);
-	return (await storage.listObjects(dest.prefix ? `${dest.prefix}/` : "", {
-		bucket: dest.bucket,
-		maxResults: 1e3
-	})).items.map((item) => item.fullPath).filter((key) => key.endsWith(".dump")).map((key) => ({
-		key,
-		createdAt: parseBackupTimestamp(key) ?? void 0
-	})).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
+	const { listBackupObjects } = await import("@rebasepro/server");
+	return (await listBackupObjects(dest, storage)).map((info) => ({
+		key: info.key,
+		createdAt: info.createdAt ? new Date(info.createdAt) : void 0
+	}));
 }
 /**
 * Apply a retention policy to a destination, deleting the backups selected
@@ -710,6 +742,6 @@ async function pruneBackups(dest, options, storage) {
 	return toDelete;
 }
 //#endregion
-export { parsePgToolMajor as A, checkToolServerCompatibility as C, parseBackupDestination as D, joinStorageKey as E, serverVersionNumToMajor as M, splitGlobalsStatements as N, parseBackupTimestamp as O, withDatabaseName as P, buildRowSecurityPgOptions as S, globalsFileForDump as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, getServerVersionMajor as c, pruneBackups as d, resolvePgBinary as f, selectBackupsToPrune as g, validateDump as h, createDump as i, resolveConnectionString as j, parseDbNameFromUrl as k, listBackups as l, uploadBackup as m, applyGlobals as n, discardPartialDump as o, restoreDump as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildPgDumpArgs as v, diagnoseRowSecurityDumpFailure as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
+export { parseDbNameFromUrl as A, buildRowSecurityPgOptions as C, joinStorageKey as D, globalsFileForDump as E, withDatabaseName as F, resolveConnectionString as M, serverVersionNumToMajor as N, parseBackupDestination as O, splitGlobalsStatements as P, buildPgRestoreListArgs as S, diagnoseRowSecurityDumpFailure as T, selectBackupsToPrune as _, detectToolMajor as a, buildPgDumpallGlobalsArgs as b, getServerVersionMajor as c, pruneBackups as d, restoreDump as f, resolvePgBinary as g, pgToolVariable as h, createDump as i, parsePgToolMajor as j, parseBackupTimestamp as k, listBackups as l, validateDump as m, applyGlobals as n, discardPartialDump as o, uploadBackup as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildBackupFilename as v, checkToolServerCompatibility as w, buildPgRestoreArgs as x, buildPgDumpArgs as y };
 
-//# sourceMappingURL=backup-service-HQ9GC4tN.js.map
+//# sourceMappingURL=backup-service-BTBB7RXn.js.map