@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.g56af4a4

package/dist/{BranchService-BRt78gfa.js → BranchService-Bsn2wfaj.js}

@@ -1,7 +1,8 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
-import { d as extractPgError, u as extractCauseMessage } from "./cli-errors-DsA-K9uP.js";
+import { K as extractCauseMessage } from "./cli-errors-CaI4ntyD.js";
+import { n as extractPgError } from "./pg-error-utils-vJezlXdI.js";
 import { sql } from "drizzle-orm";
 import { revokeInternalTableSql } from "@rebasepro/common";
 //#region src/services/BranchService.ts
@@ -374,4 +375,4 @@ var BranchService = class {
 //#endregion
 export { BranchService_exports as n, BranchingUnsupportedError as r, BranchService as t };
 
-//# sourceMappingURL=BranchService-BRt78gfa.js.map
+//# sourceMappingURL=BranchService-Bsn2wfaj.js.map

package/dist/{BranchService-BRt78gfa.js.map → BranchService-Bsn2wfaj.js.map}

@@ -1 +1 @@
-{"version":3,"file":"BranchService-BRt78gfa.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n    const pgError = extractPgError(err);\n\n    if (pgError?.code === PG_DUPLICATE_DATABASE) {\n        return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n    }\n    if (pgError?.code === PG_OBJECT_IN_USE) {\n        return new Error(\n            `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n            \"Close other clients or connections and try again.\"\n        );\n    }\n\n    // Unknown failure: surface the real PG message rather than the Drizzle\n    // wrapper, which would otherwise show the raw SQL and no reason at all.\n    const detail = pgError?.message ?? extractCauseMessage(err);\n    if (detail) return new Error(detail);\n    return err instanceof Error ? err : new Error(String(err));\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n    /** Wire code, forwarded verbatim to the client. */\n    readonly code = \"BRANCHING_UNSUPPORTED\";\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"BranchingUnsupportedError\";\n    }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n    \"Branching does not work on the managed development database. It copies a database with \"\n    + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n    + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n    + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n    + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n    if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n        throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n    }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n    validateIdentifier(name, \"branch name\");\n    if (name.length > MAX_BRANCH_NAME_LENGTH) {\n        throw new Error(\n            `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n            \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n        );\n    }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n    assertValidBranchName(name);\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\n/**\n * Where a server's branches are kept: the main database — what a branch is\n * copied from unless told otherwise, and what may never be dropped — and the\n * connection whose `rebase.branches` records them.\n */\nexport interface BranchHome {\n    /** The main database's name. */\n    database(): Promise<string>;\n    /**\n     * A connection on the database the registry is in. Asked for at each use:\n     * a pool to the main database is closed before it is copied.\n     */\n    registry(): Promise<DrizzleClient>;\n}\n\nexport class BranchService {\n    private readonly home: BranchHome;\n\n    /**\n     * @param db    A connection on the server the branches are made on. Branch\n     *              DDL runs here.\n     * @param home  Where branches are kept. Without one, the database the\n     *              pool manager's connection string names, and `db`'s registry.\n     */\n    constructor(\n        private db: DrizzleClient,\n        private poolManager: DatabasePoolManager,\n        home?: BranchHome\n    ) {\n        this.home = home ?? {\n            database: async () => poolManager.defaultDatabaseName,\n            registry: async () => db\n        };\n    }\n\n    /**\n     * Refuse a branch mutation the connected server cannot honour.\n     *\n     * The check lives here rather than in the CLI's argv parsing because the\n     * CLI is not the only caller: Studio reaches `createBranch` over the\n     * websocket, and before this it got \"Branch created successfully\" and a\n     * detail pane promising isolation for a database that is the parent.\n     *\n     * Reads only, and only mutations are guarded: `listBranches` on a managed\n     * database is an honest empty list, and refusing it would turn the Branches\n     * pane into a failure with a \"Try again\" that can never succeed.\n     */\n    private async assertBranchingSupported(): Promise<void> {\n        if (await this.poolManager.servesOneDatabase()) {\n            throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n        }\n    }\n\n    /**\n     * Ensure the `rebase.branches` metadata table exists in the default database.\n     * Idempotent — safe to call on every startup.\n     */\n    async ensureBranchMetadataTable(): Promise<void> {\n        // Create the rebase schema (idempotent — may already exist from auth/history init)\n        const registry = await this.home.registry();\n        await registry.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        await registry.execute(sql.raw(`\n            CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n                name         TEXT PRIMARY KEY,\n                db_name      TEXT NOT NULL UNIQUE,\n                parent_db    TEXT NOT NULL,\n                created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n                metadata     JSONB DEFAULT '{}'\n            );\n        `));\n\n        // Not a collection, so no RLS — and it names every branch database on\n        // this server. The driver's schema-wide grant reaches it, so revoke.\n        await registry.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n    }\n\n    /**\n     * Create a new branch database by templating the source database.\n     *\n     * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n     * of both schema and data.\n     *\n     * @param name   User-facing branch name (e.g., \"feature_auth\")\n     * @param options.source  Source database to clone; defaults to the main database.\n     */\n    async createBranch(\n        name: string,\n        options?: { source?: string; force?: boolean }\n    ): Promise<BranchInfo> {\n        await this.assertBranchingSupported();\n\n        if (options?.source) {\n            validateIdentifier(options.source, \"source database name\");\n        }\n\n        const dbName = toBranchDbName(name);\n        const sourceDb = options?.source || await this.home.database();\n\n        // Check if branch already exists\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n        );\n        if ((existing.rows as unknown[]).length > 0) {\n            throw new Error(`Branch \"${name}\" already exists.`);\n        }\n\n        // Disconnect any idle pools to the source DB so TEMPLATE works.\n        // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n        //\n        // This only reaches pools inside *this* process. The CLI runs as its own\n        // process, so a `rebase dev` holding the database open is untouched by\n        // it — which is why the failure below has to name what is connected, and\n        // why `--force` exists.\n        await this.poolManager.disconnectDatabase(sourceDb);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(sourceDb);\n            if (closed > 0) {\n                // Postgres reports the backend as gone before its slot is\n                // actually free, and CREATE DATABASE then fails on a connection\n                // that no longer exists. One short settle beats a confusing retry.\n                await new Promise((resolve) => setTimeout(resolve, 250));\n            }\n        }\n\n        // Create the database using the source as a template.\n        // Note: Identifiers must be double-quoted, not parameterized.\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(\n                sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`)\n            );\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                // The template — not the new database — is the one still in use.\n                throw new Error(\n                    `Cannot create branch: the source database \"${sourceDb}\" has active connections.\\n`\n                    + await this.describeBlockingConnections(sourceDb)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Record metadata in the registry — asked for again, as copying the\n        // main database closed any pool on it.\n        const now = new Date();\n        await (await this.home.registry()).execute(\n            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)\n                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`\n        );\n\n        return {\n            name,\n            database: dbName,\n            parentDatabase: sourceDb,\n            createdAt: now\n        };\n    }\n\n    /**\n     * Delete a branch database and remove its metadata.\n     * Cannot delete the main/default database.\n     */\n    async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n        await this.assertBranchingSupported();\n\n        assertValidBranchName(name);\n\n        // Safety, first pass: a request that would target the default database\n        // is refused before any metadata is read, so the answer costs nothing\n        // and cannot depend on what a row happens to say.\n        const mainDatabase = await this.home.database();\n        if (toBranchDbName(name) === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Verify the branch exists, and take the database name from the row\n        // rather than deriving it again. A branch created before names stopped\n        // being stripped is recorded as `rb_myfeature` while `my-feature` now\n        // derives `rb_my-feature`; re-deriving would drop a database this row\n        // never named — or, if that name happened to exist, somebody else's.\n        // The stored value is the only one that is true by construction.\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n        );\n        const existingRows = existing.rows as Record<string, unknown>[];\n        if (existingRows.length === 0) {\n            throw new Error(`Branch \"${name}\" not found.`);\n        }\n        const dbName = existingRows[0].db_name as string;\n\n        // Safety, second pass: the first checked a name we derived, this checks\n        // the one we are about to drop. They differ for any row written under\n        // the old scheme, and it is this one that governs.\n        if (dbName === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Disconnect any pools to this branch before dropping. Same limit as\n        // `createBranch`: in-process pools only.\n        await this.poolManager.disconnectDatabase(dbName);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(dbName);\n            if (closed > 0) await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n\n        // Drop the database\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                throw new Error(\n                    `Cannot delete branch \"${name}\": the database has active connections.\\n`\n                    + await this.describeBlockingConnections(dbName)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Remove metadata\n        await (await this.home.registry()).execute(\n            sql`DELETE FROM rebase.branches WHERE name = ${name}`\n        );\n    }\n\n    /**\n     * Who is holding the database open, in words a developer can act on.\n     *\n     * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n     * other session is connected, and the one thing the old message could not\n     * say is the only thing worth knowing: *which* session. \"Close other\n     * clients or connections and try again\" is advice you cannot follow when\n     * you do not know there is a `rebase dev` in another terminal — and that is\n     * the common case, because wanting a branch and running the app are the\n     * same moment.\n     *\n     * `application_name` is the useful column: node-postgres sends none by\n     * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n     * and psql all name themselves. Counting by it separates \"my own dev\n     * server\" from \"the GUI I forgot about\" without any guessing.\n     *\n     * Best-effort by construction: this runs while reporting a failure, and a\n     * diagnostic that throws would replace a real error with its own.\n     */\n    private async describeBlockingConnections(dbName: string): Promise<string> {\n        try {\n            const result = await this.db.execute(sql`\n                SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n                       count(*)::int AS n\n                  FROM pg_stat_activity\n                 WHERE datname = ${dbName}\n                   AND pid <> pg_backend_pid()\n                 GROUP BY 1\n                 ORDER BY 2 DESC, 1\n            `);\n            const rows = result.rows as Record<string, unknown>[];\n            if (rows.length === 0) {\n                // The blocker went away between the failure and this query, or\n                // it is a session Postgres does not attribute to this database.\n                return \"  Retry — whatever was connected has since disconnected.\";\n            }\n\n            const listed = rows\n                .map((row) => `    ${row.n} × ${String(row.app)}`)\n                .join(\"\\n\");\n\n            return `  Connected right now:\\n${listed}\\n`\n                + \"  A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n                + \"  disconnect them for you.\";\n        } catch {\n            return \"  Close other clients and connections, or re-run with --force.\";\n        }\n    }\n\n    /**\n     * Disconnect every other session on a database, and say how many.\n     *\n     * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n     * query leaves the session connected, and a connected session is exactly\n     * what blocks the operation.\n     *\n     * The current backend is excluded — terminating the connection running this\n     * statement would abort the command that asked for it.\n     */\n    private async terminateConnections(dbName: string): Promise<number> {\n        const result = await this.db.execute(sql`\n            SELECT pg_terminate_backend(pid)\n              FROM pg_stat_activity\n             WHERE datname = ${dbName}\n               AND pid <> pg_backend_pid()\n        `);\n\n        return (result.rows as unknown[]).length;\n    }\n\n    /**\n     * Everything prune needs to decide, in two queries.\n     *\n     * Reads the rows and the server's database list rather than joining them,\n     * so the *disagreements* between the two are visible — a row whose database\n     * is gone and a database with no row are the two things prune exists to\n     * find, and a join hides both.\n     */\n    async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n        const rowResult = await (await this.home.registry()).execute(sql.raw(`\n            SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n        `));\n        const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            dbName: row.db_name as string,\n            createdAt: new Date(row.created_at as string)\n        }));\n\n        const dbResult = await this.db.execute(sql`\n            SELECT datname FROM pg_database WHERE NOT datistemplate\n        `);\n        const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n        return { rows, databases };\n    }\n\n    /** Remove a metadata row whose database is already gone. */\n    async forgetBranchRow(name: string): Promise<void> {\n        await (await this.home.registry()).execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n    }\n\n    /**\n     * Drop a database by name, with no metadata row required.\n     *\n     * `deleteBranch` deliberately takes its database name from the row, because\n     * the row is the only value that is true by construction. Prune has the\n     * opposite job — the cases it handles are exactly the ones where row and\n     * database disagree — so it needs to name a database directly. Guarded the\n     * same way regardless: the main database is never droppable.\n     */\n    async dropDatabase(dbName: string): Promise<void> {\n        validateIdentifier(dbName, \"database name\");\n        if (dbName === await this.home.database()) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        await this.poolManager.disconnectDatabase(dbName);\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n        } catch (err) {\n            throw describeBranchDdlError(err, dbName);\n        }\n    }\n\n    /**\n     * List all branches recorded in the metadata table.\n     * Optionally fetches database sizes from pg_database.\n     */\n    async listBranches(): Promise<BranchInfo[]> {\n        const result = await (await this.home.registry()).execute(sql.raw(`\n            SELECT \n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at,\n                pg_database_size(b.db_name) as size_bytes\n            FROM ${BRANCHES_TABLE} b\n            JOIN pg_database d ON d.datname = b.db_name\n            ORDER BY b.created_at DESC\n        `));\n\n        return (result.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n        }));\n    }\n\n    /**\n     * Get info about a specific branch.\n     */\n    async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n        assertValidBranchName(name);\n\n        const result = await (await this.home.registry()).execute(sql`\n            SELECT\n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at\n            FROM rebase.branches b\n            WHERE b.name = ${name}\n        `);\n\n        const rows = result.rows as Record<string, unknown>[];\n        if (rows.length === 0) return undefined;\n\n        const row = rows[0];\n\n        // Attempt to get size — may fail if the DB was externally dropped.\n        // Same reason as `deleteBranch`: the size of a re-derived name is the\n        // size of some other database, or of nothing.\n        let sizeBytes: number | undefined;\n        try {\n            const dbName = row.db_name as string;\n            const sizeResult = await this.db.execute(\n                sql`SELECT pg_database_size(${dbName}) as size_bytes`\n            );\n            const sizeRows = sizeResult.rows as Record<string, unknown>[];\n            if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n                sizeBytes = Number(sizeRows[0].size_bytes);\n            }\n        } catch {\n            // Database might not exist anymore\n        }\n\n        return {\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;;;;;;;;;AAUzB,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAiBA,IAAa,gBAAb,MAA2B;CAUX;CACA;CAVZ;;;;;;;CAQA,YACI,IACA,aACA,MACF;EAHU,KAAA,KAAA;EACA,KAAA,cAAA;EAGR,KAAK,OAAO,QAAQ;GAChB,UAAU,YAAY,YAAY;GAClC,UAAU,YAAY;EAC1B;CACJ;;;;;;;;;;;;;CAcA,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,WAAW,MAAM,KAAK,KAAK,SAAS;EAC1C,MAAM,SAAS,QAAQ,GAAG,oCAAoC;EAE9D,MAAM,SAAS,QAAQ,IAAI,IAAI;yCACE,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,SAAS,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAChF;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,MAAM,KAAK,KAAK,SAAS;EAM7D,KAAK,OAHmB,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,EAAA,CACc,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAElD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,QAAQ,IAC1C,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAM/D,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QACV,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CACxE;EACJ,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,+BACrD,MAAM,KAAK,4BAA4B,QAAQ,CACrD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAIA,MAAM,sBAAM,IAAI,KAAK;EACrB,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,EACrE;EAEA,OAAO;GACH;GACA,UAAU;GACV,gBAAgB;GAChB,WAAW;EACf;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,MAAM,eAAe,MAAM,KAAK,KAAK,SAAS;EAC9C,IAAI,eAAe,IAAI,MAAM,cACzB,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,OAHG,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,cACX,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAEhD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAI3E,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,6CAC5B,MAAM,KAAK,4BAA4B,MAAM,CACnD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAiC;EACvE,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GAOX,OAAO,2BAJQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAEwB,EAAO;;EAG7C,QAAQ;GACJ,OAAO;EACX;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,OAHW,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;oDACzB,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG,4CAA4C,MAAM;CACpG;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,MAAM,KAAK,KAAK,SAAS,GACpC,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAaxC,QAAQ,OAZc,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;;;;;;;mBAOvD,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAY1B,MAAM,QAAO,OAVS,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG;;;;;;;6BAOxC,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;EACJ;CACJ;AACJ"}
+{"version":3,"file":"BranchService-Bsn2wfaj.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n    const pgError = extractPgError(err);\n\n    if (pgError?.code === PG_DUPLICATE_DATABASE) {\n        return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n    }\n    if (pgError?.code === PG_OBJECT_IN_USE) {\n        return new Error(\n            `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n            \"Close other clients or connections and try again.\"\n        );\n    }\n\n    // Unknown failure: surface the real PG message rather than the Drizzle\n    // wrapper, which would otherwise show the raw SQL and no reason at all.\n    const detail = pgError?.message ?? extractCauseMessage(err);\n    if (detail) return new Error(detail);\n    return err instanceof Error ? err : new Error(String(err));\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n    /** Wire code, forwarded verbatim to the client. */\n    readonly code = \"BRANCHING_UNSUPPORTED\";\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"BranchingUnsupportedError\";\n    }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n    \"Branching does not work on the managed development database. It copies a database with \"\n    + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n    + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n    + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n    + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n    if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n        throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n    }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n    validateIdentifier(name, \"branch name\");\n    if (name.length > MAX_BRANCH_NAME_LENGTH) {\n        throw new Error(\n            `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n            \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n        );\n    }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n    assertValidBranchName(name);\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\n/**\n * Where a server's branches are kept: the main database — what a branch is\n * copied from unless told otherwise, and what may never be dropped — and the\n * connection whose `rebase.branches` records them.\n */\nexport interface BranchHome {\n    /** The main database's name. */\n    database(): Promise<string>;\n    /**\n     * A connection on the database the registry is in. Asked for at each use:\n     * a pool to the main database is closed before it is copied.\n     */\n    registry(): Promise<DrizzleClient>;\n}\n\nexport class BranchService {\n    private readonly home: BranchHome;\n\n    /**\n     * @param db    A connection on the server the branches are made on. Branch\n     *              DDL runs here.\n     * @param home  Where branches are kept. Without one, the database the\n     *              pool manager's connection string names, and `db`'s registry.\n     */\n    constructor(\n        private db: DrizzleClient,\n        private poolManager: DatabasePoolManager,\n        home?: BranchHome\n    ) {\n        this.home = home ?? {\n            database: async () => poolManager.defaultDatabaseName,\n            registry: async () => db\n        };\n    }\n\n    /**\n     * Refuse a branch mutation the connected server cannot honour.\n     *\n     * The check lives here rather than in the CLI's argv parsing because the\n     * CLI is not the only caller: Studio reaches `createBranch` over the\n     * websocket, and before this it got \"Branch created successfully\" and a\n     * detail pane promising isolation for a database that is the parent.\n     *\n     * Reads only, and only mutations are guarded: `listBranches` on a managed\n     * database is an honest empty list, and refusing it would turn the Branches\n     * pane into a failure with a \"Try again\" that can never succeed.\n     */\n    private async assertBranchingSupported(): Promise<void> {\n        if (await this.poolManager.servesOneDatabase()) {\n            throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n        }\n    }\n\n    /**\n     * Ensure the `rebase.branches` metadata table exists in the default database.\n     * Idempotent — safe to call on every startup.\n     */\n    async ensureBranchMetadataTable(): Promise<void> {\n        // Create the rebase schema (idempotent — may already exist from auth/history init)\n        const registry = await this.home.registry();\n        await registry.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        await registry.execute(sql.raw(`\n            CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n                name         TEXT PRIMARY KEY,\n                db_name      TEXT NOT NULL UNIQUE,\n                parent_db    TEXT NOT NULL,\n                created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n                metadata     JSONB DEFAULT '{}'\n            );\n        `));\n\n        // Not a collection, so no RLS — and it names every branch database on\n        // this server. The driver's schema-wide grant reaches it, so revoke.\n        await registry.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n    }\n\n    /**\n     * Create a new branch database by templating the source database.\n     *\n     * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n     * of both schema and data.\n     *\n     * @param name   User-facing branch name (e.g., \"feature_auth\")\n     * @param options.source  Source database to clone; defaults to the main database.\n     */\n    async createBranch(\n        name: string,\n        options?: { source?: string; force?: boolean }\n    ): Promise<BranchInfo> {\n        await this.assertBranchingSupported();\n\n        if (options?.source) {\n            validateIdentifier(options.source, \"source database name\");\n        }\n\n        const dbName = toBranchDbName(name);\n        const sourceDb = options?.source || await this.home.database();\n\n        // Check if branch already exists\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n        );\n        if ((existing.rows as unknown[]).length > 0) {\n            throw new Error(`Branch \"${name}\" already exists.`);\n        }\n\n        // Disconnect any idle pools to the source DB so TEMPLATE works.\n        // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n        //\n        // This only reaches pools inside *this* process. The CLI runs as its own\n        // process, so a `rebase dev` holding the database open is untouched by\n        // it — which is why the failure below has to name what is connected, and\n        // why `--force` exists.\n        await this.poolManager.disconnectDatabase(sourceDb);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(sourceDb);\n            if (closed > 0) {\n                // Postgres reports the backend as gone before its slot is\n                // actually free, and CREATE DATABASE then fails on a connection\n                // that no longer exists. One short settle beats a confusing retry.\n                await new Promise((resolve) => setTimeout(resolve, 250));\n            }\n        }\n\n        // Create the database using the source as a template.\n        // Note: Identifiers must be double-quoted, not parameterized.\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(\n                sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`)\n            );\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                // The template — not the new database — is the one still in use.\n                throw new Error(\n                    `Cannot create branch: the source database \"${sourceDb}\" has active connections.\\n`\n                    + await this.describeBlockingConnections(sourceDb)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Record metadata in the registry — asked for again, as copying the\n        // main database closed any pool on it.\n        const now = new Date();\n        await (await this.home.registry()).execute(\n            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)\n                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`\n        );\n\n        return {\n            name,\n            database: dbName,\n            parentDatabase: sourceDb,\n            createdAt: now\n        };\n    }\n\n    /**\n     * Delete a branch database and remove its metadata.\n     * Cannot delete the main/default database.\n     */\n    async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n        await this.assertBranchingSupported();\n\n        assertValidBranchName(name);\n\n        // Safety, first pass: a request that would target the default database\n        // is refused before any metadata is read, so the answer costs nothing\n        // and cannot depend on what a row happens to say.\n        const mainDatabase = await this.home.database();\n        if (toBranchDbName(name) === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Verify the branch exists, and take the database name from the row\n        // rather than deriving it again. A branch created before names stopped\n        // being stripped is recorded as `rb_myfeature` while `my-feature` now\n        // derives `rb_my-feature`; re-deriving would drop a database this row\n        // never named — or, if that name happened to exist, somebody else's.\n        // The stored value is the only one that is true by construction.\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n        );\n        const existingRows = existing.rows as Record<string, unknown>[];\n        if (existingRows.length === 0) {\n            throw new Error(`Branch \"${name}\" not found.`);\n        }\n        const dbName = existingRows[0].db_name as string;\n\n        // Safety, second pass: the first checked a name we derived, this checks\n        // the one we are about to drop. They differ for any row written under\n        // the old scheme, and it is this one that governs.\n        if (dbName === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Disconnect any pools to this branch before dropping. Same limit as\n        // `createBranch`: in-process pools only.\n        await this.poolManager.disconnectDatabase(dbName);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(dbName);\n            if (closed > 0) await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n\n        // Drop the database\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                throw new Error(\n                    `Cannot delete branch \"${name}\": the database has active connections.\\n`\n                    + await this.describeBlockingConnections(dbName)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Remove metadata\n        await (await this.home.registry()).execute(\n            sql`DELETE FROM rebase.branches WHERE name = ${name}`\n        );\n    }\n\n    /**\n     * Who is holding the database open, in words a developer can act on.\n     *\n     * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n     * other session is connected, and the one thing the old message could not\n     * say is the only thing worth knowing: *which* session. \"Close other\n     * clients or connections and try again\" is advice you cannot follow when\n     * you do not know there is a `rebase dev` in another terminal — and that is\n     * the common case, because wanting a branch and running the app are the\n     * same moment.\n     *\n     * `application_name` is the useful column: node-postgres sends none by\n     * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n     * and psql all name themselves. Counting by it separates \"my own dev\n     * server\" from \"the GUI I forgot about\" without any guessing.\n     *\n     * Best-effort by construction: this runs while reporting a failure, and a\n     * diagnostic that throws would replace a real error with its own.\n     */\n    private async describeBlockingConnections(dbName: string): Promise<string> {\n        try {\n            const result = await this.db.execute(sql`\n                SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n                       count(*)::int AS n\n                  FROM pg_stat_activity\n                 WHERE datname = ${dbName}\n                   AND pid <> pg_backend_pid()\n                 GROUP BY 1\n                 ORDER BY 2 DESC, 1\n            `);\n            const rows = result.rows as Record<string, unknown>[];\n            if (rows.length === 0) {\n                // The blocker went away between the failure and this query, or\n                // it is a session Postgres does not attribute to this database.\n                return \"  Retry — whatever was connected has since disconnected.\";\n            }\n\n            const listed = rows\n                .map((row) => `    ${row.n} × ${String(row.app)}`)\n                .join(\"\\n\");\n\n            return `  Connected right now:\\n${listed}\\n`\n                + \"  A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n                + \"  disconnect them for you.\";\n        } catch {\n            return \"  Close other clients and connections, or re-run with --force.\";\n        }\n    }\n\n    /**\n     * Disconnect every other session on a database, and say how many.\n     *\n     * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n     * query leaves the session connected, and a connected session is exactly\n     * what blocks the operation.\n     *\n     * The current backend is excluded — terminating the connection running this\n     * statement would abort the command that asked for it.\n     */\n    private async terminateConnections(dbName: string): Promise<number> {\n        const result = await this.db.execute(sql`\n            SELECT pg_terminate_backend(pid)\n              FROM pg_stat_activity\n             WHERE datname = ${dbName}\n               AND pid <> pg_backend_pid()\n        `);\n\n        return (result.rows as unknown[]).length;\n    }\n\n    /**\n     * Everything prune needs to decide, in two queries.\n     *\n     * Reads the rows and the server's database list rather than joining them,\n     * so the *disagreements* between the two are visible — a row whose database\n     * is gone and a database with no row are the two things prune exists to\n     * find, and a join hides both.\n     */\n    async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n        const rowResult = await (await this.home.registry()).execute(sql.raw(`\n            SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n        `));\n        const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            dbName: row.db_name as string,\n            createdAt: new Date(row.created_at as string)\n        }));\n\n        const dbResult = await this.db.execute(sql`\n            SELECT datname FROM pg_database WHERE NOT datistemplate\n        `);\n        const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n        return { rows, databases };\n    }\n\n    /** Remove a metadata row whose database is already gone. */\n    async forgetBranchRow(name: string): Promise<void> {\n        await (await this.home.registry()).execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n    }\n\n    /**\n     * Drop a database by name, with no metadata row required.\n     *\n     * `deleteBranch` deliberately takes its database name from the row, because\n     * the row is the only value that is true by construction. Prune has the\n     * opposite job — the cases it handles are exactly the ones where row and\n     * database disagree — so it needs to name a database directly. Guarded the\n     * same way regardless: the main database is never droppable.\n     */\n    async dropDatabase(dbName: string): Promise<void> {\n        validateIdentifier(dbName, \"database name\");\n        if (dbName === await this.home.database()) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        await this.poolManager.disconnectDatabase(dbName);\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n        } catch (err) {\n            throw describeBranchDdlError(err, dbName);\n        }\n    }\n\n    /**\n     * List all branches recorded in the metadata table.\n     * Optionally fetches database sizes from pg_database.\n     */\n    async listBranches(): Promise<BranchInfo[]> {\n        const result = await (await this.home.registry()).execute(sql.raw(`\n            SELECT \n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at,\n                pg_database_size(b.db_name) as size_bytes\n            FROM ${BRANCHES_TABLE} b\n            JOIN pg_database d ON d.datname = b.db_name\n            ORDER BY b.created_at DESC\n        `));\n\n        return (result.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n        }));\n    }\n\n    /**\n     * Get info about a specific branch.\n     */\n    async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n        assertValidBranchName(name);\n\n        const result = await (await this.home.registry()).execute(sql`\n            SELECT\n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at\n            FROM rebase.branches b\n            WHERE b.name = ${name}\n        `);\n\n        const rows = result.rows as Record<string, unknown>[];\n        if (rows.length === 0) return undefined;\n\n        const row = rows[0];\n\n        // Attempt to get size — may fail if the DB was externally dropped.\n        // Same reason as `deleteBranch`: the size of a re-derived name is the\n        // size of some other database, or of nothing.\n        let sizeBytes: number | undefined;\n        try {\n            const dbName = row.db_name as string;\n            const sizeResult = await this.db.execute(\n                sql`SELECT pg_database_size(${dbName}) as size_bytes`\n            );\n            const sizeRows = sizeResult.rows as Record<string, unknown>[];\n            if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n                sizeBytes = Number(sizeRows[0].size_bytes);\n            }\n        } catch {\n            // Database might not exist anymore\n        }\n\n        return {\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;;;;;;;;;AAUzB,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAiBA,IAAa,gBAAb,MAA2B;CAUX;CACA;CAVZ;;;;;;;CAQA,YACI,IACA,aACA,MACF;EAHU,KAAA,KAAA;EACA,KAAA,cAAA;EAGR,KAAK,OAAO,QAAQ;GAChB,UAAU,YAAY,YAAY;GAClC,UAAU,YAAY;EAC1B;CACJ;;;;;;;;;;;;;CAcA,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,WAAW,MAAM,KAAK,KAAK,SAAS;EAC1C,MAAM,SAAS,QAAQ,GAAG,oCAAoC;EAE9D,MAAM,SAAS,QAAQ,IAAI,IAAI;yCACE,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,SAAS,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAChF;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,MAAM,KAAK,KAAK,SAAS;EAM7D,KAAK,OAHmB,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,EAAA,CACc,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAElD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,QAAQ,IAC1C,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAM/D,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QACV,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CACxE;EACJ,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,+BACrD,MAAM,KAAK,4BAA4B,QAAQ,CACrD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAIA,MAAM,sBAAM,IAAI,KAAK;EACrB,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,EACrE;EAEA,OAAO;GACH;GACA,UAAU;GACV,gBAAgB;GAChB,WAAW;EACf;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,MAAM,eAAe,MAAM,KAAK,KAAK,SAAS;EAC9C,IAAI,eAAe,IAAI,MAAM,cACzB,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,OAHG,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,cACX,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAEhD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAI3E,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,6CAC5B,MAAM,KAAK,4BAA4B,MAAM,CACnD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAiC;EACvE,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GAOX,OAAO,2BAJQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAEwB,EAAO;;EAG7C,QAAQ;GACJ,OAAO;EACX;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,OAHW,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;oDACzB,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG,4CAA4C,MAAM;CACpG;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,MAAM,KAAK,KAAK,SAAS,GACpC,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAaxC,QAAQ,OAZc,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;;;;;;;mBAOvD,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAY1B,MAAM,QAAO,OAVS,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG;;;;;;;6BAOxC,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;EACJ;CACJ;AACJ"}

package/dist/PostgresBackendDriver.d.ts

@@ -3,7 +3,7 @@ import { BranchService } from "./services/BranchService.js";
 import { RealtimeService, type SubscriptionAuthContext } from "./services/realtimeService.js";
 import { DatabasePoolManager } from "./databasePoolManager.js";
 import { DrizzleClient } from "./interfaces.js";
-import { DatabaseAdmin, SQLAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseCallContext, RebaseServerClient, RebaseSdkData, RestFetchService, BatchWriteProps, SaveManyProps, SaveProps, SqlScriptResult, UpdateManyProps, UpdateRelationPivotProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
+import { DatabaseAdmin, SQLAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseCallContext, RebaseServerClient, RebaseSdkData, RestFetchService, BatchWriteProps, SaveManyProps, SaveProps, SqlCursor, SqlScriptResult, UpdateManyProps, UpdateRelationPivotProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry.js";
 import { HistoryService } from "./history/HistoryService.js";
 /**
@@ -72,6 +72,8 @@ export declare class PostgresBackendDriver implements DataDriver {
     poolManager?: DatabasePoolManager | undefined;
     key: string;
     initialised: boolean;
+    /** `save` and `delete` read the row they address and run a caller's precondition on it. */
+    readonly checksRowPreconditions = true;
     dataService: DataService;
     realtimeService: RealtimeService;
     historyService?: HistoryService;
@@ -126,6 +128,19 @@ export declare class PostgresBackendDriver implements DataDriver {
      * allowing test spies applied after construction to take effect.
      */
     get admin(): DatabaseAdmin;
+    /**
+     * `SQLAdmin.listen`: a `LISTEN` on a connection of its own, through the
+     * listener CDC and the channel bus use, which reconnects and heartbeats.
+     *
+     * The connection is found the way the realtime listener finds its own:
+     * `DATABASE_DIRECT_URL` when set — a transaction-mode pooler such as
+     * PgBouncer does not keep a `LISTEN` — else the pool's own URL. The
+     * in-process development database has neither, and is refused, as is a
+     * first connect that fails: the caller polls instead.
+     */
+    listen(channel: string, onNotify: (payload: string) => void, options?: {
+        onReconnect?: () => void;
+    }): Promise<() => Promise<void>>;
     /**
      * The catalogue-reading shim the schema planner wants.
      *
@@ -190,6 +205,13 @@ export declare class PostgresBackendDriver implements DataDriver {
      * collection's afterRead (so `post.author.email` is masked by the authors
      * collection, not left raw).
      */
+    /**
+     * One stored row as `restFetchService.fetchOneForRest` serves it: through
+     * `afterRead`, on a copy, so the row the write itself goes on with (its
+     * previous values, its history) stays the stored one. A precondition
+     * compares against what the caller was served — an `ETag` is a hash of that.
+     */
+    private asRestServes;
     applyAfterReadForRest(rows: Record<string, unknown>[], path: string): Promise<Record<string, unknown>[]>;
     fetchCollection<M extends Record<string, unknown>>({ path, collection, startAfter, ...query }: FetchCollectionProps<M>): Promise<Record<string, unknown>[]>;
     /**
@@ -208,7 +230,7 @@ export declare class PostgresBackendDriver implements DataDriver {
      * `null` when it is not there — deleted, never created, or not readable by
      * the subscriber. Reads as {@link listenCollection} does.
      */
-    listenOne<M extends Record<string, unknown>>({ path, id, onUpdate, onError }: ListenOneProps<M>, authContext?: SubscriptionAuthContext | undefined): () => void;
+    listenOne<M extends Record<string, unknown>>({ path, id, include, onUpdate, onError }: ListenOneProps<M>, authContext?: SubscriptionAuthContext | undefined): () => void;
     /**
      * How many membership rows a single write will read to answer "which
      * tenants is this caller in".
@@ -293,6 +315,17 @@ export declare class PostgresBackendDriver implements DataDriver {
      * Rows are applied in order, so a batch that touches the same key twice ends
      * with the last write winning, exactly as separate calls would.
      */
+    /**
+     * Run a batch in one transaction of its own, on a driver bound to it, and
+     * tell realtime subscribers about its rows only once it has committed.
+     *
+     * Inside a request's transaction the events already wait for that one to
+     * commit, and the batch adds to its list. On the server's own driver they
+     * did not wait at all: each row was announced as it was written, before
+     * the COMMIT — a subscriber's refetch found nothing yet, and a batch that
+     * then rolled back had announced rows that never existed.
+     */
+    private inBatchTransaction;
     private bindToTransaction;
     /**
      * The callback context for work already running inside `tx` on behalf of
@@ -357,6 +390,21 @@ export declare class PostgresBackendDriver implements DataDriver {
     batchWrite<M extends Record<string, unknown>>({ operations }: BatchWriteProps<M>): Promise<(Record<string, unknown> | null)[]>;
     delete<M extends Record<string, unknown>>(props: DeleteProps<M>): Promise<void>;
     private deleteInFrame;
+    /**
+     * The child lists a save rewrote through the parent, as notifications —
+     * when nothing else will announce them.
+     *
+     * `save("posts", "p-1", { tags: [...] })` rewrites the junction, and
+     * `{ comments: [...] }` on a `hasMany` re-points the children's foreign
+     * keys: either way the contents of `posts/p-1/<relation>` changed, and the
+     * row notification names the parent, whose paths land on `posts`. Under
+     * change capture the junction's or the children's own triggers announce
+     * it. Without capture these did not reach anyone: a live list of a post's
+     * tags kept the old set. Addressed to every row of the list, which also
+     * reaches the target collection's own lists — a `hasMany` changed those
+     * rows' foreign keys.
+     */
+    private childListNotifications;
     deleteAll(path: string): Promise<void>;
     updateRelationPivot({ path, targetId, pivot }: UpdateRelationPivotProps): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;
@@ -388,6 +436,7 @@ export declare class PostgresBackendDriver implements DataDriver {
         role?: string;
         params?: unknown[];
         isolateSession?: boolean;
+        maxResultBytes?: number;
     }): Promise<Record<string, unknown>[]>;
     /**
      * Run a script a person wrote — the Studio console — and describe its
@@ -396,7 +445,19 @@ export declare class PostgresBackendDriver implements DataDriver {
     runSqlScript(sqlText: string, options?: {
         database?: string;
         role?: string;
+        signal?: AbortSignal;
     }): Promise<SqlScriptResult>;
+    /**
+     * Read the whole result of one query a person wrote, a batch at a time —
+     * see `SQLAdmin.openSqlCursor` and `openSqlCursorOnPool`. The database's
+     * refusal of the query (a write, a second statement, a syntax error, a
+     * role it may not take) is the caller's to read, as on the socket.
+     */
+    openSqlCursor(sqlText: string, options?: {
+        database?: string;
+        role?: string;
+        batchSize?: number;
+    }): Promise<SqlCursor>;
     /**
      * `SET ROLE` for the rest of a session of a script's own — not `SET LOCAL`
      * inside a transaction, which a `COMMIT` in the script ends, and every
@@ -426,6 +487,10 @@ export declare class PostgresBackendDriver implements DataDriver {
      * `onOwnSession`. `fn` is then handed no role: there is nothing left to
      * switch. A handle that is already one session (PGlite in process, a
      * single client) is reset in place, and `fn` switches the role itself.
+     *
+     * With `maxResultBytes`, a result past it is refused — see
+     * `readWithinBudget`: on a pool the read stops there, in process the rows
+     * are measured once read.
      */
     private onIsolatedSession;
     private executeSqlOn;
@@ -472,6 +537,8 @@ export declare class AuthenticatedPostgresBackendDriver implements DataDriver {
     delegate: PostgresBackendDriver;
     key: string;
     initialised: boolean;
+    /** Its delegate's, run inside this caller's transaction. */
+    readonly checksRowPreconditions = true;
     user: User;
     data: RebaseSdkData;
     constructor(delegate: PostgresBackendDriver, user: User);
@@ -480,6 +547,20 @@ export declare class AuthenticatedPostgresBackendDriver implements DataDriver {
      */
     admin: DatabaseAdmin;
     get restFetchService(): RestFetchService;
+    /**
+     * Several reads in one read-only transaction — see
+     * {@link DataDriver.readTogether}. The same transaction every read on this
+     * driver opens for itself, with the same identity, role and field viewer;
+     * `work` is handed the transaction's driver, whose reads run on it directly
+     * instead of each opening another.
+     *
+     * `REPEATABLE READ`, because the point of reading together is reading one
+     * snapshot: under the default `READ COMMITTED` each statement takes its
+     * own, and a count could still describe a different set from the page
+     * beside it. A read-only transaction cannot fail serialization at this
+     * level, so it costs nothing.
+     */
+    readTogether<T>(work: (driver: DataDriver) => Promise<T>): Promise<T>;
     private withTransaction;
     fetchCollection<M extends Record<string, unknown>>(props: FetchCollectionProps<M>): Promise<Record<string, unknown>[]>;
     /**

package/dist/auth/ensure-tables.d.ts

@@ -1,5 +1,17 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { CollectionConfig } from "@rebasepro/types";
+/**
+ * One statement that drops each named index — but only one that covers a
+ * single column that a valid, unique, non-partial btree on the same table also
+ * leads with. That is the UNIQUE (token_hash) constraint's index, which serves
+ * every `token_hash = $1` lookup; a table that somehow lacks it keeps its
+ * plain index, so no lookup is ever left without one.
+ *
+ * `DROP INDEX` takes the table's ACCESS EXCLUSIVE lock, on the tables every
+ * sign-in and token refresh touches, so it runs under the boot lock budget
+ * (`lock_timeout`, transaction-local to this statement — see `boot-ddl`).
+ */
+export declare function dropDuplicateTokenHashIndexesSql(schema: string, names: readonly string[]): string;
 /**
  * Auto-create auth tables if they don't exist.
  *

package/dist/auth/services.d.ts

@@ -84,6 +84,11 @@ export declare class UserService implements UserRepository {
     updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
+    /**
+     * @see UserRepository.firstUserIds — an unordered `LIMIT` read of the
+     * primary key, not `listUsersPaginated`'s count and sort of every row.
+     */
+    firstUserIds(limit: number): Promise<string[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
     /**
      * Update user's password hash; `null` removes the password.
@@ -338,6 +343,7 @@ export declare class PostgresAuthRepository implements AuthRepository {
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;
+    firstUserIds(limit: number): Promise<string[]>;
     updatePassword(id: string, passwordHash: string | null): Promise<void>;
     setEmailVerified(id: string, verified: boolean): Promise<void>;
     setVerificationToken(id: string, token: string | null): Promise<void>;

package/dist/backup/backup-cli.d.ts

@@ -4,6 +4,20 @@
  * backup surface stays self-contained.
  */
 import arg from "arg";
+import type { StorageController } from "@rebasepro/server";
+import { BackupDestination } from "./pg-tools.js";
+/**
+ * The controller for an object-storage destination, or `null` for a local one.
+ *
+ * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the
+ * Backups panel's routes use — so the CLI and the panel read a bucket the same
+ * way. This file had its own copy, and the two had already drifted once
+ * (`S3_FORCE_PATH_STYLE` read as `=== "true"`, so a MinIO backup addressed the
+ * bucket as a host).
+ *
+ * Exported for its test.
+ */
+export declare function resolveStorageForDestination(dest: BackupDestination, env: Record<string, string | undefined>): Promise<StorageController | null>;
 export declare function backupCommand(rawArgs: string[]): Promise<void>;
 /** Parse a `rebase db restore …` line; the first positional is the backup. */
 export declare function parseRestoreLine(rawArgs: string[]): arg.Result<{

package/dist/backup/backup-service.d.ts

@@ -1,4 +1,5 @@
 import type { StorageController } from "@rebasepro/server";
+import { resolvePgBinary } from "./pg-binary.js";
 import { BackupDestination, type RowSecurityIdentity, VersionCompatibility } from "./pg-tools.js";
 import { BackupObject, RetentionOptions } from "./retention.js";
 /**
@@ -11,8 +12,7 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
+export { resolvePgBinary };
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */

package/dist/backup/pg-binary.d.ts

@@ -0,0 +1,5 @@
+export type PgTool = "pg_dump" | "pg_restore" | "pg_dumpall";
+/** The variable that points at `tool` when it is not on the PATH. */
+export declare function pgToolVariable(tool: PgTool): string;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: PgTool, env?: Record<string, string | undefined>): string | null;

package/dist/{backup-cli-DW5p9_zv.js → backup-cli-aUfRv16h.js}

@@ -1,15 +1,15 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
-import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { D as parseBackupDestination, P as withDatabaseName, T as globalsFileForDump, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-EwcDVG-8.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
+import { A as parseDbNameFromUrl, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, O as parseBackupDestination, f as restoreDump, i as createDump, l as listBackups, m as validateDump, n as applyGlobals, o as discardPartialDump, p as uploadBackup, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-BTBB7RXn.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { r as parseDriverLine } from "./cli-flags-BglvpjHv.js";
-import { parseEnvBoolean } from "@rebasepro/types";
-import fs from "fs";
+import { r as parseDriverLine } from "./cli-flags-B-Dawocl.js";
 import path from "path";
+import fs from "fs";
 import os from "os";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
 //#region src/backup/backup-cli.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
@@ -19,30 +19,38 @@ function formatBytes(bytes) {
 	if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
 	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
 }
+/** A web stream's chunks, for piping into a file. */
+async function* webChunks(stream) {
+	const reader = stream.getReader();
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) return;
+			yield value;
+		}
+	} finally {
+		reader.releaseLock();
+	}
+}
 /**
-* Build a StorageController for an object-storage destination from the same
-* `S3_*` env vars the backend uses. Returns `null` for local destinations.
+* The controller for an object-storage destination, or `null` for a local one.
+*
+* Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the
+* Backups panel's routes use — so the CLI and the panel read a bucket the same
+* way. This file had its own copy, and the two had already drifted once
+* (`S3_FORCE_PATH_STYLE` read as `=== "true"`, so a MinIO backup addressed the
+* bucket as a host).
+*
+* Exported for its test.
 */
 async function resolveStorageForDestination(dest, env) {
 	if (dest.kind === "local") return null;
-	if (dest.kind === "gcs") {
-		const { GCSStorageController } = await import("@rebasepro/server");
-		return new GCSStorageController({
-			type: "gcs",
-			bucket: dest.bucket
-		});
+	const { backupStorageFromEnv } = await import("@rebasepro/server");
+	try {
+		return backupStorageFromEnv(dest, env);
+	} catch (error) {
+		throw new BackupToolError(error instanceof Error ? error.message : String(error), "Set the same S3_* variables your backend uses for storage.");
 	}
-	if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) throw new BackupToolError("S3 destination requires S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY in the environment.", "Set the same S3_* variables your backend uses for storage.");
-	const { S3StorageController } = await import("@rebasepro/server");
-	return new S3StorageController({
-		type: "s3",
-		bucket: dest.bucket,
-		region: env.S3_REGION || "auto",
-		accessKeyId: env.S3_ACCESS_KEY_ID,
-		secretAccessKey: env.S3_SECRET_ACCESS_KEY,
-		endpoint: env.S3_ENDPOINT,
-		forcePathStyle: parseEnvBoolean(env.S3_FORCE_PATH_STYLE)
-	});
 }
 function requireConnection() {
 	const conn = resolveConnectionString(process.env);
@@ -196,12 +204,12 @@ async function restoreCommand(rawArgs) {
 			if (!storage) throw new BackupToolError("Could not resolve storage for the given URL.");
 			const key = backupArg.replace(/^(s3|gs):\/\/[^/]+\//, "");
 			const bucket = backupArg.replace(/^(s3|gs):\/\/([^/]+)\/.*$/, "$2");
-			const file = await storage.getObject(key, bucket);
-			if (!file) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);
 			const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "rebase-restore-"));
 			localFile = path.join(tmpDir, path.basename(key));
-			fs.writeFileSync(localFile, Buffer.from(await file.arrayBuffer()));
 			cleanupTemp = true;
+			const object = storage.getObjectStream ? await storage.getObjectStream(key, { bucket }) : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });
+			if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);
+			await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));
 			const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);
 			if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString("utf-8");
 		} else {
@@ -409,4 +417,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-DW5p9_zv.js.map
+//# sourceMappingURL=backup-cli-aUfRv16h.js.map

package/dist/backup-cli-aUfRv16h.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-cli-aUfRv16h.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { parseDriverLine } from \"../cli-flags\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/** Parse a `rebase db restore …` line; the first positional is the backup. */\nexport function parseRestoreLine(rawArgs: string[]) {\n    return parseDriverLine(RESTORE_FLAGS, rawArgs);\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;AAGA,SAAgB,iBAAiB,SAAmB;CAChD,OAAO,gBAAgB,eAAe,OAAO;AACjD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}