@rebasepro/server-postgres 0.24.1-canary.g56af4a4 → 0.24.1-canary.gcb918fc

package/README.md

@@ -50,6 +50,9 @@ Implements the Rebase `DatabaseAdapter` / `BackendBootstrapper` interfaces for P
 |--------|-------------|
 | `createPostgresAdapter(config)` | Creates a `DatabaseAdapter` for use with `initializeRebaseBackend({ database: ... })`. Recommended API. |
 | `createPostgresBootstrapper(config)` | Lower-level `BackendBootstrapper` factory. Used internally by the adapter. |
+| `openPostgresDriver(pgConfig, init)` | Opens the data driver from explicit settings, reading no environment variable; `provision: false` opens it with no DDL. What the adapter runs at boot. New in 0.25. |
+| `postgresDriverConfigFromEnv(config, env?)` | Reads `DATABASE_READ_URL`, `DATABASE_DIRECT_URL` and the `REALTIME_*` variables into a driver config, as the server's boot does. New in 0.25. |
+| `openRebase({ databaseUrl, collections })` | A project's data from a script, a test or a REPL: `dataAsAdmin`, `sql`, `withAuth(user)` and `close()`. No server, no DDL, no environment reads. `rebase console` is built on it. New in 0.25. |
 | `createPostgresDatabaseConnection(url, schema?, poolConfig?)` | Creates a production-grade pooled Drizzle connection. Returns `{ db, pool, connectionString }`. |
 | `createDirectDatabaseConnection(url, schema?, poolConfig?)` | Non-pooled connection for LISTEN/NOTIFY and advisory locks (bypasses PgBouncer). |
 | `createReadReplicaConnection(url, schema?, poolConfig?)` | Read-only connection for routing reads to replicas. |
@@ -98,6 +101,19 @@ process.on("SIGTERM", async () => {
 });
 ```
 
+## From a script
+
+```typescript
+import { openRebase } from "@rebasepro/server-postgres";
+
+const rebase = await openRebase({ databaseUrl: process.env.DATABASE_URL!, collections });
+const { data } = await rebase.dataAsAdmin.posts.find({ limit: 10 });
+const ada = await rebase.withAuth({ uid: "ada", roles: ["user"] });   // what Ada's RLS lets her see
+await rebase.close();
+```
+
+See [Scripts and the Console](https://rebase.pro/docs/backend/scripts).
+
 ## Connection Pool Defaults
 
 | Option | Default |

package/dist/PostgresBackendDriver.d.ts

@@ -110,6 +110,13 @@ export declare class PostgresBackendDriver implements DataDriver {
      * migrations, `dataAsAdmin`).
      */
     rlsUserRole?: string;
+    /**
+     * The direct (non-pooled) URL {@link listen} holds its `LISTEN` on — this
+     * source's, set by the bootstrapper. Never read from `DATABASE_DIRECT_URL`
+     * here: that variable is the default source's, and a second database
+     * listening on it hears none of its own notifications.
+     */
+    listenConnectionString?: string;
     /**
      * When true, realtime notifications are deferred until after the
      * wrapping transaction commits.  Set by `withAuth` → `withTransaction`.
@@ -132,11 +139,12 @@ export declare class PostgresBackendDriver implements DataDriver {
      * `SQLAdmin.listen`: a `LISTEN` on a connection of its own, through the
      * listener CDC and the channel bus use, which reconnects and heartbeats.
      *
-     * The connection is found the way the realtime listener finds its own:
-     * `DATABASE_DIRECT_URL` when set — a transaction-mode pooler such as
-     * PgBouncer does not keep a `LISTEN` — else the pool's own URL. The
-     * in-process development database has neither, and is refused, as is a
-     * first connect that fails: the caller polls instead.
+     * The connection is the one the realtime listener uses: this source's
+     * direct URL ({@link listenConnectionString}) when the bootstrapper
+     * resolved one — a transaction-mode pooler such as PgBouncer does not keep
+     * a `LISTEN` — else the pool's own URL. The in-process development
+     * database has neither, and is refused, as is a first connect that fails:
+     * the caller polls instead.
      */
     listen(channel: string, onNotify: (payload: string) => void, options?: {
         onReconnect?: () => void;

package/dist/PostgresBootstrapper.d.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { BackendBootstrapper, CollectionConfig, type RealtimeChannelsConfig } from "@rebasepro/types";
+import { BackendBootstrapper, CollectionConfig, InitializedDriver, type DatabaseAdapterInitConfig, type RealtimeChannelsConfig } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver.js";
 import { RealtimeService } from "./services/realtimeService.js";
 import { DatabasePoolManager } from "./databasePoolManager.js";
@@ -14,7 +14,27 @@ import { type UnknownFilterFieldsMode } from "./utils/drizzle-conditions.js";
 export interface PostgresDriverConfig {
     connectionString?: string;
     adminConnectionString?: string;
+    /**
+     * This database's read replica: reads are routed there, writes stay on
+     * the primary. Unset, the boot ({@link postgresDriverConfigFromEnv}) fills
+     * it from `DATABASE_READ_URL` for the default source only; any other
+     * source has none unless its config names one — the managed runtime
+     * resolves `DATABASE_READ_URL__<KEY>` into this for each source.
+     */
     readConnectionString?: string;
+    /**
+     * A direct (non-pooled) URL to this database, for the connections that
+     * hold a `LISTEN`: change capture, cross-instance realtime, the Postgres
+     * channel bus and `admin.listen`. A transaction-mode pooler such as
+     * PgBouncer does not keep a `LISTEN`, so behind one this has to name the
+     * database itself.
+     *
+     * Unset, the boot fills it from `DATABASE_DIRECT_URL` for the default
+     * source only, and any other source listens on its own
+     * `connectionString` — see {@link resolveSourceUrls}. The managed runtime
+     * resolves `DATABASE_DIRECT_URL__<KEY>` into this for each source.
+     */
+    directConnectionString?: string;
     connection?: unknown;
     /**
      * The project's generated Drizzle module, for **diagnostics only**.
@@ -37,13 +57,17 @@ export interface PostgresDriverConfig {
      */
     introspectionSchema?: string;
     /**
-     * Realtime options, both opt-in:
+     * Realtime options, among them:
      *
      *  - `channels` — retention. Without rules no channel keeps any history and
      *    broadcast stays fire-and-forget. See {@link ChannelRetentionRule}.
      *  - `bus` — the cross-instance transport for channel broadcast and
      *    presence. Defaults to in-process only, which is correct for a single
      *    instance and wrong for two. See {@link ChannelBusConfig}.
+     *  - `cdc` — how changes are captured (`auto` by default).
+     *
+     * At boot each has an environment variable that wins over it — see
+     * {@link postgresDriverConfigFromEnv}.
      */
     realtime?: RealtimeChannelsConfig;
     /**
@@ -65,6 +89,13 @@ export interface PostgresDriverInternals {
     realtimeService: RealtimeService;
     driver: PostgresBackendDriver;
     poolManager?: DatabasePoolManager;
+    /**
+     * Whether the driver was opened with provisioning (`provision`, default
+     * true). The hooks that run after it — auth, history, the final security
+     * posture — read it, so `provision: false` means no DDL anywhere on the
+     * driver's path, not only while it opens.
+     */
+    provisioned: boolean;
     /**
      * Attach CDC triggers to tables that did not exist when the driver
      * bootstrapped. Only set when database-level capture is actually active.
@@ -118,6 +149,27 @@ export declare function describeSchemaDriftCause(provisioning: {
     attempted: boolean;
     reason?: string;
 } | undefined): string[];
+/**
+ * The URLs one source's driver opens besides its pool: the read replica, and
+ * the direct connection its `LISTEN`s are held on.
+ *
+ * The bare `DATABASE_READ_URL` and `DATABASE_DIRECT_URL` belong to the default
+ * source. Both used to be read here for every source, so a second database
+ * (`database("analytics")`) held its change-capture `LISTEN` on the default
+ * database — where none of its notifications are sent, so its realtime feed
+ * was silent — and read through the default's replica. A keyed source gets
+ * the URLs its config names, and otherwise its own connection and no replica.
+ *
+ * The default source still falls back to the environment: an application that
+ * builds this adapter itself passes a `connectionString` and nothing else, and
+ * has always had those two variables honoured.
+ *
+ * Exported for its own test; the caller needs a live database.
+ */
+export declare function resolveSourceUrls(pgConfig: Pick<PostgresDriverConfig, "connectionString" | "readConnectionString" | "directConnectionString">, sourceKey: string, env?: Record<string, string | undefined>): {
+    readUrl?: string;
+    directUrl?: string;
+};
 /**
  * Is this the local database `rebase init` scaffolds — i.e. the one case where
  * "you are connected as a superuser" is not news?
@@ -144,4 +196,51 @@ export declare function describeSchemaDriftCause(provisioning: {
  * ships `NODE_ENV=development` and some deployments inherit it.
  */
 export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
+/**
+ * `config` with the environment read into it, the way the server's boot reads
+ * it. The one place this driver reads environment variables:
+ *
+ * | variable                               | setting                                |
+ * |----------------------------------------|----------------------------------------|
+ * | `DATABASE_READ_URL`                    | `readConnectionString`, when unset (*) |
+ * | `DATABASE_DIRECT_URL`                  | `directConnectionString`, when unset (*)|
+ * | `REALTIME_CDC`                         | `realtime.cdc`                         |
+ * | `REALTIME_CHANNEL_BUS`                 | `realtime.bus` (a named transport)     |
+ * | `REALTIME_MAX_SUBSCRIPTIONS_PER_SOCKET`| `realtime.maxSubscriptionsPerSocket`   |
+ * | `REALTIME_MAX_SOCKETS_PER_USER`        | `realtime.maxSocketsPerUser`           |
+ * | `REALTIME_REFETCH_MAX_WAIT_MS`         | `realtime.refetchMaxWaitMs`            |
+ * | `REALTIME_RECOUNT_INTERVAL_MS`         | `realtime.recountIntervalMs`           |
+ * | `REALTIME_RECOUNT_MIN_ROWS`            | `realtime.recountMinRows`              |
+ *
+ * A `REALTIME_*` variable that is set wins over the option, so a deployment
+ * can change it without a rebuild; the URLs fill in only what the config left
+ * empty. A mistyped number throws, naming the variable.
+ *
+ * (*) For the default source only. The bare URL variables name the default
+ * database; read for a second source (`database("analytics")`), they put its
+ * change-capture `LISTEN` on the default database, where none of its
+ * notifications arrive, and its reads on the default's replica. A keyed
+ * source's URLs come from its own config — the managed runtime passes
+ * `DATABASE_*_URL__<KEY>` there — see {@link resolveSourceUrls}.
+ *
+ * `createPostgresAdapter` applies this when the server boots, and
+ * {@link openPostgresDriver} does not — a script that opens the driver itself
+ * gets exactly the config it passed.
+ */
+export declare function postgresDriverConfigFromEnv(config: PostgresDriverConfig, env?: NodeJS.ProcessEnv, sourceKey?: string): PostgresDriverConfig;
+/**
+ * Open the Postgres data driver from explicit settings.
+ *
+ * What `createPostgresAdapter` runs when the server boots, once it has read
+ * the environment into `pgConfig` (see {@link postgresDriverConfigFromEnv});
+ * this function reads no environment variable itself. `config` says what the
+ * caller wants opened: which collections, whether opening may change the
+ * database (`provision`, default true), and what part this process takes in
+ * realtime (`realtime`, or `false` for none at all).
+ *
+ * `openRebase` is this with `provision: false` and `realtime: false`.
+ */
+export declare function openPostgresDriver(pgConfig: PostgresDriverConfig, config: DatabaseAdapterInitConfig): Promise<InitializedDriver & {
+    internals: PostgresDriverInternals;
+}>;
 export declare function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper;

package/dist/{backup-cli-aUfRv16h.js → backup-cli-DnpJi6I7.js}

@@ -4,7 +4,7 @@ import { a as __toESM, t as require___vite_browser_external } from "./__vite-bro
 import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
 import { A as parseDbNameFromUrl, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, O as parseBackupDestination, f as restoreDump, i as createDump, l as listBackups, m as validateDump, n as applyGlobals, o as discardPartialDump, p as uploadBackup, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-BTBB7RXn.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { r as parseDriverLine } from "./cli-flags-B-Dawocl.js";
+import { i as parseDriverLine } from "./cli-flags-JNI-pwSf.js";
 import path from "path";
 import fs from "fs";
 import os from "os";
@@ -417,4 +417,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-aUfRv16h.js.map
+//# sourceMappingURL=backup-cli-DnpJi6I7.js.map

package/dist/{backup-cli-aUfRv16h.js.map → backup-cli-DnpJi6I7.js.map}

@@ -1 +1 @@
-{"version":3,"file":"backup-cli-aUfRv16h.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { parseDriverLine } from \"../cli-flags\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/** Parse a `rebase db restore …` line; the first positional is the backup. */\nexport function parseRestoreLine(rawArgs: string[]) {\n    return parseDriverLine(RESTORE_FLAGS, rawArgs);\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;AAGA,SAAgB,iBAAiB,SAAmB;CAChD,OAAO,gBAAgB,eAAe,OAAO;AACjD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}
+{"version":3,"file":"backup-cli-DnpJi6I7.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { parseDriverLine } from \"../cli-flags\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/** Parse a `rebase db restore …` line; the first positional is the backup. */\nexport function parseRestoreLine(rawArgs: string[]) {\n    return parseDriverLine(RESTORE_FLAGS, rawArgs);\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;AAuCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;AAGA,SAAgB,iBAAiB,SAAmB;CAChD,OAAO,gBAAgB,eAAe,OAAO;AACjD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}

package/dist/cli-console-Ca6ZlAVU.js

@@ -0,0 +1,154 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
+import { l as poolMaxCeiling } from "./connection-C9mT8bgf.js";
+import { t as openRebase } from "./open-rebase-CbOur0TU.js";
+import { i as outError, n as describeFailure, r as out } from "./source-DBDbBTL4.js";
+import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { t as RELAYED_FLAGS } from "./cli-flags-JNI-pwSf.js";
+import path from "path";
+import fs from "fs";
+import { inspect } from "node:util";
+import repl from "node:repl";
+//#region src/cli-console.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
+/**
+* The flags `rebase console` takes. `--history` is the CLI's own: where it
+* keeps the REPL's history (`.rebase/console_history` in the project).
+*/
+var CONSOLE_FLAGS = {
+	"--collections": String,
+	"-c": "--collections",
+	"--eval": String,
+	"-e": "--eval",
+	"--history": String
+};
+/** The constructor of `async function` — what `new Function` is for a body that awaits. */
+var AsyncFunction = Object.getPrototypeOf(async () => void 0).constructor;
+/**
+* Run `code` with `rebase` and `collections` in scope and resolve with its
+* value.
+*
+* Read as an expression first, so `rebase.dataAsAdmin.posts.find()` is its own
+* result; code that is not one expression runs as a function body, where
+* `await` works everywhere and `return` gives the result.
+*/
+async function evaluateInConsole(code, scope) {
+	let run;
+	try {
+		run = new AsyncFunction("rebase", "collections", `return (${code}\n);`);
+	} catch (error) {
+		if (!(error instanceof SyntaxError)) throw error;
+		run = new AsyncFunction("rebase", "collections", code);
+	}
+	return run(scope.rebase, scope.collections);
+}
+/** A result as JSON, the way `--eval` prints it: dates as ISO strings, bigints as strings. */
+function consoleJson(value) {
+	return JSON.stringify(value, (_key, item) => typeof item === "bigint" ? item.toString() : item, 2) ?? "undefined";
+}
+/** The host and database a URL names, for the banner — never its credentials. */
+function describeDatabase(databaseUrl) {
+	try {
+		const url = new URL(databaseUrl);
+		return `${url.hostname}${url.port ? `:${url.port}` : ""}${url.pathname}`;
+	} catch {
+		return "the configured database";
+	}
+}
+/**
+* `rebase console [--eval <code>] [--collections <dir>]`, from the driver
+* line `["console", …flags]`. Resolves with the exit code.
+*/
+async function consoleCommand(args, streams = {}) {
+	const flags = (0, import_arg.default)({
+		...RELAYED_FLAGS,
+		...CONSOLE_FLAGS
+	}, { argv: args.slice(1) });
+	if (flags["--help"]) {
+		out("Run `rebase console --help` for the options — this is the driver's own entry point.");
+		return 0;
+	}
+	const databaseUrl = flags["--database-url"] || process.env.DATABASE_URL;
+	if (!databaseUrl) {
+		outError("✗ No database to open: DATABASE_URL is not set. Set it in .env, or pass --database-url.");
+		return 1;
+	}
+	if (process.env.LOG_LEVEL === void 0) process.env.LOG_LEVEL = "warn";
+	const collectionsPath = path.resolve(flags["--collections"] || path.join("..", "config", "collections"));
+	const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+	const collections = fs.existsSync(collectionsPath) ? await loadCollections(collectionsPath) : [];
+	const ceiling = poolMaxCeiling();
+	const rebase = await openRebase({
+		databaseUrl,
+		collections,
+		...ceiling !== null ? { pool: { max: ceiling } } : {}
+	});
+	try {
+		const code = flags["--eval"];
+		if (code !== void 0) try {
+			const result = await evaluateInConsole(code, {
+				rebase,
+				collections: rebase.collections
+			});
+			if (result !== void 0) out(consoleJson(result));
+			return 0;
+		} catch (error) {
+			outError(describeFailure(error));
+			return 1;
+		}
+		await startRepl({
+			rebase,
+			collections: rebase.collections
+		}, {
+			history: flags["--history"],
+			database: describeDatabase(databaseUrl),
+			...streams
+		});
+		return 0;
+	} finally {
+		await rebase.close();
+	}
+}
+/** The interactive half: a Node REPL until `.exit` or Ctrl-D. */
+async function startRepl(scope, options) {
+	out("");
+	out(`  rebase console — ${options.database}, ${scope.collections.length} collection(s)`);
+	out("  In scope: rebase (dataAsAdmin, sql, withAuth, close) and collections. Top-level await works.");
+	out("  Try: await rebase.dataAsAdmin.<collection>.find({ limit: 5 })");
+	out("");
+	const interactive = options.input === void 0;
+	const server = repl.start({
+		prompt: "",
+		useGlobal: false,
+		...options.input ? {
+			input: options.input,
+			terminal: false
+		} : {},
+		...options.output ? { output: options.output } : {},
+		writer: (value) => inspect(value, {
+			colors: interactive,
+			depth: 6
+		})
+	});
+	server.context.rebase = scope.rebase;
+	server.context.collections = scope.collections;
+	server.setPrompt("rebase> ");
+	const history = options.history;
+	if (history) {
+		fs.mkdirSync(path.dirname(history), { recursive: true });
+		await new Promise((resolve) => {
+			server.setupHistory(history, (error) => {
+				if (error) outError(`  (history is off: ${error.message})`);
+				resolve();
+			});
+		});
+	}
+	const exited = new Promise((resolve) => server.once("exit", () => resolve()));
+	server.displayPrompt();
+	await exited;
+}
+//#endregion
+export { consoleCommand };
+
+//# sourceMappingURL=cli-console-Ca6ZlAVU.js.map

package/dist/cli-console-Ca6ZlAVU.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-console-Ca6ZlAVU.js","names":[],"sources":["../src/cli-console.ts"],"sourcesContent":["/**\n * `rebase console` — the driver's half.\n *\n * Loads the project's collections the way `rebase db push` does, opens the\n * database with {@link openRebase}, and either evaluates one piece of code\n * (`--eval`) or starts a Node REPL with `rebase` and `collections` in scope.\n * The `rebase` CLI resolves the database first (the managed one included) and\n * hands this process `DATABASE_URL`, exactly as it does for `db` commands.\n *\n * This is the boot side of `openRebase`: it is where the environment is read\n * — `DATABASE_URL`, and the `REBASE_DB_POOL_MAX` ceiling the managed\n * development database needs — and turned into explicit options.\n */\nimport arg from \"arg\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport repl from \"node:repl\";\nimport { inspect } from \"node:util\";\nimport type { CollectionConfig } from \"@rebasepro/types\";\nimport { RELAYED_FLAGS } from \"./cli-flags\";\nimport { out, outError, describeFailure } from \"./cli-output\";\nimport { poolMaxCeiling } from \"./connection\";\nimport { openRebase, type OpenedRebase } from \"./open-rebase\";\n\n/**\n * The flags `rebase console` takes. `--history` is the CLI's own: where it\n * keeps the REPL's history (`.rebase/console_history` in the project).\n */\nexport const CONSOLE_FLAGS = {\n    \"--collections\": String,\n    \"-c\": \"--collections\",\n    \"--eval\": String,\n    \"-e\": \"--eval\",\n    \"--history\": String\n} satisfies arg.Spec;\n\n/** What the code the console runs can name. */\nexport interface ConsoleScope {\n    rebase: OpenedRebase;\n    collections: CollectionConfig[];\n}\n\ntype ScopedFunction = (rebase: OpenedRebase, collections: CollectionConfig[]) => Promise<unknown>;\ntype AsyncFunctionConstructor = new (...parameters: string[]) => ScopedFunction;\n\n/** The constructor of `async function` — what `new Function` is for a body that awaits. */\nconst AsyncFunction: AsyncFunctionConstructor = Object.getPrototypeOf(async () => undefined).constructor;\n\n/**\n * Run `code` with `rebase` and `collections` in scope and resolve with its\n * value.\n *\n * Read as an expression first, so `rebase.dataAsAdmin.posts.find()` is its own\n * result; code that is not one expression runs as a function body, where\n * `await` works everywhere and `return` gives the result.\n */\nexport async function evaluateInConsole(code: string, scope: ConsoleScope): Promise<unknown> {\n    let run: ScopedFunction;\n    try {\n        run = new AsyncFunction(\"rebase\", \"collections\", `return (${code}\\n);`);\n    } catch (error) {\n        if (!(error instanceof SyntaxError)) throw error;\n        run = new AsyncFunction(\"rebase\", \"collections\", code);\n    }\n    return run(scope.rebase, scope.collections);\n}\n\n/** A result as JSON, the way `--eval` prints it: dates as ISO strings, bigints as strings. */\nexport function consoleJson(value: unknown): string {\n    return JSON.stringify(value, (_key, item: unknown) => typeof item === \"bigint\" ? item.toString() : item, 2) ?? \"undefined\";\n}\n\n/** The host and database a URL names, for the banner — never its credentials. */\nfunction describeDatabase(databaseUrl: string): string {\n    try {\n        const url = new URL(databaseUrl);\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}${url.pathname}`;\n    } catch {\n        return \"the configured database\";\n    }\n}\n\n/** Where the REPL reads and writes; the terminal unless a caller hands it streams. */\nexport interface ConsoleStreams {\n    input?: NodeJS.ReadableStream;\n    output?: NodeJS.WritableStream;\n}\n\n/**\n * `rebase console [--eval <code>] [--collections <dir>]`, from the driver\n * line `[\"console\", …flags]`. Resolves with the exit code.\n */\nexport async function consoleCommand(args: string[], streams: ConsoleStreams = {}): Promise<number> {\n    const flags = arg({ ...RELAYED_FLAGS, ...CONSOLE_FLAGS }, { argv: args.slice(1) });\n    if (flags[\"--help\"]) {\n        out(\"Run `rebase console --help` for the options — this is the driver's own entry point.\");\n        return 0;\n    }\n\n    const databaseUrl = flags[\"--database-url\"] || process.env.DATABASE_URL;\n    if (!databaseUrl) {\n        outError(\"✗ No database to open: DATABASE_URL is not set. Set it in .env, or pass --database-url.\");\n        return 1;\n    }\n\n    // The console's own lines are what the reader is here for; the driver's\n    // info-level boot notes are not, unless they asked for them.\n    if (process.env.LOG_LEVEL === undefined) process.env.LOG_LEVEL = \"warn\";\n\n    const collectionsPath = path.resolve(flags[\"--collections\"] || path.join(\"..\", \"config\", \"collections\"));\n    const { loadCollections } = await import(\"./schema/doctor\");\n    const collections = fs.existsSync(collectionsPath) ? await loadCollections(collectionsPath) : [];\n\n    const ceiling = poolMaxCeiling();\n    const rebase = await openRebase({\n        databaseUrl,\n        collections,\n        ...(ceiling !== null ? { pool: { max: ceiling } } : {})\n    });\n\n    try {\n        const code = flags[\"--eval\"];\n        if (code !== undefined) {\n            try {\n                const result = await evaluateInConsole(code, { rebase, collections: rebase.collections });\n                if (result !== undefined) out(consoleJson(result));\n                return 0;\n            } catch (error) {\n                outError(describeFailure(error));\n                return 1;\n            }\n        }\n\n        await startRepl({ rebase, collections: rebase.collections }, {\n            history: flags[\"--history\"],\n            database: describeDatabase(databaseUrl),\n            ...streams\n        });\n        return 0;\n    } finally {\n        await rebase.close();\n    }\n}\n\n/** The interactive half: a Node REPL until `.exit` or Ctrl-D. */\nasync function startRepl(scope: ConsoleScope, options: { history?: string; database: string } & ConsoleStreams): Promise<void> {\n    out(\"\");\n    out(`  rebase console — ${options.database}, ${scope.collections.length} collection(s)`);\n    out(\"  In scope: rebase (dataAsAdmin, sql, withAuth, close) and collections. Top-level await works.\");\n    out(\"  Try: await rebase.dataAsAdmin.<collection>.find({ limit: 5 })\");\n    out(\"\");\n\n    const interactive = options.input === undefined;\n    // Started without a prompt, and given one once the scope is in place: a\n    // line that arrives with the first prompt must already see `rebase`.\n    const server = repl.start({\n        prompt: \"\",\n        useGlobal: false,\n        ...(options.input ? { input: options.input, terminal: false } : {}),\n        ...(options.output ? { output: options.output } : {}),\n        writer: (value: unknown) => inspect(value, { colors: interactive, depth: 6 })\n    });\n    server.context.rebase = scope.rebase;\n    server.context.collections = scope.collections;\n    server.setPrompt(\"rebase> \");\n\n    const history = options.history;\n    if (history) {\n        fs.mkdirSync(path.dirname(history), { recursive: true });\n        await new Promise<void>((resolve) => {\n            server.setupHistory(history, (error) => {\n                if (error) outError(`  (history is off: ${error.message})`);\n                resolve();\n            });\n        });\n    }\n\n    const exited = new Promise<void>((resolve) => server.once(\"exit\", () => resolve()));\n    server.displayPrompt();\n    await exited;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AA4BA,IAAa,gBAAgB;CACzB,iBAAiB;CACjB,MAAM;CACN,UAAU;CACV,MAAM;CACN,aAAa;AACjB;;AAYA,IAAM,gBAA0C,OAAO,eAAe,YAAY,KAAA,CAAS,CAAC,CAAC;;;;;;;;;AAU7F,eAAsB,kBAAkB,MAAc,OAAuC;CACzF,IAAI;CACJ,IAAI;EACA,MAAM,IAAI,cAAc,UAAU,eAAe,WAAW,KAAK,KAAK;CAC1E,SAAS,OAAO;EACZ,IAAI,EAAE,iBAAiB,cAAc,MAAM;EAC3C,MAAM,IAAI,cAAc,UAAU,eAAe,IAAI;CACzD;CACA,OAAO,IAAI,MAAM,QAAQ,MAAM,WAAW;AAC9C;;AAGA,SAAgB,YAAY,OAAwB;CAChD,OAAO,KAAK,UAAU,QAAQ,MAAM,SAAkB,OAAO,SAAS,WAAW,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK;AACnH;;AAGA,SAAS,iBAAiB,aAA6B;CACnD,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,WAAW;EAC/B,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,KAAK,IAAI;CAClE,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;AAYA,eAAsB,eAAe,MAAgB,UAA0B,CAAC,GAAoB;CAChG,MAAM,SAAA,GAAA,WAAA,QAAA,CAAY;EAAE,GAAG;EAAe,GAAG;CAAc,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CACjF,IAAI,MAAM,WAAW;EACjB,IAAI,qFAAqF;EACzF,OAAO;CACX;CAEA,MAAM,cAAc,MAAM,qBAAqB,QAAQ,IAAI;CAC3D,IAAI,CAAC,aAAa;EACd,SAAS,yFAAyF;EAClG,OAAO;CACX;CAIA,IAAI,QAAQ,IAAI,cAAc,KAAA,GAAW,QAAQ,IAAI,YAAY;CAEjE,MAAM,kBAAkB,KAAK,QAAQ,MAAM,oBAAoB,KAAK,KAAK,MAAM,UAAU,aAAa,CAAC;CACvG,MAAM,EAAE,oBAAoB,MAAM,OAAO,uBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACzC,MAAM,cAAc,GAAG,WAAW,eAAe,IAAI,MAAM,gBAAgB,eAAe,IAAI,CAAC;CAE/F,MAAM,UAAU,eAAe;CAC/B,MAAM,SAAS,MAAM,WAAW;EAC5B;EACA;EACA,GAAI,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAE,IAAI,CAAC;CACzD,CAAC;CAED,IAAI;EACA,MAAM,OAAO,MAAM;EACnB,IAAI,SAAS,KAAA,GACT,IAAI;GACA,MAAM,SAAS,MAAM,kBAAkB,MAAM;IAAE;IAAQ,aAAa,OAAO;GAAY,CAAC;GACxF,IAAI,WAAW,KAAA,GAAW,IAAI,YAAY,MAAM,CAAC;GACjD,OAAO;EACX,SAAS,OAAO;GACZ,SAAS,gBAAgB,KAAK,CAAC;GAC/B,OAAO;EACX;EAGJ,MAAM,UAAU;GAAE;GAAQ,aAAa,OAAO;EAAY,GAAG;GACzD,SAAS,MAAM;GACf,UAAU,iBAAiB,WAAW;GACtC,GAAG;EACP,CAAC;EACD,OAAO;CACX,UAAU;EACN,MAAM,OAAO,MAAM;CACvB;AACJ;;AAGA,eAAe,UAAU,OAAqB,SAAiF;CAC3H,IAAI,EAAE;CACN,IAAI,sBAAsB,QAAQ,SAAS,IAAI,MAAM,YAAY,OAAO,eAAe;CACvF,IAAI,gGAAgG;CACpG,IAAI,iEAAiE;CACrE,IAAI,EAAE;CAEN,MAAM,cAAc,QAAQ,UAAU,KAAA;CAGtC,MAAM,SAAS,KAAK,MAAM;EACtB,QAAQ;EACR,WAAW;EACX,GAAI,QAAQ,QAAQ;GAAE,OAAO,QAAQ;GAAO,UAAU;EAAM,IAAI,CAAC;EACjE,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;EACnD,SAAS,UAAmB,QAAQ,OAAO;GAAE,QAAQ;GAAa,OAAO;EAAE,CAAC;CAChF,CAAC;CACD,OAAO,QAAQ,SAAS,MAAM;CAC9B,OAAO,QAAQ,cAAc,MAAM;CACnC,OAAO,UAAU,UAAU;CAE3B,MAAM,UAAU,QAAQ;CACxB,IAAI,SAAS;EACT,GAAG,UAAU,KAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,IAAI,SAAe,YAAY;GACjC,OAAO,aAAa,UAAU,UAAU;IACpC,IAAI,OAAO,SAAS,sBAAsB,MAAM,QAAQ,EAAE;IAC1D,QAAQ;GACZ,CAAC;EACL,CAAC;CACL;CAEA,MAAM,SAAS,IAAI,SAAe,YAAY,OAAO,KAAK,cAAc,QAAQ,CAAC,CAAC;CAClF,OAAO,cAAc;CACrB,MAAM;AACV"}

package/dist/cli-console.d.ts

@@ -0,0 +1,39 @@
+import type { CollectionConfig } from "@rebasepro/types";
+import { type OpenedRebase } from "./open-rebase.js";
+/**
+ * The flags `rebase console` takes. `--history` is the CLI's own: where it
+ * keeps the REPL's history (`.rebase/console_history` in the project).
+ */
+export declare const CONSOLE_FLAGS: {
+    "--collections": StringConstructor;
+    "-c": string;
+    "--eval": StringConstructor;
+    "-e": string;
+    "--history": StringConstructor;
+};
+/** What the code the console runs can name. */
+export interface ConsoleScope {
+    rebase: OpenedRebase;
+    collections: CollectionConfig[];
+}
+/**
+ * Run `code` with `rebase` and `collections` in scope and resolve with its
+ * value.
+ *
+ * Read as an expression first, so `rebase.dataAsAdmin.posts.find()` is its own
+ * result; code that is not one expression runs as a function body, where
+ * `await` works everywhere and `return` gives the result.
+ */
+export declare function evaluateInConsole(code: string, scope: ConsoleScope): Promise<unknown>;
+/** A result as JSON, the way `--eval` prints it: dates as ISO strings, bigints as strings. */
+export declare function consoleJson(value: unknown): string;
+/** Where the REPL reads and writes; the terminal unless a caller hands it streams. */
+export interface ConsoleStreams {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+}
+/**
+ * `rebase console [--eval <code>] [--collections <dir>]`, from the driver
+ * line `["console", …flags]`. Resolves with the exit code.
+ */
+export declare function consoleCommand(args: string[], streams?: ConsoleStreams): Promise<number>;

package/dist/{cli-flags-B-Dawocl.js → cli-flags-JNI-pwSf.js}

@@ -136,6 +136,6 @@ function assertKnownFlags(domain, subcommand, args) {
 	}
 }
 //#endregion
-export { collectionsPathIn as n, parseDriverLine as r, assertKnownFlags as t };
+export { parseDriverLine as i, assertKnownFlags as n, collectionsPathIn as r, RELAYED_FLAGS as t };
 
-//# sourceMappingURL=cli-flags-B-Dawocl.js.map
+//# sourceMappingURL=cli-flags-JNI-pwSf.js.map