@rebasepro/server-postgres 0.24.1-canary.gcb918fc → 0.25.0-canary.ge06257e

package/dist/{backup-cli-DnpJi6I7.js → backup-cli-HCEkPcQj.js}

@@ -1,18 +1,16 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
-import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
-import { A as parseDbNameFromUrl, E as globalsFileForDump, F as withDatabaseName, M as resolveConnectionString, O as parseBackupDestination, f as restoreDump, i as createDump, l as listBackups, m as validateDump, n as applyGlobals, o as discardPartialDump, p as uploadBackup, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-BTBB7RXn.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { i as parseDriverLine } from "./cli-flags-JNI-pwSf.js";
+import { $ as redactConnectionPasswords, t as checkDatabaseConnectivity } from "./cli-errors-mx4sSjB8.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DB6xJv3p.js";
+import { A as parseBackupDestination, F as resolveConnectionString, M as parseDbNameFromUrl, O as globalsFileForDump, R as withDatabaseName, c as findRestoreConflicts, d as preflight, g as validateDump, h as uploadBackup, i as createDump, m as restoreDump, n as applyGlobals, o as discardPartialDump, p as readDumpObjects, s as ensureDatabaseExists, t as BackupToolError, u as listBackups } from "./backup-service-D-UpT7DH.js";
+import { t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
+import { a as parseCommandFlags, r as closestWord } from "./cli-flags-DUozBFyK.js";
 import path from "path";
 import fs from "fs";
 import os from "os";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 //#region src/backup/backup-cli.ts
-var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
-var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
 function formatBytes(bytes) {
 	if (bytes < 1024) return `${bytes} B`;
 	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -52,6 +50,53 @@ async function resolveStorageForDestination(dest, env) {
 		throw new BackupToolError(error instanceof Error ? error.message : String(error), "Set the same S3_* variables your backend uses for storage.");
 	}
 }
+/**
+* The directory `rebase` was run from, which `rebase` puts here for the driver.
+*
+* The driver runs in the project's `backend/`, so a relative path resolved
+* against its own working directory named a different place from the one the
+* user typed it in: `rebase db backup --out ./backups` wrote to `<root>/backups`
+* (the CLI resolves explicit paths itself) while `rebase db backups list`
+* looked in `<root>/backend/backups`. Spelled the same in
+* `packages/cli/src/commands/db.ts`.
+*/
+var INVOCATION_CWD_ENV = "REBASE_INVOCATION_CWD";
+/** Where a relative path the user typed is relative to: where they ran `rebase`. */
+function invocationDir(env = process.env) {
+	const dir = env[INVOCATION_CWD_ENV]?.trim();
+	return dir && path.isAbsolute(dir) ? dir : process.cwd();
+}
+/**
+* Where `db backup` writes and `db backups list` reads, by one rule.
+*
+* - `--out` is relative to where `rebase` was run, like any path typed on a
+*   command line.
+* - `BACKUP_DESTINATION` is relative to the backend directory, because the
+*   server reads the same variable there: the Backups panel and the scheduled
+*   backup have to find what the CLI wrote.
+* - With neither, `./backups` where `rebase` was run, as the help says.
+*
+* An `s3://` or `gs://` destination is returned as given.
+*/
+function resolveBackupLocation(opts) {
+	const flag = opts.flag?.trim();
+	if (flag) return isRemoteDestination(flag) ? flag : path.resolve(opts.invocationDir, flag);
+	const configured = opts.configured?.trim();
+	if (configured) return isRemoteDestination(configured) ? configured : path.resolve(opts.backendDir, configured);
+	return path.join(opts.invocationDir, "backups");
+}
+function isRemoteDestination(value) {
+	return parseBackupDestination(value).kind !== "local";
+}
+/** {@link resolveBackupLocation} for this process. */
+function backupLocation(flag) {
+	return resolveBackupLocation({
+		flag,
+		configured: process.env.BACKUP_DESTINATION,
+		invocationDir: invocationDir(),
+		backendDir: process.cwd()
+	});
+}
 function requireConnection() {
 	const conn = resolveConnectionString(process.env);
 	if (!conn) {
@@ -60,45 +105,43 @@ function requireConnection() {
 	}
 	return conn;
 }
-async function promptConfirm(question) {
-	if (!process.stdin.isTTY) return false;
-	const rl = import___vite_browser_external.default.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await new Promise((resolve) => rl.question(question, resolve));
-		return /^y(es)?$/i.test(answer.trim());
-	} finally {
-		rl.close();
-	}
+var BACKUP_FLAGS = {
+	"--out": String,
+	"--output": "--out",
+	"--exclude-schema": [String],
+	"--no-owner": Boolean,
+	"--enable-row-security": Boolean,
+	"--row-security-role": String,
+	"-o": "--out"
+};
+/**
+* Parse a `rebase db backup …` line. An undeclared flag is refused (see
+* `parseCommandFlags`), and so is a positional: `rebase db backup ./backups`
+* means `--out ./backups`, and taken as nothing it wrote to the default
+* directory.
+*/
+function parseBackupLine(rawArgs) {
+	const args = parseCommandFlags(BACKUP_FLAGS, rawArgs.slice(2), "db backup");
+	const [stray] = args._;
+	if (stray !== void 0) throw new Error(`\`rebase db backup\` takes no argument "${stray}". Nothing was run. To choose where the backup goes, pass --out ${stray}.`);
+	return args;
 }
 async function backupCommand(rawArgs) {
-	const args = (0, import_arg.default)({
-		"--out": String,
-		"--output": "--out",
-		"--exclude-schema": [String],
-		"--no-owner": Boolean,
-		"--enable-row-security": Boolean,
-		"--row-security-role": String,
-		"-o": "--out"
-	}, {
-		argv: rawArgs.slice(2),
-		permissive: true
-	});
-	if (args._.includes("--help") || rawArgs.includes("--help")) {
+	if (rawArgs.includes("--help")) {
 		printBackupHelp();
 		return;
 	}
+	const args = parseBackupLine(rawArgs);
 	const connectionString = requireConnection();
 	const dbName = parseDbNameFromUrl(connectionString) ?? "database";
-	const out$1 = args["--out"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), "backups");
+	const out$1 = backupLocation(args["--out"]);
 	const dest = parseBackupDestination(out$1);
 	out("");
 	out(chalk.bold("  💾 Rebase DB Backup"));
 	out(chalk.gray(`  Database:    ${dbName}`));
 	out(chalk.gray(`  Destination: ${out$1}`));
 	out("");
+	await checkDatabaseConnectivity(connectionString);
 	const pf = await preflight("pg_dump", connectionString);
 	if (!pf.compatible) {
 		outError(chalk.red(`  ✗ ${pf.reason}`));
@@ -175,17 +218,64 @@ var RESTORE_FLAGS = {
 	"--yes": Boolean,
 	"-y": "--yes"
 };
-/** Parse a `rebase db restore …` line; the first positional is the backup. */
+/**
+* Parse a `rebase db restore …` line; the one positional is the backup.
+*
+* Strict, because this is the command where a typo costs most: parsed
+* permissively, `--targt-db x` became a second positional, the target fell
+* back to DATABASE_URL's own database, and the restore ran against the live
+* one.
+*/
 function parseRestoreLine(rawArgs) {
-	return parseDriverLine(RESTORE_FLAGS, rawArgs);
+	const args = parseCommandFlags(RESTORE_FLAGS, rawArgs.slice(2), "db restore");
+	if (args._.length > 1) throw new Error(`\`rebase db restore\` restores one backup, and was given ${args._.length}: ${args._.map((word) => `"${word}"`).join(", ")}. Nothing was run.`);
+	return args;
+}
+/**
+* The restore's one question, asked before anything can change.
+*
+* `--yes` skips it. On a terminal it asks for a typed 'yes'. With no terminal
+* nobody can answer, and the refusal says to pass `--yes`, as `db reset`,
+* `db pull` and `db branch prune` do: "Aborted. No changes were made." alone
+* read as though someone had answered no.
+*
+* @returns whether to go on. When not, it has said why.
+*/
+async function confirmRestore(opts) {
+	if (opts.yes) return true;
+	outWarn(chalk.yellow(`  ⚠️  This will restore into "${opts.target}" and may overwrite existing data.`));
+	if (!opts.interactive) {
+		outError(chalk.red("  ✗ Nothing was restored: there is no terminal to confirm on."));
+		outError(chalk.gray(`    Re-run with --yes to restore into "${opts.target}".`));
+		return false;
+	}
+	const confirmed = await opts.ask(chalk.yellow("     Type 'yes' to continue: "));
+	if (!confirmed) out(chalk.gray("  Aborted. No changes were made."));
+	return confirmed;
+}
+/** How many of the conflicting objects a refusal names before counting the rest. */
+var CONFLICTS_NAMED = 5;
+/**
+* What `db restore` says when the target already holds what the backup
+* creates, and the two ways round it: `--clean` replaces them with the
+* backup's copy, a new database restores beside them.
+*/
+function describeRestoreConflict(target, backupArg, conflicts) {
+	return {
+		message: `"${target}" already holds ${conflicts.slice(0, CONFLICTS_NAMED).join(", ")}${conflicts.length > CONFLICTS_NAMED ? `, and ${conflicts.length - CONFLICTS_NAMED} more` : ""}, which this backup creates. Without --clean, pg_restore stops at the first of them. Nothing was restored or changed.`,
+		hint: [`To replace them with the backup's copy:  rebase db restore ${backupArg} --clean`, `To restore beside them, in a new database:  rebase db restore ${backupArg} --create-db --target-db <new name>`].join("\n    ")
+	};
 }
 async function restoreCommand(rawArgs) {
+	if (rawArgs.includes("--help")) {
+		printRestoreHelp();
+		return;
+	}
 	const args = parseRestoreLine(rawArgs);
 	const backupArg = args._[0];
-	if (!backupArg || rawArgs.includes("--help")) {
+	if (!backupArg) {
 		printRestoreHelp();
-		if (!backupArg && !rawArgs.includes("--help")) process.exit(1);
-		return;
+		process.exit(1);
 	}
 	const baseConnection = requireConnection();
 	const targetDb = args["--target-db"] ?? parseDbNameFromUrl(baseConnection) ?? void 0;
@@ -195,6 +285,7 @@ async function restoreCommand(rawArgs) {
 	out(chalk.gray(`  Source:  ${backupArg}`));
 	out(chalk.gray(`  Target:  ${targetDb ?? "(from DATABASE_URL)"}`));
 	out("");
+	await checkDatabaseConnectivity(baseConnection);
 	let localFile;
 	let globalsSql = null;
 	let cleanupTemp = false;
@@ -213,57 +304,64 @@ async function restoreCommand(rawArgs) {
 			const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);
 			if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString("utf-8");
 		} else {
-			localFile = path.resolve(backupArg);
-			if (!fs.existsSync(localFile)) {
-				outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));
-				process.exit(1);
-			}
+			localFile = path.resolve(invocationDir(), backupArg);
+			if (!fs.existsSync(localFile)) throw new BackupToolError(`Backup file not found: ${localFile}`);
 			const globalsPath = globalsFileForDump(localFile);
 			if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, "utf-8");
 		}
 		const pf = await preflight("pg_restore", baseConnection);
-		if (!pf.compatible) {
-			outError(chalk.red(`  ✗ ${pf.reason}`));
-			process.exit(1);
-		}
-		if (args["--create-db"] && !targetDb) {
-			outError(chalk.red("  ✗ --create-db requires a resolvable target database name (use --target-db)."));
-			process.exit(1);
-		}
-		if (!args["--yes"]) {
-			outWarn(chalk.yellow(`  ⚠️  This will restore into "${targetDb ?? "the target database"}" and may overwrite existing data.`));
-			if (!await promptConfirm(chalk.yellow("     Type 'yes' to continue: "))) {
-				out(chalk.gray("  Aborted. No changes were made."));
-				process.exit(1);
+		if (!pf.compatible) throw new BackupToolError(pf.reason ?? "pg_restore cannot restore into this server.");
+		if (args["--create-db"] && !targetDb) throw new BackupToolError("--create-db requires a resolvable target database name (use --target-db).");
+		if (!args["--clean"]) {
+			const conflicts = await findRestoreConflicts(targetConnection, await readDumpObjects(localFile));
+			if (conflicts.length > 0) {
+				const { message, hint } = describeRestoreConflict(targetDb ?? "the target database", backupArg, conflicts);
+				throw new BackupToolError(message, hint);
 			}
 		}
+		if (!await confirmRestore({
+			target: targetDb ?? "the target database",
+			yes: args["--yes"] === true,
+			interactive: process.stdin.isTTY === true,
+			ask: promptConfirm
+		})) {
+			process.exitCode = 1;
+			return;
+		}
 		if (args["--create-db"]) {
 			const created = await ensureDatabaseExists(baseConnection, targetDb);
 			out(chalk.gray(created ? `  ✓ Created database "${targetDb}".` : `  • Database "${targetDb}" already exists.`));
 		}
+		let rolesApplied = 0;
 		if (globalsSql) {
 			out(chalk.gray("  Recreating cluster roles from the backup's roles sidecar…"));
 			const { applied, skipped } = await applyGlobals(targetConnection, globalsSql, (m) => out(chalk.gray(m)));
+			rolesApplied = applied;
 			out(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));
 		} else {
 			outWarn(chalk.yellow("  ⚠️  No roles sidecar (.globals.sql) accompanies this backup."));
 			outWarn(chalk.yellow("     If the dump grants to roles that don't exist (e.g. rebase_user), the restore"));
 			outWarn(chalk.yellow("     will fail — recreate those roles first, or use a backup that includes its globals."));
 		}
-		await restoreDump({
-			connectionString: targetConnection,
-			inputFile: localFile,
-			clean: args["--clean"],
-			noOwner: args["--no-owner"],
-			exitOnError: !args["--continue-on-error"],
-			inheritStdio: true
-		});
+		try {
+			await restoreDump({
+				connectionString: targetConnection,
+				inputFile: localFile,
+				clean: args["--clean"],
+				noOwner: args["--no-owner"],
+				exitOnError: !args["--continue-on-error"],
+				inheritStdio: true
+			});
+		} catch (err) {
+			if (err instanceof BackupToolError) throw err;
+			throw new BackupToolError(`pg_restore stopped on the error above. What it restored before that stays in "${targetDb ?? "the target database"}".`, rolesApplied > 0 ? `The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay too.` : void 0);
+		}
 		out("");
 		out(chalk.green(`  ✓ Restore completed into "${targetDb ?? "the target database"}".`));
 		out("");
 	} catch (err) {
 		reportError(err);
-		process.exit(1);
+		process.exitCode = 1;
 	} finally {
 		if (cleanupTemp && typeof localFile === "string" && fs.existsSync(localFile)) fs.rmSync(path.dirname(localFile), {
 			recursive: true,
@@ -271,6 +369,12 @@ async function restoreCommand(rawArgs) {
 		});
 	}
 }
+var BACKUPS_ACTIONS = ["list"];
+/** What `db backups <action>` says of an action it does not have: the sentence every `db` command says. */
+function unknownBackupsAction(action) {
+	const near = closestWord(action, BACKUPS_ACTIONS);
+	return near ? `Unknown db backups command "${action}" — did you mean \`${near}\`? Run \`rebase db backups --help\` for the rest.` : `Unknown db backups command "${action}". Run \`rebase db backups --help\` for the ones there are.`;
+}
 async function backupsCommand(rawArgs) {
 	const action = rawArgs[2];
 	if (!action || action === "--help") {
@@ -278,23 +382,23 @@ async function backupsCommand(rawArgs) {
 		return;
 	}
 	if (action !== "list") {
-		outError(chalk.red(`Unknown backups action: "${action}". Valid: list`));
+		outError(chalk.red(`✗ ${unknownBackupsAction(action)}`));
 		process.exit(1);
 	}
-	const out$2 = (0, import_arg.default)({
+	const args = parseCommandFlags({
 		"--out": String,
 		"--output": "--out",
 		"-o": "--out"
-	}, {
-		argv: rawArgs.slice(3),
-		permissive: true
-	})["--out"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), "backups");
+	}, rawArgs.slice(3), "db backups list");
+	const out$2 = backupLocation(args["--out"]);
 	const dest = parseBackupDestination(out$2);
 	try {
 		const backups = await listBackups(dest, await resolveStorageForDestination(dest, process.env) ?? void 0);
 		out("");
-		if (backups.length === 0) out(chalk.gray(`  No backups found at ${out$2}.`));
-		else {
+		if (backups.length === 0) {
+			out(chalk.gray(`  No backups found at ${out$2}.`));
+			await mentionBackendBackups(out$2, args["--out"]);
+		} else {
 			out(chalk.bold(`  💾 ${backups.length} backup(s) at ${out$2}:`));
 			out("");
 			for (const b of backups) {
@@ -318,6 +422,26 @@ async function backupsCommand(rawArgs) {
 	}
 }
 /**
+* Point at `<backend>/backups` when the default listing is empty and that
+* directory holds dumps.
+*
+* Earlier releases resolved the default there, so after an upgrade the
+* backups a project already has are one directory away from the listing.
+*/
+async function mentionBackendBackups(listed, flag) {
+	if (flag || process.env.BACKUP_DESTINATION?.trim()) return;
+	const backendBackups = path.join(process.cwd(), "backups");
+	if (path.resolve(listed) === backendBackups) return;
+	const found = await listBackups({
+		kind: "local",
+		path: backendBackups
+	}).catch(() => []);
+	if (found.length === 0) return;
+	out(chalk.gray(`  ${found.length} backup(s) are in ${backendBackups}, where earlier releases of`));
+	out(chalk.gray(`  \`rebase db backup\` wrote by default. List them with:`));
+	out(chalk.gray(`    rebase db backups list --out ${path.relative(invocationDir(), backendBackups) || "."}`));
+}
+/**
 * Verify a freshly written dump; abort the command if it looks corrupt.
 *
 * Discards the artifact on the way out. Refusing to *report* success was never
@@ -335,11 +459,20 @@ async function assertDumpValid(localFile) {
 		throw new BackupToolError(`The backup failed validation and was discarded: ${check.reason}`, "The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.");
 	}
 }
+/**
+* Say why a backup command failed, with no password in it.
+*
+* What reaches here is often a client tool's failure, and execa's message
+* repeats the tool's command line. The tools get the password through
+* `PGPASSWORD` now, so it is not on that line, but a connection string can
+* still arrive inside a message from elsewhere; this is the last place to
+* stop it reaching a terminal or a CI log.
+*/
 function reportError(err) {
 	if (err instanceof BackupToolError) {
-		outError(chalk.red(`  ✗ ${err.message}`));
-		if (err.hint) outError(chalk.gray(`    ${err.hint}`));
-	} else outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.red(`  ✗ ${redactConnectionPasswords(err.message)}`));
+		if (err.hint) outError(chalk.gray(`    ${redactConnectionPasswords(err.hint)}`));
+	} else outError(chalk.red(`  ✗ ${redactConnectionPasswords(err instanceof Error ? err.message : String(err))}`));
 }
 function printBackupHelp() {
 	out(`
@@ -396,8 +529,11 @@ ${chalk.green.bold("Options")}
 
 ${chalk.red.bold("Warning")}
   Restore is destructive and never runs automatically. Without --yes it
-  requires an interactive 'yes'. Prefer --create-db/--target-db to restore
-  into a fresh database rather than overwriting a live one.
+  asks for a typed 'yes' on a terminal, and with no terminal to ask on it
+  refuses. Prefer --create-db/--target-db to restore into a fresh database
+  rather than overwriting a live one. Into a database that already holds
+  what the backup creates, it needs --clean, and refuses before changing
+  anything without it.
 
   By default the restore aborts on the first error (--exit-on-error) so a
   skipped GRANT never silently leaves RLS un-enforced. Roles are recreated
@@ -417,4 +553,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-DnpJi6I7.js.map
+//# sourceMappingURL=backup-cli-HCEkPcQj.js.map

package/dist/backup-cli-HCEkPcQj.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-cli-HCEkPcQj.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport type arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { closestWord, parseCommandFlags } from \"../cli-flags\";\nimport { redactConnectionPasswords } from \"../utils/connection-string\";\nimport { promptConfirm } from \"../cli-prompt\";\nimport { checkDatabaseConnectivity } from \"../cli-errors\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    findRestoreConflicts,\n    listBackups,\n    preflight,\n    readDumpObjects,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\n/**\n * The directory `rebase` was run from, which `rebase` puts here for the driver.\n *\n * The driver runs in the project's `backend/`, so a relative path resolved\n * against its own working directory named a different place from the one the\n * user typed it in: `rebase db backup --out ./backups` wrote to `<root>/backups`\n * (the CLI resolves explicit paths itself) while `rebase db backups list`\n * looked in `<root>/backend/backups`. Spelled the same in\n * `packages/cli/src/commands/db.ts`.\n */\nexport const INVOCATION_CWD_ENV = \"REBASE_INVOCATION_CWD\";\n\n/** Where a relative path the user typed is relative to: where they ran `rebase`. */\nexport function invocationDir(env: Readonly<Record<string, string | undefined>> = process.env): string {\n    const dir = env[INVOCATION_CWD_ENV]?.trim();\n    return dir && path.isAbsolute(dir) ? dir : process.cwd();\n}\n\n/**\n * Where `db backup` writes and `db backups list` reads, by one rule.\n *\n * - `--out` is relative to where `rebase` was run, like any path typed on a\n *   command line.\n * - `BACKUP_DESTINATION` is relative to the backend directory, because the\n *   server reads the same variable there: the Backups panel and the scheduled\n *   backup have to find what the CLI wrote.\n * - With neither, `./backups` where `rebase` was run, as the help says.\n *\n * An `s3://` or `gs://` destination is returned as given.\n */\nexport function resolveBackupLocation(opts: {\n    flag?: string;\n    configured?: string;\n    invocationDir: string;\n    backendDir: string;\n}): string {\n    const flag = opts.flag?.trim();\n    if (flag) return isRemoteDestination(flag) ? flag : path.resolve(opts.invocationDir, flag);\n    const configured = opts.configured?.trim();\n    if (configured) return isRemoteDestination(configured) ? configured : path.resolve(opts.backendDir, configured);\n    return path.join(opts.invocationDir, \"backups\");\n}\n\nfunction isRemoteDestination(value: string): boolean {\n    return parseBackupDestination(value).kind !== \"local\";\n}\n\n/** {@link resolveBackupLocation} for this process. */\nfunction backupLocation(flag: string | undefined): string {\n    return resolveBackupLocation({\n        flag,\n        configured: process.env.BACKUP_DESTINATION,\n        invocationDir: invocationDir(),\n        backendDir: process.cwd()\n    });\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nconst BACKUP_FLAGS = {\n    \"--out\": String,\n    // The same alias `build` and `cloud env pull` carry. `--output` is the\n    // canonical spelling in this CLI, and `rebase db backup --output ./backups`\n    // has to write there.\n    \"--output\": \"--out\",\n    \"--exclude-schema\": [String],\n    \"--no-owner\": Boolean,\n    \"--enable-row-security\": Boolean,\n    \"--row-security-role\": String,\n    \"-o\": \"--out\"\n} satisfies arg.Spec;\n\n/**\n * Parse a `rebase db backup …` line. An undeclared flag is refused (see\n * `parseCommandFlags`), and so is a positional: `rebase db backup ./backups`\n * means `--out ./backups`, and taken as nothing it wrote to the default\n * directory.\n */\nexport function parseBackupLine(rawArgs: string[]) {\n    const args = parseCommandFlags(BACKUP_FLAGS, rawArgs.slice(2), \"db backup\");\n    const [stray] = args._;\n    if (stray !== undefined) {\n        throw new Error(\n            `\\`rebase db backup\\` takes no argument \"${stray}\". Nothing was run. ` +\n            `To choose where the backup goes, pass --out ${stray}.`\n        );\n    }\n    return args;\n}\n\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    if (rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n    const args = parseBackupLine(rawArgs);\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = backupLocation(args[\"--out\"]);\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // A database that is not running is said the way `db push` says it — the\n    // host, the port and what to start — before pg_dump's version probe meets\n    // it as a bare `connect ECONNREFUSED`.\n    await checkDatabaseConnectivity(connectionString);\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/**\n * Parse a `rebase db restore …` line; the one positional is the backup.\n *\n * Strict, because this is the command where a typo costs most: parsed\n * permissively, `--targt-db x` became a second positional, the target fell\n * back to DATABASE_URL's own database, and the restore ran against the live\n * one.\n */\nexport function parseRestoreLine(rawArgs: string[]) {\n    const args = parseCommandFlags(RESTORE_FLAGS, rawArgs.slice(2), \"db restore\");\n    if (args._.length > 1) {\n        throw new Error(\n            `\\`rebase db restore\\` restores one backup, and was given ${args._.length}: ` +\n            `${args._.map(word => `\"${word}\"`).join(\", \")}. Nothing was run.`\n        );\n    }\n    return args;\n}\n\n/**\n * The restore's one question, asked before anything can change.\n *\n * `--yes` skips it. On a terminal it asks for a typed 'yes'. With no terminal\n * nobody can answer, and the refusal says to pass `--yes`, as `db reset`,\n * `db pull` and `db branch prune` do: \"Aborted. No changes were made.\" alone\n * read as though someone had answered no.\n *\n * @returns whether to go on. When not, it has said why.\n */\nexport async function confirmRestore(opts: {\n    target: string;\n    yes: boolean;\n    interactive: boolean;\n    ask: (question: string) => Promise<boolean>;\n}): Promise<boolean> {\n    if (opts.yes) return true;\n    outWarn(chalk.yellow(`  ⚠️  This will restore into \"${opts.target}\" and may overwrite existing data.`));\n    if (!opts.interactive) {\n        outError(chalk.red(\"  ✗ Nothing was restored: there is no terminal to confirm on.\"));\n        outError(chalk.gray(`    Re-run with --yes to restore into \"${opts.target}\".`));\n        return false;\n    }\n    const confirmed = await opts.ask(chalk.yellow(\"     Type 'yes' to continue: \"));\n    if (!confirmed) print(chalk.gray(\"  Aborted. No changes were made.\"));\n    return confirmed;\n}\n\n/** How many of the conflicting objects a refusal names before counting the rest. */\nconst CONFLICTS_NAMED = 5;\n\n/**\n * What `db restore` says when the target already holds what the backup\n * creates, and the two ways round it: `--clean` replaces them with the\n * backup's copy, a new database restores beside them.\n */\nexport function describeRestoreConflict(\n    target: string,\n    backupArg: string,\n    conflicts: readonly string[]\n): { message: string; hint: string } {\n    const named = conflicts.slice(0, CONFLICTS_NAMED).join(\", \");\n    const more = conflicts.length > CONFLICTS_NAMED ? `, and ${conflicts.length - CONFLICTS_NAMED} more` : \"\";\n    return {\n        message: `\"${target}\" already holds ${named}${more}, which this backup creates. ` +\n            \"Without --clean, pg_restore stops at the first of them. Nothing was restored or changed.\",\n        hint: [\n            `To replace them with the backup's copy:  rebase db restore ${backupArg} --clean`,\n            `To restore beside them, in a new database:  rebase db restore ${backupArg} --create-db --target-db <new name>`\n        ].join(\"\\n    \")\n    };\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    if (rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        return;\n    }\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg) {\n        printRestoreHelp();\n        process.exit(1);\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db swaps the database\n    // name so the live one isn't clobbered. Without it the target is\n    // DATABASE_URL's own database, and `--create-db` only creates it when it is\n    // missing.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Before anything is downloaded, and in `db push`'s words: see backupCommand.\n    await checkDatabaseConnectivity(baseConnection);\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(invocationDir(), backupArg);\n            if (!fs.existsSync(localFile)) throw new BackupToolError(`Backup file not found: ${localFile}`);\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        // Thrown, not exited, from here down: an exit skipped the `finally`\n        // that removes a dump downloaded from object storage.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) throw new BackupToolError(pf.reason ?? \"pg_restore cannot restore into this server.\");\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            throw new BackupToolError(\"--create-db requires a resolvable target database name (use --target-db).\");\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        // Before the question and before anything is applied, roles included:\n        // without --clean, pg_restore stops at the first object the target\n        // already has, and said so in its own words and execa's, after the\n        // roles had run. A target that does not exist yet holds nothing.\n        if (!args[\"--clean\"]) {\n            const conflicts = await findRestoreConflicts(targetConnection, await readDumpObjects(localFile));\n            if (conflicts.length > 0) {\n                const { message, hint } = describeRestoreConflict(targetDb ?? \"the target database\", backupArg, conflicts);\n                throw new BackupToolError(message, hint);\n            }\n        }\n\n        const confirmed = await confirmRestore({\n            target: targetDb ?? \"the target database\",\n            yes: args[\"--yes\"] === true,\n            interactive: process.stdin.isTTY === true,\n            ask: promptConfirm\n        });\n        if (!confirmed) {\n            // An exit code, so the `finally` still removes a downloaded dump.\n            process.exitCode = 1;\n            return;\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        let rolesApplied = 0;\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            rolesApplied = applied;\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        try {\n            await restoreDump({\n                connectionString: targetConnection,\n                inputFile: localFile,\n                clean: args[\"--clean\"],\n                noOwner: args[\"--no-owner\"],\n                // Fail loudly by default so a skipped GRANT never leaves RLS off.\n                exitOnError: !args[\"--continue-on-error\"],\n                inheritStdio: true\n            });\n        } catch (err) {\n            if (err instanceof BackupToolError) throw err;\n            // pg_restore has printed its own error above; execa's repeats the\n            // command line, which says nothing the reader can act on.\n            throw new BackupToolError(\n                `pg_restore stopped on the error above. What it restored before that stays in \"${targetDb ?? \"the target database\"}\".`,\n                rolesApplied > 0\n                    ? `The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay too.`\n                    : undefined\n            );\n        }\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        // An exit code, not `process.exit`: exiting here skipped the `finally`\n        // below, and a failed restore from object storage left its downloaded\n        // dump, every row of the database, in the temp directory.\n        process.exitCode = 1;\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nconst BACKUPS_ACTIONS = [\"list\"] as const;\n\n/** What `db backups <action>` says of an action it does not have: the sentence every `db` command says. */\nexport function unknownBackupsAction(action: string): string {\n    const near = closestWord(action, BACKUPS_ACTIONS);\n    return near\n        ? `Unknown db backups command \"${action}\" — did you mean \\`${near}\\`? Run \\`rebase db backups --help\\` for the rest.`\n        : `Unknown db backups command \"${action}\". Run \\`rebase db backups --help\\` for the ones there are.`;\n}\n\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`✗ ${unknownBackupsAction(action)}`));\n        process.exit(1);\n    }\n\n    const args = parseCommandFlags(\n        { \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" },\n        rawArgs.slice(3),\n        \"db backups list\"\n    );\n    const out = backupLocation(args[\"--out\"]);\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n            await mentionBackendBackups(out, args[\"--out\"]);\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Point at `<backend>/backups` when the default listing is empty and that\n * directory holds dumps.\n *\n * Earlier releases resolved the default there, so after an upgrade the\n * backups a project already has are one directory away from the listing.\n */\nasync function mentionBackendBackups(listed: string, flag: string | undefined): Promise<void> {\n    if (flag || process.env.BACKUP_DESTINATION?.trim()) return;\n    const backendBackups = path.join(process.cwd(), \"backups\");\n    if (path.resolve(listed) === backendBackups) return;\n    const found = await listBackups({ kind: \"local\", path: backendBackups }).catch(() => []);\n    if (found.length === 0) return;\n    print(chalk.gray(`  ${found.length} backup(s) are in ${backendBackups}, where earlier releases of`));\n    print(chalk.gray(`  \\`rebase db backup\\` wrote by default. List them with:`));\n    print(chalk.gray(`    rebase db backups list --out ${path.relative(invocationDir(), backendBackups) || \".\"}`));\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\n/**\n * Say why a backup command failed, with no password in it.\n *\n * What reaches here is often a client tool's failure, and execa's message\n * repeats the tool's command line. The tools get the password through\n * `PGPASSWORD` now, so it is not on that line, but a connection string can\n * still arrive inside a message from elsewhere; this is the last place to\n * stop it reaching a terminal or a CI log.\n */\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${redactConnectionPasswords(err.message)}`));\n        if (err.hint) outError(chalk.gray(`    ${redactConnectionPasswords(err.hint)}`));\n    } else {\n        outError(chalk.red(`  ✗ ${redactConnectionPasswords(err instanceof Error ? err.message : String(err))}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  asks for a typed 'yes' on a terminal, and with no terminal to ask on it\n  refuses. Prefer --create-db/--target-db to restore into a fresh database\n  rather than overwriting a live one. Into a database that already holds\n  what the backup creates, it needs --clean, and refuses before changing\n  anything without it.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;AA2CA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;;;;;;;;;;;AAYA,IAAa,qBAAqB;;AAGlC,SAAgB,cAAc,MAAoD,QAAQ,KAAa;CACnG,MAAM,MAAM,IAAI,mBAAmB,EAAE,KAAK;CAC1C,OAAO,OAAO,KAAK,WAAW,GAAG,IAAI,MAAM,QAAQ,IAAI;AAC3D;;;;;;;;;;;;;AAcA,SAAgB,sBAAsB,MAK3B;CACP,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,MAAM,OAAO,oBAAoB,IAAI,IAAI,OAAO,KAAK,QAAQ,KAAK,eAAe,IAAI;CACzF,MAAM,aAAa,KAAK,YAAY,KAAK;CACzC,IAAI,YAAY,OAAO,oBAAoB,UAAU,IAAI,aAAa,KAAK,QAAQ,KAAK,YAAY,UAAU;CAC9G,OAAO,KAAK,KAAK,KAAK,eAAe,SAAS;AAClD;AAEA,SAAS,oBAAoB,OAAwB;CACjD,OAAO,uBAAuB,KAAK,CAAC,CAAC,SAAS;AAClD;;AAGA,SAAS,eAAe,MAAkC;CACtD,OAAO,sBAAsB;EACzB;EACA,YAAY,QAAQ,IAAI;EACxB,eAAe,cAAc;EAC7B,YAAY,QAAQ,IAAI;CAC5B,CAAC;AACL;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAKA,IAAM,eAAe;CACjB,SAAS;CAIT,YAAY;CACZ,oBAAoB,CAAC,MAAM;CAC3B,cAAc;CACd,yBAAyB;CACzB,uBAAuB;CACvB,MAAM;AACV;;;;;;;AAQA,SAAgB,gBAAgB,SAAmB;CAC/C,MAAM,OAAO,kBAAkB,cAAc,QAAQ,MAAM,CAAC,GAAG,WAAW;CAC1E,MAAM,CAAC,SAAS,KAAK;CACrB,IAAI,UAAU,KAAA,GACV,MAAM,IAAI,MACN,2CAA2C,MAAM,kEACF,MAAM,EACzD;CAEJ,OAAO;AACX;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,QAAQ,SAAS,QAAQ,GAAG;EAC5B,gBAAgB;EAChB;CACJ;CACA,MAAM,OAAO,gBAAgB,OAAO;CAEpC,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,eAAe,KAAK,QAAQ;CACxC,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAKR,MAAM,0BAA0B,gBAAgB;CAGhD,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;;;;;;;;AAUA,SAAgB,iBAAiB,SAAmB;CAChD,MAAM,OAAO,kBAAkB,eAAe,QAAQ,MAAM,CAAC,GAAG,YAAY;CAC5E,IAAI,KAAK,EAAE,SAAS,GAChB,MAAM,IAAI,MACN,4DAA4D,KAAK,EAAE,OAAO,IACvE,KAAK,EAAE,KAAI,SAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,mBAClD;CAEJ,OAAO;AACX;;;;;;;;;;;AAYA,eAAsB,eAAe,MAKhB;CACjB,IAAI,KAAK,KAAK,OAAO;CACrB,QAAQ,MAAM,OAAO,iCAAiC,KAAK,OAAO,mCAAmC,CAAC;CACtG,IAAI,CAAC,KAAK,aAAa;EACnB,SAAS,MAAM,IAAI,+DAA+D,CAAC;EACnF,SAAS,MAAM,KAAK,0CAA0C,KAAK,OAAO,GAAG,CAAC;EAC9E,OAAO;CACX;CACA,MAAM,YAAY,MAAM,KAAK,IAAI,MAAM,OAAO,+BAA+B,CAAC;CAC9E,IAAI,CAAC,WAAW,IAAM,MAAM,KAAK,kCAAkC,CAAC;CACpE,OAAO;AACX;;AAGA,IAAM,kBAAkB;;;;;;AAOxB,SAAgB,wBACZ,QACA,WACA,WACiC;CAGjC,OAAO;EACH,SAAS,IAAI,OAAO,kBAHV,UAAU,MAAM,GAAG,eAAe,CAAC,CAAC,KAAK,IAGb,IAF7B,UAAU,SAAS,kBAAkB,SAAS,UAAU,SAAS,gBAAgB,SAAS,GAEhD;EAEnD,MAAM,CACF,8DAA8D,UAAU,WACxE,iEAAiE,UAAU,oCAC/E,CAAC,CAAC,KAAK,QAAQ;CACnB;AACJ;AAEA,eAAsB,eAAe,SAAkC;CACnE,IAAI,QAAQ,SAAS,QAAQ,GAAG;EAC5B,iBAAiB;EACjB;CACJ;CACA,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,WAAW;EACZ,iBAAiB;EACjB,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,iBAAiB,kBAAkB;CAMzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAGR,MAAM,0BAA0B,cAAc;CAM9C,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,cAAc,GAAG,SAAS;GACnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG,MAAM,IAAI,gBAAgB,0BAA0B,WAAW;GAC9F,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAOA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY,MAAM,IAAI,gBAAgB,GAAG,UAAU,6CAA6C;EAGxG,IAAI,KAAK,kBAAkB,CAAC,UACxB,MAAM,IAAI,gBAAgB,2EAA2E;EAgBzG,IAAI,CAAC,KAAK,YAAY;GAClB,MAAM,YAAY,MAAM,qBAAqB,kBAAkB,MAAM,gBAAgB,SAAS,CAAC;GAC/F,IAAI,UAAU,SAAS,GAAG;IACtB,MAAM,EAAE,SAAS,SAAS,wBAAwB,YAAY,uBAAuB,WAAW,SAAS;IACzG,MAAM,IAAI,gBAAgB,SAAS,IAAI;GAC3C;EACJ;EAQA,IAAI,CAAC,MANmB,eAAe;GACnC,QAAQ,YAAY;GACpB,KAAK,KAAK,aAAa;GACvB,aAAa,QAAQ,MAAM,UAAU;GACrC,KAAK;EACT,CAAC,GACe;GAEZ,QAAQ,WAAW;GACnB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,eAAe;EACnB,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,eAAe;GACf,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,IAAI;GACA,MAAM,YAAY;IACd,kBAAkB;IAClB,WAAW;IACX,OAAO,KAAK;IACZ,SAAS,KAAK;IAEd,aAAa,CAAC,KAAK;IACnB,cAAc;GAClB,CAAC;EACL,SAAS,KAAK;GACV,IAAI,eAAe,iBAAiB,MAAM;GAG1C,MAAM,IAAI,gBACN,iFAAiF,YAAY,sBAAsB,KACnH,eAAe,IACT,OAAO,aAAa,4EACpB,KAAA,CACV;EACJ;EAEA,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EAIf,QAAQ,WAAW;CACvB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,IAAM,kBAAkB,CAAC,MAAM;;AAG/B,SAAgB,qBAAqB,QAAwB;CACzD,MAAM,OAAO,YAAY,QAAQ,eAAe;CAChD,OAAO,OACD,+BAA+B,OAAO,qBAAqB,KAAK,sDAChE,+BAA+B,OAAO;AAChD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,KAAK,qBAAqB,MAAM,GAAG,CAAC;EACvD,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,OAAO,kBACT;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GACtD,QAAQ,MAAM,CAAC,GACf,iBACJ;CACA,MAAM,QAAM,eAAe,KAAK,QAAQ;CACxC,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GAAG;GACtB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;GACjD,MAAM,sBAAsB,OAAK,KAAK,QAAQ;EAClD,OAAO;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;AASA,eAAe,sBAAsB,QAAgB,MAAyC;CAC1F,IAAI,QAAQ,QAAQ,IAAI,oBAAoB,KAAK,GAAG;CACpD,MAAM,iBAAiB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACzD,IAAI,KAAK,QAAQ,MAAM,MAAM,gBAAgB;CAC7C,MAAM,QAAQ,MAAM,YAAY;EAAE,MAAM;EAAS,MAAM;CAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CACvF,IAAI,MAAM,WAAW,GAAG;CACxB,IAAM,MAAM,KAAK,KAAK,MAAM,OAAO,oBAAoB,eAAe,4BAA4B,CAAC;CACnG,IAAM,MAAM,KAAK,0DAA0D,CAAC;CAC5E,IAAM,MAAM,KAAK,oCAAoC,KAAK,SAAS,cAAc,GAAG,cAAc,KAAK,KAAK,CAAC;AACjH;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;;;;;;;;;;AAWA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,0BAA0B,IAAI,OAAO,GAAG,CAAC;EACnE,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,0BAA0B,IAAI,IAAI,GAAG,CAAC;CACnF,OACI,SAAS,MAAM,IAAI,OAAO,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAEhH;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;;;;CAY3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}