@rebasepro/server-postgres 0.25.0-canary.ge06257e → 0.25.0

package/dist/{BranchService-DNg4txyf.js → BranchService-iXXZeVYD.js}

@@ -1,8 +1,9 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-V7rFbMRe.js";
-import { tt as extractCauseMessage } from "./cli-errors-mx4sSjB8.js";
-import { n as extractPgError } from "./pg-error-utils-CdsGYMTm.js";
+import { nt as extractCauseMessage } from "./cli-errors-DwQnNATs.js";
+import { n as extractPgError } from "./pg-error-utils-Bv5n2PLn.js";
+import { Client } from "pg";
 import { sql } from "drizzle-orm";
 import { revokeInternalTableSql } from "@rebasepro/common";
 //#region src/services/BranchService.ts
@@ -16,7 +17,9 @@ import { revokeInternalTableSql } from "@rebasepro/common";
 */
 var BranchService_exports = /* @__PURE__ */ __exportAll({
 	BranchService: () => BranchService,
-	BranchingUnsupportedError: () => BranchingUnsupportedError
+	BranchingUnsupportedError: () => BranchingUnsupportedError,
+	reopenClosedDatabases: () => reopenClosedDatabases,
+	reopenedDatabasesNotice: () => reopenedDatabasesNotice
 });
 /** Internal prefix applied to branch database names to avoid collisions. */
 var BRANCH_DB_PREFIX = "rb_";
@@ -24,6 +27,106 @@ var BRANCH_DB_PREFIX = "rb_";
 var PG_DUPLICATE_DATABASE = "42P04";
 /** `object_in_use` — the database still has connections attached. */
 var PG_OBJECT_IN_USE = "55006";
+/** How many times `--force` disconnects the other sessions before it reports one still there. */
+var FORCE_ATTEMPTS = 3;
+/** The database every Postgres server has, from which another one can be closed and opened. */
+var MAINTENANCE_DATABASE = "postgres";
+/**
+* The signals Node can catch that end a forced copy part-way: a closed
+* terminal or a lost SSH session (SIGHUP), Ctrl-C (SIGINT), a supervisor's
+* stop (SIGTERM) and Ctrl-\ (SIGQUIT). SIGKILL cannot be caught; what it leaves
+* closed, {@link reopenClosedDatabases} opens again.
+*/
+var REOPEN_ON_SIGNALS = [
+	"SIGHUP",
+	"SIGINT",
+	"SIGTERM",
+	"SIGQUIT"
+];
+/** `ALTER DATABASE … ALLOW_CONNECTIONS true`, the statement that opens a closed database again. */
+function reopenStatement(dbName) {
+	return `ALTER DATABASE "${dbName.replace(/"/g, "\"\"")}" ALLOW_CONNECTIONS true`;
+}
+/**
+* Open again the database `connectionString` names, and each of `others`,
+* where one refuses new connections.
+*
+* `rebase db branch create --force` closes its source with `ALLOW_CONNECTIONS
+* false` for the copy, and opens it again after, and on every signal it can
+* catch. A SIGKILL — an out-of-memory kill, a CI runner's hard stop — leaves
+* it closed: the app answers 503, and `rebase dev`, `console` and `push` all
+* fail, on the project's own database. Nothing else in a development database
+* closes one, so a closed one found here is that, and every `rebase db branch`
+* command calls this before it does anything else.
+*
+* Runs from the server's `postgres` database, since a closed database cannot
+* be connected to. A template is never touched (`template0` is closed by
+* design), nor a database a `CREATE DATABASE … TEMPLATE` is copying right now:
+* that is another forced create, which opens it itself.
+*
+* Best-effort: a server it cannot reach, or a catalogue it cannot read, is an
+* empty answer, and the command's own connection check speaks next.
+*/
+async function reopenClosedDatabases(connectionString, others = []) {
+	const result = {
+		reopened: [],
+		failed: []
+	};
+	let maintenanceUrl;
+	let named;
+	try {
+		const url = new URL(connectionString);
+		named = decodeURIComponent(url.pathname.slice(1));
+		url.pathname = `/${MAINTENANCE_DATABASE}`;
+		maintenanceUrl = url.toString();
+	} catch {
+		return result;
+	}
+	const names = [...new Set([named, ...others].map((name) => name?.trim() ?? "").filter((name) => name !== "" && name !== MAINTENANCE_DATABASE))];
+	if (names.length === 0) return result;
+	const client = new Client({
+		connectionString: maintenanceUrl,
+		connectionTimeoutMillis: 5e3
+	});
+	client.on("error", () => void 0);
+	try {
+		await client.connect();
+	} catch {
+		return result;
+	}
+	try {
+		const closed = await client.query(`SELECT d.datname
+               FROM pg_database d
+              WHERE d.datname = ANY($1::text[])
+                AND NOT d.datallowconn
+                AND NOT d.datistemplate
+                AND NOT EXISTS (
+                    SELECT 1 FROM pg_stat_activity a
+                     WHERE a.state = 'active'
+                       AND position(('TEMPLATE "' || replace(d.datname, '"', '""') || '"') IN a.query) > 0)
+              ORDER BY 1`, [names]);
+		for (const { datname } of closed.rows) {
+			const statement = reopenStatement(datname);
+			try {
+				await client.query(statement);
+				result.reopened.push(datname);
+			} catch (err) {
+				result.failed.push({
+					database: datname,
+					reason: extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err),
+					statement
+				});
+			}
+		}
+	} catch {} finally {
+		await client.end().catch(() => void 0);
+	}
+	return result;
+}
+/** What to say about {@link reopenClosedDatabases}'s answer: one line a database, or none. */
+function reopenedDatabasesNotice(result) {
+	return [...result.reopened.map((database) => `⚠ "${database}" was refusing every connection — an interrupted \`rebase db branch create --force\` had closed it for the copy. It is open again.`), ...result.failed.map(({ database, reason, statement }) => `⚠ "${database}" refuses every connection — an interrupted \`rebase db branch create --force\` closed it — and could not be opened again (${reason}). Run, connected to the server's postgres database: ${statement};`)];
+}
 /**
 * Describe a failed branch DDL statement in terms a user can act on.
 *
@@ -181,15 +284,16 @@ var BranchService = class {
 		const sourceDb = options?.source || await this.home.database();
 		if ((await (await this.home.registry()).execute(sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`)).rows.length > 0) throw new Error(`Branch "${name}" already exists.`);
 		await this.poolManager.disconnectDatabase(sourceDb);
-		if (options?.force) {
-			if (await this.terminateConnections(sourceDb) > 0) await new Promise((resolve) => setTimeout(resolve, 250));
-		}
 		const safeDbName = dbName.replace(/"/g, "\"\"");
 		const safeSourceDb = sourceDb.replace(/"/g, "\"\"");
-		try {
+		const copy = async () => {
 			await this.db.execute(sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`));
+		};
+		try {
+			if (options?.force) await this.whileClosedToNewConnections(sourceDb, () => this.disconnectingOthers(sourceDb, copy));
+			else await copy();
 		} catch (err) {
-			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" has active connections.\n` + await this.describeBlockingConnections(sourceDb));
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" ${options?.force ? "still had connections after they were disconnected" : "has active connections"}.\n` + await this.describeBlockingConnections(sourceDb, { forced: options?.force === true }));
 			throw describeBranchDdlError(err, dbName);
 		}
 		const now = /* @__PURE__ */ new Date();
@@ -216,14 +320,15 @@ var BranchService = class {
 		const dbName = existingRows[0].db_name;
 		if (dbName === mainDatabase) throw new Error("Cannot delete the main database.");
 		await this.poolManager.disconnectDatabase(dbName);
-		if (options?.force) {
-			if (await this.terminateConnections(dbName) > 0) await new Promise((resolve) => setTimeout(resolve, 250));
-		}
 		const safeDbName = dbName.replace(/"/g, "\"\"");
-		try {
+		const drop = async () => {
 			await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
+		};
+		try {
+			if (options?.force) await this.disconnectingOthers(dbName, drop);
+			else await drop();
 		} catch (err) {
-			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${name}": the database has active connections.\n` + await this.describeBlockingConnections(dbName));
+			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot delete branch "${name}": the database ${options?.force ? "still had connections after they were disconnected" : "has active connections"}.\n` + await this.describeBlockingConnections(dbName, { forced: options?.force === true }));
 			throw describeBranchDdlError(err, dbName);
 		}
 		await (await this.home.registry()).execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);
@@ -247,7 +352,7 @@ var BranchService = class {
 	* Best-effort by construction: this runs while reporting a failure, and a
 	* diagnostic that throws would replace a real error with its own.
 	*/
-	async describeBlockingConnections(dbName) {
+	async describeBlockingConnections(dbName, options = {}) {
 		try {
 			const rows = (await this.db.execute(sql`
                 SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,
@@ -259,10 +364,108 @@ var BranchService = class {
                  ORDER BY 2 DESC, 1
             `)).rows;
 			if (rows.length === 0) return "  Retry — whatever was connected has since disconnected.";
-			return `  Connected right now:\n${rows.map((row) => `    ${row.n} × ${String(row.app)}`).join("\n")}\n  A running \`rebase dev\` is the usual one — stop it, or re-run with --force to
-  disconnect them for you.`;
+			return `  Connected right now:\n${rows.map((row) => `    ${row.n} × ${String(row.app)}`).join("\n")}\n` + (options.forced ? "  They reconnected as fast as they were disconnected. A running `rebase dev` is the\n  usual one — stop it, then run this again." : "  A running `rebase dev` is the usual one — stop it, or re-run with --force to\n  disconnect them for you.");
 		} catch {
-			return "  Close other clients and connections, or re-run with --force.";
+			return options.forced ? "  Stop the clients connected to it — a running `rebase dev` is the usual one — then run this again." : "  Close other clients and connections, or re-run with --force.";
+		}
+	}
+	/**
+	* Run `operation` with no other session on `dbName`, disconnecting them
+	* first: what `--force` asks for.
+	*
+	* Disconnected, a client that reconnects — a running `rebase dev`'s
+	* realtime listener does — can be back before `CREATE DATABASE … TEMPLATE`
+	* or `DROP DATABASE` counts the sessions, and it failed on one about once
+	* in seven tries, saying to pass the `--force` that had been passed. So a
+	* refusal on a session still connected is retried, disconnecting again, a
+	* few times before it is reported.
+	*/
+	async disconnectingOthers(dbName, operation) {
+		for (let attempt = 1;; attempt++) {
+			if (await this.terminateConnections(dbName) > 0) await new Promise((resolve) => setTimeout(resolve, 250));
+			try {
+				await operation();
+				return;
+			} catch (err) {
+				if (attempt >= FORCE_ATTEMPTS || extractPgError(err)?.code !== PG_OBJECT_IN_USE) throw err;
+			}
+		}
+	}
+	/**
+	* Run `operation` with `dbName` refusing new connections, and open it
+	* again after, whatever happens.
+	*
+	* A client disconnected from the source — a running `rebase dev` holds a
+	* pool and a realtime listener — cannot then reconnect before the copy has
+	* counted the sessions on it. Postgres refuses `ALLOW_CONNECTIONS false` on
+	* the database a session is connected to, so both statements run from the
+	* server's `postgres` database, and they need the database's owner. Where
+	* either is missing, the retries of {@link disconnectingOthers} are what is
+	* left. A database found closed already — by a run killed before it could
+	* open it — is copied as it is and opened after, like one this run closed.
+	*
+	* Stopped by a signal while closed ({@link REOPEN_ON_SIGNALS}), it opens
+	* the database again before the process exits; a second signal waits for
+	* that rather than cutting it short. One it could not open is named, with
+	* the statement that does. No handler is left installed after the copy.
+	*/
+	async whileClosedToNewConnections(dbName, operation) {
+		const safe = dbName.replace(/"/g, "\"\"");
+		const maintenance = dbName === MAINTENANCE_DATABASE ? null : this.poolManager.getDrizzle(MAINTENANCE_DATABASE);
+		let closed = false;
+		try {
+			if (maintenance) {
+				const [row] = (await maintenance.execute(sql`SELECT datallowconn FROM pg_database WHERE datname = ${dbName}`)).rows;
+				if (row?.datallowconn === true) await maintenance.execute(sql.raw(`ALTER DATABASE "${safe}" ALLOW_CONNECTIONS false`));
+				closed = row !== void 0;
+			}
+		} catch {}
+		if (!closed) {
+			await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);
+			await operation();
+			return;
+		}
+		let reopening;
+		const reopen = () => {
+			reopening ??= this.reopenToConnections(dbName);
+			return reopening;
+		};
+		let caught;
+		const release = () => {
+			for (const signal of REOPEN_ON_SIGNALS) process.removeListener(signal, onSignal);
+		};
+		const onSignal = (signal) => {
+			if (caught) return;
+			caught = signal;
+			reopen().catch((err) => {
+				console.error(err instanceof Error ? err.message : String(err));
+			}).finally(() => {
+				release();
+				process.kill(process.pid, signal);
+			});
+		};
+		for (const signal of REOPEN_ON_SIGNALS) try {
+			process.on(signal, onSignal);
+		} catch {}
+		try {
+			await operation();
+		} finally {
+			try {
+				await reopen();
+			} finally {
+				if (!caught) release();
+			}
+		}
+	}
+	/** `ALLOW_CONNECTIONS true` again, from the maintenance database, or an error that says how to do it by hand. */
+	async reopenToConnections(dbName) {
+		const statement = reopenStatement(dbName);
+		try {
+			await this.poolManager.getDrizzle(MAINTENANCE_DATABASE).execute(sql.raw(statement));
+		} catch (err) {
+			throw new Error(`"${dbName}" was closed to new connections for the copy and could not be opened again (${extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err)}). Nothing can connect to it until you run, from another database: ${statement};`);
+		} finally {
+			await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);
 		}
 	}
 	/**
@@ -383,6 +586,6 @@ var BranchService = class {
 	}
 };
 //#endregion
-export { BranchService_exports as n, BranchingUnsupportedError as r, BranchService as t };
+export { reopenedDatabasesNotice as a, reopenClosedDatabases as i, BranchService_exports as n, BranchingUnsupportedError as r, BranchService as t };
 
-//# sourceMappingURL=BranchService-DNg4txyf.js.map
+//# sourceMappingURL=BranchService-iXXZeVYD.js.map

package/dist/BranchService-iXXZeVYD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"BranchService-iXXZeVYD.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { Client } from \"pg\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\n\n/** How many times `--force` disconnects the other sessions before it reports one still there. */\nconst FORCE_ATTEMPTS = 3;\n\n/** The database every Postgres server has, from which another one can be closed and opened. */\nconst MAINTENANCE_DATABASE = \"postgres\";\n\n/**\n * The signals Node can catch that end a forced copy part-way: a closed\n * terminal or a lost SSH session (SIGHUP), Ctrl-C (SIGINT), a supervisor's\n * stop (SIGTERM) and Ctrl-\\ (SIGQUIT). SIGKILL cannot be caught; what it leaves\n * closed, {@link reopenClosedDatabases} opens again.\n */\nconst REOPEN_ON_SIGNALS: readonly NodeJS.Signals[] = [\"SIGHUP\", \"SIGINT\", \"SIGTERM\", \"SIGQUIT\"];\n\n/** `ALTER DATABASE … ALLOW_CONNECTIONS true`, the statement that opens a closed database again. */\nfunction reopenStatement(dbName: string): string {\n    return `ALTER DATABASE \"${dbName.replace(/\"/g, '\"\"')}\" ALLOW_CONNECTIONS true`;\n}\n\n/** What {@link reopenClosedDatabases} found closed, and what became of each. */\nexport interface ReopenedDatabases {\n    /** Databases that refused new connections, and accept them again. */\n    reopened: string[];\n    /** Databases that refuse new connections and could not be opened, with Postgres's reason. */\n    failed: { database: string; reason: string; statement: string }[];\n}\n\n/**\n * Open again the database `connectionString` names, and each of `others`,\n * where one refuses new connections.\n *\n * `rebase db branch create --force` closes its source with `ALLOW_CONNECTIONS\n * false` for the copy, and opens it again after, and on every signal it can\n * catch. A SIGKILL — an out-of-memory kill, a CI runner's hard stop — leaves\n * it closed: the app answers 503, and `rebase dev`, `console` and `push` all\n * fail, on the project's own database. Nothing else in a development database\n * closes one, so a closed one found here is that, and every `rebase db branch`\n * command calls this before it does anything else.\n *\n * Runs from the server's `postgres` database, since a closed database cannot\n * be connected to. A template is never touched (`template0` is closed by\n * design), nor a database a `CREATE DATABASE … TEMPLATE` is copying right now:\n * that is another forced create, which opens it itself.\n *\n * Best-effort: a server it cannot reach, or a catalogue it cannot read, is an\n * empty answer, and the command's own connection check speaks next.\n */\nexport async function reopenClosedDatabases(\n    connectionString: string,\n    others: readonly (string | null | undefined)[] = []\n): Promise<ReopenedDatabases> {\n    const result: ReopenedDatabases = { reopened: [], failed: [] };\n    let maintenanceUrl: string;\n    let named: string;\n    try {\n        const url = new URL(connectionString);\n        named = decodeURIComponent(url.pathname.slice(1));\n        url.pathname = `/${MAINTENANCE_DATABASE}`;\n        maintenanceUrl = url.toString();\n    } catch {\n        return result;\n    }\n    const names = [...new Set([named, ...others].map((name) => name?.trim() ?? \"\")\n        .filter((name) => name !== \"\" && name !== MAINTENANCE_DATABASE))];\n    if (names.length === 0) return result;\n\n    const client = new Client({ connectionString: maintenanceUrl, connectionTimeoutMillis: 5000 });\n    // A connection dropped while idle must not take the command down with it.\n    client.on(\"error\", () => undefined);\n    try {\n        await client.connect();\n    } catch {\n        return result;\n    }\n    try {\n        const closed = await client.query<{ datname: string }>(\n            `SELECT d.datname\n               FROM pg_database d\n              WHERE d.datname = ANY($1::text[])\n                AND NOT d.datallowconn\n                AND NOT d.datistemplate\n                AND NOT EXISTS (\n                    SELECT 1 FROM pg_stat_activity a\n                     WHERE a.state = 'active'\n                       AND position(('TEMPLATE \"' || replace(d.datname, '\"', '\"\"') || '\"') IN a.query) > 0)\n              ORDER BY 1`,\n            [names]\n        );\n        for (const { datname } of closed.rows) {\n            const statement = reopenStatement(datname);\n            try {\n                await client.query(statement);\n                result.reopened.push(datname);\n            } catch (err) {\n                result.failed.push({\n                    database: datname,\n                    reason: extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err),\n                    statement\n                });\n            }\n        }\n    } catch {\n        // The catalogue could not be read: nothing found to open.\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n    return result;\n}\n\n/** What to say about {@link reopenClosedDatabases}'s answer: one line a database, or none. */\nexport function reopenedDatabasesNotice(result: ReopenedDatabases): string[] {\n    return [\n        ...result.reopened.map((database) =>\n            `⚠ \"${database}\" was refusing every connection — an interrupted \\`rebase db branch create --force\\` ` +\n            \"had closed it for the copy. It is open again.\"),\n        ...result.failed.map(({ database, reason, statement }) =>\n            `⚠ \"${database}\" refuses every connection — an interrupted \\`rebase db branch create --force\\` closed it — ` +\n            `and could not be opened again (${reason}). Run, connected to the server's postgres database: ${statement};`)\n    ];\n}\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n    const pgError = extractPgError(err);\n\n    if (pgError?.code === PG_DUPLICATE_DATABASE) {\n        return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n    }\n    if (pgError?.code === PG_OBJECT_IN_USE) {\n        return new Error(\n            `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n            \"Close other clients or connections and try again.\"\n        );\n    }\n\n    // Unknown failure: surface the real PG message rather than the Drizzle\n    // wrapper, which would otherwise show the raw SQL and no reason at all.\n    const detail = pgError?.message ?? extractCauseMessage(err);\n    if (detail) return new Error(detail);\n    return err instanceof Error ? err : new Error(String(err));\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n    /** Wire code, forwarded verbatim to the client. */\n    readonly code = \"BRANCHING_UNSUPPORTED\";\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"BranchingUnsupportedError\";\n    }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n    \"Branching does not work on the managed development database. It copies a database with \"\n    + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n    + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n    + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n    + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n    if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n        throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n    }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n    validateIdentifier(name, \"branch name\");\n    if (name.length > MAX_BRANCH_NAME_LENGTH) {\n        throw new Error(\n            `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n            \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n        );\n    }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n    assertValidBranchName(name);\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\n/**\n * Where a server's branches are kept: the main database — what a branch is\n * copied from unless told otherwise, and what may never be dropped — and the\n * connection whose `rebase.branches` records them.\n */\nexport interface BranchHome {\n    /** The main database's name. */\n    database(): Promise<string>;\n    /**\n     * A connection on the database the registry is in. Asked for at each use:\n     * a pool to the main database is closed before it is copied.\n     */\n    registry(): Promise<DrizzleClient>;\n}\n\nexport class BranchService {\n    private readonly home: BranchHome;\n\n    /**\n     * @param db    A connection on the server the branches are made on. Branch\n     *              DDL runs here.\n     * @param home  Where branches are kept. Without one, the database the\n     *              pool manager's connection string names, and `db`'s registry.\n     */\n    constructor(\n        private db: DrizzleClient,\n        private poolManager: DatabasePoolManager,\n        home?: BranchHome\n    ) {\n        this.home = home ?? {\n            database: async () => poolManager.defaultDatabaseName,\n            registry: async () => db\n        };\n    }\n\n    /**\n     * Refuse a branch mutation the connected server cannot honour.\n     *\n     * The check lives here rather than in the CLI's argv parsing because the\n     * CLI is not the only caller: Studio reaches `createBranch` over the\n     * websocket, and before this it got \"Branch created successfully\" and a\n     * detail pane promising isolation for a database that is the parent.\n     *\n     * Reads only, and only mutations are guarded: `listBranches` on a managed\n     * database is an honest empty list, and refusing it would turn the Branches\n     * pane into a failure with a \"Try again\" that can never succeed.\n     */\n    private async assertBranchingSupported(): Promise<void> {\n        if (await this.poolManager.servesOneDatabase()) {\n            throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n        }\n    }\n\n    /**\n     * Whether the `rebase.branches` registry exists. A database that has never\n     * had a branch made on it may not have it, and reading it there is an\n     * empty answer, not an error — nor a reason to create it. The CLI's `list`\n     * and `info` ask this rather than running the DDL that creates it.\n     */\n    async hasBranchRegistry(): Promise<boolean> {\n        const result = await (await this.home.registry()).execute(\n            sql`SELECT to_regclass('rebase.branches') IS NOT NULL AS present`\n        );\n        const [row] = result.rows;\n        return row !== undefined && Reflect.get(row, \"present\") === true;\n    }\n\n    /**\n     * Ensure the `rebase.branches` metadata table exists in the default database.\n     * Idempotent — safe to call on every startup.\n     */\n    async ensureBranchMetadataTable(): Promise<void> {\n        // Create the rebase schema (idempotent — may already exist from auth/history init)\n        const registry = await this.home.registry();\n        await registry.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        await registry.execute(sql.raw(`\n            CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n                name         TEXT PRIMARY KEY,\n                db_name      TEXT NOT NULL UNIQUE,\n                parent_db    TEXT NOT NULL,\n                created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n                metadata     JSONB DEFAULT '{}'\n            );\n        `));\n\n        // Not a collection, so no RLS — and it names every branch database on\n        // this server. The driver's schema-wide grant reaches it, so revoke.\n        await registry.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n    }\n\n    /**\n     * Create a new branch database by templating the source database.\n     *\n     * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n     * of both schema and data.\n     *\n     * @param name   User-facing branch name (e.g., \"feature_auth\")\n     * @param options.source  Source database to clone; defaults to the main database.\n     */\n    async createBranch(\n        name: string,\n        options?: { source?: string; force?: boolean }\n    ): Promise<BranchInfo> {\n        await this.assertBranchingSupported();\n\n        if (options?.source) {\n            validateIdentifier(options.source, \"source database name\");\n        }\n\n        const dbName = toBranchDbName(name);\n        const sourceDb = options?.source || await this.home.database();\n\n        // Check if branch already exists\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n        );\n        if ((existing.rows as unknown[]).length > 0) {\n            throw new Error(`Branch \"${name}\" already exists.`);\n        }\n\n        // Disconnect any idle pools to the source DB so TEMPLATE works.\n        // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n        //\n        // This only reaches pools inside *this* process. The CLI runs as its own\n        // process, so a `rebase dev` holding the database open is untouched by\n        // it — which is why the failure below has to name what is connected, and\n        // why `--force` exists.\n        await this.poolManager.disconnectDatabase(sourceDb);\n\n        // Create the database using the source as a template.\n        // Note: Identifiers must be double-quoted, not parameterized.\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n        const copy = async (): Promise<void> => {\n            await this.db.execute(sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`));\n        };\n        try {\n            if (options?.force) {\n                await this.whileClosedToNewConnections(sourceDb, () => this.disconnectingOthers(sourceDb, copy));\n            } else {\n                await copy();\n            }\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                // The template — not the new database — is the one still in use.\n                throw new Error(\n                    `Cannot create branch: the source database \"${sourceDb}\" ${options?.force\n                        ? \"still had connections after they were disconnected\"\n                        : \"has active connections\"}.\\n`\n                    + await this.describeBlockingConnections(sourceDb, { forced: options?.force === true })\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Record metadata in the registry — asked for again, as copying the\n        // main database closed any pool on it.\n        const now = new Date();\n        await (await this.home.registry()).execute(\n            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)\n                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`\n        );\n\n        return {\n            name,\n            database: dbName,\n            parentDatabase: sourceDb,\n            createdAt: now\n        };\n    }\n\n    /**\n     * Delete a branch database and remove its metadata.\n     * Cannot delete the main/default database.\n     */\n    async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n        await this.assertBranchingSupported();\n\n        assertValidBranchName(name);\n\n        // Safety, first pass: a request that would target the default database\n        // is refused before any metadata is read, so the answer costs nothing\n        // and cannot depend on what a row happens to say.\n        const mainDatabase = await this.home.database();\n        if (toBranchDbName(name) === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Verify the branch exists, and take the database name from the row\n        // rather than deriving it again. A branch created before names stopped\n        // being stripped is recorded as `rb_myfeature` while `my-feature` now\n        // derives `rb_my-feature`; re-deriving would drop a database this row\n        // never named — or, if that name happened to exist, somebody else's.\n        // The stored value is the only one that is true by construction.\n        const existing = await (await this.home.registry()).execute(\n            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n        );\n        const existingRows = existing.rows as Record<string, unknown>[];\n        if (existingRows.length === 0) {\n            throw new Error(`Branch \"${name}\" not found.`);\n        }\n        const dbName = existingRows[0].db_name as string;\n\n        // Safety, second pass: the first checked a name we derived, this checks\n        // the one we are about to drop. They differ for any row written under\n        // the old scheme, and it is this one that governs.\n        if (dbName === mainDatabase) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Disconnect any pools to this branch before dropping. Same limit as\n        // `createBranch`: in-process pools only.\n        await this.poolManager.disconnectDatabase(dbName);\n\n        // Drop the database\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const drop = async (): Promise<void> => {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n        };\n        try {\n            if (options?.force) await this.disconnectingOthers(dbName, drop);\n            else await drop();\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                throw new Error(\n                    `Cannot delete branch \"${name}\": the database ${options?.force\n                        ? \"still had connections after they were disconnected\"\n                        : \"has active connections\"}.\\n`\n                    + await this.describeBlockingConnections(dbName, { forced: options?.force === true })\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Remove metadata\n        await (await this.home.registry()).execute(\n            sql`DELETE FROM rebase.branches WHERE name = ${name}`\n        );\n    }\n\n    /**\n     * Who is holding the database open, in words a developer can act on.\n     *\n     * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n     * other session is connected, and the one thing the old message could not\n     * say is the only thing worth knowing: *which* session. \"Close other\n     * clients or connections and try again\" is advice you cannot follow when\n     * you do not know there is a `rebase dev` in another terminal — and that is\n     * the common case, because wanting a branch and running the app are the\n     * same moment.\n     *\n     * `application_name` is the useful column: node-postgres sends none by\n     * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n     * and psql all name themselves. Counting by it separates \"my own dev\n     * server\" from \"the GUI I forgot about\" without any guessing.\n     *\n     * Best-effort by construction: this runs while reporting a failure, and a\n     * diagnostic that throws would replace a real error with its own.\n     */\n    private async describeBlockingConnections(dbName: string, options: { forced?: boolean } = {}): Promise<string> {\n        try {\n            const result = await this.db.execute(sql`\n                SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n                       count(*)::int AS n\n                  FROM pg_stat_activity\n                 WHERE datname = ${dbName}\n                   AND pid <> pg_backend_pid()\n                 GROUP BY 1\n                 ORDER BY 2 DESC, 1\n            `);\n            const rows = result.rows as Record<string, unknown>[];\n            if (rows.length === 0) {\n                // The blocker went away between the failure and this query, or\n                // it is a session Postgres does not attribute to this database.\n                return \"  Retry — whatever was connected has since disconnected.\";\n            }\n\n            const listed = rows\n                .map((row) => `    ${row.n} × ${String(row.app)}`)\n                .join(\"\\n\");\n\n            // With --force they were disconnected already, and came back: the\n            // one thing left to say is what to stop, not to pass --force.\n            return `  Connected right now:\\n${listed}\\n`\n                + (options.forced\n                    ? \"  They reconnected as fast as they were disconnected. A running `rebase dev` is the\\n\"\n                        + \"  usual one — stop it, then run this again.\"\n                    : \"  A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n                        + \"  disconnect them for you.\");\n        } catch {\n            return options.forced\n                ? \"  Stop the clients connected to it — a running `rebase dev` is the usual one — then run this again.\"\n                : \"  Close other clients and connections, or re-run with --force.\";\n        }\n    }\n\n    /**\n     * Run `operation` with no other session on `dbName`, disconnecting them\n     * first: what `--force` asks for.\n     *\n     * Disconnected, a client that reconnects — a running `rebase dev`'s\n     * realtime listener does — can be back before `CREATE DATABASE … TEMPLATE`\n     * or `DROP DATABASE` counts the sessions, and it failed on one about once\n     * in seven tries, saying to pass the `--force` that had been passed. So a\n     * refusal on a session still connected is retried, disconnecting again, a\n     * few times before it is reported.\n     */\n    private async disconnectingOthers(dbName: string, operation: () => Promise<void>): Promise<void> {\n        for (let attempt = 1; ; attempt++) {\n            const closed = await this.terminateConnections(dbName);\n            if (closed > 0) {\n                // Postgres reports the backend as gone before its slot is\n                // actually free, and the operation then fails on a connection\n                // that no longer exists. A short settle first.\n                await new Promise((resolve) => setTimeout(resolve, 250));\n            }\n            try {\n                await operation();\n                return;\n            } catch (err) {\n                if (attempt >= FORCE_ATTEMPTS || extractPgError(err)?.code !== PG_OBJECT_IN_USE) throw err;\n            }\n        }\n    }\n\n    /**\n     * Run `operation` with `dbName` refusing new connections, and open it\n     * again after, whatever happens.\n     *\n     * A client disconnected from the source — a running `rebase dev` holds a\n     * pool and a realtime listener — cannot then reconnect before the copy has\n     * counted the sessions on it. Postgres refuses `ALLOW_CONNECTIONS false` on\n     * the database a session is connected to, so both statements run from the\n     * server's `postgres` database, and they need the database's owner. Where\n     * either is missing, the retries of {@link disconnectingOthers} are what is\n     * left. A database found closed already — by a run killed before it could\n     * open it — is copied as it is and opened after, like one this run closed.\n     *\n     * Stopped by a signal while closed ({@link REOPEN_ON_SIGNALS}), it opens\n     * the database again before the process exits; a second signal waits for\n     * that rather than cutting it short. One it could not open is named, with\n     * the statement that does. No handler is left installed after the copy.\n     */\n    private async whileClosedToNewConnections(dbName: string, operation: () => Promise<void>): Promise<void> {\n        const safe = dbName.replace(/\"/g, '\"\"');\n        const maintenance = dbName === MAINTENANCE_DATABASE ? null : this.poolManager.getDrizzle(MAINTENANCE_DATABASE);\n        let closed = false;\n        try {\n            if (maintenance) {\n                const state = await maintenance.execute(sql`SELECT datallowconn FROM pg_database WHERE datname = ${dbName}`);\n                const [row] = state.rows as Record<string, unknown>[];\n                if (row?.datallowconn === true) {\n                    await maintenance.execute(sql.raw(`ALTER DATABASE \"${safe}\" ALLOW_CONNECTIONS false`));\n                }\n                closed = row !== undefined;\n            }\n        } catch {\n            // No `postgres` database to run it from, or not the owner.\n        }\n        if (!closed) {\n            await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);\n            await operation();\n            return;\n        }\n\n        let reopening: Promise<void> | undefined;\n        const reopen = (): Promise<void> => {\n            reopening ??= this.reopenToConnections(dbName);\n            return reopening;\n        };\n        let caught: NodeJS.Signals | undefined;\n        const release = (): void => {\n            for (const signal of REOPEN_ON_SIGNALS) process.removeListener(signal, onSignal);\n        };\n        const onSignal = (signal: NodeJS.Signals): void => {\n            if (caught) return;\n            caught = signal;\n            void reopen()\n                .catch((err: unknown) => {\n                    console.error(err instanceof Error ? err.message : String(err));\n                })\n                .finally(() => {\n                    release();\n                    process.kill(process.pid, signal);\n                });\n        };\n        for (const signal of REOPEN_ON_SIGNALS) {\n            try {\n                process.on(signal, onSignal);\n            } catch {\n                // A signal this platform cannot deliver (SIGQUIT on Windows).\n            }\n        }\n        try {\n            await operation();\n        } finally {\n            try {\n                await reopen();\n            } finally {\n                // A caught signal releases them itself, once the database is open.\n                if (!caught) release();\n            }\n        }\n    }\n\n    /** `ALLOW_CONNECTIONS true` again, from the maintenance database, or an error that says how to do it by hand. */\n    private async reopenToConnections(dbName: string): Promise<void> {\n        const statement = reopenStatement(dbName);\n        try {\n            await this.poolManager.getDrizzle(MAINTENANCE_DATABASE).execute(sql.raw(statement));\n        } catch (err) {\n            throw new Error(\n                `\"${dbName}\" was closed to new connections for the copy and could not be opened again ` +\n                `(${extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err)}). ` +\n                `Nothing can connect to it until you run, from another database: ${statement};`\n            );\n        } finally {\n            await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);\n        }\n    }\n\n    /**\n     * Disconnect every other session on a database, and say how many.\n     *\n     * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n     * query leaves the session connected, and a connected session is exactly\n     * what blocks the operation.\n     *\n     * The current backend is excluded — terminating the connection running this\n     * statement would abort the command that asked for it.\n     */\n    private async terminateConnections(dbName: string): Promise<number> {\n        const result = await this.db.execute(sql`\n            SELECT pg_terminate_backend(pid)\n              FROM pg_stat_activity\n             WHERE datname = ${dbName}\n               AND pid <> pg_backend_pid()\n        `);\n\n        return (result.rows as unknown[]).length;\n    }\n\n    /**\n     * Everything prune needs to decide, in two queries.\n     *\n     * Reads the rows and the server's database list rather than joining them,\n     * so the *disagreements* between the two are visible — a row whose database\n     * is gone and a database with no row are the two things prune exists to\n     * find, and a join hides both.\n     */\n    async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n        const rowResult = await (await this.home.registry()).execute(sql.raw(`\n            SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n        `));\n        const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            dbName: row.db_name as string,\n            createdAt: new Date(row.created_at as string)\n        }));\n\n        const dbResult = await this.db.execute(sql`\n            SELECT datname FROM pg_database WHERE NOT datistemplate\n        `);\n        const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n        return { rows, databases };\n    }\n\n    /** Remove a metadata row whose database is already gone. */\n    async forgetBranchRow(name: string): Promise<void> {\n        await (await this.home.registry()).execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n    }\n\n    /**\n     * Drop a database by name, with no metadata row required.\n     *\n     * `deleteBranch` deliberately takes its database name from the row, because\n     * the row is the only value that is true by construction. Prune has the\n     * opposite job — the cases it handles are exactly the ones where row and\n     * database disagree — so it needs to name a database directly. Guarded the\n     * same way regardless: the main database is never droppable.\n     */\n    async dropDatabase(dbName: string): Promise<void> {\n        validateIdentifier(dbName, \"database name\");\n        if (dbName === await this.home.database()) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        await this.poolManager.disconnectDatabase(dbName);\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n        } catch (err) {\n            throw describeBranchDdlError(err, dbName);\n        }\n    }\n\n    /**\n     * List all branches recorded in the metadata table.\n     * Optionally fetches database sizes from pg_database.\n     */\n    async listBranches(): Promise<BranchInfo[]> {\n        const result = await (await this.home.registry()).execute(sql.raw(`\n            SELECT \n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at,\n                pg_database_size(b.db_name) as size_bytes\n            FROM ${BRANCHES_TABLE} b\n            JOIN pg_database d ON d.datname = b.db_name\n            ORDER BY b.created_at DESC\n        `));\n\n        return (result.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n        }));\n    }\n\n    /**\n     * Get info about a specific branch.\n     */\n    async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n        assertValidBranchName(name);\n\n        const result = await (await this.home.registry()).execute(sql`\n            SELECT\n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at\n            FROM rebase.branches b\n            WHERE b.name = ${name}\n        `);\n\n        const rows = result.rows as Record<string, unknown>[];\n        if (rows.length === 0) return undefined;\n\n        const row = rows[0];\n\n        // Attempt to get size — may fail if the DB was externally dropped.\n        // Same reason as `deleteBranch`: the size of a re-derived name is the\n        // size of some other database, or of nothing.\n        let sizeBytes: number | undefined;\n        try {\n            const dbName = row.db_name as string;\n            const sizeResult = await this.db.execute(\n                sql`SELECT pg_database_size(${dbName}) as size_bytes`\n            );\n            const sizeRows = sizeResult.rows as Record<string, unknown>[];\n            if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n                sizeBytes = Number(sizeRows[0].size_bytes);\n            }\n        } catch {\n            // Database might not exist anymore\n        }\n\n        return {\n            name: row.name as string,\n            database: row.db_name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;;AAGzB,IAAM,iBAAiB;;AAGvB,IAAM,uBAAuB;;;;;;;AAQ7B,IAAM,oBAA+C;CAAC;CAAU;CAAU;CAAW;AAAS;;AAG9F,SAAS,gBAAgB,QAAwB;CAC7C,OAAO,mBAAmB,OAAO,QAAQ,MAAM,MAAI,EAAE;AACzD;;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,sBAClB,kBACA,SAAiD,CAAC,GACxB;CAC1B,MAAM,SAA4B;EAAE,UAAU,CAAC;EAAG,QAAQ,CAAC;CAAE;CAC7D,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,QAAQ,mBAAmB,IAAI,SAAS,MAAM,CAAC,CAAC;EAChD,IAAI,WAAW,IAAI;EACnB,iBAAiB,IAAI,SAAS;CAClC,QAAQ;EACJ,OAAO;CACX;CACA,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,SAAS,MAAM,KAAK,KAAK,EAAE,CAAC,CACzE,QAAQ,SAAS,SAAS,MAAM,SAAS,oBAAoB,CAAC,CAAC;CACpE,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,MAAM,SAAS,IAAI,OAAO;EAAE,kBAAkB;EAAgB,yBAAyB;CAAK,CAAC;CAE7F,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;EACA,MAAM,OAAO,QAAQ;CACzB,QAAQ;EACJ,OAAO;CACX;CACA,IAAI;EACA,MAAM,SAAS,MAAM,OAAO,MACxB;;;;;;;;;2BAUA,CAAC,KAAK,CACV;EACA,KAAK,MAAM,EAAE,aAAa,OAAO,MAAM;GACnC,MAAM,YAAY,gBAAgB,OAAO;GACzC,IAAI;IACA,MAAM,OAAO,MAAM,SAAS;IAC5B,OAAO,SAAS,KAAK,OAAO;GAChC,SAAS,KAAK;IACV,OAAO,OAAO,KAAK;KACf,UAAU;KACV,QAAQ,eAAe,GAAG,CAAC,EAAE,WAAW,oBAAoB,GAAG,KAAK,OAAO,GAAG;KAC9E;IACJ,CAAC;GACL;EACJ;CACJ,QAAQ,CAER,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;CACA,OAAO;AACX;;AAGA,SAAgB,wBAAwB,QAAqC;CACzE,OAAO,CACH,GAAG,OAAO,SAAS,KAAK,aACpB,MAAM,SAAS,mIACgC,GACnD,GAAG,OAAO,OAAO,KAAK,EAAE,UAAU,QAAQ,gBACtC,MAAM,SAAS,6HACmB,OAAO,uDAAuD,UAAU,EAAE,CACpH;AACJ;;;;;;;;;AAUA,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAiBA,IAAa,gBAAb,MAA2B;CAUX;CACA;CAVZ;;;;;;;CAQA,YACI,IACA,aACA,MACF;EAHU,KAAA,KAAA;EACA,KAAA,cAAA;EAGR,KAAK,OAAO,QAAQ;GAChB,UAAU,YAAY,YAAY;GAClC,UAAU,YAAY;EAC1B;CACJ;;;;;;;;;;;;;CAcA,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;;;CAQA,MAAM,oBAAsC;EAIxC,MAAM,CAAC,QAAO,OAHQ,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC9C,GAAG,8DACP,EAAA,CACqB;EACrB,OAAO,QAAQ,KAAA,KAAa,QAAQ,IAAI,KAAK,SAAS,MAAM;CAChE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,WAAW,MAAM,KAAK,KAAK,SAAS;EAC1C,MAAM,SAAS,QAAQ,GAAG,oCAAoC;EAE9D,MAAM,SAAS,QAAQ,IAAI,IAAI;yCACE,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,SAAS,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAChF;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,MAAM,KAAK,KAAK,SAAS;EAM7D,KAAK,OAHmB,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,EAAA,CACc,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAIlD,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,MAAM,OAAO,YAA2B;GACpC,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CAAC;EAC/F;EACA,IAAI;GACA,IAAI,SAAS,OACT,MAAM,KAAK,4BAA4B,gBAAgB,KAAK,oBAAoB,UAAU,IAAI,CAAC;QAE/F,MAAM,KAAK;EAEnB,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,IAAI,SAAS,QAC9D,uDACA,yBAAyB,OAC7B,MAAM,KAAK,4BAA4B,UAAU,EAAE,QAAQ,SAAS,UAAU,KAAK,CAAC,CAC1F;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAIA,MAAM,sBAAM,IAAI,KAAK;EACrB,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,EACrE;EAEA,OAAO;GACH;GACA,UAAU;GACV,gBAAgB;GAChB,WAAW;EACf;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,MAAM,eAAe,MAAM,KAAK,KAAK,SAAS;EAC9C,IAAI,eAAe,IAAI,MAAM,cACzB,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,OAHG,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,cACX,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAGhD,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,OAAO,YAA2B;GACpC,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE;EACA,IAAI;GACA,IAAI,SAAS,OAAO,MAAM,KAAK,oBAAoB,QAAQ,IAAI;QAC1D,MAAM,KAAK;EACpB,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,kBAAkB,SAAS,QACnD,uDACA,yBAAyB,OAC7B,MAAM,KAAK,4BAA4B,QAAQ,EAAE,QAAQ,SAAS,UAAU,KAAK,CAAC,CACxF;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAgB,UAAgC,CAAC,GAAoB;EAC3G,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GASX,OAAO,2BANQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAIwB,EAAO,OAClC,QAAQ,SACL,qIAEA;EAEd,QAAQ;GACJ,OAAO,QAAQ,SACT,wGACA;EACV;CACJ;;;;;;;;;;;;CAaA,MAAc,oBAAoB,QAAgB,WAA+C;EAC7F,KAAK,IAAI,UAAU,IAAK,WAAW;GAE/B,IAAI,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;GAE3D,IAAI;IACA,MAAM,UAAU;IAChB;GACJ,SAAS,KAAK;IACV,IAAI,WAAW,kBAAkB,eAAe,GAAG,CAAC,EAAE,SAAS,kBAAkB,MAAM;GAC3F;EACJ;CACJ;;;;;;;;;;;;;;;;;;;CAoBA,MAAc,4BAA4B,QAAgB,WAA+C;EACrG,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAI;EACtC,MAAM,cAAc,WAAW,uBAAuB,OAAO,KAAK,YAAY,WAAW,oBAAoB;EAC7G,IAAI,SAAS;EACb,IAAI;GACA,IAAI,aAAa;IAEb,MAAM,CAAC,QAAO,MADM,YAAY,QAAQ,GAAG,wDAAwD,QAAQ,EAAA,CACvF;IACpB,IAAI,KAAK,iBAAiB,MACtB,MAAM,YAAY,QAAQ,IAAI,IAAI,mBAAmB,KAAK,0BAA0B,CAAC;IAEzF,SAAS,QAAQ,KAAA;GACrB;EACJ,QAAQ,CAER;EACA,IAAI,CAAC,QAAQ;GACT,MAAM,KAAK,YAAY,mBAAmB,oBAAoB;GAC9D,MAAM,UAAU;GAChB;EACJ;EAEA,IAAI;EACJ,MAAM,eAA8B;GAChC,cAAc,KAAK,oBAAoB,MAAM;GAC7C,OAAO;EACX;EACA,IAAI;EACJ,MAAM,gBAAsB;GACxB,KAAK,MAAM,UAAU,mBAAmB,QAAQ,eAAe,QAAQ,QAAQ;EACnF;EACA,MAAM,YAAY,WAAiC;GAC/C,IAAI,QAAQ;GACZ,SAAS;GACT,OAAY,CAAC,CACR,OAAO,QAAiB;IACrB,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAClE,CAAC,CAAC,CACD,cAAc;IACX,QAAQ;IACR,QAAQ,KAAK,QAAQ,KAAK,MAAM;GACpC,CAAC;EACT;EACA,KAAK,MAAM,UAAU,mBACjB,IAAI;GACA,QAAQ,GAAG,QAAQ,QAAQ;EAC/B,QAAQ,CAER;EAEJ,IAAI;GACA,MAAM,UAAU;EACpB,UAAU;GACN,IAAI;IACA,MAAM,OAAO;GACjB,UAAU;IAEN,IAAI,CAAC,QAAQ,QAAQ;GACzB;EACJ;CACJ;;CAGA,MAAc,oBAAoB,QAA+B;EAC7D,MAAM,YAAY,gBAAgB,MAAM;EACxC,IAAI;GACA,MAAM,KAAK,YAAY,WAAW,oBAAoB,CAAC,CAAC,QAAQ,IAAI,IAAI,SAAS,CAAC;EACtF,SAAS,KAAK;GACV,MAAM,IAAI,MACN,IAAI,OAAO,8EACP,eAAe,GAAG,CAAC,EAAE,WAAW,oBAAoB,GAAG,KAAK,OAAO,GAAG,EAAE,qEACT,UAAU,EACjF;EACJ,UAAU;GACN,MAAM,KAAK,YAAY,mBAAmB,oBAAoB;EAClE;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,OAHW,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;oDACzB,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG,4CAA4C,MAAM;CACpG;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,MAAM,KAAK,KAAK,SAAS,GACpC,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAaxC,QAAQ,OAZc,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;;;;;;;mBAOvD,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAY1B,MAAM,QAAO,OAVS,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG;;;;;;;6BAOxC,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;EACJ;CACJ;AACJ"}

package/dist/backup/backup-cli.d.ts

@@ -70,6 +70,13 @@ export declare function parseBackupLine(rawArgs: string[]): arg.Result<{
     "--row-security-role": StringConstructor;
     "-o": string;
 }>;
+/**
+ * Whether a `pg_dump --exclude-schema` pattern matches the `rebase` schema, by
+ * pg_dump's own rules: `*` and `?` are wildcards, an unquoted name is folded
+ * to lower case and a double-quoted one is taken as written, and a
+ * `<database>.<schema>` pattern is matched on its schema.
+ */
+export declare function excludesRebaseSchema(pattern: string): boolean;
 export declare function backupCommand(rawArgs: string[]): Promise<void>;
 /**
  * Parse a `rebase db restore …` line; the one positional is the backup.
@@ -114,11 +121,36 @@ export declare function confirmRestore(opts: {
  * What `db restore` says when the target already holds what the backup
  * creates, and the two ways round it: `--clean` replaces them with the
  * backup's copy, a new database restores beside them.
+ *
+ * `line` is the rest of what the user typed — the database it names, `--yes`,
+ * `--no-owner` — which both commands keep, so the one copied runs against the
+ * same database and does not stop again to ask. `--target-db` goes on the
+ * `--clean` one only: the other names a new database.
  */
-export declare function describeRestoreConflict(target: string, backupArg: string, conflicts: readonly string[]): {
+export declare function describeRestoreConflict(target: string, backupArg: string, conflicts: readonly string[], line?: {
+    targetDb?: string;
+    carried?: readonly string[];
+}): {
     message: string;
     hint: string;
 };
+/**
+ * What `restore --clean` says, before it asks, about what it drops that the
+ * backup does not hold — see `findCleanExtras`. Nothing when there is none.
+ */
+export declare function describeCleanExtras(schemas: readonly string[], extras: readonly string[]): string[];
+/**
+ * What a `restore --clean` that stopped says: it ran as one transaction, so
+ * nothing changed. The cluster roles the sidecar recreated are the exception,
+ * and are said to be.
+ */
+export declare function describeCleanRestoreFailure(target: string, failure: {
+    tool: "pg_restore" | "psql";
+    lockTimeout: boolean;
+}, rolesApplied: number): {
+    message: string;
+    hint?: string;
+};
 export declare function restoreCommand(rawArgs: string[]): Promise<void>;
 /** What `db backups <action>` says of an action it does not have: the sentence every `db` command says. */
 export declare function unknownBackupsAction(action: string): string;

package/dist/backup/backup-service.d.ts

@@ -17,6 +17,24 @@ export { resolvePgBinary };
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */
 export declare function getServerVersionMajor(connectionString: string): Promise<number | null>;
+/**
+ * Put back what a client tool left set on a database that is one session
+ * every connection shares, and do nothing on any other.
+ *
+ * The managed development database is PGlite: one session behind a socket
+ * server, so what `pg_dump` sets for itself — `search_path` emptied,
+ * `row_security` off, `PREPARE dumpEnumType …` — stays set for every client
+ * after it, a running `rebase dev` included. One `rebase db backup` there left
+ * every API request answering 500 "table does not exist", a restart did not
+ * help (the database outlives `rebase dev`), and the next backup failed on
+ * `prepared statement "dumpenumtype" already exists`.
+ *
+ * `RESET ALL` and `DEALLOCATE ALL`, not `DISCARD ALL`: that would also drop
+ * the `LISTEN` a running `rebase dev`'s realtime holds on the same session.
+ * Best effort: it runs after the tool, whose own outcome is what the caller
+ * reports.
+ */
+export declare function resetSharedSession(connectionString: string): Promise<void>;
 export interface PreflightResult extends VersionCompatibility {
     bin: string;
     toolMajor: number | null;
@@ -114,6 +132,56 @@ export declare function restoreDump(opts: {
     inheritStdio?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<void>;
+/**
+ * A `restore --clean` that stopped, and so was rolled back whole.
+ *
+ * `tool` is the one that stopped it: `pg_restore`, writing the dump's script,
+ * or `psql`, running it. `lockTimeout` when what `psql` stopped on was the
+ * wait for a lock — `CLEAN_LOCK_TIMEOUT` in `pg-tools.ts`.
+ */
+export declare class CleanRestoreFailed extends Error {
+    readonly tool: "pg_restore" | "psql";
+    readonly exitCode: number | undefined;
+    readonly lockTimeout: boolean;
+    constructor(tool: "pg_restore" | "psql", exitCode: number | undefined, lockTimeout: boolean);
+}
+/**
+ * Restore a dump over what the database holds, as one transaction:
+ * {@link cleanRestorePrelude} first, then the dump as `pg_restore` writes it
+ * for `psql`, and the `COMMIT` only after the last of it.
+ *
+ * One unit, so it either replaces what the dump holds or changes nothing:
+ * `pg_restore --clean` runs each statement on its own, so the drops it starts
+ * with had all happened when a later one failed — and its plain `DROP SCHEMA
+ * rebase` fails on any table the backup lacks, which left a database with
+ * every table dropped and nothing restored. Here a failure anywhere —
+ * `pg_restore` cannot read the archive, a statement fails, the connection
+ * drops — ends the transaction without a `COMMIT`, and Postgres rolls it back.
+ *
+ * Throws {@link CleanRestoreFailed} when it did not commit.
+ */
+export declare function restoreDumpReplacing(opts: {
+    connectionString: string;
+    inputFile: string;
+    objects: DumpObjects;
+    noOwner?: boolean;
+    inheritStdio?: boolean;
+    env?: Record<string, string | undefined>;
+}): Promise<void>;
+/**
+ * What `restore --clean` drops that the backup does not hold, so it can say
+ * so before it runs: what a schema the backup replaces whole holds that it has
+ * no copy of — tables, views, sequences, functions, procedures, aggregates,
+ * types and domains — and the views and foreign keys elsewhere that reference
+ * one of the relations it replaces. As `<kind> <name>`.
+ *
+ * A function is matched by its name, so an overload the backup lacks beside
+ * one it holds is not named. Sequences a column owns go with their table,
+ * and what an extension owns with the extension, so neither is named.
+ *
+ * None for a database that does not exist yet.
+ */
+export declare function findCleanExtras(connectionString: string, objects: DumpObjects): Promise<string[]>;
 /** The schemas and tables a dump creates, from `pg_restore --list`. See {@link parseDumpObjects}. */
 export declare function readDumpObjects(inputFile: string, env?: Record<string, string | undefined>): Promise<DumpObjects>;
 /**

package/dist/backup/pg-binary.d.ts

@@ -1,5 +1,5 @@
-export type PgTool = "pg_dump" | "pg_restore" | "pg_dumpall";
+export type PgTool = "pg_dump" | "pg_restore" | "pg_dumpall" | "psql";
 /** The variable that points at `tool` when it is not on the PATH. */
 export declare function pgToolVariable(tool: PgTool): string;
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall` / `psql`, honouring an env override. */
 export declare function resolvePgBinary(tool: PgTool, env?: Record<string, string | undefined>): string | null;

package/dist/backup/pg-tools.d.ts

@@ -168,6 +168,25 @@ export interface DumpObjects {
         schema: string;
         table: string;
     }[];
+    /**
+     * Every relation it creates — tables, views, materialized views, foreign
+     * tables and sequences — by schema and name: what `restore --clean` can
+     * tell apart from what the target holds besides.
+     */
+    relations: {
+        schema: string;
+        name: string;
+    }[];
+    /** Every function, procedure and aggregate it creates, by schema and name: an overloaded name once for each. */
+    routines: {
+        schema: string;
+        name: string;
+    }[];
+    /** Every type it creates — enum, composite, range — and every domain, by schema and name. */
+    types: {
+        schema: string;
+        name: string;
+    }[];
 }
 /**
  * The schemas and tables in `pg_restore --list` output: the objects a
@@ -176,9 +195,49 @@ export interface DumpObjects {
  * A TOC line ends in the object's owner, after its namespace and its name;
  * a schema's namespace is `-`. The name is what lies between the two, so a
  * name with a space in it (`Odd Name`) reads whole. `TABLE DATA` and every
- * other kind of entry are not objects of their own here.
+ * other kind of entry are not objects of their own here. Its relations,
+ * functions and types are read too, for what `restore --clean` would drop
+ * that the dump does not hold (`findCleanExtras`).
  */
 export declare function parseDumpObjects(list: string): DumpObjects;
+/**
+ * How long `restore --clean` waits for a lock before it gives up.
+ *
+ * A `rebase dev` serving from the database holds connections, and one inside a
+ * transaction would otherwise make the restore wait without a word. The dump's
+ * own script sets `lock_timeout = 0` after this, for the objects it creates.
+ */
+export declare const CLEAN_LOCK_TIMEOUT = "15s";
+/**
+ * What `restore --clean` runs first, in the transaction the restore runs in:
+ * every schema the dump creates, dropped with `CASCADE`, and every table it
+ * creates in a schema it does not (`public`), the same.
+ *
+ * `CASCADE`, which `pg_restore --clean` never uses: a table the backup lacks
+ * in one of its schemas — `rebase.atlas_schema_revisions` from `rebase db
+ * migrate`, a table a newer runtime added — is exactly what stopped its plain
+ * `DROP SCHEMA rebase`, and a table that references one of the backup's is what
+ * stops a plain `DROP TABLE`. The dump's script follows, with its own `DROP …
+ * IF EXISTS` for everything else it creates.
+ */
+export declare function cleanRestorePrelude(objects: DumpObjects): string[];
+/**
+ * `pg_restore` writing the dump as a SQL script on stdout, with the `DROP …
+ * IF EXISTS` that `--clean` adds, for `psql` to run. See {@link buildPsqlScriptArgs}.
+ */
+export declare function buildPgRestoreScriptArgs(opts: {
+    inputFile: string;
+    noOwner?: boolean;
+}): string[];
+/**
+ * `psql` running a script read from stdin, stopping at its first error.
+ *
+ * `-X`, so no `.psqlrc` changes what runs; `-q`, so it prints errors and
+ * warnings, not a command tag per statement. The transaction is the script's
+ * own: `restore --clean` writes the `BEGIN`, and the `COMMIT` only once
+ * `pg_restore` has written the whole dump.
+ */
+export declare function buildPsqlScriptArgs(connectionString: string): string[];
 /**
  * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
  * cluster-wide objects) live outside any single database, so a per-database