@rebasepro/server-postgres 0.25.0-canary.ge06257e → 0.25.0

package/dist/{backup-cli-HCEkPcQj.js → backup-cli-B2CAn9fR.js}

@@ -1,10 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { $ as redactConnectionPasswords, t as checkDatabaseConnectivity } from "./cli-errors-mx4sSjB8.js";
-import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DB6xJv3p.js";
-import { A as parseBackupDestination, F as resolveConnectionString, M as parseDbNameFromUrl, O as globalsFileForDump, R as withDatabaseName, c as findRestoreConflicts, d as preflight, g as validateDump, h as uploadBackup, i as createDump, m as restoreDump, n as applyGlobals, o as discardPartialDump, p as readDumpObjects, s as ensureDatabaseExists, t as BackupToolError, u as listBackups } from "./backup-service-D-UpT7DH.js";
+import { et as redactConnectionPasswords, t as checkDatabaseConnectivity } from "./cli-errors-DwQnNATs.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "./source-Bv5KPeIx.js";
+import { B as parseDbNameFromUrl, I as globalsFileForDump, K as withDatabaseName, R as parseBackupDestination, S as resolvePgBinary, U as resolveConnectionString, _ as restoreDump, a as createDump, b as validateDump, c as ensureDatabaseExists, f as listBackups, h as readDumpObjects, l as findCleanExtras, n as CleanRestoreFailed, p as preflight, r as applyGlobals, s as discardPartialDump, t as BackupToolError, u as findRestoreConflicts, v as restoreDumpReplacing, y as uploadBackup } from "./backup-service-Bb39plam.js";
 import { t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
-import { a as parseCommandFlags, r as closestWord } from "./cli-flags-DUozBFyK.js";
+import { a as parseCommandFlags, r as closestWord } from "./cli-flags-D-b0qL9T.js";
 import path from "path";
 import fs from "fs";
 import os from "os";
@@ -124,8 +124,29 @@ function parseBackupLine(rawArgs) {
 	const args = parseCommandFlags(BACKUP_FLAGS, rawArgs.slice(2), "db backup");
 	const [stray] = args._;
 	if (stray !== void 0) throw new Error(`\`rebase db backup\` takes no argument "${stray}". Nothing was run. To choose where the backup goes, pass --out ${stray}.`);
+	const dropsRebase = (args["--exclude-schema"] ?? []).find(excludesRebaseSchema);
+	if (dropsRebase !== void 0) throw new Error(`--exclude-schema ${dropsRebase} leaves out the rebase schema, and a backup without it cannot be restored: it holds the users, roles and the functions every policy calls. Nothing was run.`);
 	return args;
 }
+/**
+* Whether a `pg_dump --exclude-schema` pattern matches the `rebase` schema, by
+* pg_dump's own rules: `*` and `?` are wildcards, an unquoted name is folded
+* to lower case and a double-quoted one is taken as written, and a
+* `<database>.<schema>` pattern is matched on its schema.
+*/
+function excludesRebaseSchema(pattern) {
+	let source = "";
+	let quoted = false;
+	for (const char of pattern) if (char === "\"") quoted = !quoted;
+	else if (char === "." && !quoted) source = "";
+	else if (char === "*" && !quoted) source += ".*";
+	else if (char === "?" && !quoted) source += ".";
+	else {
+		const literal = quoted ? char : char.toLowerCase();
+		source += literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	}
+	return new RegExp(`^(?:${source})$`).test("rebase");
+}
 async function backupCommand(rawArgs) {
 	if (rawArgs.includes("--help")) {
 		printBackupHelp();
@@ -259,11 +280,48 @@ var CONFLICTS_NAMED = 5;
 * What `db restore` says when the target already holds what the backup
 * creates, and the two ways round it: `--clean` replaces them with the
 * backup's copy, a new database restores beside them.
+*
+* `line` is the rest of what the user typed — the database it names, `--yes`,
+* `--no-owner` — which both commands keep, so the one copied runs against the
+* same database and does not stop again to ask. `--target-db` goes on the
+* `--clean` one only: the other names a new database.
+*/
+function describeRestoreConflict(target, backupArg, conflicts, line = {}) {
+	const named = conflicts.slice(0, CONFLICTS_NAMED).join(", ");
+	const more = conflicts.length > CONFLICTS_NAMED ? `, and ${conflicts.length - CONFLICTS_NAMED} more` : "";
+	const carried = line.carried?.length ? ` ${line.carried.join(" ")}` : "";
+	const sameTarget = line.targetDb ? ` --target-db ${line.targetDb}` : "";
+	return {
+		message: `"${target}" already holds ${named}${more}, which this backup creates. Without --clean, pg_restore stops at the first of them. Nothing was restored or changed.`,
+		hint: [`To replace them with the backup's copy:  rebase db restore ${backupArg}${sameTarget} --clean${carried}`, `To restore beside them, in a new database:  rebase db restore ${backupArg} --create-db --target-db <new name>${carried}`].join("\n    ")
+	};
+}
+/** How many of the objects `--clean` drops beyond the backup's own it names before counting the rest. */
+var EXTRAS_NAMED = 10;
+/**
+* What `restore --clean` says, before it asks, about what it drops that the
+* backup does not hold — see `findCleanExtras`. Nothing when there is none.
+*/
+function describeCleanExtras(schemas, extras) {
+	if (extras.length === 0) return [];
+	const replaced = schemas.filter((schema) => schema !== "public");
+	return [
+		replaced.length > 0 ? `--clean replaces ${replaced.length === 1 ? "schema" : "schemas"} ${replaced.join(", ")} whole, so it also drops what this backup does not hold:` : "--clean also drops what this backup does not hold:",
+		...extras.slice(0, EXTRAS_NAMED).map((extra) => `  ${extra}`),
+		...extras.length > EXTRAS_NAMED ? [`  and ${extras.length - EXTRAS_NAMED} more`] : []
+	];
+}
+/**
+* What a `restore --clean` that stopped says: it ran as one transaction, so
+* nothing changed. The cluster roles the sidecar recreated are the exception,
+* and are said to be.
 */
-function describeRestoreConflict(target, backupArg, conflicts) {
+function describeCleanRestoreFailure(target, failure, rolesApplied) {
+	const why = failure.tool === "pg_restore" ? "pg_restore could not read the whole backup" : failure.lockTimeout ? `it waited too long for a lock on "${target}"` : "a statement failed";
+	const hints = [...failure.lockTimeout ? ["Something holds a lock on it — usually a `rebase dev` serving from it. Stop that, then restore again."] : [], ...rolesApplied > 0 ? [`The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay.`] : []];
 	return {
-		message: `"${target}" already holds ${conflicts.slice(0, CONFLICTS_NAMED).join(", ")}${conflicts.length > CONFLICTS_NAMED ? `, and ${conflicts.length - CONFLICTS_NAMED} more` : ""}, which this backup creates. Without --clean, pg_restore stops at the first of them. Nothing was restored or changed.`,
-		hint: [`To replace them with the backup's copy:  rebase db restore ${backupArg} --clean`, `To restore beside them, in a new database:  rebase db restore ${backupArg} --create-db --target-db <new name>`].join("\n    ")
+		message: `Nothing was restored or changed: the restore ran as one transaction, and it was rolled back when ${why} (above). "${target}" holds what it held before.`,
+		hint: hints.length > 0 ? hints.join("\n    ") : void 0
 	};
 }
 async function restoreCommand(rawArgs) {
@@ -312,13 +370,31 @@ async function restoreCommand(rawArgs) {
 		const pf = await preflight("pg_restore", baseConnection);
 		if (!pf.compatible) throw new BackupToolError(pf.reason ?? "pg_restore cannot restore into this server.");
 		if (args["--create-db"] && !targetDb) throw new BackupToolError("--create-db requires a resolvable target database name (use --target-db).");
+		const objects = await readDumpObjects(localFile);
 		if (!args["--clean"]) {
-			const conflicts = await findRestoreConflicts(targetConnection, await readDumpObjects(localFile));
+			const conflicts = await findRestoreConflicts(targetConnection, objects);
 			if (conflicts.length > 0) {
-				const { message, hint } = describeRestoreConflict(targetDb ?? "the target database", backupArg, conflicts);
+				const { message, hint } = describeRestoreConflict(targetDb ?? "the target database", backupArg, conflicts, {
+					targetDb: args["--target-db"],
+					carried: [
+						...args["--database-url"] ? ["--database-url", `"${args["--database-url"]}"`] : [],
+						...args["--docker"] ? ["--docker"] : [],
+						...args["--no-owner"] ? ["--no-owner"] : [],
+						...args["--yes"] ? ["--yes"] : []
+					]
+				});
 				throw new BackupToolError(message, hint);
 			}
 		}
+		const replacing = args["--clean"] === true && args["--continue-on-error"] !== true;
+		if (replacing) {
+			if (!resolvePgBinary("psql")) throw new BackupToolError("Could not find the 'psql' binary, which runs a --clean restore as one transaction. Nothing was restored or changed.", "Install the PostgreSQL client tools (they ship psql beside pg_restore), or set PSQL_PATH to its full path.");
+			const extras = describeCleanExtras(objects.schemas, await findCleanExtras(targetConnection, objects));
+			if (extras.length > 0) {
+				outWarn(chalk.yellow(`  ⚠️  ${extras[0]}`));
+				for (const extra of extras.slice(1)) outWarn(chalk.yellow(`     ${extra}`));
+			}
+		}
 		if (!await confirmRestore({
 			target: targetDb ?? "the target database",
 			yes: args["--yes"] === true,
@@ -344,7 +420,14 @@ async function restoreCommand(rawArgs) {
 			outWarn(chalk.yellow("     will fail — recreate those roles first, or use a backup that includes its globals."));
 		}
 		try {
-			await restoreDump({
+			if (replacing) await restoreDumpReplacing({
+				connectionString: targetConnection,
+				inputFile: localFile,
+				objects,
+				noOwner: args["--no-owner"],
+				inheritStdio: true
+			});
+			else await restoreDump({
 				connectionString: targetConnection,
 				inputFile: localFile,
 				clean: args["--clean"],
@@ -354,6 +437,10 @@ async function restoreCommand(rawArgs) {
 			});
 		} catch (err) {
 			if (err instanceof BackupToolError) throw err;
+			if (err instanceof CleanRestoreFailed) {
+				const { message, hint } = describeCleanRestoreFailure(targetDb ?? "the target database", err, rolesApplied);
+				throw new BackupToolError(message, hint);
+			}
 			throw new BackupToolError(`pg_restore stopped on the error above. What it restored before that stays in "${targetDb ?? "the target database"}".`, rolesApplied > 0 ? `The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay too.` : void 0);
 		}
 		out("");
@@ -483,7 +570,8 @@ ${chalk.green.bold("Usage")}
 
 ${chalk.green.bold("Options")}
   ${chalk.blue("--out, -o")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)
-  ${chalk.blue("--exclude-schema")} <s>    Exclude a schema (repeatable)
+  ${chalk.blue("--exclude-schema")} <s>    Exclude a schema (repeatable). Never rebase: a backup
+                             without it cannot be restored
   ${chalk.blue("--no-owner")}              Omit ownership commands from the dump
   ${chalk.blue("--enable-row-security")}   Dump as an admin subject instead of failing on RLS
                              ${chalk.red("(may produce a partial dump — see below)")}
@@ -522,7 +610,8 @@ ${chalk.green.bold("Arguments")}
 ${chalk.green.bold("Options")}
   ${chalk.blue("--target-db")} <name>      Restore into this database instead of DATABASE_URL's
   ${chalk.blue("--create-db")}             Create the target database first if it doesn't exist
-  ${chalk.blue("--clean")}                 Drop existing objects before recreating them
+  ${chalk.blue("--clean")}                 Replace what the backup holds, in one transaction with
+                             the restore (runs the dump through psql)
   ${chalk.blue("--no-owner")}              Ignore ownership from the dump
   ${chalk.blue("--continue-on-error")}     Log and continue past errors ${chalk.red("(may leave RLS un-enforced!)")}
   ${chalk.blue("--yes, -y")}               Skip the interactive confirmation ${chalk.red("(destructive!)")}
@@ -533,7 +622,9 @@ ${chalk.red.bold("Warning")}
   refuses. Prefer --create-db/--target-db to restore into a fresh database
   rather than overwriting a live one. Into a database that already holds
   what the backup creates, it needs --clean, and refuses before changing
-  anything without it.
+  anything without it. --clean drops each schema the backup creates whole,
+  with what it holds that the backup does not (it names those first), and
+  restores in the same transaction: a restore that stops changes nothing.
 
   By default the restore aborts on the first error (--exit-on-error) so a
   skipped GRANT never silently leaves RLS un-enforced. Roles are recreated
@@ -553,4 +644,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-HCEkPcQj.js.map
+//# sourceMappingURL=backup-cli-B2CAn9fR.js.map

package/dist/backup-cli-B2CAn9fR.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-cli-B2CAn9fR.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport type arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport { Readable } from \"stream\";\nimport { pipeline } from \"stream/promises\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport { closestWord, parseCommandFlags } from \"../cli-flags\";\nimport { redactConnectionPasswords } from \"../utils/connection-string\";\nimport { promptConfirm } from \"../cli-prompt\";\nimport { checkDatabaseConnectivity } from \"../cli-errors\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    CleanRestoreFailed,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    findCleanExtras,\n    findRestoreConflicts,\n    listBackups,\n    preflight,\n    readDumpObjects,\n    restoreDump,\n    restoreDumpReplacing,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\nimport { resolvePgBinary } from \"./pg-binary\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/** A web stream's chunks, for piping into a file. */\nasync function* webChunks(stream: ReadableStream<Uint8Array>): AsyncGenerator<Uint8Array> {\n    const reader = stream.getReader();\n    try {\n        for (;;) {\n            const { done, value } = await reader.read();\n            if (done) return;\n            yield value;\n        }\n    } finally {\n        reader.releaseLock();\n    }\n}\n\n/**\n * The controller for an object-storage destination, or `null` for a local one.\n *\n * Built by `backupStorageFromEnv` from `@rebasepro/server` — the function the\n * Backups panel's routes use — so the CLI and the panel read a bucket the same\n * way. This file had its own copy, and the two had already drifted once\n * (`S3_FORCE_PATH_STYLE` read as `=== \"true\"`, so a MinIO backup addressed the\n * bucket as a host).\n *\n * Exported for its test.\n */\nexport async function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    const { backupStorageFromEnv } = await import(\"@rebasepro/server\");\n    try {\n        return backupStorageFromEnv(dest, env);\n    } catch (error) {\n        throw new BackupToolError(\n            error instanceof Error ? error.message : String(error),\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n}\n\n/**\n * The directory `rebase` was run from, which `rebase` puts here for the driver.\n *\n * The driver runs in the project's `backend/`, so a relative path resolved\n * against its own working directory named a different place from the one the\n * user typed it in: `rebase db backup --out ./backups` wrote to `<root>/backups`\n * (the CLI resolves explicit paths itself) while `rebase db backups list`\n * looked in `<root>/backend/backups`. Spelled the same in\n * `packages/cli/src/commands/db.ts`.\n */\nexport const INVOCATION_CWD_ENV = \"REBASE_INVOCATION_CWD\";\n\n/** Where a relative path the user typed is relative to: where they ran `rebase`. */\nexport function invocationDir(env: Readonly<Record<string, string | undefined>> = process.env): string {\n    const dir = env[INVOCATION_CWD_ENV]?.trim();\n    return dir && path.isAbsolute(dir) ? dir : process.cwd();\n}\n\n/**\n * Where `db backup` writes and `db backups list` reads, by one rule.\n *\n * - `--out` is relative to where `rebase` was run, like any path typed on a\n *   command line.\n * - `BACKUP_DESTINATION` is relative to the backend directory, because the\n *   server reads the same variable there: the Backups panel and the scheduled\n *   backup have to find what the CLI wrote.\n * - With neither, `./backups` where `rebase` was run, as the help says.\n *\n * An `s3://` or `gs://` destination is returned as given.\n */\nexport function resolveBackupLocation(opts: {\n    flag?: string;\n    configured?: string;\n    invocationDir: string;\n    backendDir: string;\n}): string {\n    const flag = opts.flag?.trim();\n    if (flag) return isRemoteDestination(flag) ? flag : path.resolve(opts.invocationDir, flag);\n    const configured = opts.configured?.trim();\n    if (configured) return isRemoteDestination(configured) ? configured : path.resolve(opts.backendDir, configured);\n    return path.join(opts.invocationDir, \"backups\");\n}\n\nfunction isRemoteDestination(value: string): boolean {\n    return parseBackupDestination(value).kind !== \"local\";\n}\n\n/** {@link resolveBackupLocation} for this process. */\nfunction backupLocation(flag: string | undefined): string {\n    return resolveBackupLocation({\n        flag,\n        configured: process.env.BACKUP_DESTINATION,\n        invocationDir: invocationDir(),\n        backendDir: process.cwd()\n    });\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nconst BACKUP_FLAGS = {\n    \"--out\": String,\n    // The same alias `build` and `cloud env pull` carry. `--output` is the\n    // canonical spelling in this CLI, and `rebase db backup --output ./backups`\n    // has to write there.\n    \"--output\": \"--out\",\n    \"--exclude-schema\": [String],\n    \"--no-owner\": Boolean,\n    \"--enable-row-security\": Boolean,\n    \"--row-security-role\": String,\n    \"-o\": \"--out\"\n} satisfies arg.Spec;\n\n/**\n * Parse a `rebase db backup …` line. An undeclared flag is refused (see\n * `parseCommandFlags`), and so is a positional: `rebase db backup ./backups`\n * means `--out ./backups`, and taken as nothing it wrote to the default\n * directory.\n */\nexport function parseBackupLine(rawArgs: string[]) {\n    const args = parseCommandFlags(BACKUP_FLAGS, rawArgs.slice(2), \"db backup\");\n    const [stray] = args._;\n    if (stray !== undefined) {\n        throw new Error(\n            `\\`rebase db backup\\` takes no argument \"${stray}\". Nothing was run. ` +\n            `To choose where the backup goes, pass --out ${stray}.`\n        );\n    }\n    const dropsRebase = (args[\"--exclude-schema\"] ?? []).find(excludesRebaseSchema);\n    if (dropsRebase !== undefined) {\n        throw new Error(\n            `--exclude-schema ${dropsRebase} leaves out the rebase schema, and a backup without it cannot be restored: ` +\n            \"it holds the users, roles and the functions every policy calls. Nothing was run.\"\n        );\n    }\n    return args;\n}\n\n/**\n * Whether a `pg_dump --exclude-schema` pattern matches the `rebase` schema, by\n * pg_dump's own rules: `*` and `?` are wildcards, an unquoted name is folded\n * to lower case and a double-quoted one is taken as written, and a\n * `<database>.<schema>` pattern is matched on its schema.\n */\nexport function excludesRebaseSchema(pattern: string): boolean {\n    let source = \"\";\n    let quoted = false;\n    for (const char of pattern) {\n        if (char === \"\\\"\") {\n            quoted = !quoted;\n        } else if (char === \".\" && !quoted) {\n            // What came before was the database: the schema is what follows.\n            source = \"\";\n        } else if (char === \"*\" && !quoted) {\n            source += \".*\";\n        } else if (char === \"?\" && !quoted) {\n            source += \".\";\n        } else {\n            const literal = quoted ? char : char.toLowerCase();\n            source += literal.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n        }\n    }\n    return new RegExp(`^(?:${source})$`).test(\"rebase\");\n}\n\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    if (rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n    const args = parseBackupLine(rawArgs);\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = backupLocation(args[\"--out\"]);\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // A database that is not running is said the way `db push` says it — the\n    // host, the port and what to start — before pg_dump's version probe meets\n    // it as a bare `connect ECONNREFUSED`.\n    await checkDatabaseConnectivity(connectionString);\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nconst RESTORE_FLAGS = {\n    \"--target-db\": String,\n    \"--create-db\": Boolean,\n    \"--clean\": Boolean,\n    \"--no-owner\": Boolean,\n    \"--continue-on-error\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\"\n} satisfies arg.Spec;\n\n/**\n * Parse a `rebase db restore …` line; the one positional is the backup.\n *\n * Strict, because this is the command where a typo costs most: parsed\n * permissively, `--targt-db x` became a second positional, the target fell\n * back to DATABASE_URL's own database, and the restore ran against the live\n * one.\n */\nexport function parseRestoreLine(rawArgs: string[]) {\n    const args = parseCommandFlags(RESTORE_FLAGS, rawArgs.slice(2), \"db restore\");\n    if (args._.length > 1) {\n        throw new Error(\n            `\\`rebase db restore\\` restores one backup, and was given ${args._.length}: ` +\n            `${args._.map(word => `\"${word}\"`).join(\", \")}. Nothing was run.`\n        );\n    }\n    return args;\n}\n\n/**\n * The restore's one question, asked before anything can change.\n *\n * `--yes` skips it. On a terminal it asks for a typed 'yes'. With no terminal\n * nobody can answer, and the refusal says to pass `--yes`, as `db reset`,\n * `db pull` and `db branch prune` do: \"Aborted. No changes were made.\" alone\n * read as though someone had answered no.\n *\n * @returns whether to go on. When not, it has said why.\n */\nexport async function confirmRestore(opts: {\n    target: string;\n    yes: boolean;\n    interactive: boolean;\n    ask: (question: string) => Promise<boolean>;\n}): Promise<boolean> {\n    if (opts.yes) return true;\n    outWarn(chalk.yellow(`  ⚠️  This will restore into \"${opts.target}\" and may overwrite existing data.`));\n    if (!opts.interactive) {\n        outError(chalk.red(\"  ✗ Nothing was restored: there is no terminal to confirm on.\"));\n        outError(chalk.gray(`    Re-run with --yes to restore into \"${opts.target}\".`));\n        return false;\n    }\n    const confirmed = await opts.ask(chalk.yellow(\"     Type 'yes' to continue: \"));\n    if (!confirmed) print(chalk.gray(\"  Aborted. No changes were made.\"));\n    return confirmed;\n}\n\n/** How many of the conflicting objects a refusal names before counting the rest. */\nconst CONFLICTS_NAMED = 5;\n\n/**\n * What `db restore` says when the target already holds what the backup\n * creates, and the two ways round it: `--clean` replaces them with the\n * backup's copy, a new database restores beside them.\n *\n * `line` is the rest of what the user typed — the database it names, `--yes`,\n * `--no-owner` — which both commands keep, so the one copied runs against the\n * same database and does not stop again to ask. `--target-db` goes on the\n * `--clean` one only: the other names a new database.\n */\nexport function describeRestoreConflict(\n    target: string,\n    backupArg: string,\n    conflicts: readonly string[],\n    line: { targetDb?: string; carried?: readonly string[] } = {}\n): { message: string; hint: string } {\n    const named = conflicts.slice(0, CONFLICTS_NAMED).join(\", \");\n    const more = conflicts.length > CONFLICTS_NAMED ? `, and ${conflicts.length - CONFLICTS_NAMED} more` : \"\";\n    const carried = line.carried?.length ? ` ${line.carried.join(\" \")}` : \"\";\n    const sameTarget = line.targetDb ? ` --target-db ${line.targetDb}` : \"\";\n    return {\n        message: `\"${target}\" already holds ${named}${more}, which this backup creates. ` +\n            \"Without --clean, pg_restore stops at the first of them. Nothing was restored or changed.\",\n        hint: [\n            `To replace them with the backup's copy:  rebase db restore ${backupArg}${sameTarget} --clean${carried}`,\n            `To restore beside them, in a new database:  rebase db restore ${backupArg} --create-db --target-db <new name>${carried}`\n        ].join(\"\\n    \")\n    };\n}\n\n/** How many of the objects `--clean` drops beyond the backup's own it names before counting the rest. */\nconst EXTRAS_NAMED = 10;\n\n/**\n * What `restore --clean` says, before it asks, about what it drops that the\n * backup does not hold — see `findCleanExtras`. Nothing when there is none.\n */\nexport function describeCleanExtras(schemas: readonly string[], extras: readonly string[]): string[] {\n    if (extras.length === 0) return [];\n    const replaced = schemas.filter((schema) => schema !== \"public\");\n    const lead = replaced.length > 0\n        ? `--clean replaces ${replaced.length === 1 ? \"schema\" : \"schemas\"} ${replaced.join(\", \")} whole, so it also drops what this backup does not hold:`\n        : \"--clean also drops what this backup does not hold:\";\n    return [\n        lead,\n        ...extras.slice(0, EXTRAS_NAMED).map((extra) => `  ${extra}`),\n        ...(extras.length > EXTRAS_NAMED ? [`  and ${extras.length - EXTRAS_NAMED} more`] : [])\n    ];\n}\n\n/**\n * What a `restore --clean` that stopped says: it ran as one transaction, so\n * nothing changed. The cluster roles the sidecar recreated are the exception,\n * and are said to be.\n */\nexport function describeCleanRestoreFailure(\n    target: string,\n    failure: { tool: \"pg_restore\" | \"psql\"; lockTimeout: boolean },\n    rolesApplied: number\n): { message: string; hint?: string } {\n    const why = failure.tool === \"pg_restore\"\n        ? \"pg_restore could not read the whole backup\"\n        : failure.lockTimeout\n            ? `it waited too long for a lock on \"${target}\"`\n            : \"a statement failed\";\n    const hints = [\n        ...(failure.lockTimeout\n            ? [\"Something holds a lock on it — usually a `rebase dev` serving from it. Stop that, then restore again.\"]\n            : []),\n        ...(rolesApplied > 0\n            ? [`The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay.`]\n            : [])\n    ];\n    return {\n        message: `Nothing was restored or changed: the restore ran as one transaction, and it was rolled back when ${why} (above). ` +\n            `\"${target}\" holds what it held before.`,\n        hint: hints.length > 0 ? hints.join(\"\\n    \") : undefined\n    };\n}\n\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    if (rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        return;\n    }\n    const args = parseRestoreLine(rawArgs);\n\n    const backupArg = args._[0];\n    if (!backupArg) {\n        printRestoreHelp();\n        process.exit(1);\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db swaps the database\n    // name so the live one isn't clobbered. Without it the target is\n    // DATABASE_URL's own database, and `--create-db` only creates it when it is\n    // missing.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Before anything is downloaded, and in `db push`'s words: see backupCommand.\n    await checkDatabaseConnectivity(baseConnection);\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            cleanupTemp = true;\n            // Streamed to disk: buffered, a dump was held twice in memory and\n            // one over 2 GiB could not be written in one call at all.\n            const object = storage.getObjectStream\n                ? await storage.getObjectStream(key, { bucket })\n                : await storage.getObject(key, bucket).then((file) => file && { stream: file.stream() });\n            if (!object) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            await pipeline(Readable.from(webChunks(object.stream)), fs.createWriteStream(localFile));\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(invocationDir(), backupArg);\n            if (!fs.existsSync(localFile)) throw new BackupToolError(`Backup file not found: ${localFile}`);\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        // Thrown, not exited, from here down: an exit skipped the `finally`\n        // that removes a dump downloaded from object storage.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) throw new BackupToolError(pf.reason ?? \"pg_restore cannot restore into this server.\");\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            throw new BackupToolError(\"--create-db requires a resolvable target database name (use --target-db).\");\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        // Before the question and before anything is applied, roles included:\n        // without --clean, pg_restore stops at the first object the target\n        // already has, and said so in its own words and execa's, after the\n        // roles had run. A target that does not exist yet holds nothing.\n        const objects = await readDumpObjects(localFile);\n        if (!args[\"--clean\"]) {\n            const conflicts = await findRestoreConflicts(targetConnection, objects);\n            if (conflicts.length > 0) {\n                const { message, hint } = describeRestoreConflict(targetDb ?? \"the target database\", backupArg, conflicts, {\n                    targetDb: args[\"--target-db\"],\n                    carried: [\n                        ...(args[\"--database-url\"] ? [\"--database-url\", `\"${args[\"--database-url\"]}\"`] : []),\n                        ...(args[\"--docker\"] ? [\"--docker\"] : []),\n                        ...(args[\"--no-owner\"] ? [\"--no-owner\"] : []),\n                        ...(args[\"--yes\"] ? [\"--yes\"] : [])\n                    ]\n                });\n                throw new BackupToolError(message, hint);\n            }\n        }\n\n        // `--clean` replaces the backup's schemas whole, in one transaction\n        // with the restore — see `restoreDumpReplacing`. `--continue-on-error`\n        // asks for the opposite of one transaction, and gets pg_restore's own\n        // `--clean`, statement by statement, as it asked.\n        const replacing = args[\"--clean\"] === true && args[\"--continue-on-error\"] !== true;\n        if (replacing) {\n            if (!resolvePgBinary(\"psql\")) {\n                throw new BackupToolError(\n                    \"Could not find the 'psql' binary, which runs a --clean restore as one transaction. Nothing was restored or changed.\",\n                    \"Install the PostgreSQL client tools (they ship psql beside pg_restore), or set PSQL_PATH to its full path.\"\n                );\n            }\n            const extras = describeCleanExtras(objects.schemas, await findCleanExtras(targetConnection, objects));\n            if (extras.length > 0) {\n                outWarn(chalk.yellow(`  ⚠️  ${extras[0]}`));\n                for (const extra of extras.slice(1)) outWarn(chalk.yellow(`     ${extra}`));\n            }\n        }\n\n        const confirmed = await confirmRestore({\n            target: targetDb ?? \"the target database\",\n            yes: args[\"--yes\"] === true,\n            interactive: process.stdin.isTTY === true,\n            ask: promptConfirm\n        });\n        if (!confirmed) {\n            // An exit code, so the `finally` still removes a downloaded dump.\n            process.exitCode = 1;\n            return;\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        let rolesApplied = 0;\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            rolesApplied = applied;\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        try {\n            if (replacing) {\n                await restoreDumpReplacing({\n                    connectionString: targetConnection,\n                    inputFile: localFile,\n                    objects,\n                    noOwner: args[\"--no-owner\"],\n                    inheritStdio: true\n                });\n            } else {\n                await restoreDump({\n                    connectionString: targetConnection,\n                    inputFile: localFile,\n                    clean: args[\"--clean\"],\n                    noOwner: args[\"--no-owner\"],\n                    // Fail loudly by default so a skipped GRANT never leaves RLS off.\n                    exitOnError: !args[\"--continue-on-error\"],\n                    inheritStdio: true\n                });\n            }\n        } catch (err) {\n            if (err instanceof BackupToolError) throw err;\n            if (err instanceof CleanRestoreFailed) {\n                const { message, hint } = describeCleanRestoreFailure(targetDb ?? \"the target database\", err, rolesApplied);\n                throw new BackupToolError(message, hint);\n            }\n            // pg_restore has printed its own error above; execa's repeats the\n            // command line, which says nothing the reader can act on.\n            throw new BackupToolError(\n                `pg_restore stopped on the error above. What it restored before that stays in \"${targetDb ?? \"the target database\"}\".`,\n                rolesApplied > 0\n                    ? `The ${rolesApplied} cluster role(s) recreated from the backup's sidecar before it stay too.`\n                    : undefined\n            );\n        }\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        // An exit code, not `process.exit`: exiting here skipped the `finally`\n        // below, and a failed restore from object storage left its downloaded\n        // dump, every row of the database, in the temp directory.\n        process.exitCode = 1;\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nconst BACKUPS_ACTIONS = [\"list\"] as const;\n\n/** What `db backups <action>` says of an action it does not have: the sentence every `db` command says. */\nexport function unknownBackupsAction(action: string): string {\n    const near = closestWord(action, BACKUPS_ACTIONS);\n    return near\n        ? `Unknown db backups command \"${action}\" — did you mean \\`${near}\\`? Run \\`rebase db backups --help\\` for the rest.`\n        : `Unknown db backups command \"${action}\". Run \\`rebase db backups --help\\` for the ones there are.`;\n}\n\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`✗ ${unknownBackupsAction(action)}`));\n        process.exit(1);\n    }\n\n    const args = parseCommandFlags(\n        { \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" },\n        rawArgs.slice(3),\n        \"db backups list\"\n    );\n    const out = backupLocation(args[\"--out\"]);\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n            await mentionBackendBackups(out, args[\"--out\"]);\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Point at `<backend>/backups` when the default listing is empty and that\n * directory holds dumps.\n *\n * Earlier releases resolved the default there, so after an upgrade the\n * backups a project already has are one directory away from the listing.\n */\nasync function mentionBackendBackups(listed: string, flag: string | undefined): Promise<void> {\n    if (flag || process.env.BACKUP_DESTINATION?.trim()) return;\n    const backendBackups = path.join(process.cwd(), \"backups\");\n    if (path.resolve(listed) === backendBackups) return;\n    const found = await listBackups({ kind: \"local\", path: backendBackups }).catch(() => []);\n    if (found.length === 0) return;\n    print(chalk.gray(`  ${found.length} backup(s) are in ${backendBackups}, where earlier releases of`));\n    print(chalk.gray(`  \\`rebase db backup\\` wrote by default. List them with:`));\n    print(chalk.gray(`    rebase db backups list --out ${path.relative(invocationDir(), backendBackups) || \".\"}`));\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\n/**\n * Say why a backup command failed, with no password in it.\n *\n * What reaches here is often a client tool's failure, and execa's message\n * repeats the tool's command line. The tools get the password through\n * `PGPASSWORD` now, so it is not on that line, but a connection string can\n * still arrive inside a message from elsewhere; this is the last place to\n * stop it reaching a terminal or a CI log.\n */\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${redactConnectionPasswords(err.message)}`));\n        if (err.hint) outError(chalk.gray(`    ${redactConnectionPasswords(err.hint)}`));\n    } else {\n        outError(chalk.red(`  ✗ ${redactConnectionPasswords(err instanceof Error ? err.message : String(err))}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable). Never rebase: a backup\n                             without it cannot be restored\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Replace what the backup holds, in one transaction with\n                             the restore (runs the dump through psql)\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  asks for a typed 'yes' on a terminal, and with no terminal to ask on it\n  refuses. Prefer --create-db/--target-db to restore into a fresh database\n  rather than overwriting a live one. Into a database that already holds\n  what the backup creates, it needs --clean, and refuses before changing\n  anything without it. --clean drops each schema the backup creates whole,\n  with what it holds that the backup does not (it names those first), and\n  restores in the same transaction: a restore that stops changes nothing.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;AA+CA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;AAGA,gBAAgB,UAAU,QAAgE;CACtF,MAAM,SAAS,OAAO,UAAU;CAChC,IAAI;EACA,SAAS;GACL,MAAM,EAAE,MAAM,UAAU,MAAM,OAAO,KAAK;GAC1C,IAAI,MAAM;GACV,MAAM;EACV;CACJ,UAAU;EACN,OAAO,YAAY;CACvB;AACJ;;;;;;;;;;;;AAaA,eAAsB,6BAClB,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAC9C,IAAI;EACA,OAAO,qBAAqB,MAAM,GAAG;CACzC,SAAS,OAAO;EACZ,MAAM,IAAI,gBACN,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,4DACJ;CACJ;AACJ;;;;;;;;;;;AAYA,IAAa,qBAAqB;;AAGlC,SAAgB,cAAc,MAAoD,QAAQ,KAAa;CACnG,MAAM,MAAM,IAAI,mBAAmB,EAAE,KAAK;CAC1C,OAAO,OAAO,KAAK,WAAW,GAAG,IAAI,MAAM,QAAQ,IAAI;AAC3D;;;;;;;;;;;;;AAcA,SAAgB,sBAAsB,MAK3B;CACP,MAAM,OAAO,KAAK,MAAM,KAAK;CAC7B,IAAI,MAAM,OAAO,oBAAoB,IAAI,IAAI,OAAO,KAAK,QAAQ,KAAK,eAAe,IAAI;CACzF,MAAM,aAAa,KAAK,YAAY,KAAK;CACzC,IAAI,YAAY,OAAO,oBAAoB,UAAU,IAAI,aAAa,KAAK,QAAQ,KAAK,YAAY,UAAU;CAC9G,OAAO,KAAK,KAAK,KAAK,eAAe,SAAS;AAClD;AAEA,SAAS,oBAAoB,OAAwB;CACjD,OAAO,uBAAuB,KAAK,CAAC,CAAC,SAAS;AAClD;;AAGA,SAAS,eAAe,MAAkC;CACtD,OAAO,sBAAsB;EACzB;EACA,YAAY,QAAQ,IAAI;EACxB,eAAe,cAAc;EAC7B,YAAY,QAAQ,IAAI;CAC5B,CAAC;AACL;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAKA,IAAM,eAAe;CACjB,SAAS;CAIT,YAAY;CACZ,oBAAoB,CAAC,MAAM;CAC3B,cAAc;CACd,yBAAyB;CACzB,uBAAuB;CACvB,MAAM;AACV;;;;;;;AAQA,SAAgB,gBAAgB,SAAmB;CAC/C,MAAM,OAAO,kBAAkB,cAAc,QAAQ,MAAM,CAAC,GAAG,WAAW;CAC1E,MAAM,CAAC,SAAS,KAAK;CACrB,IAAI,UAAU,KAAA,GACV,MAAM,IAAI,MACN,2CAA2C,MAAM,kEACF,MAAM,EACzD;CAEJ,MAAM,eAAe,KAAK,uBAAuB,CAAC,EAAA,CAAG,KAAK,oBAAoB;CAC9E,IAAI,gBAAgB,KAAA,GAChB,MAAM,IAAI,MACN,oBAAoB,YAAY,4JAEpC;CAEJ,OAAO;AACX;;;;;;;AAQA,SAAgB,qBAAqB,SAA0B;CAC3D,IAAI,SAAS;CACb,IAAI,SAAS;CACb,KAAK,MAAM,QAAQ,SACf,IAAI,SAAS,MACT,SAAS,CAAC;MACP,IAAI,SAAS,OAAO,CAAC,QAExB,SAAS;MACN,IAAI,SAAS,OAAO,CAAC,QACxB,UAAU;MACP,IAAI,SAAS,OAAO,CAAC,QACxB,UAAU;MACP;EACH,MAAM,UAAU,SAAS,OAAO,KAAK,YAAY;EACjD,UAAU,QAAQ,QAAQ,uBAAuB,MAAM;CAC3D;CAEJ,OAAO,IAAI,OAAO,OAAO,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ;AACtD;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,QAAQ,SAAS,QAAQ,GAAG;EAC5B,gBAAgB;EAChB;CACJ;CACA,MAAM,OAAO,gBAAgB,OAAO;CAEpC,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,eAAe,KAAK,QAAQ;CACxC,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAKR,MAAM,0BAA0B,gBAAgB;CAGhD,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,IAAM,gBAAgB;CAClB,eAAe;CACf,eAAe;CACf,WAAW;CACX,cAAc;CACd,uBAAuB;CACvB,SAAS;CACT,MAAM;AACV;;;;;;;;;AAUA,SAAgB,iBAAiB,SAAmB;CAChD,MAAM,OAAO,kBAAkB,eAAe,QAAQ,MAAM,CAAC,GAAG,YAAY;CAC5E,IAAI,KAAK,EAAE,SAAS,GAChB,MAAM,IAAI,MACN,4DAA4D,KAAK,EAAE,OAAO,IACvE,KAAK,EAAE,KAAI,SAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,mBAClD;CAEJ,OAAO;AACX;;;;;;;;;;;AAYA,eAAsB,eAAe,MAKhB;CACjB,IAAI,KAAK,KAAK,OAAO;CACrB,QAAQ,MAAM,OAAO,iCAAiC,KAAK,OAAO,mCAAmC,CAAC;CACtG,IAAI,CAAC,KAAK,aAAa;EACnB,SAAS,MAAM,IAAI,+DAA+D,CAAC;EACnF,SAAS,MAAM,KAAK,0CAA0C,KAAK,OAAO,GAAG,CAAC;EAC9E,OAAO;CACX;CACA,MAAM,YAAY,MAAM,KAAK,IAAI,MAAM,OAAO,+BAA+B,CAAC;CAC9E,IAAI,CAAC,WAAW,IAAM,MAAM,KAAK,kCAAkC,CAAC;CACpE,OAAO;AACX;;AAGA,IAAM,kBAAkB;;;;;;;;;;;AAYxB,SAAgB,wBACZ,QACA,WACA,WACA,OAA2D,CAAC,GAC3B;CACjC,MAAM,QAAQ,UAAU,MAAM,GAAG,eAAe,CAAC,CAAC,KAAK,IAAI;CAC3D,MAAM,OAAO,UAAU,SAAS,kBAAkB,SAAS,UAAU,SAAS,gBAAgB,SAAS;CACvG,MAAM,UAAU,KAAK,SAAS,SAAS,IAAI,KAAK,QAAQ,KAAK,GAAG,MAAM;CACtE,MAAM,aAAa,KAAK,WAAW,gBAAgB,KAAK,aAAa;CACrE,OAAO;EACH,SAAS,IAAI,OAAO,kBAAkB,QAAQ,KAAK;EAEnD,MAAM,CACF,8DAA8D,YAAY,WAAW,UAAU,WAC/F,iEAAiE,UAAU,qCAAqC,SACpH,CAAC,CAAC,KAAK,QAAQ;CACnB;AACJ;;AAGA,IAAM,eAAe;;;;;AAMrB,SAAgB,oBAAoB,SAA4B,QAAqC;CACjG,IAAI,OAAO,WAAW,GAAG,OAAO,CAAC;CACjC,MAAM,WAAW,QAAQ,QAAQ,WAAW,WAAW,QAAQ;CAI/D,OAAO;EAHM,SAAS,SAAS,IACzB,oBAAoB,SAAS,WAAW,IAAI,WAAW,UAAU,GAAG,SAAS,KAAK,IAAI,EAAE,4DACxF;EAGF,GAAG,OAAO,MAAM,GAAG,YAAY,CAAC,CAAC,KAAK,UAAU,KAAK,OAAO;EAC5D,GAAI,OAAO,SAAS,eAAe,CAAC,SAAS,OAAO,SAAS,aAAa,MAAM,IAAI,CAAC;CACzF;AACJ;;;;;;AAOA,SAAgB,4BACZ,QACA,SACA,cACkC;CAClC,MAAM,MAAM,QAAQ,SAAS,eACvB,+CACA,QAAQ,cACJ,qCAAqC,OAAO,KAC5C;CACV,MAAM,QAAQ,CACV,GAAI,QAAQ,cACN,CAAC,uGAAuG,IACxG,CAAC,GACP,GAAI,eAAe,IACb,CAAC,OAAO,aAAa,qEAAqE,IAC1F,CAAC,CACX;CACA,OAAO;EACH,SAAS,oGAAoG,IAAI,aACzG,OAAO;EACf,MAAM,MAAM,SAAS,IAAI,MAAM,KAAK,QAAQ,IAAI,KAAA;CACpD;AACJ;AAEA,eAAsB,eAAe,SAAkC;CACnE,IAAI,QAAQ,SAAS,QAAQ,GAAG;EAC5B,iBAAiB;EACjB;CACJ;CACA,MAAM,OAAO,iBAAiB,OAAO;CAErC,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,WAAW;EACZ,iBAAiB;EACjB,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,iBAAiB,kBAAkB;CAMzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAGR,MAAM,0BAA0B,cAAc;CAM9C,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,cAAc;GAGd,MAAM,SAAS,QAAQ,kBACjB,MAAM,QAAQ,gBAAgB,KAAK,EAAE,OAAO,CAAC,IAC7C,MAAM,QAAQ,UAAU,KAAK,MAAM,CAAC,CAAC,MAAM,SAAS,QAAQ,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;GAC3F,IAAI,CAAC,QAAQ,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAClF,MAAM,SAAS,SAAS,KAAK,UAAU,OAAO,MAAM,CAAC,GAAG,GAAG,kBAAkB,SAAS,CAAC;GACvF,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,cAAc,GAAG,SAAS;GACnD,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG,MAAM,IAAI,gBAAgB,0BAA0B,WAAW;GAC9F,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAOA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY,MAAM,IAAI,gBAAgB,GAAG,UAAU,6CAA6C;EAGxG,IAAI,KAAK,kBAAkB,CAAC,UACxB,MAAM,IAAI,gBAAgB,2EAA2E;EAgBzG,MAAM,UAAU,MAAM,gBAAgB,SAAS;EAC/C,IAAI,CAAC,KAAK,YAAY;GAClB,MAAM,YAAY,MAAM,qBAAqB,kBAAkB,OAAO;GACtE,IAAI,UAAU,SAAS,GAAG;IACtB,MAAM,EAAE,SAAS,SAAS,wBAAwB,YAAY,uBAAuB,WAAW,WAAW;KACvG,UAAU,KAAK;KACf,SAAS;MACL,GAAI,KAAK,oBAAoB,CAAC,kBAAkB,IAAI,KAAK,kBAAkB,EAAE,IAAI,CAAC;MAClF,GAAI,KAAK,cAAc,CAAC,UAAU,IAAI,CAAC;MACvC,GAAI,KAAK,gBAAgB,CAAC,YAAY,IAAI,CAAC;MAC3C,GAAI,KAAK,WAAW,CAAC,OAAO,IAAI,CAAC;KACrC;IACJ,CAAC;IACD,MAAM,IAAI,gBAAgB,SAAS,IAAI;GAC3C;EACJ;EAMA,MAAM,YAAY,KAAK,eAAe,QAAQ,KAAK,2BAA2B;EAC9E,IAAI,WAAW;GACX,IAAI,CAAC,gBAAgB,MAAM,GACvB,MAAM,IAAI,gBACN,uHACA,4GACJ;GAEJ,MAAM,SAAS,oBAAoB,QAAQ,SAAS,MAAM,gBAAgB,kBAAkB,OAAO,CAAC;GACpG,IAAI,OAAO,SAAS,GAAG;IACnB,QAAQ,MAAM,OAAO,SAAS,OAAO,IAAI,CAAC;IAC1C,KAAK,MAAM,SAAS,OAAO,MAAM,CAAC,GAAG,QAAQ,MAAM,OAAO,QAAQ,OAAO,CAAC;GAC9E;EACJ;EAQA,IAAI,CAAC,MANmB,eAAe;GACnC,QAAQ,YAAY;GACpB,KAAK,KAAK,aAAa;GACvB,aAAa,QAAQ,MAAM,UAAU;GACrC,KAAK;EACT,CAAC,GACe;GAEZ,QAAQ,WAAW;GACnB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,eAAe;EACnB,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,eAAe;GACf,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,IAAI;GACA,IAAI,WACA,MAAM,qBAAqB;IACvB,kBAAkB;IAClB,WAAW;IACX;IACA,SAAS,KAAK;IACd,cAAc;GAClB,CAAC;QAED,MAAM,YAAY;IACd,kBAAkB;IAClB,WAAW;IACX,OAAO,KAAK;IACZ,SAAS,KAAK;IAEd,aAAa,CAAC,KAAK;IACnB,cAAc;GAClB,CAAC;EAET,SAAS,KAAK;GACV,IAAI,eAAe,iBAAiB,MAAM;GAC1C,IAAI,eAAe,oBAAoB;IACnC,MAAM,EAAE,SAAS,SAAS,4BAA4B,YAAY,uBAAuB,KAAK,YAAY;IAC1G,MAAM,IAAI,gBAAgB,SAAS,IAAI;GAC3C;GAGA,MAAM,IAAI,gBACN,iFAAiF,YAAY,sBAAsB,KACnH,eAAe,IACT,OAAO,aAAa,4EACpB,KAAA,CACV;EACJ;EAEA,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EAIf,QAAQ,WAAW;CACvB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,IAAM,kBAAkB,CAAC,MAAM;;AAG/B,SAAgB,qBAAqB,QAAwB;CACzD,MAAM,OAAO,YAAY,QAAQ,eAAe;CAChD,OAAO,OACD,+BAA+B,OAAO,qBAAqB,KAAK,sDAChE,+BAA+B,OAAO;AAChD;AAEA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,KAAK,qBAAqB,MAAM,GAAG,CAAC;EACvD,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,OAAO,kBACT;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GACtD,QAAQ,MAAM,CAAC,GACf,iBACJ;CACA,MAAM,QAAM,eAAe,KAAK,QAAQ;CACxC,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GAAG;GACtB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;GACjD,MAAM,sBAAsB,OAAK,KAAK,QAAQ;EAClD,OAAO;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;AASA,eAAe,sBAAsB,QAAgB,MAAyC;CAC1F,IAAI,QAAQ,QAAQ,IAAI,oBAAoB,KAAK,GAAG;CACpD,MAAM,iBAAiB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACzD,IAAI,KAAK,QAAQ,MAAM,MAAM,gBAAgB;CAC7C,MAAM,QAAQ,MAAM,YAAY;EAAE,MAAM;EAAS,MAAM;CAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;CACvF,IAAI,MAAM,WAAW,GAAG;CACxB,IAAM,MAAM,KAAK,KAAK,MAAM,OAAO,oBAAoB,eAAe,4BAA4B,CAAC;CACnG,IAAM,MAAM,KAAK,0DAA0D,CAAC;CAC5E,IAAM,MAAM,KAAK,oCAAoC,KAAK,SAAS,cAAc,GAAG,cAAc,KAAK,KAAK,CAAC;AACjH;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;;;;;;;;;;AAWA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,0BAA0B,IAAI,OAAO,GAAG,CAAC;EACnE,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,0BAA0B,IAAI,IAAI,GAAG,CAAC;CACnF,OACI,SAAS,MAAM,IAAI,OAAO,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG,CAAC;AAEhH;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;;IAE/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;;IAEtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;;;;;;CAc3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}