@rebasepro/server-postgres 0.25.0-canary.ge06257e → 0.25.1

package/dist/backup-service-D-UpT7DH.js

@@ -1,857 +0,0 @@
-import { createRequire as __createRequire } from "module";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-V7rFbMRe.js";
-import { Q as forLibpq, R as resolveLocalBin, et as splitPassword } from "./cli-errors-mx4sSjB8.js";
-import { o as execa } from "./rls-bootstrap-sql-Bd-hJk08.js";
-import path from "path";
-import fs from "fs";
-import os from "os";
-//#region src/backup/pg-tools.ts
-/**
-* Pure helpers for the backup/restore commands.
-*
-* Everything in this file is side-effect free so it can be unit-tested
-* without a live Postgres server, matching the constraint that CI must
-* not require a database.
-*/
-/**
-* Extract the database name from a Postgres connection string.
-* Returns `null` when the URL has no database path (e.g. bare host).
-*/
-function parseDbNameFromUrl(connectionString) {
-	try {
-		const name = new URL(connectionString).pathname.replace(/^\//, "").trim();
-		return name.length > 0 ? name : null;
-	} catch {
-		const match = connectionString.match(/\/([^/?]+)(\?|$)/);
-		return match && match[1] ? match[1] : null;
-	}
-}
-/**
-* Swap the database name in a connection string, preserving credentials,
-* host, port and query params. Used by `--target-db` / `--create-db` so a
-* restore can target a fresh database instead of clobbering the live one.
-*/
-function withDatabaseName(connectionString, dbName) {
-	try {
-		const parsed = new URL(connectionString);
-		parsed.pathname = `/${dbName}`;
-		return parsed.toString();
-	} catch {
-		return connectionString.replace(/\/([^/?]+)(\?|$)/, `/${dbName}$2`);
-	}
-}
-/**
-* Parse the major version out of `pg_dump --version` / `pg_restore --version`
-* output, e.g. `"pg_dump (PostgreSQL) 16.2"` → `16`. Handles the pre-10
-* `9.6.x` scheme (returns `9`) and beta strings like `"17beta1"`.
-*/
-function parsePgToolMajor(versionOutput) {
-	const match = versionOutput.match(/(\d+)(?:\.(\d+))?/);
-	if (!match) return null;
-	const major = Number(match[1]);
-	if (!Number.isFinite(major)) return null;
-	if (major === 9 && match[2] !== void 0) return 9;
-	return major;
-}
-/**
-* Convert `SELECT current_setting('server_version_num')` (e.g. `160002`)
-* into a major version (`16`). Also accepts pre-10 encodings like `90603`
-* → `9`.
-*/
-function serverVersionNumToMajor(versionNum) {
-	const num = typeof versionNum === "string" ? Number(versionNum) : versionNum;
-	if (!Number.isFinite(num) || num <= 0) return null;
-	if (num < 1e5) return Math.floor(num / 1e4);
-	return Math.floor(num / 1e4);
-}
-/**
-* pg_dump / pg_restore must be **at least** as new as the server they talk
-* to. A newer client against an older server is supported; an older client
-* against a newer server is not and produces corrupt or rejected output.
-*/
-function checkToolServerCompatibility(toolMajor, serverMajor) {
-	if (toolMajor === null) return {
-		compatible: false,
-		reason: "Could not determine the client tool version."
-	};
-	if (serverMajor === null) return {
-		compatible: false,
-		reason: "Could not determine the Postgres server version."
-	};
-	if (toolMajor < serverMajor) return {
-		compatible: false,
-		reason: `Client tool is Postgres ${toolMajor} but the server is Postgres ${serverMajor}. pg_dump/pg_restore must be the same major version as the server or newer. Install Postgres ${serverMajor} client tools.`
-	};
-	return { compatible: true };
-}
-/**
-* Build a deterministic, sortable backup file name:
-*   `rebase-<db>-<YYYYMMDD>T<HHMMSS>Z.dump`
-*
-* The UTC timestamp is embedded so retention pruning can recover the
-* creation time from the object key alone, without extra metadata.
-*/
-function buildBackupFilename(dbName, date = /* @__PURE__ */ new Date()) {
-	const stamp = date.toISOString().replace(/\.\d+Z$/, "Z").replace(/[-:]/g, "");
-	return `rebase-${dbName.replace(/[^a-zA-Z0-9_-]/g, "_")}-${stamp}.dump`;
-}
-/**
-* Recover the creation timestamp encoded in a backup file name by
-* {@link buildBackupFilename}. Returns `null` for names that don't match,
-* so foreign objects in a shared prefix are never pruned.
-*/
-function parseBackupTimestamp(fileName) {
-	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
-	if (!match) return null;
-	const [, ymd, hms] = match;
-	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
-	const date = new Date(iso);
-	return Number.isNaN(date.getTime()) ? null : date;
-}
-/**
-* Parse a destination string into a structured {@link BackupDestination}.
-* `s3://bucket/prefix` and `gs://bucket/prefix` map to object storage;
-* anything else is treated as a local path.
-*/
-function parseBackupDestination(out) {
-	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
-	if (s3) return {
-		kind: "s3",
-		bucket: s3[1],
-		prefix: stripTrailingSlash(s3[2])
-	};
-	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
-	if (gcs) return {
-		kind: "gcs",
-		bucket: gcs[1],
-		prefix: stripTrailingSlash(gcs[2])
-	};
-	return {
-		kind: "local",
-		path: out
-	};
-}
-function stripTrailingSlash(s) {
-	return s.replace(/\/+$/, "");
-}
-/**
-* Join a storage prefix and a file name without producing a leading or
-* doubled slash.
-*/
-function joinStorageKey(prefix, fileName) {
-	const clean = prefix.replace(/^\/+|\/+$/g, "");
-	return clean.length > 0 ? `${clean}/${fileName}` : fileName;
-}
-/**
-* `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
-* set a GUC.
-*
-* A backslash escape rather than quoting, which is what libpq's `-c` parsing
-* takes: a space inside a value ends the option otherwise, so a role list is
-* comma-joined and never spaced.
-*/
-function buildRowSecurityPgOptions(identity) {
-	const escape = (value) => value.replace(/([\\ ])/g, "\\$1");
-	return [
-		`-c app.uid=${escape(identity.uid)}`,
-		`-c app.user_id=${escape(identity.uid)}`,
-		`-c app.user_roles=${escape(identity.roles.join(","))}`
-	].join(" ");
-}
-/**
-* Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
-* which is compressed and restorable selectively via `pg_restore`.
-*/
-function buildPgDumpArgs(opts) {
-	const args = [
-		"--format=custom",
-		"--no-password",
-		`--file=${opts.outFile}`
-	];
-	if (opts.noOwner) args.push("--no-owner");
-	if (opts.rowSecurity) args.push("--enable-row-security");
-	for (const schema of opts.excludeSchemas ?? []) args.push(`--exclude-schema=${schema}`);
-	args.push(forLibpq(opts.connectionString));
-	return args;
-}
-/**
-* Whether a `pg_dump` failure is the row-security one, and what to do about it.
-*
-* The error text names the table and nothing else, so the first read of it is
-* "why would a backup be affected by RLS at all?" — the answer being that the
-* dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
-* normal state of the `postgres` user on Cloud SQL, RDS and every other managed
-* Postgres. Nothing about that is visible from the message.
-*
-* Returns `null` for any other failure, so the caller reports it unchanged.
-*/
-function diagnoseRowSecurityDumpFailure(error) {
-	const text = [error?.stderr, error?.message].map((part) => typeof part === "string" ? part : "").join("\n");
-	if (!/row-level security policy/i.test(text)) return null;
-	const table = text.match(/for table "([^"]+)"/)?.[1];
-	return [
-		`pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
-		"",
-		"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
-		"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
-		"  no superuser to hand out.",
-		"",
-		"  Two ways out:",
-		"",
-		"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
-		"      dump then contains every row, which is what a backup should mean.",
-		"",
-		"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
-		"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
-		"      admits the dump. Read the warning it prints: the result contains exactly the",
-		"      rows those policies admit, and any table whose policies do not include an",
-		"      admin rule comes out short — with no error.",
-		"",
-		"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
-		"  settings above it succeeds and silently omits rows."
-	].join("\n");
-}
-/**
-* Assemble the `pg_restore` argument vector for a custom-format dump.
-*/
-function buildPgRestoreArgs(opts) {
-	const args = [
-		"--format=custom",
-		"--no-password",
-		`--dbname=${forLibpq(opts.connectionString)}`
-	];
-	if (opts.clean) args.push("--clean", "--if-exists");
-	if (opts.noOwner) args.push("--no-owner");
-	if (opts.exitOnError !== false) args.push("--exit-on-error");
-	args.push(opts.inputFile);
-	return args;
-}
-/**
-* Assemble the `pg_restore --list` argument vector. Reading a dump's table
-* of contents parses the whole archive without touching a database, so it is
-* a cheap integrity check that the file isn't truncated or corrupt.
-*/
-function buildPgRestoreListArgs(inputFile) {
-	return ["--list", inputFile];
-}
-/** `<id>; <catalog oid> <oid> <description> <namespace> <tag…> <owner>`, the shape of a TOC entry. */
-var TOC_ENTRY = /^\d+;\s+\d+\s+\d+\s+(SCHEMA|TABLE)\s+(?!DATA\s)(\S+)\s+(.+)\s+(\S+)$/;
-/**
-* The schemas and tables in `pg_restore --list` output: the objects a
-* restore without `--clean` fails on when the target already has them.
-*
-* A TOC line ends in the object's owner, after its namespace and its name;
-* a schema's namespace is `-`. The name is what lies between the two, so a
-* name with a space in it (`Odd Name`) reads whole. `TABLE DATA` and every
-* other kind of entry are not objects of their own here.
-*/
-function parseDumpObjects(list) {
-	const objects = {
-		schemas: [],
-		tables: []
-	};
-	for (const line of list.split("\n")) {
-		const entry = TOC_ENTRY.exec(line.trim());
-		if (!entry) continue;
-		const [, kind, namespace, name] = entry;
-		if (kind === "SCHEMA") objects.schemas.push(name);
-		else objects.tables.push({
-			schema: namespace,
-			table: name
-		});
-	}
-	return objects;
-}
-/**
-* Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
-* cluster-wide objects) live outside any single database, so a per-database
-* `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
-* statements in the main dump fail on restore and RLS is silently lost — so
-* every backup captures the globals into a sidecar `.globals.sql`.
-*
-* `--no-role-passwords` keeps role secrets out of the artifact (backups may
-* be shipped off-box); roles are recreated password-less and re-secured by
-* the operator.
-*/
-function buildPgDumpallGlobalsArgs(opts) {
-	return [
-		"--globals-only",
-		"--no-role-passwords",
-		"--no-password",
-		`--file=${opts.outFile}`,
-		`--dbname=${forLibpq(opts.connectionString)}`
-	];
-}
-/**
-* Derive the globals sidecar path/key for a given `.dump` file. Keeps the
-* two artifacts adjacent so listing, uploading and pruning can find one from
-* the other. A name that doesn't end in `.dump` is returned unchanged with a
-* `.globals.sql` suffix appended.
-*/
-function globalsFileForDump(dumpPath) {
-	return dumpPath.endsWith(".dump") ? dumpPath.slice(0, -5) + ".globals.sql" : dumpPath + ".globals.sql";
-}
-/**
-* Split a `pg_dumpall --globals-only` script into individual statements.
-* Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
-* can run independently and a benign "role already exists" on one doesn't
-* abort the rest. Drops `--` comment lines and blank statements.
-*/
-function splitGlobalsStatements(sql) {
-	return sql.split("\n").filter((line) => {
-		const trimmed = line.trim();
-		return !trimmed.startsWith("--") && !trimmed.startsWith("\\");
-	}).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-/**
-* Resolve the Postgres connection string the backup commands should use,
-* mirroring the precedence the branch command already relies on.
-*/
-function resolveConnectionString(env) {
-	return env.DATABASE_URL || env.ADMIN_CONNECTION_STRING || null;
-}
-//#endregion
-//#region src/backup/retention.ts
-/**
-* Retention pruning for scheduled backups. Pure logic — no I/O — so it can
-* be exhaustively unit-tested without touching a storage backend.
-*/
-/**
-* Decide which backups to delete under the given retention policy.
-*
-* Rules, applied in order:
-*  1. Objects whose key isn't a recognised rebase backup (no parseable
-*     timestamp and no `createdAt`) are never selected — foreign files in a
-*     shared bucket are left untouched.
-*  2. The `keepMinimum` newest backups are always retained.
-*  3. Of the remainder, any older than `retentionDays` are selected for
-*     deletion.
-*
-* Returns the keys to delete, oldest first.
-*/
-function selectBackupsToPrune(backups, options) {
-	const retentionDays = options.retentionDays ?? 0;
-	const keepMinimum = Math.max(0, options.keepMinimum ?? 0);
-	const now = options.now ?? /* @__PURE__ */ new Date();
-	if (retentionDays <= 0) return [];
-	const dated = backups.map((b) => {
-		const createdAt = b.createdAt ?? parseBackupTimestamp(b.key);
-		return createdAt ? {
-			key: b.key,
-			createdAt
-		} : null;
-	}).filter((b) => b !== null);
-	dated.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
-	const cutoff = now.getTime() - retentionDays * 24 * 60 * 60 * 1e3;
-	const toDelete = dated.slice(keepMinimum).filter((b) => b.createdAt.getTime() < cutoff);
-	toDelete.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
-	return toDelete.map((b) => b.key);
-}
-//#endregion
-//#region src/backup/pg-binary.ts
-/**
-* Where the PostgreSQL client tools are, without spawning them.
-*
-* Kept apart from `backup-service.ts`, which pulls in `execa` (ESM-only), so
-* `createBackupCron` can check for the tools when it is registered.
-*/
-var OVERRIDE_VARIABLE = {
-	pg_dump: "PG_DUMP_PATH",
-	pg_restore: "PG_RESTORE_PATH",
-	pg_dumpall: "PG_DUMPALL_PATH"
-};
-/** The variable that points at `tool` when it is not on the PATH. */
-function pgToolVariable(tool) {
-	return OVERRIDE_VARIABLE[tool];
-}
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-function resolvePgBinary(tool, env = process.env) {
-	const override = env[OVERRIDE_VARIABLE[tool]];
-	if (override && fs.existsSync(override)) return override;
-	return resolveLocalBin(tool);
-}
-//#endregion
-//#region src/backup/backup-logic.ts
-/**
-* Pure-ish orchestration for the backup/restore paths, kept free of `execa`
-* and `pg` value imports so it can be unit-tested under jest (the impure
-* edges — spawning processes, opening connections — live in
-* `backup-service.ts`, which is vitest/runtime only).
-*
-* The functions here take their side-effecting dependency as an argument
-* (a statement runner, an object deleter) so tests can inject fakes.
-*/
-/**
-* Replay a `pg_dumpall --globals-only` script one statement at a time,
-* tolerating per-statement failures. On a same-cluster restore the roles
-* usually already exist (`CREATE ROLE` → "already exists") and on a managed
-* provider an `ALTER ROLE <superuser>` may be refused; neither should abort
-* recreation of the roles that *are* missing. Returns how many statements
-* applied vs were skipped.
-*
-* `runStatement` executes one SQL statement and rejects on error.
-*/
-async function applyGlobalsWith(runStatement, globalsSql, log = () => {}) {
-	let applied = 0;
-	let skipped = 0;
-	for (const statement of splitGlobalsStatements(globalsSql)) try {
-		await runStatement(statement);
-		applied++;
-	} catch (err) {
-		skipped++;
-		log(`  • Skipped global: ${statement.split("\n")[0].slice(0, 80)} (${err instanceof Error ? err.message : String(err)})`);
-	}
-	return {
-		applied,
-		skipped
-	};
-}
-/**
-* Delete each pruned dump together with its `.globals.sql` roles sidecar, so
-* pruning never orphans the roles file. The sidecar is best-effort — older
-* backups predate it, so a missing-sidecar failure is swallowed while a
-* failure deleting the dump itself propagates.
-*
-* `deleteObject` removes one key and rejects if it cannot (e.g. not found).
-*/
-async function pruneWith(keys, deleteObject) {
-	for (const key of keys) {
-		await deleteObject(key);
-		try {
-			await deleteObject(globalsFileForDump(key));
-		} catch {}
-	}
-}
-/**
-* Remove a dump artifact abandoned by a failed tool run.
-*
-* `pg_dump` creates its `--file=` target before it finishes connecting, so any
-* failure — a URL libpq rejects, a dropped connection, a full disk — leaves a
-* 0-byte file behind. That corpse is not inert: `rebase db backups list` used
-* to show it as an ordinary entry, and `selectBackupsToPrune` ranks by
-* timestamp alone, so it occupies a protected `keepMinimum` slot and can push
-* a real backup out of retention.
-*
-* Best-effort on purpose: the caller is already throwing, and a failed unlink
-* must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.
-*
-* Lives here rather than in `backup-service.ts` for the reason at the top of
-* this file — that module's top-level `execa` import makes it unloadable under
-* jest, so anything placed there cannot be unit-tested.
-*
-* `remove` deletes one file and throws if it cannot; `exists` reports presence.
-*/
-function discardPartialDumpWith(exists, remove, file) {
-	try {
-		if (exists(file)) remove(file);
-	} catch {}
-}
-//#endregion
-//#region src/backup/backup-service.ts
-/**
-* Backup / restore orchestration: thin, well-typed wrappers around
-* `pg_dump` and `pg_restore`, plus binary detection, version pre-flight,
-* and upload/prune against a storage backend.
-*
-* The pure argument- and policy-logic lives in `pg-tools.ts` and
-* `retention.ts`; this module is the impure edge (spawns processes, talks
-* to Postgres and storage) and is intentionally kept small.
-*/
-var backup_service_exports = /* @__PURE__ */ __exportAll({
-	BackupToolError: () => BackupToolError,
-	applyGlobals: () => applyGlobals,
-	createDump: () => createDump,
-	detectToolMajor: () => detectToolMajor,
-	discardPartialDump: () => discardPartialDump,
-	ensureDatabaseExists: () => ensureDatabaseExists,
-	findRestoreConflicts: () => findRestoreConflicts,
-	getServerVersionMajor: () => getServerVersionMajor,
-	listBackups: () => listBackups,
-	preflight: () => preflight,
-	pruneBackups: () => pruneBackups,
-	readDumpObjects: () => readDumpObjects,
-	resolvePgBinary: () => resolvePgBinary,
-	restoreDump: () => restoreDump,
-	uploadBackup: () => uploadBackup,
-	validateDump: () => validateDump
-});
-/**
-* How a libpq tool is invoked for a connection string: the URL its command
-* line carries, and the environment it runs in.
-*
-* The password goes in `PGPASSWORD`, never on the command line, where every
-* process listing could read it and every failure printed it back (execa's
-* error repeats the command). See {@link splitPassword}.
-*/
-function libpqInvocation(connectionString, env) {
-	const split = splitPassword(connectionString);
-	const toolEnv = {};
-	for (const [key, value] of Object.entries(env)) if (value !== void 0) toolEnv[key] = value;
-	if (split.password !== null) toolEnv.PGPASSWORD = split.password;
-	return {
-		connectionString: split.connectionString,
-		env: toolEnv
-	};
-}
-/**
-* Remove a dump artifact abandoned by a failed tool run. See
-* {@link discardPartialDumpWith} for why this exists and why the logic lives
-* in the execa-free module.
-*/
-function discardPartialDump(file) {
-	discardPartialDumpWith((f) => fs.existsSync(f), (f) => fs.unlinkSync(f), file);
-}
-var BackupToolError = class extends Error {
-	hint;
-	constructor(message, hint) {
-		super(message);
-		this.hint = hint;
-		this.name = "BackupToolError";
-	}
-};
-/** Run `<bin> --version` and extract the major version. */
-async function detectToolMajor(bin) {
-	try {
-		const { stdout } = await execa(bin, ["--version"]);
-		return parsePgToolMajor(stdout);
-	} catch {
-		return null;
-	}
-}
-/** Query the server for its major version via `server_version_num`. */
-async function getServerVersionMajor(connectionString) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString });
-	await client.connect();
-	try {
-		const raw = (await client.query("SHOW server_version_num")).rows?.[0]?.server_version_num;
-		return serverVersionNumToMajor(raw);
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Verify the requested client tool exists and its major version is
-* compatible with the live server. Throws {@link BackupToolError} — with a
-* doctor-style hint — when the binary is missing.
-*/
-async function preflight(tool, connectionString, env = process.env) {
-	const bin = resolvePgBinary(tool, env);
-	if (!bin) throw new BackupToolError(`Could not find the '${tool}' binary.`, `Install the PostgreSQL client tools (e.g. 'brew install libpq' or 'apt-get install postgresql-client'), or set ${tool === "pg_dump" ? "PG_DUMP_PATH" : "PG_RESTORE_PATH"} to its full path.`);
-	const [toolMajor, serverMajor] = await Promise.all([detectToolMajor(bin), getServerVersionMajor(connectionString)]);
-	return {
-		bin,
-		toolMajor,
-		serverMajor,
-		...checkToolServerCompatibility(toolMajor, serverMajor)
-	};
-}
-/**
-* Produce a custom-format dump on local disk. When `outDir` is omitted the
-* file is written to the OS temp directory (used by the upload path, which
-* cleans it up afterwards).
-*
-* Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
-* `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
-* depend on can be recreated on restore. Set `includeGlobals: false` to skip
-* it (e.g. when the caller has no privilege to read cluster globals).
-*/
-async function createDump(opts) {
-	const env = opts.env ?? process.env;
-	const bin = resolvePgBinary("pg_dump", env);
-	if (!bin) throw new BackupToolError("Could not find the 'pg_dump' binary.", "Install the PostgreSQL client tools or set PG_DUMP_PATH.");
-	const fileName = opts.fileName ?? buildBackupFilename(opts.dbName);
-	const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "rebase-backup-"));
-	fs.mkdirSync(outDir, { recursive: true });
-	const localFile = path.join(outDir, fileName);
-	createOwnerOnly(localFile);
-	const tool = libpqInvocation(opts.connectionString, env);
-	const args = buildPgDumpArgs({
-		connectionString: tool.connectionString,
-		outFile: localFile,
-		excludeSchemas: opts.excludeSchemas,
-		noOwner: opts.noOwner,
-		rowSecurity: opts.rowSecurity
-	});
-	const dumpEnv = { ...tool.env };
-	if (opts.rowSecurity) dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)].filter(Boolean).join(" ");
-	try {
-		await execa(bin, args, {
-			stdio: opts.inheritStdio ? "inherit" : "pipe",
-			env: dumpEnv
-		});
-	} catch (error) {
-		discardPartialDump(localFile);
-		const diagnosis = diagnoseRowSecurityDumpFailure(error);
-		if (!diagnosis) throw error;
-		throw new BackupToolError(diagnosis, "Run `rebase db backup --help` for the flag, and read what it says about partial dumps.");
-	}
-	const result = {
-		localFile,
-		fileName,
-		sizeBytes: fs.existsSync(localFile) ? fs.statSync(localFile).size : 0
-	};
-	if (opts.includeGlobals !== false) {
-		const dumpallBin = resolvePgBinary("pg_dumpall", env);
-		if (!dumpallBin) throw new BackupToolError("Could not find the 'pg_dumpall' binary needed to capture cluster roles.", "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. To take a role-incomplete backup anyway, pass includeGlobals: false.");
-		const globalsFile = globalsFileForDump(localFile);
-		createOwnerOnly(globalsFile);
-		try {
-			await execa(dumpallBin, buildPgDumpallGlobalsArgs({
-				connectionString: tool.connectionString,
-				outFile: globalsFile
-			}), {
-				stdio: opts.inheritStdio ? "inherit" : "pipe",
-				env: tool.env
-			});
-		} catch (error) {
-			discardPartialDump(globalsFile);
-			discardPartialDump(localFile);
-			throw error;
-		}
-		result.globalsFile = globalsFile;
-		result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
-	}
-	return result;
-}
-/**
-* Create `file` empty and readable by its owner only, before a tool writes it.
-*
-* A dump holds every row, and the `.globals.sql` sidecar every role's password
-* hash. pg_dump and pg_dumpall create their `--file=` target with the
-* process's umask — 0644 on most machines, readable by every user — and keep
-* the mode of a file that is already there. Created 0600 first, the file is
-* never readable by anyone else, not even while the dump runs; chmod-ing it
-* afterwards would leave it open for as long as that takes. A file that
-* already existed is narrowed too.
-*/
-function createOwnerOnly(file) {
-	fs.closeSync(fs.openSync(file, "w", 384));
-	fs.chmodSync(file, 384);
-}
-/**
-* Cheap integrity check on a freshly written dump: it must be non-empty and
-* `pg_restore --list` must parse its table of contents without error. Used
-* before pruning older backups so a corrupt-but-exit-0 dump never becomes
-* the reason the last good backup is deleted.
-*/
-async function validateDump(localFile, env = process.env) {
-	if (!fs.existsSync(localFile)) return {
-		ok: false,
-		reason: `Dump file does not exist: ${localFile}`
-	};
-	if (fs.statSync(localFile).size === 0) return {
-		ok: false,
-		reason: "Dump file is empty (0 bytes)."
-	};
-	const bin = resolvePgBinary("pg_restore", env);
-	if (!bin) return {
-		ok: false,
-		reason: "Could not find 'pg_restore' to verify the dump."
-	};
-	try {
-		await execa(bin, buildPgRestoreListArgs(localFile), {
-			stdio: "pipe",
-			env: { ...env }
-		});
-		return { ok: true };
-	} catch (err) {
-		return {
-			ok: false,
-			reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}`
-		};
-	}
-}
-/**
-* Replay a `pg_dumpall --globals-only` script to recreate cluster roles
-* before a restore, so the dump's GRANT/RLS statements (which reference
-* `rebase_user` and any owner roles) actually apply. Runs statement by
-* statement and tolerates per-statement failures — on a same-cluster restore
-* the roles usually already exist (`CREATE ROLE` → "already exists"), and on
-* a managed provider an `ALTER ROLE <superuser>` may be refused; neither
-* should abort role recreation. Returns how many statements applied vs were
-* skipped.
-*/
-async function applyGlobals(connectionString, globalsSql, log = () => {}) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString });
-	await client.connect();
-	try {
-		return await applyGlobalsWith(async (sql) => {
-			await client.query(sql);
-		}, globalsSql, log);
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Restore a custom-format dump into the database named by
-* `connectionString`. Destructive when `clean` is set (drops objects
-* first). Never called automatically — the CLI gates it behind explicit
-* confirmation.
-*
-* Runs with `--exit-on-error` by default: a restore that logs-and-continues
-* past a failed GRANT (because a role was missing) reports success with RLS
-* un-enforced. Callers should recreate roles first (see {@link applyGlobals})
-* and only set `exitOnError: false` deliberately.
-*/
-async function restoreDump(opts) {
-	const env = opts.env ?? process.env;
-	const bin = resolvePgBinary("pg_restore", env);
-	if (!bin) throw new BackupToolError("Could not find the 'pg_restore' binary.", "Install the PostgreSQL client tools or set PG_RESTORE_PATH.");
-	const tool = libpqInvocation(opts.connectionString, env);
-	await execa(bin, buildPgRestoreArgs({
-		connectionString: tool.connectionString,
-		inputFile: opts.inputFile,
-		clean: opts.clean,
-		noOwner: opts.noOwner,
-		exitOnError: opts.exitOnError
-	}), {
-		stdio: opts.inheritStdio ? "inherit" : "pipe",
-		env: tool.env
-	});
-}
-/** The schemas and tables a dump creates, from `pg_restore --list`. See {@link parseDumpObjects}. */
-async function readDumpObjects(inputFile, env = process.env) {
-	const bin = resolvePgBinary("pg_restore", env);
-	if (!bin) throw new BackupToolError("Could not find the 'pg_restore' binary.", "Install the PostgreSQL client tools or set PG_RESTORE_PATH.");
-	const toolEnv = Object.fromEntries(Object.entries(env).filter((entry) => entry[1] !== void 0));
-	const { stdout } = await execa(bin, buildPgRestoreListArgs(inputFile), {
-		stdio: "pipe",
-		env: toolEnv
-	});
-	return parseDumpObjects(stdout);
-}
-/**
-* Which of a dump's schemas and tables the target database already holds,
-* as `schema <name>` / `table <schema>.<name>`: what a restore without
-* `--clean` would stop on. `public` is left out of the schemas — every
-* database has it, and pg_restore does not create it. None for a database
-* that does not exist yet.
-*/
-async function findRestoreConflicts(connectionString, objects) {
-	const schemas = objects.schemas.filter((schema) => schema !== "public");
-	if (schemas.length === 0 && objects.tables.length === 0) return [];
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString });
-	try {
-		await client.connect();
-	} catch (err) {
-		if (err instanceof Error && "code" in err && err.code === "3D000") return [];
-		throw err;
-	}
-	try {
-		const existingSchemas = await client.query("SELECT nspname FROM pg_namespace WHERE nspname = ANY($1::text[]) ORDER BY nspname", [schemas]);
-		const existingTables = await client.query(`SELECT n.nspname, c.relname
-               FROM pg_class c
-               JOIN pg_namespace n ON n.oid = c.relnamespace
-               JOIN unnest($1::text[], $2::text[]) AS d(schema_name, table_name)
-                 ON d.schema_name = n.nspname AND d.table_name = c.relname
-              WHERE c.relkind IN ('r', 'p')
-              ORDER BY n.nspname, c.relname`, [objects.tables.map((t) => t.schema), objects.tables.map((t) => t.table)]);
-		return [...existingSchemas.rows.map((row) => `schema ${row.nspname}`), ...existingTables.rows.map((row) => `table ${row.nspname}.${row.relname}`)];
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Create a database (if absent) by connecting to the maintenance
-* `postgres` database. Used by `restore --create-db`.
-*/
-async function ensureDatabaseExists(adminConnectionString, dbName) {
-	const { Client } = await import("pg");
-	const parsed = new URL(adminConnectionString);
-	parsed.pathname = "/postgres";
-	const client = new Client({ connectionString: parsed.toString() });
-	await client.connect();
-	try {
-		const existing = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [dbName]);
-		if (existing.rowCount && existing.rowCount > 0) return false;
-		if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(dbName)) throw new BackupToolError(`Invalid database name: "${dbName}"`);
-		await client.query(`CREATE DATABASE "${dbName}"`);
-		return true;
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Upload a local dump to object storage under the destination's prefix.
-* Backups may contain secrets/PII, so the object is written with a
-* private/octet-stream content type; bucket-level ACLs must stay private.
-*/
-async function uploadBackup(storage, localFile, dest) {
-	const fileName = path.basename(localFile);
-	const key = joinStorageKey(dest.prefix, fileName);
-	const file = new File([await fs.openAsBlob(localFile)], fileName, { type: "application/octet-stream" });
-	return {
-		key,
-		storageUrl: (await storage.putObject({
-			file,
-			key,
-			bucket: dest.bucket,
-			metadata: { "rebase-backup": "1" }
-		}, { uploadLimits: false })).storageUrl
-	};
-}
-/** Stats in flight at once while listing a local backup folder. */
-var LOCAL_STAT_CONCURRENCY = 32;
-/** `fn` over `items`, at most `limit` at a time; results in input order. */
-async function mapBounded(items, limit, fn) {
-	const results = new Array(items.length);
-	let next = 0;
-	const worker = async () => {
-		while (next < items.length) {
-			const i = next++;
-			results[i] = await fn(items[i]);
-		}
-	};
-	await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
-	return results;
-}
-/**
-* List existing backups at a destination. For local destinations reads the
-* directory; for object storage lists the prefix via the controller.
-*/
-async function listBackups(dest, storage) {
-	if (dest.kind === "local") {
-		const stat = await fs.promises.stat(dest.path).catch(() => null);
-		if (!stat) return [];
-		const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);
-		const dumps = (await fs.promises.readdir(dir)).filter((f) => f.endsWith(".dump"));
-		const stats = await mapBounded(dumps, LOCAL_STAT_CONCURRENCY, (f) => fs.promises.stat(path.join(dir, f)));
-		return dumps.map((f, i) => {
-			const createdAt = parseBackupTimestamp(f) ?? stats[i].mtime;
-			return {
-				key: path.join(dir, f),
-				createdAt,
-				sizeBytes: stats[i].size
-			};
-		}).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
-	}
-	if (!storage) throw new BackupToolError(`Listing ${dest.kind} backups requires a configured storage backend.`);
-	const { listBackupObjects } = await import("@rebasepro/server");
-	return (await listBackupObjects(dest, storage)).map((info) => ({
-		key: info.key,
-		createdAt: info.createdAt ? new Date(info.createdAt) : void 0
-	}));
-}
-/**
-* Apply a retention policy to a destination, deleting the backups selected
-* by {@link selectBackupsToPrune}. Returns the keys that were removed.
-*/
-async function pruneBackups(dest, options, storage) {
-	const toDelete = selectBackupsToPrune(await listBackups(dest, storage), options);
-	await pruneWith(toDelete, dest.kind === "local" ? async (key) => {
-		if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
-		fs.unlinkSync(key);
-	} : async (key) => {
-		if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
-		await storage.deleteObject(key, dest.bucket);
-	});
-	return toDelete;
-}
-//#endregion
-export { parseBackupDestination as A, buildPgRestoreArgs as C, diagnoseRowSecurityDumpFailure as D, checkToolServerCompatibility as E, resolveConnectionString as F, serverVersionNumToMajor as I, splitGlobalsStatements as L, parseDbNameFromUrl as M, parseDumpObjects as N, globalsFileForDump as O, parsePgToolMajor as P, withDatabaseName as R, buildPgDumpallGlobalsArgs as S, buildRowSecurityPgOptions as T, pgToolVariable as _, detectToolMajor as a, buildBackupFilename as b, findRestoreConflicts as c, preflight as d, pruneBackups as f, validateDump as g, uploadBackup as h, createDump as i, parseBackupTimestamp as j, joinStorageKey as k, getServerVersionMajor as l, restoreDump as m, applyGlobals as n, discardPartialDump as o, readDumpObjects as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, listBackups as u, resolvePgBinary as v, buildPgRestoreListArgs as w, buildPgDumpArgs as x, selectBackupsToPrune as y };
-
-//# sourceMappingURL=backup-service-D-UpT7DH.js.map