npm - @rebasepro/server-postgres - Versions diffs - 0.25.1 → 0.26.0 - Mend

@rebasepro/server-postgres 0.25.1 → 0.26.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (83) hide show

package/dist/{BranchService-ClklxyAQ.js → BranchService-CWBnDhcv.js} RENAMED Viewed

@@ -1,8 +1,8 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { i as __exportAll } from "./cli-prompt-DXG0yk-h.js";
-import { nt as extractCauseMessage } from "./cli-errors-DiA0XFIS.js";
-import { n as extractPgError } from "./pg-error-utils-CFEnm2m9.js";
+import { rt as extractCauseMessage } from "./cli-errors-DsYyNYzd.js";
+import { n as extractPgError } from "./pg-error-utils-DhiUTlVx.js";
 import { Client } from "pg";
 import { sql } from "drizzle-orm";
 import { revokeInternalTableSql } from "@rebasepro/common";
@@ -27,6 +27,7 @@ var BRANCH_DB_PREFIX = "rb_";
 var PG_DUPLICATE_DATABASE = "42P04";
 /** `object_in_use` — the database still has connections attached. */
 var PG_OBJECT_IN_USE = "55006";
+var PG_UNDEFINED_TABLE = "42P01";
 /** How many times `--force` disconnects the other sessions before it reports one still there. */
 var FORCE_ATTEMPTS = 3;
 /** The database every Postgres server has, from which another one can be closed and opened. */
@@ -158,6 +159,14 @@ function describeBranchDdlError(err, fallbackContext) {
 	if (detail) return new Error(detail);
 	return err instanceof Error ? err : new Error(String(err));
 }
+/**
+* The registry is not there: a server with `REBASE_PROVISION=false` never
+* creates it. Said by name rather than as Postgres's "relation does not exist".
+*/
+function missingRegistryError(err) {
+	if (extractPgError(err)?.code !== PG_UNDEFINED_TABLE) return void 0;
+	return /* @__PURE__ */ new Error("Branching needs the rebase.branches registry, and this database has none. A server with REBASE_PROVISION=false does not create it: boot once with provisioning on, or create it with `rebase db branch create` from the CLI, which makes it.");
+}
 /** Fully-qualified metadata table in the rebase schema. */
 var BRANCHES_TABLE = "rebase.branches";
 /**
@@ -297,7 +306,9 @@ var BranchService = class {
 		if (options?.source) validateIdentifier(options.source, "source database name");
 		const dbName = toBranchDbName(name);
 		const sourceDb = options?.source || await this.home.database();
-		if ((await (await this.home.registry()).execute(sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`)).rows.length > 0) throw new Error(`Branch "${name}" already exists.`);
+		if ((await (await this.home.registry()).execute(sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`).catch((err) => {
+			throw missingRegistryError(err) ?? err;
+		})).rows.length > 0) throw new Error(`Branch "${name}" already exists.`);
 		await this.poolManager.disconnectDatabase(sourceDb);
 		const safeDbName = dbName.replace(/"/g, "\"\"");
 		const safeSourceDb = sourceDb.replace(/"/g, "\"\"");
@@ -311,14 +322,17 @@ var BranchService = class {
 			if (extractPgError(err)?.code === PG_OBJECT_IN_USE) throw new Error(`Cannot create branch: the source database "${sourceDb}" ${options?.force ? "still had connections after they were disconnected" : "has active connections"}.\n` + await this.describeBlockingConnections(sourceDb, { forced: options?.force === true }));
 			throw describeBranchDdlError(err, dbName);
 		}
+		const forkXid = (await this.db.execute(sql`SELECT xmin::text AS xid FROM pg_database WHERE datname = ${dbName}`)).rows[0]?.xid;
 		const now = /* @__PURE__ */ new Date();
-		await (await this.home.registry()).execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)
-                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`);
+		const metadata = typeof forkXid === "string" ? { forkXid } : {};
+		await (await this.home.registry()).execute(sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at, metadata)
+                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()}, ${JSON.stringify(metadata)}::jsonb)`);
 		return {
 			name,
 			database: dbName,
 			parentDatabase: sourceDb,
-			createdAt: now
+			createdAt: now,
+			...typeof forkXid === "string" ? { forkXid } : {}
 		};
 	}
 	/**
@@ -624,7 +638,8 @@ var BranchService = class {
                 b.name,
                 b.db_name,
                 b.parent_db,
-                b.created_at
+                b.created_at,
+                b.metadata->>'forkXid' AS fork_xid
             FROM rebase.branches b
             WHERE b.name = ${name}
         `)).rows;
@@ -641,11 +656,12 @@ var BranchService = class {
 			database: row.db_name,
 			parentDatabase: row.parent_db,
 			createdAt: new Date(row.created_at),
-			sizeBytes
+			sizeBytes,
+			...typeof row.fork_xid === "string" ? { forkXid: row.fork_xid } : {}
 		};
 	}
 };
 //#endregion
 export { reopenedDatabasesNotice as a, reopenClosedDatabases as i, BranchService_exports as n, BranchingUnsupportedError as r, BranchService as t };
-//# sourceMappingURL=BranchService-ClklxyAQ.js.map
+//# sourceMappingURL=BranchService-CWBnDhcv.js.map

package/dist/BranchService-CWBnDhcv.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"BranchService-CWBnDhcv.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { Client } from \"pg\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\nconst PG_UNDEFINED_TABLE = \"42P01\";\n\n/** How many times `--force` disconnects the other sessions before it reports one still there. */\nconst FORCE_ATTEMPTS = 3;\n\n/** The database every Postgres server has, from which another one can be closed and opened. */\nconst MAINTENANCE_DATABASE = \"postgres\";\n\n/**\n * The signals Node can catch that end a forced copy part-way: a closed\n * terminal or a lost SSH session (SIGHUP), Ctrl-C (SIGINT), a supervisor's\n * stop (SIGTERM) and Ctrl-\\ (SIGQUIT). SIGKILL cannot be caught; what it leaves\n * closed, {@link reopenClosedDatabases} opens again.\n */\nconst REOPEN_ON_SIGNALS: readonly NodeJS.Signals[] = [\"SIGHUP\", \"SIGINT\", \"SIGTERM\", \"SIGQUIT\"];\n\n/**\n * The class of the advisory lock a forced create holds on its source from the\n * moment it closes it until it opens it again: `(COPY_LOCK_CLASS,\n * hashtext(<source>))`, taken in the server's `postgres` database, where the\n * self-heal looks. Without it, the self-heal every `rebase db branch` command\n * runs could not tell a database a killed create left closed from one a live\n * create had just closed, and opened that one in the settle before the copy\n * starts; and a second forced create on the same source copied beside the\n * first and opened it under it.\n */\nconst COPY_LOCK_CLASS = 0x52424331;\n\n/** `ALTER DATABASE … ALLOW_CONNECTIONS true`, the statement that opens a closed database again. */\nfunction reopenStatement(dbName: string): string {\n return `ALTER DATABASE \"${dbName.replace(/\"/g, '\"\"')}\" ALLOW_CONNECTIONS true`;\n}\n\n/** What {@link reopenClosedDatabases} found closed, and what became of each. */\nexport interface ReopenedDatabases {\n /** Databases that refused new connections, and accept them again. */\n reopened: string[];\n /** Databases that refuse new connections and could not be opened, with Postgres's reason. */\n failed: { database: string; reason: string; statement: string }[];\n}\n\n/**\n * Open again the database `connectionString` names, and each of `others`,\n * where one refuses new connections.\n *\n * `rebase db branch create --force` closes its source with `ALLOW_CONNECTIONS\n * false` for the copy, and opens it again after, and on every signal it can\n * catch. A SIGKILL — an out-of-memory kill, a CI runner's hard stop — leaves\n * it closed: the app answers 503, and `rebase dev`, `console` and `push` all\n * fail, on the project's own database. Nothing else in a development database\n * closes one, so a closed one found here is that, and every `rebase db branch`\n * command calls this before it does anything else.\n *\n * Runs from the server's `postgres` database, since a closed database cannot\n * be connected to. A template is never touched (`template0` is closed by\n * design), nor a database a live forced create holds closed: one whose\n * {@link COPY_LOCK_CLASS} lock is held, or that a `CREATE DATABASE … TEMPLATE`\n * is copying right now. That create opens it itself.\n *\n * Best-effort: a server it cannot reach, or a catalogue it cannot read, is an\n * empty answer, and the command's own connection check speaks next.\n */\nexport async function reopenClosedDatabases(\n connectionString: string,\n others: readonly (string | null | undefined)[] = []\n): Promise<ReopenedDatabases> {\n const result: ReopenedDatabases = { reopened: [], failed: [] };\n let maintenanceUrl: string;\n let named: string;\n try {\n const url = new URL(connectionString);\n named = decodeURIComponent(url.pathname.slice(1));\n url.pathname = `/${MAINTENANCE_DATABASE}`;\n maintenanceUrl = url.toString();\n } catch {\n return result;\n }\n const names = [...new Set([named, ...others].map((name) => name?.trim() ?? \"\")\n .filter((name) => name !== \"\" && name !== MAINTENANCE_DATABASE))];\n if (names.length === 0) return result;\n\n const client = new Client({ connectionString: maintenanceUrl, connectionTimeoutMillis: 5000 });\n // A connection dropped while idle must not take the command down with it.\n client.on(\"error\", () => undefined);\n try {\n await client.connect();\n } catch {\n return result;\n }\n try {\n const closed = await client.query<{ datname: string }>(\n `SELECT d.datname\n FROM pg_database d\n WHERE d.datname = ANY($1::text[])\n AND NOT d.datallowconn\n AND NOT d.datistemplate\n AND NOT EXISTS (\n SELECT 1 FROM pg_stat_activity a\n WHERE a.state = 'active'\n AND position(('TEMPLATE \"' || replace(d.datname, '\"', '\"\"') || '\"') IN a.query) > 0)\n ORDER BY 1`,\n [names]\n );\n for (const { datname } of closed.rows) {\n // Held while it opens it, so a forced create starting now waits.\n const free = await client.query<{ locked: boolean }>(\n \"SELECT pg_try_advisory_lock($1, hashtext($2)) AS locked\",\n [COPY_LOCK_CLASS, datname]\n );\n if (free.rows[0]?.locked !== true) continue;\n const statement = reopenStatement(datname);\n try {\n await client.query(statement);\n result.reopened.push(datname);\n } catch (err) {\n result.failed.push({\n database: datname,\n reason: extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err),\n statement\n });\n } finally {\n await client.query(\"SELECT pg_advisory_unlock($1, hashtext($2))\", [COPY_LOCK_CLASS, datname])\n .catch(() => undefined);\n }\n }\n } catch {\n // The catalogue could not be read: nothing found to open.\n } finally {\n await client.end().catch(() => undefined);\n }\n return result;\n}\n\n/** What to say about {@link reopenClosedDatabases}'s answer: one line a database, or none. */\nexport function reopenedDatabasesNotice(result: ReopenedDatabases): string[] {\n return [\n ...result.reopened.map((database) =>\n `⚠ \"${database}\" was refusing every connection — an interrupted \\`rebase db branch create --force\\` ` +\n \"had closed it for the copy. It is open again.\"),\n ...result.failed.map(({ database, reason, statement }) =>\n `⚠ \"${database}\" refuses every connection — an interrupted \\`rebase db branch create --force\\` closed it — ` +\n `and could not be opened again (${reason}). Run, connected to the server's postgres database: ${statement};`)\n ];\n}\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n const pgError = extractPgError(err);\n\n if (pgError?.code === PG_DUPLICATE_DATABASE) {\n return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n }\n if (pgError?.code === PG_OBJECT_IN_USE) {\n return new Error(\n `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n \"Close other clients or connections and try again.\"\n );\n }\n\n // Unknown failure: surface the real PG message rather than the Drizzle\n // wrapper, which would otherwise show the raw SQL and no reason at all.\n const detail = pgError?.message ?? extractCauseMessage(err);\n if (detail) return new Error(detail);\n return err instanceof Error ? err : new Error(String(err));\n}\n\n/**\n * The registry is not there: a server with `REBASE_PROVISION=false` never\n * creates it. Said by name rather than as Postgres's \"relation does not exist\".\n */\nfunction missingRegistryError(err: unknown): Error | undefined {\n if (extractPgError(err)?.code !== PG_UNDEFINED_TABLE) return undefined;\n return new Error(\n \"Branching needs the rebase.branches registry, and this database has none. A server with \" +\n \"REBASE_PROVISION=false does not create it: boot once with provisioning on, or create it with \" +\n \"`rebase db branch create` from the CLI, which makes it.\"\n );\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n /** Wire code, forwarded verbatim to the client. */\n readonly code = \"BRANCHING_UNSUPPORTED\";\n\n constructor(message: string) {\n super(message);\n this.name = \"BranchingUnsupportedError\";\n }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n \"Branching does not work on the managed development database. It copies a database with \"\n + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n validateIdentifier(name, \"branch name\");\n if (name.length > MAX_BRANCH_NAME_LENGTH) {\n throw new Error(\n `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n );\n }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n assertValidBranchName(name);\n return `${BRANCH_DB_PREFIX}${name}`;\n}\n\n/**\n * Where a server's branches are kept: the main database — what a branch is\n * copied from unless told otherwise, and what may never be dropped — and the\n * connection whose `rebase.branches` records them.\n */\nexport interface BranchHome {\n /** The main database's name. */\n database(): Promise<string>;\n /**\n * A connection on the database the registry is in. Asked for at each use:\n * a pool to the main database is closed before it is copied.\n */\n registry(): Promise<DrizzleClient>;\n}\n\nexport class BranchService {\n private readonly home: BranchHome;\n\n /**\n * @param db A connection on the server the branches are made on. Branch\n * DDL runs here.\n * @param home Where branches are kept. Without one, the database the\n * pool manager's connection string names, and `db`'s registry.\n */\n constructor(\n private db: DrizzleClient,\n private poolManager: DatabasePoolManager,\n home?: BranchHome\n ) {\n this.home = home ?? {\n database: async () => poolManager.defaultDatabaseName,\n registry: async () => db\n };\n }\n\n /**\n * Refuse a branch mutation the connected server cannot honour.\n *\n * The check lives here rather than in the CLI's argv parsing because the\n * CLI is not the only caller: Studio reaches `createBranch` over the\n * websocket, and before this it got \"Branch created successfully\" and a\n * detail pane promising isolation for a database that is the parent.\n *\n * Reads only, and only mutations are guarded: `listBranches` on a managed\n * database is an honest empty list, and refusing it would turn the Branches\n * pane into a failure with a \"Try again\" that can never succeed.\n */\n private async assertBranchingSupported(): Promise<void> {\n if (await this.poolManager.servesOneDatabase()) {\n throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n }\n }\n\n /**\n * Whether the `rebase.branches` registry exists. A database that has never\n * had a branch made on it may not have it, and reading it there is an\n * empty answer, not an error — nor a reason to create it. The CLI's `list`\n * and `info` ask this rather than running the DDL that creates it.\n */\n async hasBranchRegistry(): Promise<boolean> {\n const result = await (await this.home.registry()).execute(\n sql`SELECT to_regclass('rebase.branches') IS NOT NULL AS present`\n );\n const [row] = result.rows;\n return row !== undefined && Reflect.get(row, \"present\") === true;\n }\n\n /**\n * Ensure the `rebase.branches` metadata table exists in the default database.\n * Idempotent — safe to call on every startup.\n */\n async ensureBranchMetadataTable(): Promise<void> {\n // Create the rebase schema (idempotent — may already exist from auth/history init)\n const registry = await this.home.registry();\n await registry.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n await registry.execute(sql.raw(`\n CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n name TEXT PRIMARY KEY,\n db_name TEXT NOT NULL UNIQUE,\n parent_db TEXT NOT NULL,\n created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n metadata JSONB DEFAULT '{}'\n );\n `));\n\n // Not a collection, so no RLS — and it names every branch database on\n // this server. The driver's schema-wide grant reaches it, so revoke.\n await registry.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n }\n\n /**\n * Create a new branch database by templating the source database.\n *\n * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n * of both schema and data.\n *\n * @param name User-facing branch name (e.g., \"feature_auth\")\n * @param options.source Source database to clone; defaults to the main database.\n */\n async createBranch(\n name: string,\n options?: { source?: string; force?: boolean }\n ): Promise<BranchInfo> {\n await this.assertBranchingSupported();\n\n if (options?.source) {\n validateIdentifier(options.source, \"source database name\");\n }\n\n const dbName = toBranchDbName(name);\n const sourceDb = options?.source || await this.home.database();\n\n // Check if branch already exists\n const existing = await (await this.home.registry()).execute(\n sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n ).catch((err: unknown) => {\n throw missingRegistryError(err) ?? err;\n });\n if ((existing.rows as unknown[]).length > 0) {\n throw new Error(`Branch \"${name}\" already exists.`);\n }\n\n // Disconnect any idle pools to the source DB so TEMPLATE works.\n // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n //\n // This only reaches pools inside *this* process. The CLI runs as its own\n // process, so a `rebase dev` holding the database open is untouched by\n // it — which is why the failure below has to name what is connected, and\n // why `--force` exists.\n await this.poolManager.disconnectDatabase(sourceDb);\n\n // Create the database using the source as a template.\n // Note: Identifiers must be double-quoted, not parameterized.\n const safeDbName = dbName.replace(/\"/g, '\"\"');\n const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n const copy = async (): Promise<void> => {\n await this.db.execute(sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`));\n };\n try {\n if (options?.force) {\n await this.whileClosedToNewConnections(sourceDb, () => this.disconnectingOthers(sourceDb, copy));\n } else {\n await copy();\n }\n } catch (err) {\n const pgError = extractPgError(err);\n if (pgError?.code === PG_OBJECT_IN_USE) {\n // The template — not the new database — is the one still in use.\n throw new Error(\n `Cannot create branch: the source database \"${sourceDb}\" ${options?.force\n ? \"still had connections after they were disconnected\"\n : \"has active connections\"}.\\n`\n + await this.describeBlockingConnections(sourceDb, { forced: options?.force === true })\n );\n }\n throw describeBranchDdlError(err, dbName);\n }\n\n // The fork point, read now and kept: the `xmin` of the new database's\n // `pg_database` row is the transaction that created it — until\n // anything rewrites that row. A `GRANT CONNECT`, an `ALTER DATABASE`,\n // or `--force` closing this branch as the source of another all do,\n // and a diff that read the fork point from the catalog afterwards\n // would take every target write before it for a branch delete.\n const forkResult = await this.db.execute(\n sql`SELECT xmin::text AS xid FROM pg_database WHERE datname = ${dbName}`\n );\n const forkXid = (forkResult.rows as Record<string, unknown>[])[0]?.xid;\n\n // Record metadata in the registry — asked for again, as copying the\n // main database closed any pool on it.\n const now = new Date();\n const metadata = typeof forkXid === \"string\" ? { forkXid } : {};\n await (await this.home.registry()).execute(\n sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at, metadata)\n VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()}, ${JSON.stringify(metadata)}::jsonb)`\n );\n\n return {\n name,\n database: dbName,\n parentDatabase: sourceDb,\n createdAt: now,\n ...(typeof forkXid === \"string\" ? { forkXid } : {})\n };\n }\n\n /**\n * Delete a branch database and remove its metadata.\n * Cannot delete the main/default database.\n */\n async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n await this.assertBranchingSupported();\n\n assertValidBranchName(name);\n\n // Safety, first pass: a request that would target the default database\n // is refused before any metadata is read, so the answer costs nothing\n // and cannot depend on what a row happens to say.\n const mainDatabase = await this.home.database();\n if (toBranchDbName(name) === mainDatabase) {\n throw new Error(\"Cannot delete the main database.\");\n }\n\n // Verify the branch exists, and take the database name from the row\n // rather than deriving it again. A branch created before names stopped\n // being stripped is recorded as `rb_myfeature` while `my-feature` now\n // derives `rb_my-feature`; re-deriving would drop a database this row\n // never named — or, if that name happened to exist, somebody else's.\n // The stored value is the only one that is true by construction.\n const existing = await (await this.home.registry()).execute(\n sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n );\n const existingRows = existing.rows as Record<string, unknown>[];\n if (existingRows.length === 0) {\n throw new Error(`Branch \"${name}\" not found.`);\n }\n const dbName = existingRows[0].db_name as string;\n\n // Safety, second pass: the first checked a name we derived, this checks\n // the one we are about to drop. They differ for any row written under\n // the old scheme, and it is this one that governs.\n if (dbName === mainDatabase) {\n throw new Error(\"Cannot delete the main database.\");\n }\n\n // Disconnect any pools to this branch before dropping. Same limit as\n // `createBranch`: in-process pools only.\n await this.poolManager.disconnectDatabase(dbName);\n\n // Drop the database\n const safeDbName = dbName.replace(/\"/g, '\"\"');\n const drop = async (): Promise<void> => {\n await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n };\n try {\n if (options?.force) await this.disconnectingOthers(dbName, drop);\n else await drop();\n } catch (err) {\n const pgError = extractPgError(err);\n if (pgError?.code === PG_OBJECT_IN_USE) {\n throw new Error(\n `Cannot delete branch \"${name}\": the database ${options?.force\n ? \"still had connections after they were disconnected\"\n : \"has active connections\"}.\\n`\n + await this.describeBlockingConnections(dbName, { forced: options?.force === true })\n );\n }\n throw describeBranchDdlError(err, dbName);\n }\n\n // Remove metadata\n await (await this.home.registry()).execute(\n sql`DELETE FROM rebase.branches WHERE name = ${name}`\n );\n }\n\n /**\n * Who is holding the database open, in words a developer can act on.\n *\n * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n * other session is connected, and the one thing the old message could not\n * say is the only thing worth knowing: *which* session. \"Close other\n * clients or connections and try again\" is advice you cannot follow when\n * you do not know there is a `rebase dev` in another terminal — and that is\n * the common case, because wanting a branch and running the app are the\n * same moment.\n *\n * `application_name` is the useful column: node-postgres sends none by\n * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n * and psql all name themselves. Counting by it separates \"my own dev\n * server\" from \"the GUI I forgot about\" without any guessing.\n *\n * Best-effort by construction: this runs while reporting a failure, and a\n * diagnostic that throws would replace a real error with its own.\n */\n private async describeBlockingConnections(dbName: string, options: { forced?: boolean } = {}): Promise<string> {\n try {\n const result = await this.db.execute(sql`\n SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n count(*)::int AS n\n FROM pg_stat_activity\n WHERE datname = ${dbName}\n AND pid <> pg_backend_pid()\n GROUP BY 1\n ORDER BY 2 DESC, 1\n `);\n const rows = result.rows as Record<string, unknown>[];\n if (rows.length === 0) {\n // The blocker went away between the failure and this query, or\n // it is a session Postgres does not attribute to this database.\n return \" Retry — whatever was connected has since disconnected.\";\n }\n\n const listed = rows\n .map((row) => ` ${row.n} × ${String(row.app)}`)\n .join(\"\\n\");\n\n // With --force they were disconnected already, and came back: the\n // one thing left to say is what to stop, not to pass --force.\n return ` Connected right now:\\n${listed}\\n`\n + (options.forced\n ? \" They reconnected as fast as they were disconnected. A running `rebase dev` is the\\n\"\n + \" usual one — stop it, then run this again.\"\n : \" A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n + \" disconnect them for you.\");\n } catch {\n return options.forced\n ? \" Stop the clients connected to it — a running `rebase dev` is the usual one — then run this again.\"\n : \" Close other clients and connections, or re-run with --force.\";\n }\n }\n\n /**\n * Run `operation` with no other session on `dbName`, disconnecting them\n * first: what `--force` asks for.\n *\n * Disconnected, a client that reconnects — a running `rebase dev`'s\n * realtime listener does — can be back before `CREATE DATABASE … TEMPLATE`\n * or `DROP DATABASE` counts the sessions, and it failed on one about once\n * in seven tries, saying to pass the `--force` that had been passed. So a\n * refusal on a session still connected is retried, disconnecting again, a\n * few times before it is reported.\n */\n private async disconnectingOthers(dbName: string, operation: () => Promise<void>): Promise<void> {\n for (let attempt = 1; ; attempt++) {\n const closed = await this.terminateConnections(dbName);\n if (closed > 0) {\n // Postgres reports the backend as gone before its slot is\n // actually free, and the operation then fails on a connection\n // that no longer exists. A short settle first.\n await new Promise((resolve) => setTimeout(resolve, 250));\n }\n try {\n await operation();\n return;\n } catch (err) {\n if (attempt >= FORCE_ATTEMPTS || extractPgError(err)?.code !== PG_OBJECT_IN_USE) throw err;\n }\n }\n }\n\n /**\n * Run `operation` with `dbName` refusing new connections, and open it\n * again after, whatever happens.\n *\n * A client disconnected from the source — a running `rebase dev` holds a\n * pool and a realtime listener — cannot then reconnect before the copy has\n * counted the sessions on it. Postgres refuses `ALLOW_CONNECTIONS false` on\n * the database a session is connected to, so both statements run from the\n * server's `postgres` database, and they need the database's owner. Where\n * either is missing, the retries of {@link disconnectingOthers} are what is\n * left. A database found closed already — by a run killed before it could\n * open it — is copied as it is and opened after, like one this run closed.\n *\n * Stopped by a signal while closed ({@link REOPEN_ON_SIGNALS}), it opens\n * the database again before the process exits; a second signal waits for\n * that rather than cutting it short. One it could not open is named, with\n * the statement that does. No handler is left installed after the copy.\n *\n * From before it reads whether the database is open until after it opens\n * it, it holds the {@link COPY_LOCK_CLASS} lock, so the self-heal leaves\n * the database to it and a second forced create on the same source waits\n * for it. A process that dies holding it ends its session, which releases\n * it. A server the lock cannot be taken on is copied without one.\n */\n private async whileClosedToNewConnections(dbName: string, operation: () => Promise<void>): Promise<void> {\n const lock = dbName === MAINTENANCE_DATABASE ? null : await this.holdCopyLock(dbName);\n try {\n await this.closedToNewConnections(dbName, operation);\n } finally {\n await lock?.end().catch(() => undefined);\n }\n }\n\n /**\n * The {@link COPY_LOCK_CLASS} lock on `dbName`, on a client of its own, or\n * null where it cannot be taken.\n *\n * Its own client, never one checked out of the maintenance pool: opening\n * the database again ends that pool, and `pool.end()` waits for its\n * checked-out clients, so the create would wait on itself.\n */\n private async holdCopyLock(dbName: string): Promise<Client | null> {\n let client: Client;\n try {\n const { connectionString } = this.poolManager.getPool(MAINTENANCE_DATABASE).options;\n if (!connectionString) return null;\n client = new Client({ connectionString, connectionTimeoutMillis: 5000 });\n } catch {\n return null;\n }\n // A connection dropped while it waits must not take the command down with it.\n client.on(\"error\", () => undefined);\n try {\n await client.connect();\n await client.query(\"SELECT pg_advisory_lock($1, hashtext($2))\", [COPY_LOCK_CLASS, dbName]);\n return client;\n } catch {\n await client.end().catch(() => undefined);\n return null;\n }\n }\n\n /** {@link whileClosedToNewConnections} past its lock. */\n private async closedToNewConnections(dbName: string, operation: () => Promise<void>): Promise<void> {\n const safe = dbName.replace(/\"/g, '\"\"');\n const maintenance = dbName === MAINTENANCE_DATABASE ? null : this.poolManager.getDrizzle(MAINTENANCE_DATABASE);\n let closed = false;\n try {\n if (maintenance) {\n const state = await maintenance.execute(sql`SELECT datallowconn FROM pg_database WHERE datname = ${dbName}`);\n const [row] = state.rows as Record<string, unknown>[];\n if (row?.datallowconn === true) {\n await maintenance.execute(sql.raw(`ALTER DATABASE \"${safe}\" ALLOW_CONNECTIONS false`));\n }\n closed = row !== undefined;\n }\n } catch {\n // No `postgres` database to run it from, or not the owner.\n }\n if (!closed) {\n await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);\n await operation();\n return;\n }\n\n let reopening: Promise<void> | undefined;\n const reopen = (): Promise<void> => {\n reopening ??= this.reopenToConnections(dbName);\n return reopening;\n };\n let caught: NodeJS.Signals | undefined;\n const release = (): void => {\n for (const signal of REOPEN_ON_SIGNALS) process.removeListener(signal, onSignal);\n };\n const onSignal = (signal: NodeJS.Signals): void => {\n if (caught) return;\n caught = signal;\n void reopen()\n .catch((err: unknown) => {\n console.error(err instanceof Error ? err.message : String(err));\n })\n .finally(() => {\n release();\n process.kill(process.pid, signal);\n });\n };\n for (const signal of REOPEN_ON_SIGNALS) {\n try {\n process.on(signal, onSignal);\n } catch {\n // A signal this platform cannot deliver (SIGQUIT on Windows).\n }\n }\n try {\n await operation();\n } finally {\n try {\n await reopen();\n } finally {\n // A caught signal releases them itself, once the database is open.\n if (!caught) release();\n }\n }\n }\n\n /** `ALLOW_CONNECTIONS true` again, from the maintenance database, or an error that says how to do it by hand. */\n private async reopenToConnections(dbName: string): Promise<void> {\n const statement = reopenStatement(dbName);\n try {\n await this.poolManager.getDrizzle(MAINTENANCE_DATABASE).execute(sql.raw(statement));\n } catch (err) {\n throw new Error(\n `\"${dbName}\" was closed to new connections for the copy and could not be opened again ` +\n `(${extractPgError(err)?.message ?? extractCauseMessage(err) ?? String(err)}). ` +\n `Nothing can connect to it until you run, from another database: ${statement};`\n );\n } finally {\n await this.poolManager.disconnectDatabase(MAINTENANCE_DATABASE);\n }\n }\n\n /**\n * Disconnect every other session on a database, and say how many.\n *\n * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n * query leaves the session connected, and a connected session is exactly\n * what blocks the operation.\n *\n * The current backend is excluded — terminating the connection running this\n * statement would abort the command that asked for it.\n */\n private async terminateConnections(dbName: string): Promise<number> {\n const result = await this.db.execute(sql`\n SELECT pg_terminate_backend(pid)\n FROM pg_stat_activity\n WHERE datname = ${dbName}\n AND pid <> pg_backend_pid()\n `);\n\n return (result.rows as unknown[]).length;\n }\n\n /**\n * Everything prune needs to decide, in two queries.\n *\n * Reads the rows and the server's database list rather than joining them,\n * so the *disagreements* between the two are visible — a row whose database\n * is gone and a database with no row are the two things prune exists to\n * find, and a join hides both.\n */\n async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n const rowResult = await (await this.home.registry()).execute(sql.raw(`\n SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n `));\n const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n name: row.name as string,\n dbName: row.db_name as string,\n createdAt: new Date(row.created_at as string)\n }));\n\n const dbResult = await this.db.execute(sql`\n SELECT datname FROM pg_database WHERE NOT datistemplate\n `);\n const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n return { rows, databases };\n }\n\n /** Remove a metadata row whose database is already gone. */\n async forgetBranchRow(name: string): Promise<void> {\n await (await this.home.registry()).execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n }\n\n /**\n * Drop a database by name, with no metadata row required.\n *\n * `deleteBranch` deliberately takes its database name from the row, because\n * the row is the only value that is true by construction. Prune has the\n * opposite job — the cases it handles are exactly the ones where row and\n * database disagree — so it needs to name a database directly. Guarded the\n * same way regardless: the main database is never droppable.\n */\n async dropDatabase(dbName: string): Promise<void> {\n validateIdentifier(dbName, \"database name\");\n if (dbName === await this.home.database()) {\n throw new Error(\"Cannot delete the main database.\");\n }\n\n await this.poolManager.disconnectDatabase(dbName);\n try {\n await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n } catch (err) {\n throw describeBranchDdlError(err, dbName);\n }\n }\n\n /**\n * List all branches recorded in the metadata table.\n * Optionally fetches database sizes from pg_database.\n */\n async listBranches(): Promise<BranchInfo[]> {\n const result = await (await this.home.registry()).execute(sql.raw(`\n SELECT \n b.name,\n b.db_name,\n b.parent_db,\n b.created_at,\n pg_database_size(b.db_name) as size_bytes\n FROM ${BRANCHES_TABLE} b\n JOIN pg_database d ON d.datname = b.db_name\n ORDER BY b.created_at DESC\n `));\n\n return (result.rows as Record<string, unknown>[]).map((row) => ({\n name: row.name as string,\n database: row.db_name as string,\n parentDatabase: row.parent_db as string,\n createdAt: new Date(row.created_at as string),\n sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n }));\n }\n\n /**\n * Get info about a specific branch.\n */\n async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n assertValidBranchName(name);\n\n const result = await (await this.home.registry()).execute(sql`\n SELECT\n b.name,\n b.db_name,\n b.parent_db,\n b.created_at,\n b.metadata->>'forkXid' AS fork_xid\n FROM rebase.branches b\n WHERE b.name = ${name}\n `);\n\n const rows = result.rows as Record<string, unknown>[];\n if (rows.length === 0) return undefined;\n\n const row = rows[0];\n\n // Attempt to get size — may fail if the DB was externally dropped.\n // Same reason as `deleteBranch`: the size of a re-derived name is the\n // size of some other database, or of nothing.\n let sizeBytes: number | undefined;\n try {\n const dbName = row.db_name as string;\n const sizeResult = await this.db.execute(\n sql`SELECT pg_database_size(${dbName}) as size_bytes`\n );\n const sizeRows = sizeResult.rows as Record<string, unknown>[];\n if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n sizeBytes = Number(sizeRows[0].size_bytes);\n }\n } catch {\n // Database might not exist anymore\n }\n\n return {\n name: row.name as string,\n database: row.db_name as string,\n parentDatabase: row.parent_db as string,\n createdAt: new Date(row.created_at as string),\n sizeBytes,\n ...(typeof row.fork_xid === \"string\" ? { forkXid: row.fork_xid } : {})\n };\n }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAmBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;;AAG3B,IAAM,iBAAiB;;AAGvB,IAAM,uBAAuB;;;;;;;AAQ7B,IAAM,oBAA+C;CAAC;CAAU;CAAU;CAAW;AAAS;;;;;;;;;;;AAY9F,IAAM,kBAAkB;;AAGxB,SAAS,gBAAgB,QAAwB;CAC7C,OAAO,mBAAmB,OAAO,QAAQ,MAAM,MAAI,EAAE;AACzD;;;;;;;;;;;;;;;;;;;;;;AA+BA,eAAsB,sBAClB,kBACA,SAAiD,CAAC,GACxB;CAC1B,MAAM,SAA4B;EAAE,UAAU,CAAC;EAAG,QAAQ,CAAC;CAAE;CAC7D,IAAI;CACJ,IAAI;CACJ,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,QAAQ,mBAAmB,IAAI,SAAS,MAAM,CAAC,CAAC;EAChD,IAAI,WAAW,IAAI;EACnB,iBAAiB,IAAI,SAAS;CAClC,QAAQ;EACJ,OAAO;CACX;CACA,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,KAAK,SAAS,MAAM,KAAK,KAAK,EAAE,CAAC,CACzE,QAAQ,SAAS,SAAS,MAAM,SAAS,oBAAoB,CAAC,CAAC;CACpE,IAAI,MAAM,WAAW,GAAG,OAAO;CAE/B,MAAM,SAAS,IAAI,OAAO;EAAE,kBAAkB;EAAgB,yBAAyB;CAAK,CAAC;CAE7F,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;EACA,MAAM,OAAO,QAAQ;CACzB,QAAQ;EACJ,OAAO;CACX;CACA,IAAI;EACA,MAAM,SAAS,MAAM,OAAO,MACxB;;;;;;;;;2BAUA,CAAC,KAAK,CACV;EACA,KAAK,MAAM,EAAE,aAAa,OAAO,MAAM;GAMnC,KAAI,MAJe,OAAO,MACtB,2DACA,CAAC,iBAAiB,OAAO,CAC7B,EAAA,CACS,KAAK,EAAE,EAAE,WAAW,MAAM;GACnC,MAAM,YAAY,gBAAgB,OAAO;GACzC,IAAI;IACA,MAAM,OAAO,MAAM,SAAS;IAC5B,OAAO,SAAS,KAAK,OAAO;GAChC,SAAS,KAAK;IACV,OAAO,OAAO,KAAK;KACf,UAAU;KACV,QAAQ,eAAe,GAAG,CAAC,EAAE,WAAW,oBAAoB,GAAG,KAAK,OAAO,GAAG;KAC9E;IACJ,CAAC;GACL,UAAU;IACN,MAAM,OAAO,MAAM,+CAA+C,CAAC,iBAAiB,OAAO,CAAC,CAAC,CACxF,YAAY,KAAA,CAAS;GAC9B;EACJ;CACJ,QAAQ,CAER,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;CACA,OAAO;AACX;;AAGA,SAAgB,wBAAwB,QAAqC;CACzE,OAAO,CACH,GAAG,OAAO,SAAS,KAAK,aACpB,MAAM,SAAS,mIACgC,GACnD,GAAG,OAAO,OAAO,KAAK,EAAE,UAAU,QAAQ,gBACtC,MAAM,SAAS,6HACmB,OAAO,uDAAuD,UAAU,EAAE,CACpH;AACJ;;;;;;;;;AAUA,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;;;;AAMA,SAAS,qBAAqB,KAAiC;CAC3D,IAAI,eAAe,GAAG,CAAC,EAAE,SAAS,oBAAoB,OAAO,KAAA;CAC7D,uBAAO,IAAI,MACP,8OAGJ;AACJ;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAiBA,IAAa,gBAAb,MAA2B;CAUX;CACA;CAVZ;;;;;;;CAQA,YACI,IACA,aACA,MACF;EAHU,KAAA,KAAA;EACA,KAAA,cAAA;EAGR,KAAK,OAAO,QAAQ;GAChB,UAAU,YAAY,YAAY;GAClC,UAAU,YAAY;EAC1B;CACJ;;;;;;;;;;;;;CAcA,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;;;CAQA,MAAM,oBAAsC;EAIxC,MAAM,CAAC,QAAO,OAHQ,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC9C,GAAG,8DACP,EAAA,CACqB;EACrB,OAAO,QAAQ,KAAA,KAAa,QAAQ,IAAI,KAAK,SAAS,MAAM;CAChE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,WAAW,MAAM,KAAK,KAAK,SAAS;EAC1C,MAAM,SAAS,QAAQ,GAAG,oCAAoC;EAE9D,MAAM,SAAS,QAAQ,IAAI,IAAI;yCACE,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,SAAS,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAChF;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,MAAM,KAAK,KAAK,SAAS;EAQ7D,KAAK,OALmB,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,CAAC,CAAC,OAAO,QAAiB;GACtB,MAAM,qBAAqB,GAAG,KAAK;EACvC,CAAC,EAAA,CACa,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAIlD,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,MAAM,OAAO,YAA2B;GACpC,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CAAC;EAC/F;EACA,IAAI;GACA,IAAI,SAAS,OACT,MAAM,KAAK,4BAA4B,gBAAgB,KAAK,oBAAoB,UAAU,IAAI,CAAC;QAE/F,MAAM,KAAK;EAEnB,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,IAAI,SAAS,QAC9D,uDACA,yBAAyB,OAC7B,MAAM,KAAK,4BAA4B,UAAU,EAAE,QAAQ,SAAS,UAAU,KAAK,CAAC,CAC1F;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAWA,MAAM,WAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,6DAA6D,QACpE,EAAA,CAC4B,KAAmC,EAAE,EAAE;EAInE,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,WAAW,OAAO,YAAY,WAAW,EAAE,QAAQ,IAAI,CAAC;EAC9D,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,IAAI,KAAK,UAAU,QAAQ,EAAE,SAClG;EAEA,OAAO;GACH;GACA,UAAU;GACV,gBAAgB;GAChB,WAAW;GACX,GAAI,OAAO,YAAY,WAAW,EAAE,QAAQ,IAAI,CAAC;EACrD;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,MAAM,eAAe,MAAM,KAAK,KAAK,SAAS;EAC9C,IAAI,eAAe,IAAI,MAAM,cACzB,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,OAHG,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAChD,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,cACX,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAGhD,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,OAAO,YAA2B;GACpC,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE;EACA,IAAI;GACA,IAAI,SAAS,OAAO,MAAM,KAAK,oBAAoB,QAAQ,IAAI;QAC1D,MAAM,KAAK;EACpB,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,kBAAkB,SAAS,QACnD,uDACA,yBAAyB,OAC7B,MAAM,KAAK,4BAA4B,QAAQ,EAAE,QAAQ,SAAS,UAAU,KAAK,CAAC,CACxF;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAC/B,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAgB,UAAgC,CAAC,GAAoB;EAC3G,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GASX,OAAO,2BANQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAIwB,EAAO,OAClC,QAAQ,SACL,qIAEA;EAEd,QAAQ;GACJ,OAAO,QAAQ,SACT,wGACA;EACV;CACJ;;;;;;;;;;;;CAaA,MAAc,oBAAoB,QAAgB,WAA+C;EAC7F,KAAK,IAAI,UAAU,IAAK,WAAW;GAE/B,IAAI,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;GAE3D,IAAI;IACA,MAAM,UAAU;IAChB;GACJ,SAAS,KAAK;IACV,IAAI,WAAW,kBAAkB,eAAe,GAAG,CAAC,EAAE,SAAS,kBAAkB,MAAM;GAC3F;EACJ;CACJ;;;;;;;;;;;;;;;;;;;;;;;;;CA0BA,MAAc,4BAA4B,QAAgB,WAA+C;EACrG,MAAM,OAAO,WAAW,uBAAuB,OAAO,MAAM,KAAK,aAAa,MAAM;EACpF,IAAI;GACA,MAAM,KAAK,uBAAuB,QAAQ,SAAS;EACvD,UAAU;GACN,MAAM,MAAM,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;EAC3C;CACJ;;;;;;;;;CAUA,MAAc,aAAa,QAAwC;EAC/D,IAAI;EACJ,IAAI;GACA,MAAM,EAAE,qBAAqB,KAAK,YAAY,QAAQ,oBAAoB,CAAC,CAAC;GAC5E,IAAI,CAAC,kBAAkB,OAAO;GAC9B,SAAS,IAAI,OAAO;IAAE;IAAkB,yBAAyB;GAAK,CAAC;EAC3E,QAAQ;GACJ,OAAO;EACX;EAEA,OAAO,GAAG,eAAe,KAAA,CAAS;EAClC,IAAI;GACA,MAAM,OAAO,QAAQ;GACrB,MAAM,OAAO,MAAM,6CAA6C,CAAC,iBAAiB,MAAM,CAAC;GACzF,OAAO;EACX,QAAQ;GACJ,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;GACxC,OAAO;EACX;CACJ;;CAGA,MAAc,uBAAuB,QAAgB,WAA+C;EAChG,MAAM,OAAO,OAAO,QAAQ,MAAM,MAAI;EACtC,MAAM,cAAc,WAAW,uBAAuB,OAAO,KAAK,YAAY,WAAW,oBAAoB;EAC7G,IAAI,SAAS;EACb,IAAI;GACA,IAAI,aAAa;IAEb,MAAM,CAAC,QAAO,MADM,YAAY,QAAQ,GAAG,wDAAwD,QAAQ,EAAA,CACvF;IACpB,IAAI,KAAK,iBAAiB,MACtB,MAAM,YAAY,QAAQ,IAAI,IAAI,mBAAmB,KAAK,0BAA0B,CAAC;IAEzF,SAAS,QAAQ,KAAA;GACrB;EACJ,QAAQ,CAER;EACA,IAAI,CAAC,QAAQ;GACT,MAAM,KAAK,YAAY,mBAAmB,oBAAoB;GAC9D,MAAM,UAAU;GAChB;EACJ;EAEA,IAAI;EACJ,MAAM,eAA8B;GAChC,cAAc,KAAK,oBAAoB,MAAM;GAC7C,OAAO;EACX;EACA,IAAI;EACJ,MAAM,gBAAsB;GACxB,KAAK,MAAM,UAAU,mBAAmB,QAAQ,eAAe,QAAQ,QAAQ;EACnF;EACA,MAAM,YAAY,WAAiC;GAC/C,IAAI,QAAQ;GACZ,SAAS;GACT,OAAY,CAAC,CACR,OAAO,QAAiB;IACrB,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;GAClE,CAAC,CAAC,CACD,cAAc;IACX,QAAQ;IACR,QAAQ,KAAK,QAAQ,KAAK,MAAM;GACpC,CAAC;EACT;EACA,KAAK,MAAM,UAAU,mBACjB,IAAI;GACA,QAAQ,GAAG,QAAQ,QAAQ;EAC/B,QAAQ,CAER;EAEJ,IAAI;GACA,MAAM,UAAU;EACpB,UAAU;GACN,IAAI;IACA,MAAM,OAAO;GACjB,UAAU;IAEN,IAAI,CAAC,QAAQ,QAAQ;GACzB;EACJ;CACJ;;CAGA,MAAc,oBAAoB,QAA+B;EAC7D,MAAM,YAAY,gBAAgB,MAAM;EACxC,IAAI;GACA,MAAM,KAAK,YAAY,WAAW,oBAAoB,CAAC,CAAC,QAAQ,IAAI,IAAI,SAAS,CAAC;EACtF,SAAS,KAAK;GACV,MAAM,IAAI,MACN,IAAI,OAAO,8EACP,eAAe,GAAG,CAAC,EAAE,WAAW,oBAAoB,GAAG,KAAK,OAAO,GAAG,EAAE,qEACT,UAAU,EACjF;EACJ,UAAU;GACN,MAAM,KAAK,YAAY,mBAAmB,oBAAoB;EAClE;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,OAHW,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;oDACzB,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,OAAO,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG,4CAA4C,MAAM;CACpG;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,MAAM,KAAK,KAAK,SAAS,GACpC,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAaxC,QAAQ,OAZc,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,IAAI,IAAI;;;;;;;mBAOvD,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAa1B,MAAM,QAAO,OAXS,MAAM,KAAK,KAAK,SAAS,EAAA,CAAG,QAAQ,GAAG;;;;;;;;6BAQxC,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,UAAU,IAAI;GACd,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;GACA,GAAI,OAAO,IAAI,aAAa,WAAW,EAAE,SAAS,IAAI,SAAS,IAAI,CAAC;EACxE;CACJ;AACJ"}

package/dist/PostgresBackendDriver.d.ts CHANGED Viewed

@@ -135,6 +135,8 @@ export declare class PostgresBackendDriver implements DataDriver {
      * allowing test spies applied after construction to take effect.
      */
     get admin(): DatabaseAdmin;
+    /** The diff with each table named by the collection it backs, where one does. */
+    private nameDiffCollections;
     /**
      * `SQLAdmin.listen`: a `LISTEN` on a connection of its own, through the
      * listener CDC and the channel bus use, which reconnects and heartbeats.
@@ -222,6 +224,17 @@ export declare class PostgresBackendDriver implements DataDriver {
     private asRestServes;
     applyAfterReadForRest(rows: Record<string, unknown>[], path: string): Promise<Record<string, unknown>[]>;
     fetchCollection<M extends Record<string, unknown>>({ path, collection, startAfter, ...query }: FetchCollectionProps<M>): Promise<Record<string, unknown>[]>;
+    /**
+     * Every stored row of a collection, past every read hook, for a whole-store
+     * sweep — see `DataDriver.scanStoredRows`. Only this unscoped driver has
+     * it: {@link AuthenticatedPostgresBackendDriver} reads as a caller, and a
+     * caller's reads are scoped.
+     */
+    scanStoredRows(props: {
+        path: string;
+        collection: CollectionConfig;
+        pageSize?: number;
+    }): AsyncIterable<Record<string, unknown>[]>;
     /**
      * Listen to a collection: the rows now, then again after every change.
      *

package/dist/PostgresBootstrapper.d.ts CHANGED Viewed

@@ -115,6 +115,13 @@ export interface PostgresDriverInternals {
      * they would stay uninstrumented until the next restart.
      */
     provisionCdcForTables?: (tables: CdcTableRef[]) => Promise<void>;
+    /**
+     * Opened without provisioning: the framework's internal tables the
+     * request role can reach, which a provisioning boot would have revoked.
+     * Empty when there are none or requests do not run as that role. The
+     * server's boot refuses on any; a script's `openRebase` only warns.
+     */
+    exposedInternalTables?: string[];
 }
 /**
  * Which table name the boot-time drift check should look for, for one collection.

package/dist/auth/services.d.ts CHANGED Viewed

@@ -111,7 +111,14 @@ export declare class UserService implements UserRepository {
      */
     getUserRoleIds(uid: string): Promise<string[]>;
     /**
-     * Set roles for a user (replaces existing roles)
+     * Set roles for a user (replaces existing roles).
+     *
+     * Each role is its own bound parameter. The array used to be spelled as a
+     * literal, `{${roles.join(",")}}`, so the database parsed what the caller
+     * had only checked as strings: `"support,admin"` was stored as two roles,
+     * one of them `admin`, and `"NULL"` as a SQL NULL. A name that would be read
+     * back as other roles is refused (`roleNameProblem`) — RLS splits the
+     * comma-joined `app.user_roles` the same way.
      */
     setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     /**

package/dist/auth/verify-auth-tables.d.ts ADDED Viewed

@@ -0,0 +1,21 @@
+import type { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { type PgTable } from "drizzle-orm/pg-core";
+/** One table and the columns of it that auth reads and writes. */
+export interface AuthTableExpectation {
+    /** Schema-qualified, quoted. */
+    table: string;
+    columns: string[];
+}
+/** What a Drizzle table definition says auth will query. */
+export declare function expectationOf(table: PgTable): AuthTableExpectation;
+/**
+ * The users table, which is the project's own when it declares an auth
+ * collection: only the columns the auth bootstrap guarantees on it are
+ * expected, never the collection's other fields — those are the collection
+ * schema's business, checked where collections are.
+ */
+export declare function usersExpectation(qualifiedTable: string): AuthTableExpectation;
+/** Each table that cannot be read as expected, with the database's reason. */
+export declare function findUnusableAuthTables(db: NodePgDatabase, expectations: readonly AuthTableExpectation[]): Promise<string[]>;
+/** The refusal, phrased as what to run. */
+export declare function unusableAuthTablesError(problems: readonly string[]): Error;

package/dist/{backup-cli-gijeXe0u.js → backup-cli-PoRG-zEq.js} RENAMED Viewed

@@ -1,9 +1,9 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { i as __exportAll, t as promptConfirm } from "./cli-prompt-DXG0yk-h.js";
-import { $ as forLibpq, et as redactConnectionPasswords, t as checkDatabaseConnectivity, tt as splitPassword, z as resolveLocalBin } from "./cli-errors-DiA0XFIS.js";
+import { et as forLibpq, nt as splitPassword, t as checkDatabaseConnectivity, tt as redactConnectionPasswords, z as resolveLocalBin } from "./cli-errors-DsYyNYzd.js";
 import { a as outWarn, i as outError, r as out, t as chalk } from "./source-fZb92pN8.js";
-import { d as parseCommandFlags, l as closestWord, y as execa } from "./db-subcommands-BPoHCxJR.js";
+import { T as execa, _ as parseCommandFlags, h as closestWord } from "./migrate-baseline-B-2Ef4Mv.js";
 import path from "path";
 import fs from "fs";
 import os from "os";
@@ -1958,4 +1958,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { buildBackupFilename as A, diagnoseRowSecurityDumpFailure as B, restoreDumpReplacing as C, resolvePgBinary as D, pgToolVariable as E, buildPgRestoreScriptArgs as F, parseDbNameFromUrl as G, joinStorageKey as H, buildPsqlScriptArgs as I, resolveConnectionString as J, parseDumpObjects as K, buildRowSecurityPgOptions as L, buildPgDumpallGlobalsArgs as M, buildPgRestoreArgs as N, selectBackupsToPrune as O, buildPgRestoreListArgs as P, checkToolServerCompatibility as R, restoreDump as S, validateDump as T, parseBackupDestination as U, globalsFileForDump as V, parseBackupTimestamp as W, splitGlobalsStatements as X, serverVersionNumToMajor as Y, withDatabaseName as Z, listBackups as _, BackupToolError as a, readDumpObjects as b, backup_service_exports as c, detectToolMajor as d, discardPartialDump as f, getServerVersionMajor as g, findRestoreConflicts as h, parseRestoreLine as i, buildPgDumpArgs as j, CLEAN_LOCK_TIMEOUT as k, createDump as l, findCleanExtras as m, parseBackupLine as n, CleanRestoreFailed as o, ensureDatabaseExists as p, parsePgToolMajor as q, parseBackupsListLine as r, applyGlobals as s, backup_cli_exports as t, describeUnreadableDump as u, preflight as v, uploadBackup as w, resetSharedSession as x, pruneBackups as y, cleanRestorePrelude as z };
-//# sourceMappingURL=backup-cli-gijeXe0u.js.map
+//# sourceMappingURL=backup-cli-PoRG-zEq.js.map