pgman v0.3.0

Highlights

• A local copy of an environment in two commands. pgman dump staging/ledger takes it from the replica through the bastion, the
  password read at that moment and never on a command line or on disk;
  pgman restore … local --as ledger_copy --clean puts it into a local
  database, never a protected one.
• Scripts and patches from the command line. pgman run runs a
  script that manages its own transactions, \c between databases;
  pgman apply is the environments view's P, --outside included.
• For a coding agent: MCP dump and restore, each confirmed by
  you, so an agent can refresh its copy without ever holding the
  environment's credentials.

Added

• pgman dump <target> [FILE]: a dump by your own pg_dump, through
  pgman's connection — the environment's replica unless --primary, the
  password read from its secret at that moment and given to pg_dump only
  in its environment, the ssh tunnel opened for it. The local pg_dump's
  version is checked against the server first; the dump is written to a
  hidden name and renamed into place on success, private to you, with a
  -latest link for a default name. A replica cancelling the dump (a
  recovery conflict) and a permission failure are explained. What the
  dump's user can't read (no SELECT, no USAGE on its schema, row-level
  security, large objects) is found before pg_dump starts and refused
  by name; --skip-unreadable leaves exactly that out and says so. A
  sequence that a readable table owns can't be left out, and is named
  with the GRANT that fixes it. See
  docs/dump-restore.md.
• pgman restore <FILE> <target>: a dump restored by your own
  pg_restore, never into a protected environment and only on this
  machine unless --allow-remote. --as NAME restores into another
  database, --create makes it, --clean replaces it; other sessions
  refuse it unless --terminate; it is confirmed, or --yes. It exits
  1 when pg_restore went past real errors, counting a newer pg_dump's
  SET of a setting the server doesn't have as harmless. --jobs,
  --keep-owners and options after -- go to pg_restore; a plain SQL
  dump is psql's.
• pgman run <target> <FILE>: a script that runs its own transactions
  (BEGIN … COMMIT), as psql -f does, with \c DATABASE moving it
  to another database of the environment. Checked against safety.toml
  first; confirmed (a protected target by typing its name); a failure
  or Ctrl-C reports what stayed committed, what rolled back and what
  never ran. VACUUM and CONCURRENTLY run without the statement
  timeout; a standby is refused. See docs/run.md.
• pgman apply <target> [--outside] [--dry-run | --copy]: the
  environments view's P from the command line. An --outside plan or
  a protected environment takes the typed name, which --yes doesn't
  answer.
• MCP: dump and restore tools, each confirmed by the operator
  through elicitation (a protected environment, or a database to be
  replaced, by typing its name); files stay inside the server's
  working directory, and a restore is local and unprotected only.
• A <target> on the command line is ENV, ENV/DATABASE,
  ENV/SERVER/DATABASE, a connections.toml name, or a URL. It is
  protected by its environment, by "prod" in its name, or by being on a
  server a protected environment reaches, however that is written.
• pgman dumpp says unknown command "dumpp" (did you mean dump?).
• Ctrl-C, SIGTERM and SIGHUP stop dump, restore, run and apply
  cleanly: the tool stopped, a partial file removed, a transaction
  rolled back.

Fixed

• Ctrl-C in the editor (and Esc twice while patches run) now cancels
  the running statement on a server reached with sslmode=require or
  verify-*, such as RDS: the cancel request went out without TLS,
  which the client library refuses for such a session, so it never
  reached the server.