@rebasepro/server-postgres 0.10.1-canary.a54c057 → 0.10.1-canary.b1e3dbf

package/src/backup/backup-service.ts

@@ -17,8 +17,11 @@ import {
     BackupDestination,
     buildBackupFilename,
     buildPgDumpArgs,
+    buildPgDumpallGlobalsArgs,
     buildPgRestoreArgs,
+    buildPgRestoreListArgs,
     checkToolServerCompatibility,
+    globalsFileForDump,
     joinStorageKey,
     parsePgToolMajor,
     parseBackupTimestamp,
@@ -26,6 +29,7 @@ import {
     VersionCompatibility
 } from "./pg-tools";
 import { BackupObject, RetentionOptions, selectBackupsToPrune } from "./retention";
+import { applyGlobalsWith, pruneWith } from "./backup-logic";
 
 export class BackupToolError extends Error {
     constructor(message: string, readonly hint?: string) {
@@ -34,13 +38,16 @@ export class BackupToolError extends Error {
     }
 }
 
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
 export function resolvePgBinary(
-    tool: "pg_dump" | "pg_restore",
+    tool: "pg_dump" | "pg_restore" | "pg_dumpall",
     env: Record<string, string | undefined> = process.env
 ): string | null {
-    const override = tool === "pg_dump" ? env.PG_DUMP_PATH : env.PG_RESTORE_PATH;
-    if (override && fs.existsSync(override)) return override;
+    const overrideVar =
+        tool === "pg_dump" ? env.PG_DUMP_PATH
+        : tool === "pg_restore" ? env.PG_RESTORE_PATH
+        : env.PG_DUMPALL_PATH;
+    if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
     return resolveLocalBin(tool);
 }
 
@@ -105,12 +112,23 @@ export interface BackupResult {
     localFile: string;
     fileName: string;
     sizeBytes: number;
+    /**
+     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles
+     * (present unless globals capture was disabled or unavailable).
+     */
+    globalsFile?: string;
+    globalsSizeBytes?: number;
 }
 
 /**
  * Produce a custom-format dump on local disk. When `outDir` is omitted the
  * file is written to the OS temp directory (used by the upload path, which
  * cleans it up afterwards).
+ *
+ * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+ * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+ * depend on can be recreated on restore. Set `includeGlobals: false` to skip
+ * it (e.g. when the caller has no privilege to read cluster globals).
  */
 export async function createDump(opts: {
     connectionString: string;
@@ -120,6 +138,7 @@ export async function createDump(opts: {
     excludeSchemas?: string[];
     noOwner?: boolean;
     inheritStdio?: boolean;
+    includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<BackupResult> {
     const env = opts.env ?? process.env;
@@ -149,7 +168,91 @@ export async function createDump(opts: {
     });
 
     const sizeBytes = fs.existsSync(localFile) ? fs.statSync(localFile).size : 0;
-    return { localFile, fileName, sizeBytes };
+
+    const result: BackupResult = { localFile, fileName, sizeBytes };
+
+    if (opts.includeGlobals !== false) {
+        const dumpallBin = resolvePgBinary("pg_dumpall", env);
+        if (!dumpallBin) {
+            throw new BackupToolError(
+                "Could not find the 'pg_dumpall' binary needed to capture cluster roles.",
+                "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. " +
+                "To take a role-incomplete backup anyway, pass includeGlobals: false."
+            );
+        }
+        const globalsFile = globalsFileForDump(localFile);
+        await execa(
+            dumpallBin,
+            buildPgDumpallGlobalsArgs({ connectionString: opts.connectionString, outFile: globalsFile }),
+            { stdio: opts.inheritStdio ? "inherit" : "pipe", env: { ...(env as Record<string, string>) } }
+        );
+        result.globalsFile = globalsFile;
+        result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
+    }
+
+    return result;
+}
+
+/**
+ * Cheap integrity check on a freshly written dump: it must be non-empty and
+ * `pg_restore --list` must parse its table of contents without error. Used
+ * before pruning older backups so a corrupt-but-exit-0 dump never becomes
+ * the reason the last good backup is deleted.
+ */
+export async function validateDump(
+    localFile: string,
+    env: Record<string, string | undefined> = process.env
+): Promise<{ ok: boolean; reason?: string }> {
+    if (!fs.existsSync(localFile)) {
+        return { ok: false, reason: `Dump file does not exist: ${localFile}` };
+    }
+    if (fs.statSync(localFile).size === 0) {
+        return { ok: false, reason: "Dump file is empty (0 bytes)." };
+    }
+    const bin = resolvePgBinary("pg_restore", env);
+    if (!bin) {
+        // Can't verify without pg_restore; treat as inconclusive-but-fail so
+        // pruning doesn't proceed on an unverified dump.
+        return { ok: false, reason: "Could not find 'pg_restore' to verify the dump." };
+    }
+    try {
+        await execa(bin, buildPgRestoreListArgs(localFile), {
+            stdio: "pipe",
+            env: { ...(env as Record<string, string>) }
+        });
+        return { ok: true };
+    } catch (err) {
+        return { ok: false, reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}` };
+    }
+}
+
+/**
+ * Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+ * before a restore, so the dump's GRANT/RLS statements (which reference
+ * `rebase_user` and any owner roles) actually apply. Runs statement by
+ * statement and tolerates per-statement failures — on a same-cluster restore
+ * the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+ * a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+ * should abort role recreation. Returns how many statements applied vs were
+ * skipped.
+ */
+export async function applyGlobals(
+    connectionString: string,
+    globalsSql: string,
+    log: (message: string) => void = () => {}
+): Promise<{ applied: number; skipped: number }> {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+        return await applyGlobalsWith(
+            async (sql) => { await client.query(sql); },
+            globalsSql,
+            log
+        );
+    } finally {
+        await client.end();
+    }
 }
 
 /**
@@ -157,12 +260,18 @@ export async function createDump(opts: {
  * `connectionString`. Destructive when `clean` is set (drops objects
  * first). Never called automatically — the CLI gates it behind explicit
  * confirmation.
+ *
+ * Runs with `--exit-on-error` by default: a restore that logs-and-continues
+ * past a failed GRANT (because a role was missing) reports success with RLS
+ * un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+ * and only set `exitOnError: false` deliberately.
  */
 export async function restoreDump(opts: {
     connectionString: string;
     inputFile: string;
     clean?: boolean;
     noOwner?: boolean;
+    exitOnError?: boolean;
     inheritStdio?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<void> {
@@ -178,7 +287,8 @@ export async function restoreDump(opts: {
         connectionString: opts.connectionString,
         inputFile: opts.inputFile,
         clean: opts.clean,
-        noOwner: opts.noOwner
+        noOwner: opts.noOwner,
+        exitOnError: opts.exitOnError
     });
     await execa(bin, args, {
         stdio: opts.inheritStdio ? "inherit" : "pipe",
@@ -288,12 +398,21 @@ export async function pruneBackups(
 ): Promise<string[]> {
     const backups = await listBackups(dest, storage);
     const toDelete = selectBackupsToPrune(backups, options);
-    for (const key of toDelete) {
-        if (dest.kind === "local") {
-            if (fs.existsSync(key)) fs.unlinkSync(key);
-        } else if (storage) {
-            await storage.deleteObject(key, dest.bucket);
-        }
-    }
+
+    // Delete each dump together with its `.globals.sql` sidecar (pruneWith
+    // handles the pairing + best-effort sidecar). The deleter rejects on a
+    // missing key so pruneWith can swallow an absent sidecar.
+    const deleteObject =
+        dest.kind === "local"
+            ? async (key: string) => {
+                if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
+                fs.unlinkSync(key);
+            }
+            : async (key: string) => {
+                if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
+                await storage.deleteObject(key, dest.bucket);
+            };
+
+    await pruneWith(toDelete, deleteObject);
     return toDelete;
 }

package/src/backup/pg-tools.ts

@@ -202,7 +202,12 @@ export function buildPgRestoreArgs(opts: {
     inputFile: string;
     /** Drop objects before recreating them (destructive but idempotent). */
     clean?: boolean;
-    /** Continue past individual errors instead of aborting. */
+    /**
+     * Abort on the first error instead of logging and continuing. Defaults
+     * ON: a restore that silently skips failed GRANT/RLS statements (because
+     * a role is missing) "succeeds" with RLS un-enforced — a security hole.
+     * Fail loudly instead so the operator knows the restore is incomplete.
+     */
     exitOnError?: boolean;
     noOwner?: boolean;
 }): string[] {
@@ -213,13 +218,76 @@ export function buildPgRestoreArgs(opts: {
     if (opts.noOwner) {
         args.push("--no-owner");
     }
-    if (opts.exitOnError) {
+    // Default to --exit-on-error unless explicitly disabled.
+    if (opts.exitOnError !== false) {
         args.push("--exit-on-error");
     }
     args.push(opts.inputFile);
     return args;
 }
 
+/**
+ * Assemble the `pg_restore --list` argument vector. Reading a dump's table
+ * of contents parses the whole archive without touching a database, so it is
+ * a cheap integrity check that the file isn't truncated or corrupt.
+ */
+export function buildPgRestoreListArgs(inputFile: string): string[] {
+    return ["--list", inputFile];
+}
+
+/**
+ * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+ * cluster-wide objects) live outside any single database, so a per-database
+ * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+ * statements in the main dump fail on restore and RLS is silently lost — so
+ * every backup captures the globals into a sidecar `.globals.sql`.
+ *
+ * `--no-role-passwords` keeps role secrets out of the artifact (backups may
+ * be shipped off-box); roles are recreated password-less and re-secured by
+ * the operator.
+ */
+export function buildPgDumpallGlobalsArgs(opts: {
+    connectionString: string;
+    outFile: string;
+}): string[] {
+    return [
+        "--globals-only",
+        "--no-role-passwords",
+        "--no-password",
+        `--file=${opts.outFile}`,
+        `--dbname=${opts.connectionString}`
+    ];
+}
+
+/**
+ * Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+ * two artifacts adjacent so listing, uploading and pruning can find one from
+ * the other. A name that doesn't end in `.dump` is returned unchanged with a
+ * `.globals.sql` suffix appended.
+ */
+export function globalsFileForDump(dumpPath: string): string {
+    return dumpPath.endsWith(".dump")
+        ? dumpPath.slice(0, -".dump".length) + ".globals.sql"
+        : dumpPath + ".globals.sql";
+}
+
+/**
+ * Split a `pg_dumpall --globals-only` script into individual statements.
+ * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+ * can run independently and a benign "role already exists" on one doesn't
+ * abort the rest. Drops `--` comment lines and blank statements.
+ */
+export function splitGlobalsStatements(sql: string): string[] {
+    const withoutComments = sql
+        .split("\n")
+        .filter((line) => !line.trim().startsWith("--"))
+        .join("\n");
+    return withoutComments
+        .split(";")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+
 /**
  * Resolve the Postgres connection string the backup commands should use,
  * mirroring the precedence the branch command already relies on.

package/src/cli-helpers.ts

@@ -143,36 +143,91 @@ export async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUr
     }
 }
 
-export async function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]> {
-    const includes = await getTableIncludes(collectionsPath);
-    const excludes: string[] = ["atlas_schema_revisions.*", "auth.*"];
-    
+/**
+ * Query the live database for every user table/view outside the system
+ * catalogs. Separated from {@link getTableExcludes} so its failure mode can
+ * be handled explicitly (fail closed) and so tests can inject a stub.
+ */
+export async function queryExistingTables(databaseUrl: string): Promise<string[]> {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
     try {
-        const { Client } = await import("pg");
-        const client = new Client({ connectionString: databaseUrl });
-        await client.connect();
-        try {
-            const res = await client.query(`
-                SELECT table_schema || '.' || table_name AS full_name
-                FROM information_schema.tables
-                WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-                  AND table_type IN ('BASE TABLE', 'VIEW');
-            `);
-            
-            const existingTables = res.rows.map((row: { full_name: string }) => row.full_name);
-            
-            for (const table of existingTables) {
-                if (!includes.includes(table)) {
-                    excludes.push(table);
-                }
-            }
-        } finally {
-            await client.end();
-        }
+        const res = await client.query(`
+            SELECT table_schema || '.' || table_name AS full_name
+            FROM information_schema.tables
+            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+              AND table_type IN ('BASE TABLE', 'VIEW');
+        `);
+        return res.rows.map((row: { full_name: string }) => row.full_name);
+    } finally {
+        await client.end();
+    }
+}
+
+/**
+ * Raised when the exclude list could not be built. `db push` MUST abort on
+ * this rather than continue: the exclude list is the only thing shielding
+ * non-collection (user/system) tables from the auto-approved declarative
+ * apply. A partial list — the old fail-open behaviour — meant a transient
+ * introspection hiccup dropped every table not present in `schema.sql`.
+ */
+export class ExcludeIntrospectionError extends Error {
+    constructor(message: string, readonly cause?: unknown) {
+        super(message);
+        this.name = "ExcludeIntrospectionError";
+    }
+}
+
+/**
+ * Build the `--exclude` list that protects tables Rebase doesn't manage from
+ * the declarative apply. Anything not backing a collection (or its M2M
+ * junctions) is excluded so Atlas never drops it.
+ *
+ * Fails **closed**: if the database can't be introspected we cannot know
+ * which tables to protect, so we throw {@link ExcludeIntrospectionError}
+ * instead of returning a near-empty list and letting the caller drop
+ * everything.
+ *
+ * `deps` is injectable for tests; production uses the real pg-backed queries.
+ */
+export async function getTableExcludes(
+    databaseUrl: string,
+    collectionsPath: string,
+    deps: {
+        queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+        getIncludes?: (collectionsPath: string) => Promise<string[]>;
+    } = {}
+): Promise<string[]> {
+    const getIncludes = deps.getIncludes ?? getTableIncludes;
+    const queryTables = deps.queryExistingTables ?? queryExistingTables;
+
+    const includes = await getIncludes(collectionsPath);
+    // Framework-owned schemas Rebase manages itself — the declarative apply
+    // must never touch them. `auth` holds the helper functions; `rebase` holds
+    // the auth tables (users, refresh_tokens, …) and Atlas's own revision
+    // table. Excluding both the schema object AND its contents keeps Atlas
+    // from planning a `DROP SCHEMA … CASCADE` — which on a live database would
+    // take the user/auth tables with it. `atlas_schema_revisions.*` is kept
+    // for backwards-compatibility with any external revision schema.
+    const excludes: string[] = ["atlas_schema_revisions.*", "auth", "auth.*", "rebase", "rebase.*"];
+
+    let existingTables: string[];
+    try {
+        existingTables = await queryTables(databaseUrl);
     } catch (err) {
-        logger.warn(chalk.yellow(`  ⚠️  Failed to query database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`));
+        throw new ExcludeIntrospectionError(
+            `Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`,
+            err
+        );
     }
-    
+
+    for (const table of existingTables) {
+        if (!includes.includes(table)) {
+            excludes.push(table);
+        }
+    }
+
     return excludes;
 }
 

package/src/cli.ts

@@ -10,10 +10,13 @@ import {
     getTableIncludes,
     getDevDatabaseUrl,
     ensureDevDatabaseExists,
-    getTableExcludes
+    getTableExcludes,
+    ExcludeIntrospectionError
 } from "./cli-helpers";
 import { checkDatabaseConnectivity, diagnoseDbError } from "./cli-errors";
 import { AUTH_BOOTSTRAP_SQL } from "./schema/auth-bootstrap-sql";
+import { detectDestructiveStatements, decidePushSafety } from "./schema/destructive-sql";
+import readline from "readline";
 
 const __cliDirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -87,7 +90,10 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
     const argsList = arg(
         {
             "--collections": String,
-            "-c": "--collections"
+            "--allow-destructive": Boolean,
+            "--yes": Boolean,
+            "-c": "--collections",
+            "-y": "--yes"
         },
         {
             argv: rawArgs.slice(2),
@@ -171,10 +177,60 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             if (databaseUrl) {
                 await ensureAuthSchemaAndFunctions(databaseUrl);
             }
+
+            // Preview the plan before touching data. `atlas schema apply` with
+            // --auto-approve will silently DROP COLUMN on a field removal and
+            // drop+add on a rename, so we first dry-run to obtain the planned
+            // SQL and gate anything destructive.
+            const plan = await runAtlas(
+                "schema",
+                ["apply", "--to", "file://drizzle/schema.sql", "--dry-run"],
+                collectionsPath,
+                { captureStdout: true }
+            );
+            const destructive = detectDestructiveStatements(plan);
+            const allowDestructive = argsList["--allow-destructive"] === true || argsList["--yes"] === true;
+            const decision = decidePushSafety({
+                destructiveCount: destructive.length,
+                allowDestructive,
+                interactive: process.stdin.isTTY === true
+            });
+
+            if (destructive.length > 0) {
+                logger.warn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
+                logger.warn("");
+                for (const d of destructive) {
+                    logger.warn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+                }
+                logger.warn("");
+                logger.warn(chalk.yellow("  Full planned changes:"));
+                logger.warn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+                logger.warn("");
+
+                if (decision === "refuse") {
+                    logger.error(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
+                    logger.error(chalk.gray("    Re-run interactively, or pass --allow-destructive to proceed. Back up first: rebase db backup"));
+                    process.exit(1);
+                }
+                if (decision === "confirm") {
+                    const confirmed = await promptConfirm(
+                        chalk.yellow("  Type 'yes' to apply these destructive changes (this cannot be undone): ")
+                    );
+                    if (!confirmed) {
+                        logger.info(chalk.gray("  Aborted. No changes were made."));
+                        process.exit(1);
+                    }
+                } else {
+                    // decision === "apply" via --allow-destructive
+                    logger.warn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
+                }
+            }
+
             await runAtlas("schema", ["apply", "--to", "file://drizzle/schema.sql", "--auto-approve"], collectionsPath);
             logger.info("");
             
             if (databaseUrl) {
+                await ensureAuthTables(databaseUrl, collectionsPath);
                 await applyPolicies(databaseUrl);
                 await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
@@ -218,6 +274,43 @@ async function ensureAuthSchemaAndFunctions(databaseUrl: string): Promise<void>
     }
 }
 
+/**
+ * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
+ * policies reference, before `applyPolicies` runs. Mirrors what the server does
+ * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
+ *
+ * Without this, `rebase db push` against a database that has never booted the
+ * server fails while applying policies with `relation "rebase.users" does not
+ * exist` — the documented first-run does `db push` *before* the first `dev`.
+ * `ensureAuthTablesExist` is idempotent (CREATE TABLE IF NOT EXISTS), so it is
+ * safe to run on every push and harmless once the server has also created them.
+ */
+async function ensureAuthTables(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { drizzle } = await import("drizzle-orm/node-postgres");
+        const { ensureAuthTablesExist } = await import("./auth/ensure-tables");
+        const { loadCollections } = await import("./schema/doctor");
+        const { Client } = await import("pg");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        // The auth collection is flagged with `auth: true` or `auth: { enabled: true }`.
+        const authCollection = collections.find((c) => {
+            const a = c.auth;
+            return a === true || (typeof a === "object" && a !== null && a.enabled === true);
+        });
+
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            await ensureAuthTablesExist(drizzle(client), authCollection);
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Failed to ensure framework auth tables: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 /**
  * Provision the restricted `rebase_user` role right after schema changes land,
  * so grants cover freshly created tables (default privileges cover future
@@ -517,7 +610,29 @@ function timeAgo(date: Date): string {
 
 
 
-async function runAtlas(domain: "schema" | "migrate", args: string[], collectionsPath?: string): Promise<void> {
+/**
+ * Ask a yes/no question on an interactive terminal. Non-interactive shells
+ * (CI, pipes, agents) can't answer, so this must only be reached after
+ * {@link decidePushSafety} has already ruled that interactive confirmation is
+ * possible.
+ */
+async function promptConfirm(question: string): Promise<boolean> {
+    if (!process.stdin.isTTY) return false;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer: string = await new Promise((resolve) => rl.question(question, resolve));
+        return /^y(es)?$/i.test(answer.trim());
+    } finally {
+        rl.close();
+    }
+}
+
+async function runAtlas(
+    domain: "schema" | "migrate",
+    args: string[],
+    collectionsPath?: string,
+    opts: { captureStdout?: boolean } = {}
+): Promise<string> {
     const atlasBin = resolveLocalBin("atlas");
     if (!atlasBin) {
         logger.error(chalk.red("✗ Could not find atlas binary."));
@@ -587,7 +702,24 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
     }
 
     if (domain === "schema" && args.includes("apply") && collectionsPath) {
-        const excludes = await getTableExcludes(databaseUrl, collectionsPath);
+        // Fail CLOSED: the exclude list is the only thing shielding
+        // non-collection tables from the auto-approved apply. If we can't
+        // introspect the database to build it, abort rather than proceed with
+        // a partial list that would let Atlas drop unmanaged tables.
+        let excludes: string[];
+        try {
+            excludes = await getTableExcludes(databaseUrl, collectionsPath);
+        } catch (err) {
+            if (err instanceof ExcludeIntrospectionError) {
+                logger.error(chalk.red("\n✗ Aborting push: could not determine which tables to protect."));
+                logger.error(chalk.gray(`  ${err.message}`));
+                logger.error(chalk.gray("  Refusing to apply — a partial exclude list could drop tables Rebase does not manage."));
+                const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+                if (hint) logger.error(hint);
+                process.exit(1);
+            }
+            throw err;
+        }
         for (const exc of excludes) {
             atlasArgs.push("--exclude", exc);
         }
@@ -595,13 +727,20 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
 
     // Stream stdout live but tee stderr so we can inspect Atlas's error text
     // for known, actionable failure modes (e.g. a dependency-drop that leaves
-    // the schema half-applied) after the process exits.
+    // the schema half-applied) after the process exits. When capturing (used
+    // for the destructive-change dry-run), pipe stdout and collect it instead.
     const subprocess = execa(atlasBin, atlasArgs, {
         cwd: process.cwd(),
-        stdout: "inherit",
+        stdout: opts.captureStdout ? "pipe" : "inherit",
         stderr: "pipe",
         env
     });
+    let stdoutText = "";
+    if (opts.captureStdout) {
+        subprocess.stdout?.on("data", (chunk: Buffer) => {
+            stdoutText += chunk.toString();
+        });
+    }
     let stderrText = "";
     subprocess.stderr?.on("data", (chunk: Buffer) => {
         const text = chunk.toString();
@@ -619,6 +758,13 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
         }
         process.exit(1);
     }
+    // Atlas prints the plan to stdout, but fall back to stderr so the
+    // destructive-change detector never misses a plan on a version/build that
+    // routes it differently.
+    if (opts.captureStdout) {
+        return stdoutText.trim().length > 0 ? stdoutText : stderrText;
+    }
+    return "";
 }
 
 async function generatePostgresDdlCommand(rawArgs: string[]): Promise<void> {

package/src/index.ts

@@ -7,6 +7,10 @@ export * from "./schema/generate-drizzle-schema-logic";
 export * from "./schema/generate-drizzle-schema";
 export * from "./utils/drizzle-conditions";
 export * from "./services/realtimeService";
+// The channel bus is a public extension point: a transport published as its own
+// package implements `ChannelBus` (declared in @rebasepro/types and re-exported
+// here) and is passed to `realtime.bus`. Without this export it would be one.
+export * from "./services/channel-bus";
 export * from "./websocket";
 export * from "./collections/PostgresCollectionRegistry";
 export * from "./services/BranchService";