@rebasepro/server-postgres 0.18.0 → 0.19.0

package/dist/cli.js

@@ -0,0 +1,2020 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
+import { i as diagnoseDbError, r as diagnoseAtlasFailure, s as reportCommandFailure, t as checkDatabaseConnectivity } from "./cli-errors-DxN4yzdH.js";
+import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
+import { C as resolveLocalBin, S as readVectorDdl, T as forLibpq, _ as getSearchExcludes, a as ExcludeIntrospectionError, b as promptConfirm, c as describeBuildScriptRemedy, d as detectProjectPackageManager, f as diagnoseMissingBin, g as getForeignIndexExcludes, h as getDevDatabaseUrl, l as describeDevAddCommand, m as ensureDevDatabaseExists, o as applySearchDdl, p as dropDevDatabase, r as dropLegacyAuthSchema, s as applyVectorDdl, t as RLS_BOOTSTRAP_SQL, u as describeReinstallCommand, v as getTableExcludes, w as execa, x as readSearchDdl, y as getVectorExcludes } from "./rls-bootstrap-sql-DLDnUjtx.js";
+import { t as chalk } from "./source-Br7L7GOI.js";
+import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { logger } from "@rebasepro/server";
+import { formatRelativeTime } from "@rebasepro/utils";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath } from "url";
+//#region src/schema/destructive-sql.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
+/**
+* Pure helpers that classify an Atlas declarative-apply plan as destructive
+* or not, and decide what `rebase db push` should do about it.
+*
+* `db push` runs `atlas schema apply` to make the live database match the
+* generated `schema.sql`. Removing a collection field compiles to
+* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+* here, and refuse to auto-approve anything destructive without an explicit
+* opt-in.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without Atlas or a database.
+*/
+/**
+* SQL fragments that destroy data or data-bearing objects. Matched
+* case-insensitively against each statement of the plan. `IF EXISTS` /
+* whitespace variations are tolerated by the regexes below.
+*/
+var DESTRUCTIVE_PATTERNS = [
+	{
+		label: "DROP TABLE",
+		re: /\bDROP\s+TABLE\b/i
+	},
+	{
+		label: "DROP COLUMN",
+		re: /\bDROP\s+COLUMN\b/i
+	},
+	{
+		label: "DROP SCHEMA",
+		re: /\bDROP\s+SCHEMA\b/i
+	},
+	{
+		label: "DROP VIEW",
+		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
+	},
+	{
+		label: "DROP TYPE",
+		re: /\bDROP\s+TYPE\b/i
+	},
+	{
+		label: "TRUNCATE",
+		re: /\bTRUNCATE\b/i
+	}
+];
+/**
+* Split a SQL script into individual statements, dropping blank lines and
+* `--` comment lines. Deliberately simple: Atlas emits one plain statement
+* per `;`, without string literals that contain semicolons in a schema DDL
+* plan, so a naive split is safe and keeps this dependency-free.
+*/
+function splitSqlStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
+* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+* the statements that would destroy data. An empty array means the plan is
+* safe to auto-approve.
+*/
+function detectDestructiveStatements(planSql) {
+	const found = [];
+	for (const statement of splitSqlStatements(planSql)) for (const { label, re } of DESTRUCTIVE_PATTERNS) if (re.test(statement)) {
+		found.push({
+			statement,
+			kind: label
+		});
+		break;
+	}
+	return found;
+}
+/**
+* Decide how `db push` should proceed given the plan's destructiveness and
+* the invocation context.
+*
+*  - No destructive statements → `apply` (safe to auto-approve).
+*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+*  - Destructive + interactive TTY → `confirm` (prompt before applying).
+*  - Destructive + non-interactive → `refuse` (never silently drop data in
+*    CI / scripts / agents).
+*/
+function decidePushSafety(opts) {
+	if (opts.destructiveCount === 0) return "apply";
+	if (opts.allowDestructive) return "apply";
+	return opts.interactive ? "confirm" : "refuse";
+}
+//#endregion
+//#region src/schema/carved-out-migration.ts
+/**
+* Keep the objects Rebase carved out of Atlas's view out of the migrations
+* Atlas writes.
+*
+* `db push` protects them with `--exclude`. `atlas migrate diff` has no such
+* flag — measured on the pinned 1.2.3, `--exclude` is rejected outright with
+* `unknown flag`, and the `exclude` attribute of an `atlas.hcl` `env` block is
+* accepted and then silently ignored on that path. So the diff sees the search
+* column that the migration directory's own appended DDL created when it
+* replayed, does not see it in `schema.sql`, and plans a drop:
+*
+*     ALTER TABLE "public"."talents" DROP COLUMN "search_vector";
+*
+* That statement is removed here, after Atlas has written the file and before
+* anything is appended to it — so the input is always Atlas's own plain output,
+* never the dollar-quoted helper bodies that get appended afterwards.
+*
+* The drop does not arrive alone. Atlas folds every change to one table into a
+* single statement, so a real edit in the same run produces
+*
+*     ALTER TABLE "public"."talents"
+*         DROP COLUMN "search_vector", DROP COLUMN "interests", ADD COLUMN "headline" text NULL;
+*
+* and dropping the whole statement would silently throw away a migration the
+* project asked for. The removal is therefore per *clause*.
+*
+* Fail-safe throughout: a statement that mentions a carved-out object but does
+* not match a shape this understands is left exactly as it is and reported as
+* `unhandled`, so the caller can say so out loud. A spurious drop the developer
+* can see beats a migration quietly rewritten wrong.
+*/
+/** Anything Postgres accepts in an unquoted identifier past ASCII. */
+var IDENT = "(?:\"(?:[^\"]|\"\")*\"|[A-Za-z_\\u0080-\\uffff][\\w$\\u0080-\\uffff]*)";
+var QUALIFIED = `${IDENT}(?:\\s*\\.\\s*${IDENT})*`;
+var ALTER_TABLE_RE = new RegExp(`^ALTER\\s+TABLE\\s+(?:ONLY\\s+)?(${QUALIFIED})\\s+([\\s\\S]+)$`, "i");
+var DROP_COLUMN_RE = new RegExp(`^DROP\\s+(?:COLUMN\\s+)?(?:IF\\s+EXISTS\\s+)?(${IDENT})$`, "i");
+var DROP_INDEX_RE = new RegExp(`^DROP\\s+INDEX\\s+(?:CONCURRENTLY\\s+)?(?:IF\\s+EXISTS\\s+)?(${QUALIFIED})$`, "i");
+/**
+* Does this statement destroy anything at all?
+*
+* The gate on reporting. A statement that merely *names* a carved-out object —
+* `COMMENT ON COLUMN … "search_vector"` — is not a problem and must not be
+* reported as one, because an unrewritable drop stops the caller outright.
+*/
+var MENTIONS_DROP = /\bDROP\b/i;
+/**
+* Split `schema.table.object` patterns. Anything not in three parts is
+* ignored rather than guessed at — the two-part form is the one Atlas itself
+* silently mis-reads, and repeating that mistake here would be worse than
+* doing nothing.
+*/
+function parseExcludePatterns(patterns) {
+	const parsed = [];
+	for (const pattern of patterns) {
+		const parts = pattern.split(".");
+		if (parts.length !== 3) continue;
+		if (parts.some((p) => p.length === 0)) continue;
+		parsed.push({
+			schema: parts[0],
+			table: parts[1],
+			object: parts[2]
+		});
+	}
+	return parsed;
+}
+/** `"public"` and `public` are the same name; `"Public"` is not `public`. */
+function unquoteIdentifier(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.startsWith("\"") && trimmed.endsWith("\"") && trimmed.length >= 2) return trimmed.slice(1, -1).replace(/""/g, "\"");
+	return trimmed.toLowerCase();
+}
+/** Split a dotted identifier at its top-level dots, respecting quoting. */
+function splitQualifiedName(raw) {
+	const parts = [];
+	let current = "";
+	let inQuote = false;
+	for (let i = 0; i < raw.length; i++) {
+		const ch = raw[i];
+		if (inQuote) {
+			if (ch === "\"") {
+				if (raw[i + 1] === "\"") {
+					current += "\"\"";
+					i++;
+					continue;
+				}
+				inQuote = false;
+			}
+			current += ch;
+			continue;
+		}
+		if (ch === "\"") {
+			inQuote = true;
+			current += ch;
+			continue;
+		}
+		if (ch === ".") {
+			parts.push(current);
+			current = "";
+			continue;
+		}
+		current += ch;
+	}
+	if (inQuote) return null;
+	parts.push(current);
+	return parts.map(unquoteIdentifier);
+}
+/**
+* Walk the script and locate every statement. Quote-, comment- and
+* dollar-aware: the appended halves of a migration are not passed here, but a
+* splitter that shreds a `DO $tag$ ... $tag$` block is a trap worth not
+* leaving behind — it is how the derived-names renderer broke.
+*
+* Returns null if the text ends inside a quote or a dollar-quoted body, or
+* trails off in a statement with no semicolon. Either means this cannot be
+* reasoned about safely.
+*/
+function locateStatements(sql) {
+	const statements = [];
+	let i = 0;
+	let statementStart = 0;
+	let sawCode = false;
+	const pushStatement = (endExclusive) => {
+		const leading = sql.slice(statementStart, endExclusive);
+		let consumed = 0;
+		for (const line of leading.split("\n")) {
+			const trimmed = line.trim();
+			if (trimmed === "" || trimmed.startsWith("--")) {
+				consumed += line.length + 1;
+				continue;
+			}
+			break;
+		}
+		const bodyStart = statementStart + consumed;
+		statements.push({
+			start: statementStart,
+			end: endExclusive,
+			bodyStart,
+			body: sql.slice(bodyStart, endExclusive).replace(/;\s*$/, "").trim()
+		});
+	};
+	while (i < sql.length) {
+		const ch = sql[i];
+		if (ch === "-" && sql[i + 1] === "-") {
+			const nl = sql.indexOf("\n", i);
+			i = nl === -1 ? sql.length : nl + 1;
+			continue;
+		}
+		if (ch === "/" && sql[i + 1] === "*") {
+			const close = sql.indexOf("*/", i + 2);
+			if (close === -1) return null;
+			i = close + 2;
+			sawCode = true;
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			i++;
+			let closed = false;
+			while (i < sql.length) {
+				if (sql[i] === quote) {
+					if (sql[i + 1] === quote) {
+						i += 2;
+						continue;
+					}
+					i++;
+					closed = true;
+					break;
+				}
+				i++;
+			}
+			if (!closed) return null;
+			sawCode = true;
+			continue;
+		}
+		if (ch === "$") {
+			const tag = /^\$(?:[A-Za-z_\u0080-\uffff][\w\u0080-\uffff]*)?\$/.exec(sql.slice(i));
+			if (tag) {
+				const close = sql.indexOf(tag[0], i + tag[0].length);
+				if (close === -1) return null;
+				i = close + tag[0].length;
+				sawCode = true;
+				continue;
+			}
+		}
+		if (ch === ";") {
+			pushStatement(i + 1);
+			i++;
+			statementStart = i;
+			sawCode = false;
+			continue;
+		}
+		if (!/\s/.test(ch)) sawCode = true;
+		i++;
+	}
+	if (sawCode) return null;
+	return statements;
+}
+/** Split an ALTER TABLE action list at its top-level commas. */
+function splitClauses(actions) {
+	const clauses = [];
+	let depth = 0;
+	let current = "";
+	let i = 0;
+	while (i < actions.length) {
+		const ch = actions[i];
+		if (ch === "'" || ch === "\"") {
+			const quote = ch;
+			current += ch;
+			i++;
+			let closed = false;
+			while (i < actions.length) {
+				current += actions[i];
+				if (actions[i] === quote) {
+					if (actions[i + 1] === quote) {
+						current += actions[i + 1];
+						i += 2;
+						continue;
+					}
+					i++;
+					closed = true;
+					break;
+				}
+				i++;
+			}
+			if (!closed) return null;
+			continue;
+		}
+		if (ch === "(") {
+			depth++;
+			current += ch;
+			i++;
+			continue;
+		}
+		if (ch === ")") {
+			depth--;
+			current += ch;
+			i++;
+			continue;
+		}
+		if (ch === "," && depth === 0) {
+			clauses.push(current);
+			current = "";
+			i++;
+			continue;
+		}
+		current += ch;
+		i++;
+	}
+	if (depth !== 0) return null;
+	clauses.push(current);
+	return clauses.map((c) => c.trim()).filter((c) => c.length > 0);
+}
+/**
+* Remove every clause and statement that would drop one of `patterns`.
+*
+* `patterns` are the `schema.table.object` strings the CLI already builds for
+* Atlas's `--exclude`, so the diff path and the apply path protect exactly the
+* same set by construction.
+*/
+function stripCarvedOutStatements(migrationSql, patterns) {
+	const carved = parseExcludePatterns(patterns);
+	if (carved.length === 0) return {
+		sql: migrationSql,
+		removed: [],
+		unhandled: [],
+		empty: isBlank(migrationSql)
+	};
+	const located = locateStatements(migrationSql);
+	if (located === null) return {
+		sql: migrationSql,
+		removed: [],
+		unhandled: MENTIONS_DROP.test(migrationSql) && carved.some((c) => migrationSql.includes(c.object)) ? [migrationSql.trim()] : [],
+		empty: isBlank(migrationSql)
+	};
+	const removed = [];
+	const unhandled = [];
+	const edits = [];
+	for (const statement of located) {
+		if (!carved.some((c) => statement.body.includes(c.object))) continue;
+		const dropIndex = DROP_INDEX_RE.exec(statement.body);
+		if (dropIndex) {
+			const parts = splitQualifiedName(dropIndex[1]);
+			const name = parts?.[parts.length - 1];
+			const schema = parts && parts.length > 1 ? parts[parts.length - 2] : void 0;
+			if (name !== void 0 && carved.some((c) => c.object === name && (schema === void 0 || c.schema === schema))) {
+				removed.push(statement.body);
+				edits.push({
+					start: statement.start,
+					end: statement.end,
+					replacement: ""
+				});
+			} else unhandled.push(statement.body);
+			continue;
+		}
+		const alter = ALTER_TABLE_RE.exec(statement.body);
+		if (!alter) {
+			if (MENTIONS_DROP.test(statement.body)) unhandled.push(statement.body);
+			continue;
+		}
+		const target = splitQualifiedName(alter[1]);
+		if (!target) {
+			if (MENTIONS_DROP.test(statement.body)) unhandled.push(statement.body);
+			continue;
+		}
+		const table = target[target.length - 1];
+		const schema = target.length > 1 ? target[target.length - 2] : void 0;
+		const clauses = splitClauses(alter[2]);
+		if (!clauses) {
+			if (MENTIONS_DROP.test(statement.body)) unhandled.push(statement.body);
+			continue;
+		}
+		const survivors = [];
+		let removedHere = 0;
+		let unhandledHere = false;
+		for (const clause of clauses) {
+			const drop = DROP_COLUMN_RE.exec(clause);
+			const column = drop ? unquoteIdentifier(drop[1]) : void 0;
+			if (column !== void 0 && carved.some((c) => c.object === column && c.table === table && (schema === void 0 || c.schema === schema))) {
+				removed.push(`ALTER TABLE ${alter[1]}: ${clause}`);
+				removedHere++;
+				continue;
+			}
+			if (MENTIONS_DROP.test(clause) && carved.some((c) => clause.includes(c.object))) unhandledHere = true;
+			survivors.push(clause);
+		}
+		if (unhandledHere) unhandled.push(statement.body);
+		if (removedHere === 0) continue;
+		if (survivors.length === 0) edits.push({
+			start: statement.start,
+			end: statement.end,
+			replacement: ""
+		});
+		else edits.push({
+			start: statement.bodyStart,
+			end: statement.end,
+			replacement: `ALTER TABLE ${alter[1]} ${survivors.join(", ")};`
+		});
+	}
+	let sql = migrationSql;
+	for (const edit of edits.sort((a, b) => b.start - a.start)) sql = sql.slice(0, edit.start) + edit.replacement + sql.slice(edit.end);
+	if (edits.length > 0) sql = tidy(sql);
+	return {
+		sql,
+		removed,
+		unhandled,
+		empty: isBlank(sql)
+	};
+}
+/** Only comments and whitespace left — nothing a migration would do. */
+function isBlank(sql) {
+	return sql.split("\n").every((line) => line.trim() === "" || line.trim().startsWith("--"));
+}
+/** Collapse the blank runs an excision leaves behind. */
+function tidy(sql) {
+	const trimmed = sql.replace(/\n{3,}/g, "\n\n").replace(/^\s*\n/, "").trimEnd();
+	return trimmed.length === 0 ? "" : `${trimmed}\n`;
+}
+//#endregion
+//#region src/schema/atlas-argv.ts
+/**
+* Does this Atlas invocation accept `--exclude`?
+*
+* Only `atlas schema apply` does, on the pinned 1.2.3. Measured against the
+* binary: `migrate diff` and `migrate apply` both answer `unknown flag:
+* --exclude`, and neither lists it in `--help` (`migrate apply` offers
+* `--url/--dir/--format/--revisions-schema/--dry-run/--lock-name/--lock-timeout/`
+* `--skip-lock/--baseline/--to-version/--tx-mode/--exec-order/--allow-dirty`).
+* Hence `domain === "schema"` and not just the subcommand.
+*
+* The `exclude` attribute of an `atlas.hcl` `env` block is not a way round it
+* either: measured, it is accepted and then ignored on the diff path, which is
+* the silent-no-match shape that costs the most time to notice.
+*
+* So the diff keeps the carved-out objects out of the migration afterwards
+* instead, with `stripCarvedOutStatements`.
+*/
+function acceptsExcludeFlag(domain, args) {
+	return domain === "schema" && args.includes("apply");
+}
+/** Assemble the full argv, connection flags and all. */
+function buildAtlasArgs(invocation) {
+	const { domain, args, url, devUrl, excludes = [] } = invocation;
+	const argv = [domain, ...args];
+	if (domain === "schema") {
+		if (args.includes("apply")) argv.push("--url", url, "--dev-url", devUrl);
+		else if (args.includes("clean") || args.includes("inspect")) argv.push("--url", url);
+	} else if (domain === "migrate") {
+		if (args.includes("diff")) argv.push("--dev-url", devUrl);
+		else if (args.includes("apply") || args.includes("status")) {
+			argv.push("--url", url, "--revisions-schema", "rebase");
+			if (args.includes("apply") && !args.includes("--baseline")) argv.push("--allow-dirty");
+		}
+	}
+	if (acceptsExcludeFlag(domain, args)) for (const exclude of excludes) argv.push("--exclude", exclude);
+	return argv;
+}
+//#endregion
+//#region src/branch-argv.ts
+/**
+* Argument shapes for `rebase db branch`, with no dependencies.
+*
+* Its own module for the same reason `schema/atlas-argv.ts` is: `cli.ts` pulls
+* in chalk, execa and the driver runtime, so a unit test that imports it cannot
+* run. Argv parsing is the part most worth testing and the part least in need
+* of any of that.
+*/
+/**
+* Words on a `db branch` command line that no argument accounts for.
+*
+* `rebase db branch create alpha beta` created a branch called `alpha` and
+* threw `beta` away without a word. The shapes that produces are all quiet and
+* all wrong: an unquoted name (`create my feature` → `my`), a flag written
+* without its dashes (`create feat from main` → `feat`), a shell that split
+* something you thought was one token. In each case the command succeeds and
+* the branch is not the one asked for — and branch names are the thing you
+* later type to switch, delete, or point a deploy at.
+*
+* Anything starting with `-` is left alone rather than validated. This runs on
+* every branch subcommand, including ones added later with flags this function
+* has never heard of, and rejecting an unrecognised flag here would break them
+* from a distance. The value after a flag that takes one is skipped for the
+* same reason: it is that flag's argument, not a stray word.
+*
+* @param words The command's own arguments: action, name, then the rest.
+*/
+function unexpectedBranchArgs(words) {
+	const extras = [];
+	let seenName = false;
+	for (let index = 1; index < words.length; index += 1) {
+		const word = words[index];
+		if (word.startsWith("-")) {
+			if (TAKES_A_VALUE.has(word.split("=")[0])) index += 1;
+			continue;
+		}
+		if (!seenName) {
+			seenName = true;
+			continue;
+		}
+		extras.push(word);
+	}
+	return extras;
+}
+/**
+* Branch-line flags whose next word belongs to them.
+*
+* `--from` was the only one listed, and `--database-url` is the one that bit:
+* `rebase db branch list --database-url postgres://…` — which the CLI itself
+* appends when the checkout is on a branch, so `rebase.branches` is read in the
+* parent where it lives — answered `✗ Unexpected argument: postgres://…`. The
+* `=` form carries its value in the same word and needs no skip.
+*/
+var TAKES_A_VALUE = /* @__PURE__ */ new Set([
+	"--from",
+	"--older-than",
+	"--database-url"
+]);
+//#endregion
+//#region src/cli-flags.ts
+/**
+* The flags each driver command takes, in one place, and the check that
+* enforces them.
+*
+* Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not
+* mean "be lenient" — it means **an undeclared flag becomes a positional**. So
+* `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the
+* push ran with the destructive gate still closed, and the developer read the
+* refusal as Rebase ignoring the flag they had just typed. `rebase schema
+* generate --ouput src/schema.ts` was worse — it wrote the default path and
+* said nothing, so the next build compiled a file nobody had regenerated.
+*
+* The check has to live at the entry point rather than in those parsers, and
+* that is not a detail: `db push` and `db generate` re-enter `schemaCommand`
+* and `generatePostgresDdlCommand` with the *db* line, so a strict parser
+* inside either of them would reject `--allow-destructive` on a line where it
+* is correct. One validation, once, against the spec for the command the user
+* actually named; the inner parsers keep reading an already-validated line.
+*
+* Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),
+* `db backup`, `db restore`, `db backups` — are deliberately absent: they own
+* their spec, and a second list here would be one more thing to keep in step.
+* An absent entry is "not checked here", never "takes nothing".
+*/
+/**
+* Flags that reach this process on a line it did not compose.
+*
+* `rebase db …` hands the driver the user's whole line: the CLI *reads*
+* `--database-url` and `--docker` to resolve the database and then relays them
+* verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
+* the thing to re-run with. Rejecting any of the three would make the driver
+* refuse commands the CLI documents.
+*/
+var RELAYED_FLAGS = {
+	"--database-url": String,
+	"--docker": Boolean,
+	"--debug": Boolean,
+	"--help": Boolean,
+	"-h": "--help"
+};
+/** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
+var DRIVER_FLAG_SPECS = {
+	"db push": {
+		"--collections": String,
+		"-c": "--collections",
+		"--dry-run": Boolean,
+		"--allow-destructive": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	},
+	"db generate": {
+		"--collections": String,
+		"-c": "--collections"
+	},
+	"db migrate": { "--baseline": String },
+	"schema generate": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--watch": Boolean,
+		"-w": "--watch"
+	},
+	"schema introspect": {
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--collections": String,
+		"-c": "--collections",
+		"--force": Boolean,
+		"-f": "--force",
+		"--schema": String
+	},
+	"schema stale": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--fix": Boolean
+	}
+};
+/**
+* The `--collections` path the user typed, or `null` if they typed none.
+*
+* Read once, at the entry point, because every command that takes it re-enters
+* the generators with the same line and each of them resolved it again — which
+* is how "Collections path not found" came to be printed four times before the
+* real output, and how a path that does not exist got as far as *writing* an
+* empty schema.
+*
+* Permissive, and it has to be: {@link assertKnownFlags} has already judged the
+* line, and `db push` carries flags the `--collections` spec does not name.
+*/
+function collectionsPathIn(args) {
+	try {
+		return (0, import_arg.default)({
+			"--collections": String,
+			"-c": "--collections"
+		}, {
+			argv: args.slice(2),
+			permissive: true
+		})["--collections"] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Reject a flag the named command does not take.
+*
+* `args` is the driver's whole line — `["db", "push", …]` — so the flags are
+* read from `args.slice(2)`, past the two command words.
+*
+* Throws rather than exiting: `runPluginCommand`'s caller already turns a
+* thrown error into one red line and exit 1, and a thrown error is what the
+* tests can see.
+*/
+function assertKnownFlags(domain, subcommand, args) {
+	if (!subcommand) return;
+	const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];
+	if (!spec) return;
+	try {
+		(0, import_arg.default)({
+			...RELAYED_FLAGS,
+			...spec
+		}, { argv: args.slice(2) });
+	} catch (err) {
+		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		throw err;
+	}
+}
+//#endregion
+//#region src/cli-collections-path.ts
+/**
+* `--collections <dir>`, checked once, before anything is written.
+*
+* A path that does not resolve used to warn and carry on. Four times over —
+* `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv assembly
+* each re-enter the loader with the same line — and then both generators wrote
+* an *empty* schema: `drizzle/schema.sql` truncated to `CREATE SCHEMA IF NOT
+* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both are committed
+* artifacts. The push that followed planned a `DROP TABLE` for every table in
+* the database, and the only thing between a typo and that was the destructive
+* gate.
+*
+* The check has to be here rather than inside `loadCollectionsForCli`, which is
+* deliberately forgiving: its callers use it to narrow what Atlas may touch,
+* and making a broken *file* fatal there would block a push over something
+* unrelated. "Does the directory the user named exist" is a different question,
+* it was answerable before the first write, and the code already knew.
+*/
+/**
+* Thrown rather than exited, so the tests can see it and the entry point owns
+* the exit code.
+*
+* `alreadyReported` is read by `reportCommandFailure`: the full diagnosis is on
+* stderr by the time this is thrown, and the point of the whole change is that
+* it is printed once.
+*/
+var CollectionsPathMissing = class extends Error {
+	typed;
+	resolved;
+	alreadyReported = true;
+	constructor(typed, resolved) {
+		super(`Collections path not found: "${typed}"`);
+		this.typed = typed;
+		this.resolved = resolved;
+		this.name = "CollectionsPathMissing";
+	}
+};
+/**
+* The whole message, in one place, because it is printed by two callers.
+*
+* Names what was typed, what it resolved to, and the working directory it
+* resolved against — a relative `--collections` is resolved against the cwd,
+* and the generated npm script runs with `cwd: backend/`, so "the path is
+* right and the directory is wrong" is the commonest way to arrive here.
+*/
+function describeMissingCollectionsPath(typed, resolved) {
+	return [
+		chalk.red(`✗ Collections path not found: "${typed}"`),
+		chalk.gray(`    Resolved to: ${resolved}`),
+		chalk.gray(`    (relative to cwd: ${process.cwd()})`),
+		"",
+		chalk.gray("  Nothing was generated and nothing was applied — a schema generated from a"),
+		chalk.gray("  directory that is not there is an empty one, and applying it would drop"),
+		chalk.gray("  every table it does not describe."),
+		"",
+		chalk.gray("  Pass an absolute path, or one relative to where you run the command.")
+	].join("\n");
+}
+/**
+* Refuse a `--collections` path that does not exist.
+*
+* `null` means the flag was not given: the default (`../config/collections`) is
+* left to the loader, which warns and continues — a project may legitimately
+* have no collections directory, and a headless scaffold does.
+*/
+function assertCollectionsPathExists(typed) {
+	if (typed === null) return;
+	const resolved = path.resolve(process.cwd(), typed);
+	if (fs.existsSync(resolved)) return;
+	outError("");
+	outError(describeMissingCollectionsPath(typed, resolved));
+	outError("");
+	throw new CollectionsPathMissing(typed, resolved);
+}
+//#endregion
+//#region src/backup-argv.ts
+/**
+* @param rawArgs the driver's whole line, `["db", "backup", …]`.
+*/
+function backupActionOf(rawArgs) {
+	return rawArgs[2] === "list" ? "list" : "create";
+}
+//#endregion
+//#region src/branch-prune.ts
+/** True when nothing at all needs doing. */
+function planIsEmpty(plan, includeDevDiff) {
+	return plan.staleRows.length === 0 && plan.orphanDatabases.length === 0 && plan.expired.length === 0 && (!includeDevDiff || plan.devDiff.length === 0);
+}
+/**
+* Age in whole days, floored.
+*
+* Floored rather than rounded so `--older-than 7` never catches something six
+* and a half days old: a prune that removes more than it said it would is worse
+* than one that waits another twelve hours.
+*/
+function ageInDays(createdAt, now) {
+	return Math.floor((now.getTime() - createdAt.getTime()) / 864e5);
+}
+/**
+* Parse `--older-than`. Accepts a bare number of days, or `7d` / `2w`.
+*
+* Returns null for anything else, so the caller refuses rather than guessing —
+* silently reading `--older-than 7h` as seven *days* would delete a week of
+* work.
+*/
+function parseOlderThan(value) {
+	const match = /^(\d+)\s*([dw])?$/i.exec(value.trim());
+	if (!match) return null;
+	const amount = Number(match[1]);
+	if (!Number.isFinite(amount)) return null;
+	return match[2]?.toLowerCase() === "w" ? amount * 7 : amount;
+}
+function planPrune(input, options = {}) {
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	const present = new Set(input.databases);
+	const registered = new Set(input.rows.map((row) => row.dbName));
+	return {
+		staleRows: input.rows.filter((row) => !present.has(row.dbName)),
+		orphanDatabases: input.databases.filter((name) => name.startsWith(input.branchPrefix) && !registered.has(name)).sort(),
+		expired: options.olderThanDays == null ? [] : input.rows.filter((row) => present.has(row.dbName)).map((branch) => ({
+			branch,
+			ageDays: ageInDays(branch.createdAt, now)
+		})).filter((entry) => entry.ageDays >= options.olderThanDays).sort((a, b) => b.ageDays - a.ageDays),
+		devDiff: input.databases.filter((name) => name.endsWith("_dev_diff")).sort()
+	};
+}
+//#endregion
+//#region src/cli.ts
+var __cliDirname = path.dirname(fileURLToPath(import.meta.url));
+/**
+* A script this CLI spawns, and how to run it.
+*
+* Four commands — `schema generate`, the DDL plan, `introspect` and the schema
+* doctor — run as child processes, located by path relative to this file. That
+* path used to be `<dir>/schema/<name>.ts`, which worked only because `files`
+* shipped `src`. When the tarball stopped shipping `src`, every one of those
+* commands broke for every npm consumer at once: the file was simply absent,
+* and the parent CLI reported the absence as "Dependencies are not installed"
+* at projects that had installed perfectly. 0.18.0 shipped that way — a
+* scaffolded project's first `rebase dev` could not regenerate its schema and
+* every `GET /api/data/*` answered `Table not found for collection 'posts'`.
+*
+* The build emits each of them beside this file, so a published copy carries
+* the command surface as an artifact. Source still wins where there is no
+* build, which is how the monorepo runs before `pnpm build`.
+*
+* **The interpreter is tsx either way, and that is not incidental.** These
+* scripts load the *project's* collection files, which are TypeScript and
+* import each other as `./authors.js` — the extension TypeScript tells you to
+* write. Node resolves that literally and fails on a file that does not exist;
+* tsx maps it back. Running the built `.js` under plain `node` therefore fails
+* on the user's code rather than on ours, one directory further from anything
+* the error mentions.
+*/
+function resolveChildScript(name) {
+	const built = path.join(__cliDirname, "schema", `${name}.js`);
+	const source = path.join(__cliDirname, "schema", `${name}.ts`);
+	const script = fs.existsSync(built) ? built : fs.existsSync(source) ? source : null;
+	if (!script) return {
+		ok: false,
+		reason: "script"
+	};
+	const tsxBin = resolveLocalBin("tsx");
+	if (!tsxBin) return {
+		ok: false,
+		reason: "tsx"
+	};
+	return {
+		ok: true,
+		bin: tsxBin,
+		script
+	};
+}
+/** What to print when {@link resolveChildScript} cannot produce a command. */
+function childScriptError(what, reason) {
+	if (reason === "tsx") return `✗ Could not find the tsx binary, which ${what} needs to read your collection files. Install your project's dependencies and try again.`;
+	return `✗ The driver's ${what} is missing. This copy of @rebasepro/server-postgres is incomplete — reinstall it, or run its build if you are working in the monorepo.`;
+}
+async function loadEnv() {
+	try {
+		const dotenv = await import("dotenv");
+		const envPaths = [
+			process.env.DOTENV_CONFIG_PATH,
+			path.resolve(process.cwd(), ".env"),
+			path.resolve(process.cwd(), "../.env"),
+			path.resolve(process.cwd(), "../../.env")
+		].filter(Boolean);
+		for (const p of envPaths) if (fs.existsSync(p)) {
+			const parsed = dotenv.config({
+				path: p,
+				quiet: true
+			});
+			if (parsed.parsed) {
+				for (const [key, val] of Object.entries(parsed.parsed)) if (process.env[key] === void 0) process.env[key] = val;
+				break;
+			}
+		}
+	} catch {}
+}
+async function runPluginCommand(args) {
+	if (process.env.DOTENV_CONFIG_QUIET === void 0) process.env.DOTENV_CONFIG_QUIET = "true";
+	await loadEnv();
+	const domain = args[0];
+	const subcommand = args[1];
+	assertKnownFlags(domain, subcommand, args);
+	assertCollectionsPathExists(collectionsPathIn(args));
+	if (domain === "db") await dbCommand(subcommand, args);
+	else if (domain === "schema") await schemaCommand(subcommand, args);
+	else if (domain === "doctor") await doctorPluginCommand(args);
+	else {
+		outError(chalk.red(`Unknown domain command: ${domain}`));
+		process.exit(1);
+	}
+}
+/** The migration files on disk, sorted, or none if the directory is absent. */
+function listMigrationFiles() {
+	const dir = path.resolve(process.cwd(), "drizzle", "migrations");
+	if (!fs.existsSync(dir)) return [];
+	return fs.readdirSync(dir).filter((f) => f.endsWith(".sql")).sort();
+}
+/**
+* The newest migration's version — the numeric prefix Atlas records.
+*
+* `20260906101530_init.sql` → `20260906101530`. Named in the baseline remedy so
+* the command it prints can be typed rather than worked out.
+*/
+function latestMigrationVersion() {
+	const newest = listMigrationFiles().at(-1);
+	if (!newest) return null;
+	const match = /^(\d+)/.exec(newest);
+	return match ? match[1] : newest.replace(/\.sql$/, "");
+}
+/**
+* Take Atlas's carve-outs back out of the migration `migrate diff` just wrote.
+*
+* The apply path hands Atlas `--exclude` and it never sees the search or vector
+* columns. The diff path has no such flag — `atlas migrate diff` rejects
+* `--exclude` outright, and an `atlas.hcl` `env` block's `exclude` is accepted
+* and then ignored — so Atlas replays the migration directory (which builds
+* both columns, because that DDL is appended to migrations), does not find them
+* in `schema.sql`, and plans `DROP COLUMN`. Applied, that would take search and
+* the embeddings away from every database the migration reaches.
+*
+* Returns whether a migration Atlas just wrote is still there afterwards: a
+* file whose only content was the spurious drop is deleted, because an empty
+* migration is worse than none — it takes a slot in the revision history and
+* the caller would append the carved-out DDL and the policies to it.
+*
+* @returns true when a new migration survives and may be appended to.
+*/
+async function stripCarvedOutFromNewestMigration(collectionsPath) {
+	const patterns = [...await getSearchExcludes(collectionsPath), ...await getVectorExcludes(collectionsPath)];
+	if (patterns.length === 0) return true;
+	const newest = listMigrationFiles().at(-1);
+	if (!newest) return false;
+	const file = path.resolve(process.cwd(), "drizzle", "migrations", newest);
+	const result = stripCarvedOutStatements(fs.readFileSync(file, "utf-8"), patterns);
+	if (result.unhandled.length > 0) {
+		outError(chalk.red(`\n  ✗ ${newest} drops an object Rebase manages outside Atlas, in a form the CLI`));
+		outError(chalk.red("    could not remove:"));
+		for (const statement of result.unhandled) outError(chalk.gray(`       ${statement.replace(/\s+/g, " ")}`));
+		outError(chalk.gray("    Left as Atlas wrote it. Delete those statements by hand before running\n    `rebase db migrate` — and please report them: rewriting this is meant to\n    be automatic."));
+		process.exit(1);
+	}
+	if (result.removed.length === 0) return true;
+	if (result.empty) {
+		fs.rmSync(file);
+		out(chalk.gray(`  ✓ Dropped ${newest} — it planned nothing but the removal of columns\n    Atlas cannot see and Rebase applies itself.`));
+	} else {
+		fs.writeFileSync(file, result.sql, "utf-8");
+		out(chalk.gray(`  ✓ Kept Rebase's own columns out of ${newest} (${result.removed.length} statement(s))`));
+	}
+	await runAtlas("migrate", [
+		"hash",
+		"--dir",
+		"file://drizzle/migrations"
+	], collectionsPath);
+	return !result.empty;
+}
+async function dbCommand(subcommand, rawArgs) {
+	const VALID_ACTIONS = [
+		"push",
+		"generate",
+		"migrate",
+		"branch",
+		"backup",
+		"restore",
+		"backups"
+	];
+	if (!subcommand || !VALID_ACTIONS.includes(subcommand)) {
+		outError(chalk.red(`Unknown db command. Valid: ${VALID_ACTIONS.join(", ")}`));
+		process.exit(1);
+	}
+	if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
+		out("");
+		out(chalk.bold(`  rebase db ${subcommand}`));
+		out(chalk.gray("  Run `rebase db --help` for the full page — this is the driver's own entry point."));
+		out("");
+		return;
+	}
+	if (subcommand === "branch") {
+		await branchCommand(rawArgs);
+		return;
+	}
+	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-oM9WQVlV.js");
+		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
+		else if (subcommand === "backup") await backupCommand(rawArgs);
+		else if (subcommand === "restore") await restoreCommand(rawArgs);
+		else await backupsCommand(rawArgs);
+		return;
+	}
+	const argsList = (0, import_arg.default)({
+		"--collections": String,
+		"--allow-destructive": Boolean,
+		"--dry-run": Boolean,
+		"--yes": Boolean,
+		"--baseline": String,
+		"-c": "--collections",
+		"-y": "--yes"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+	if (subcommand === "generate") {
+		out("");
+		out(chalk.bold("  📦 Rebase DB Generate"));
+		out(chalk.gray("  Step 1/2: Generating Drizzle schema & Postgres DDL from collections..."));
+		out("");
+		await schemaCommand("generate", rawArgs);
+		await generatePostgresDdlCommand(rawArgs);
+		out("");
+		out(chalk.gray("  Step 2/2: Generating SQL migration files with Atlas..."));
+		out("");
+		const migrationName = argsList._[0] || "migration";
+		const migrationsBefore = listMigrationFiles();
+		await runAtlas("migrate", [
+			"diff",
+			migrationName,
+			"--dir",
+			"file://drizzle/migrations",
+			"--to",
+			"file://drizzle/schema.sql"
+		], collectionsPath);
+		let wroteNewMigration = listMigrationFiles().length > migrationsBefore.length;
+		if (wroteNewMigration) wroteNewMigration = await stripCarvedOutFromNewestMigration(collectionsPath);
+		try {
+			const migrationsDir = path.resolve(process.cwd(), "drizzle", "migrations");
+			if (fs.existsSync(migrationsDir) && wroteNewMigration) {
+				const sqlFiles = fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
+				if (sqlFiles.length > 0) {
+					const newestMigrationFile = path.join(migrationsDir, sqlFiles[sqlFiles.length - 1]);
+					let migrationContent = fs.readFileSync(newestMigrationFile, "utf-8");
+					migrationContent = migrationContent.replace(/CREATE SCHEMA (?!IF NOT EXISTS)("[^"]+");/g, "CREATE SCHEMA IF NOT EXISTS $1;");
+					const vectorContent = readVectorDdl();
+					if (vectorContent) {
+						migrationContent = `${migrationContent}\n\n${vectorContent}`;
+						out(chalk.gray("  ✓ Appended vector DDL to the migration"));
+					}
+					const searchContent = readSearchDdl();
+					if (searchContent) {
+						migrationContent = `${migrationContent}\n\n${searchContent}`;
+						out(chalk.gray("  ✓ Appended search DDL to the migration"));
+					}
+					fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
+					const policiesFile = path.resolve(process.cwd(), "drizzle", "policies.sql");
+					if (fs.existsSync(policiesFile)) {
+						const policiesContent = fs.readFileSync(policiesFile, "utf-8");
+						fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
+						out(chalk.gray(`  ✓ Appended RLS policies to migration file: ${path.basename(newestMigrationFile)}`));
+						out(chalk.gray("  Re-hashing migration files..."));
+						await runAtlas("migrate", [
+							"hash",
+							"--dir",
+							"file://drizzle/migrations"
+						], collectionsPath);
+						out(chalk.gray("  ✓ Migration directory checksum updated successfully."));
+					}
+				}
+			}
+		} catch (err) {
+			outWarn(chalk.yellow(`  ⚠️  Failed to append policies or re-hash migration: ${err instanceof Error ? err.message : String(err)}`));
+		}
+		if (!wroteNewMigration) out(chalk.gray("  ℹ No migration written — nothing in this change is visible to Atlas.\n    Search, vector and RLS DDL are applied by `rebase db push`, and at boot by\n    the schema ensure. For a migration-only deployment, add drizzle/search.sql,\n    drizzle/vector.sql and drizzle/policies.sql to a migration by hand."));
+		out("");
+		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
+		out("");
+	} else {
+		out("");
+		out(chalk.bold(`  🗄️  Rebase DB ${subcommand.charAt(0).toUpperCase() + subcommand.slice(1)}`));
+		out("");
+		if (subcommand === "push") {
+			out(chalk.gray("  Step 1/3: Generating Drizzle schema & Postgres DDL from collections..."));
+			out("");
+			await schemaCommand("generate", rawArgs);
+			await generatePostgresDdlCommand(rawArgs);
+			out("");
+			const dryRun = argsList["--dry-run"] === true;
+			out(chalk.gray(dryRun ? "  Step 2/3: Planning the change against the database (nothing is applied)..." : "  Step 2/3: Pushing schema to database with Atlas..."));
+			out("");
+			const databaseUrl = process.env.DATABASE_URL;
+			if (databaseUrl && !dryRun) await ensureAuthSchemaAndFunctions(databaseUrl);
+			const plan = await runAtlas("schema", [
+				"apply",
+				"--to",
+				"file://drizzle/schema.sql",
+				"--dry-run"
+			], collectionsPath, { captureStdout: true });
+			const destructive = detectDestructiveStatements(plan);
+			if (dryRun) {
+				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
+				out("");
+				if (plan.trim()) {
+					out(chalk.bold("  Planned changes:"));
+					out(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
+				out("");
+				if (destructive.length > 0) {
+					outWarn(chalk.yellow(`  ⚠️  ${destructive.length} of those DESTROY data:`));
+					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+					outWarn("");
+					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
+					outWarn("");
+				}
+				out(chalk.gray("  The auth schema step was skipped, because it writes. A real push runs it first."));
+				out("");
+				return;
+			}
+			const allowDestructive = argsList["--allow-destructive"] === true || argsList["--yes"] === true;
+			const decision = decidePushSafety({
+				destructiveCount: destructive.length,
+				allowDestructive,
+				interactive: process.stdin.isTTY === true
+			});
+			if (destructive.length > 0) {
+				outWarn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
+				outWarn("");
+				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+				outWarn("");
+				outWarn(chalk.yellow("  Full planned changes:"));
+				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				outWarn("");
+				if (decision === "refuse") {
+					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
+					outError(chalk.gray("    Re-run interactively, or pass --allow-destructive to proceed. Back up first: rebase db backup"));
+					process.exit(1);
+				}
+				if (decision === "confirm") {
+					if (!await promptConfirm(chalk.yellow("  Type 'yes' to apply these destructive changes (this cannot be undone): "))) {
+						out(chalk.gray("  Aborted. No changes were made."));
+						process.exit(1);
+					}
+				} else outWarn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
+			}
+			await runAtlas("schema", [
+				"apply",
+				"--to",
+				"file://drizzle/schema.sql",
+				"--auto-approve"
+			], collectionsPath);
+			out("");
+			if (databaseUrl) {
+				await ensureAuthTables(databaseUrl, collectionsPath);
+				await applyVectorDdl(databaseUrl);
+				await applySearchDdl(databaseUrl);
+				await applyPolicies(databaseUrl);
+				await reconcilePolicies(databaseUrl, collectionsPath);
+				await ensureRlsUserRole(databaseUrl);
+				await retireLegacyAuthSchema(databaseUrl);
+				if (scratchDatabaseCreatedHere) await dropDevDatabase(databaseUrl, getDevDatabaseUrl(databaseUrl));
+			} else outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
+		} else if (subcommand === "migrate") {
+			const databaseUrl = process.env.DATABASE_URL;
+			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
+			const extraArgs = argsList._.filter((arg) => arg !== "migrate");
+			const baseline = argsList["--baseline"];
+			if (baseline) {
+				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
+				out("");
+			}
+			await runAtlas("migrate", [
+				"apply",
+				"--dir",
+				"file://drizzle/migrations",
+				...baseline ? ["--baseline", baseline] : [],
+				...extraArgs
+			], collectionsPath);
+			if (databaseUrl) {
+				await ensureRlsUserRole(databaseUrl);
+				await retireLegacyAuthSchema(databaseUrl);
+			}
+		}
+		out("");
+		out(chalk.green(`  ✓ rebase db ${subcommand} completed successfully.`));
+		out("");
+	}
+}
+async function ensureAuthSchemaAndFunctions(databaseUrl) {
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			await client.query(RLS_BOOTSTRAP_SQL);
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  Failed to bootstrap the RLS helper functions: ${err instanceof Error ? err.message : String(err)}`));
+	}
+}
+/**
+* Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
+* policies reference, before `applyPolicies` runs. Mirrors what the server does
+* at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
+*
+* Without this, `rebase db push` against a database that has never booted the
+* server fails while applying policies with `relation "rebase.users" does not
+* exist` — the documented first-run does `db push` *before* the first `dev`.
+* `ensureAuthTablesExist` is idempotent (CREATE TABLE IF NOT EXISTS), so it is
+* safe to run on every push and harmless once the server has also created them.
+*/
+async function ensureAuthTables(databaseUrl, collectionsPath) {
+	try {
+		const { drizzle } = await import("drizzle-orm/node-postgres");
+		const { ensureAuthTablesExist } = await import("./ensure-tables-CIojK-Rx.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-D7HWmGzs.js").then((n) => n.t);
+		const { Client } = await import("pg");
+		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
+			const a = c.auth;
+			return a === true || typeof a === "object" && a !== null && a.enabled === true;
+		});
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			await ensureAuthTablesExist(drizzle(client), authCollection);
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  Failed to ensure framework auth tables: ${err instanceof Error ? err.message : String(err)}`));
+	}
+}
+/**
+* Provision the restricted `rebase_user` role right after schema changes land,
+* so grants cover freshly created tables (default privileges cover future
+* ones). Only needed — and only possible without extra setup — when the
+* connection would bypass RLS (superuser / BYPASSRLS / table owner).
+*/
+async function ensureRlsUserRole(databaseUrl) {
+	const schemas = ["public", "rebase"];
+	let rls;
+	try {
+		rls = await import("./rls-enforcement-DeYEjYLt.js").then((n) => n.a);
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
+		return;
+	}
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			const runSql = async (text) => (await client.query(text)).rows;
+			if ((await rls.detectConnectionPosture(runSql)).privileged) {
+				await rls.ensureAppRole(runSql, schemas);
+				out(chalk.gray(`  ✓ RLS role "${rls.REBASE_USER_ROLE}" provisioned/refreshed.`));
+			}
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ The schema change was applied, but the "${rls.REBASE_USER_ROLE}" role could not be provisioned: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray(rls.appRoleSetupInstructions("your database user", schemas)));
+	}
+}
+/**
+* Retire the pre-1.0 `auth` schema, once nothing depends on it any more.
+*
+* Runs last on purpose. Postgres refuses to drop a function an RLS policy still
+* calls, so this only succeeds after the policies above have been rewritten to
+* `rebase.uid()`. See `dropLegacyAuthSchema` for what it reports when something
+* hand-written is still holding the schema open, and DROP_LEGACY_AUTH_SCHEMA_SQL
+* for the guards that keep it off a Supabase `auth` schema.
+*/
+async function retireLegacyAuthSchema(databaseUrl) {
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			await dropLegacyAuthSchema(async (text) => (await client.query(text)).rows, {
+				info: (m) => out(chalk.gray(`  ${m}`)),
+				warn: (m) => outWarn(chalk.yellow(`  ⚠️  ${m}`))
+			});
+		} finally {
+			await client.end();
+		}
+	} catch {}
+}
+async function applyPolicies(databaseUrl) {
+	try {
+		const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
+		if (!fs.existsSync(policiesPath)) return;
+		out(chalk.gray("  Step 3/3: Applying RLS policies to database..."));
+		out("");
+		const policiesContent = fs.readFileSync(policiesPath, "utf-8");
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			await client.query(policiesContent);
+			out(chalk.green("  ✓ RLS policies applied successfully."));
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		const hint = diagnoseDbError(err, databaseUrl);
+		if (hint) outError(hint);
+		else outError(chalk.red(`  ✗ Failed to apply RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+}
+/**
+* Remove the policies an earlier push superseded but never dropped.
+*
+* `policies.sql` only DROPs the names it is about to CREATE, and a rule's
+* generated name contains a hash of its own semantics — so editing a rule
+* writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
+* policies together, which makes an abandoned grant outrank every tightening
+* that replaced it, and push reported success the whole time.
+*
+* Runs after `applyPolicies` so the current policies are already in place: the
+* drift check then sees exactly the set that should survive, and anything else
+* on a managed table is by definition left over.
+*/
+async function reconcilePolicies(databaseUrl, collectionsPath) {
+	try {
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-kNJ6X2Uj.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-D7HWmGzs.js").then((n) => n.t);
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			const drift = await checkPolicyDrift(client, collections);
+			const { dropped, kept } = await dropOrphanedPolicies(client, drift, collections);
+			for (const p of dropped) out(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
+			if (dropped.length > 0) out(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
+			if (kept.length > 0) {
+				outWarn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
+				for (const p of kept) outWarn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
+				outWarn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+			}
+			const remaining = {
+				...drift,
+				orphaned: kept
+			};
+			if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
+				outWarn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
+				outWarn(formatPolicyDrift({
+					...remaining,
+					orphaned: []
+				}));
+			}
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+	}
+}
+/**
+* Flags the `branch` subcommands take.
+*
+* Declared as an `arg` spec rather than picked out of argv by hand, which is
+* both how the rest of this file parses flags and how the documentation
+* verifier discovers them: it reads `arg({ … })` specs out of this source, so a
+* flag parsed any other way is one it reports as unrunnable in every page that
+* documents it. Hand-rolled parsing here cost exactly that — `--older-than`
+* worked and the docs check called it a command a reader cannot run.
+*/
+var BRANCH_FLAGS = {
+	"--older-than": String,
+	"--include-dev-diff": Boolean,
+	"--from": String,
+	"--yes": Boolean,
+	"-y": "--yes"
+};
+async function branchCommand(rawArgs) {
+	const branchAction = rawArgs[2];
+	if (!branchAction || branchAction === "--help") {
+		printBranchHelp();
+		return;
+	}
+	const extras = unexpectedBranchArgs(rawArgs.slice(2));
+	if (extras.length > 0) {
+		outError("");
+		outError(chalk.red(`  ✗ Unexpected argument${extras.length > 1 ? "s" : ""}: ${extras.join(" ")}`));
+		outError("");
+		outError(chalk.gray(`  ${chalk.bold("rebase db branch")} takes one name. A branch name may contain letters,`));
+		outError(chalk.gray("  digits, underscores and hyphens — no spaces."));
+		if (rawArgs[3]) outError(chalk.gray(`  Did you mean: ${chalk.cyan(`rebase db branch ${branchAction} ${[rawArgs[3], ...extras].join("-")}`)}`));
+		outError("");
+		process.exit(1);
+	}
+	try {
+		const dotenv = await import("dotenv");
+		const envPath = process.env.DOTENV_CONFIG_PATH;
+		if (envPath) dotenv.config({
+			path: envPath,
+			quiet: true
+		});
+		else dotenv.config({ quiet: true });
+	} catch {}
+	const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
+	if (!databaseUrl) {
+		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
+		process.exit(1);
+	}
+	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-ByLfM_Tt.js").then((n) => n.n);
+	const { drizzle } = await import("drizzle-orm/node-postgres");
+	const { Pool } = await import("pg");
+	const pool = new Pool({
+		connectionString: databaseUrl,
+		max: 3
+	});
+	const db = drizzle(pool);
+	const poolManager = new DatabasePoolManager(databaseUrl);
+	const branchService = new BranchService(db, poolManager);
+	await branchService.ensureBranchMetadataTable();
+	try {
+		switch (branchAction) {
+			case "create": {
+				const name = rawArgs[3];
+				if (!name) {
+					outError(chalk.red("✗ Branch name is required."));
+					out(chalk.gray("  Usage: rebase db branch create <name> [--from <source>]"));
+					process.exit(1);
+				}
+				let source;
+				const fromIdx = rawArgs.indexOf("--from");
+				if (fromIdx !== -1 && rawArgs[fromIdx + 1]) source = rawArgs[fromIdx + 1];
+				const force = rawArgs.includes("--force");
+				out("");
+				out(chalk.bold("  🌿 Creating database branch..."));
+				out(chalk.gray(`  Name:   ${name}`));
+				if (source) out(chalk.gray(`  Source: ${source}`));
+				if (force) out(chalk.gray("  Force:  other connections to the source will be disconnected"));
+				out("");
+				const branch = await branchService.createBranch(name, {
+					source,
+					force
+				});
+				out(chalk.green(`  ✓ Branch "${branch.name}" created successfully.`));
+				out(chalk.gray(`    Database: rb_${branch.name}`));
+				out(chalk.gray(`    Parent:   ${branch.parentDatabase}`));
+				out("");
+				break;
+			}
+			case "list": {
+				const branches = await branchService.listBranches();
+				out("");
+				if (branches.length === 0) out(chalk.gray("  No branches found. Create one with: rebase db branch create <name>"));
+				else {
+					out(chalk.bold(`  🌿 ${branches.length} branch(es):`));
+					out("");
+					for (const b of branches) {
+						const size = b.sizeBytes != null ? chalk.gray(` (${formatBytes(b.sizeBytes)})`) : "";
+						const age = chalk.gray(` — created ${timeAgo(b.createdAt)}`);
+						out(`  ${chalk.green("●")} ${chalk.bold(b.name)}${size}${age}`);
+						out(chalk.gray(`    from ${b.parentDatabase}`));
+					}
+				}
+				out("");
+				break;
+			}
+			case "delete": {
+				const name = rawArgs[3];
+				if (!name) {
+					outError(chalk.red("✗ Branch name is required."));
+					out(chalk.gray("  Usage: rebase db branch delete <name>"));
+					process.exit(1);
+				}
+				out("");
+				out(chalk.bold(`  🗑️  Deleting branch "${name}"...`));
+				await branchService.deleteBranch(name, { force: rawArgs.includes("--force") });
+				out(chalk.green(`  ✓ Branch "${name}" deleted.`));
+				out("");
+				break;
+			}
+			case "info": {
+				const name = rawArgs[3];
+				if (!name) {
+					outError(chalk.red("✗ Branch name is required."));
+					out(chalk.gray("  Usage: rebase db branch info <name>"));
+					process.exit(1);
+				}
+				const info = await branchService.getBranchInfo(name);
+				out("");
+				if (!info) {
+					outError(chalk.red(`  ✗ Branch "${name}" not found.`));
+					out("");
+					process.exit(1);
+				} else {
+					out(chalk.bold(`  🌿 Branch: ${info.name}`));
+					out(chalk.gray(`    Database: rb_${info.name}`));
+					out(chalk.gray(`    Parent:   ${info.parentDatabase}`));
+					out(chalk.gray(`    Created:  ${info.createdAt.toISOString()}`));
+					if (info.sizeBytes != null) out(chalk.gray(`    Size:     ${formatBytes(info.sizeBytes)}`));
+				}
+				out("");
+				break;
+			}
+			case "prune": {
+				const parsed = (0, import_arg.default)(BRANCH_FLAGS, {
+					argv: rawArgs.slice(3),
+					permissive: true
+				});
+				const olderThanRaw = parsed["--older-than"] ?? null;
+				const olderThanDays = olderThanRaw == null ? null : parseOlderThan(olderThanRaw);
+				if (olderThanRaw != null && olderThanDays == null) {
+					outError(chalk.red(`  ✗ --older-than "${olderThanRaw}" is not a duration.`));
+					out(chalk.gray("    Use a number of days (14), or 14d / 2w."));
+					process.exit(1);
+				}
+				const includeDevDiff = parsed["--include-dev-diff"] === true;
+				const { rows, databases } = await branchService.pruneCandidates();
+				const plan = planPrune({
+					rows,
+					databases,
+					branchPrefix: "rb_"
+				}, { olderThanDays });
+				out("");
+				if (planIsEmpty(plan, includeDevDiff)) {
+					out(chalk.gray("  Nothing to prune."));
+					if (!olderThanDays && rows.length > 0) out(chalk.gray(`  ${rows.length} branch(es) are healthy — --older-than 14 also removes old ones.`));
+					if (!includeDevDiff && plan.devDiff.length > 0) {
+						out(chalk.gray(`  ${plan.devDiff.length} Atlas scratch database(s) left over from db push;`));
+						out(chalk.gray("  --include-dev-diff removes those too."));
+					}
+					out("");
+					break;
+				}
+				out(chalk.bold("  🧹 Prune plan"));
+				out("");
+				for (const row of plan.staleRows) out(`  ${chalk.yellow("○")} ${chalk.bold(row.name)} ${chalk.gray("— registered, but its database is gone; the entry will be removed")}`);
+				for (const dbName of plan.orphanDatabases) out(`  ${chalk.yellow("○")} ${chalk.bold(dbName)} ${chalk.gray("— a branch database with no entry; the database will be dropped")}`);
+				for (const { branch, ageDays } of plan.expired) out(`  ${chalk.red("●")} ${chalk.bold(branch.name)} ${chalk.gray(`— ${ageDays} days old; branch and database will be dropped`)}`);
+				if (includeDevDiff) for (const dbName of plan.devDiff) out(`  ${chalk.red("●")} ${chalk.bold(dbName)} ${chalk.gray("— Atlas scratch database; will be dropped")}`);
+				else if (plan.devDiff.length > 0) out(chalk.gray(`  (${plan.devDiff.length} Atlas scratch database(s) not listed — --include-dev-diff)`));
+				out("");
+				if (parsed["--yes"] !== true) {
+					if (!await promptConfirm("  Remove these? (y/N) ")) {
+						out(chalk.gray("  Nothing was changed."));
+						out("");
+						break;
+					}
+				}
+				let removed = 0;
+				for (const row of plan.staleRows) {
+					await branchService.forgetBranchRow(row.name);
+					removed += 1;
+				}
+				for (const dbName of plan.orphanDatabases) {
+					await branchService.dropDatabase(dbName);
+					removed += 1;
+				}
+				for (const { branch } of plan.expired) {
+					await branchService.deleteBranch(branch.name);
+					removed += 1;
+				}
+				if (includeDevDiff) for (const dbName of plan.devDiff) {
+					await branchService.dropDatabase(dbName);
+					removed += 1;
+				}
+				out(chalk.green(`  ✓ Pruned ${removed} item(s).`));
+				out("");
+				break;
+			}
+			default:
+				outError(chalk.red(`Unknown branch action: "${branchAction}".`));
+				printBranchHelp();
+				process.exit(1);
+		}
+	} finally {
+		await poolManager.shutdown();
+		await pool.end();
+	}
+}
+function printBranchHelp() {
+	out(`
+${chalk.bold("rebase db branch")} — Database branching commands
+
+${chalk.green.bold("Usage")}
+  rebase db branch ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("create")} <name> [--from <source>]   Create a new branch
+  ${chalk.blue.bold("list")}                              List all branches
+  ${chalk.blue.bold("switch")} [<name>|--off]             Point this checkout at a branch
+  ${chalk.blue.bold("delete")} <name>                     Delete a branch
+  ${chalk.blue.bold("info")} <name>                       Show branch details
+  ${chalk.blue.bold("prune")} [--older-than <14|14d|2w>]  Remove branches nothing is using
+
+${chalk.green.bold("Why prune")}
+  Every branch is a full-size copy — CREATE DATABASE ... TEMPLATE duplicates the
+  files on disk, so five branches of a 100GB database cost 500GB. Prune also
+  finds the two ways branches drift: an entry whose database was dropped
+  outside Rebase, and a branch database whose entry never got written.
+
+${chalk.green.bold("Options")}
+  ${chalk.blue.bold("--force")}                           Disconnect other sessions first.
+                                    Postgres refuses to copy or drop a database
+                                    anything else is connected to — usually your
+                                    own \`rebase dev\`.
+  ${chalk.blue.bold("--include-dev-diff")}                Also prune the Atlas scratch databases
+                                    \`db push\` leaves behind.
+  ${chalk.blue.bold("--yes, -y")}                         Skip prune's confirmation prompt. Dropping a
+                                    branch is not undoable, so this is the flag
+                                    a CI job passes and a person usually should not.
+
+${chalk.green.bold("Examples")}
+  ${chalk.gray("# Create a branch and work on it")}
+  rebase db branch create feature_auth
+  rebase db branch switch feature_auth
+
+  ${chalk.gray("# Create a branch from a specific source")}
+  rebase db branch create staging --from production
+
+  ${chalk.gray("# Remove branches older than two weeks, and anything orphaned")}
+  rebase db branch prune --older-than 2w
+
+  ${chalk.gray("# List all branches")}
+  rebase db branch list
+
+  ${chalk.gray("# Delete a branch")}
+  rebase db branch delete feature_auth
+`);
+}
+function formatBytes(bytes) {
+	if (bytes < 1024) return `${bytes} B`;
+	if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+	if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+	return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;
+}
+/** A branch's age, for "…created 6d ago". */
+function timeAgo(date) {
+	return formatRelativeTime(date, { maxMs: Number.POSITIVE_INFINITY }) ?? "unknown";
+}
+/** Set when this process created the Atlas scratch database; see `ensureDevDatabaseExists`. */
+var scratchDatabaseCreatedHere = false;
+async function runAtlas(domain, args, collectionsPath, opts = {}) {
+	const atlasBin = resolveLocalBin("atlas");
+	if (!atlasBin) {
+		outError(chalk.red("\n✗ The atlas binary is missing, so the schema cannot be applied.\n"));
+		const manager = detectProjectPackageManager();
+		const diagnosis = diagnoseMissingBin("@ariga/atlas");
+		if (diagnosis === "bin-link-missing") {
+			outError(chalk.yellow("  @ariga/atlas and its binary are both on disk — only the\n  node_modules/.bin/atlas link that puts it on PATH is missing.\n"));
+			outError(chalk.gray("  Usually a half-written install: the link is created before the script that\n  downloads the target, so an interrupted or copied tree keeps the binary and\n  loses the shim.\n"));
+			outError("  Fix it with:\n");
+			outError(chalk.bold(`    ${describeReinstallCommand(manager)}\n`));
+		} else if (diagnosis === "build-script-blocked") {
+			outError(chalk.yellow("  @ariga/atlas IS installed — only its binary is missing.\n"));
+			outError(chalk.gray("  It downloads that binary in a `preinstall` script, and pnpm 10+ and npm 12+\n  do not run a dependency's scripts unless you allow it. The install still\n  exits 0, so the only sign is a line several screens up: pnpm's\n  `Ignored build scripts: @ariga/atlas`, or npm's `install scripts blocked`.\n"));
+			outError("  Fix it with either:\n");
+			for (const line of describeBuildScriptRemedy("@ariga/atlas", manager)) outError(line ? chalk.bold(line) : "");
+			outError("");
+		} else {
+			outError(chalk.gray("  It is not installed in this project.\n"));
+			outError("  Install it with:\n");
+			outError(chalk.bold(`    ${describeDevAddCommand("@ariga/atlas", manager)}\n`));
+			outError(chalk.gray("  If the install then reports blocked or ignored build scripts, allow them too —\n  the package carries a `preinstall` script that fetches the binary.\n"));
+		}
+		process.exit(1);
+	}
+	const env = { ...process.env };
+	try {
+		const dotenv = await import("dotenv");
+		const envPaths = [
+			process.env.DOTENV_CONFIG_PATH,
+			path.resolve(process.cwd(), ".env"),
+			path.resolve(process.cwd(), "../.env"),
+			path.resolve(process.cwd(), "../../.env")
+		].filter(Boolean);
+		for (const p of envPaths) if (fs.existsSync(p)) {
+			const parsed = dotenv.config({
+				path: p,
+				quiet: true
+			});
+			if (parsed.parsed) {
+				for (const [key, val] of Object.entries(parsed.parsed)) if (env[key] === void 0) env[key] = val;
+				break;
+			}
+		}
+	} catch {}
+	const databaseUrl = env.DATABASE_URL;
+	if (!databaseUrl) {
+		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
+		process.exit(1);
+	}
+	await checkDatabaseConnectivity(databaseUrl);
+	const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
+	if (await ensureDevDatabaseExists(databaseUrl, devDatabaseUrl)) scratchDatabaseCreatedHere = true;
+	const atlasUrl = forLibpq(databaseUrl);
+	const atlasDevUrl = forLibpq(devDatabaseUrl);
+	const excludes = [];
+	if (collectionsPath && acceptsExcludeFlag(domain, args)) {
+		excludes.push(...await getSearchExcludes(collectionsPath));
+		excludes.push(...await getVectorExcludes(collectionsPath));
+		try {
+			excludes.push(...await getTableExcludes(databaseUrl, collectionsPath));
+		} catch (err) {
+			if (err instanceof ExcludeIntrospectionError) {
+				outError(chalk.red("\n✗ Aborting push: could not determine which tables to protect."));
+				outError(chalk.gray(`  ${err.message}`));
+				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop tables Rebase does not manage."));
+				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+				if (hint) outError(hint);
+				process.exit(1);
+			}
+			throw err;
+		}
+		try {
+			excludes.push(...await getForeignIndexExcludes(databaseUrl, collectionsPath));
+		} catch (err) {
+			if (err instanceof ExcludeIntrospectionError) {
+				outError(chalk.red("\n✗ Aborting push: could not determine which indexes to protect."));
+				outError(chalk.gray(`  ${err.message}`));
+				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop an index Rebase does not manage."));
+				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+				if (hint) outError(hint);
+				process.exit(1);
+			}
+			throw err;
+		}
+	}
+	const subprocess = execa(atlasBin, buildAtlasArgs({
+		domain,
+		args,
+		url: atlasUrl,
+		devUrl: atlasDevUrl,
+		excludes
+	}), {
+		cwd: process.cwd(),
+		stdout: opts.captureStdout ? "pipe" : "inherit",
+		stderr: "pipe",
+		env
+	});
+	let stdoutText = "";
+	if (opts.captureStdout) subprocess.stdout?.on("data", (chunk) => {
+		stdoutText += chunk.toString();
+	});
+	let stderrText = "";
+	subprocess.stderr?.on("data", (chunk) => {
+		const text = chunk.toString();
+		stderrText += text;
+		process.stderr.write(text);
+	});
+	try {
+		await subprocess;
+	} catch {
+		outError(chalk.red(`\n✗ atlas ${domain} ${args.join(" ")} failed.\n`));
+		const hint = await diagnoseAtlasFailure({
+			domain,
+			args,
+			stderr: stderrText,
+			databaseUrl,
+			latestMigrationVersion: latestMigrationVersion()
+		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
+		if (hint) outError(hint);
+		process.exit(1);
+	}
+	if (opts.captureStdout) return stdoutText.trim().length > 0 ? stdoutText : stderrText;
+	return "";
+}
+async function generatePostgresDdlCommand(rawArgs) {
+	const argsList = (0, import_arg.default)({
+		"--collections": String,
+		"--output": String,
+		"-c": "--collections",
+		"-o": "--output"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const ddl = resolveChildScript("generate-postgres-ddl");
+	if (!ddl.ok) {
+		outError(chalk.red(childScriptError("DDL generator", ddl.reason)));
+		process.exit(1);
+	}
+	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+	const outputPath = argsList["--output"] || path.join("drizzle", "schema.sql");
+	const cmdParts = [
+		ddl.bin,
+		ddl.script,
+		`--collections=${collectionsPath}`,
+		`--output=${outputPath}`
+	];
+	try {
+		await execa(cmdParts[0], cmdParts.slice(1), {
+			cwd: process.cwd(),
+			stdio: "inherit",
+			env: { ...process.env }
+		});
+	} catch (err) {
+		if (typeof err.exitCode === "number") outError(chalk.red("✗ Postgres DDL generation failed — nothing was applied."));
+		else outError(chalk.red(`✗ Failed to run Postgres DDL generator: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+}
+/**
+* `schema stale [--fix]` — is the generated Drizzle schema older than the rule
+* that derives its foreign-key names?
+*
+* This exists for one upgrade path and is worth the command. 0.13 derives
+* `category_id` where 0.12 derived `categorie_id`; boot-ensure renames the
+* database column to match, and the project's checked-in
+* `backend/src/schema.generated.ts` is then wrong in a way nothing the developer
+* did would explain. Relation validation refuses to boot on it, permanently,
+* because the rename has already been applied and will not run again.
+*
+* `rebase dev` calls this with `--fix` before starting the backend, so the
+* upgrade behaves the way the release note says it does: the column moves and the
+* project keeps working. Without `--fix` it reports and exits non-zero, which is
+* what a build or a CI step wants.
+*/
+async function schemaStaleCommand(rawArgs) {
+	const argsList = (0, import_arg.default)({
+		"--collections": String,
+		"--output": String,
+		"--fix": Boolean,
+		"-c": "--collections",
+		"-o": "--output",
+		"--out": "--output"
+	}, {
+		argv: rawArgs.slice(2),
+		permissive: true
+	});
+	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+	const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
+	const schemaFile = path.resolve(process.cwd(), outputPath);
+	const fix = Boolean(argsList["--fix"]);
+	const generatedExists = fs.existsSync(schemaFile);
+	const { loadCollections } = await import("./doctor-D7HWmGzs.js").then((n) => n.t);
+	const { findLegacyForeignKeyNames, staleVerdict } = await import("./generated-schema-staleness-DQdfJl2A.js");
+	let stale = [];
+	let unreadable;
+	if (generatedExists) try {
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		stale = findLegacyForeignKeyNames(fs.readFileSync(schemaFile, "utf8"), collections);
+	} catch (err) {
+		unreadable = err instanceof Error ? err.message : String(err);
+		logger.debug(`schema stale: skipped (${unreadable})`);
+	}
+	const verdict = staleVerdict({
+		outputPath,
+		generatedExists,
+		stale,
+		unreadable,
+		fix
+	});
+	for (const line of verdict.lines) if (!line) out("");
+	else if (line.includes("⚠️")) outWarn(chalk.yellow(line));
+	else if (verdict.exitCode !== 0) outError(chalk.red(line));
+	else if (line.includes("✓")) out(chalk.green(line));
+	else out(chalk.gray(line));
+	if (verdict.exitCode !== 0) process.exit(verdict.exitCode);
+	if (!verdict.regenerate) return;
+	await schemaCommand("generate", [
+		"schema",
+		"generate",
+		`--collections=${collectionsPath}`,
+		`--output=${outputPath}`
+	]);
+}
+async function schemaCommand(subcommand, rawArgs) {
+	if (subcommand && (rawArgs.includes("--help") || rawArgs.includes("-h"))) {
+		out("");
+		out(chalk.bold(`  rebase schema ${subcommand}`));
+		out(chalk.gray("  Run `rebase schema --help` for the full page — this is the driver's own entry point."));
+		out("");
+		return;
+	}
+	if (subcommand === "stale") {
+		await schemaStaleCommand(rawArgs);
+		return;
+	}
+	if (subcommand === "generate") {
+		const argsList = (0, import_arg.default)({
+			"--collections": String,
+			"--output": String,
+			"--watch": Boolean,
+			"-c": "--collections",
+			"-o": "--output",
+			"--out": "--output",
+			"-w": "--watch"
+		}, {
+			argv: rawArgs.slice(2),
+			permissive: true
+		});
+		const generator = resolveChildScript("generate-drizzle-schema");
+		if (!generator.ok) {
+			outError(chalk.red(childScriptError("schema generator", generator.reason)));
+			process.exit(1);
+		}
+		const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+		const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
+		const watch = argsList["--watch"] || false;
+		out("");
+		out(chalk.bold("  🔧 Rebase Schema Generator"));
+		out("");
+		const cmdParts = [
+			generator.bin,
+			generator.script,
+			`--collections=${collectionsPath}`,
+			`--output=${outputPath}`
+		];
+		if (watch) cmdParts.push("--watch");
+		try {
+			await execa(cmdParts[0], cmdParts.slice(1), {
+				cwd: process.cwd(),
+				stdio: "inherit",
+				env: { ...process.env }
+			});
+		} catch (err) {
+			if (typeof err.exitCode === "number") outError(chalk.red("✗ Drizzle schema generation failed — nothing was applied."));
+			else outError(chalk.red(`✗ Failed to run schema generator: ${err instanceof Error ? err.message : String(err)}`));
+			process.exit(1);
+		}
+	} else if (subcommand === "introspect") {
+		const argsList = (0, import_arg.default)({
+			"--output": String,
+			"--collections": String,
+			"--force": Boolean,
+			"--schema": String,
+			"-o": "--output",
+			"--out": "--output",
+			"-c": "--collections",
+			"-f": "--force"
+		}, {
+			argv: rawArgs.slice(2),
+			permissive: true
+		});
+		const introspect = resolveChildScript("introspect-db");
+		if (!introspect.ok) {
+			outError(chalk.red(childScriptError("introspection script", introspect.reason)));
+			process.exit(1);
+		}
+		const outputPath = argsList["--output"] || argsList["--collections"] || path.join("..", "config", "collections");
+		out("");
+		out(chalk.bold("  🔍 Rebase Schema Introspector"));
+		out("");
+		const cmdParts = [
+			introspect.bin,
+			introspect.script,
+			`--output=${outputPath}`,
+			...argsList["--force"] ? ["--force"] : [],
+			...argsList["--schema"] ? [`--schema=${argsList["--schema"]}`] : []
+		];
+		try {
+			await execa(cmdParts[0], cmdParts.slice(1), {
+				cwd: process.cwd(),
+				stdio: "inherit",
+				env: { ...process.env }
+			});
+		} catch (err) {
+			outError(chalk.red(`✗ Failed to run schema introspector: ${err instanceof Error ? err.message : String(err)}`));
+			process.exit(1);
+		}
+	} else {
+		outError(chalk.red("Unknown schema command."));
+		process.exit(1);
+	}
+}
+async function doctorPluginCommand(rawArgs) {
+	const parsedArgs = (0, import_arg.default)({
+		"--collections": String,
+		"--schema": String,
+		"--sdk": String,
+		"--policies": Boolean,
+		"-c": "--collections",
+		"-s": "--schema",
+		"-k": "--sdk"
+	}, {
+		argv: rawArgs.slice(1),
+		permissive: true
+	});
+	const doctor = resolveChildScript("doctor-cli");
+	if (!doctor.ok) {
+		outError(chalk.red(childScriptError("doctor script", doctor.reason)));
+		process.exit(1);
+	}
+	const collectionsPath = parsedArgs["--collections"] || path.join("..", "config", "collections");
+	const schemaPath = parsedArgs["--schema"] || path.join("src", "schema.generated.ts");
+	const sdkPath = parsedArgs["--sdk"] || path.join("..", "generated", "sdk", "database.types.ts");
+	const cmdParts = [
+		doctor.bin,
+		doctor.script,
+		`--collections=${collectionsPath}`,
+		`--schema=${schemaPath}`,
+		`--sdk=${sdkPath}`,
+		...parsedArgs["--policies"] ? ["--policies"] : []
+	];
+	try {
+		await execa(cmdParts[0], cmdParts.slice(1), {
+			cwd: process.cwd(),
+			stdio: "inherit",
+			env: { ...process.env }
+		});
+	} catch {
+		process.exit(1);
+	}
+}
+var argv1Real = process.argv[1] ? fs.realpathSync(process.argv[1]) : "";
+if (import.meta.url === `file://${argv1Real}`) runPluginCommand(process.argv.slice(2)).catch((error) => {
+	reportCommandFailure(error);
+	process.exit(1);
+});
+//#endregion
+export { runPluginCommand };
+
+//# sourceMappingURL=cli.js.map