@rebasepro/server-postgres 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{rls-bootstrap-sql-BHA6jLtj.js → rls-bootstrap-sql-B8EclDyM.js}

@@ -4,7 +4,7 @@ import { a as __toESM, i as __require, n as __commonJSMin, r as __exportAll, t a
 import { o as isRebaseIndexName } from "./collection-index-DdnsxiJ_.js";
 import { r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
-import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA, isManyToMany } from "@rebasepro/types";
+import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
 import { sqlRows } from "@rebasepro/common";
 import fs from "fs";
 import path from "path";
@@ -6252,8 +6252,303 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
-//#region src/module-dir.ts
+//#region src/schema/destructive-sql.ts
 var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
+/**
+* Pure helpers that classify an Atlas declarative-apply plan as destructive
+* or not, and decide what `rebase db push` should do about it.
+*
+* `db push` runs `atlas schema apply` to make the live database match the
+* generated `schema.sql`. Removing a collection field compiles to
+* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+* here, and refuse to auto-approve anything destructive without an explicit
+* opt-in.
+*
+* A type change is the one destructive plan that names no DROP. `ALTER COLUMN
+* "price" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away
+* every timestamp's time of day, in a statement that reads like a routine
+* alter. So a type change is gated too, unless it is a widening every value
+* survives unchanged — which needs the column's current type, read from the
+* catalogue by the caller.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without Atlas or a database.
+*/
+/**
+* SQL fragments that destroy data or data-bearing objects. Matched
+* case-insensitively against each statement of the plan. `IF EXISTS` /
+* whitespace variations are tolerated by the regexes below.
+*/
+var DESTRUCTIVE_PATTERNS = [
+	{
+		label: "DROP TABLE",
+		re: /\bDROP\s+TABLE\b/i
+	},
+	{
+		label: "DROP COLUMN",
+		re: /\bDROP\s+COLUMN\b/i
+	},
+	{
+		label: "DROP SCHEMA",
+		re: /\bDROP\s+SCHEMA\b/i
+	},
+	{
+		label: "DROP VIEW",
+		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
+	},
+	{
+		label: "DROP TYPE",
+		re: /\bDROP\s+TYPE\b/i
+	},
+	{
+		label: "TRUNCATE",
+		re: /\bTRUNCATE\b/i
+	}
+];
+/**
+* Split a SQL script into individual statements, dropping blank lines and
+* `--` comment lines. Deliberately simple: Atlas emits one plain statement
+* per `;`, without string literals that contain semicolons in a schema DDL
+* plan, so a naive split is safe and keeps this dependency-free.
+*/
+function splitSqlStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
+* Every column of every ordinary table outside the system schemas, with its
+* type. What {@link detectDestructiveStatements} compares a planned type
+* change against; `format_type` because it carries the modifier (`(255)`,
+* `(10,2)`) that decides whether a change widens or narrows.
+*/
+var COLUMN_TYPES_SQL = `
+    SELECT n.nspname AS "schema",
+           c.relname AS "table",
+           a.attname AS "column",
+           format_type(a.atttypid, a.atttypmod) AS "type"
+    FROM pg_attribute a
+    JOIN pg_class c     ON c.oid = a.attrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND n.nspname NOT LIKE 'pg\\_%'
+`;
+/**
+* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+* the statements that would destroy data. An empty array means the plan is
+* safe to auto-approve.
+*
+* `columnTypes` is what the database holds now. A type change to a column it
+* does not list is flagged: not knowing what a column is means not knowing
+* whether the change keeps its values.
+*/
+function detectDestructiveStatements(planSql, columnTypes = []) {
+	const found = [];
+	for (const statement of splitSqlStatements(planSql)) {
+		const dropped = DESTRUCTIVE_PATTERNS.find(({ re }) => re.test(statement));
+		if (dropped) {
+			found.push({
+				statement,
+				kind: dropped.label
+			});
+			continue;
+		}
+		const lossy = parseColumnTypeChanges(statement).map((change) => ({
+			change,
+			from: currentTypeOf(change, columnTypes)
+		})).filter(({ change, from }) => from === void 0 || !isLosslessTypeChange(from, change.to));
+		if (lossy.length > 0) found.push({
+			statement,
+			kind: "ALTER COLUMN TYPE",
+			detail: lossy.map(({ change, from }) => `"${change.column}" ${from ?? "(current type unknown)"} → ${change.to}`).join("; ")
+		});
+	}
+	return found;
+}
+var IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)`;
+var ALTER_TABLE_RE = new RegExp(String.raw`^ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${IDENT})(?:\.(${IDENT}))?\s+([\s\S]*)$`, "i");
+var TYPE_CLAUSE_RE = new RegExp(String.raw`^ALTER\s+(?:COLUMN\s+)?(${IDENT})\s+(?:SET\s+DATA\s+)?TYPE\s+([\s\S]+)$`, "i");
+var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1).replace(/""/g, "\"") : ident;
+/**
+* Split an `ALTER TABLE`'s clause list on its top-level commas — the ones
+* outside parentheses and quotes, so `TYPE numeric(10, 2)` stays one clause.
+*/
+function splitClauses(body) {
+	const clauses = [];
+	let depth = 0;
+	let quote;
+	let start = 0;
+	for (let i = 0; i < body.length; i++) {
+		const ch = body[i];
+		if (quote) {
+			if (ch === quote) quote = void 0;
+		} else if (ch === "\"" || ch === "'") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			clauses.push(body.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	clauses.push(body.slice(start).trim());
+	return clauses.filter((clause) => clause.length > 0);
+}
+/**
+* Every `ALTER COLUMN … [SET DATA] TYPE` in one statement. Atlas prints its
+* dry-run statements under a `-> ` marker and puts several clauses in one
+* `ALTER TABLE`, so both are handled.
+*/
+function parseColumnTypeChanges(statement) {
+	const table = ALTER_TABLE_RE.exec(statement.replace(/^\s*->\s*/, "").trim());
+	if (!table) return [];
+	const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
+	const changes = [];
+	for (const clause of splitClauses(table[3])) {
+		const match = TYPE_CLAUSE_RE.exec(clause);
+		if (!match) continue;
+		const to = match[2].split(/\s+(?:USING|COLLATE)\s/i)[0].trim();
+		changes.push({
+			schema,
+			table: name,
+			column: unquote(match[1]),
+			to
+		});
+	}
+	return changes;
+}
+/**
+* The column's current type. A table named without its schema matches in any
+* schema, but only when every match agrees — two same-named tables with
+* different types leave the answer unknown.
+*/
+function currentTypeOf(change, columnTypes) {
+	const types = new Set(columnTypes.filter((col) => col.table === change.table && col.column === change.column && (change.schema === void 0 || col.schema === change.schema)).map((col) => col.type));
+	return types.size === 1 ? [...types][0] : void 0;
+}
+/** Spellings of one type, mapped to one name. Anything absent compares verbatim. */
+var TYPE_ALIASES = {
+	"int": "integer",
+	"int4": "integer",
+	"int2": "smallint",
+	"int8": "bigint",
+	"character varying": "varchar",
+	"decimal": "numeric",
+	"timestamp without time zone": "timestamp",
+	"timestamp with time zone": "timestamptz",
+	"time without time zone": "time",
+	"time with time zone": "timetz",
+	"bool": "boolean",
+	"float4": "real",
+	"float8": "double precision",
+	"character": "bpchar",
+	"char": "bpchar"
+};
+/** Decimal digits each integer type holds, which is what a `numeric` must hold too. */
+var INTEGER_DIGITS = {
+	smallint: 5,
+	integer: 10,
+	bigint: 19
+};
+/** Types whose modifier is a fractional-seconds precision, 6 when absent. */
+var SECONDS_PRECISION = /* @__PURE__ */ new Set([
+	"timestamp",
+	"timestamptz",
+	"time",
+	"timetz"
+]);
+function parseType(raw) {
+	let text = raw.trim().replace(/\s+/g, " ");
+	let dims = 0;
+	for (let suffix = /\s*\[\d*\]$/.exec(text); suffix; suffix = /\s*\[\d*\]$/.exec(text)) {
+		dims++;
+		text = text.slice(0, suffix.index);
+	}
+	if (text.includes("\"")) return {
+		base: text,
+		dims
+	};
+	text = text.toLowerCase().replace(/^pg_catalog\./, "");
+	let args;
+	const modifier = /\(([^)]*)\)/.exec(text);
+	if (modifier) {
+		args = modifier[1].split(",").map((part) => Number(part.trim()));
+		text = `${text.slice(0, modifier.index)} ${text.slice(modifier.index + modifier[0].length)}`.replace(/\s+/g, " ").trim();
+	}
+	return {
+		base: TYPE_ALIASES[text] ?? text,
+		args,
+		dims
+	};
+}
+/** Does moving from one modifier to another, on the same type, keep every value? */
+function modifierWidens(base, from, to) {
+	if (JSON.stringify(from) === JSON.stringify(to)) return true;
+	if (base === "varchar") return to === void 0 || from !== void 0 && to[0] >= from[0];
+	if (base === "numeric") {
+		if (to === void 0) return true;
+		if (from === void 0) return false;
+		const [p1, s1 = 0] = from;
+		const [p2, s2 = 0] = to;
+		return s2 >= s1 && p2 - s2 >= p1 - s1;
+	}
+	if (SECONDS_PRECISION.has(base)) return (to?.[0] ?? 6) >= (from?.[0] ?? 6);
+	return false;
+}
+/**
+* Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly
+* as it was?
+*
+* Deliberately short. Everything not listed needs a confirmation, including
+* changes that are usually harmless: `timestamp` → `timestamptz` reads each
+* value in the session's time zone, `json` → `jsonb` drops duplicate keys,
+* `real` → `double precision` prints 0.1 as 0.100000001490116, and `integer` →
+* `text` keeps the digits but changes what the column is.
+*
+*  - the same type, with a modifier at least as wide (`varchar(100)` →
+*    `varchar(255)`, `numeric(10,2)` → `numeric(12,2)` or unbounded,
+*    `timestamptz(3)` → `timestamptz`);
+*  - `smallint` → `integer` → `bigint`, and any of them to a `numeric` with
+*    room for all their digits;
+*  - `varchar(n)` → `text`, and `text` → an unbounded `varchar`.
+*
+* Arrays follow their element type, and never gain or lose a dimension.
+*/
+function isLosslessTypeChange(from, to) {
+	const a = parseType(from);
+	const b = parseType(to);
+	if (a.dims !== b.dims) return false;
+	if (a.args?.some(Number.isNaN) || b.args?.some(Number.isNaN)) return false;
+	if (a.base === b.base) return modifierWidens(a.base, a.args, b.args);
+	const fromDigits = INTEGER_DIGITS[a.base];
+	if (fromDigits !== void 0) {
+		const toDigits = INTEGER_DIGITS[b.base];
+		if (toDigits !== void 0) return toDigits >= fromDigits;
+		if (b.base === "numeric") return b.args === void 0 || b.args[0] - (b.args[1] ?? 0) >= fromDigits;
+		return false;
+	}
+	if (a.base === "varchar" && b.base === "text") return true;
+	if (a.base === "text" && b.base === "varchar") return b.args === void 0;
+	return false;
+}
+/**
+* Decide how `db push` should proceed given the plan's destructiveness and
+* the invocation context.
+*
+*  - No destructive statements → `apply` (safe to auto-approve).
+*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+*  - Destructive + interactive TTY → `confirm` (prompt before applying).
+*  - Destructive + non-interactive → `refuse` (never silently drop data in
+*    CI / scripts / agents).
+*/
+function decidePushSafety(opts) {
+	if (opts.destructiveCount === 0) return "apply";
+	if (opts.allowDestructive) return "apply";
+	return opts.interactive ? "confirm" : "refuse";
+}
+//#endregion
+//#region src/module-dir.ts
 var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
 //#endregion
 //#region src/cli-helpers.ts
@@ -6419,7 +6714,7 @@ function resolveLocalBin(binName) {
 	return null;
 }
 async function getTableIncludesFromCollections(allCollections) {
-	const { getTableName, resolveCollectionRelations, relationalCollections } = await import("@rebasepro/common");
+	const { getTableName, relationalCollections, resolveJunctionSpecs } = await import("@rebasepro/common");
 	const { isPostgresCollectionConfig } = await import("@rebasepro/types");
 	const collections = relationalCollections(allCollections);
 	const includes = [];
@@ -6427,14 +6722,8 @@ async function getTableIncludesFromCollections(allCollections) {
 		const tableName = getTableName(col);
 		const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
 		if (tableName) includes.push(`${schema}.${tableName}`);
-		const resolvedRelations = resolveCollectionRelations(col);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			const targetCollection = relation.target();
-			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-			includes.push(`${targetSchema}.${junctionTableName}`);
-		}
 	}
+	for (const junction of resolveJunctionSpecs(collections).values()) includes.push(`${junction.schema}.${junction.table}`);
 	return Array.from(new Set(includes));
 }
 async function getTableIncludes(collectionsPath) {
@@ -6610,7 +6899,7 @@ async function applySearchDdl(databaseUrl, drizzleDir = path.resolve(process.cwd
 * `search` block, which is every project that has not opted in.
 */
 async function getSearchExcludes(collectionsPath) {
-	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-CR2xcS7e.js").then((n) => n.o);
+	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
 	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -6654,6 +6943,20 @@ async function queryGeneratedColumnDependencies(databaseUrl) {
 	}
 }
 /**
+* Every column in the database with its current type, for the destructive
+* gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.
+*/
+async function queryColumnTypes(databaseUrl) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	await client.connect();
+	try {
+		return (await client.query(COLUMN_TYPES_SQL)).rows;
+	} finally {
+		await client.end();
+	}
+}
+/**
 * Drop the generated columns standing in the way of an apply.
 *
 * Their indexes and their `COMMENT ON COLUMN` stamp go with them, which is
@@ -6723,7 +7026,7 @@ async function applyVectorDdl(databaseUrl, drizzleDir = path.resolve(process.cwd
 * `vector` property, which is every project that has not opted in.
 */
 async function getVectorExcludes(collectionsPath) {
-	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-CR2xcS7e.js").then((n) => n.o);
+	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
 	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -6767,7 +7070,7 @@ async function applyTriggersDdl(databaseUrl, drizzleDir = path.resolve(process.c
 }
 /** @see getSearchExcludes */
 async function getTriggerExcludes(collectionsPath) {
-	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-CR2xcS7e.js").then((n) => n.o);
+	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
 	return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -6853,8 +7156,8 @@ async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {})
 */
 async function managedIndexNames(collectionsPath) {
 	const collections = await loadCollectionsForCli(collectionsPath);
-	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-CR2xcS7e.js").then((n) => n.o);
-	const { resolveColumnName } = await import("./column-plan-helpers-CpILzHJS.js").then((n) => n.n);
+	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
+	const { resolveColumnName } = await import("./column-plan-helpers-DF-8dTVa.js").then((n) => n.n);
 	const { buildCollectionIndexPlan } = await import("./collection-index-DdnsxiJ_.js").then((n) => n.i);
 	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
 	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
@@ -7191,6 +7494,6 @@ async function dropLegacyAuthSchema(run, report) {
 	}
 }
 //#endregion
-export { execa as A, loadCollectionsForCli as C, readTriggersDdl as D, readSearchDdl as E, readVectorDdl as O, getVectorExcludes as S, queryGeneratedColumnDependencies as T, getDevDatabaseUrl as _, ExcludeIntrospectionError as a, getTableExcludes as b, applyVectorDdl as c, describeReinstallCommand as d, detectProjectPackageManager as f, ensureDevDatabaseExists as g, dropGeneratedColumns as h, rls_bootstrap_sql_exports as i, forLibpq as j, resolveLocalBin as k, describeBuildScriptRemedy as l, dropDevDatabase as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, diagnoseMissingBin as p, dropLegacyAuthSchema as r, applyTriggersDdl as s, RLS_BOOTSTRAP_SQL as t, describeDevAddCommand as u, getForeignIndexExcludes as v, promptConfirm as w, getTriggerExcludes as x, getSearchExcludes as y };
+export { resolveLocalBin as A, loadCollectionsForCli as C, readSearchDdl as D, queryGeneratedColumnDependencies as E, forLibpq as F, detectDestructiveStatements as M, splitSqlStatements as N, readTriggersDdl as O, execa as P, getVectorExcludes as S, queryColumnTypes as T, getDevDatabaseUrl as _, ExcludeIntrospectionError as a, getTableExcludes as b, applyVectorDdl as c, describeReinstallCommand as d, detectProjectPackageManager as f, ensureDevDatabaseExists as g, dropGeneratedColumns as h, rls_bootstrap_sql_exports as i, decidePushSafety as j, readVectorDdl as k, describeBuildScriptRemedy as l, dropDevDatabase as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, diagnoseMissingBin as p, dropLegacyAuthSchema as r, applyTriggersDdl as s, RLS_BOOTSTRAP_SQL as t, describeDevAddCommand as u, getForeignIndexExcludes as v, promptConfirm as w, getTriggerExcludes as x, getSearchExcludes as y };
 
-//# sourceMappingURL=rls-bootstrap-sql-BHA6jLtj.js.map
+//# sourceMappingURL=rls-bootstrap-sql-B8EclDyM.js.map