@rebasepro/server-postgres 0.21.2-canary.g1ea48be → 0.23.0

package/dist/cli-flags-BglvpjHv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-flags-BglvpjHv.js","names":[],"sources":["../src/cli-flags.ts"],"sourcesContent":["/**\n * The flags each driver command takes, in one place, and the check that\n * enforces them.\n *\n * Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not\n * mean \"be lenient\" — it means **an undeclared flag becomes a positional**. So\n * `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the\n * push ran with the destructive gate still closed, and the developer read the\n * refusal as Rebase ignoring the flag they had just typed. `rebase schema\n * generate --ouput src/schema.ts` was worse — it wrote the default path and\n * said nothing, so the next build compiled a file nobody had regenerated.\n *\n * The check has to live at the entry point rather than in those parsers, and\n * that is not a detail: `db push` and `db generate` re-enter `schemaCommand`\n * and `generatePostgresDdlCommand` with the *db* line, so a strict parser\n * inside either of them would reject `--allow-destructive` on a line where it\n * is correct. One validation, once, against the spec for the command the user\n * actually named; the inner parsers keep reading an already-validated line.\n *\n * Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),\n * `db backup`, `db restore`, `db backups` — are deliberately absent: they own\n * their spec, and a second list here would be one more thing to keep in step.\n * An absent entry is \"not checked here\", never \"takes nothing\".\n */\nimport arg from \"arg\";\n\n/**\n * Flags that reach this process on a line it did not compose.\n *\n * `rebase db …` hands the driver the user's whole line: the CLI *reads*\n * `--database-url` and `--docker` to resolve the database and then relays them\n * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as\n * the thing to re-run with. Rejecting any of the three would make the driver\n * refuse commands the CLI documents.\n */\nexport const RELAYED_FLAGS = {\n    \"--database-url\": String,\n    \"--docker\": Boolean,\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} satisfies arg.Spec;\n\n/**\n * Parse a driver command's line — `[\"db\", \"<subcommand>\", …]` — with the\n * relayed flags declared alongside the command's own.\n *\n * Every driver parser is permissive, and an undeclared flag in a permissive\n * parse is a positional. The positionals are what `db migrate` hands\n * `atlas migrate apply`, what `db generate` names its migration after and\n * which backup `db restore` restores, so a relayed flag left undeclared was\n * read as one of those: `rebase db migrate --docker` died on Atlas's\n * `unknown flag: --docker` after it had already written the auth schema.\n */\nexport function parseDriverLine<S extends arg.Spec>(\n    spec: S,\n    args: string[]\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    return arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2), permissive: true });\n}\n\n/** Keyed by `\"<domain> <subcommand>\"`, the way the user types it. */\nexport const DRIVER_FLAG_SPECS: Record<string, arg.Spec> = {\n    \"db push\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--dry-run\": Boolean,\n        \"--allow-destructive\": Boolean,\n        \"--yes\": Boolean,\n        \"-y\": \"--yes\"\n    },\n    \"db generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\"\n    },\n    // Bare positionals still pass through to `atlas migrate apply`, which takes\n    // an optional amount; flags do not, apart from `--baseline`.\n    //\n    // `--baseline <version>` is the escape hatch for the normal case, not an\n    // exotic one: every Rebase boot ensures the schema, so a production\n    // database has the tables before its first migration ever runs, and\n    // `migrate apply` then dies on `type \"…\" already exists (42710)`. It maps\n    // onto Atlas's own `migrate apply --baseline`, which writes the revision\n    // row Atlas reads — no ledger of ours.\n    \"db migrate\": {\n        \"--baseline\": String\n    },\n    \"schema generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--watch\": Boolean,\n        \"-w\": \"--watch\"\n    },\n    \"schema introspect\": {\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--force\": Boolean,\n        \"-f\": \"--force\",\n        \"--schema\": String\n    },\n    \"schema stale\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--fix\": Boolean\n    }\n};\n\n/**\n * One destination flag, two spellings, everywhere.\n *\n * `--out` is the primary on `rebase build`, an alias on `generate-sdk`, `db\n * backup` and `cloud env pull`, and was refused outright by the three `schema`\n * commands — so the spelling a user learned on one command was an\n * \"unknown or unexpected option\" on the next. Neither name can be retired (both\n * are shipped), so both are accepted, and {@link assertOutputAliasesPaired}\n * makes that the rule rather than a habit.\n */\nexport const OUTPUT_FLAG_ALIASES = [\"--out\", \"--output\"] as const;\n\n/**\n * Every spec that names one of the pair names both.\n *\n * Exported so the CLI's own specs can be held to it too: the drift this fixes\n * ran across two packages, and a check that only reads this file would let the\n * next `--out`-only command through.\n */\nexport function assertOutputAliasesPaired(specs: Record<string, arg.Spec>): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const present = OUTPUT_FLAG_ALIASES.filter(flag => flag in spec);\n        if (present.length === 0 || present.length === OUTPUT_FLAG_ALIASES.length) continue;\n        const missing = OUTPUT_FLAG_ALIASES.filter(flag => !(flag in spec));\n        problems.push(`\\`${command}\\` takes ${present.join(\", \")} but not ${missing.join(\", \")}`);\n    }\n    return problems;\n}\n\n/**\n * The `--collections` path the user typed, or `null` if they typed none.\n *\n * Read once, at the entry point, because every command that takes it re-enters\n * the generators with the same line and each of them resolved it again — which\n * is how \"Collections path not found\" came to be printed four times before the\n * real output, and how a path that does not exist got as far as *writing* an\n * empty schema.\n *\n * Permissive, and it has to be: {@link assertKnownFlags} has already judged the\n * line, and `db push` carries flags the `--collections` spec does not name.\n */\nexport function collectionsPathIn(args: string[]): string | null {\n    try {\n        const parsed = arg(\n            { \"--collections\": String, \"-c\": \"--collections\" },\n            { argv: args.slice(2), permissive: true }\n        );\n\n        return parsed[\"--collections\"] ?? null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The long flags a `--help` usage line documents.\n *\n * `\"rebase db push [--collections <dir>] [--dry-run] …\"` → `[\"--collections\",\n * \"--dry-run\"]`. Placeholders (`<dir>`) and the alternation inside a positional\n * (`<create|list|switch>`) are not flags and are not returned.\n */\nexport function flagsInUsage(usage: string): string[] {\n    return [...new Set(usage.match(/--[a-z][a-z0-9-]*/g) ?? [])];\n}\n\n/**\n * Every flag the help documents is accepted, and every flag accepted is documented.\n *\n * The drift this catches shipped: `rebase db push --help` has printed\n * `[--dry-run]` since the flag was written, `DRIVER_FLAG_SPECS[\"db push\"]` never\n * listed it, and {@link assertKnownFlags} — added later to stop typos being\n * swallowed — turned the documented flag into `unknown or unexpected option`.\n * The only way to see a push's SQL was to trip the destructive gate, which is\n * the exact problem `--dry-run` was written to solve. Worse in a project on an\n * older driver, whose permissive parser *applied* the schema on that line.\n *\n * Two hand-maintained lists in two packages cannot be kept in step by care, so\n * they are held to each other instead: `usages` is keyed the way\n * {@link DRIVER_FLAG_SPECS} is (`\"db push\"`), and comes from the CLI's own help\n * pages. A key in only one of the two is not this function's business — the\n * help covers commands that parse their own lines (`db branch`, `db backup`),\n * and an absent spec entry means \"not checked here\".\n *\n * Aliases (`\"-c\": \"--collections\"`, `\"--out\": \"--output\"`) need no line of their\n * own: they are spellings of a documented flag. Neither do {@link RELAYED_FLAGS},\n * which every driver command accepts because the CLI relays them.\n */\nexport function assertSpecMatchesUsage(\n    specs: Record<string, arg.Spec>,\n    usages: Record<string, string>\n): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const usage = usages[command];\n        if (usage === undefined) continue;\n\n        const documented = flagsInUsage(usage);\n        const accepted = Object.entries(spec);\n        // An alias resolves to the flag it spells; only the target needs a line.\n        const canonical = new Set(\n            accepted\n                .map(([flag, kind]) => (typeof kind === \"string\" ? kind : flag))\n                .filter(flag => flag.startsWith(\"--\"))\n        );\n\n        for (const flag of documented) {\n            if (flag in spec || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` documents ${flag} in its usage line but the spec rejects it`);\n        }\n        for (const flag of canonical) {\n            if (documented.includes(flag) || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` accepts ${flag} but no usage line documents it`);\n        }\n    }\n    return problems;\n}\n\n/**\n * Reject a flag the named command does not take.\n *\n * `args` is the driver's whole line — `[\"db\", \"push\", …]` — so the flags are\n * read from `args.slice(2)`, past the two command words.\n *\n * Throws rather than exiting: `runPluginCommand`'s caller already turns a\n * thrown error into one red line and exit 1, and a thrown error is what the\n * tests can see.\n */\nexport function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void {\n    if (!subcommand) return;\n    const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];\n    if (!spec) return;\n\n    try {\n        arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2) });\n    } catch (err) {\n        if (err instanceof Error && (err as arg.ArgError).code === \"ARG_UNKNOWN_OPTION\") {\n            throw new Error(\n                `${err.message} — run \\`rebase ${domain} --help\\` for the options ` +\n                `\\`${domain} ${subcommand}\\` takes.`\n            );\n        }\n        throw err;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmCA,IAAa,gBAAgB;CACzB,kBAAkB;CAClB,YAAY;CACZ,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;;;;;;;AAaA,SAAgB,gBACZ,MACA,MACoC;CACpC,QAAA,GAAA,WAAA,QAAA,CAAW;EAAE,GAAG;EAAe,GAAG;CAAK,GAAG;EAAE,MAAM,KAAK,MAAM,CAAC;EAAG,YAAY;CAAK,CAAC;AACvF;;AAGA,IAAa,oBAA8C;CACvD,WAAW;EACP,iBAAiB;EACjB,MAAM;EACN,aAAa;EACb,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV;CACA,eAAe;EACX,iBAAiB;EACjB,MAAM;CACV;CAUA,cAAc,EACV,cAAc,OAClB;CACA,mBAAmB;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,WAAW;EACX,MAAM;CACV;CACA,qBAAqB;EACjB,YAAY;EACZ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,MAAM;EACN,WAAW;EACX,MAAM;EACN,YAAY;CAChB;CACA,gBAAgB;EACZ,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,SAAS;CACb;AACJ;;;;;;;;;;;;;AA4CA,SAAgB,kBAAkB,MAA+B;CAC7D,IAAI;EAMA,QAAA,GAAA,WAAA,QAAA,CAJI;GAAE,iBAAiB;GAAQ,MAAM;EAAgB,GACjD;GAAE,MAAM,KAAK,MAAM,CAAC;GAAG,YAAY;EAAK,CAGrC,CAAA,CAAO,oBAAoB;CACtC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AA2EA,SAAgB,iBAAiB,QAAgB,YAAgC,MAAsB;CACnG,IAAI,CAAC,YAAY;CACjB,MAAM,OAAO,kBAAkB,GAAG,OAAO,GAAG;CAC5C,IAAI,CAAC,MAAM;CAEX,IAAI;EACA,CAAA,GAAA,WAAA,QAAA,CAAI;GAAE,GAAG;GAAe,GAAG;EAAK,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CAC9D,SAAS,KAAK;EACV,IAAI,eAAe,SAAU,IAAqB,SAAS,sBACvD,MAAM,IAAI,MACN,GAAG,IAAI,QAAQ,kBAAkB,OAAO,8BACnC,OAAO,GAAG,WAAW,UAC9B;EAEJ,MAAM;CACV;AACJ"}

package/dist/cli-flags.d.ts

@@ -23,6 +23,34 @@
  * An absent entry is "not checked here", never "takes nothing".
  */
 import arg from "arg";
+/**
+ * Flags that reach this process on a line it did not compose.
+ *
+ * `rebase db …` hands the driver the user's whole line: the CLI *reads*
+ * `--database-url` and `--docker` to resolve the database and then relays them
+ * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
+ * the thing to re-run with. Rejecting any of the three would make the driver
+ * refuse commands the CLI documents.
+ */
+export declare const RELAYED_FLAGS: {
+    "--database-url": StringConstructor;
+    "--docker": BooleanConstructor;
+    "--debug": BooleanConstructor;
+    "--help": BooleanConstructor;
+    "-h": string;
+};
+/**
+ * Parse a driver command's line — `["db", "<subcommand>", …]` — with the
+ * relayed flags declared alongside the command's own.
+ *
+ * Every driver parser is permissive, and an undeclared flag in a permissive
+ * parse is a positional. The positionals are what `db migrate` hands
+ * `atlas migrate apply`, what `db generate` names its migration after and
+ * which backup `db restore` restores, so a relayed flag left undeclared was
+ * read as one of those: `rebase db migrate --docker` died on Atlas's
+ * `unknown flag: --docker` after it had already written the auth schema.
+ */
+export declare function parseDriverLine<S extends arg.Spec>(spec: S, args: string[]): arg.Result<typeof RELAYED_FLAGS & S>;
 /** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
 export declare const DRIVER_FLAG_SPECS: Record<string, arg.Spec>;
 /**

package/dist/cli-helpers.d.ts

@@ -1,4 +1,5 @@
 import type { GeneratedColumnDependency } from "./schema/generated-column-conflicts.js";
+import { type ExistingColumnType } from "./schema/destructive-sql.js";
 import type { CollectionConfig } from "@rebasepro/types";
 /**
  * Why is a dependency's binary missing — never installed, or installed with its
@@ -164,6 +165,11 @@ export declare function getSearchExcludes(collectionsPath: string): Promise<stri
  * see `generated-column-conflicts.ts` for why that is necessary at all.
  */
 export declare function queryGeneratedColumnDependencies(databaseUrl: string): Promise<GeneratedColumnDependency[]>;
+/**
+ * Every column in the database with its current type, for the destructive
+ * gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.
+ */
+export declare function queryColumnTypes(databaseUrl: string): Promise<ExistingColumnType[]>;
 /**
  * Drop the generated columns standing in the way of an apply.
  *

package/dist/cli-scratch-database.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The scratch database Atlas plans against, for the length of one db command.
+ *
+ * `atlas schema apply` and `atlas migrate diff` need a `--dev-url`: an empty
+ * database they build the desired state in, made as `<db>_dev_diff` beside the
+ * real one. It is a full copy of the schema, so it is removed again once the
+ * command that made it has succeeded — every such command, not only an applied
+ * `db push`: a `--dry-run` that left one behind while saying nothing was
+ * applied, and `db generate`, left one per target on the server.
+ *
+ * Two cases keep it. A command that fails leaves it as the state Atlas was
+ * planning against, which is the one thing worth inspecting. And one this
+ * process did not create — made by hand, the remedy for a role without
+ * `CREATEDB` — is the user's, and dropping it would put them back at the same
+ * refusal next time.
+ */
+export interface ScratchDatabaseOps {
+    /** Create it if it is missing; `true` only when this call created it. */
+    create(databaseUrl: string, devDatabaseUrl: string): Promise<boolean>;
+    drop(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
+}
+export declare class ScratchDatabase {
+    private readonly ops;
+    private created;
+    constructor(ops: ScratchDatabaseOps);
+    /** Make sure it exists before an Atlas call that plans against it. */
+    ensure(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
+    /**
+     * Run a command, then drop the scratch database if the command created it.
+     * A command that throws skips the drop; one that exits the process never
+     * returns here, which is the same thing.
+     */
+    around<T>(command: () => Promise<T>): Promise<T>;
+}

package/dist/cli.js

@@ -1,105 +1,19 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-Dka89exj.js";
+import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-B8qHg02P.js";
 import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { A as execa, C as loadCollectionsForCli, D as readTriggersDdl, E as readSearchDdl, O as readVectorDdl, S as getVectorExcludes, T as queryGeneratedColumnDependencies, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as forLibpq, k as resolveLocalBin, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-BHA6jLtj.js";
+import { A as resolveLocalBin, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as forLibpq, M as detectDestructiveStatements, N as splitSqlStatements, O as readTriggersDdl, P as execa, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as decidePushSafety, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-B8EclDyM.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-BglvpjHv.js";
 import { logger } from "@rebasepro/server";
 import { formatRelativeTime } from "@rebasepro/utils";
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-//#region src/schema/destructive-sql.ts
-var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
-/**
-* Pure helpers that classify an Atlas declarative-apply plan as destructive
-* or not, and decide what `rebase db push` should do about it.
-*
-* `db push` runs `atlas schema apply` to make the live database match the
-* generated `schema.sql`. Removing a collection field compiles to
-* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
-* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
-* here, and refuse to auto-approve anything destructive without an explicit
-* opt-in.
-*
-* Everything in this file is side-effect free so it can be unit-tested
-* without Atlas or a database.
-*/
-/**
-* SQL fragments that destroy data or data-bearing objects. Matched
-* case-insensitively against each statement of the plan. `IF EXISTS` /
-* whitespace variations are tolerated by the regexes below.
-*/
-var DESTRUCTIVE_PATTERNS = [
-	{
-		label: "DROP TABLE",
-		re: /\bDROP\s+TABLE\b/i
-	},
-	{
-		label: "DROP COLUMN",
-		re: /\bDROP\s+COLUMN\b/i
-	},
-	{
-		label: "DROP SCHEMA",
-		re: /\bDROP\s+SCHEMA\b/i
-	},
-	{
-		label: "DROP VIEW",
-		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
-	},
-	{
-		label: "DROP TYPE",
-		re: /\bDROP\s+TYPE\b/i
-	},
-	{
-		label: "TRUNCATE",
-		re: /\bTRUNCATE\b/i
-	}
-];
-/**
-* Split a SQL script into individual statements, dropping blank lines and
-* `--` comment lines. Deliberately simple: Atlas emits one plain statement
-* per `;`, without string literals that contain semicolons in a schema DDL
-* plan, so a naive split is safe and keeps this dependency-free.
-*/
-function splitSqlStatements(sql) {
-	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-/**
-* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
-* the statements that would destroy data. An empty array means the plan is
-* safe to auto-approve.
-*/
-function detectDestructiveStatements(planSql) {
-	const found = [];
-	for (const statement of splitSqlStatements(planSql)) for (const { label, re } of DESTRUCTIVE_PATTERNS) if (re.test(statement)) {
-		found.push({
-			statement,
-			kind: label
-		});
-		break;
-	}
-	return found;
-}
-/**
-* Decide how `db push` should proceed given the plan's destructiveness and
-* the invocation context.
-*
-*  - No destructive statements → `apply` (safe to auto-approve).
-*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
-*  - Destructive + interactive TTY → `confirm` (prompt before applying).
-*  - Destructive + non-interactive → `refuse` (never silently drop data in
-*    CI / scripts / agents).
-*/
-function decidePushSafety(opts) {
-	if (opts.destructiveCount === 0) return "apply";
-	if (opts.allowDestructive) return "apply";
-	return opts.interactive ? "confirm" : "refuse";
-}
-//#endregion
 //#region src/schema/generated-column-conflicts.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
 * Which columns an Atlas plan cannot touch, because a generated column reads
 * them.
@@ -650,6 +564,15 @@ function tidy(sql) {
 function acceptsExcludeFlag(domain, args) {
 	return domain === "schema" && args.includes("apply");
 }
+/**
+* Does this Atlas invocation plan against the scratch database (`--dev-url`)?
+*
+* `schema apply` and `migrate diff` do; `migrate apply`, `hash` and `status`
+* never read it, so `db migrate` has no reason to create one.
+*/
+function takesDevUrl(domain, args) {
+	return domain === "schema" && args.includes("apply") || domain === "migrate" && args.includes("diff");
+}
 /** Assemble the full argv, connection flags and all. */
 function buildAtlasArgs(invocation) {
 	const { domain, args, url, devUrl, excludes = [] } = invocation;
@@ -667,6 +590,52 @@ function buildAtlasArgs(invocation) {
 	if (acceptsExcludeFlag(domain, args)) for (const exclude of excludes) argv.push("--exclude", exclude);
 	return argv;
 }
+/**
+* `atlas migrate apply`'s own arguments for `rebase db migrate`.
+*
+* `positionals` are what is left of the user's line once every flag the
+* driver knows has been consumed — at most the optional amount Atlas takes. A
+* flag reaching here is a flag Atlas rejects before doing any work.
+*/
+function migrateApplyArgs(positionals, baseline) {
+	return [
+		"apply",
+		"--dir",
+		"file://drizzle/migrations",
+		...baseline ? ["--baseline", baseline] : [],
+		...positionals.filter((positional) => positional !== "migrate")
+	];
+}
+//#endregion
+//#region src/cli-scratch-database.ts
+var ScratchDatabase = class {
+	ops;
+	created;
+	constructor(ops) {
+		this.ops = ops;
+	}
+	/** Make sure it exists before an Atlas call that plans against it. */
+	async ensure(databaseUrl, devDatabaseUrl) {
+		if (await this.ops.create(databaseUrl, devDatabaseUrl)) this.created = {
+			databaseUrl,
+			devDatabaseUrl
+		};
+	}
+	/**
+	* Run a command, then drop the scratch database if the command created it.
+	* A command that throws skips the drop; one that exits the process never
+	* returns here, which is the same thing.
+	*/
+	async around(command) {
+		const result = await command();
+		const created = this.created;
+		if (created) {
+			this.created = void 0;
+			await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+		}
+		return result;
+	}
+};
 //#endregion
 //#region src/branch-argv.ts
 /**
@@ -728,140 +697,6 @@ var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 	"--database-url"
 ]);
 //#endregion
-//#region src/cli-flags.ts
-/**
-* The flags each driver command takes, in one place, and the check that
-* enforces them.
-*
-* Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not
-* mean "be lenient" — it means **an undeclared flag becomes a positional**. So
-* `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the
-* push ran with the destructive gate still closed, and the developer read the
-* refusal as Rebase ignoring the flag they had just typed. `rebase schema
-* generate --ouput src/schema.ts` was worse — it wrote the default path and
-* said nothing, so the next build compiled a file nobody had regenerated.
-*
-* The check has to live at the entry point rather than in those parsers, and
-* that is not a detail: `db push` and `db generate` re-enter `schemaCommand`
-* and `generatePostgresDdlCommand` with the *db* line, so a strict parser
-* inside either of them would reject `--allow-destructive` on a line where it
-* is correct. One validation, once, against the spec for the command the user
-* actually named; the inner parsers keep reading an already-validated line.
-*
-* Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),
-* `db backup`, `db restore`, `db backups` — are deliberately absent: they own
-* their spec, and a second list here would be one more thing to keep in step.
-* An absent entry is "not checked here", never "takes nothing".
-*/
-/**
-* Flags that reach this process on a line it did not compose.
-*
-* `rebase db …` hands the driver the user's whole line: the CLI *reads*
-* `--database-url` and `--docker` to resolve the database and then relays them
-* verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
-* the thing to re-run with. Rejecting any of the three would make the driver
-* refuse commands the CLI documents.
-*/
-var RELAYED_FLAGS = {
-	"--database-url": String,
-	"--docker": Boolean,
-	"--debug": Boolean,
-	"--help": Boolean,
-	"-h": "--help"
-};
-/** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
-var DRIVER_FLAG_SPECS = {
-	"db push": {
-		"--collections": String,
-		"-c": "--collections",
-		"--dry-run": Boolean,
-		"--allow-destructive": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	},
-	"db generate": {
-		"--collections": String,
-		"-c": "--collections"
-	},
-	"db migrate": { "--baseline": String },
-	"schema generate": {
-		"--collections": String,
-		"-c": "--collections",
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--watch": Boolean,
-		"-w": "--watch"
-	},
-	"schema introspect": {
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--collections": String,
-		"-c": "--collections",
-		"--force": Boolean,
-		"-f": "--force",
-		"--schema": String
-	},
-	"schema stale": {
-		"--collections": String,
-		"-c": "--collections",
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--fix": Boolean
-	}
-};
-/**
-* The `--collections` path the user typed, or `null` if they typed none.
-*
-* Read once, at the entry point, because every command that takes it re-enters
-* the generators with the same line and each of them resolved it again — which
-* is how "Collections path not found" came to be printed four times before the
-* real output, and how a path that does not exist got as far as *writing* an
-* empty schema.
-*
-* Permissive, and it has to be: {@link assertKnownFlags} has already judged the
-* line, and `db push` carries flags the `--collections` spec does not name.
-*/
-function collectionsPathIn(args) {
-	try {
-		return (0, import_arg.default)({
-			"--collections": String,
-			"-c": "--collections"
-		}, {
-			argv: args.slice(2),
-			permissive: true
-		})["--collections"] ?? null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Reject a flag the named command does not take.
-*
-* `args` is the driver's whole line — `["db", "push", …]` — so the flags are
-* read from `args.slice(2)`, past the two command words.
-*
-* Throws rather than exiting: `runPluginCommand`'s caller already turns a
-* thrown error into one red line and exit 1, and a thrown error is what the
-* tests can see.
-*/
-function assertKnownFlags(domain, subcommand, args) {
-	if (!subcommand) return;
-	const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];
-	if (!spec) return;
-	try {
-		(0, import_arg.default)({
-			...RELAYED_FLAGS,
-			...spec
-		}, { argv: args.slice(2) });
-	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
-		throw err;
-	}
-}
-//#endregion
 //#region src/cli-collections-path.ts
 /**
 * `--collections <dir>`, checked once, before anything is written.
@@ -1069,7 +904,7 @@ async function runPluginCommand(args) {
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
-	if (domain === "db") await dbCommand(subcommand, args);
+	if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
 	else if (domain === "schema") await schemaCommand(subcommand, args);
 	else if (domain === "doctor") await doctorPluginCommand(args);
 	else {
@@ -1146,6 +981,20 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 	], collectionsPath);
 	return !result.empty;
 }
+/**
+* The flags `rebase db` reads for the subcommands it parses itself. Hoisted
+* and named `…FLAGS` so the documentation verifier, which reads specs out of
+* this source, sees them.
+*/
+var DB_FLAGS = {
+	"--collections": String,
+	"--allow-destructive": Boolean,
+	"--dry-run": Boolean,
+	"--yes": Boolean,
+	"--baseline": String,
+	"-c": "--collections",
+	"-y": "--yes"
+};
 async function dbCommand(subcommand, rawArgs) {
 	const VALID_ACTIONS = [
 		"push",
@@ -1172,25 +1021,14 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-CkjsJEcu.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-24v4OlSp.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
 		else await backupsCommand(rawArgs);
 		return;
 	}
-	const argsList = (0, import_arg.default)({
-		"--collections": String,
-		"--allow-destructive": Boolean,
-		"--dry-run": Boolean,
-		"--yes": Boolean,
-		"--baseline": String,
-		"-c": "--collections",
-		"-y": "--yes"
-	}, {
-		argv: rawArgs.slice(2),
-		permissive: true
-	});
+	const argsList = parseDriverLine(DB_FLAGS, rawArgs);
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
 	if (subcommand === "generate") {
 		out("");
@@ -1229,7 +1067,7 @@ async function dbCommand(subcommand, rawArgs) {
 					}
 					const searchContent = readSearchDdl();
 					if (searchContent) {
-						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-CR2xcS7e.js").then((n) => n.o);
+						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
 						const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 						const preamble = migrationDropPreamble(migrationConflicts);
 						if (preamble) {
@@ -1288,7 +1126,7 @@ async function dbCommand(subcommand, rawArgs) {
 				"file://drizzle/schema.sql",
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
-			const destructive = detectDestructiveStatements(plan);
+			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
@@ -1308,7 +1146,7 @@ async function dbCommand(subcommand, rawArgs) {
 				if (unowned.length > 0) outWarn(formatForeignGeneratedColumnBanner(unowned));
 				if (destructive.length > 0) {
 					outWarn(chalk.yellow(`  ⚠️  ${destructive.length} of those DESTROY data:`));
-					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
 					outWarn("");
@@ -1330,7 +1168,7 @@ async function dbCommand(subcommand, rawArgs) {
 			if (destructive.length > 0) {
 				outWarn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
 				outWarn("");
-				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
 				outWarn("");
 				outWarn(chalk.yellow("  Full planned changes:"));
 				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
@@ -1375,24 +1213,16 @@ async function dbCommand(subcommand, rawArgs) {
 				await reconcilePolicies(databaseUrl, collectionsPath);
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
-				if (scratchDatabaseCreatedHere) await dropDevDatabase(databaseUrl, getDevDatabaseUrl(databaseUrl));
 			} else outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
 		} else if (subcommand === "migrate") {
 			const databaseUrl = process.env.DATABASE_URL;
 			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
-			const extraArgs = argsList._.filter((arg) => arg !== "migrate");
 			const baseline = argsList["--baseline"];
 			if (baseline) {
 				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
 				out("");
 			}
-			await runAtlas("migrate", [
-				"apply",
-				"--dir",
-				"file://drizzle/migrations",
-				...baseline ? ["--baseline", baseline] : [],
-				...extraArgs
-			], collectionsPath);
+			await runAtlas("migrate", migrateApplyArgs(argsList._, baseline), collectionsPath);
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
@@ -1431,8 +1261,8 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-BnEvEJPr.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-Gzzd8wTq.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-Dhn9KM3B.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
 		const { Client } = await import("pg");
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
@@ -1544,8 +1374,8 @@ async function applyPolicies(databaseUrl) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-B0GDRh7_.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-Gzzd8wTq.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-DljYdrpW.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const { Client } = await import("pg");
 		const client = new Client({ connectionString: databaseUrl });
@@ -1627,7 +1457,7 @@ async function branchCommand(rawArgs) {
 		process.exit(1);
 	}
 	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-CucnFcSE.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-DGPL6G_C.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const pool = new Pool({
@@ -1857,8 +1687,14 @@ function formatBytes(bytes) {
 function timeAgo(date) {
 	return formatRelativeTime(date, { maxMs: Number.POSITIVE_INFINITY }) ?? "unknown";
 }
-/** Set when this process created the Atlas scratch database; see `ensureDevDatabaseExists`. */
-var scratchDatabaseCreatedHere = false;
+/**
+* The Atlas scratch database this process created, dropped once the db
+* command that needed it succeeds — see `ScratchDatabase`.
+*/
+var scratchDatabase = new ScratchDatabase({
+	create: ensureDevDatabaseExists,
+	drop: dropDevDatabase
+});
 async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	const atlasBin = resolveLocalBin("atlas");
 	if (!atlasBin) {
@@ -1911,7 +1747,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	}
 	await checkDatabaseConnectivity(databaseUrl);
 	const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
-	if (await ensureDevDatabaseExists(databaseUrl, devDatabaseUrl)) scratchDatabaseCreatedHere = true;
+	if (takesDevUrl(domain, args)) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
 	const atlasUrl = forLibpq(databaseUrl);
 	const atlasDevUrl = forLibpq(devDatabaseUrl);
 	const excludes = [];
@@ -2053,9 +1889,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-Gzzd8wTq.js").then((n) => n.t);
+	const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
 	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-DFa9qy9u.js").then((n) => n.n);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-BfzK7UQd.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];