@rebasepro/server-postgres 0.22.0 → 0.24.0

package/dist/{rls-bootstrap-sql-H3rCFi3F.js → rls-bootstrap-sql-_KNnjanK.js}

@@ -4,7 +4,7 @@ import { a as __toESM, i as __require, n as __commonJSMin, r as __exportAll, t a
 import { o as isRebaseIndexName } from "./collection-index-DdnsxiJ_.js";
 import { r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
-import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA, isManyToMany } from "@rebasepro/types";
+import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
 import { sqlRows } from "@rebasepro/common";
 import fs from "fs";
 import path from "path";
@@ -6252,10 +6252,529 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
-//#region src/module-dir.ts
+//#region src/schema/destructive-sql.ts
 var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
+/**
+* Pure helpers that classify an Atlas declarative-apply plan as destructive
+* or not, and decide what `rebase db push` should do about it.
+*
+* `db push` runs `atlas schema apply` to make the live database match the
+* generated `schema.sql`. Removing a collection field compiles to
+* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+* here, and refuse to auto-approve anything destructive without an explicit
+* opt-in.
+*
+* A type change is a destructive plan that names no DROP. `ALTER COLUMN
+* "price" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away
+* every timestamp's time of day, in a statement that reads like a routine
+* alter. So a type change is gated too, unless it is a widening every value
+* survives unchanged — which needs the column's current type, read from the
+* catalogue by the caller.
+*
+* A primary key change names no DROP of data either: `DROP CONSTRAINT
+* "<table>_pkey", ADD PRIMARY KEY ("id", "locale")` keeps every value and
+* gives every row a new address. It is gated like a drop.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without Atlas or a database.
+*/
+/**
+* SQL fragments that destroy data or data-bearing objects. Matched
+* case-insensitively against each statement of the plan. `IF EXISTS` /
+* whitespace variations are tolerated by the regexes below.
+*/
+var DESTRUCTIVE_PATTERNS = [
+	{
+		label: "DROP TABLE",
+		re: /\bDROP\s+TABLE\b/i
+	},
+	{
+		label: "DROP COLUMN",
+		re: /\bDROP\s+COLUMN\b/i
+	},
+	{
+		label: "DROP SCHEMA",
+		re: /\bDROP\s+SCHEMA\b/i
+	},
+	{
+		label: "DROP VIEW",
+		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
+	},
+	{
+		label: "DROP TYPE",
+		re: /\bDROP\s+TYPE\b/i
+	},
+	{
+		label: "TRUNCATE",
+		re: /\bTRUNCATE\b/i
+	}
+];
+/**
+* Split a SQL script into individual statements, dropping blank lines and
+* `--` comment lines. Deliberately simple: Atlas emits one plain statement
+* per `;`, without string literals that contain semicolons in a schema DDL
+* plan, so a naive split is safe and keeps this dependency-free.
+*/
+function splitSqlStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** `->`, the marker Atlas prints in front of the first line of every statement. */
+var PLAN_MARKER_RE = /^\s*->\s?/;
+/** `-------`, both the rule between sections and the one above a summary. */
+var PLAN_RULE_RE = /^\s*-{5,}\s*$/;
+/** `Planning migration statements (3 in total):` — and the count it announces. */
+var PLAN_HEADING_RE = /^Planning migration statements \((\d+) in total\):/m;
+/** What Atlas prints, and nothing else, when there is nothing to plan. */
+var PLAN_SYNCED_RE = /^\s*Schema is synced, no changes to be made\s*$/;
+/**
+* Read the statements out of whatever Atlas printed.
+*
+* `atlas schema apply --dry-run` does not print SQL. It prints a report, and
+* the same statements appear in it twice:
+*
+*     Planning migration statements (2 in total):
+*
+*       -- modify "people" table:
+*         -> ALTER TABLE "public"."people" ALTER COLUMN "rating" TYPE numeric(4,1);
+*       -- create "notes" table:
+*         -> CREATE TABLE "public"."notes" (
+*              "body" text NULL DEFAULT 'a;b',
+*              …
+*            );
+*
+*     -------------------------------------------
+*
+*     Analyzing planned statements (2 in total):
+*       …
+*     Running dry-run migration (2 statements in total):
+*       -- modify "people" table
+*         -> ALTER TABLE …;          ← the same statement, again
+*       -- ok (19µs)
+*
+* Splitting that on `;` is how the push gate went blind: the heading has no
+* `;` and does not start with `--`, so it became the first line of the first
+* statement, and an `ALTER TABLE` parse anchored at the start of a statement
+* read nothing — every narrowing type change applied without a prompt. Reading
+* both sections was a second bug, counting every destructive statement twice.
+*
+* So the report is read as a report: a statement is a `->` line and the lines
+* indented under it, up to the next `--` heading, `->`, blank line or rule;
+* only the first section that holds a `->` is read; and `;` plays no part,
+* because a default like `'a;b'` contains one.
+*
+* Plain SQL — a migration file, or an Atlas that printed SQL — has no `->`
+* and is split the old way.
+*/
+function readPlan(plan) {
+	if (PLAN_SYNCED_RE.test(plan)) return { statements: [] };
+	const lines = plan.split(/\r?\n/);
+	if (!lines.some((line) => PLAN_MARKER_RE.test(line))) return { statements: splitSqlStatements(plan) };
+	const heading = PLAN_HEADING_RE.exec(plan);
+	const statements = [];
+	let current = null;
+	const flush = () => {
+		if (current) statements.push(current.join("\n").trim().replace(/;\s*$/, "").trimEnd());
+		current = null;
+	};
+	for (const line of lines) {
+		if (PLAN_MARKER_RE.test(line)) {
+			flush();
+			current = [line.replace(PLAN_MARKER_RE, "")];
+			continue;
+		}
+		if (PLAN_RULE_RE.test(line) || /^\S/.test(line) && !line.startsWith("--")) {
+			flush();
+			if (statements.length > 0) break;
+			continue;
+		}
+		if (!current) continue;
+		if (line.trim() === "" || line.trim().startsWith("--")) {
+			flush();
+			continue;
+		}
+		current.push(line);
+	}
+	flush();
+	return {
+		statements,
+		announced: heading ? Number(heading[1]) : void 0
+	};
+}
+/**
+* The statements of an Atlas plan, each exactly once, without Atlas's
+* rendering and without the trailing `;`. See {@link readPlan} for the shape
+* it reads; `test/fixtures/atlas-dry-run/` holds real captures of it.
+*/
+function extractPlanStatements(plan) {
+	return readPlan(plan).statements;
+}
+/**
+* Every column of every ordinary table outside the system schemas, with its
+* type. What {@link detectDestructiveStatements} compares a planned type
+* change against; `format_type` because it carries the modifier (`(255)`,
+* `(10,2)`) that decides whether a change widens or narrows.
+*/
+var COLUMN_TYPES_SQL = `
+    SELECT n.nspname AS "schema",
+           c.relname AS "table",
+           a.attname AS "column",
+           format_type(a.atttypid, a.atttypmod) AS "type"
+    FROM pg_attribute a
+    JOIN pg_class c     ON c.oid = a.attrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND n.nspname NOT LIKE 'pg\\_%'
+`;
+/**
+* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+* the statements that would destroy data. An empty array means the plan is
+* safe to auto-approve.
+*
+* `columnTypes` is what the database holds now. A type change to a column it
+* does not list is flagged: not knowing what a column is means not knowing
+* whether the change keeps its values.
+*/
+function detectDestructiveStatements(planSql, columnTypes = []) {
+	const found = [];
+	const { statements, announced } = readPlan(planSql);
+	if (announced !== void 0 && announced !== statements.length) found.push({
+		statement: `Planning migration statements (${announced} in total)`,
+		kind: "UNREADABLE PLAN",
+		detail: `Atlas announced ${announced} statement(s) and ${statements.length} could be read — read the plan yourself before allowing it`
+	});
+	for (const statement of statements) {
+		const dropped = DESTRUCTIVE_PATTERNS.find(({ re }) => re.test(statement));
+		const rekeyed = describePrimaryKeyChange(statement);
+		const lossy = parseColumnTypeChanges(statement).map((change) => ({
+			change,
+			from: currentTypeOf(change, columnTypes)
+		})).filter(({ change, from }) => from === void 0 || !isLosslessTypeChange(from, change.to)).map(({ change, from }) => `"${change.column}" ${from ?? "(current type unknown)"} → ${change.to}`).join("; ");
+		const kind = dropped?.label ?? (rekeyed ? "PRIMARY KEY CHANGE" : lossy ? "ALTER COLUMN TYPE" : void 0);
+		if (!kind) continue;
+		const detail = [rekeyed, lossy].filter(Boolean).join("; ");
+		found.push(detail ? {
+			statement,
+			kind,
+			detail
+		} : {
+			statement,
+			kind
+		});
+	}
+	return found;
+}
+var IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)`;
+var ALTER_TABLE_RE = new RegExp(String.raw`^ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${IDENT})(?:\.(${IDENT}))?\s+([\s\S]*)$`, "i");
+var TYPE_CLAUSE_RE = new RegExp(String.raw`^ALTER\s+(?:COLUMN\s+)?(${IDENT})\s+(?:SET\s+DATA\s+)?TYPE\s+([\s\S]+)$`, "i");
+var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1).replace(/""/g, "\"") : ident;
+/**
+* Split an `ALTER TABLE`'s clause list on its top-level commas — the ones
+* outside parentheses and quotes, so `TYPE numeric(10, 2)` stays one clause.
+*/
+function splitClauses(body) {
+	const clauses = [];
+	let depth = 0;
+	let quote;
+	let start = 0;
+	for (let i = 0; i < body.length; i++) {
+		const ch = body[i];
+		if (quote) {
+			if (ch === quote) quote = void 0;
+		} else if (ch === "\"" || ch === "'") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			clauses.push(body.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	clauses.push(body.slice(start).trim());
+	return clauses.filter((clause) => clause.length > 0);
+}
+/**
+* The statement from its `ALTER TABLE` on, wherever on a line that starts.
+*
+* {@link readPlan} hands over clean statements. This is the second line of
+* defence for text it could not clean — a rendering it does not know yet —
+* where a line of prose above the statement must not hide the statement, which
+* is exactly how an anchored match once read Atlas's whole plan as safe.
+*/
+function fromAlterTable(statement) {
+	const start = /(?:^|\n)[ \t]*(?:->[ \t]*)?(ALTER\s+TABLE\b)/i.exec(statement);
+	return start ? statement.slice(start.index + start[0].length - start[1].length).trim() : statement.trim();
+}
+/**
+* Every `ALTER COLUMN … [SET DATA] TYPE` in one statement. Atlas prints its
+* dry-run statements under a `-> ` marker and puts several clauses in one
+* `ALTER TABLE`, so both are handled.
+*/
+function parseColumnTypeChanges(statement) {
+	const table = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!table) return [];
+	const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
+	const changes = [];
+	for (const clause of splitClauses(table[3])) {
+		const match = TYPE_CLAUSE_RE.exec(clause);
+		if (!match) continue;
+		const to = match[2].split(/\s+(?:USING|COLLATE)\s/i)[0].trim();
+		changes.push({
+			schema,
+			table: name,
+			column: unquote(match[1]),
+			to
+		});
+	}
+	return changes;
+}
+/** `ADD [CONSTRAINT "x"] PRIMARY KEY ("a", "b")`, one clause of an `ALTER TABLE`. */
+var ADD_PRIMARY_KEY_RE = new RegExp(String.raw`^ADD\s+(?:CONSTRAINT\s+${IDENT}\s+)?PRIMARY\s+KEY\b\s*(?:\(([^)]*)\))?`, "i");
+/** `DROP CONSTRAINT [IF EXISTS] "x"`, one clause of an `ALTER TABLE`. */
+var DROP_CONSTRAINT_RE = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i");
+/** What a row loses when the columns that address it change. */
+var ROW_ADDRESS_LOST = "every row's id changes, so anything that refers to a row by its id — a URL, a foreign key, an id stored elsewhere — stops finding it";
+/**
+* What an `ALTER TABLE` does to the table's primary key, in a sentence — or
+* `undefined` when it leaves the key alone.
+*
+* The key is a row's address: Rebase reads, links and routes every row by it.
+* Atlas plans a key change as `DROP CONSTRAINT "<table>_pkey", ADD PRIMARY KEY
+* (…)` — one routine-looking statement that names no DROP of data — so moving
+* a collection from `(id)` to `(id, locale)` re-keyed a populated table with
+* no prompt. A `CREATE TABLE`'s own `PRIMARY KEY` is not a change and is never
+* read here: only an `ALTER TABLE`'s clauses are. A dropped constraint counts
+* as the key when it carries Postgres's default name for one, `<table>_pkey`;
+* a key under another name is caught by the `ADD PRIMARY KEY` that replaces it.
+*/
+function describePrimaryKeyChange(statement) {
+	const alter = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!alter) return void 0;
+	const table = alter[2] ? `${alter[1]}.${alter[2]}` : alter[1];
+	let added;
+	let dropped;
+	for (const clause of splitClauses(alter[3])) {
+		const add = ADD_PRIMARY_KEY_RE.exec(clause);
+		if (add) {
+			added = add[1] === void 0 ? "a new key" : `(${add[1].split(",").map((c) => c.trim()).join(", ")})`;
+			continue;
+		}
+		const drop = DROP_CONSTRAINT_RE.exec(clause);
+		if (drop && unquote(drop[1]).endsWith("_pkey")) dropped = drop[1];
+	}
+	if (added && dropped) return `${table} is re-keyed on ${added}: ${ROW_ADDRESS_LOST}`;
+	if (added) return `${table} gets the primary key ${added}: rows are addressed by it from now on, and the push fails if two rows share a value`;
+	if (dropped) return `${table} loses its primary key ${dropped}: ${ROW_ADDRESS_LOST}`;
+}
+/**
+* The column's current type. A table named without its schema matches in any
+* schema, but only when every match agrees — two same-named tables with
+* different types leave the answer unknown.
+*/
+function currentTypeOf(change, columnTypes) {
+	const types = new Set(columnTypes.filter((col) => col.table === change.table && col.column === change.column && (change.schema === void 0 || col.schema === change.schema)).map((col) => col.type));
+	return types.size === 1 ? [...types][0] : void 0;
+}
+/** Spellings of one type, mapped to one name. Anything absent compares verbatim. */
+var TYPE_ALIASES = {
+	"int": "integer",
+	"int4": "integer",
+	"int2": "smallint",
+	"int8": "bigint",
+	"character varying": "varchar",
+	"decimal": "numeric",
+	"timestamp without time zone": "timestamp",
+	"timestamp with time zone": "timestamptz",
+	"time without time zone": "time",
+	"time with time zone": "timetz",
+	"bool": "boolean",
+	"float4": "real",
+	"float8": "double precision",
+	"character": "bpchar",
+	"char": "bpchar"
+};
+/** Decimal digits each integer type holds, which is what a `numeric` must hold too. */
+var INTEGER_DIGITS = {
+	smallint: 5,
+	integer: 10,
+	bigint: 19
+};
+/** Types whose modifier is a fractional-seconds precision, 6 when absent. */
+var SECONDS_PRECISION = /* @__PURE__ */ new Set([
+	"timestamp",
+	"timestamptz",
+	"time",
+	"timetz"
+]);
+function parseType(raw) {
+	let text = raw.trim().replace(/\s+/g, " ");
+	let dims = 0;
+	for (let suffix = /\s*\[\d*\]$/.exec(text); suffix; suffix = /\s*\[\d*\]$/.exec(text)) {
+		dims++;
+		text = text.slice(0, suffix.index);
+	}
+	if (text.includes("\"")) return {
+		base: text,
+		dims
+	};
+	text = text.toLowerCase().replace(/^pg_catalog\./, "");
+	let args;
+	const modifier = /\(([^)]*)\)/.exec(text);
+	if (modifier) {
+		args = modifier[1].split(",").map((part) => Number(part.trim()));
+		text = `${text.slice(0, modifier.index)} ${text.slice(modifier.index + modifier[0].length)}`.replace(/\s+/g, " ").trim();
+	}
+	return {
+		base: TYPE_ALIASES[text] ?? text,
+		args,
+		dims
+	};
+}
+/** Does moving from one modifier to another, on the same type, keep every value? */
+function modifierWidens(base, from, to) {
+	if (JSON.stringify(from) === JSON.stringify(to)) return true;
+	if (base === "varchar") return to === void 0 || from !== void 0 && to[0] >= from[0];
+	if (base === "numeric") {
+		if (to === void 0) return true;
+		if (from === void 0) return false;
+		const [p1, s1 = 0] = from;
+		const [p2, s2 = 0] = to;
+		return s2 >= s1 && p2 - s2 >= p1 - s1;
+	}
+	if (SECONDS_PRECISION.has(base)) return (to?.[0] ?? 6) >= (from?.[0] ?? 6);
+	return false;
+}
+/**
+* Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly
+* as it was?
+*
+* Deliberately short. Everything not listed needs a confirmation, including
+* changes that are usually harmless: `timestamp` → `timestamptz` reads each
+* value in the session's time zone, `json` → `jsonb` drops duplicate keys,
+* `real` → `double precision` prints 0.1 as 0.100000001490116, and `integer` →
+* `text` keeps the digits but changes what the column is.
+*
+*  - the same type, with a modifier at least as wide (`varchar(100)` →
+*    `varchar(255)`, `numeric(10,2)` → `numeric(12,2)` or unbounded,
+*    `timestamptz(3)` → `timestamptz`);
+*  - `smallint` → `integer` → `bigint`, and any of them to a `numeric` with
+*    room for all their digits;
+*  - `varchar(n)` → `text`, and `text` → an unbounded `varchar`.
+*
+* Arrays follow their element type, and never gain or lose a dimension.
+*/
+function isLosslessTypeChange(from, to) {
+	const a = parseType(from);
+	const b = parseType(to);
+	if (a.dims !== b.dims) return false;
+	if (a.args?.some(Number.isNaN) || b.args?.some(Number.isNaN)) return false;
+	if (a.base === b.base) return modifierWidens(a.base, a.args, b.args);
+	const fromDigits = INTEGER_DIGITS[a.base];
+	if (fromDigits !== void 0) {
+		const toDigits = INTEGER_DIGITS[b.base];
+		if (toDigits !== void 0) return toDigits >= fromDigits;
+		if (b.base === "numeric") return b.args === void 0 || b.args[0] - (b.args[1] ?? 0) >= fromDigits;
+		return false;
+	}
+	if (a.base === "varchar" && b.base === "text") return true;
+	if (a.base === "text" && b.base === "varchar") return b.args === void 0;
+	return false;
+}
+/**
+* Decide how `db push` should proceed given the plan's destructiveness and
+* the invocation context.
+*
+*  - No destructive statements → `apply` (safe to auto-approve).
+*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+*  - Destructive + interactive TTY → `confirm` (prompt before applying).
+*  - Destructive + non-interactive → `refuse` (never silently drop data in
+*    CI / scripts / agents).
+*/
+function decidePushSafety(opts) {
+	if (opts.destructiveCount === 0) return "apply";
+	if (opts.allowDestructive) return "apply";
+	return opts.interactive ? "confirm" : "refuse";
+}
+//#endregion
+//#region src/module-dir.ts
 var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
 //#endregion
+//#region src/generated-sql.ts
+/**
+* Where `db push` and `db generate` put the SQL they render from the collections.
+*
+* Five files — `schema.sql` (Atlas's desired state), `policies.sql`,
+* `search.sql`, `vector.sql` and `triggers.sql` — and every one of them is
+* scratch. Both commands regenerate all five before reading any of them, and
+* nothing else reads them at all. They used to be written into `drizzle/`, beside
+* the migrations, and committed: a copy nobody read, which every collection
+* change rewrote in the diff and every two branches touching collections
+* conflicted on.
+*
+* Relative to the directory the command runs in (the backend), like the
+* migrations are.
+*/
+/** The directory, relative to the working directory. POSIX, because it is also a URL path. */
+var GENERATED_SQL_DIR = ".rebase/sql";
+/**
+* `schema.sql` as Atlas takes it. Relative on purpose, like the
+* `file://drizzle/migrations` beside it: Atlas joins the URL's host and path, so
+* `.rebase` is read as the first path segment, measured against the pinned 1.2.3.
+*/
+var DESIRED_STATE_URL = `file://${GENERATED_SQL_DIR}/schema.sql`;
+/** The files the DDL generator writes, all of them derived from the collections. */
+var GENERATED_SQL_FILES = [
+	"schema.sql",
+	"policies.sql",
+	"search.sql",
+	"vector.sql",
+	"triggers.sql"
+];
+/** The absolute directory, for the working directory the command runs in. */
+function generatedSqlDir(cwd = process.cwd()) {
+	return path.resolve(cwd, GENERATED_SQL_DIR);
+}
+/**
+* The first line of every file the generator writes, in every release that
+* wrote them into `drizzle/`. Matching it is what makes removing the old copy
+* safe: a file there under one of these names that does not open this way was
+* written by a person, and is left alone.
+*/
+var GENERATED_HEADER = /^-- This file (is auto-generated by the Rebase DDL generator|contains RLS policies generated by Rebase)\./;
+/**
+* Get the directory ready to be written, and retire the copies an older release
+* committed.
+*
+* The directory ignores itself, rather than relying on the project's
+* `.gitignore`: a scaffold ignores `.rebase/`, but a project created before it
+* did would otherwise start committing these files from their new home.
+*
+* The old copies in `drizzle/` are deleted, not left behind. Nothing writes them
+* any more, so from the first push after an upgrade they only fall further
+* behind — and a stale `policies.sql` in the repository is exactly what someone
+* reviewing the project's RLS would read.
+*
+* @returns the old files it removed, relative to the working directory.
+*/
+function prepareGeneratedSqlDir(cwd = process.cwd()) {
+	const dir = generatedSqlDir(cwd);
+	fs.mkdirSync(dir, { recursive: true });
+	const ignore = path.join(dir, ".gitignore");
+	if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, "# Generated by `rebase db push` / `rebase db generate` from the collections.\n*\n");
+	const removed = [];
+	for (const name of GENERATED_SQL_FILES) {
+		const legacy = path.join(cwd, "drizzle", name);
+		if (!fs.existsSync(legacy)) continue;
+		const firstLine = fs.readFileSync(legacy, "utf-8").split("\n", 1)[0];
+		if (!GENERATED_HEADER.test(firstLine)) continue;
+		fs.rmSync(legacy);
+		removed.push(path.posix.join("drizzle", name));
+	}
+	return removed;
+}
+//#endregion
 //#region src/cli-helpers.ts
 /**
 * Which package manager installed this project, read off its lockfile.
@@ -6419,7 +6938,7 @@ function resolveLocalBin(binName) {
 	return null;
 }
 async function getTableIncludesFromCollections(allCollections) {
-	const { getTableName, resolveCollectionRelations, relationalCollections } = await import("@rebasepro/common");
+	const { getTableName, relationalCollections, resolveJunctionSpecs } = await import("@rebasepro/common");
 	const { isPostgresCollectionConfig } = await import("@rebasepro/types");
 	const collections = relationalCollections(allCollections);
 	const includes = [];
@@ -6427,14 +6946,8 @@ async function getTableIncludesFromCollections(allCollections) {
 		const tableName = getTableName(col);
 		const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
 		if (tableName) includes.push(`${schema}.${tableName}`);
-		const resolvedRelations = resolveCollectionRelations(col);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			const targetCollection = relation.target();
-			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-			includes.push(`${targetSchema}.${junctionTableName}`);
-		}
 	}
+	for (const junction of resolveJunctionSpecs(collections).values()) includes.push(`${junction.schema}.${junction.table}`);
 	return Array.from(new Set(includes));
 }
 async function getTableIncludes(collectionsPath) {
@@ -6569,11 +7082,11 @@ async function dropDevDatabase(databaseUrl, devDatabaseUrl) {
 /**
 * The generated SQL for the project's `search` blocks, if it has any.
 *
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
 */
-function readSearchDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const searchFile = path.join(drizzleDir, "search.sql");
+function readSearchDdl(sqlDir = generatedSqlDir()) {
+	const searchFile = path.join(sqlDir, "search.sql");
 	if (!fs.existsSync(searchFile)) return "";
 	return fs.readFileSync(searchFile, "utf-8").trim();
 }
@@ -6590,8 +7103,8 @@ function readSearchDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
 * silently pushing a schema whose search column never appeared is how a
 * collection ends up with search configured, no error anywhere, and no results.
 */
-async function applySearchDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readSearchDdl(drizzleDir);
+async function applySearchDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readSearchDdl(sqlDir);
 	if (!sql) return;
 	const { Client } = await import("pg");
 	const client = new Client({ connectionString: databaseUrl });
@@ -6610,7 +7123,7 @@ async function applySearchDdl(databaseUrl, drizzleDir = path.resolve(process.cwd
 * `search` block, which is every project that has not opted in.
 */
 async function getSearchExcludes(collectionsPath) {
-	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-D7imhYV8.js").then((n) => n.o);
+	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
 	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -6654,6 +7167,20 @@ async function queryGeneratedColumnDependencies(databaseUrl) {
 	}
 }
 /**
+* Every column in the database with its current type, for the destructive
+* gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.
+*/
+async function queryColumnTypes(databaseUrl) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	await client.connect();
+	try {
+		return (await client.query(COLUMN_TYPES_SQL)).rows;
+	} finally {
+		await client.end();
+	}
+}
+/**
 * Drop the generated columns standing in the way of an apply.
 *
 * Their indexes and their `COMMENT ON COLUMN` stamp go with them, which is
@@ -6674,11 +7201,11 @@ async function dropGeneratedColumns(databaseUrl, statements) {
 /**
 * The generated SQL for the project's `vector` properties, if it has any.
 *
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
 */
-function readVectorDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const vectorFile = path.join(drizzleDir, "vector.sql");
+function readVectorDdl(sqlDir = generatedSqlDir()) {
+	const vectorFile = path.join(sqlDir, "vector.sql");
 	if (!fs.existsSync(vectorFile)) return "";
 	return fs.readFileSync(vectorFile, "utf-8").trim();
 }
@@ -6697,8 +7224,8 @@ function readVectorDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
 * appeared is how a project ends up with vector search configured, no error
 * anywhere, and no results.
 */
-async function applyVectorDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readVectorDdl(drizzleDir);
+async function applyVectorDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readVectorDdl(sqlDir);
 	if (!sql) return;
 	const { vectorExtensionHint } = await import("./vector-index-CMJKb3C9.js").then((n) => n.f);
 	const { Client } = await import("pg");
@@ -6723,18 +7250,18 @@ async function applyVectorDdl(databaseUrl, drizzleDir = path.resolve(process.cwd
 * `vector` property, which is every project that has not opted in.
 */
 async function getVectorExcludes(collectionsPath) {
-	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-D7imhYV8.js").then((n) => n.o);
+	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
 	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
 * The generated SQL for the project's `autoValue: "on_update"` properties, if
 * it has any.
 *
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
 */
-function readTriggersDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const triggersFile = path.join(drizzleDir, "triggers.sql");
+function readTriggersDdl(sqlDir = generatedSqlDir()) {
+	const triggersFile = path.join(sqlDir, "triggers.sql");
 	if (!fs.existsSync(triggersFile)) return "";
 	return fs.readFileSync(triggersFile, "utf-8").trim();
 }
@@ -6752,8 +7279,8 @@ function readTriggersDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
 * appeared is how `updated_at` ends up silently stale for every writer that is
 * not the driver, which is the whole reason the trigger exists.
 */
-async function applyTriggersDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readTriggersDdl(drizzleDir);
+async function applyTriggersDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readTriggersDdl(sqlDir);
 	if (!sql) return;
 	const { Client } = await import("pg");
 	const client = new Client({ connectionString: databaseUrl });
@@ -6767,7 +7294,7 @@ async function applyTriggersDdl(databaseUrl, drizzleDir = path.resolve(process.c
 }
 /** @see getSearchExcludes */
 async function getTriggerExcludes(collectionsPath) {
-	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-D7imhYV8.js").then((n) => n.o);
+	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
 	return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -6853,8 +7380,8 @@ async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {})
 */
 async function managedIndexNames(collectionsPath) {
 	const collections = await loadCollectionsForCli(collectionsPath);
-	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-D7imhYV8.js").then((n) => n.o);
-	const { resolveColumnName } = await import("./column-plan-helpers-CpILzHJS.js").then((n) => n.n);
+	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
+	const { resolveColumnName } = await import("./column-plan-helpers-1-LQD0yI.js").then((n) => n.t);
 	const { buildCollectionIndexPlan } = await import("./collection-index-DdnsxiJ_.js").then((n) => n.i);
 	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
 	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
@@ -7191,6 +7718,6 @@ async function dropLegacyAuthSchema(run, report) {
 	}
 }
 //#endregion
-export { execa as A, loadCollectionsForCli as C, readTriggersDdl as D, readSearchDdl as E, readVectorDdl as O, getVectorExcludes as S, queryGeneratedColumnDependencies as T, getDevDatabaseUrl as _, ExcludeIntrospectionError as a, getTableExcludes as b, applyVectorDdl as c, describeReinstallCommand as d, detectProjectPackageManager as f, ensureDevDatabaseExists as g, dropGeneratedColumns as h, rls_bootstrap_sql_exports as i, forLibpq as j, resolveLocalBin as k, describeBuildScriptRemedy as l, dropDevDatabase as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, diagnoseMissingBin as p, dropLegacyAuthSchema as r, applyTriggersDdl as s, RLS_BOOTSTRAP_SQL as t, describeDevAddCommand as u, getForeignIndexExcludes as v, promptConfirm as w, getTriggerExcludes as x, getSearchExcludes as y };
+export { resolveLocalBin as A, forLibpq as B, loadCollectionsForCli as C, readSearchDdl as D, queryGeneratedColumnDependencies as E, decidePushSafety as F, detectDestructiveStatements as I, extractPlanStatements as L, GENERATED_SQL_DIR as M, generatedSqlDir as N, readTriggersDdl as O, prepareGeneratedSqlDir as P, fromAlterTable as R, getVectorExcludes as S, queryColumnTypes as T, getDevDatabaseUrl as _, ExcludeIntrospectionError as a, getTableExcludes as b, applyVectorDdl as c, describeReinstallCommand as d, detectProjectPackageManager as f, ensureDevDatabaseExists as g, dropGeneratedColumns as h, rls_bootstrap_sql_exports as i, DESIRED_STATE_URL as j, readVectorDdl as k, describeBuildScriptRemedy as l, dropDevDatabase as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, diagnoseMissingBin as p, dropLegacyAuthSchema as r, applyTriggersDdl as s, RLS_BOOTSTRAP_SQL as t, describeDevAddCommand as u, getForeignIndexExcludes as v, promptConfirm as w, getTriggerExcludes as x, getSearchExcludes as y, execa as z };
 
-//# sourceMappingURL=rls-bootstrap-sql-H3rCFi3F.js.map
+//# sourceMappingURL=rls-bootstrap-sql-_KNnjanK.js.map