@rebasepro/server-postgres 0.22.0 → 0.24.0

package/dist/cli.js

@@ -1,105 +1,19 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-Dka89exj.js";
+import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-DsA-K9uP.js";
 import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { A as execa, C as loadCollectionsForCli, D as readTriggersDdl, E as readSearchDdl, O as readVectorDdl, S as getVectorExcludes, T as queryGeneratedColumnDependencies, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as forLibpq, k as resolveLocalBin, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-H3rCFi3F.js";
+import { A as resolveLocalBin, B as forLibpq, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as decidePushSafety, I as detectDestructiveStatements, L as extractPlanStatements, M as GENERATED_SQL_DIR, N as generatedSqlDir, O as readTriggersDdl, P as prepareGeneratedSqlDir, R as fromAlterTable, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as DESIRED_STATE_URL, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes, z as execa } from "./rls-bootstrap-sql-_KNnjanK.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-BglvpjHv.js";
 import { logger } from "@rebasepro/server";
 import { formatRelativeTime } from "@rebasepro/utils";
 import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-//#region src/schema/destructive-sql.ts
-var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
-/**
-* Pure helpers that classify an Atlas declarative-apply plan as destructive
-* or not, and decide what `rebase db push` should do about it.
-*
-* `db push` runs `atlas schema apply` to make the live database match the
-* generated `schema.sql`. Removing a collection field compiles to
-* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
-* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
-* here, and refuse to auto-approve anything destructive without an explicit
-* opt-in.
-*
-* Everything in this file is side-effect free so it can be unit-tested
-* without Atlas or a database.
-*/
-/**
-* SQL fragments that destroy data or data-bearing objects. Matched
-* case-insensitively against each statement of the plan. `IF EXISTS` /
-* whitespace variations are tolerated by the regexes below.
-*/
-var DESTRUCTIVE_PATTERNS = [
-	{
-		label: "DROP TABLE",
-		re: /\bDROP\s+TABLE\b/i
-	},
-	{
-		label: "DROP COLUMN",
-		re: /\bDROP\s+COLUMN\b/i
-	},
-	{
-		label: "DROP SCHEMA",
-		re: /\bDROP\s+SCHEMA\b/i
-	},
-	{
-		label: "DROP VIEW",
-		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
-	},
-	{
-		label: "DROP TYPE",
-		re: /\bDROP\s+TYPE\b/i
-	},
-	{
-		label: "TRUNCATE",
-		re: /\bTRUNCATE\b/i
-	}
-];
-/**
-* Split a SQL script into individual statements, dropping blank lines and
-* `--` comment lines. Deliberately simple: Atlas emits one plain statement
-* per `;`, without string literals that contain semicolons in a schema DDL
-* plan, so a naive split is safe and keeps this dependency-free.
-*/
-function splitSqlStatements(sql) {
-	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-/**
-* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
-* the statements that would destroy data. An empty array means the plan is
-* safe to auto-approve.
-*/
-function detectDestructiveStatements(planSql) {
-	const found = [];
-	for (const statement of splitSqlStatements(planSql)) for (const { label, re } of DESTRUCTIVE_PATTERNS) if (re.test(statement)) {
-		found.push({
-			statement,
-			kind: label
-		});
-		break;
-	}
-	return found;
-}
-/**
-* Decide how `db push` should proceed given the plan's destructiveness and
-* the invocation context.
-*
-*  - No destructive statements → `apply` (safe to auto-approve).
-*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
-*  - Destructive + interactive TTY → `confirm` (prompt before applying).
-*  - Destructive + non-interactive → `refuse` (never silently drop data in
-*    CI / scripts / agents).
-*/
-function decidePushSafety(opts) {
-	if (opts.destructiveCount === 0) return "apply";
-	if (opts.allowDestructive) return "apply";
-	return opts.interactive ? "confirm" : "refuse";
-}
-//#endregion
 //#region src/schema/generated-column-conflicts.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
 * Which columns an Atlas plan cannot touch, because a generated column reads
 * them.
@@ -137,16 +51,6 @@ var ALTER_COLUMN_RE = new RegExp(String.raw`\bALTER\s+(?:COLUMN\s+)?(${IDENT$1})
 var DROP_COLUMN_RE$1 = new RegExp(String.raw`\bDROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT$1})`, "gi");
 var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1) : ident;
 /**
-* Strip Atlas's plan rendering from a statement.
-*
-* What `schema apply --dry-run` prints is not a SQL file: each statement is
-* indented under a `-- modify "posts" table` heading and prefixed with `-> `,
-* with an `-- ok (12µs)` line after it. `splitSqlStatements` drops the comment
-* lines, and this drops the arrow — without it an anchored `^ALTER TABLE`
-* matches nothing at all, which is a silent no-op rather than an error.
-*/
-var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
-/**
 * Every column an Atlas plan retypes or drops, with the table it belongs to.
 *
 * One statement carries many clauses — Atlas emits `ALTER TABLE "public"."posts"
@@ -155,8 +59,8 @@ var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
 */
 function parseColumnMutations(planSql) {
 	const mutations = [];
-	for (const raw of splitSqlStatements(planSql)) {
-		const statement = stripPlanMarker(raw);
+	for (const raw of extractPlanStatements(planSql)) {
+		const statement = fromAlterTable(raw);
 		const table = TABLE_RE.exec(statement);
 		if (!table) continue;
 		const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
@@ -650,6 +554,15 @@ function tidy(sql) {
 function acceptsExcludeFlag(domain, args) {
 	return domain === "schema" && args.includes("apply");
 }
+/**
+* Does this Atlas invocation plan against the scratch database (`--dev-url`)?
+*
+* `schema apply` and `migrate diff` do; `migrate apply`, `hash` and `status`
+* never read it, so `db migrate` has no reason to create one.
+*/
+function takesDevUrl(domain, args) {
+	return domain === "schema" && args.includes("apply") || domain === "migrate" && args.includes("diff");
+}
 /** Assemble the full argv, connection flags and all. */
 function buildAtlasArgs(invocation) {
 	const { domain, args, url, devUrl, excludes = [] } = invocation;
@@ -667,6 +580,52 @@ function buildAtlasArgs(invocation) {
 	if (acceptsExcludeFlag(domain, args)) for (const exclude of excludes) argv.push("--exclude", exclude);
 	return argv;
 }
+/**
+* `atlas migrate apply`'s own arguments for `rebase db migrate`.
+*
+* `positionals` are what is left of the user's line once every flag the
+* driver knows has been consumed — at most the optional amount Atlas takes. A
+* flag reaching here is a flag Atlas rejects before doing any work.
+*/
+function migrateApplyArgs(positionals, baseline) {
+	return [
+		"apply",
+		"--dir",
+		"file://drizzle/migrations",
+		...baseline ? ["--baseline", baseline] : [],
+		...positionals.filter((positional) => positional !== "migrate")
+	];
+}
+//#endregion
+//#region src/cli-scratch-database.ts
+var ScratchDatabase = class {
+	ops;
+	created;
+	constructor(ops) {
+		this.ops = ops;
+	}
+	/** Make sure it exists before an Atlas call that plans against it. */
+	async ensure(databaseUrl, devDatabaseUrl) {
+		if (await this.ops.create(databaseUrl, devDatabaseUrl)) this.created = {
+			databaseUrl,
+			devDatabaseUrl
+		};
+	}
+	/**
+	* Run a command, then drop the scratch database if the command created it.
+	* A command that throws skips the drop; one that exits the process never
+	* returns here, which is the same thing.
+	*/
+	async around(command) {
+		const result = await command();
+		const created = this.created;
+		if (created) {
+			this.created = void 0;
+			await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+		}
+		return result;
+	}
+};
 //#endregion
 //#region src/branch-argv.ts
 /**
@@ -728,140 +687,6 @@ var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 	"--database-url"
 ]);
 //#endregion
-//#region src/cli-flags.ts
-/**
-* The flags each driver command takes, in one place, and the check that
-* enforces them.
-*
-* Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not
-* mean "be lenient" — it means **an undeclared flag becomes a positional**. So
-* `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the
-* push ran with the destructive gate still closed, and the developer read the
-* refusal as Rebase ignoring the flag they had just typed. `rebase schema
-* generate --ouput src/schema.ts` was worse — it wrote the default path and
-* said nothing, so the next build compiled a file nobody had regenerated.
-*
-* The check has to live at the entry point rather than in those parsers, and
-* that is not a detail: `db push` and `db generate` re-enter `schemaCommand`
-* and `generatePostgresDdlCommand` with the *db* line, so a strict parser
-* inside either of them would reject `--allow-destructive` on a line where it
-* is correct. One validation, once, against the spec for the command the user
-* actually named; the inner parsers keep reading an already-validated line.
-*
-* Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),
-* `db backup`, `db restore`, `db backups` — are deliberately absent: they own
-* their spec, and a second list here would be one more thing to keep in step.
-* An absent entry is "not checked here", never "takes nothing".
-*/
-/**
-* Flags that reach this process on a line it did not compose.
-*
-* `rebase db …` hands the driver the user's whole line: the CLI *reads*
-* `--database-url` and `--docker` to resolve the database and then relays them
-* verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
-* the thing to re-run with. Rejecting any of the three would make the driver
-* refuse commands the CLI documents.
-*/
-var RELAYED_FLAGS = {
-	"--database-url": String,
-	"--docker": Boolean,
-	"--debug": Boolean,
-	"--help": Boolean,
-	"-h": "--help"
-};
-/** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
-var DRIVER_FLAG_SPECS = {
-	"db push": {
-		"--collections": String,
-		"-c": "--collections",
-		"--dry-run": Boolean,
-		"--allow-destructive": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	},
-	"db generate": {
-		"--collections": String,
-		"-c": "--collections"
-	},
-	"db migrate": { "--baseline": String },
-	"schema generate": {
-		"--collections": String,
-		"-c": "--collections",
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--watch": Boolean,
-		"-w": "--watch"
-	},
-	"schema introspect": {
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--collections": String,
-		"-c": "--collections",
-		"--force": Boolean,
-		"-f": "--force",
-		"--schema": String
-	},
-	"schema stale": {
-		"--collections": String,
-		"-c": "--collections",
-		"--output": String,
-		"-o": "--output",
-		"--out": "--output",
-		"--fix": Boolean
-	}
-};
-/**
-* The `--collections` path the user typed, or `null` if they typed none.
-*
-* Read once, at the entry point, because every command that takes it re-enters
-* the generators with the same line and each of them resolved it again — which
-* is how "Collections path not found" came to be printed four times before the
-* real output, and how a path that does not exist got as far as *writing* an
-* empty schema.
-*
-* Permissive, and it has to be: {@link assertKnownFlags} has already judged the
-* line, and `db push` carries flags the `--collections` spec does not name.
-*/
-function collectionsPathIn(args) {
-	try {
-		return (0, import_arg.default)({
-			"--collections": String,
-			"-c": "--collections"
-		}, {
-			argv: args.slice(2),
-			permissive: true
-		})["--collections"] ?? null;
-	} catch {
-		return null;
-	}
-}
-/**
-* Reject a flag the named command does not take.
-*
-* `args` is the driver's whole line — `["db", "push", …]` — so the flags are
-* read from `args.slice(2)`, past the two command words.
-*
-* Throws rather than exiting: `runPluginCommand`'s caller already turns a
-* thrown error into one red line and exit 1, and a thrown error is what the
-* tests can see.
-*/
-function assertKnownFlags(domain, subcommand, args) {
-	if (!subcommand) return;
-	const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];
-	if (!spec) return;
-	try {
-		(0, import_arg.default)({
-			...RELAYED_FLAGS,
-			...spec
-		}, { argv: args.slice(2) });
-	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
-		throw err;
-	}
-}
-//#endregion
 //#region src/cli-collections-path.ts
 /**
 * `--collections <dir>`, checked once, before anything is written.
@@ -870,8 +695,8 @@ function assertKnownFlags(domain, subcommand, args) {
 * `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv assembly
 * each re-enter the loader with the same line — and then both generators wrote
 * an *empty* schema: `drizzle/schema.sql` truncated to `CREATE SCHEMA IF NOT
-* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both are committed
-* artifacts. The push that followed planned a `DROP TABLE` for every table in
+* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both were committed
+* artifacts then. The push that followed planned a `DROP TABLE` for every table in
 * the database, and the only thing between a typo and that was the destructive
 * gate.
 *
@@ -1069,7 +894,7 @@ async function runPluginCommand(args) {
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
-	if (domain === "db") await dbCommand(subcommand, args);
+	if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
 	else if (domain === "schema") await schemaCommand(subcommand, args);
 	else if (domain === "doctor") await doctorPluginCommand(args);
 	else {
@@ -1146,6 +971,20 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 	], collectionsPath);
 	return !result.empty;
 }
+/**
+* The flags `rebase db` reads for the subcommands it parses itself. Hoisted
+* and named `…FLAGS` so the documentation verifier, which reads specs out of
+* this source, sees them.
+*/
+var DB_FLAGS = {
+	"--collections": String,
+	"--allow-destructive": Boolean,
+	"--dry-run": Boolean,
+	"--yes": Boolean,
+	"--baseline": String,
+	"-c": "--collections",
+	"-y": "--yes"
+};
 async function dbCommand(subcommand, rawArgs) {
 	const VALID_ACTIONS = [
 		"push",
@@ -1172,25 +1011,14 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-DqBakiMO.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-DW5p9_zv.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
 		else await backupsCommand(rawArgs);
 		return;
 	}
-	const argsList = (0, import_arg.default)({
-		"--collections": String,
-		"--allow-destructive": Boolean,
-		"--dry-run": Boolean,
-		"--yes": Boolean,
-		"--baseline": String,
-		"-c": "--collections",
-		"-y": "--yes"
-	}, {
-		argv: rawArgs.slice(2),
-		permissive: true
-	});
+	const argsList = parseDriverLine(DB_FLAGS, rawArgs);
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
 	if (subcommand === "generate") {
 		out("");
@@ -1210,7 +1038,7 @@ async function dbCommand(subcommand, rawArgs) {
 			"--dir",
 			"file://drizzle/migrations",
 			"--to",
-			"file://drizzle/schema.sql"
+			DESIRED_STATE_URL
 		], collectionsPath);
 		let wroteNewMigration = listMigrationFiles().length > migrationsBefore.length;
 		if (wroteNewMigration) wroteNewMigration = await stripCarvedOutFromNewestMigration(collectionsPath);
@@ -1229,7 +1057,7 @@ async function dbCommand(subcommand, rawArgs) {
 					}
 					const searchContent = readSearchDdl();
 					if (searchContent) {
-						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-D7imhYV8.js").then((n) => n.o);
+						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-BJsLaVNX.js").then((n) => n.o);
 						const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 						const preamble = migrationDropPreamble(migrationConflicts);
 						if (preamble) {
@@ -1245,7 +1073,7 @@ async function dbCommand(subcommand, rawArgs) {
 						out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
 					}
 					fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
-					const policiesFile = path.resolve(process.cwd(), "drizzle", "policies.sql");
+					const policiesFile = path.join(generatedSqlDir(), "policies.sql");
 					if (fs.existsSync(policiesFile)) {
 						const policiesContent = fs.readFileSync(policiesFile, "utf-8");
 						fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
@@ -1263,7 +1091,10 @@ async function dbCommand(subcommand, rawArgs) {
 		} catch (err) {
 			outWarn(chalk.yellow(`  ⚠️  Failed to append policies or re-hash migration: ${err instanceof Error ? err.message : String(err)}`));
 		}
-		if (!wroteNewMigration) out(chalk.gray("  ℹ No migration written — nothing in this change is visible to Atlas.\n    Search, vector, trigger and RLS DDL are applied by `rebase db push`, and at\n    boot by the schema ensure. For a migration-only deployment, add\n    drizzle/search.sql, drizzle/vector.sql, drizzle/triggers.sql and\n    drizzle/policies.sql to a migration by hand."));
+		if (!wroteNewMigration) out(chalk.gray(`  ℹ No migration written — nothing in this change is visible to Atlas.
+    Search, vector, trigger and RLS DDL are applied by \`rebase db push\`, and at
+    boot by the schema ensure. For a migration-only deployment, add
+    ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
 		out("");
 		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
 		out("");
@@ -1285,17 +1116,20 @@ async function dbCommand(subcommand, rawArgs) {
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
-				"file://drizzle/schema.sql",
+				DESIRED_STATE_URL,
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
-			const destructive = detectDestructiveStatements(plan);
+			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
+			const unreadable = destructive.some((d) => d.kind === "UNREADABLE PLAN");
+			const planStatements = extractPlanStatements(plan);
+			const planListing = unreadable ? plan.trim() : planStatements.map((statement) => `${statement};`).join("\n");
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
 				out("");
-				if (plan.trim()) {
+				if (planStatements.length > 0 || unreadable) {
 					out(chalk.bold("  Planned changes:"));
-					out(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+					out(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
 				out("");
 				if (rebuildable.length > 0) {
@@ -1308,7 +1142,7 @@ async function dbCommand(subcommand, rawArgs) {
 				if (unowned.length > 0) outWarn(formatForeignGeneratedColumnBanner(unowned));
 				if (destructive.length > 0) {
 					outWarn(chalk.yellow(`  ⚠️  ${destructive.length} of those DESTROY data:`));
-					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
 					outWarn("");
@@ -1330,10 +1164,10 @@ async function dbCommand(subcommand, rawArgs) {
 			if (destructive.length > 0) {
 				outWarn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
 				outWarn("");
-				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
 				outWarn("");
 				outWarn(chalk.yellow("  Full planned changes:"));
-				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				outWarn(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				outWarn("");
 				if (decision === "refuse") {
 					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
@@ -1355,9 +1189,9 @@ async function dbCommand(subcommand, rawArgs) {
 				await runAtlas("schema", [
 					"apply",
 					"--to",
-					"file://drizzle/schema.sql",
+					DESIRED_STATE_URL,
 					"--auto-approve"
-				], collectionsPath);
+				], collectionsPath, { throwOnFailure: true });
 			} catch (err) {
 				if (rebuildable.length > 0 && databaseUrl) {
 					out(chalk.gray("  The apply failed — rebuilding the generated columns it needed out of the way."));
@@ -1367,6 +1201,7 @@ async function dbCommand(subcommand, rawArgs) {
 			}
 			out("");
 			if (databaseUrl) {
+				await lockManagedTables(databaseUrl, collectionsPath);
 				await ensureAuthTables(databaseUrl, collectionsPath);
 				await applyVectorDdl(databaseUrl);
 				await applySearchDdl(databaseUrl);
@@ -1375,24 +1210,16 @@ async function dbCommand(subcommand, rawArgs) {
 				await reconcilePolicies(databaseUrl, collectionsPath);
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
-				if (scratchDatabaseCreatedHere) await dropDevDatabase(databaseUrl, getDevDatabaseUrl(databaseUrl));
 			} else outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
 		} else if (subcommand === "migrate") {
 			const databaseUrl = process.env.DATABASE_URL;
 			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
-			const extraArgs = argsList._.filter((arg) => arg !== "migrate");
 			const baseline = argsList["--baseline"];
 			if (baseline) {
 				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
 				out("");
 			}
-			await runAtlas("migrate", [
-				"apply",
-				"--dir",
-				"file://drizzle/migrations",
-				...baseline ? ["--baseline", baseline] : [],
-				...extraArgs
-			], collectionsPath);
+			await runAtlas("migrate", migrateApplyArgs(argsList._, baseline), collectionsPath);
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
@@ -1418,6 +1245,58 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 	}
 }
 /**
+* Switch row-level security on for every table the collections declare, right
+* after Atlas has applied the schema.
+*
+* Atlas cannot carry `ENABLE ROW LEVEL SECURITY` in `schema.sql`: its free tier
+* neither plans it nor reads it back, so a table it creates is born with RLS
+* off — and `rebase_user`, the role every authenticated request runs as, holds
+* DML on it from that moment through the schema's default privileges. RLS used
+* to arrive with the policies, the last step of the push; a refusal from the
+* vector, search or trigger step in between left the new table readable and
+* writable by every caller, with no policy, until a later push or boot fixed
+* it — and a deployment with `REBASE_MIGRATE_ON_BOOT=none` never did. Locked
+* first, a failure later leaves a table that denies, not one that is open.
+*
+* Fatal when a table cannot be locked, and before the steps that follow: the
+* role provisioning at the end re-grants on every table in the schema, which
+* would undo the revoke that is the fallback here.
+*/
+async function lockManagedTables(databaseUrl, collectionsPath) {
+	let unsecured;
+	let userRole;
+	try {
+		const { lockCollectionTables } = await import("./ensure-collection-policies-B1ureSIV.js");
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-CfXOJJaW.js").then((n) => n.o)).REBASE_USER_ROLE;
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const { Client } = await import("pg");
+		const client = new Client({ connectionString: databaseUrl });
+		await client.connect();
+		try {
+			({unsecured} = await lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ The schema was applied, but row-level security could not be switched on for its tables: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("    A table this push created may be readable and writable by every authenticated request\n    until it is. Re-run `rebase db push` — it locks every collection table before anything else."));
+		process.exit(1);
+	}
+	if (unsecured.length === 0) return;
+	outError(chalk.red("\n  ✗ The schema was applied, but row-level security could not be switched on for:"));
+	for (const u of unsecured) {
+		outError(chalk.red(`      ${u.table}: ${u.error}`));
+		outError(chalk.gray(u.grantWithdrawn ? `        Its privileges were taken back from ${userRole}, so it is unreachable rather than unprotected.` : `        ${userRole} still holds its privileges: every authenticated request can read and write every row.`));
+	}
+	outError(chalk.gray("    Nothing after the schema apply ran. Fix the cause — the connection role must own these\n    tables, or be able to ALTER them — and run `rebase db push` again, or as their owner:"));
+	for (const u of unsecured) {
+		const [schema, ...table] = u.table.split(".");
+		outError(chalk.bold(`      ALTER TABLE "${schema}"."${table.join(".")}" ENABLE ROW LEVEL SECURITY;`));
+	}
+	process.exit(1);
+}
+/**
 * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
 * policies reference, before `applyPolicies` runs. Mirrors what the server does
 * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
@@ -1431,8 +1310,8 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Cr5B4UmH.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-CU9IogdL.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-BmI_tRxc.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 		const { Client } = await import("pg");
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
@@ -1459,7 +1338,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-C6Xk0lA6.js").then((n) => n.a);
+		rls = await import("./rls-enforcement-CfXOJJaW.js").then((n) => n.o);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -1508,7 +1387,7 @@ async function retireLegacyAuthSchema(databaseUrl) {
 }
 async function applyPolicies(databaseUrl) {
 	try {
-		const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
+		const policiesPath = path.join(generatedSqlDir(), "policies.sql");
 		if (!fs.existsSync(policiesPath)) return;
 		out(chalk.gray("  Step 3/3: Applying RLS policies to database..."));
 		out("");
@@ -1544,8 +1423,8 @@ async function applyPolicies(databaseUrl) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-xJfy9xG7.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-CU9IogdL.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-B-J2hhm0.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const { Client } = await import("pg");
 		const client = new Client({ connectionString: databaseUrl });
@@ -1627,7 +1506,7 @@ async function branchCommand(rawArgs) {
 		process.exit(1);
 	}
 	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-CucnFcSE.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-BRt78gfa.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const pool = new Pool({
@@ -1857,8 +1736,14 @@ function formatBytes(bytes) {
 function timeAgo(date) {
 	return formatRelativeTime(date, { maxMs: Number.POSITIVE_INFINITY }) ?? "unknown";
 }
-/** Set when this process created the Atlas scratch database; see `ensureDevDatabaseExists`. */
-var scratchDatabaseCreatedHere = false;
+/**
+* The Atlas scratch database this process created, dropped once the db
+* command that needed it succeeds — see `ScratchDatabase`.
+*/
+var scratchDatabase = new ScratchDatabase({
+	create: ensureDevDatabaseExists,
+	drop: dropDevDatabase
+});
 async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	const atlasBin = resolveLocalBin("atlas");
 	if (!atlasBin) {
@@ -1911,7 +1796,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	}
 	await checkDatabaseConnectivity(databaseUrl);
 	const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
-	if (await ensureDevDatabaseExists(databaseUrl, devDatabaseUrl)) scratchDatabaseCreatedHere = true;
+	if (takesDevUrl(domain, args)) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
 	const atlasUrl = forLibpq(databaseUrl);
 	const atlasDevUrl = forLibpq(devDatabaseUrl);
 	const excludes = [];
@@ -1980,6 +1865,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 			latestMigrationVersion: latestMigrationVersion()
 		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
 		if (hint) outError(hint);
+		if (opts.throwOnFailure) throw Object.assign(/* @__PURE__ */ new Error(`atlas ${domain} ${args.join(" ")} failed`), { alreadyReported: true });
 		process.exit(1);
 	}
 	if (opts.captureStdout) return stdoutText.trim().length > 0 ? stdoutText : stderrText;
@@ -2001,7 +1887,11 @@ async function generatePostgresDdlCommand(rawArgs) {
 		process.exit(1);
 	}
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-	const outputPath = argsList["--output"] || path.join("drizzle", "schema.sql");
+	const outputPath = argsList["--output"] || path.join(".rebase/sql", "schema.sql");
+	if (!argsList["--output"]) {
+		const retired = prepareGeneratedSqlDir();
+		if (retired.length > 0) out(chalk.gray(`  Generated SQL is written to ${GENERATED_SQL_DIR}/ now, which is not committed. Removed the old copies — commit the deletion:\n    ${retired.join(", ")}`));
+	}
 	const cmdParts = [
 		ddl.bin,
 		ddl.script,
@@ -2053,9 +1943,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-CU9IogdL.js").then((n) => n.t);
+	const { loadCollections } = await import("./doctor-C-sYWbmt.js").then((n) => n.t);
 	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-BcMl7VSy.js").then((n) => n.n);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-sSFDp6LR.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];