@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/cli.js

@@ -1,20 +1,41 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-B8qHg02P.js";
-import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { A as resolveLocalBin, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as forLibpq, M as detectDestructiveStatements, N as splitSqlStatements, O as readTriggersDdl, P as execa, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as decidePushSafety, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-B8EclDyM.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-BglvpjHv.js";
-import { logger } from "@rebasepro/server";
+import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
+import { A as queryColumnTypes, B as generatedSqlDir, C as getForeignIndexExcludes, D as getUndeclaredConstraintExcludes, E as getTriggerExcludes, F as readVectorDdl, G as extractPlanStatements, H as decidePushSafety, I as resolveLocalBin, J as forLibpq, K as fromAlterTable, L as withAppClient, M as queryUndeclarableConstraints, N as readSearchDdl, O as getVectorExcludes, P as readTriggersDdl, R as DESIRED_STATE_URL, S as ensureDevDatabaseExists, T as getTableExcludes, U as destructiveOptInFlag, V as prepareGeneratedSqlDir, W as detectDestructiveStatements, Y as redactConnectionPasswords, _ as describeReinstallCommand, a as formatForeignGeneratedColumnBanner, b as dropDevDatabase, c as reportCommandFailure, d as applyTriggersDdl, f as applyVectorDdl, g as describeDevAddCommand, h as describeBuildScriptRemedy, i as diagnoseDbError, j as queryGeneratedColumnDependencies, k as loadCollectionsForCli, l as ExcludeIntrospectionError, m as closeAppClients, p as atlasDevDatabaseUrl, q as isSyncedPlan, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity, u as applySearchDdl, v as detectProjectPackageManager, w as getSearchExcludes, x as dropGeneratedColumns, y as diagnoseMissingBin, z as GENERATED_SQL_DIR } from "./cli-errors-oVUuD8k0.js";
+import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-DB6xJv3p.js";
+import { o as execa, r as dropLegacyAuthSchema, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-Bd-hJk08.js";
+import { n as require_arg, t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
+import { a as parseDriverLine, n as assertKnownFlags, r as collectionsPathIn } from "./cli-flags-DnPHXjRH.js";
 import { formatRelativeTime } from "@rebasepro/utils";
-import fs from "fs";
 import path from "path";
-import { fileURLToPath } from "url";
-//#region src/schema/generated-column-conflicts.ts
+import fs from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createRequire } from "module";
+//#region src/tsx-loader.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
+* tsx's loader, as the URL `node --import` takes, or null when none resolves.
+*
+* For running one of this driver's scripts in one Node process. The `tsx`
+* binary is a relay — pnpm's `.bin/tsx` shell shim, then tsx's CLI in one Node,
+* which spawns a second Node with this same loader to run the script — so
+* spawning through it costs a shell and a Node start (~50–100 ms) per child.
+*
+* Resolved the way Node resolves the package: from the project the driver
+* runs in first (its cwd is the backend, where a scaffold declares tsx), then
+* from this package. A URL rather than a path: a Windows path is not a valid
+* `--import` specifier.
+*/
+function resolveTsxLoader() {
+	const bases = [path.join(process.cwd(), "noop.js"), import.meta.url];
+	for (const base of bases) try {
+		return pathToFileURL(createRequire(base).resolve("tsx")).href;
+	} catch {}
+	return null;
+}
+//#endregion
+//#region src/schema/generated-column-conflicts.ts
+/**
 * Which columns an Atlas plan cannot touch, because a generated column reads
 * them.
 *
@@ -51,16 +72,6 @@ var ALTER_COLUMN_RE = new RegExp(String.raw`\bALTER\s+(?:COLUMN\s+)?(${IDENT$1})
 var DROP_COLUMN_RE$1 = new RegExp(String.raw`\bDROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT$1})`, "gi");
 var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1) : ident;
 /**
-* Strip Atlas's plan rendering from a statement.
-*
-* What `schema apply --dry-run` prints is not a SQL file: each statement is
-* indented under a `-- modify "posts" table` heading and prefixed with `-> `,
-* with an `-- ok (12µs)` line after it. `splitSqlStatements` drops the comment
-* lines, and this drops the arrow — without it an anchored `^ALTER TABLE`
-* matches nothing at all, which is a silent no-op rather than an error.
-*/
-var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
-/**
 * Every column an Atlas plan retypes or drops, with the table it belongs to.
 *
 * One statement carries many clauses — Atlas emits `ALTER TABLE "public"."posts"
@@ -69,8 +80,8 @@ var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
 */
 function parseColumnMutations(planSql) {
 	const mutations = [];
-	for (const raw of splitSqlStatements(planSql)) {
-		const statement = stripPlanMarker(raw);
+	for (const raw of extractPlanStatements(planSql)) {
+		const statement = fromAlterTable(raw);
 		const table = TABLE_RE.exec(statement);
 		if (!table) continue;
 		const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
@@ -136,7 +147,7 @@ function partitionByOwnership(conflicts, excludePatterns) {
 	const managed = [];
 	const foreign = [];
 	for (const conflict of conflicts) {
-		const target = `${conflict.schema}.${conflict.table}.${conflict.column}`;
+		const target = atlasExcludePattern(conflict.schema, conflict.table, conflict.column);
 		(owned.has(target) ? managed : foreign).push(conflict);
 	}
 	return {
@@ -231,16 +242,17 @@ var DROP_INDEX_RE = new RegExp(`^DROP\\s+INDEX\\s+(?:CONCURRENTLY\\s+)?(?:IF\\s+
 */
 var MENTIONS_DROP = /\bDROP\b/i;
 /**
-* Split `schema.table.object` patterns. Anything not in three parts is
-* ignored rather than guessed at — the two-part form is the one Atlas itself
-* silently mis-reads, and repeating that mistake here would be worse than
-* doing nothing.
+* Split `schema.table.object` patterns back into the names they were built
+* from (`excludePatternParts`, the inverse of how every exclude is spelled).
+* Anything not in three parts is ignored rather than guessed at — the two-part
+* form is the one Atlas itself silently mis-reads, and repeating that mistake
+* here would be worse than doing nothing.
 */
 function parseExcludePatterns(patterns) {
 	const parsed = [];
 	for (const pattern of patterns) {
-		const parts = pattern.split(".");
-		if (parts.length !== 3) continue;
+		const parts = excludePatternParts(pattern);
+		if (parts === void 0 || parts.length !== 3) continue;
 		if (parts.some((p) => p.length === 0)) continue;
 		parsed.push({
 			schema: parts[0],
@@ -543,6 +555,60 @@ function tidy(sql) {
 	return trimmed.length === 0 ? "" : `${trimmed}\n`;
 }
 //#endregion
+//#region src/schema/migration-post-process.ts
+/**
+* Run the steps that finish a migration Atlas just wrote — the search, vector
+* and trigger DDL, the RLS bootstrap and policies, the re-hash — and take the
+* migration back out when any of them fails.
+*
+* Atlas's own file creates the tables and nothing else: no `ENABLE ROW LEVEL
+* SECURITY`, no policy. Those arrive in the append. A failure here used to be a
+* yellow warning followed by "You can now run rebase db migrate", and when it
+* struck before the file was rewritten the checksum still matched — so the
+* migration applied cleanly and created every new table with RLS off while
+* the schema's default privileges handed `rebase_user` full DML on it. On a
+* deployment that runs migrations and never provisions at boot
+* (`REBASE_MIGRATE_ON_BOOT=none`), nothing closed it again.
+*
+* Deleting the file is safe because it is the one this run created: running
+* `db generate` again, once the cause is fixed, writes the same diff.
+*/
+async function finishNewMigration(file, steps, rehash) {
+	try {
+		await steps();
+		return { ok: true };
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		let removed = false;
+		try {
+			if (fs.existsSync(file)) fs.unlinkSync(file);
+			removed = !fs.existsSync(file);
+		} catch {
+			removed = false;
+		}
+		if (!removed) return {
+			ok: false,
+			error,
+			removed
+		};
+		try {
+			await rehash();
+			return {
+				ok: false,
+				error,
+				removed
+			};
+		} catch (hashErr) {
+			return {
+				ok: false,
+				error,
+				removed,
+				rehashError: hashErr instanceof Error ? hashErr.message : String(hashErr)
+			};
+		}
+	}
+}
+//#endregion
 //#region src/schema/atlas-argv.ts
 /**
 * Does this Atlas invocation accept `--exclude`?
@@ -582,7 +648,7 @@ function buildAtlasArgs(invocation) {
 		else if (args.includes("clean") || args.includes("inspect")) argv.push("--url", url);
 	} else if (domain === "migrate") {
 		if (args.includes("diff")) argv.push("--dev-url", devUrl);
-		else if (args.includes("apply") || args.includes("status")) {
+		else if (args.includes("apply") || args.includes("status") || args.includes("set")) {
 			argv.push("--url", url, "--revisions-schema", "rebase");
 			if (args.includes("apply") && !args.includes("--baseline")) argv.push("--allow-dirty");
 		}
@@ -611,6 +677,7 @@ function migrateApplyArgs(positionals, baseline) {
 var ScratchDatabase = class {
 	ops;
 	created;
+	keptAsEvidence = false;
 	constructor(ops) {
 		this.ops = ops;
 	}
@@ -621,22 +688,205 @@ var ScratchDatabase = class {
 			devDatabaseUrl
 		};
 	}
+	/** An Atlas run against it failed: keep it, whatever the command does next. */
+	keepAsEvidence() {
+		this.keptAsEvidence = true;
+	}
 	/**
-	* Run a command, then drop the scratch database if the command created it.
-	* A command that throws skips the drop; one that exits the process never
-	* returns here, which is the same thing.
+	* Run a command, then drop the scratch database if the command created it,
+	* whether the command returned or threw. A throw after
+	* {@link keepAsEvidence} keeps it. A command that wants to stop with exit 1
+	* throws {@link CommandStopped} rather than calling `process.exit`, which
+	* would skip this.
 	*/
 	async around(command) {
-		const result = await command();
-		const created = this.created;
-		if (created) {
-			this.created = void 0;
-			await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+		let result;
+		try {
+			result = await command();
+		} catch (err) {
+			if (!this.keptAsEvidence) await this.release();
+			throw err;
 		}
+		await this.release();
 		return result;
 	}
+	/** Drop it now if this process created it. Safe to call twice. */
+	async release() {
+		const created = this.created;
+		if (!created) return;
+		this.created = void 0;
+		await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+	}
+};
+/**
+* A db command stopping with exit 1 after it has said why: a destructive push
+* the user declined, or one with no terminal to ask on.
+*
+* Thrown instead of `process.exit(1)`, so it unwinds through
+* {@link ScratchDatabase.around} and the scratch database is dropped on the way
+* out. `alreadyReported` tells `reportCommandFailure` the explanation is on the
+* terminal already; the entry point sets the exit code.
+*/
+var CommandStopped = class extends Error {
+	alreadyReported = true;
+	constructor(reason) {
+		super(reason);
+		this.name = "CommandStopped";
+	}
 };
 //#endregion
+//#region src/schema/migrate-baseline.ts
+/**
+* What `rebase db migrate --baseline <version>` does, given the history the
+* database already has.
+*
+* The flag promises to record `<version>` as applied and migrate from the next
+* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
+* database with no revision history: once one row exists it ignores the flag
+* without a word, applies the migration anyway, and the CLI had already printed
+* "Recording … as already applied". That is the normal second time: a project
+* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
+* the migration for it, and `db migrate` fails on `column … already exists
+* (42701)` however the baseline is spelled.
+*
+* So the history is read first. With none, Atlas's baseline does the work.
+* Behind `<version>`, `atlas migrate set` marks every migration up to it as
+* applied, which is what a baseline means. At or past it, there is nothing to
+* record, and the command says so instead of claiming it recorded something.
+*/
+/**
+* Atlas's version order for the versions Rebase writes: numeric timestamps,
+* compared as numbers so a shorter one is not read as later; anything else as
+* text.
+*/
+function compareMigrationVersions(a, b) {
+	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
+		const x = BigInt(a);
+		const y = BigInt(b);
+		return x === y ? 0 : x < y ? -1 : 1;
+	}
+	return a.localeCompare(b);
+}
+/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
+function planBaseline(version, latestRecorded) {
+	if (latestRecorded === null) return { kind: "atlas-baseline" };
+	if (compareMigrationVersions(version, latestRecorded) > 0) return {
+		kind: "set",
+		latest: latestRecorded
+	};
+	return {
+		kind: "already-recorded",
+		latest: latestRecorded
+	};
+}
+/** What the command says before it migrates, for each plan. */
+function describeBaselinePlan(version, plan) {
+	switch (plan.kind) {
+		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
+		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
+		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
+	}
+}
+/**
+* The newest version Atlas has recorded on this database, or `null` when it
+* has recorded none (no revisions table yet included).
+*
+* The table is `rebase.atlas_schema_revisions`: the CLI passes
+* `--revisions-schema rebase` to every `migrate apply`.
+*/
+async function latestRecordedMigration(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
+		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
+		if (versions.length === 0) return null;
+		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
+	});
+}
+//#endregion
+//#region src/cli-push.ts
+/**
+* Apply a planned push.
+*
+* A dry-run that answered "Schema is synced" skips the second Atlas run: that
+* run would plan the same diff again (≈0.9 s at 111 tables, 5.5 s at 411 —
+* Atlas's cost grows faster than the table count) and then apply nothing. The
+* steps after it still run, because Atlas cannot see what they own. A plan with
+* anything in it keeps the old flow, including Atlas re-planning at apply time.
+*
+* @returns `"synced"` when Atlas was not run again, `"applied"` otherwise.
+*/
+async function applyPushPlan(plan, steps) {
+	const synced = isSyncedPlan(plan.dryRun) && plan.rebuildable === 0;
+	if (synced) steps.reportSynced();
+	else {
+		if (plan.rebuildable > 0) await steps.dropRebuildable();
+		try {
+			await steps.atlasApply();
+		} catch (err) {
+			if (plan.rebuildable > 0) await steps.rebuildAfterFailure();
+			throw err;
+		}
+	}
+	await steps.afterApply();
+	return synced ? "synced" : "applied";
+}
+/**
+* The tables whose stamp `db push` may write: those every one of whose planned
+* statements `policies.sql` carries, verbatim.
+*
+* A stamp says "this stored definition is what the plan's statement made". It
+* is only true of a policy the statement *did* make — and since both are
+* rendered by the same function from the same collections, a table whose
+* statements are all in the file is one whose policies the file just created.
+* Anything else (a hand-edited file, a file generated elsewhere) is not
+* stamped, and the next boot re-applies that table, as before.
+*/
+function stampableTables(plans, policiesSql) {
+	return plans.filter((plan) => plan.policyStatements.length > 0 && plan.policyStatements.every((statement) => policiesSql.includes(statement)));
+}
+/**
+* Run `policies.sql`, then stamp the policies it created the way a boot does,
+* in the same transaction.
+*
+* Before stamps the push's policies carried none, so the first boot after
+* every push re-applied them all — a DROP and a CREATE per policy, an ACCESS
+* EXCLUSIVE lock per table. Stamped here, that boot finds them current.
+*
+* The file runs in one transaction, as it did as one implicit one: a policy
+* that fails leaves the previous ones in place. The stamps run after it, under
+* a savepoint: a stamp that cannot be written costs the next boot a re-apply,
+* which is what it did before, so it is reported and the policies are kept.
+* Nothing is left set on the connection: `SET LOCAL` ends with the transaction.
+*/
+async function applyPoliciesFile(client, policiesSql, stamping) {
+	await client.query("BEGIN");
+	let stamped = 0;
+	let stampError;
+	try {
+		await client.query(policiesSql);
+		if (stamping.statements.length > 0) {
+			await client.query("SAVEPOINT rebase_policy_stamps");
+			try {
+				if (stamping.searchPath) await client.query(`SET LOCAL search_path TO ${stamping.searchPath}`);
+				await client.query(stamping.statements.join("\n"));
+				await client.query("RELEASE SAVEPOINT rebase_policy_stamps");
+				stamped = stamping.statements.length;
+			} catch (err) {
+				await client.query("ROLLBACK TO SAVEPOINT rebase_policy_stamps");
+				stampError = err instanceof Error ? err.message : String(err);
+			}
+		}
+		await client.query("COMMIT");
+	} catch (err) {
+		await client.query("ROLLBACK").catch(() => void 0);
+		throw err;
+	}
+	return {
+		stamped,
+		stampError
+	};
+}
+//#endregion
 //#region src/branch-argv.ts
 /**
 * Argument shapes for `rebase db branch`, with no dependencies.
@@ -705,8 +955,8 @@ var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 * `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv assembly
 * each re-enter the loader with the same line — and then both generators wrote
 * an *empty* schema: `drizzle/schema.sql` truncated to `CREATE SCHEMA IF NOT
-* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both are committed
-* artifacts. The push that followed planned a `DROP TABLE` for every table in
+* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both were committed
+* artifacts then. The push that followed planned a `DROP TABLE` for every table in
 * the database, and the only thing between a typo and that was the destructive
 * gate.
 *
@@ -851,6 +1101,11 @@ var __cliDirname = path.dirname(fileURLToPath(import.meta.url));
 * tsx maps it back. Running the built `.js` under plain `node` therefore fails
 * on the user's code rather than on ours, one directory further from anything
 * the error mentions.
+*
+* tsx's loader in one Node (`node --import`) when it resolves, rather than the
+* `tsx` binary, which is a shell shim and a relay Node in front of that same
+* loader (see `tsx-loader.ts`). The binary stays the fallback — a global tsx.
+* `args` is everything after `bin`, the script included.
 */
 function resolveChildScript(name) {
 	const built = path.join(__cliDirname, "schema", `${name}.js`);
@@ -860,6 +1115,16 @@ function resolveChildScript(name) {
 		ok: false,
 		reason: "script"
 	};
+	const tsxLoader = resolveTsxLoader();
+	if (tsxLoader) return {
+		ok: true,
+		bin: process.execPath,
+		args: [
+			"--import",
+			tsxLoader,
+			script
+		]
+	};
 	const tsxBin = resolveLocalBin("tsx");
 	if (!tsxBin) return {
 		ok: false,
@@ -868,7 +1133,7 @@ function resolveChildScript(name) {
 	return {
 		ok: true,
 		bin: tsxBin,
-		script
+		args: [script]
 	};
 }
 /** What to print when {@link resolveChildScript} cannot produce a command. */
@@ -876,6 +1141,40 @@ function childScriptError(what, reason) {
 	if (reason === "tsx") return `✗ Could not find the tsx binary, which ${what} needs to read your collection files. Install your project's dependencies and try again.`;
 	return `✗ The driver's ${what} is missing. This copy of @rebasepro/server-postgres is incomplete — reinstall it, or run its build if you are working in the monorepo.`;
 }
+/**
+* Whether this process can run the generators itself — that is, whether it
+* runs under tsx, the interpreter the project's collection files need (see
+* {@link resolveChildScript}). `rebase` always starts the driver that way when
+* tsx is installed, which a scaffold guarantees; a driver started with plain
+* `node` keeps the child process, which brings its own tsx.
+*/
+function generatesInProcess() {
+	return [...process.execArgv, process.env.NODE_OPTIONS ?? ""].some((flag) => /(?:^|[\s\\/=])tsx(?:$|[\s\\/@])/.test(flag));
+}
+/**
+* Run one of the generators in this process — see `schema/generate-files.ts`
+* for why a one-shot generation no longer gets a process of its own.
+*
+* The messages and the exit code are the child's: a generator that failed has
+* printed its own error, and this adds the one-line verdict; one that could not
+* even be loaded is reported the way a child that never started was.
+*/
+async function generateInProcess(what, label, run) {
+	let generators;
+	try {
+		generators = await import("./generate-files-OoRJLEdk.js").then((n) => n.t);
+	} catch (err) {
+		outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	try {
+		await run(generators);
+	} catch (err) {
+		if (err instanceof generators.GenerationFailed) outError(chalk.red(`✗ ${label} generation failed — nothing was applied.`));
+		else outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+}
 async function loadEnv() {
 	try {
 		const dotenv = await import("dotenv");
@@ -904,12 +1203,19 @@ async function runPluginCommand(args) {
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
-	if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
-	else if (domain === "schema") await schemaCommand(subcommand, args);
-	else if (domain === "doctor") await doctorPluginCommand(args);
-	else {
-		outError(chalk.red(`Unknown domain command: ${domain}`));
-		process.exit(1);
+	try {
+		if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
+		else if (domain === "schema") await schemaCommand(subcommand, args);
+		else if (domain === "doctor") await doctorPluginCommand(args);
+		else if (domain === "console") {
+			const { consoleCommand } = await import("./cli-console-DGee3Zl7.js");
+			process.exitCode = await consoleCommand(args);
+		} else {
+			outError(chalk.red(`Unknown domain command: ${domain}`));
+			process.exit(1);
+		}
+	} finally {
+		await closeAppClients();
 	}
 }
 /** The migration files on disk, sorted, or none if the directory is absent. */
@@ -982,6 +1288,62 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 	return !result.empty;
 }
 /**
+* One line per destructive statement, as `db push` prints them — shared by
+* push, `db generate` and `db migrate --refuse-destructive`, so the three
+* describe the same statement the same way.
+*/
+function destructiveLines(destructive) {
+	return destructive.map((d) => chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+}
+/**
+* The column types `detectDestructiveStatements` reads a type change against,
+* or none when the database cannot be asked — every type change then counts
+* as destructive, which is the safe side of a report.
+*/
+async function columnTypesOrNone(databaseUrl) {
+	if (!databaseUrl) return [];
+	try {
+		return await queryColumnTypes(databaseUrl);
+	} catch {
+		return [];
+	}
+}
+/**
+* The CHECK and EXCLUDE constraints `detectDestructiveStatements` reads a
+* `DROP CONSTRAINT` against, or none when the database cannot be asked. A
+* report then cannot tell a dropped CHECK from a dropped foreign key, and says
+* nothing about either, as before.
+*/
+async function constraintsOrNone(databaseUrl) {
+	if (!databaseUrl) return [];
+	try {
+		return await queryUndeclarableConstraints(databaseUrl);
+	} catch {
+		return [];
+	}
+}
+/**
+* Say what in the migration `db generate` just wrote destroys data.
+*
+* `db push` stops before a destructive change; `db generate` wrote the same
+* `DROP COLUMN` into a file without a word, and `db migrate` applied it. Only
+* the part Atlas planned is read: what is appended after it (the search
+* rebuild, policies, triggers) is Rebase's own and puts back what it drops.
+* A report, not a refusal — the exit code is unchanged.
+*/
+async function reportDestructiveMigration(migrationSql, migrationFile, databaseUrl) {
+	const destructive = detectDestructiveStatements(migrationSql, await columnTypesOrNone(databaseUrl), await constraintsOrNone(databaseUrl));
+	if (destructive.length === 0) return;
+	outWarn("");
+	outWarn(chalk.yellow(`  ⚠️  ${migrationFile} includes ${destructive.length} destructive change(s) that will DESTROY data when applied:`));
+	outWarn("");
+	for (const line of destructiveLines(destructive)) outWarn(line);
+	outWarn("");
+	outWarn(chalk.yellow("  Review it before `rebase db migrate`. `rebase db migrate --refuse-destructive` will not apply it."));
+	outWarn(chalk.yellow("  Back up first: rebase db backup"));
+	outWarn("");
+}
+/**
 * The flags `rebase db` reads for the subcommands it parses itself. Hoisted
 * and named `…FLAGS` so the documentation verifier, which reads specs out of
 * this source, sees them.
@@ -989,6 +1351,7 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 var DB_FLAGS = {
 	"--collections": String,
 	"--allow-destructive": Boolean,
+	"--refuse-destructive": Boolean,
 	"--dry-run": Boolean,
 	"--yes": Boolean,
 	"--baseline": String,
@@ -1021,7 +1384,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-24v4OlSp.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-yiKd1GsC.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1035,7 +1398,7 @@ async function dbCommand(subcommand, rawArgs) {
 		out(chalk.bold("  📦 Rebase DB Generate"));
 		out(chalk.gray("  Step 1/2: Generating Drizzle schema & Postgres DDL from collections..."));
 		out("");
-		await schemaCommand("generate", rawArgs);
+		await schemaCommand("generate", rawArgs, { nextStep: false });
 		await generatePostgresDdlCommand(rawArgs);
 		out("");
 		out(chalk.gray("  Step 2/2: Generating SQL migration files with Atlas..."));
@@ -1048,60 +1411,74 @@ async function dbCommand(subcommand, rawArgs) {
 			"--dir",
 			"file://drizzle/migrations",
 			"--to",
-			"file://drizzle/schema.sql"
+			DESIRED_STATE_URL
 		], collectionsPath);
 		let wroteNewMigration = listMigrationFiles().length > migrationsBefore.length;
 		if (wroteNewMigration) wroteNewMigration = await stripCarvedOutFromNewestMigration(collectionsPath);
-		try {
-			const migrationsDir = path.resolve(process.cwd(), "drizzle", "migrations");
-			if (fs.existsSync(migrationsDir) && wroteNewMigration) {
-				const sqlFiles = fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
-				if (sqlFiles.length > 0) {
-					const newestMigrationFile = path.join(migrationsDir, sqlFiles[sqlFiles.length - 1]);
-					let migrationContent = fs.readFileSync(newestMigrationFile, "utf-8");
-					migrationContent = migrationContent.replace(/CREATE SCHEMA (?!IF NOT EXISTS)("[^"]+");/g, "CREATE SCHEMA IF NOT EXISTS $1;");
-					const vectorContent = readVectorDdl();
-					if (vectorContent) {
-						migrationContent = `${migrationContent}\n\n${vectorContent}`;
-						out(chalk.gray("  ✓ Appended vector DDL to the migration"));
-					}
-					const searchContent = readSearchDdl();
-					if (searchContent) {
-						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-						const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
-						const preamble = migrationDropPreamble(migrationConflicts);
-						if (preamble) {
-							migrationContent = `${preamble}\n${migrationContent}`;
-							for (const conflict of migrationConflicts) out(chalk.gray(`  ✓ ${describeConflict(conflict)} is dropped and rebuilt inside the migration`));
-						}
-						migrationContent = `${migrationContent}\n\n${searchContent}`;
-						out(chalk.gray("  ✓ Appended search DDL to the migration"));
-					}
-					const triggersContent = readTriggersDdl();
-					if (triggersContent) {
-						migrationContent = `${migrationContent}\n\n${triggersContent}`;
-						out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
-					}
-					fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
-					const policiesFile = path.resolve(process.cwd(), "drizzle", "policies.sql");
-					if (fs.existsSync(policiesFile)) {
-						const policiesContent = fs.readFileSync(policiesFile, "utf-8");
-						fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
-						out(chalk.gray(`  ✓ Appended RLS policies to migration file: ${path.basename(newestMigrationFile)}`));
-						out(chalk.gray("  Re-hashing migration files..."));
-						await runAtlas("migrate", [
-							"hash",
-							"--dir",
-							"file://drizzle/migrations"
-						], collectionsPath);
-						out(chalk.gray("  ✓ Migration directory checksum updated successfully."));
+		const newestWritten = wroteNewMigration ? listMigrationFiles().at(-1) : void 0;
+		if (newestWritten) await reportDestructiveMigration(fs.readFileSync(path.resolve(process.cwd(), "drizzle", "migrations", newestWritten), "utf-8"), newestWritten, process.env.DATABASE_URL);
+		const migrationsDir = path.resolve(process.cwd(), "drizzle", "migrations");
+		const newestSql = fs.existsSync(migrationsDir) && wroteNewMigration ? fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort().at(-1) : void 0;
+		if (newestSql) {
+			const newestMigrationFile = path.join(migrationsDir, newestSql);
+			const finished = await finishNewMigration(newestMigrationFile, async () => {
+				let migrationContent = fs.readFileSync(newestMigrationFile, "utf-8");
+				migrationContent = migrationContent.replace(/CREATE SCHEMA (?!IF NOT EXISTS)("[^"]+");/g, "CREATE SCHEMA IF NOT EXISTS $1;");
+				const vectorContent = readVectorDdl();
+				if (vectorContent) {
+					migrationContent = `${migrationContent}\n\n${vectorContent}`;
+					out(chalk.gray("  ✓ Appended vector DDL to the migration"));
+				}
+				const searchContent = readSearchDdl();
+				if (searchContent) {
+					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+					const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
+					const preamble = migrationDropPreamble(migrationConflicts);
+					if (preamble) {
+						migrationContent = `${preamble}\n${migrationContent}`;
+						for (const conflict of migrationConflicts) out(chalk.gray(`  ✓ ${describeConflict(conflict)} is dropped and rebuilt inside the migration`));
 					}
+					migrationContent = `${migrationContent}\n\n${searchContent}`;
+					out(chalk.gray("  ✓ Appended search DDL to the migration"));
+				}
+				const triggersContent = readTriggersDdl();
+				if (triggersContent) {
+					migrationContent = `${migrationContent}\n\n${triggersContent}`;
+					out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
 				}
+				fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
+				const policiesFile = path.join(generatedSqlDir(), "policies.sql");
+				if (fs.existsSync(policiesFile)) {
+					const policiesContent = fs.readFileSync(policiesFile, "utf-8");
+					fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
+					out(chalk.gray(`  ✓ Appended RLS policies to migration file: ${path.basename(newestMigrationFile)}`));
+					out(chalk.gray("  Re-hashing migration files..."));
+					await runAtlas("migrate", [
+						"hash",
+						"--dir",
+						"file://drizzle/migrations"
+					], collectionsPath, { throwOnFailure: true });
+					out(chalk.gray("  ✓ Migration directory checksum updated successfully."));
+				}
+			}, async () => {
+				await runAtlas("migrate", [
+					"hash",
+					"--dir",
+					"file://drizzle/migrations"
+				], collectionsPath, { throwOnFailure: true });
+			});
+			if (!finished.ok) {
+				outError(chalk.red(`\n  ✗ Could not finish ${newestSql}: ${finished.error}`));
+				outError(chalk.gray("    Atlas's half of a migration creates the tables; the part that failed adds their\n    row-level security, policies, search, vector and trigger DDL. Applied alone, it\n    would serve the new tables with no row filtering."));
+				outError(chalk.gray(finished.removed ? `    ${newestSql} was removed. Fix the cause and run \`rebase db generate\` again.` : `    ${newestSql} could not be removed — delete it by hand before \`rebase db migrate\`.`));
+				if (finished.rehashError) outError(chalk.gray(`    Re-hashing failed too (${finished.rehashError}); run \`atlas migrate hash\` or generate again.`));
+				process.exit(1);
 			}
-		} catch (err) {
-			outWarn(chalk.yellow(`  ⚠️  Failed to append policies or re-hash migration: ${err instanceof Error ? err.message : String(err)}`));
 		}
-		if (!wroteNewMigration) out(chalk.gray("  ℹ No migration written — nothing in this change is visible to Atlas.\n    Search, vector, trigger and RLS DDL are applied by `rebase db push`, and at\n    boot by the schema ensure. For a migration-only deployment, add\n    drizzle/search.sql, drizzle/vector.sql, drizzle/triggers.sql and\n    drizzle/policies.sql to a migration by hand."));
+		if (!wroteNewMigration) out(chalk.gray(`  ℹ No migration written — nothing in this change is visible to Atlas.
+    Search, vector, trigger and RLS DDL are applied by \`rebase db push\`, and at
+    boot by the schema ensure. For a migration-only deployment, add
+    ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
 		out("");
 		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
 		out("");
@@ -1110,32 +1487,46 @@ async function dbCommand(subcommand, rawArgs) {
 		out(chalk.bold(`  🗄️  Rebase DB ${subcommand.charAt(0).toUpperCase() + subcommand.slice(1)}`));
 		out("");
 		if (subcommand === "push") {
-			out(chalk.gray("  Step 1/3: Generating Drizzle schema & Postgres DDL from collections..."));
+			const dryRun = argsList["--dry-run"] === true;
+			out(chalk.gray(dryRun ? "  Step 1/3: Generating the Postgres DDL from collections (the plan's input)..." : "  Step 1/3: Generating Drizzle schema & Postgres DDL from collections..."));
 			out("");
-			await schemaCommand("generate", rawArgs);
-			await generatePostgresDdlCommand(rawArgs);
+			if (dryRun) out(chalk.gray("  --dry-run: src/schema.generated.ts is left as it is."));
+			else await schemaCommand("generate", rawArgs, { nextStep: false });
+			await generatePostgresDdlCommand(rawArgs, { retireLegacyCopies: !dryRun });
 			out("");
-			const dryRun = argsList["--dry-run"] === true;
 			out(chalk.gray(dryRun ? "  Step 2/3: Planning the change against the database (nothing is applied)..." : "  Step 2/3: Pushing schema to database with Atlas..."));
 			out("");
 			const databaseUrl = process.env.DATABASE_URL;
 			if (databaseUrl && !dryRun) await ensureAuthSchemaAndFunctions(databaseUrl);
+			if (databaseUrl) await renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun);
+			const prebuilt = databaseUrl ? await prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) : [];
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
-				"file://drizzle/schema.sql",
+				DESIRED_STATE_URL,
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
-			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
+			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : [], databaseUrl ? await queryUndeclarableConstraints(databaseUrl) : []);
+			const unreadable = destructive.some((d) => d.kind === "UNREADABLE PLAN");
+			const planStatements = extractPlanStatements(plan);
+			const planListing = unreadable ? plan.trim() : planStatements.map((statement) => `${statement};`).join("\n");
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
+			if (databaseUrl) await reportKeptEnumLabels(databaseUrl, collectionsPath);
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
 				out("");
-				if (plan.trim()) {
+				if (planStatements.length > 0 || unreadable) {
 					out(chalk.bold("  Planned changes:"));
-					out(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+					out(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
 				out("");
+				if (prebuilt.length > 0) {
+					out(chalk.gray(`  ${prebuilt.length} foreign-key index(es) on existing tables would be built first,`));
+					out(chalk.gray("  CONCURRENTLY, so the apply would not build them under a write lock (the plan"));
+					out(chalk.gray("  above lists them because they do not exist yet):"));
+					for (const name of prebuilt) out(chalk.gray(`       ${name}`));
+					out("");
+				}
 				if (rebuildable.length > 0) {
 					out(chalk.gray(`  ${rebuildable.length} generated column(s) would be dropped before the apply and`));
 					out(chalk.gray("  rebuilt from search.sql after it — Postgres cannot retype a column"));
@@ -1146,7 +1537,7 @@ async function dbCommand(subcommand, rawArgs) {
 				if (unowned.length > 0) outWarn(formatForeignGeneratedColumnBanner(unowned));
 				if (destructive.length > 0) {
 					outWarn(chalk.yellow(`  ⚠️  ${destructive.length} of those DESTROY data:`));
-					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+					for (const line of destructiveLines(destructive)) outWarn(line);
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
 					outWarn("");
@@ -1157,72 +1548,106 @@ async function dbCommand(subcommand, rawArgs) {
 			}
 			if (unowned.length > 0) {
 				outError(formatForeignGeneratedColumnBanner(unowned));
-				process.exit(1);
+				throw new CommandStopped("A generated column Rebase does not own blocks the push.");
 			}
-			const allowDestructive = argsList["--allow-destructive"] === true || argsList["--yes"] === true;
+			const optIn = destructiveOptInFlag(argsList);
 			const decision = decidePushSafety({
 				destructiveCount: destructive.length,
-				allowDestructive,
+				allowDestructive: optIn !== void 0,
 				interactive: process.stdin.isTTY === true
 			});
 			if (destructive.length > 0) {
 				outWarn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
 				outWarn("");
-				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+				for (const line of destructiveLines(destructive)) outWarn(line);
 				outWarn("");
 				outWarn(chalk.yellow("  Full planned changes:"));
-				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				outWarn(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				outWarn("");
 				if (decision === "refuse") {
 					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
 					outError(chalk.gray("    Re-run interactively, or pass --allow-destructive to proceed. Back up first: rebase db backup"));
-					process.exit(1);
+					throw new CommandStopped("Destructive changes need confirmation.");
 				}
 				if (decision === "confirm") {
 					if (!await promptConfirm(chalk.yellow("  Type 'yes' to apply these destructive changes (this cannot be undone): "))) {
 						out(chalk.gray("  Aborted. No changes were made."));
-						process.exit(1);
+						throw new CommandStopped("The destructive push was declined.");
 					}
-				} else outWarn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
-			}
-			if (rebuildable.length > 0 && databaseUrl) {
-				for (const conflict of rebuildable) out(chalk.gray(`  Dropping ${describeConflict(conflict)} — it reads a column this push retypes.`));
-				await dropGeneratedColumns(databaseUrl, dropGeneratedColumnStatements(rebuildable));
+				} else outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
 			}
-			try {
-				await runAtlas("schema", [
-					"apply",
-					"--to",
-					"file://drizzle/schema.sql",
-					"--auto-approve"
-				], collectionsPath);
-			} catch (err) {
-				if (rebuildable.length > 0 && databaseUrl) {
+			await applyPushPlan({
+				dryRun: plan,
+				rebuildable: databaseUrl ? rebuildable.length : 0
+			}, {
+				dropRebuildable: async () => {
+					if (!databaseUrl) return;
+					for (const conflict of rebuildable) out(chalk.gray(`  Dropping ${describeConflict(conflict)} — it reads a column this push retypes.`));
+					await dropGeneratedColumns(databaseUrl, dropGeneratedColumnStatements(rebuildable));
+				},
+				atlasApply: async () => {
+					await runAtlas("schema", [
+						"apply",
+						"--to",
+						DESIRED_STATE_URL,
+						"--auto-approve"
+					], collectionsPath, { throwOnFailure: true });
+				},
+				reportSynced: () => out("Schema is synced, no changes to be made"),
+				rebuildAfterFailure: async () => {
+					if (!databaseUrl) return;
 					out(chalk.gray("  The apply failed — rebuilding the generated columns it needed out of the way."));
 					await applySearchDdl(databaseUrl);
+				},
+				afterApply: async () => {
+					out("");
+					if (!databaseUrl) {
+						outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
+						return;
+					}
+					await lockManagedTables(databaseUrl, collectionsPath);
+					await ensureAuthTables(databaseUrl, collectionsPath);
+					await applyVectorDdl(databaseUrl);
+					await applySearchDdl(databaseUrl);
+					await applyTriggersDdl(databaseUrl);
+					await applyPolicies(databaseUrl, collectionsPath);
+					await reconcilePolicies(databaseUrl, collectionsPath);
+					await ensureRlsUserRole(databaseUrl);
+					await retireLegacyAuthSchema(databaseUrl);
 				}
-				throw err;
-			}
-			out("");
-			if (databaseUrl) {
-				await ensureAuthTables(databaseUrl, collectionsPath);
-				await applyVectorDdl(databaseUrl);
-				await applySearchDdl(databaseUrl);
-				await applyTriggersDdl(databaseUrl);
-				await applyPolicies(databaseUrl);
-				await reconcilePolicies(databaseUrl, collectionsPath);
-				await ensureRlsUserRole(databaseUrl);
-				await retireLegacyAuthSchema(databaseUrl);
-			} else outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
+			});
 		} else if (subcommand === "migrate") {
 			const databaseUrl = process.env.DATABASE_URL;
-			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
 			const baseline = argsList["--baseline"];
-			if (baseline) {
-				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
+			const baselinePlan = baseline ? planBaseline(baseline, databaseUrl ? await latestRecordedMigration(databaseUrl) : null) : null;
+			const atlasBaseline = baselinePlan?.kind === "atlas-baseline" ? baseline : void 0;
+			if (argsList["--refuse-destructive"] === true) {
+				const plan = await runAtlas("migrate", [...migrateApplyArgs(argsList._, atlasBaseline), "--dry-run"], collectionsPath, { captureStdout: true });
+				const destructive = detectDestructiveStatements(plan, await columnTypesOrNone(databaseUrl), await constraintsOrNone(databaseUrl));
+				if (destructive.length > 0) {
+					outError(chalk.red(`  ✗ Refusing to migrate: the pending migrations include ${destructive.length} destructive change(s):`));
+					outError("");
+					for (const line of destructiveLines(destructive)) outError(line);
+					outError("");
+					outError(chalk.gray("    Nothing was applied. Run `rebase db migrate` without --refuse-destructive to apply them."));
+					outError(chalk.gray("    Back up first: rebase db backup"));
+					process.exit(1);
+				}
+				out(chalk.gray(`  --refuse-destructive: ${extractPlanStatements(plan).length} pending statement(s), none destructive.`));
 				out("");
 			}
-			await runAtlas("migrate", migrateApplyArgs(argsList._, baseline), collectionsPath);
+			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
+			if (baseline && baselinePlan) {
+				out(chalk.gray(`  ${describeBaselinePlan(baseline, baselinePlan)}`));
+				out("");
+				if (baselinePlan.kind === "set") await runAtlas("migrate", [
+					"set",
+					baseline,
+					"--dir",
+					"file://drizzle/migrations"
+				], collectionsPath);
+			}
+			await runAtlas("migrate", migrateApplyArgs(argsList._, atlasBaseline), collectionsPath);
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
@@ -1233,21 +1658,129 @@ async function dbCommand(subcommand, rawArgs) {
 		out("");
 	}
 }
+/**
+* Build, CONCURRENTLY and before Atlas plans, the derived foreign-key indexes
+* an existing table is missing — see `schema/push-index-prebuild.ts`. With
+* `dryRun`, only find them.
+*
+* Never fatal: an index not built here is one Atlas builds inside the push, as
+* it always did.
+*
+* @returns `schema.index` of each one missing when this started.
+*/
+/** Renames relation columns that carry their pre-0.13 derived name, as boot does; a dry-run only names them. */
+async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
+	let renames;
+	try {
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-5g9h3HOa.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+	} catch {
+		return;
+	}
+	if (renames.length === 0) return;
+	out(chalk.gray(dryRun ? `  ${renames.length} relation column(s) carry the name Rebase derived before 0.13; a push renames them first,` : `  Renaming ${renames.length} relation column(s) that carry the name Rebase derived before 0.13 (data, indexes and`));
+	out(chalk.gray(dryRun ? "  keeping their data (the plan below still shows them as a drop and an add, because nothing ran):" : "  constraints are kept — the same rename `rebase dev` runs):"));
+	for (const rename of renames) out(chalk.gray(`       ${rename.table}: "${rename.legacy}" → "${rename.expected}"`));
+	if (!dryRun) await withAppClient(databaseUrl, async (client) => {
+		for (const rename of renames) await client.query(rename.sql);
+	});
+	out(chalk.gray("  To keep an old name instead, name the column on the relation (`localKey`, or `through` on a many-to-many)."));
+	out("");
+}
+/** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
+async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
+	try {
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-Msq5gMcb.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
+	} catch {}
+}
+async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
+	let missing;
+	try {
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-C_qhyoJa.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+	} catch {
+		return [];
+	}
+	const names = missing.map((index) => `${index.schema}.${index.indexName}`);
+	if (missing.length === 0 || dryRun) return names;
+	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
+	try {
+		const { buildDeferredIndexes } = await import("./deferred-index-build-BqmEHGaD.js").then((n) => n.r);
+		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
+			dedicated: true,
+			query: async (text) => ({ rows: (await client.query(text)).rows }),
+			release: () => void 0
+		}), missing, { log: (message) => out(chalk.gray(`    ${message}`)) }));
+		for (const failure of outcome.failed) outWarn(chalk.yellow(`  ⚠️  ${failure.index} was not built ahead (${failure.error}); the push builds it inside its transaction instead.`));
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  The foreign-key indexes were not built ahead (${err instanceof Error ? err.message : String(err)}); the push builds them inside its transaction instead.`));
+	}
+	out("");
+	return names;
+}
 async function ensureAuthSchemaAndFunctions(databaseUrl) {
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			await client.query(RLS_BOOTSTRAP_SQL);
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Failed to bootstrap the RLS helper functions: ${err instanceof Error ? err.message : String(err)}`));
 	}
 }
 /**
+* Switch row-level security on for every table the collections declare, right
+* after Atlas has applied the schema.
+*
+* Atlas cannot carry `ENABLE ROW LEVEL SECURITY` in `schema.sql`: its free tier
+* neither plans it nor reads it back, so a table it creates is born with RLS
+* off — and `rebase_user`, the role every authenticated request runs as, holds
+* DML on it from that moment through the schema's default privileges. RLS used
+* to arrive with the policies, the last step of the push; a refusal from the
+* vector, search or trigger step in between left the new table readable and
+* writable by every caller, with no policy, until a later push or boot fixed
+* it — and a deployment with `REBASE_MIGRATE_ON_BOOT=none` never did. Locked
+* first, a failure later leaves a table that denies, not one that is open.
+*
+* Fatal when a table cannot be locked, and before the steps that follow: the
+* role provisioning at the end re-grants on every table in the schema, which
+* would undo the revoke that is the fallback here.
+*/
+async function lockManagedTables(databaseUrl, collectionsPath) {
+	let unsecured;
+	let userRole;
+	try {
+		const { lockCollectionTables } = await import("./ensure-collection-policies-Bb51V2OV.js");
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ The schema was applied, but row-level security could not be switched on for its tables: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("    A table this push created may be readable and writable by every authenticated request\n    until it is. Re-run `rebase db push` — it locks every collection table before anything else."));
+		process.exit(1);
+	}
+	if (unsecured.length === 0) return;
+	outError(chalk.red("\n  ✗ The schema was applied, but row-level security could not be switched on for:"));
+	for (const u of unsecured) {
+		outError(chalk.red(`      ${u.table}: ${u.error}`));
+		outError(chalk.gray(u.grantWithdrawn ? `        Its privileges were taken back from ${userRole}, so it is unreachable rather than unprotected.` : `        ${userRole} still holds its privileges: every authenticated request can read and write every row.`));
+	}
+	outError(chalk.gray("    Nothing after the schema apply ran. Fix the cause — the connection role must own these\n    tables, or be able to ALTER them — and run `rebase db push` again, or as their owner:"));
+	for (const u of unsecured) {
+		const [schema, ...table] = u.table.split(".");
+		outError(chalk.bold(`      ALTER TABLE "${schema}"."${table.join(".")}" ENABLE ROW LEVEL SECURITY;`));
+	}
+	process.exit(1);
+}
+/**
 * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
 * policies reference, before `applyPolicies` runs. Mirrors what the server does
 * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
@@ -1261,20 +1794,13 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Dhn9KM3B.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
-		const { Client } = await import("pg");
+		const { ensureAuthTablesExist } = await import("./ensure-tables-DMPWhJ6R.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
 		});
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await ensureAuthTablesExist(drizzle(client), authCollection);
-		} finally {
-			await client.end();
-		}
+		await withAppClient(databaseUrl, (client) => ensureAuthTablesExist(drizzle(client), authCollection));
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Failed to ensure framework auth tables: ${err instanceof Error ? err.message : String(err)}`));
 	}
@@ -1289,24 +1815,19 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-C6Xk0lA6.js").then((n) => n.a);
+		rls = await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
 	}
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			const runSql = async (text) => (await client.query(text)).rows;
 			if ((await rls.detectConnectionPosture(runSql)).privileged) {
 				await rls.ensureAppRole(runSql, schemas);
 				out(chalk.gray(`  ✓ RLS role "${rls.REBASE_USER_ROLE}" provisioned/refreshed.`));
 			}
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ The schema change was applied, but the "${rls.REBASE_USER_ROLE}" role could not be provisioned: ${err instanceof Error ? err.message : String(err)}`));
 		outError(chalk.gray(rls.appRoleSetupInstructions("your database user", schemas)));
@@ -1323,35 +1844,23 @@ async function ensureRlsUserRole(databaseUrl) {
 */
 async function retireLegacyAuthSchema(databaseUrl) {
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await dropLegacyAuthSchema(async (text) => (await client.query(text)).rows, {
-				info: (m) => out(chalk.gray(`  ${m}`)),
-				warn: (m) => outWarn(chalk.yellow(`  ⚠️  ${m}`))
-			});
-		} finally {
-			await client.end();
-		}
+		await withAppClient(databaseUrl, (client) => dropLegacyAuthSchema(async (text) => (await client.query(text)).rows, {
+			info: (m) => out(chalk.gray(`  ${m}`)),
+			warn: (m) => outWarn(chalk.yellow(`  ⚠️  ${m}`))
+		}));
 	} catch {}
 }
-async function applyPolicies(databaseUrl) {
+async function applyPolicies(databaseUrl, collectionsPath) {
 	try {
-		const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
+		const policiesPath = path.join(generatedSqlDir(), "policies.sql");
 		if (!fs.existsSync(policiesPath)) return;
 		out(chalk.gray("  Step 3/3: Applying RLS policies to database..."));
 		out("");
 		const policiesContent = fs.readFileSync(policiesPath, "utf-8");
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await client.query(policiesContent);
-			out(chalk.green("  ✓ RLS policies applied successfully."));
-		} finally {
-			await client.end();
-		}
+		const stamping = await policyStamping(databaseUrl, collectionsPath, policiesContent);
+		const { stampError } = await withAppClient(databaseUrl, (client) => applyPoliciesFile(client, policiesContent, stamping));
+		out(chalk.green("  ✓ RLS policies applied successfully."));
+		if (stampError) outWarn(chalk.yellow(`  ⚠️  The policies could not be stamped (${stampError}); the next boot applies them again.`));
 	} catch (err) {
 		const hint = diagnoseDbError(err, databaseUrl);
 		if (hint) outError(hint);
@@ -1360,6 +1869,25 @@ async function applyPolicies(databaseUrl) {
 	}
 }
 /**
+* The stamps a boot looks for, for the policies `policies.sql` is about to
+* create — see `applyPoliciesFile`. None when the collections cannot be read
+* here, which costs only the shortcut: the next boot re-applies, as before.
+*/
+async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
+	try {
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+		const { policyStampSql } = await import("./ensure-collection-policies-Bb51V2OV.js");
+		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		return {
+			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
+			searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public"
+		};
+	} catch {
+		return { statements: [] };
+	}
+}
+/**
 * Remove the policies an earlier push superseded but never dropped.
 *
 * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
@@ -1374,13 +1902,10 @@ async function applyPolicies(databaseUrl) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-DljYdrpW.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-BKC50y2p.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
 			const { dropped, kept } = await dropOrphanedPolicies(client, drift, collections);
 			for (const p of dropped) out(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
@@ -1388,7 +1913,8 @@ async function reconcilePolicies(databaseUrl, collectionsPath) {
 			if (kept.length > 0) {
 				outWarn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
 				for (const p of kept) outWarn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
-				outWarn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+				outWarn(chalk.yellow("       Each is still in force. To keep one, describe it in its collection's `securityRules`"));
+				outWarn(chalk.yellow("       (Studio's RLS view imports it); if it is stale, drop it by hand."));
 			}
 			const remaining = {
 				...drift,
@@ -1401,9 +1927,7 @@ async function reconcilePolicies(databaseUrl, collectionsPath) {
 					orphaned: []
 				}));
 			}
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
 	}
@@ -1456,10 +1980,12 @@ async function branchCommand(rawArgs) {
 		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
 		process.exit(1);
 	}
-	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-DGPL6G_C.js").then((n) => n.n);
+	const { DatabasePoolManager } = await import("./databasePoolManager-DZgnBOgj.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-UgKa416x.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
+	await checkDatabaseConnectivity(databaseUrl);
+	await closeAppClients();
 	const pool = new Pool({
 		connectionString: databaseUrl,
 		max: 3
@@ -1467,8 +1993,8 @@ async function branchCommand(rawArgs) {
 	const db = drizzle(pool);
 	const poolManager = new DatabasePoolManager(databaseUrl);
 	const branchService = new BranchService(db, poolManager);
-	await branchService.ensureBranchMetadataTable();
 	try {
+		if (branchAction === "create" || branchAction === "delete" || branchAction === "prune") await branchService.ensureBranchMetadataTable();
 		switch (branchAction) {
 			case "create": {
 				const name = rawArgs[3];
@@ -1498,7 +2024,7 @@ async function branchCommand(rawArgs) {
 				break;
 			}
 			case "list": {
-				const branches = await branchService.listBranches();
+				const branches = await branchService.hasBranchRegistry() ? await branchService.listBranches() : [];
 				out("");
 				if (branches.length === 0) out(chalk.gray("  No branches found. Create one with: rebase db branch create <name>"));
 				else {
@@ -1535,7 +2061,7 @@ async function branchCommand(rawArgs) {
 					out(chalk.gray("  Usage: rebase db branch info <name>"));
 					process.exit(1);
 				}
-				const info = await branchService.getBranchInfo(name);
+				const info = await branchService.hasBranchRegistry() ? await branchService.getBranchInfo(name) : void 0;
 				out("");
 				if (!info) {
 					outError(chalk.red(`  ✗ Branch "${name}" not found.`));
@@ -1590,6 +2116,12 @@ async function branchCommand(rawArgs) {
 				else if (plan.devDiff.length > 0) out(chalk.gray(`  (${plan.devDiff.length} Atlas scratch database(s) not listed — --include-dev-diff)`));
 				out("");
 				if (parsed["--yes"] !== true) {
+					if (!process.stdin.isTTY) {
+						outError(chalk.red("  ✗ Nothing was pruned: there is no terminal to confirm on."));
+						outError(chalk.gray("    Re-run with --yes to remove what is listed above."));
+						outError("");
+						process.exit(1);
+					}
 					if (!await promptConfirm("  Remove these? (y/N) ")) {
 						out(chalk.gray("  Nothing was changed."));
 						out("");
@@ -1688,6 +2220,13 @@ function timeAgo(date) {
 	return formatRelativeTime(date, { maxMs: Number.POSITIVE_INFINITY }) ?? "unknown";
 }
 /**
+* Whether DATABASE_URL is the managed development database (PGlite), as the
+* CLI resolved it and says in `REBASE_DEV_DATABASE_KIND`.
+*/
+function managedDatabase() {
+	return process.env.REBASE_DEV_DATABASE_KIND === "managed";
+}
+/**
 * The Atlas scratch database this process created, dropped once the db
 * command that needed it succeeds — see `ScratchDatabase`.
 */
@@ -1746,8 +2285,15 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 		process.exit(1);
 	}
 	await checkDatabaseConnectivity(databaseUrl);
-	const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
-	if (takesDevUrl(domain, args)) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
+	let devDatabase;
+	try {
+		devDatabase = atlasDevDatabaseUrl(databaseUrl, env);
+	} catch (err) {
+		outError(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	const devDatabaseUrl = devDatabase.url;
+	if (takesDevUrl(domain, args) && !devDatabase.named) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
 	const atlasUrl = forLibpq(databaseUrl);
 	const atlasDevUrl = forLibpq(devDatabaseUrl);
 	const excludes = [];
@@ -1764,7 +2310,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop tables Rebase does not manage."));
 				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
 				if (hint) outError(hint);
-				process.exit(1);
+				throw new CommandStopped("Could not determine which tables to protect.");
 			}
 			throw err;
 		}
@@ -1777,18 +2323,35 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop an index Rebase does not manage."));
 				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
 				if (hint) outError(hint);
-				process.exit(1);
+				throw new CommandStopped("Could not determine which indexes to protect.");
+			}
+			throw err;
+		}
+		try {
+			const desiredSqlFile = path.join(generatedSqlDir(), "schema.sql");
+			const desiredSql = fs.existsSync(desiredSqlFile) ? fs.readFileSync(desiredSqlFile, "utf-8") : "";
+			excludes.push(...await getUndeclaredConstraintExcludes(databaseUrl, desiredSql));
+		} catch (err) {
+			if (err instanceof ExcludeIntrospectionError) {
+				outError(chalk.red("\n✗ Aborting push: could not determine which constraints to protect."));
+				outError(chalk.gray(`  ${err.message}`));
+				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop a CHECK or EXCLUDE constraint the database enforces."));
+				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+				if (hint) outError(hint);
+				throw new CommandStopped("Could not determine which constraints to protect.");
 			}
 			throw err;
 		}
 	}
-	const subprocess = execa(atlasBin, buildAtlasArgs({
+	const atlasArgs = buildAtlasArgs({
 		domain,
 		args,
 		url: atlasUrl,
 		devUrl: atlasDevUrl,
 		excludes
-	}), {
+	});
+	if (managedDatabase()) await closeAppClients();
+	const subprocess = execa(atlasBin, atlasArgs, {
 		cwd: process.cwd(),
 		stdout: opts.captureStdout ? "pipe" : "inherit",
 		stderr: "pipe",
@@ -1802,26 +2365,29 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	subprocess.stderr?.on("data", (chunk) => {
 		const text = chunk.toString();
 		stderrText += text;
-		process.stderr.write(text);
+		process.stderr.write(redactConnectionPasswords(text));
 	});
 	try {
 		await subprocess;
 	} catch {
+		scratchDatabase.keepAsEvidence();
 		outError(chalk.red(`\n✗ atlas ${domain} ${args.join(" ")} failed.\n`));
 		const hint = await diagnoseAtlasFailure({
 			domain,
 			args,
 			stderr: stderrText,
 			databaseUrl,
-			latestMigrationVersion: latestMigrationVersion()
+			latestMigrationVersion: latestMigrationVersion(),
+			managedDatabase: managedDatabase()
 		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
 		if (hint) outError(hint);
+		if (opts.throwOnFailure) throw Object.assign(/* @__PURE__ */ new Error(`atlas ${domain} ${args.join(" ")} failed`), { alreadyReported: true });
 		process.exit(1);
 	}
 	if (opts.captureStdout) return stdoutText.trim().length > 0 ? stdoutText : stderrText;
 	return "";
 }
-async function generatePostgresDdlCommand(rawArgs) {
+async function generatePostgresDdlCommand(rawArgs, options = {}) {
 	const argsList = (0, import_arg.default)({
 		"--collections": String,
 		"--output": String,
@@ -1831,16 +2397,31 @@ async function generatePostgresDdlCommand(rawArgs) {
 		argv: rawArgs.slice(2),
 		permissive: true
 	});
-	const ddl = resolveChildScript("generate-postgres-ddl");
-	if (!ddl.ok) {
+	const ddl = generatesInProcess() ? void 0 : resolveChildScript("generate-postgres-ddl");
+	if (ddl && !ddl.ok) {
 		outError(chalk.red(childScriptError("DDL generator", ddl.reason)));
 		process.exit(1);
 	}
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-	const outputPath = argsList["--output"] || path.join("drizzle", "schema.sql");
+	const outputPath = argsList["--output"] || path.join(".rebase/sql", "schema.sql");
+	if (!argsList["--output"]) {
+		const retire = options.retireLegacyCopies !== false;
+		const retired = prepareGeneratedSqlDir(process.cwd(), { retire });
+		if (retired.length > 0 && !retire) out(chalk.gray(`  The next \`rebase db push\` or \`rebase db generate\` removes the old copies an earlier release committed:\n    ${retired.join(", ")}`));
+		else if (retired.length > 0) out(chalk.gray(`  Generated SQL is written to ${GENERATED_SQL_DIR}/ now, which is not committed. Removed the old copies — commit the deletion:\n    ${retired.join(", ")}`));
+	}
+	if (!ddl) {
+		await generateInProcess("Postgres DDL generator", "Postgres DDL", async ({ writePostgresDdl }) => {
+			await writePostgresDdl({
+				collectionsPath: path.resolve(process.cwd(), collectionsPath),
+				outputPath: path.resolve(process.cwd(), outputPath)
+			});
+		});
+		return;
+	}
 	const cmdParts = [
 		ddl.bin,
-		ddl.script,
+		...ddl.args,
 		`--collections=${collectionsPath}`,
 		`--output=${outputPath}`
 	];
@@ -1889,9 +2470,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
-	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-BfzK7UQd.js").then((n) => n.n);
+	const { loadCollections } = await import("./doctor-CUAAOFZm.js").then((n) => n.t);
+	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-BWN_PsMi.js").then((n) => n.r);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-BaT0H7Gq.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];
@@ -1904,6 +2485,7 @@ async function schemaStaleCommand(rawArgs) {
 		if (postgresCollections.length > 0) differences = compareGeneratedDeclarations(generateSchema(postgresCollections), onDisk);
 	} catch (err) {
 		unreadable = err instanceof Error ? err.message : String(err);
+		const { logger } = await import("@rebasepro/server");
 		logger.debug(`schema stale: skipped (${unreadable})`);
 	}
 	const verdict = staleVerdict({
@@ -1928,7 +2510,7 @@ async function schemaStaleCommand(rawArgs) {
 		`--output=${outputPath}`
 	]);
 }
-async function schemaCommand(subcommand, rawArgs) {
+async function schemaCommand(subcommand, rawArgs, options = {}) {
 	if (subcommand && (rawArgs.includes("--help") || rawArgs.includes("-h"))) {
 		out("");
 		out(chalk.bold(`  rebase schema ${subcommand}`));
@@ -1953,24 +2535,38 @@ async function schemaCommand(subcommand, rawArgs) {
 			argv: rawArgs.slice(2),
 			permissive: true
 		});
+		const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+		const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
+		const watch = argsList["--watch"] || false;
+		if (!watch && generatesInProcess()) {
+			out("");
+			out(chalk.bold("  🔧 Rebase Schema Generator"));
+			out("");
+			await generateInProcess("schema generator", "Drizzle schema", async ({ writeDrizzleSchema }) => {
+				await writeDrizzleSchema({
+					collectionsPath: path.resolve(process.cwd(), collectionsPath),
+					outputPath: path.resolve(process.cwd(), outputPath),
+					nextStep: options.nextStep
+				});
+			});
+			return;
+		}
 		const generator = resolveChildScript("generate-drizzle-schema");
 		if (!generator.ok) {
 			outError(chalk.red(childScriptError("schema generator", generator.reason)));
 			process.exit(1);
 		}
-		const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-		const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
-		const watch = argsList["--watch"] || false;
 		out("");
 		out(chalk.bold("  🔧 Rebase Schema Generator"));
 		out("");
 		const cmdParts = [
 			generator.bin,
-			generator.script,
+			...generator.args,
 			`--collections=${collectionsPath}`,
 			`--output=${outputPath}`
 		];
 		if (watch) cmdParts.push("--watch");
+		if (options.nextStep === false) cmdParts.push("--no-next-step");
 		try {
 			await execa(cmdParts[0], cmdParts.slice(1), {
 				cwd: process.cwd(),
@@ -2007,7 +2603,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		out("");
 		const cmdParts = [
 			introspect.bin,
-			introspect.script,
+			...introspect.args,
 			`--output=${outputPath}`,
 			...argsList["--force"] ? ["--force"] : [],
 			...argsList["--schema"] ? [`--schema=${argsList["--schema"]}`] : []
@@ -2019,7 +2615,7 @@ async function schemaCommand(subcommand, rawArgs) {
 				env: { ...process.env }
 			});
 		} catch (err) {
-			outError(chalk.red(`✗ Failed to run schema introspector: ${err instanceof Error ? err.message : String(err)}`));
+			if (typeof (typeof err === "object" && err !== null ? Reflect.get(err, "exitCode") : void 0) !== "number") outError(chalk.red(`✗ Failed to run schema introspector: ${err instanceof Error ? err.message : String(err)}`));
 			process.exit(1);
 		}
 	} else {
@@ -2050,7 +2646,7 @@ async function doctorPluginCommand(rawArgs) {
 	const sdkPath = parsedArgs["--sdk"] || path.join("..", "generated", "sdk", "database.types.ts");
 	const cmdParts = [
 		doctor.bin,
-		doctor.script,
+		...doctor.args,
 		`--collections=${collectionsPath}`,
 		`--schema=${schemaPath}`,
 		`--sdk=${sdkPath}`,