@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/{rls-bootstrap-sql-B8EclDyM.js → rls-bootstrap-sql-Bd-hJk08.js}

@@ -1,86 +1,23 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM, i as __require, n as __commonJSMin, r as __exportAll, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
-import { o as isRebaseIndexName } from "./collection-index-DdnsxiJ_.js";
-import { r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
+import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-V7rFbMRe.js";
 import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
 import { sqlRows } from "@rebasepro/common";
-import fs from "fs";
-import path from "path";
+import process$1, { execArgv, execPath, hrtime, platform } from "node:process";
+import { constants } from "node:os";
+import tty from "node:tty";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
 import { aborted, callbackify, debuglog, inspect, promisify, stripVTControlCharacters } from "node:util";
-import process$1, { execArgv, execPath, hrtime, platform } from "node:process";
-import tty from "node:tty";
-import path$1 from "node:path";
-import { execSync } from "child_process";
+import path from "node:path";
 import { scheduler, setImmediate, setTimeout } from "node:timers/promises";
-import { constants } from "node:os";
 import { EventEmitter, addAbortListener, on, once, setMaxListeners } from "node:events";
 import { serialize } from "node:v8";
 import { appendFileSync, createReadStream, createWriteStream, readFileSync, statSync, writeFileSync } from "node:fs";
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
-import { createRequire } from "module";
-import { fileURLToPath as fileURLToPath$1, pathToFileURL } from "url";
-//#region src/utils/connection-string.ts
-/**
-* Connection-string rewrites for the tools Rebase shells out to.
-*
-* Pure and dependency-free: `pg-tools` builds argument vectors without a live
-* server, and these have to be usable from there.
-*/
-/**
-* The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
-*/
-var LIBPQ_SSLMODES = /* @__PURE__ */ new Set([
-	"disable",
-	"allow",
-	"prefer",
-	"require",
-	"verify-ca",
-	"verify-full"
-]);
-/**
-* Make a connection string safe to hand to a libpq program.
-*
-* `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
-* the certificate — and libpq does not have it. It does not degrade or warn:
-*
-*     psql: error: invalid sslmode value: "no-verify"
-*
-* which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
-* `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
-* points at the value rather than at the convention it comes from. It has cost
-* this project time more than once.
-*
-* `require` is the honest translation: libpq's `require` encrypts and does not
-* verify the certificate either, which is exactly what `no-verify` asks for.
-* Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
-* alone, so a connection string that asked for verification still gets it.
-*
-* Only `sslmode` is touched, and only when it is a value libpq would reject.
-* Anything unparseable is returned as given: a connection that works
-* unverified beats one this corrupted.
-*/
-function forLibpq(connectionString) {
-	let url;
-	try {
-		url = new URL(connectionString);
-	} catch {
-		return connectionString;
-	}
-	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
-	const sslmode = url.searchParams.get("sslmode");
-	if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
-	url.searchParams.set("sslmode", "require");
-	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
-	return url.toString();
-}
-//#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -851,7 +788,7 @@ var handleCommand = (filePath, rawArguments, rawOptions) => {
 var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = isexe;
 	isexe.sync = sync;
-	var fs$3 = __require("fs");
+	var fs$2 = __require("fs");
 	function checkPathExt(path, options) {
 		var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
 		if (!pathext) return true;
@@ -868,12 +805,12 @@ var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		return checkPathExt(path, options);
 	}
 	function isexe(path, options, cb) {
-		fs$3.stat(path, function(er, stat) {
+		fs$2.stat(path, function(er, stat) {
 			cb(er, er ? false : checkStat(stat, path, options));
 		});
 	}
 	function sync(path, options) {
-		return checkStat(fs$3.statSync(path), path, options);
+		return checkStat(fs$2.statSync(path), path, options);
 	}
 }));
 //#endregion
@@ -881,14 +818,14 @@ var require_windows = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 var require_mode = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = isexe;
 	isexe.sync = sync;
-	var fs$2 = __require("fs");
+	var fs$1 = __require("fs");
 	function isexe(path, options, cb) {
-		fs$2.stat(path, function(er, stat) {
+		fs$1.stat(path, function(er, stat) {
 			cb(er, er ? false : checkStat(stat, options));
 		});
 	}
 	function sync(path, options) {
-		return checkStat(fs$2.statSync(path), options);
+		return checkStat(fs$1.statSync(path), options);
 	}
 	function checkStat(stat, options) {
 		return stat.isFile() && checkMode(stat, options);
@@ -952,7 +889,7 @@ var require_isexe = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#region ../../node_modules/.pnpm/which@2.0.2/node_modules/which/which.js
 var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var isWindows = process.platform === "win32" || process.env.OSTYPE === "cygwin" || process.env.OSTYPE === "msys";
-	var path$4 = __require("path");
+	var path$3 = __require("path");
 	var COLON = isWindows ? ";" : ":";
 	var isexe = require_isexe();
 	var getNotFoundError = (cmd) => Object.assign(/* @__PURE__ */ new Error(`not found: ${cmd}`), { code: "ENOENT" });
@@ -982,7 +919,7 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 			if (i === pathEnv.length) return opt.all && found.length ? resolve(found) : reject(getNotFoundError(cmd));
 			const ppRaw = pathEnv[i];
 			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-			const pCmd = path$4.join(pathPart, cmd);
+			const pCmd = path$3.join(pathPart, cmd);
 			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
 			resolve(subStep(p, i, 0));
 		});
@@ -1004,7 +941,7 @@ var require_which = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		for (let i = 0; i < pathEnv.length; i++) {
 			const ppRaw = pathEnv[i];
 			const pathPart = /^".*"$/.test(ppRaw) ? ppRaw.slice(1, -1) : ppRaw;
-			const pCmd = path$4.join(pathPart, cmd);
+			const pCmd = path$3.join(pathPart, cmd);
 			const p = !pathPart && /^\.[\\\/]/.test(cmd) ? cmd.slice(0, 2) + pCmd : pCmd;
 			for (let j = 0; j < pathExt.length; j++) {
 				const cur = p + pathExt[j];
@@ -1035,7 +972,7 @@ var require_path_key = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/resolveCommand.js
 var require_resolveCommand = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$3 = __require("path");
+	var path$2 = __require("path");
 	var which = require_which();
 	var getPathKey = require_path_key();
 	function resolveCommandAttempt(parsed, withoutPathExt) {
@@ -1050,12 +987,12 @@ var require_resolveCommand = /* @__PURE__ */ __commonJSMin(((exports, module) =>
 		try {
 			resolved = which.sync(parsed.command, {
 				path: env[getPathKey({ env })],
-				pathExt: withoutPathExt ? path$3.delimiter : void 0
+				pathExt: withoutPathExt ? path$2.delimiter : void 0
 			});
 		} catch (e) {} finally {
 			if (shouldSwitchCwd) process.chdir(cwd);
 		}
-		if (resolved) resolved = path$3.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
+		if (resolved) resolved = path$2.resolve(hasCustomCwd ? parsed.options.cwd : "", resolved);
 		return resolved;
 	}
 	function resolveCommand(parsed) {
@@ -1104,16 +1041,16 @@ var require_shebang_command = /* @__PURE__ */ __commonJSMin(((exports, module) =
 //#endregion
 //#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js
 var require_readShebang = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var fs$1 = __require("fs");
+	var fs = __require("fs");
 	var shebangCommand = require_shebang_command();
 	function readShebang(command) {
 		const size = 150;
 		const buffer = Buffer.alloc(size);
 		let fd;
 		try {
-			fd = fs$1.openSync(command, "r");
-			fs$1.readSync(fd, buffer, 0, size, 0);
-			fs$1.closeSync(fd);
+			fd = fs.openSync(command, "r");
+			fs.readSync(fd, buffer, 0, size, 0);
+			fs.closeSync(fd);
 		} catch (e) {}
 		return shebangCommand(buffer.toString());
 	}
@@ -1122,7 +1059,7 @@ var require_readShebang = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 //#endregion
 //#region ../../node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/parse.js
 var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var path$2 = __require("path");
+	var path$1 = __require("path");
 	var resolveCommand = require_resolveCommand();
 	var escape = require_escape();
 	var readShebang = require_readShebang();
@@ -1145,7 +1082,7 @@ var require_parse = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		const needsShell = !isExecutableRegExp.test(commandFile);
 		if (parsed.options.forceShell || needsShell) {
 			const needsDoubleEscapeMetaChars = isCmdShimRegExp.test(commandFile);
-			parsed.command = path$2.normalize(parsed.command);
+			parsed.command = path$1.normalize(parsed.command);
 			parsed.command = escape.command(parsed.command);
 			parsed.args = parsed.args.map((arg) => escape.argument(arg, needsDoubleEscapeMetaChars));
 			parsed.args = [
@@ -1254,33 +1191,33 @@ function toPath(urlOrPath) {
 }
 function traversePathUp(startPath) {
 	return { *[Symbol.iterator]() {
-		let currentPath = path$1.resolve(toPath(startPath));
+		let currentPath = path.resolve(toPath(startPath));
 		let previousPath;
 		while (previousPath !== currentPath) {
 			yield currentPath;
 			previousPath = currentPath;
-			currentPath = path$1.resolve(currentPath, "..");
+			currentPath = path.resolve(currentPath, "..");
 		}
 	} };
 }
 //#endregion
 //#region ../../node_modules/.pnpm/npm-run-path@6.0.0/node_modules/npm-run-path/index.js
 var npmRunPath = ({ cwd = process$1.cwd(), path: pathOption = process$1.env[pathKey()], preferLocal = true, execPath = process$1.execPath, addExecPath = true } = {}) => {
-	const cwdPath = path$1.resolve(toPath(cwd));
+	const cwdPath = path.resolve(toPath(cwd));
 	const result = [];
-	const pathParts = pathOption.split(path$1.delimiter);
+	const pathParts = pathOption.split(path.delimiter);
 	if (preferLocal) applyPreferLocal(result, pathParts, cwdPath);
 	if (addExecPath) applyExecPath(result, pathParts, execPath, cwdPath);
-	return pathOption === "" || pathOption === path$1.delimiter ? `${result.join(path$1.delimiter)}${pathOption}` : [...result, pathOption].join(path$1.delimiter);
+	return pathOption === "" || pathOption === path.delimiter ? `${result.join(path.delimiter)}${pathOption}` : [...result, pathOption].join(path.delimiter);
 };
 var applyPreferLocal = (result, pathParts, cwdPath) => {
 	for (const directory of traversePathUp(cwdPath)) {
-		const pathPart = path$1.join(directory, "node_modules/.bin");
+		const pathPart = path.join(directory, "node_modules/.bin");
 		if (!pathParts.includes(pathPart)) result.push(pathPart);
 	}
 };
 var applyExecPath = (result, pathParts, execPath, cwdPath) => {
-	const pathPart = path$1.resolve(cwdPath, toPath(execPath), "..");
+	const pathPart = path.resolve(cwdPath, toPath(execPath), "..");
 	if (!pathParts.includes(pathPart)) result.push(pathPart);
 };
 var npmRunPathEnv = ({ env = process$1.env, ...options } = {}) => {
@@ -2290,7 +2227,7 @@ var mapNode = ({ options }) => {
 var handleNodeOption = (file, commandArguments, { node: shouldHandleNode = false, nodePath = execPath, nodeOptions = execArgv.filter((nodeOption) => !nodeOption.startsWith("--inspect")), cwd, execPath: formerNodePath, ...options }) => {
 	if (formerNodePath !== void 0) throw new TypeError("The \"execPath\" option has been removed. Please use the \"nodePath\" option instead.");
 	const normalizedNodePath = safeNormalizeFileUrl(nodePath, "The \"nodePath\" option");
-	const resolvedNodePath = path$1.resolve(cwd, normalizedNodePath);
+	const resolvedNodePath = path.resolve(cwd, normalizedNodePath);
 	const newOptions = {
 		...options,
 		nodePath: resolvedNodePath,
@@ -2302,7 +2239,7 @@ var handleNodeOption = (file, commandArguments, { node: shouldHandleNode = false
 		commandArguments,
 		newOptions
 	];
-	if (path$1.basename(file, ".exe") === "node") throw new TypeError("When the \"node\" option is true, the first argument does not need to be \"node\".");
+	if (path.basename(file, ".exe") === "node") throw new TypeError("When the \"node\" option is true, the first argument does not need to be \"node\".");
 	return [
 		resolvedNodePath,
 		[
@@ -2386,7 +2323,7 @@ var serializeEncoding = (encoding) => typeof encoding === "string" ? `"${encodin
 //#region ../../node_modules/.pnpm/execa@9.6.1/node_modules/execa/lib/arguments/cwd.js
 var normalizeCwd = (cwd = getDefaultCwd()) => {
 	const cwdString = safeNormalizeFileUrl(cwd, "The \"cwd\" option");
-	return path$1.resolve(cwdString);
+	return path.resolve(cwdString);
 };
 var getDefaultCwd = () => {
 	try {
@@ -2424,7 +2361,7 @@ var normalizeOptions = (filePath, rawArguments, rawOptions) => {
 	options.killSignal = normalizeKillSignal(options.killSignal);
 	options.forceKillAfterDelay = normalizeForceKillAfterDelay(options.forceKillAfterDelay);
 	options.lines = options.lines.map((lines, fdNumber) => lines && !BINARY_ENCODINGS.has(options.encoding) && options.buffer[fdNumber]);
-	if (process$1.platform === "win32" && path$1.basename(file, ".exe") === "cmd") commandArguments.unshift("/q");
+	if (process$1.platform === "win32" && path.basename(file, ".exe") === "cmd") commandArguments.unshift("/q");
 	return {
 		file,
 		commandArguments,
@@ -6252,1007 +6189,6 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
-//#region src/schema/destructive-sql.ts
-var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
-/**
-* Pure helpers that classify an Atlas declarative-apply plan as destructive
-* or not, and decide what `rebase db push` should do about it.
-*
-* `db push` runs `atlas schema apply` to make the live database match the
-* generated `schema.sql`. Removing a collection field compiles to
-* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
-* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
-* here, and refuse to auto-approve anything destructive without an explicit
-* opt-in.
-*
-* A type change is the one destructive plan that names no DROP. `ALTER COLUMN
-* "price" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away
-* every timestamp's time of day, in a statement that reads like a routine
-* alter. So a type change is gated too, unless it is a widening every value
-* survives unchanged — which needs the column's current type, read from the
-* catalogue by the caller.
-*
-* Everything in this file is side-effect free so it can be unit-tested
-* without Atlas or a database.
-*/
-/**
-* SQL fragments that destroy data or data-bearing objects. Matched
-* case-insensitively against each statement of the plan. `IF EXISTS` /
-* whitespace variations are tolerated by the regexes below.
-*/
-var DESTRUCTIVE_PATTERNS = [
-	{
-		label: "DROP TABLE",
-		re: /\bDROP\s+TABLE\b/i
-	},
-	{
-		label: "DROP COLUMN",
-		re: /\bDROP\s+COLUMN\b/i
-	},
-	{
-		label: "DROP SCHEMA",
-		re: /\bDROP\s+SCHEMA\b/i
-	},
-	{
-		label: "DROP VIEW",
-		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
-	},
-	{
-		label: "DROP TYPE",
-		re: /\bDROP\s+TYPE\b/i
-	},
-	{
-		label: "TRUNCATE",
-		re: /\bTRUNCATE\b/i
-	}
-];
-/**
-* Split a SQL script into individual statements, dropping blank lines and
-* `--` comment lines. Deliberately simple: Atlas emits one plain statement
-* per `;`, without string literals that contain semicolons in a schema DDL
-* plan, so a naive split is safe and keeps this dependency-free.
-*/
-function splitSqlStatements(sql) {
-	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-/**
-* Every column of every ordinary table outside the system schemas, with its
-* type. What {@link detectDestructiveStatements} compares a planned type
-* change against; `format_type` because it carries the modifier (`(255)`,
-* `(10,2)`) that decides whether a change widens or narrows.
-*/
-var COLUMN_TYPES_SQL = `
-    SELECT n.nspname AS "schema",
-           c.relname AS "table",
-           a.attname AS "column",
-           format_type(a.atttypid, a.atttypmod) AS "type"
-    FROM pg_attribute a
-    JOIN pg_class c     ON c.oid = a.attrelid
-    JOIN pg_namespace n ON n.oid = c.relnamespace
-    WHERE c.relkind IN ('r', 'p')
-      AND a.attnum > 0
-      AND NOT a.attisdropped
-      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
-      AND n.nspname NOT LIKE 'pg\\_%'
-`;
-/**
-* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
-* the statements that would destroy data. An empty array means the plan is
-* safe to auto-approve.
-*
-* `columnTypes` is what the database holds now. A type change to a column it
-* does not list is flagged: not knowing what a column is means not knowing
-* whether the change keeps its values.
-*/
-function detectDestructiveStatements(planSql, columnTypes = []) {
-	const found = [];
-	for (const statement of splitSqlStatements(planSql)) {
-		const dropped = DESTRUCTIVE_PATTERNS.find(({ re }) => re.test(statement));
-		if (dropped) {
-			found.push({
-				statement,
-				kind: dropped.label
-			});
-			continue;
-		}
-		const lossy = parseColumnTypeChanges(statement).map((change) => ({
-			change,
-			from: currentTypeOf(change, columnTypes)
-		})).filter(({ change, from }) => from === void 0 || !isLosslessTypeChange(from, change.to));
-		if (lossy.length > 0) found.push({
-			statement,
-			kind: "ALTER COLUMN TYPE",
-			detail: lossy.map(({ change, from }) => `"${change.column}" ${from ?? "(current type unknown)"} → ${change.to}`).join("; ")
-		});
-	}
-	return found;
-}
-var IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)`;
-var ALTER_TABLE_RE = new RegExp(String.raw`^ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${IDENT})(?:\.(${IDENT}))?\s+([\s\S]*)$`, "i");
-var TYPE_CLAUSE_RE = new RegExp(String.raw`^ALTER\s+(?:COLUMN\s+)?(${IDENT})\s+(?:SET\s+DATA\s+)?TYPE\s+([\s\S]+)$`, "i");
-var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1).replace(/""/g, "\"") : ident;
-/**
-* Split an `ALTER TABLE`'s clause list on its top-level commas — the ones
-* outside parentheses and quotes, so `TYPE numeric(10, 2)` stays one clause.
-*/
-function splitClauses(body) {
-	const clauses = [];
-	let depth = 0;
-	let quote;
-	let start = 0;
-	for (let i = 0; i < body.length; i++) {
-		const ch = body[i];
-		if (quote) {
-			if (ch === quote) quote = void 0;
-		} else if (ch === "\"" || ch === "'") quote = ch;
-		else if (ch === "(") depth++;
-		else if (ch === ")") depth--;
-		else if (ch === "," && depth === 0) {
-			clauses.push(body.slice(start, i).trim());
-			start = i + 1;
-		}
-	}
-	clauses.push(body.slice(start).trim());
-	return clauses.filter((clause) => clause.length > 0);
-}
-/**
-* Every `ALTER COLUMN … [SET DATA] TYPE` in one statement. Atlas prints its
-* dry-run statements under a `-> ` marker and puts several clauses in one
-* `ALTER TABLE`, so both are handled.
-*/
-function parseColumnTypeChanges(statement) {
-	const table = ALTER_TABLE_RE.exec(statement.replace(/^\s*->\s*/, "").trim());
-	if (!table) return [];
-	const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
-	const changes = [];
-	for (const clause of splitClauses(table[3])) {
-		const match = TYPE_CLAUSE_RE.exec(clause);
-		if (!match) continue;
-		const to = match[2].split(/\s+(?:USING|COLLATE)\s/i)[0].trim();
-		changes.push({
-			schema,
-			table: name,
-			column: unquote(match[1]),
-			to
-		});
-	}
-	return changes;
-}
-/**
-* The column's current type. A table named without its schema matches in any
-* schema, but only when every match agrees — two same-named tables with
-* different types leave the answer unknown.
-*/
-function currentTypeOf(change, columnTypes) {
-	const types = new Set(columnTypes.filter((col) => col.table === change.table && col.column === change.column && (change.schema === void 0 || col.schema === change.schema)).map((col) => col.type));
-	return types.size === 1 ? [...types][0] : void 0;
-}
-/** Spellings of one type, mapped to one name. Anything absent compares verbatim. */
-var TYPE_ALIASES = {
-	"int": "integer",
-	"int4": "integer",
-	"int2": "smallint",
-	"int8": "bigint",
-	"character varying": "varchar",
-	"decimal": "numeric",
-	"timestamp without time zone": "timestamp",
-	"timestamp with time zone": "timestamptz",
-	"time without time zone": "time",
-	"time with time zone": "timetz",
-	"bool": "boolean",
-	"float4": "real",
-	"float8": "double precision",
-	"character": "bpchar",
-	"char": "bpchar"
-};
-/** Decimal digits each integer type holds, which is what a `numeric` must hold too. */
-var INTEGER_DIGITS = {
-	smallint: 5,
-	integer: 10,
-	bigint: 19
-};
-/** Types whose modifier is a fractional-seconds precision, 6 when absent. */
-var SECONDS_PRECISION = /* @__PURE__ */ new Set([
-	"timestamp",
-	"timestamptz",
-	"time",
-	"timetz"
-]);
-function parseType(raw) {
-	let text = raw.trim().replace(/\s+/g, " ");
-	let dims = 0;
-	for (let suffix = /\s*\[\d*\]$/.exec(text); suffix; suffix = /\s*\[\d*\]$/.exec(text)) {
-		dims++;
-		text = text.slice(0, suffix.index);
-	}
-	if (text.includes("\"")) return {
-		base: text,
-		dims
-	};
-	text = text.toLowerCase().replace(/^pg_catalog\./, "");
-	let args;
-	const modifier = /\(([^)]*)\)/.exec(text);
-	if (modifier) {
-		args = modifier[1].split(",").map((part) => Number(part.trim()));
-		text = `${text.slice(0, modifier.index)} ${text.slice(modifier.index + modifier[0].length)}`.replace(/\s+/g, " ").trim();
-	}
-	return {
-		base: TYPE_ALIASES[text] ?? text,
-		args,
-		dims
-	};
-}
-/** Does moving from one modifier to another, on the same type, keep every value? */
-function modifierWidens(base, from, to) {
-	if (JSON.stringify(from) === JSON.stringify(to)) return true;
-	if (base === "varchar") return to === void 0 || from !== void 0 && to[0] >= from[0];
-	if (base === "numeric") {
-		if (to === void 0) return true;
-		if (from === void 0) return false;
-		const [p1, s1 = 0] = from;
-		const [p2, s2 = 0] = to;
-		return s2 >= s1 && p2 - s2 >= p1 - s1;
-	}
-	if (SECONDS_PRECISION.has(base)) return (to?.[0] ?? 6) >= (from?.[0] ?? 6);
-	return false;
-}
-/**
-* Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly
-* as it was?
-*
-* Deliberately short. Everything not listed needs a confirmation, including
-* changes that are usually harmless: `timestamp` → `timestamptz` reads each
-* value in the session's time zone, `json` → `jsonb` drops duplicate keys,
-* `real` → `double precision` prints 0.1 as 0.100000001490116, and `integer` →
-* `text` keeps the digits but changes what the column is.
-*
-*  - the same type, with a modifier at least as wide (`varchar(100)` →
-*    `varchar(255)`, `numeric(10,2)` → `numeric(12,2)` or unbounded,
-*    `timestamptz(3)` → `timestamptz`);
-*  - `smallint` → `integer` → `bigint`, and any of them to a `numeric` with
-*    room for all their digits;
-*  - `varchar(n)` → `text`, and `text` → an unbounded `varchar`.
-*
-* Arrays follow their element type, and never gain or lose a dimension.
-*/
-function isLosslessTypeChange(from, to) {
-	const a = parseType(from);
-	const b = parseType(to);
-	if (a.dims !== b.dims) return false;
-	if (a.args?.some(Number.isNaN) || b.args?.some(Number.isNaN)) return false;
-	if (a.base === b.base) return modifierWidens(a.base, a.args, b.args);
-	const fromDigits = INTEGER_DIGITS[a.base];
-	if (fromDigits !== void 0) {
-		const toDigits = INTEGER_DIGITS[b.base];
-		if (toDigits !== void 0) return toDigits >= fromDigits;
-		if (b.base === "numeric") return b.args === void 0 || b.args[0] - (b.args[1] ?? 0) >= fromDigits;
-		return false;
-	}
-	if (a.base === "varchar" && b.base === "text") return true;
-	if (a.base === "text" && b.base === "varchar") return b.args === void 0;
-	return false;
-}
-/**
-* Decide how `db push` should proceed given the plan's destructiveness and
-* the invocation context.
-*
-*  - No destructive statements → `apply` (safe to auto-approve).
-*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
-*  - Destructive + interactive TTY → `confirm` (prompt before applying).
-*  - Destructive + non-interactive → `refuse` (never silently drop data in
-*    CI / scripts / agents).
-*/
-function decidePushSafety(opts) {
-	if (opts.destructiveCount === 0) return "apply";
-	if (opts.allowDestructive) return "apply";
-	return opts.interactive ? "confirm" : "refuse";
-}
-//#endregion
-//#region src/module-dir.ts
-var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
-//#endregion
-//#region src/cli-helpers.ts
-/**
-* Which package manager installed this project, read off its lockfile.
-*
-* Every remedy for a blocked build script is package-manager specific, and
-* naming the wrong one is the same failure as naming none: `pnpm approve-builds`
-* is not a thing an npm user can run, and `pnpm.onlyBuiltDependencies` is a key
-* npm does not read. This existed as a pnpm-only message for long enough that
-* npm 12 — which blocks dependency lifecycle scripts by default, the way pnpm 10
-* does — could ship and leave every npm reader three unfollowable commands deep.
-*
-* The lockfile, not `npm_config_user_agent`: the question is how the project's
-* `node_modules` was built, not which binary happens to be invoking us. Walks up
-* because commands run from `backend/` in a scaffolded project, and the lockfile
-* is at the workspace root.
-*/
-function detectProjectPackageManager(startDir = process.cwd()) {
-	const lockfiles = [
-		["pnpm-lock.yaml", "pnpm"],
-		["bun.lock", "bun"],
-		["bun.lockb", "bun"],
-		["yarn.lock", "yarn"],
-		["package-lock.json", "npm"]
-	];
-	let dir = path.resolve(startDir);
-	while (true) {
-		for (const [file, manager] of lockfiles) if (fs.existsSync(path.join(dir, file))) return manager;
-		const parent = path.dirname(dir);
-		if (parent === dir) return "unknown";
-		dir = parent;
-	}
-}
-/**
-* How to let `@ariga/atlas` run its `preinstall`, in the reader's own package
-* manager.
-*
-* Returns the lines to print after "the binary is missing but the package is
-* installed". Kept next to {@link detectProjectPackageManager} so the two move
-* together, and returned rather than printed so it can be asserted on.
-*/
-function describeBuildScriptRemedy(packageName, manager = detectProjectPackageManager()) {
-	switch (manager) {
-		case "npm": return [
-			`    npm install-scripts approve ${packageName}`,
-			"",
-			"  or, to record it in the project (what `rebase init` scaffolds):",
-			"",
-			"    // package.json",
-			`    "allowScripts": { "${packageName}": true }`,
-			"",
-			"  Then re-run `npm install`."
-		];
-		case "yarn": return [
-			"    // .yarnrc.yml",
-			"    enableScripts: true",
-			"",
-			"  Then re-run `yarn install`."
-		];
-		case "bun": return [
-			"    // package.json",
-			`    "trustedDependencies": ["${packageName}"]`,
-			"",
-			"  Then re-run `bun install`."
-		];
-		default: return [
-			"    pnpm approve-builds",
-			"",
-			"  or, to record it in the project (what `rebase init` scaffolds):",
-			"",
-			"    // package.json",
-			`    "pnpm": { "onlyBuiltDependencies": ["${packageName}"] }`,
-			"",
-			"  Then re-run `pnpm install`."
-		];
-	}
-}
-/**
-* "Install again, from scratch", in the reader's own package manager.
-*
-* For the `bin-link-missing` state: the tree is half-written, and re-resolving
-* it is what recreates the `.bin` shim. `--force` on pnpm is what makes it
-* relink rather than decide the tree is already up to date.
-*/
-function describeReinstallCommand(manager = detectProjectPackageManager()) {
-	switch (manager) {
-		case "npm": return "rm -rf node_modules && npm install";
-		case "yarn": return "yarn install --force";
-		case "bun": return "rm -rf node_modules && bun install";
-		default: return "pnpm install --force";
-	}
-}
-/** `add <pkg>` as a dev dependency, in the reader's own package manager. */
-function describeDevAddCommand(packageName, manager = detectProjectPackageManager()) {
-	switch (manager) {
-		case "npm": return `npm install -D ${packageName}`;
-		case "yarn": return `yarn add -D ${packageName}`;
-		case "bun": return `bun add -d ${packageName}`;
-		default: return `pnpm add -D ${packageName}`;
-	}
-}
-/**
-* Where a package's own manifest lives, or null if it is not installed here.
-*
-* `package.json` rather than the package root: a package with an `exports` map
-* that omits `.` is unresolvable by name even when it is perfectly installed,
-* which would misreport it as absent.
-*/
-function resolvePackageManifest(packageName) {
-	const bases = [pathToFileURL(path.join(process.cwd(), "package.json")), pathToFileURL(path.join(moduleDir, "package.json"))];
-	for (const base of bases) try {
-		return createRequire(base).resolve(`${packageName}/package.json`);
-	} catch {}
-	return null;
-}
-/**
-* The binaries a package's own manifest declares, as absolute paths.
-*
-* `bin` is a string for a single binary named after the package, or a map.
-* Both forms appear in the wild and `@ariga/atlas` uses the map.
-*/
-function declaredBinaries(manifestPath) {
-	let manifest;
-	try {
-		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
-	} catch {
-		return [];
-	}
-	const dir = path.dirname(manifestPath);
-	if (typeof manifest.bin === "string") return [path.resolve(dir, manifest.bin)];
-	if (manifest.bin && typeof manifest.bin === "object") return Object.values(manifest.bin).filter((target) => typeof target === "string").map((target) => path.resolve(dir, target));
-	return [];
-}
-function diagnoseMissingBin(packageName) {
-	const manifestPath = resolvePackageManifest(packageName);
-	if (!manifestPath) return "not-installed";
-	const binaries = declaredBinaries(manifestPath);
-	if (binaries.length === 0) return "build-script-blocked";
-	return binaries.some((file) => fs.existsSync(file)) ? "bin-link-missing" : "build-script-blocked";
-}
-function resolveLocalBin(binName) {
-	let dir = moduleDir;
-	while (true) {
-		const candidate = path.join(dir, "node_modules", ".bin", binName);
-		if (fs.existsSync(candidate)) return candidate;
-		const parent = path.dirname(dir);
-		if (parent === dir) break;
-		dir = parent;
-	}
-	let cwd = process.cwd();
-	while (true) {
-		const candidate = path.join(cwd, "node_modules", ".bin", binName);
-		if (fs.existsSync(candidate)) return candidate;
-		const parent = path.dirname(cwd);
-		if (parent === cwd) break;
-		cwd = parent;
-	}
-	try {
-		const globalPath = execSync(process.platform === "win32" ? `where ${binName}` : `which ${binName}`, { encoding: "utf-8" }).trim().split("\n")[0].trim();
-		if (globalPath && fs.existsSync(globalPath)) return globalPath;
-	} catch {}
-	return null;
-}
-async function getTableIncludesFromCollections(allCollections) {
-	const { getTableName, relationalCollections, resolveJunctionSpecs } = await import("@rebasepro/common");
-	const { isPostgresCollectionConfig } = await import("@rebasepro/types");
-	const collections = relationalCollections(allCollections);
-	const includes = [];
-	for (const col of collections) {
-		const tableName = getTableName(col);
-		const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
-		if (tableName) includes.push(`${schema}.${tableName}`);
-	}
-	for (const junction of resolveJunctionSpecs(collections).values()) includes.push(`${junction.schema}.${junction.table}`);
-	return Array.from(new Set(includes));
-}
-async function getTableIncludes(collectionsPath) {
-	return getTableIncludesFromCollections(await loadCollectionsForCli(collectionsPath));
-}
-/**
-* Load a project's collections the way the Atlas-facing commands need them.
-*
-* Deliberately forgiving — a file that fails to import is skipped rather than
-* fatal — because the callers use this to *narrow* what Atlas may touch, and a
-* hard failure here would block a push over an unrelated broken file. Callers
-* that cannot tolerate a partial answer (the table excludes, which fail closed)
-* check the result themselves.
-*/
-/** Paths this process has already complained about. See {@link loadCollectionsForCli}. */
-var warnedMissingCollectionsPaths = /* @__PURE__ */ new Set();
-async function loadCollectionsForCli(collectionsPath) {
-	const resolvedPath = path.resolve(collectionsPath);
-	const collections = [];
-	if (!fs.existsSync(resolvedPath) && !warnedMissingCollectionsPaths.has(resolvedPath)) {
-		warnedMissingCollectionsPaths.add(resolvedPath);
-		outWarn(chalk.yellow(`  ⚠  Collections path not found: "${collectionsPath}"\n     Resolved to: ${resolvedPath}\n     (relative to cwd: ${process.cwd()})\n     Pass an absolute path, or a path relative to where you run the command.`));
-	}
-	if (fs.existsSync(resolvedPath)) {
-		if (fs.statSync(resolvedPath).isDirectory()) {
-			const files = fs.readdirSync(resolvedPath);
-			for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") try {
-				const module = await import(pathToFileURL(path.join(resolvedPath, file)).href);
-				if (module && module.default) collections.push(module.default);
-			} catch {}
-		}
-	}
-	return collections;
-}
-function getDevDatabaseUrl(databaseUrl) {
-	try {
-		const parsed = new URL(databaseUrl);
-		parsed.pathname = `/${parsed.pathname.slice(1)}_dev_diff`;
-		return parsed.toString();
-	} catch {
-		return databaseUrl + "_dev_diff";
-	}
-}
-/**
-* Create the scratch database Atlas plans against, and say so when we cannot.
-*
-* Atlas needs a `--dev-url` — an empty database it can build the desired state
-* in — and this makes `<db>_dev_diff` next to the real one. The whole body used
-* to be wrapped in an empty catch commented "Ignore, let Atlas handle
-* connection failures", and Atlas's version of handling it is `postgres:
-* querying system variables: pq: database "app_dev_diff" does not exist
-* (3D000)` — the symptom, four frames downstream of the cause, with the cause
-* thrown away.
-*
-* The cause is almost always `42501`: `CREATE DATABASE` is a privilege managed
-* providers do not grant, so this is the first thing a hosted user hits and the
-* one they can do least with.
-*
-* @returns whether the scratch database was created by *this* call — the only
-*          case in which dropping it afterwards is ours to do.
-*/
-async function ensureDevDatabaseExists(databaseUrl, devDatabaseUrl) {
-	let devDbName = "";
-	try {
-		const { Client } = await import("pg");
-		const parsed = new URL(databaseUrl);
-		devDbName = new URL(devDatabaseUrl).pathname.slice(1);
-		parsed.pathname = "/postgres";
-		const client = new Client({ connectionString: parsed.toString() });
-		await client.connect();
-		try {
-			if ((await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName])).rowCount === 0) {
-				await client.query(`CREATE DATABASE "${devDbName}"`);
-				out(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
-				return true;
-			}
-		} finally {
-			await client.end();
-		}
-	} catch (err) {
-		outWarn(describeDevDatabaseFailure(err, devDbName || "<db>_dev_diff"));
-	}
-	return false;
-}
-/**
-* What went wrong creating the scratch database, and what to do about it.
-*
-* Exported for its test: the `42501` branch is the one that matters and it
-* cannot be provoked without a non-superuser role.
-*/
-function describeDevDatabaseFailure(err, devDbName) {
-	const code = err?.code;
-	const message = err instanceof Error ? err.message : String(err);
-	const lines = [chalk.yellow(`  ⚠  Could not create the Atlas scratch database "${devDbName}": ${message}`)];
-	if (code === "42501") lines.push(chalk.gray(`     Atlas plans every change in a throwaway copy of the schema, and CREATE DATABASE
-     is a privilege most managed providers withhold. Two ways forward:
-       • GRANT the role CREATEDB:  ALTER ROLE "<role>" CREATEDB;
-       • or create it once by hand:  CREATE DATABASE "${devDbName}";`));
-	else lines.push(chalk.gray("     Atlas will fail next with `database \"" + devDbName + "\" does not exist (3D000)`, which is this."));
-	return lines.join("\n");
-}
-/**
-* Drop the scratch database again, after the command that needed it succeeded.
-*
-* It is a full copy of the schema — no rows, but every table, type and index —
-* and it was left behind per target forever. The only notice anyone got was
-* `rebase db branch prune` reporting "3 Atlas scratch database(s) left over
-* from db push", and on a provider that bills per database it is a silent cost.
-*
-* Deliberately NOT called on the failure path: after a failed push the scratch
-* database holds the state Atlas was planning against, which is the one thing
-* worth inspecting.
-*/
-async function dropDevDatabase(databaseUrl, devDatabaseUrl) {
-	try {
-		const { Client } = await import("pg");
-		const parsed = new URL(databaseUrl);
-		const devDbName = new URL(devDatabaseUrl).pathname.slice(1);
-		parsed.pathname = "/postgres";
-		const client = new Client({ connectionString: parsed.toString() });
-		await client.connect();
-		try {
-			await client.query(`DROP DATABASE IF EXISTS "${devDbName}"`);
-			out(chalk.gray(`  ✓ Removed validation database "${devDbName}"`));
-		} finally {
-			await client.end();
-		}
-	} catch (err) {
-		outWarn(chalk.gray(`  ⚠  Could not remove the Atlas scratch database: ${err instanceof Error ? err.message : String(err)}\n     \`rebase db branch prune --include-dev-diff\` clears them.`));
-	}
-}
-/**
-* The generated SQL for the project's `search` blocks, if it has any.
-*
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
-*/
-function readSearchDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const searchFile = path.join(drizzleDir, "search.sql");
-	if (!fs.existsSync(searchFile)) return "";
-	return fs.readFileSync(searchFile, "utf-8").trim();
-}
-/**
-* Bring the search column, its index and their helpers up to date.
-*
-* Runs *after* Atlas, not before: the statements are `ALTER TABLE ... ADD
-* COLUMN`, so the table has to exist. Atlas is told to ignore these objects
-* entirely (`getSearchExcludes`) — it cannot manage them, and left to itself it
-* would plan a `DROP COLUMN` for every one, since they are absent from the
-* desired state it was given.
-*
-* A no-op when no collection declared `search`. A failure is *not* swallowed:
-* silently pushing a schema whose search column never appeared is how a
-* collection ends up with search configured, no error anywhere, and no results.
-*/
-async function applySearchDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readSearchDdl(drizzleDir);
-	if (!sql) return;
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		await client.query(sql);
-	} finally {
-		await client.end();
-	}
-	out(chalk.gray("  ✓ Applied full-text search columns and indexes"));
-}
-/**
-* Glob patterns keeping Atlas away from the search objects.
-*
-* Returns an empty list — and so changes nothing — for a project with no
-* `search` block, which is every project that has not opted in.
-*/
-async function getSearchExcludes(collectionsPath) {
-	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
-}
-/**
-* Every `generated column → column it reads` edge in the database.
-*
-* Read from `pg_depend` rather than by matching names in the expression text:
-* a generated column's `pg_attrdef` row carries one `deptype = 'n'` dependency
-* per column its expression references, which is the catalogue's own answer and
-* cannot be fooled by a column name that also appears inside a string literal
-* or as part of a longer identifier.
-*
-* Used by `db push` to find what has to come out of the way before Atlas runs —
-* see `generated-column-conflicts.ts` for why that is necessary at all.
-*/
-async function queryGeneratedColumnDependencies(databaseUrl) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		return (await client.query(`
-            SELECT n.nspname       AS "schema",
-                   c.relname       AS "table",
-                   gen.attname     AS "column",
-                   dep.attname     AS "dependsOn"
-            FROM pg_attrdef ad
-            JOIN pg_class c         ON c.oid = ad.adrelid
-            JOIN pg_namespace n     ON n.oid = c.relnamespace
-            JOIN pg_attribute gen   ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum
-            JOIN pg_depend d        ON d.classid = 'pg_attrdef'::regclass
-                                   AND d.objid = ad.oid
-                                   AND d.refclassid = 'pg_class'::regclass
-                                   AND d.refobjid = ad.adrelid
-                                   AND d.deptype = 'n'
-            JOIN pg_attribute dep   ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid
-            WHERE gen.attgenerated <> ''
-              AND NOT gen.attisdropped
-              AND NOT dep.attisdropped;
-        `)).rows;
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Every column in the database with its current type, for the destructive
-* gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.
-*/
-async function queryColumnTypes(databaseUrl) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		return (await client.query(COLUMN_TYPES_SQL)).rows;
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Drop the generated columns standing in the way of an apply.
-*
-* Their indexes and their `COMMENT ON COLUMN` stamp go with them, which is
-* exactly right: `applySearchDdl` rebuilds all three from `search.sql` and a
-* surviving stamp would make the rebuilt column look like drift.
-*/
-async function dropGeneratedColumns(databaseUrl, statements) {
-	if (statements.length === 0) return;
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		for (const statement of statements) await client.query(statement);
-	} finally {
-		await client.end();
-	}
-}
-/**
-* The generated SQL for the project's `vector` properties, if it has any.
-*
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
-*/
-function readVectorDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const vectorFile = path.join(drizzleDir, "vector.sql");
-	if (!fs.existsSync(vectorFile)) return "";
-	return fs.readFileSync(vectorFile, "utf-8").trim();
-}
-/**
-* Install pgvector and bring the vector columns and their ANN indexes up to
-* date.
-*
-* Runs *after* Atlas, like {@link applySearchDdl} and for the same reason: the
-* statements are `ALTER TABLE … ADD COLUMN`, so the table has to exist. Atlas
-* is told to ignore these objects entirely ({@link getVectorExcludes}) — it
-* cannot manage a type its dev database is structurally incapable of having,
-* and left to itself it would plan a `DROP COLUMN` for every one.
-*
-* A no-op when no collection declares a `vector` property. A failure is *not*
-* swallowed: a push that reported success while the embedding column never
-* appeared is how a project ends up with vector search configured, no error
-* anywhere, and no results.
-*/
-async function applyVectorDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readVectorDdl(drizzleDir);
-	if (!sql) return;
-	const { vectorExtensionHint } = await import("./vector-index-CMJKb3C9.js").then((n) => n.f);
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		await client.query(sql);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		const hint = vectorExtensionHint(message);
-		if (!hint) throw err;
-		throw new Error(`${message}${hint}`, { cause: err });
-	} finally {
-		await client.end();
-	}
-	out(chalk.gray("  ✓ Applied vector columns and ANN indexes"));
-}
-/**
-* Glob patterns keeping Atlas away from the vector objects.
-*
-* Returns an empty list — and so changes nothing — for a project with no
-* `vector` property, which is every project that has not opted in.
-*/
-async function getVectorExcludes(collectionsPath) {
-	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
-}
-/**
-* The generated SQL for the project's `autoValue: "on_update"` properties, if
-* it has any.
-*
-* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
-*        under the working directory.
-*/
-function readTriggersDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const triggersFile = path.join(drizzleDir, "triggers.sql");
-	if (!fs.existsSync(triggersFile)) return "";
-	return fs.readFileSync(triggersFile, "utf-8").trim();
-}
-/**
-* Install the `updated_at` trigger function and bind it to every column that
-* asked for one.
-*
-* Runs *after* Atlas, like {@link applySearchDdl} and {@link applyVectorDdl}:
-* a trigger needs its table and its column to exist. Atlas is told to ignore
-* the triggers ({@link getTriggerExcludes}) because it cannot manage a function
-* at all — its free tier refuses to parse a desired state containing one.
-*
-* A no-op when no property declares `autoValue: "on_update"`. A failure is
-* *not* swallowed: a push that reported success while the trigger never
-* appeared is how `updated_at` ends up silently stale for every writer that is
-* not the driver, which is the whole reason the trigger exists.
-*/
-async function applyTriggersDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
-	const sql = readTriggersDdl(drizzleDir);
-	if (!sql) return;
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		await client.query(sql);
-	} finally {
-		await client.end();
-	}
-	out(chalk.gray("  ✓ Applied `updated_at` triggers"));
-}
-/** @see getSearchExcludes */
-async function getTriggerExcludes(collectionsPath) {
-	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-	return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));
-}
-/**
-* Query the live database for every user table/view outside the system
-* catalogs. Separated from {@link getTableExcludes} so its failure mode can
-* be handled explicitly (fail closed) and so tests can inject a stub.
-*/
-/**
-* Every index Postgres holds on a table Rebase manages, as
-* `schema.table.index`.
-*
-* Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
-* *constraint* to Atlas, diffed from the constraint declaration, and naming its
-* index in an exclude would shield the constraint itself.
-*/
-async function queryExistingIndexes(databaseUrl) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		return (await client.query(`
-            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name
-            FROM pg_index x
-            JOIN pg_class i ON i.oid = x.indexrelid
-            JOIN pg_class t ON t.oid = x.indrelid
-            JOIN pg_namespace n ON n.oid = t.relnamespace
-            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
-              AND t.relkind IN ('r', 'p')
-              AND NOT EXISTS (
-                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
-              );
-        `)).rows.map((row) => row.full_name);
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Glob patterns keeping Atlas away from indexes that are not Rebase's.
-*
-* The problem this solves is live and predates the `indexes:` block. `db push`
-* is declarative, so an index on a managed table that is absent from
-* `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified
-* against atlas v1.2.3: create one by hand, re-run an unchanged push, and the
-* plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the
-* auto-approved apply took it without asking. Until now the only way to have
-* an index at all was to write it by hand, which made that the *only* outcome.
-*
-* Ownership rather than a prompt, because once indexes are declarable a drop
-* is usually correct: removing one from the config should remove it from the
-* database, quietly. What must never be dropped is an index Rebase never
-* created — a hand-written one, or one an introspected database arrived with.
-* {@link isRebaseIndexName} is the test, the same arrangement
-* `isGeneratedPolicyName` uses to let policy reconciliation drop only what it
-* generated.
-*
-* The named-in-the-desired-state check comes first and is what makes removal
-* work: a declared index that the author has just deleted still matches the
-* name pattern, is no longer in the plan, and so is *not* excluded — Atlas
-* drops it, as intended.
-*
-* Three-part `schema.table.index`, never two: a two-part pattern reads as a
-* *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
-* reports no error — the trap already recorded for the search excludes.
-*/
-async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {}) {
-	const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
-	const managed = await (deps.getManagedIndexNames ?? managedIndexNames)(collectionsPath);
-	let existing;
-	try {
-		existing = await queryIndexes(databaseUrl);
-	} catch (err) {
-		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`, err);
-	}
-	return existing.filter((full) => {
-		const indexName = full.slice(full.lastIndexOf(".") + 1);
-		if (managed.has(indexName)) return false;
-		return !isRebaseIndexName(indexName);
-	});
-}
-/**
-* The index names the current collections would create — search, vector and
-* declared alike. Anything Atlas would emit is by definition not foreign.
-*/
-async function managedIndexNames(collectionsPath) {
-	const collections = await loadCollectionsForCli(collectionsPath);
-	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-	const { resolveColumnName } = await import("./column-plan-helpers-DF-8dTVa.js").then((n) => n.n);
-	const { buildCollectionIndexPlan } = await import("./collection-index-DdnsxiJ_.js").then((n) => n.i);
-	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
-	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
-	return names;
-}
-async function queryExistingTables(databaseUrl) {
-	const { Client } = await import("pg");
-	const client = new Client({ connectionString: databaseUrl });
-	await client.connect();
-	try {
-		return (await client.query(`
-            SELECT table_schema || '.' || table_name AS full_name
-            FROM information_schema.tables
-            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-              AND table_type IN ('BASE TABLE', 'VIEW');
-        `)).rows.map((row) => row.full_name);
-	} finally {
-		await client.end();
-	}
-}
-/**
-* Raised when the exclude list could not be built. `db push` MUST abort on
-* this rather than continue: the exclude list is the only thing shielding
-* non-collection (user/system) tables from the auto-approved declarative
-* apply. A partial list — the old fail-open behaviour — meant a transient
-* introspection hiccup dropped every table not present in `schema.sql`.
-*/
-var ExcludeIntrospectionError = class extends Error {
-	cause;
-	constructor(message, cause) {
-		super(message);
-		this.cause = cause;
-		this.name = "ExcludeIntrospectionError";
-	}
-};
-/**
-* Build the `--exclude` list that protects tables Rebase doesn't manage from
-* the declarative apply. Anything not backing a collection (or its M2M
-* junctions) is excluded so Atlas never drops it.
-*
-* Fails **closed**: if the database can't be introspected we cannot know
-* which tables to protect, so we throw {@link ExcludeIntrospectionError}
-* instead of returning a near-empty list and letting the caller drop
-* everything.
-*
-* `deps` is injectable for tests; production uses the real pg-backed queries.
-*/
-async function getTableExcludes(databaseUrl, collectionsPath, deps = {}) {
-	const getIncludes = deps.getIncludes ?? getTableIncludes;
-	const queryTables = deps.queryExistingTables ?? queryExistingTables;
-	const includes = await getIncludes(collectionsPath);
-	const excludes = [
-		"atlas_schema_revisions.*",
-		"auth",
-		"auth.*",
-		"rebase",
-		"rebase.*"
-	];
-	let existingTables;
-	try {
-		existingTables = await queryTables(databaseUrl);
-	} catch (err) {
-		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`, err);
-	}
-	for (const table of existingTables) if (!includes.includes(table)) excludes.push(table);
-	return excludes;
-}
-/**
-* Ask a yes/no question on an interactive terminal.
-*
-* The `isTTY` guard is the contract, not an optimisation: non-interactive
-* shells (CI, pipes, agents) can never answer, and `readline` on a
-* non-TTY stdin resolves with whatever the pipe happens to contain — or never
-* resolves at all. Returning false there is what makes an unattended
-* `db push` abort instead of auto-confirming a destructive change. Callers
-* should already have gone through {@link decidePushSafety}, which decides
-* whether interactive confirmation is even possible; this is the backstop.
-*
-* Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
-* `import.meta` and cannot be imported by the jest runner.
-*/
-async function promptConfirm(question) {
-	if (!process.stdin.isTTY) return false;
-	const rl = import___vite_browser_external.default.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await new Promise((resolve) => rl.question(question, resolve));
-		return /^y(es)?$/i.test(answer.trim());
-	} finally {
-		rl.close();
-	}
-}
-//#endregion
 //#region src/schema/rls-bootstrap-sql.ts
 var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
 	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
@@ -7260,7 +6196,8 @@ var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
 	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
 	RLS_BOOTSTRAP_SQL: () => RLS_BOOTSTRAP_SQL,
 	RLS_BOOTSTRAP_STATEMENTS: () => RLS_BOOTSTRAP_STATEMENTS,
-	dropLegacyAuthSchema: () => dropLegacyAuthSchema
+	dropLegacyAuthSchema: () => dropLegacyAuthSchema,
+	rlsRuntimeIsCurrent: () => rlsRuntimeIsCurrent
 });
 /**
 * Canonical SQL bootstrap for the RLS helper functions.
@@ -7329,6 +6266,93 @@ $$ LANGUAGE sql STABLE`,
     SELECT COALESCE(NULLIF(current_setting('app.is_anonymous', true), ''), 'false')::boolean;
 $$ LANGUAGE sql STABLE`
 ];
+/** Everything `CREATE OR REPLACE FUNCTION` sets on a function, as one comparable string. */
+var describeFunction = (facts) => JSON.stringify([
+	facts.returns.toLowerCase(),
+	facts.language.toLowerCase(),
+	facts.volatility,
+	facts.strict,
+	facts.parallel,
+	facts.securityDefiner,
+	facts.leakproof,
+	facts.cost,
+	facts.hasConfig,
+	facts.body
+]);
+/**
+* What each `CREATE OR REPLACE FUNCTION` in {@link RLS_BOOTSTRAP_STATEMENTS}
+* would leave in the catalogue, by `schema.name`. Parsed
+* from the statements themselves, so the two cannot drift; a statement this
+* does not recognise makes {@link rlsRuntimeIsCurrent} answer "no", and the
+* bootstrap runs as it always did.
+*/
+var expectedRlsFunctions = () => {
+	const expected = /* @__PURE__ */ new Map();
+	for (const statement of RLS_BOOTSTRAP_STATEMENTS) {
+		if (/^CREATE SCHEMA IF NOT EXISTS /.test(statement)) continue;
+		const match = /^CREATE OR REPLACE FUNCTION (\w+)\.(\w+)\(\) RETURNS (\w+) AS \$\$([\s\S]*)\$\$ LANGUAGE (\w+) (IMMUTABLE|STABLE|VOLATILE)$/.exec(statement);
+		if (!match) return void 0;
+		const [, schema, name, returns, body, language, volatility] = match;
+		expected.set(`${schema}.${name}`, describeFunction({
+			returns,
+			language,
+			volatility: volatility[0].toLowerCase(),
+			strict: false,
+			parallel: "u",
+			securityDefiner: false,
+			leakproof: false,
+			cost: 100,
+			hasConfig: false,
+			body
+		}));
+	}
+	return expected;
+};
+/**
+* Whether the `rebase` schema and every RLS helper function are exactly what
+* {@link RLS_BOOTSTRAP_STATEMENTS} would make them — one catalogue read.
+*
+* The boot ran those statements unconditionally, on every boot and on every
+* source: four `CREATE OR REPLACE FUNCTION`s in a transaction under an
+* advisory lock. Replacing a function rewrites its `pg_proc` row even when
+* nothing changed, and every cached plan that inlined it — every plan of every
+* statement a policy applies to, on every connection — is invalidated by it.
+* A function that differs in anything `CREATE OR REPLACE` sets (body,
+* language, volatility, strictness, parallel safety, security, leakproofness,
+* cost, `SET` options), or is missing, answers `false`, and the statements run
+* as before.
+*/
+async function rlsRuntimeIsCurrent(run) {
+	const expected = expectedRlsFunctions();
+	if (!expected) return false;
+	const rows = await run(`SELECT n.nspname AS schema, p.proname AS name, pg_get_function_identity_arguments(p.oid) AS args,
+                format_type(p.prorettype, NULL) AS returns, l.lanname AS language,
+                p.provolatile::text AS volatility, p.proisstrict AS strict, p.proparallel::text AS parallel,
+                p.prosecdef AS security_definer, p.proleakproof AS leakproof, p.procost AS cost,
+                p.proconfig IS NOT NULL AS has_config, p.prosrc AS body
+         FROM pg_proc p
+         JOIN pg_namespace n ON p.pronamespace = n.oid
+         JOIN pg_language l ON p.prolang = l.oid
+         WHERE (n.nspname, p.proname) IN (${[...expected.keys()].map((key) => key.split(".")).map(([schema, name]) => `('${schema}', '${name}')`).join(", ")})`);
+	const live = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (String(row.args ?? "") !== "") continue;
+		live.set(`${row.schema}.${row.name}`, describeFunction({
+			returns: String(row.returns),
+			language: String(row.language),
+			volatility: String(row.volatility),
+			strict: row.strict === true,
+			parallel: String(row.parallel),
+			securityDefiner: row.security_definer === true,
+			leakproof: row.leakproof === true,
+			cost: Number(row.cost),
+			hasConfig: row.has_config === true,
+			body: String(row.body)
+		}));
+	}
+	for (const [key, definition] of expected) if (live.get(key) !== definition) return false;
+	return true;
+}
 /** The same statements as one script, for migration files and raw clients. */
 var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by the policies below)\n" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n") + "\n";
 /**
@@ -7494,6 +6518,6 @@ async function dropLegacyAuthSchema(run, report) {
 	}
 }
 //#endregion
-export { resolveLocalBin as A, loadCollectionsForCli as C, readSearchDdl as D, queryGeneratedColumnDependencies as E, forLibpq as F, detectDestructiveStatements as M, splitSqlStatements as N, readTriggersDdl as O, execa as P, getVectorExcludes as S, queryColumnTypes as T, getDevDatabaseUrl as _, ExcludeIntrospectionError as a, getTableExcludes as b, applyVectorDdl as c, describeReinstallCommand as d, detectProjectPackageManager as f, ensureDevDatabaseExists as g, dropGeneratedColumns as h, rls_bootstrap_sql_exports as i, decidePushSafety as j, readVectorDdl as k, describeBuildScriptRemedy as l, dropDevDatabase as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, diagnoseMissingBin as p, dropLegacyAuthSchema as r, applyTriggersDdl as s, RLS_BOOTSTRAP_SQL as t, describeDevAddCommand as u, getForeignIndexExcludes as v, promptConfirm as w, getTriggerExcludes as x, getSearchExcludes as y };
+export { rls_bootstrap_sql_exports as a, rlsRuntimeIsCurrent as i, RLS_BOOTSTRAP_STATEMENTS as n, execa as o, dropLegacyAuthSchema as r, RLS_BOOTSTRAP_SQL as t };
 
-//# sourceMappingURL=rls-bootstrap-sql-B8EclDyM.js.map
+//# sourceMappingURL=rls-bootstrap-sql-Bd-hJk08.js.map