@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/cli-errors-oVUuD8k0.js

@@ -0,0 +1,2180 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as outWarn, i as outError, m as isRebaseIndexName, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-DB6xJv3p.js";
+import path from "path";
+import fs from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { execSync } from "child_process";
+import { createRequire } from "module";
+//#region src/utils/error-cause.ts
+/**
+* Walk the error cause chain and return the deepest meaningful message.
+*
+* A leaf module, imported by the driver CLI: `pg-error-utils.ts`, where it used
+* to live, imports `@rebasepro/server`, and the CLI must start without it.
+*/
+function extractCauseMessage(error) {
+	if (!error || typeof error !== "object") return null;
+	if (!(error instanceof Error)) return null;
+	if (error.cause && typeof error.cause === "object") {
+		const deeper = extractCauseMessage(error.cause);
+		if (deeper) return deeper;
+		if (error.cause instanceof Error && error.cause.message) return error.cause.message;
+	}
+	return null;
+}
+//#endregion
+//#region src/utils/connection-string.ts
+/**
+* Connection-string rewrites for the tools Rebase shells out to.
+*
+* Pure and dependency-free: `pg-tools` builds argument vectors without a live
+* server, and these have to be usable from there.
+*/
+/**
+* The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+*/
+var LIBPQ_SSLMODES = /* @__PURE__ */ new Set([
+	"disable",
+	"allow",
+	"prefer",
+	"require",
+	"verify-ca",
+	"verify-full"
+]);
+/**
+* Make a connection string safe to hand to a libpq program.
+*
+* `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+* the certificate — and libpq does not have it. It does not degrade or warn:
+*
+*     psql: error: invalid sslmode value: "no-verify"
+*
+* which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+* `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+* points at the value rather than at the convention it comes from. It has cost
+* this project time more than once.
+*
+* `require` is the honest translation: libpq's `require` encrypts and does not
+* verify the certificate either, which is exactly what `no-verify` asks for.
+* Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+* alone, so a connection string that asked for verification still gets it.
+*
+* Only `sslmode` is touched, and only when it is a value libpq would reject.
+* Anything unparseable is returned as given: a connection that works
+* unverified beats one this corrupted.
+*/
+function forLibpq(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return connectionString;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+	const sslmode = url.searchParams.get("sslmode");
+	if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+	url.searchParams.set("sslmode", "require");
+	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return url.toString();
+}
+/**
+* A connection string with its password taken out, and the password.
+*
+* For a libpq program: the URL goes on its command line, and the password goes
+* in `PGPASSWORD`. On the command line it was readable by anyone who can list
+* processes, and it came back verbatim in every failure, because execa's error
+* message repeats the command: `Command failed with exit code 1: pg_restore
+* '--dbname=postgresql://app:s3cret@…'`, in a terminal, a CI log and the
+* scheduled backup's run history.
+*
+* libpq takes the password from the URL's user info or a `password` parameter,
+* so both are removed. The value is percent-decoded, because `PGPASSWORD` is
+* read literally. Anything that is not a URL is returned as given, with no
+* password: a key/value DSN keeps its own.
+*/
+function splitPassword(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return {
+			connectionString,
+			password: null
+		};
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return {
+		connectionString,
+		password: null
+	};
+	const fromUserInfo = url.password ? decodePercent(url.password) : null;
+	const fromParameter = url.searchParams.get("password");
+	if (fromUserInfo === null && fromParameter === null) return {
+		connectionString,
+		password: null
+	};
+	url.password = "";
+	if (fromParameter !== null) {
+		url.searchParams.delete("password");
+		url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	}
+	return {
+		connectionString: url.toString(),
+		password: fromUserInfo ?? fromParameter
+	};
+}
+function decodePercent(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* Every password a line of text carries in a connection string, replaced with
+* `***`.
+*
+* For whatever is about to be printed or logged and may have a connection
+* string in it: an error a client tool or a driver raised, a message that
+* quotes a command line. Covers the URL user-info form (`scheme://user:pass@`,
+* any scheme, a password with a raw `@` in it included) and `password=` in a
+* query string or a key/value DSN. The user, host and database stay, because
+* they are what a reader needs to tell which database it was.
+*/
+function redactConnectionPasswords(text) {
+	return text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^\s/?#@'"]*):[^\s/?#'"]*@/gi, "$1:***@").replace(/(\bpassword\s*=\s*)('[^']*'|[^\s&'"]+)/gi, "$1***");
+}
+//#endregion
+//#region src/schema/destructive-sql.ts
+/**
+* SQL fragments that destroy data or data-bearing objects. Matched
+* case-insensitively against each statement of the plan. `IF EXISTS` /
+* whitespace variations are tolerated by the regexes below.
+*/
+var DESTRUCTIVE_PATTERNS = [
+	{
+		label: "DROP TABLE",
+		re: /\bDROP\s+TABLE\b/i
+	},
+	{
+		label: "DROP COLUMN",
+		re: /\bDROP\s+COLUMN\b/i
+	},
+	{
+		label: "DROP SCHEMA",
+		re: /\bDROP\s+SCHEMA\b/i
+	},
+	{
+		label: "DROP VIEW",
+		re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i
+	},
+	{
+		label: "DROP TYPE",
+		re: /\bDROP\s+TYPE\b/i
+	},
+	{
+		label: "TRUNCATE",
+		re: /\bTRUNCATE\b/i
+	}
+];
+/**
+* Split a SQL script into individual statements, dropping blank lines and
+* `--` comment lines. Deliberately simple: Atlas emits one plain statement
+* per `;`, without string literals that contain semicolons in a schema DDL
+* plan, so a naive split is safe and keeps this dependency-free.
+*/
+function splitSqlStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/** `->`, the marker Atlas prints in front of the first line of every statement. */
+var PLAN_MARKER_RE = /^\s*->\s?/;
+/** `-------`, both the rule between sections and the one above a summary. */
+var PLAN_RULE_RE = /^\s*-{5,}\s*$/;
+/** `Planning migration statements (3 in total):` — and the count it announces. */
+var PLAN_HEADING_RE = /^Planning migration statements \((\d+) in total\):/m;
+/**
+* What Atlas prints, and nothing else, when there is nothing to plan — from
+* `schema apply`, or from `migrate apply` with no file pending.
+*/
+var PLAN_SYNCED_RE = /^\s*(?:Schema is synced, no changes to be made|No migration files to execute)\s*$/;
+/**
+* Read the statements out of whatever Atlas printed.
+*
+* `atlas schema apply --dry-run` does not print SQL. It prints a report, and
+* the same statements appear in it twice:
+*
+*     Planning migration statements (2 in total):
+*
+*       -- modify "people" table:
+*         -> ALTER TABLE "public"."people" ALTER COLUMN "rating" TYPE numeric(4,1);
+*       -- create "notes" table:
+*         -> CREATE TABLE "public"."notes" (
+*              "body" text NULL DEFAULT 'a;b',
+*              …
+*            );
+*
+*     -------------------------------------------
+*
+*     Analyzing planned statements (2 in total):
+*       …
+*     Running dry-run migration (2 statements in total):
+*       -- modify "people" table
+*         -> ALTER TABLE …;          ← the same statement, again
+*       -- ok (19µs)
+*
+* Splitting that on `;` is how the push gate went blind: the heading has no
+* `;` and does not start with `--`, so it became the first line of the first
+* statement, and an `ALTER TABLE` parse anchored at the start of a statement
+* read nothing — every narrowing type change applied without a prompt. Reading
+* both sections was a second bug, counting every destructive statement twice.
+*
+* So the report is read as a report: a statement is a `->` line and the lines
+* indented under it, up to the next `--` heading, `->`, blank line or rule;
+* only the first section that holds a `->` is read; and `;` plays no part,
+* because a default like `'a;b'` contains one.
+*
+* Plain SQL — a migration file, or an Atlas that printed SQL — has no `->`
+* and is split the old way.
+*/
+function readPlan(plan) {
+	if (PLAN_SYNCED_RE.test(plan)) return { statements: [] };
+	const lines = plan.split(/\r?\n/);
+	if (!lines.some((line) => PLAN_MARKER_RE.test(line))) return { statements: splitSqlStatements(plan) };
+	const heading = PLAN_HEADING_RE.exec(plan);
+	const statements = [];
+	let current = null;
+	const flush = () => {
+		if (current) statements.push(current.join("\n").trim().replace(/;\s*$/, "").trimEnd());
+		current = null;
+	};
+	for (const line of lines) {
+		if (PLAN_MARKER_RE.test(line)) {
+			flush();
+			current = [line.replace(PLAN_MARKER_RE, "")];
+			continue;
+		}
+		if (PLAN_RULE_RE.test(line) || /^\S/.test(line) && !line.startsWith("--")) {
+			flush();
+			if (statements.length > 0) break;
+			continue;
+		}
+		if (!current) continue;
+		if (line.trim() === "" || line.trim().startsWith("--")) {
+			flush();
+			continue;
+		}
+		current.push(line);
+	}
+	flush();
+	return {
+		statements,
+		announced: heading ? Number(heading[1]) : void 0
+	};
+}
+/**
+* The statements of an Atlas plan, each exactly once, without Atlas's
+* rendering and without the trailing `;`. See {@link readPlan} for the shape
+* it reads; `test/fixtures/atlas-dry-run/` holds real captures of it.
+*/
+function extractPlanStatements(plan) {
+	return readPlan(plan).statements;
+}
+/**
+* Whether Atlas answered the dry-run with "Schema is synced" and nothing else.
+*
+* Positive evidence only: an empty or unreadable report also yields no
+* statements, and is not the same answer.
+*/
+function isSyncedPlan(plan) {
+	return PLAN_SYNCED_RE.test(plan);
+}
+/**
+* Every column of every ordinary table outside the system schemas, with its
+* type. What {@link detectDestructiveStatements} compares a planned type
+* change against; `format_type` because it carries the modifier (`(255)`,
+* `(10,2)`) that decides whether a change widens or narrows.
+*/
+var COLUMN_TYPES_SQL = `
+    SELECT n.nspname AS "schema",
+           c.relname AS "table",
+           a.attname AS "column",
+           format_type(a.atttypid, a.atttypmod) AS "type"
+    FROM pg_attribute a
+    JOIN pg_class c     ON c.oid = a.attrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE c.relkind IN ('r', 'p')
+      AND a.attnum > 0
+      AND NOT a.attisdropped
+      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND n.nspname NOT LIKE 'pg\\_%'
+`;
+/**
+* Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+* the statements that would destroy data. An empty array means the plan is
+* safe to auto-approve.
+*
+* `columnTypes` is what the database holds now. A type change to a column it
+* does not list is flagged: not knowing what a column is means not knowing
+* whether the change keeps its values.
+*
+* `constraints` are the CHECK and EXCLUDE constraints the database holds now.
+* A `DROP CONSTRAINT` of one of them is flagged; of any other constraint (a
+* foreign key, a `UNIQUE`) it is not, as before.
+*/
+function detectDestructiveStatements(planSql, columnTypes = [], constraints = []) {
+	const found = [];
+	const { statements, announced } = readPlan(planSql);
+	if (announced !== void 0 && announced !== statements.length) found.push({
+		statement: `Planning migration statements (${announced} in total)`,
+		kind: "UNREADABLE PLAN",
+		detail: `Atlas announced ${announced} statement(s) and ${statements.length} could be read — read the plan yourself before allowing it`
+	});
+	for (const statement of statements) {
+		const dropped = DESTRUCTIVE_PATTERNS.find(({ re }) => re.test(statement));
+		const rekeyed = describePrimaryKeyChange(statement);
+		const lossy = parseColumnTypeChanges(statement).map((change) => ({
+			change,
+			from: currentTypeOf(change, columnTypes)
+		})).filter(({ change, from }) => from === void 0 || !isLosslessTypeChange(from, change.to)).map(({ change, from }) => `"${change.column}" ${from ?? "(current type unknown)"} → ${change.to}`).join("; ");
+		const unenforced = describeConstraintDrops(statement, constraints);
+		const kind = dropped?.label ?? (rekeyed ? "PRIMARY KEY CHANGE" : lossy ? "ALTER COLUMN TYPE" : unenforced ? "DROP CONSTRAINT" : void 0);
+		if (!kind) continue;
+		const detail = [
+			rekeyed,
+			lossy,
+			unenforced
+		].filter(Boolean).join("; ");
+		found.push(detail ? {
+			statement,
+			kind,
+			detail
+		} : {
+			statement,
+			kind
+		});
+	}
+	return found;
+}
+var IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)`;
+var ALTER_TABLE_RE = new RegExp(String.raw`^ALTER\s+TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${IDENT})(?:\.(${IDENT}))?\s+([\s\S]*)$`, "i");
+var TYPE_CLAUSE_RE = new RegExp(String.raw`^ALTER\s+(?:COLUMN\s+)?(${IDENT})\s+(?:SET\s+DATA\s+)?TYPE\s+([\s\S]+)$`, "i");
+var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1).replace(/""/g, "\"") : ident;
+/**
+* Split an `ALTER TABLE`'s clause list on its top-level commas — the ones
+* outside parentheses and quotes, so `TYPE numeric(10, 2)` stays one clause.
+*/
+function splitClauses(body) {
+	const clauses = [];
+	let depth = 0;
+	let quote;
+	let start = 0;
+	for (let i = 0; i < body.length; i++) {
+		const ch = body[i];
+		if (quote) {
+			if (ch === quote) quote = void 0;
+		} else if (ch === "\"" || ch === "'") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			clauses.push(body.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	clauses.push(body.slice(start).trim());
+	return clauses.filter((clause) => clause.length > 0);
+}
+/**
+* The statement from its `ALTER TABLE` on, wherever on a line that starts.
+*
+* {@link readPlan} hands over clean statements. This is the second line of
+* defence for text it could not clean — a rendering it does not know yet —
+* where a line of prose above the statement must not hide the statement, which
+* is exactly how an anchored match once read Atlas's whole plan as safe.
+*/
+function fromAlterTable(statement) {
+	const start = /(?:^|\n)[ \t]*(?:->[ \t]*)?(ALTER\s+TABLE\b)/i.exec(statement);
+	return start ? statement.slice(start.index + start[0].length - start[1].length).trim() : statement.trim();
+}
+/**
+* Every `ALTER COLUMN … [SET DATA] TYPE` in one statement. Atlas prints its
+* dry-run statements under a `-> ` marker and puts several clauses in one
+* `ALTER TABLE`, so both are handled.
+*/
+function parseColumnTypeChanges(statement) {
+	const table = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!table) return [];
+	const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
+	const changes = [];
+	for (const clause of splitClauses(table[3])) {
+		const match = TYPE_CLAUSE_RE.exec(clause);
+		if (!match) continue;
+		const to = match[2].split(/\s+(?:USING|COLLATE)\s/i)[0].trim();
+		changes.push({
+			schema,
+			table: name,
+			column: unquote(match[1]),
+			to
+		});
+	}
+	return changes;
+}
+/** `ADD [CONSTRAINT "x"] PRIMARY KEY ("a", "b")`, one clause of an `ALTER TABLE`. */
+var ADD_PRIMARY_KEY_RE = new RegExp(String.raw`^ADD\s+(?:CONSTRAINT\s+${IDENT}\s+)?PRIMARY\s+KEY\b\s*(?:\(([^)]*)\))?`, "i");
+/** `DROP CONSTRAINT [IF EXISTS] "x"`, one clause of an `ALTER TABLE`. */
+var DROP_CONSTRAINT_RE = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i");
+/** What a row loses when the columns that address it change. */
+var ROW_ADDRESS_LOST = "every row's id changes, so anything that refers to a row by its id — a URL, a foreign key, an id stored elsewhere — stops finding it";
+/**
+* What an `ALTER TABLE` does to the table's primary key, in a sentence — or
+* `undefined` when it leaves the key alone.
+*
+* The key is a row's address: Rebase reads, links and routes every row by it.
+* Atlas plans a key change as `DROP CONSTRAINT "<table>_pkey", ADD PRIMARY KEY
+* (…)` — one routine-looking statement that names no DROP of data — so moving
+* a collection from `(id)` to `(id, locale)` re-keyed a populated table with
+* no prompt. A `CREATE TABLE`'s own `PRIMARY KEY` is not a change and is never
+* read here: only an `ALTER TABLE`'s clauses are. A dropped constraint counts
+* as the key when it carries Postgres's default name for one, `<table>_pkey`;
+* a key under another name is caught by the `ADD PRIMARY KEY` that replaces it.
+*/
+function describePrimaryKeyChange(statement) {
+	const alter = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!alter) return void 0;
+	const table = alter[2] ? `${alter[1]}.${alter[2]}` : alter[1];
+	let added;
+	let dropped;
+	for (const clause of splitClauses(alter[3])) {
+		const add = ADD_PRIMARY_KEY_RE.exec(clause);
+		if (add) {
+			added = add[1] === void 0 ? "a new key" : `(${add[1].split(",").map((c) => c.trim()).join(", ")})`;
+			continue;
+		}
+		const drop = DROP_CONSTRAINT_RE.exec(clause);
+		if (drop && unquote(drop[1]).endsWith("_pkey")) dropped = drop[1];
+	}
+	if (added && dropped) return `${table} is re-keyed on ${added}: ${ROW_ADDRESS_LOST}`;
+	if (added) return `${table} gets the primary key ${added}: rows are addressed by it from now on, and the push fails if two rows share a value`;
+	if (dropped) return `${table} loses its primary key ${dropped}: ${ROW_ADDRESS_LOST}`;
+}
+/**
+* The CHECK and EXCLUDE constraints an `ALTER TABLE` drops, in a sentence — or
+* `undefined` when it drops none.
+*
+* Matched by name on the statement's table, in its schema when the plan names
+* one (Atlas always does). A constraint the catalogue does not list as a CHECK
+* or an EXCLUDE — a foreign key, a `UNIQUE`, the primary key — is not this.
+*/
+function describeConstraintDrops(statement, constraints) {
+	if (constraints.length === 0) return void 0;
+	const alter = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!alter) return void 0;
+	const [schema, table] = alter[2] ? [unquote(alter[1]), unquote(alter[2])] : [void 0, unquote(alter[1])];
+	const lost = [];
+	for (const clause of splitClauses(alter[3])) {
+		const drop = DROP_CONSTRAINT_RE.exec(clause);
+		if (!drop) continue;
+		const name = unquote(drop[1]);
+		const constraint = constraints.find((c) => c.table === table && c.name === name && (schema === void 0 || c.schema === schema));
+		if (constraint) lost.push(`${constraint.kind === "check" ? "CHECK" : "EXCLUDE"} "${name}"`);
+	}
+	if (lost.length === 0) return void 0;
+	return `${schema ? `${schema}.${table}` : table} loses ${lost.join(", ")}: no row is lost, and the database accepts every row ${lost.length === 1 ? "it refuses" : "they refuse"} today`;
+}
+/**
+* The column's current type. A table named without its schema matches in any
+* schema, but only when every match agrees — two same-named tables with
+* different types leave the answer unknown.
+*/
+function currentTypeOf(change, columnTypes) {
+	const types = new Set(columnTypes.filter((col) => col.table === change.table && col.column === change.column && (change.schema === void 0 || col.schema === change.schema)).map((col) => col.type));
+	return types.size === 1 ? [...types][0] : void 0;
+}
+/** Spellings of one type, mapped to one name. Anything absent compares verbatim. */
+var TYPE_ALIASES = {
+	"int": "integer",
+	"int4": "integer",
+	"int2": "smallint",
+	"int8": "bigint",
+	"character varying": "varchar",
+	"decimal": "numeric",
+	"timestamp without time zone": "timestamp",
+	"timestamp with time zone": "timestamptz",
+	"time without time zone": "time",
+	"time with time zone": "timetz",
+	"bool": "boolean",
+	"float4": "real",
+	"float8": "double precision",
+	"character": "bpchar",
+	"char": "bpchar"
+};
+/** Decimal digits each integer type holds, which is what a `numeric` must hold too. */
+var INTEGER_DIGITS = {
+	smallint: 5,
+	integer: 10,
+	bigint: 19
+};
+/** Types whose modifier is a fractional-seconds precision, 6 when absent. */
+var SECONDS_PRECISION = /* @__PURE__ */ new Set([
+	"timestamp",
+	"timestamptz",
+	"time",
+	"timetz"
+]);
+function parseType(raw) {
+	let text = raw.trim().replace(/\s+/g, " ");
+	let dims = 0;
+	for (let suffix = /\s*\[\d*\]$/.exec(text); suffix; suffix = /\s*\[\d*\]$/.exec(text)) {
+		dims++;
+		text = text.slice(0, suffix.index);
+	}
+	if (text.includes("\"")) return {
+		base: text,
+		dims
+	};
+	text = text.toLowerCase().replace(/^pg_catalog\./, "");
+	let args;
+	const modifier = /\(([^)]*)\)/.exec(text);
+	if (modifier) {
+		args = modifier[1].split(",").map((part) => Number(part.trim()));
+		text = `${text.slice(0, modifier.index)} ${text.slice(modifier.index + modifier[0].length)}`.replace(/\s+/g, " ").trim();
+	}
+	return {
+		base: TYPE_ALIASES[text] ?? text,
+		args,
+		dims
+	};
+}
+/** Does moving from one modifier to another, on the same type, keep every value? */
+function modifierWidens(base, from, to) {
+	if (JSON.stringify(from) === JSON.stringify(to)) return true;
+	if (base === "varchar") return to === void 0 || from !== void 0 && to[0] >= from[0];
+	if (base === "numeric") {
+		if (to === void 0) return true;
+		if (from === void 0) return false;
+		const [p1, s1 = 0] = from;
+		const [p2, s2 = 0] = to;
+		return s2 >= s1 && p2 - s2 >= p1 - s1;
+	}
+	if (SECONDS_PRECISION.has(base)) return (to?.[0] ?? 6) >= (from?.[0] ?? 6);
+	return false;
+}
+/**
+* Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly
+* as it was?
+*
+* Deliberately short. Everything not listed needs a confirmation, including
+* changes that are usually harmless: `timestamp` → `timestamptz` reads each
+* value in the session's time zone, `json` → `jsonb` drops duplicate keys,
+* `real` → `double precision` prints 0.1 as 0.100000001490116, and `integer` →
+* `text` keeps the digits but changes what the column is.
+*
+*  - the same type, with a modifier at least as wide (`varchar(100)` →
+*    `varchar(255)`, `numeric(10,2)` → `numeric(12,2)` or unbounded,
+*    `timestamptz(3)` → `timestamptz`);
+*  - `smallint` → `integer` → `bigint`, and any of them to a `numeric` with
+*    room for all their digits;
+*  - `varchar(n)` → `text`, and `text` → an unbounded `varchar`.
+*
+* Arrays follow their element type, and never gain or lose a dimension.
+*/
+function isLosslessTypeChange(from, to) {
+	const a = parseType(from);
+	const b = parseType(to);
+	if (a.dims !== b.dims) return false;
+	if (a.args?.some(Number.isNaN) || b.args?.some(Number.isNaN)) return false;
+	if (a.base === b.base) return modifierWidens(a.base, a.args, b.args);
+	const fromDigits = INTEGER_DIGITS[a.base];
+	if (fromDigits !== void 0) {
+		const toDigits = INTEGER_DIGITS[b.base];
+		if (toDigits !== void 0) return toDigits >= fromDigits;
+		if (b.base === "numeric") return b.args === void 0 || b.args[0] - (b.args[1] ?? 0) >= fromDigits;
+		return false;
+	}
+	if (a.base === "varchar" && b.base === "text") return true;
+	if (a.base === "text" && b.base === "varchar") return b.args === void 0;
+	return false;
+}
+/**
+* The flag that opted a push into destructive changes, as it was given —
+* `--allow-destructive`, or its alias `--yes` / `-y` — or `undefined` for
+* none. The line that says why a destructive push went ahead names the one
+* the user typed: "because --allow-destructive was passed" to someone who
+* typed `--yes` reads like a flag they never set.
+*/
+function destructiveOptInFlag(args) {
+	if (args["--allow-destructive"] === true) return "--allow-destructive";
+	if (args["--yes"] === true) return "--yes";
+}
+/**
+* Decide how `db push` should proceed given the plan's destructiveness and
+* the invocation context.
+*
+*  - No destructive statements → `apply` (safe to auto-approve).
+*  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+*  - Destructive + interactive TTY → `confirm` (prompt before applying).
+*  - Destructive + non-interactive → `refuse` (never silently drop data in
+*    CI / scripts / agents).
+*/
+function decidePushSafety(opts) {
+	if (opts.destructiveCount === 0) return "apply";
+	if (opts.allowDestructive) return "apply";
+	return opts.interactive ? "confirm" : "refuse";
+}
+//#endregion
+//#region src/schema/undeclarable-constraints.ts
+/**
+* The constraints a collection cannot declare, and how `db push` keeps Atlas
+* from dropping them.
+*
+* `db push` is declarative: Atlas makes each managed table match `schema.sql`,
+* and anything on the table that `schema.sql` does not mention is planned as a
+* drop. The collection model declares a table's primary key, its columns'
+* `NOT NULL`, `UNIQUE` and foreign keys, and nothing else. So a hand-written
+* `CHECK (total >= 0)` — or one an adopted database arrived with, which
+* `schema introspect` reads as `validation.min: 0` — was dropped by the first
+* push, in the same `ALTER TABLE` as whatever else the push changed, with no
+* prompt. From then on the database accepted every row the constraint used to
+* refuse, while the form still enforced the rule and so hid that it had gone.
+*
+* EXCLUDE constraints are the same case: Atlas inspects them and plans their
+* drop the same way. Triggers and functions are not: Atlas's free tier does
+* not inspect either, so it never plans a drop for one. Measured on the pinned
+* atlas 1.2.3 against PG 18; `introspect-check-constraints-e2e` pins all four.
+*
+* Ownership, as with indexes (`getForeignIndexExcludes` in `cli-helpers.ts`)
+* and policies: a constraint the desired state declares is
+* Atlas's to manage, and every other CHECK or EXCLUDE is somebody else's and is
+* kept out of the plan with `--exclude`. Today the desired state declares
+* neither kind, so every one is kept. A rule nobody wants any more is dropped
+* by hand (`ALTER TABLE … DROP CONSTRAINT …`), which is the only statement that
+* can say so.
+*
+* Side-effect free, so it is unit-tested without Atlas or a database.
+*/
+/**
+* Every CHECK and EXCLUDE constraint on an ordinary or partitioned table
+* outside the system schemas.
+*
+* `contype` `c` and `x` only. A primary key (`p`), `UNIQUE` (`u`), foreign key
+* (`f`) and, from PG 18, a catalogued `NOT NULL` (`n`) are what a collection
+* declares, so Atlas keeps managing them.
+*/
+var UNDECLARABLE_CONSTRAINTS_SQL = `
+    SELECT n.nspname AS "schema",
+           c.relname AS "table",
+           con.conname AS "name",
+           CASE con.contype WHEN 'c' THEN 'check' ELSE 'exclude' END AS "kind"
+    FROM pg_constraint con
+    JOIN pg_class c     ON c.oid = con.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE con.contype IN ('c', 'x')
+      AND c.relkind IN ('r', 'p')
+      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND n.nspname NOT LIKE 'pg\\_%'
+`;
+var DECLARED_CONSTRAINT_RE = /\bCONSTRAINT\s+"((?:[^"]|"")+)"\s+(?:CHECK|EXCLUDE)\b/gi;
+/**
+* The CHECK and EXCLUDE constraint names a desired state (`schema.sql`)
+* declares — Atlas's to manage, and so never excluded.
+*/
+function declaredConstraintNames(desiredSql) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of desiredSql.matchAll(DECLARED_CONSTRAINT_RE)) names.add(match[1].replace(/""/g, "\""));
+	return names;
+}
+/**
+* The `--exclude` patterns that keep Atlas from dropping the CHECK and EXCLUDE
+* constraints the desired state does not declare. Three-part
+* `schema.table.constraint`, which is what Atlas matches a constraint by: a
+* two-part pattern reads as a table, matches nothing, and reports no error.
+*/
+function undeclaredConstraintExcludes(existing, desiredSql) {
+	const declared = declaredConstraintNames(desiredSql);
+	return existing.filter((constraint) => !declared.has(constraint.name)).map((constraint) => atlasExcludePattern(constraint.schema, constraint.table, constraint.name));
+}
+//#endregion
+//#region src/module-dir.ts
+var moduleDir = path.dirname(fileURLToPath(import.meta.url));
+//#endregion
+//#region src/generated-sql.ts
+/**
+* Where `db push` and `db generate` put the SQL they render from the collections.
+*
+* Five files — `schema.sql` (Atlas's desired state), `policies.sql`,
+* `search.sql`, `vector.sql` and `triggers.sql` — and every one of them is
+* scratch. Both commands regenerate all five before reading any of them, and
+* nothing else reads them at all. They used to be written into `drizzle/`, beside
+* the migrations, and committed: a copy nobody read, which every collection
+* change rewrote in the diff and every two branches touching collections
+* conflicted on.
+*
+* Relative to the directory the command runs in (the backend), like the
+* migrations are.
+*/
+/** The directory, relative to the working directory. POSIX, because it is also a URL path. */
+var GENERATED_SQL_DIR = ".rebase/sql";
+/**
+* `schema.sql` as Atlas takes it. Relative on purpose, like the
+* `file://drizzle/migrations` beside it: Atlas joins the URL's host and path, so
+* `.rebase` is read as the first path segment, measured against the pinned 1.2.3.
+*/
+var DESIRED_STATE_URL = `file://${GENERATED_SQL_DIR}/schema.sql`;
+/** The files the DDL generator writes, all of them derived from the collections. */
+var GENERATED_SQL_FILES = [
+	"schema.sql",
+	"policies.sql",
+	"search.sql",
+	"vector.sql",
+	"triggers.sql"
+];
+/** The absolute directory, for the working directory the command runs in. */
+function generatedSqlDir(cwd = process.cwd()) {
+	return path.resolve(cwd, GENERATED_SQL_DIR);
+}
+/**
+* The first line of every file the generator writes, in every release that
+* wrote them into `drizzle/`. Matching it is what makes removing the old copy
+* safe: a file there under one of these names that does not open this way was
+* written by a person, and is left alone.
+*/
+var GENERATED_HEADER = /^-- This file (is auto-generated by the Rebase DDL generator|contains RLS policies generated by Rebase)\./;
+/**
+* Get the directory ready to be written, and retire the copies an older release
+* committed.
+*
+* The directory ignores itself, rather than relying on the project's
+* `.gitignore`: a scaffold ignores `.rebase/`, but a project created before it
+* did would otherwise start committing these files from their new home.
+*
+* The old copies in `drizzle/` are deleted, not left behind. Nothing writes them
+* any more, so from the first push after an upgrade they only fall further
+* behind — and a stale `policies.sql` in the repository is exactly what someone
+* reviewing the project's RLS would read.
+*
+* With `retire: false` (`db push --dry-run`, which writes nothing of the
+* project's) the old copies are only found, not removed.
+*
+* @returns the old files it removed — or, with `retire: false`, would remove —
+*   relative to the working directory.
+*/
+function prepareGeneratedSqlDir(cwd = process.cwd(), options = {}) {
+	const dir = generatedSqlDir(cwd);
+	fs.mkdirSync(dir, { recursive: true });
+	const ignore = path.join(dir, ".gitignore");
+	if (!fs.existsSync(ignore)) fs.writeFileSync(ignore, "# Generated by `rebase db push` / `rebase db generate` from the collections.\n*\n");
+	const removed = [];
+	for (const name of GENERATED_SQL_FILES) {
+		const legacy = path.join(cwd, "drizzle", name);
+		if (!fs.existsSync(legacy)) continue;
+		const firstLine = fs.readFileSync(legacy, "utf-8").split("\n", 1)[0];
+		if (!GENERATED_HEADER.test(firstLine)) continue;
+		if (options.retire !== false) fs.rmSync(legacy);
+		removed.push(path.posix.join("drizzle", name));
+	}
+	return removed;
+}
+//#endregion
+//#region src/cli-helpers.ts
+/**
+* Which package manager installed this project, read off its lockfile.
+*
+* Every remedy for a blocked build script is package-manager specific, and
+* naming the wrong one is the same failure as naming none: `pnpm approve-builds`
+* is not a thing an npm user can run, and `pnpm.onlyBuiltDependencies` is a key
+* npm does not read. This existed as a pnpm-only message for long enough that
+* npm 12 — which blocks dependency lifecycle scripts by default, the way pnpm 10
+* does — could ship and leave every npm reader three unfollowable commands deep.
+*
+* The lockfile, not `npm_config_user_agent`: the question is how the project's
+* `node_modules` was built, not which binary happens to be invoking us. Walks up
+* because commands run from `backend/` in a scaffolded project, and the lockfile
+* is at the workspace root.
+*/
+function detectProjectPackageManager(startDir = process.cwd()) {
+	const lockfiles = [
+		["pnpm-lock.yaml", "pnpm"],
+		["bun.lock", "bun"],
+		["bun.lockb", "bun"],
+		["yarn.lock", "yarn"],
+		["package-lock.json", "npm"]
+	];
+	let dir = path.resolve(startDir);
+	while (true) {
+		for (const [file, manager] of lockfiles) if (fs.existsSync(path.join(dir, file))) return manager;
+		const parent = path.dirname(dir);
+		if (parent === dir) return "unknown";
+		dir = parent;
+	}
+}
+/**
+* How to let `@ariga/atlas` run its `preinstall`, in the reader's own package
+* manager.
+*
+* Returns the lines to print after "the binary is missing but the package is
+* installed". Kept next to {@link detectProjectPackageManager} so the two move
+* together, and returned rather than printed so it can be asserted on.
+*/
+function describeBuildScriptRemedy(packageName, manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return [
+			`    npm install-scripts approve ${packageName}`,
+			"",
+			"  or, to record it in the project (what `rebase init` scaffolds):",
+			"",
+			"    // package.json",
+			`    "allowScripts": { "${packageName}": true }`,
+			"",
+			"  Then re-run `npm install`."
+		];
+		case "yarn": return [
+			"    // .yarnrc.yml",
+			"    enableScripts: true",
+			"",
+			"  Then re-run `yarn install`."
+		];
+		case "bun": return [
+			"    // package.json",
+			`    "trustedDependencies": ["${packageName}"]`,
+			"",
+			"  Then re-run `bun install`."
+		];
+		default: return [
+			"    pnpm approve-builds",
+			"",
+			"  or, to record it in the project (what `rebase init` scaffolds):",
+			"",
+			"    // package.json",
+			`    "pnpm": { "onlyBuiltDependencies": ["${packageName}"] }`,
+			"",
+			"  Then re-run `pnpm install`."
+		];
+	}
+}
+/**
+* "Install again, from scratch", in the reader's own package manager.
+*
+* For the `bin-link-missing` state: the tree is half-written, and re-resolving
+* it is what recreates the `.bin` shim. `--force` on pnpm is what makes it
+* relink rather than decide the tree is already up to date.
+*/
+function describeReinstallCommand(manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return "rm -rf node_modules && npm install";
+		case "yarn": return "yarn install --force";
+		case "bun": return "rm -rf node_modules && bun install";
+		default: return "pnpm install --force";
+	}
+}
+/** `add <pkg>` as a dev dependency, in the reader's own package manager. */
+function describeDevAddCommand(packageName, manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return `npm install -D ${packageName}`;
+		case "yarn": return `yarn add -D ${packageName}`;
+		case "bun": return `bun add -d ${packageName}`;
+		default: return `pnpm add -D ${packageName}`;
+	}
+}
+/**
+* Where a package's own manifest lives, or null if it is not installed here.
+*
+* `package.json` rather than the package root: a package with an `exports` map
+* that omits `.` is unresolvable by name even when it is perfectly installed,
+* which would misreport it as absent.
+*/
+function resolvePackageManifest(packageName) {
+	const bases = [pathToFileURL(path.join(process.cwd(), "package.json")), pathToFileURL(path.join(moduleDir, "package.json"))];
+	for (const base of bases) try {
+		return createRequire(base).resolve(`${packageName}/package.json`);
+	} catch {}
+	return null;
+}
+/**
+* The binaries a package's own manifest declares, as absolute paths.
+*
+* `bin` is a string for a single binary named after the package, or a map.
+* Both forms appear in the wild and `@ariga/atlas` uses the map.
+*/
+function declaredBinaries(manifestPath) {
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	} catch {
+		return [];
+	}
+	const dir = path.dirname(manifestPath);
+	if (typeof manifest.bin === "string") return [path.resolve(dir, manifest.bin)];
+	if (manifest.bin && typeof manifest.bin === "object") return Object.values(manifest.bin).filter((target) => typeof target === "string").map((target) => path.resolve(dir, target));
+	return [];
+}
+function diagnoseMissingBin(packageName) {
+	const manifestPath = resolvePackageManifest(packageName);
+	if (!manifestPath) return "not-installed";
+	const binaries = declaredBinaries(manifestPath);
+	if (binaries.length === 0) return "build-script-blocked";
+	return binaries.some((file) => fs.existsSync(file)) ? "bin-link-missing" : "build-script-blocked";
+}
+function resolveLocalBin(binName) {
+	let dir = moduleDir;
+	while (true) {
+		const candidate = path.join(dir, "node_modules", ".bin", binName);
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	let cwd = process.cwd();
+	while (true) {
+		const candidate = path.join(cwd, "node_modules", ".bin", binName);
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(cwd);
+		if (parent === cwd) break;
+		cwd = parent;
+	}
+	try {
+		const globalPath = execSync(process.platform === "win32" ? `where ${binName}` : `which ${binName}`, { encoding: "utf-8" }).trim().split("\n")[0].trim();
+		if (globalPath && fs.existsSync(globalPath)) return globalPath;
+	} catch {}
+	return null;
+}
+async function getTableIncludesFromCollections(allCollections) {
+	const { getTableName, relationalCollections, resolveJunctionSpecs } = await import("@rebasepro/common");
+	const { isPostgresCollectionConfig } = await import("@rebasepro/types");
+	const collections = relationalCollections(allCollections);
+	const includes = [];
+	for (const col of collections) {
+		const tableName = getTableName(col);
+		const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
+		if (tableName) includes.push(`${schema}.${tableName}`);
+	}
+	for (const junction of resolveJunctionSpecs(collections).values()) includes.push(`${junction.schema}.${junction.table}`);
+	return Array.from(new Set(includes));
+}
+async function getTableIncludes(collectionsPath) {
+	return getTableIncludesFromCollections(await loadCollectionsForCli(collectionsPath));
+}
+/**
+* Load a project's collections the way the Atlas-facing commands need them.
+*
+* Deliberately forgiving — a file that fails to import is skipped rather than
+* fatal — because the callers use this to *narrow* what Atlas may touch, and a
+* hard failure here would block a push over an unrelated broken file. Callers
+* that cannot tolerate a partial answer (the table excludes, which fail closed)
+* check the result themselves.
+*/
+/** Paths this process has already complained about. See {@link loadCollectionsForCli}. */
+var warnedMissingCollectionsPaths = /* @__PURE__ */ new Set();
+async function loadCollectionsForCli(collectionsPath) {
+	const resolvedPath = path.resolve(collectionsPath);
+	const collections = [];
+	if (!fs.existsSync(resolvedPath) && !warnedMissingCollectionsPaths.has(resolvedPath)) {
+		warnedMissingCollectionsPaths.add(resolvedPath);
+		outWarn(chalk.yellow(`  ⚠  Collections path not found: "${collectionsPath}"\n     Resolved to: ${resolvedPath}\n     (relative to cwd: ${process.cwd()})\n     Pass an absolute path, or a path relative to where you run the command.`));
+	}
+	if (fs.existsSync(resolvedPath)) {
+		if (fs.statSync(resolvedPath).isDirectory()) {
+			const files = fs.readdirSync(resolvedPath);
+			for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") try {
+				const module = await import(pathToFileURL(path.join(resolvedPath, file)).href);
+				if (module && module.default) collections.push(module.default);
+			} catch {}
+		}
+	}
+	return collections;
+}
+/**
+* The app database connections this process has open, by URL — one each.
+*
+* `rebase db push` used to open a connection per step: the auth bootstrap, the
+* connectivity probe, each catalogue read behind the Atlas excludes, the
+* column types, the generated-column edges, and then every post-step — RLS
+* lock, auth tables, vector, search, triggers, policies, reconcile, role,
+* legacy schema. 18 of them on a push that changed nothing. Locally each costs
+* a few milliseconds; against a hosted Postgres over TLS a connect is four or
+* five round trips (TCP, TLS 1.3, startup, SCRAM twice) — about 4 s of every
+* push at 40 ms, and more on a serverless database that wakes per connection.
+*
+* Opened on first use and closed by {@link closeAppClients} when the command
+* ends. The scratch database Atlas plans in is created and dropped through the
+* `postgres` database, on a connection of its own: it is not this one.
+*/
+var appClients = /* @__PURE__ */ new Map();
+async function openAppClient(databaseUrl, connectionTimeoutMillis) {
+	const open = appClients.get(databaseUrl);
+	if (open) return open;
+	const opening = (async () => {
+		const { Client } = await import("pg");
+		const client = new Client({
+			connectionString: databaseUrl,
+			...connectionTimeoutMillis ? { connectionTimeoutMillis } : {}
+		});
+		const forget = () => {
+			if (appClients.get(databaseUrl) === opening) appClients.delete(databaseUrl);
+		};
+		client.on("error", forget);
+		client.on("end", forget);
+		await client.connect();
+		return client;
+	})();
+	appClients.set(databaseUrl, opening);
+	try {
+		return await opening;
+	} catch (err) {
+		appClients.delete(databaseUrl);
+		throw err;
+	}
+}
+/**
+* Run one step on this process's connection to the app database.
+*
+* Every step leaves the session as it found it, which is what a connection of
+* its own used to guarantee by being closed. None of them sets anything for
+* the session — `SET LOCAL` inside their own transaction, or `RESET` — and one
+* that fails part-way through a transaction it opened is rolled back here, so
+* the next step does not meet `current transaction is aborted`.
+*
+* @param options.connectionTimeoutMillis applies only when this call is the one
+*        that connects.
+*/
+async function withAppClient(databaseUrl, step, options = {}) {
+	const client = await openAppClient(databaseUrl, options.connectionTimeoutMillis);
+	try {
+		return await step(client);
+	} catch (err) {
+		await client.query("ROLLBACK").catch(() => void 0);
+		throw err;
+	}
+}
+/** Close every connection {@link withAppClient} opened. Called once, as the command ends. */
+async function closeAppClients() {
+	const open = [...appClients.values()];
+	appClients.clear();
+	await Promise.all(open.map(async (opening) => {
+		try {
+			await (await opening).end();
+		} catch {}
+	}));
+}
+/**
+* Names the empty database Atlas plans against, instead of `<db>_dev_diff`.
+*
+* The derived one is made with `CREATE DATABASE` beside the real database,
+* which assumes a server that holds more than one. PGlite — the managed
+* development database — serves exactly one: the CREATE succeeds and creates
+* nothing, so Atlas connected straight back to the database it was comparing
+* and refused it as "not clean". `rebase db push` on the managed database now
+* starts a second, throwaway PGlite and names it here. Anyone can name their
+* own the same way; a named database is neither created nor dropped.
+*/
+var ATLAS_DEV_URL_ENV = "REBASE_ATLAS_DEV_URL";
+/**
+* The database Atlas replays the desired schema into: the one
+* {@link ATLAS_DEV_URL_ENV} names (`named: true` — not ours to create or
+* drop), else `<db>_dev_diff`.
+*/
+function atlasDevDatabaseUrl(databaseUrl, env) {
+	const named = env[ATLAS_DEV_URL_ENV]?.trim();
+	if (!named) return {
+		url: getDevDatabaseUrl(databaseUrl),
+		named: false
+	};
+	if (named === databaseUrl.trim()) throw new Error(`${ATLAS_DEV_URL_ENV} names the same database as DATABASE_URL. It must be a separate, empty database that Atlas may fill and clear.`);
+	return {
+		url: named,
+		named: true
+	};
+}
+function getDevDatabaseUrl(databaseUrl) {
+	try {
+		const parsed = new URL(databaseUrl);
+		parsed.pathname = `/${parsed.pathname.slice(1)}_dev_diff`;
+		return parsed.toString();
+	} catch {
+		return databaseUrl + "_dev_diff";
+	}
+}
+/**
+* Create the scratch database Atlas plans against, and say so when we cannot.
+*
+* Atlas needs a `--dev-url` — an empty database it can build the desired state
+* in — and this makes `<db>_dev_diff` next to the real one. The whole body used
+* to be wrapped in an empty catch commented "Ignore, let Atlas handle
+* connection failures", and Atlas's version of handling it is `postgres:
+* querying system variables: pq: database "app_dev_diff" does not exist
+* (3D000)` — the symptom, four frames downstream of the cause, with the cause
+* thrown away.
+*
+* The cause is almost always `42501`: `CREATE DATABASE` is a privilege managed
+* providers do not grant, so this is the first thing a hosted user hits and the
+* one they can do least with.
+*
+* @returns whether the scratch database was created by *this* call — the only
+*          case in which dropping it afterwards is ours to do.
+*/
+async function ensureDevDatabaseExists(databaseUrl, devDatabaseUrl) {
+	let devDbName = "";
+	try {
+		const { Client } = await import("pg");
+		const parsed = new URL(databaseUrl);
+		devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+		parsed.pathname = "/postgres";
+		const client = new Client({ connectionString: parsed.toString() });
+		await client.connect();
+		try {
+			if ((await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName])).rowCount === 0) {
+				await client.query(`CREATE DATABASE "${devDbName}"`);
+				out(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
+				return true;
+			}
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(describeDevDatabaseFailure(err, devDbName || "<db>_dev_diff"));
+	}
+	return false;
+}
+/**
+* What went wrong creating the scratch database, and what to do about it.
+*
+* Exported for its test: the `42501` branch is the one that matters and it
+* cannot be provoked without a non-superuser role.
+*/
+function describeDevDatabaseFailure(err, devDbName) {
+	const code = err?.code;
+	const message = err instanceof Error ? err.message : String(err);
+	const lines = [chalk.yellow(`  ⚠  Could not create the Atlas scratch database "${devDbName}": ${message}`)];
+	if (code === "42501") lines.push(chalk.gray(`     Atlas plans every change in a throwaway copy of the schema, and CREATE DATABASE
+     is a privilege most managed providers withhold. Two ways forward:
+       • GRANT the role CREATEDB:  ALTER ROLE "<role>" CREATEDB;
+       • or create it once by hand:  CREATE DATABASE "${devDbName}";`));
+	else lines.push(chalk.gray("     Atlas will fail next with `database \"" + devDbName + "\" does not exist (3D000)`, which is this."));
+	return lines.join("\n");
+}
+/**
+* Drop the scratch database again, after the command that needed it succeeded.
+*
+* It is a full copy of the schema — no rows, but every table, type and index —
+* and it was left behind per target forever. The only notice anyone got was
+* `rebase db branch prune` reporting "3 Atlas scratch database(s) left over
+* from db push", and on a provider that bills per database it is a silent cost.
+*
+* Deliberately NOT called on the failure path: after a failed push the scratch
+* database holds the state Atlas was planning against, which is the one thing
+* worth inspecting.
+*/
+async function dropDevDatabase(databaseUrl, devDatabaseUrl) {
+	try {
+		const { Client } = await import("pg");
+		const parsed = new URL(databaseUrl);
+		const devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+		parsed.pathname = "/postgres";
+		const client = new Client({ connectionString: parsed.toString() });
+		await client.connect();
+		try {
+			await client.query(`DROP DATABASE IF EXISTS "${devDbName}"`);
+			out(chalk.gray(`  ✓ Removed validation database "${devDbName}"`));
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(chalk.gray(`  ⚠  Could not remove the Atlas scratch database: ${err instanceof Error ? err.message : String(err)}\n     \`rebase db branch prune --include-dev-diff\` clears them.`));
+	}
+}
+/**
+* The generated SQL for the project's `search` blocks, if it has any.
+*
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
+*/
+function readSearchDdl(sqlDir = generatedSqlDir()) {
+	const searchFile = path.join(sqlDir, "search.sql");
+	if (!fs.existsSync(searchFile)) return "";
+	return fs.readFileSync(searchFile, "utf-8").trim();
+}
+/**
+* Bring the search column, its index and their helpers up to date.
+*
+* Runs *after* Atlas, not before: the statements are `ALTER TABLE ... ADD
+* COLUMN`, so the table has to exist. Atlas is told to ignore these objects
+* entirely (`getSearchExcludes`) — it cannot manage them, and left to itself it
+* would plan a `DROP COLUMN` for every one, since they are absent from the
+* desired state it was given.
+*
+* A no-op when no collection declared `search`. A failure is *not* swallowed:
+* silently pushing a schema whose search column never appeared is how a
+* collection ends up with search configured, no error anywhere, and no results.
+*/
+async function applySearchDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readSearchDdl(sqlDir);
+	if (!sql) return;
+	await withAppClient(databaseUrl, (client) => client.query(sql));
+	out(chalk.gray("  ✓ Applied full-text search columns and indexes"));
+}
+/**
+* Glob patterns keeping Atlas away from the search objects.
+*
+* Returns an empty list — and so changes nothing — for a project with no
+* `search` block, which is every project that has not opted in.
+*/
+async function getSearchExcludes(collectionsPath) {
+	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
+}
+/**
+* Every `generated column → column it reads` edge in the database.
+*
+* Read from `pg_depend` rather than by matching names in the expression text:
+* a generated column's `pg_attrdef` row carries one `deptype = 'n'` dependency
+* per column its expression references, which is the catalogue's own answer and
+* cannot be fooled by a column name that also appears inside a string literal
+* or as part of a longer identifier.
+*
+* Used by `db push` to find what has to come out of the way before Atlas runs —
+* see `generated-column-conflicts.ts` for why that is necessary at all.
+*/
+async function queryGeneratedColumnDependencies(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		return (await client.query(`
+            SELECT n.nspname       AS "schema",
+                   c.relname       AS "table",
+                   gen.attname     AS "column",
+                   dep.attname     AS "dependsOn"
+            FROM pg_attrdef ad
+            JOIN pg_class c         ON c.oid = ad.adrelid
+            JOIN pg_namespace n     ON n.oid = c.relnamespace
+            JOIN pg_attribute gen   ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum
+            JOIN pg_depend d        ON d.classid = 'pg_attrdef'::regclass
+                                   AND d.objid = ad.oid
+                                   AND d.refclassid = 'pg_class'::regclass
+                                   AND d.refobjid = ad.adrelid
+                                   AND d.deptype = 'n'
+            JOIN pg_attribute dep   ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid
+            WHERE gen.attgenerated <> ''
+              AND NOT gen.attisdropped
+              AND NOT dep.attisdropped;
+        `)).rows;
+	});
+}
+/**
+* Every column in the database with its current type, for the destructive
+* gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.
+*/
+async function queryColumnTypes(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => (await client.query(COLUMN_TYPES_SQL)).rows);
+}
+/**
+* Drop the generated columns standing in the way of an apply.
+*
+* Their indexes and their `COMMENT ON COLUMN` stamp go with them, which is
+* exactly right: `applySearchDdl` rebuilds all three from `search.sql` and a
+* surviving stamp would make the rebuilt column look like drift.
+*/
+async function dropGeneratedColumns(databaseUrl, statements) {
+	if (statements.length === 0) return;
+	await withAppClient(databaseUrl, async (client) => {
+		for (const statement of statements) await client.query(statement);
+	});
+}
+/**
+* The generated SQL for the project's `vector` properties, if it has any.
+*
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
+*/
+function readVectorDdl(sqlDir = generatedSqlDir()) {
+	const vectorFile = path.join(sqlDir, "vector.sql");
+	if (!fs.existsSync(vectorFile)) return "";
+	return fs.readFileSync(vectorFile, "utf-8").trim();
+}
+/**
+* Install pgvector and bring the vector columns and their ANN indexes up to
+* date.
+*
+* Runs *after* Atlas, like {@link applySearchDdl} and for the same reason: the
+* statements are `ALTER TABLE … ADD COLUMN`, so the table has to exist. Atlas
+* is told to ignore these objects entirely ({@link getVectorExcludes}) — it
+* cannot manage a type its dev database is structurally incapable of having,
+* and left to itself it would plan a `DROP COLUMN` for every one.
+*
+* A no-op when no collection declares a `vector` property. A failure is *not*
+* swallowed: a push that reported success while the embedding column never
+* appeared is how a project ends up with vector search configured, no error
+* anywhere, and no results.
+*/
+async function applyVectorDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readVectorDdl(sqlDir);
+	if (!sql) return;
+	const { vectorExtensionHint } = await import("./vector-index-BFhyEaiz.js").then((n) => n.f);
+	try {
+		await withAppClient(databaseUrl, (client) => client.query(sql));
+	} catch (err) {
+		const message = err instanceof Error ? err.message : String(err);
+		const hint = vectorExtensionHint(message);
+		if (!hint) throw err;
+		throw new Error(`${message}${hint}`, { cause: err });
+	}
+	out(chalk.gray("  ✓ Applied vector columns and ANN indexes"));
+}
+/**
+* Glob patterns keeping Atlas away from the vector objects.
+*
+* Returns an empty list — and so changes nothing — for a project with no
+* `vector` property, which is every project that has not opted in.
+*/
+async function getVectorExcludes(collectionsPath) {
+	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
+}
+/**
+* The generated SQL for the project's `autoValue: "on_update"` properties, if
+* it has any.
+*
+* @param sqlDir directory holding the generated SQL. Defaults to
+*        `.rebase/sql` under the working directory.
+*/
+function readTriggersDdl(sqlDir = generatedSqlDir()) {
+	const triggersFile = path.join(sqlDir, "triggers.sql");
+	if (!fs.existsSync(triggersFile)) return "";
+	return fs.readFileSync(triggersFile, "utf-8").trim();
+}
+/**
+* Install the `updated_at` trigger function and bind it to every column that
+* asked for one.
+*
+* Runs *after* Atlas, like {@link applySearchDdl} and {@link applyVectorDdl}:
+* a trigger needs its table and its column to exist. Atlas is told to ignore
+* the triggers ({@link getTriggerExcludes}) because it cannot manage a function
+* at all — its free tier refuses to parse a desired state containing one.
+*
+* A no-op when no property declares `autoValue: "on_update"`. A failure is
+* *not* swallowed: a push that reported success while the trigger never
+* appeared is how `updated_at` ends up silently stale for every writer that is
+* not the driver, which is the whole reason the trigger exists.
+*/
+async function applyTriggersDdl(databaseUrl, sqlDir = generatedSqlDir()) {
+	const sql = readTriggersDdl(sqlDir);
+	if (!sql) return;
+	await withAppClient(databaseUrl, (client) => client.query(sql));
+	out(chalk.gray("  ✓ Applied `updated_at` triggers"));
+}
+/** @see getSearchExcludes */
+async function getTriggerExcludes(collectionsPath) {
+	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+	return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));
+}
+/**
+* Every index Postgres holds on a table, by its parts — never joined with `.`,
+* which a name may itself contain.
+*
+* Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
+* *constraint* to Atlas, diffed from the constraint declaration, and naming its
+* index in an exclude would shield the constraint itself.
+*/
+async function queryExistingIndexes(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		return (await client.query(`
+            SELECT n.nspname AS "schema", t.relname AS "table", i.relname AS "index"
+            FROM pg_index x
+            JOIN pg_class i ON i.oid = x.indexrelid
+            JOIN pg_class t ON t.oid = x.indrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+              AND t.relkind IN ('r', 'p')
+              AND NOT EXISTS (
+                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
+              );
+        `)).rows;
+	});
+}
+/**
+* Glob patterns keeping Atlas away from indexes that are not Rebase's.
+*
+* The problem this solves is live and predates the `indexes:` block. `db push`
+* is declarative, so an index on a managed table that is absent from
+* `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified
+* against atlas v1.2.3: create one by hand, re-run an unchanged push, and the
+* plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the
+* auto-approved apply took it without asking. Until now the only way to have
+* an index at all was to write it by hand, which made that the *only* outcome.
+*
+* Ownership rather than a prompt, because once indexes are declarable a drop
+* is usually correct: removing one from the config should remove it from the
+* database, quietly. What must never be dropped is an index Rebase never
+* created — a hand-written one, or one an introspected database arrived with.
+* {@link isRebaseIndexName} is the test, the same arrangement
+* `isGeneratedPolicyName` uses to let policy reconciliation drop only what it
+* generated.
+*
+* The named-in-the-desired-state check comes first and is what makes removal
+* work: a declared index that the author has just deleted still matches the
+* name pattern, is no longer in the plan, and so is *not* excluded — Atlas
+* drops it, as intended.
+*
+* Three-part `schema.table.index`, never two: a two-part pattern reads as a
+* *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
+* reports no error — the trap already recorded for the search excludes. And
+* spelled by `atlasExcludePattern`: a raw `orders_idx[v1]` is a glob that
+* matches `orders_idxv`, so that index was dropped with no prompt.
+*/
+async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {}) {
+	const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
+	const managed = await (deps.getManagedIndexNames ?? managedIndexNames)(collectionsPath);
+	let existing;
+	try {
+		existing = await queryIndexes(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	return existing.filter(({ index }) => {
+		if (managed.has(index)) return false;
+		return !isRebaseIndexName(index);
+	}).map(({ schema, table, index }) => atlasExcludePattern(schema, table, index));
+}
+/**
+* The index names the current collections would create — search, vector and
+* declared alike. Anything Atlas would emit is by definition not foreign.
+*/
+async function managedIndexNames(collectionsPath) {
+	const collections = await loadCollectionsForCli(collectionsPath);
+	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+	const { resolveColumnName } = await import("./column-plan-helpers-D_V4oaZh.js").then((n) => n.t);
+	const { buildCollectionIndexPlan } = await import("./source-DB6xJv3p.js").then((n) => n.d);
+	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
+	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) {
+		const object = excludePatternParts(pattern)?.[2];
+		if (object !== void 0) names.add(object);
+	}
+	return names;
+}
+/** Every CHECK and EXCLUDE constraint the database holds. @see UNDECLARABLE_CONSTRAINTS_SQL */
+async function queryUndeclarableConstraints(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => (await client.query(UNDECLARABLE_CONSTRAINTS_SQL)).rows);
+}
+/**
+* Patterns keeping Atlas away from the CHECK and EXCLUDE constraints the
+* collections do not declare — which, since a collection cannot declare
+* either, is all of them. See `schema/undeclarable-constraints.ts`.
+*
+* Fails CLOSED, like {@link getTableExcludes}: without the catalogue nothing
+* says which constraints are there, and a partial list lets the push drop a
+* rule the database enforces. `desiredSql` is the `schema.sql` Atlas is about
+* to diff against; a constraint it declares is Atlas's to manage.
+*/
+async function getUndeclaredConstraintExcludes(databaseUrl, desiredSql, deps = {}) {
+	const queryConstraints = deps.queryConstraints ?? queryUndeclarableConstraints;
+	let existing;
+	try {
+		existing = await queryConstraints(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for CHECK and EXCLUDE constraints: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	return undeclaredConstraintExcludes(existing, desiredSql);
+}
+async function queryExistingTables(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		return (await client.query(`
+            SELECT table_schema AS "schema", table_name AS "table"
+            FROM information_schema.tables
+            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+              AND table_type IN ('BASE TABLE', 'VIEW');
+        `)).rows;
+	});
+}
+/**
+* Raised when the exclude list could not be built. `db push` MUST abort on
+* this rather than continue: the exclude list is the only thing shielding
+* non-collection (user/system) tables from the auto-approved declarative
+* apply. A partial list — the old fail-open behaviour — meant a transient
+* introspection hiccup dropped every table not present in `schema.sql`.
+*/
+var ExcludeIntrospectionError = class extends Error {
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.cause = cause;
+		this.name = "ExcludeIntrospectionError";
+	}
+};
+/**
+* Build the `--exclude` list that protects tables Rebase doesn't manage from
+* the declarative apply. Anything not backing a collection (or its M2M
+* junctions) is excluded so Atlas never drops it.
+*
+* Fails **closed**: if the database can't be introspected we cannot know
+* which tables to protect, so we throw {@link ExcludeIntrospectionError}
+* instead of returning a near-empty list and letting the caller drop
+* everything.
+*
+* `deps` is injectable for tests; production uses the real pg-backed queries.
+*/
+async function getTableExcludes(databaseUrl, collectionsPath, deps = {}) {
+	const getIncludes = deps.getIncludes ?? getTableIncludes;
+	const queryTables = deps.queryExistingTables ?? queryExistingTables;
+	const includes = await getIncludes(collectionsPath);
+	const excludes = [
+		"atlas_schema_revisions.*",
+		"auth",
+		"auth.*",
+		"rebase",
+		"rebase.*"
+	];
+	let existingTables;
+	try {
+		existingTables = await queryTables(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	for (const { schema, table } of existingTables) if (!includes.includes(`${schema}.${table}`)) excludes.push(atlasExcludePattern(schema, table));
+	return excludes;
+}
+//#endregion
+//#region src/cli-errors.ts
+/**
+* Detect whether an error (or AggregateError wrapping multiple attempts)
+* represents an ECONNREFUSED — i.e. the database is simply not running.
+*
+* Handles:
+* - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
+* - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
+* - Drizzle's `cause`-wrapped pg errors
+*/
+function isEconnrefused(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (e.code === "ECONNREFUSED") return true;
+	if (Array.isArray(e.errors)) return e.errors.some((inner) => inner && typeof inner === "object" && inner.code === "ECONNREFUSED");
+	if (e.cause && typeof e.cause === "object") return isEconnrefused(e.cause);
+	return false;
+}
+/**
+* Detect PostgreSQL authentication failures.
+* PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)
+*/
+function isAuthFailure(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (e.code === "28P01" || e.code === "28000") return true;
+	if (e.cause && typeof e.cause === "object") return isAuthFailure(e.cause);
+	if ("message" in e && typeof e.message === "string") {
+		const msg = e.message.toLowerCase();
+		if (msg.includes("password authentication failed") || msg.includes("no pg_hba.conf entry")) return true;
+	}
+	return false;
+}
+/**
+* Detect the "SSL is not enabled on the server" failure — the client attempted
+* an SSL handshake against a Postgres server that doesn't support it (common
+* with a plain local dev database). The fix is `?sslmode=disable` on the URL.
+*/
+function isSslNotEnabled(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (typeof e.message === "string" && e.message.toLowerCase().includes("ssl is not enabled on the server")) return true;
+	if (e.cause && typeof e.cause === "object") return isSslNotEnabled(e.cause);
+	return false;
+}
+/**
+* Detect PostgreSQL "cannot drop ... because other objects depend on it"
+* (error code 2BP01, dependent_objects_still_exist). This is the failure that
+* strands a declarative `db push` half-applied when a collection is removed but
+* an enum type it defined is still referenced by another object.
+*/
+function isDependencyDropError(err) {
+	if (!err || typeof err !== "object") return false;
+	const e = err;
+	if (e.code === "2BP01") return true;
+	if (typeof e.message === "string") {
+		const msg = e.message.toLowerCase();
+		if (msg.includes("other objects depend on it") || msg.includes("cannot drop type")) return true;
+	}
+	if (e.cause && typeof e.cause === "object") return isDependencyDropError(e.cause);
+	return false;
+}
+/**
+* Parse host:port from a DATABASE_URL for display purposes.
+*
+* Exported because every message about a connection has to name the thing it
+* could not reach, and the boot path needs the same rendering the CLI banners
+* use — including the same refusal to print the URL itself, which carries the
+* password.
+*/
+function parseHostInfo(databaseUrl) {
+	try {
+		const parsed = new URL(databaseUrl);
+		return `${parsed.hostname}:${parsed.port || 5432}`;
+	} catch {
+		return "unknown";
+	}
+}
+/**
+* The sentence the operating system actually produced, dug out of the wrappers.
+*
+* `connect ECONNREFUSED 127.0.0.1:5432` is written by `net`, then wrapped by
+* `pg`, then wrapped again by Drizzle as `Failed query: …` — and on a
+* dual-stack host it is not in `.cause` at all but inside the
+* `AggregateError.errors` array of one attempt per resolved address. Printing
+* the banner without it loses the one token every search engine, runbook and
+* colleague recognises.
+*/
+function deepestErrorMessage(err) {
+	if (!err || typeof err !== "object") return null;
+	const e = err;
+	if (Array.isArray(e.errors)) for (const inner of e.errors) {
+		const deeper = deepestErrorMessage(inner);
+		if (deeper) return deeper;
+	}
+	if (e.cause) {
+		const deeper = deepestErrorMessage(e.cause);
+		if (deeper) return deeper;
+	}
+	if (typeof e.message === "string" && e.message && !e.message.startsWith("Failed query:")) return e.code ? `${e.message} (${e.code})` : e.message;
+	return null;
+}
+/** One indented line naming the driver's own reason, or nothing. */
+function driverReasonLine(err) {
+	const reason = err === void 0 ? null : deepestErrorMessage(err);
+	return reason ? `  The driver said: ${reason}\n\n` : "";
+}
+/**
+* Format a diagnostic banner for ECONNREFUSED errors.
+*/
+function formatConnectionRefusedBanner(databaseUrl, err) {
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Cannot connect to PostgreSQL at ${parseHostInfo(databaseUrl)}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + "  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • docker compose up -d db          (the service a Rebase scaffold ships)\n    • brew services start postgresql@18\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
+}
+/**
+* Format a diagnostic banner for authentication failures.
+*/
+function formatAuthFailureBanner(databaseUrl, err) {
+	const hostInfo = parseHostInfo(databaseUrl);
+	let username = "unknown";
+	try {
+		username = new URL(databaseUrl).username || "unknown";
+	} catch {}
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Authentication failed for user "${username}" at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + `  PostgreSQL rejected the credentials. Common fixes:
+
+    • Check the username and password in DATABASE_URL
+    • Verify the user exists:  psql -c "\\du"
+    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* Format a diagnostic banner for "SSL is not enabled on the server".
+*/
+function formatSslNotEnabledBanner(databaseUrl) {
+	const hostInfo = parseHostInfo(databaseUrl);
+	const suggestion = databaseUrl.includes("?") ? "&sslmode=disable" : "?sslmode=disable";
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  SSL is not enabled on the PostgreSQL server at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The client tried to connect over SSL, but the server does not\n  support it. This is normal for a plain local dev database.\n\n  Fix: append ${chalk.bold("sslmode=disable")} to DATABASE_URL, e.g.\n\n    DATABASE_URL=...${suggestion}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* Format a diagnostic banner for a dependency-drop failure during `db push`.
+* Explains that the database may be left partially migrated and how to recover.
+*/
+function formatDependencyDropBanner() {
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Schema push failed: a type/table could not be dropped
+      because other objects still depend on it.
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+  ${chalk.yellow("The database may now be partially migrated.")} Atlas applies\n  statements individually, so earlier changes in this push may\n  already be committed while later ones failed.\n\n  This commonly happens when a collection is removed but an enum\n  type it defined is still referenced. To recover:\n\n    1. Inspect the leftover object named in the error above.\n    2. Drop it with CASCADE, e.g.:\n         psql "$DATABASE_URL" -c 'DROP TYPE "<name>" CASCADE;'\n    3. Re-run:  ${chalk.bold.green("rebase db push")}\n\n  Prefer a safe, versioned workflow? Use ${chalk.bold("rebase db generate")}\n  + ${chalk.bold("rebase db migrate")} instead of push for destructive changes.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* Pre-flight check: verify that the database is reachable before running
+* a heavy subprocess (Atlas, migrations, etc.).
+*
+* Exits with code 1 and a friendly banner on known failure modes.
+* On unknown errors, logs a warning and allows the caller to proceed.
+*/
+async function checkDatabaseConnectivity(databaseUrl) {
+	try {
+		await withAppClient(databaseUrl, (client) => client.query("SELECT 1"), { connectionTimeoutMillis: 5e3 });
+	} catch (err) {
+		if (isEconnrefused(err)) {
+			outError(formatConnectionRefusedBanner(databaseUrl, err));
+			process.exit(1);
+		}
+		if (isAuthFailure(err)) {
+			outError(formatAuthFailureBanner(databaseUrl, err));
+			process.exit(1);
+		}
+		if (isSslNotEnabled(err)) {
+			outError(formatSslNotEnabledBanner(databaseUrl));
+			process.exit(1);
+		}
+		outWarn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
+		outWarn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
+	}
+}
+/**
+* Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).
+* Returns a formatted diagnostic string if the error matches a known pattern,
+* or null if unrecognized.
+*/
+function diagnoseDbError(err, databaseUrl) {
+	if (isEconnrefused(err)) return formatConnectionRefusedBanner(databaseUrl || "", err);
+	if (isAuthFailure(err)) return formatAuthFailureBanner(databaseUrl || "", err);
+	if (isSslNotEnabled(err)) return formatSslNotEnabledBanner(databaseUrl || "");
+	if (isDependencyDropError(err)) return formatDependencyDropBanner();
+	return null;
+}
+/**
+* Say why the command failed, on the way out.
+*
+* The entry point below used to be `.catch(() => process.exit(1))`, which threw
+* the error away. Every message this file and its services raise — "Branch
+* \"x\" already exists.", "the source database has active connections", "Branch
+* name is too long" — was written, wrapped in the right PG error code, and then
+* discarded one frame before it reached a terminal. What a developer saw was a
+* header line, no error, and exit 1.
+*
+* Two shapes are deliberately kept quiet:
+*
+* - **A child process that already spoke.** Atlas, `pg_dump` and `psql` run
+*   with inherited stdio, so their diagnosis is on the terminal already and
+*   execa's wrapper adds only `Command failed with exit code 1: atlas …`.
+*   `packages/cli` filters exactly these two phrasings one level up
+*   (`runDbCommand`), and this is that filter, for the process that is actually
+*   throwing.
+*
+* - **A message that is only a query.** Drizzle reports failures as
+*   `Failed query: <sql> params:` and hides the real PostgreSQL error in
+*   `cause`, so the wrapper alone tells a reader nothing they can act on. The
+*   cause is appended when it says something the message does not.
+*
+* - **An error that has already printed its own diagnosis**, marked
+*   `alreadyReported`. `CollectionsPathMissing` is one: it prints the path, what
+*   it resolved to and the cwd it resolved against, and then throws so the entry
+*   point owns the exit code. Repeating its one-line summary underneath would
+*   undo the "printed once" this whole path exists for.
+*
+* Whatever is printed has its connection-string passwords replaced (see
+* `redactConnectionPasswords`): a driver or tool error can quote the URL it was
+* given, and this line lands in terminals and CI logs.
+*/
+function reportCommandFailure(error) {
+	const message = redactConnectionPasswords(error instanceof Error ? error.message : String(error ?? ""));
+	if (error?.alreadyReported) return;
+	if (!message || /Command failed|exited with code/i.test(message)) return;
+	outError("");
+	outError(chalk.red(`  ✗ ${message}`));
+	const rawCause = extractCauseMessage(error);
+	const cause = rawCause ? redactConnectionPasswords(rawCause) : rawCause;
+	if (cause && !message.includes(cause)) outError(chalk.gray(`    ${cause}`));
+	outError("");
+}
+/**
+* `migrate apply` refusing because the database already has the schema.
+*
+* `42710` (duplicate_object), `42P07` (duplicate_table), `42701`
+* (duplicate_column) and `42P06` (duplicate_schema) are what a migration hits
+* when boot-ensure — or a `db push` — has already provisioned the objects it
+* was going to create. Since boot-ensure provisions *every* production
+* database, this is the normal case rather than the exotic one, and the raw
+* failure (`pq: type "posts_status" already exists (42710)`, then `sql/migrate:
+* write revision: … current transaction is aborted`) names no way forward.
+*
+* `42701` is the everyday one in development: `rebase dev` adds a new
+* column at boot, `db generate` writes the migration that adds it, and
+* `db migrate` then finds it there. A column is named `table.column`.
+*/
+function parseAlreadyProvisioned(text) {
+	const column = /column "([^"]+)" of relation "([^"]+)" already exists/.exec(text);
+	if (column && /42701/.test(text)) return {
+		object: `${column[2]}.${column[1]}`,
+		code: "42701"
+	};
+	const withCode = /(?:type|relation|constraint|schema) "([^"]+)" already exists \((42710|42P07|42P06)\)/.exec(text);
+	if (withCode) return {
+		object: withCode[1],
+		code: withCode[2]
+	};
+	const bare = /(?:type|relation|constraint|schema) "([^"]+)" already exists/.exec(text);
+	const code = /42P07|42P06|42710/.exec(text)?.[0];
+	if (bare && code) return {
+		object: bare[1],
+		code
+	};
+	return null;
+}
+/**
+* The migration Atlas was running when it failed: `from version "<v>"` in
+* `sql/migrate: executing statement "…" from version "20261013201353": …`.
+*/
+function parseFailedMigrationVersion(text) {
+	return /from version "([^"]+)"/.exec(text)?.[1] ?? null;
+}
+/**
+* What to do about it: tell Atlas the database is already at a version.
+*
+* Atlas's own mechanism (`migrate apply --baseline <version>`), not a ledger of
+* ours — it writes the revision row Atlas reads, so every later `rebase db
+* migrate` is an ordinary one.
+*/
+function formatBaselineRemedy(version, object, failedVersion) {
+	const versionToken = version ?? "<version>";
+	const onlyTheFailedOne = failedVersion && failedVersion !== version ? `  To mark only the migration that failed, and run the ones after it:
+
+    ${chalk.bold.green(`rebase db migrate --baseline ${failedVersion}`)}\n\n` : "";
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  This database already has the schema this migration creates\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + (object ? `  ${chalk.gray(`"${object}" is already there, so the migration cannot create it.`)}\n\n` : "") + `  Nothing is wrong with the migration — the database was provisioned\n  another way. Every Rebase boot ensures the schema, and ${chalk.bold("rebase db push")}\n  applies it directly, so a database that has ever run either one is\n  ahead of the migrations recorded on it.\n\n  Record where it already is, then migrate normally:\n\n    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\n    ${chalk.bold.green("rebase db migrate")}\n\n  The baseline is the version already applied — the numeric prefix of\n  the migration file describing what is in the database now. Migrations\n  after it run; it and everything before it are marked done.\n\n` + onlyTheFailedOne + "  On a database nothing has ever booted against, none of this is needed.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
+}
+/**
+* Atlas's whole report when a connection was closed before it answered:
+* `Error: EOF`, sometimes with the step in front (`Error: postgres: querying
+* system variables: EOF`). The line names neither the database nor the
+* connection, so on its own it reads like a crash.
+*/
+function parseConnectionEof(text) {
+	return /^Error: (?:.*: )?EOF\s*$/m.test(text);
+}
+/**
+* What a closed connection means, and that running the command again is safe.
+*
+* On the managed development database it is almost always the connection
+* limit. PGlite is one session behind a socket server that accepts only a few
+* connections; a running `rebase dev` holds some, `atlas schema apply` opens
+* two, and the one over the limit is closed unanswered. Measured: with the
+* daemon's limit of four and three held, `db push --dry-run` failed with a
+* bare `Error: EOF`; with two held it passed. The dev server's pool lets an
+* idle connection go after 30 seconds (`idleTimeoutMillis` in connection.ts),
+* which is why a later attempt usually works.
+*/
+function formatConnectionEofBanner(managed) {
+	const why = managed ? `  The managed development database accepts only a few connections at a\n  time, and a running ${chalk.bold("rebase dev")} holds some of them. Atlas opened one more,\n  and it was closed before the database answered.\n` : "  The server, or a proxy or pooler in front of it, closed the connection:\n  a restart, a connection limit, or a reaper for idle connections.\n";
+	const next = managed ? `  Run the command again in a moment: it is safe to repeat, and the dev
+  server lets an idle connection go after 30 seconds. If it keeps failing,
+  stop ${chalk.bold("rebase dev")} while you run it.\n` : `  Run the command again: it is safe to repeat. If it keeps failing, check\n  the server's connection limit and that it is up: ${chalk.bold("rebase doctor")}.\n`;
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  Atlas lost its connection to the database (EOF)\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + why + `\n` + next + "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
+}
+/** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */
+function parseNotNullViolation(text) {
+	const match = /column "([^"]+)" of relation "([^"]+)" contains null values/.exec(text);
+	return match ? {
+		table: match[2],
+		column: match[1]
+	} : null;
+}
+/**
+* Whether the column that refused NOT NULL was being added by this push, read
+* from the statement Atlas was running: `true` for `ADD COLUMN "<column>"`,
+* `false` for any other statement that names it (`ALTER COLUMN … SET NOT
+* NULL`), `null` when the error carried no statement.
+*/
+function notNullColumnIsNew(stderr, column) {
+	const statement = parseFailedStatement(stderr);
+	if (!statement) return null;
+	const quoted = column.replace(/"/g, "\"\"").replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`ADD\\s+COLUMN\\s+(?:IF\\s+NOT\\s+EXISTS\\s+)?"${quoted}"`, "i").test(statement);
+}
+/**
+* The ways out, and only the ones that work for this column.
+*
+* A `defaultValue` backfills only a column the push is adding: PostgreSQL
+* fills `ADD COLUMN … NOT NULL DEFAULT …` for every existing row, but `ALTER
+* COLUMN … SET DEFAULT` touches no row that is already there, so for an
+* existing column that remedy fails exactly as before. When the error does not
+* say which it was (`isNew` null), the default is offered with that caveat.
+*
+* Boot-ensure handles this case — it adds the column nullable and sets NOT NULL
+* only when the table is empty — so a push that dies here is strictly worse
+* than the boot that would have run instead.
+*/
+function formatNotNullViolationBanner(violation, rowCount, isNew = null) {
+	const { table, column } = violation;
+	const rows = rowCount === null ? `  "${table}" already holds rows, and none of them has a value for "${column}".\n` : `  "${table}" already holds ${rowCount} row${rowCount === 1 ? "" : "s"}, and they have no value for "${column}".\n`;
+	const backfill = `Backfill by hand first, then push again:\n         ${chalk.gray(`psql "$DATABASE_URL" -c 'UPDATE "${table}" SET "${column}" = … WHERE "${column}" IS NULL;'`)}\n`;
+	const leaveOptional = `Leave it optional — take \`validation.required\` off the property.\n`;
+	const defaultLine = (caveat) => `Give the property a default, so the push can backfill${caveat}:\n         ${chalk.gray(`{ type: "string", defaultValue: "…", validation: { required: true } }`)}\n`;
+	const remedies = isNew === false ? [backfill, leaveOptional] : isNew === true ? [
+		defaultLine(""),
+		backfill,
+		leaveOptional
+	] : [
+		backfill,
+		defaultLine(" (only if this push adds the column — a default never fills rows that already exist)"),
+		leaveOptional
+	];
+	const count = [
+		"",
+		"One way",
+		"Two ways",
+		"Three ways"
+	][remedies.length];
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Cannot make "${table}"."${column}" required: existing rows are null\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + rows + `  PostgreSQL will not add the NOT NULL until every one of them does.
+
+  ${count} forward:\n\n` + remedies.map((r, i) => `    ${i + 1}. ${r}`).join("") + `\n  ${chalk.gray("Nothing in this push was applied: Atlas applies it as one transaction.")}\n  ${chalk.gray("`rebase dev` would have kept the column nullable instead:")}\n  ${chalk.gray("boot sets NOT NULL only when it is safe.")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */
+function parseEnumLabelDrop(text) {
+	const match = /dropping (?:enum )?value "([^"]+)" from enum "([^"]+)" is not supported/.exec(text);
+	return match ? {
+		label: match[1],
+		enumType: match[2]
+	} : null;
+}
+/**
+* Why the two paths disagree, and what retiring an option id actually costs.
+*
+* Boot-ensure adds enum labels and never removes one, so `rebase dev` accepts
+* the very edit that stops `db push` dead. PostgreSQL has no `ALTER TYPE …
+* DROP VALUE`: a label goes only by rewriting the type, which is a data
+* migration and not a schema push.
+*/
+function formatEnumLabelDropBanner(drop) {
+	const { label, enumType } = drop;
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  "${label}" cannot be removed from the enum "${enumType}"\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  PostgreSQL has no ALTER TYPE … DROP VALUE. An option id can be added\n  to an enum but never taken out of one, so renaming an id reads as a\n  removal and a push cannot carry it.\n\n  ${chalk.yellow("Nothing was applied.")} ${chalk.bold("rebase dev")} accepts this same edit — boot adds\n  new labels and never removes one — so the two paths disagree by\n  design, and the old label would simply have stayed behind, unused.\n\n  To keep the id: put "${label}" back and change only its label text.\n\n  To retire it for real, it is a data migration:\n\n    1. Add the new id alongside the old one, and push.\n    2. Move the rows:  ${chalk.gray(`UPDATE … SET … = '<new>' WHERE … = '${label}';`)}\n    3. Rewrite the type, which is what actually drops the label:\n       ${chalk.gray("rebase db generate retire_option && rebase db migrate")}\n       ${chalk.gray("(a migration can CREATE TYPE …, ALTER TABLE … TYPE … USING, DROP TYPE)")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* The statement Atlas was running when it failed, unescaped.
+*
+* Two spellings, one per phase: the apply quotes it
+* (`executing statement "ALTER TABLE \"public\".\"people\" …;": pq: …`), and
+* the dry-run's analysis does not
+* (`analyzing plan: executing statement: ALTER TABLE "public"."people" …;: pq: …`).
+*/
+function parseFailedStatement(text) {
+	const quoted = /executing statement "((?:[^"\\]|\\.)*)"/.exec(text);
+	if (quoted) return quoted[1].replace(/\\(.)/g, "$1");
+	const bare = /executing statement: ([\s\S]*?;): pq:/.exec(text);
+	return bare ? bare[1] : null;
+}
+/** `ALTER TABLE "public"."people" …` → `{ schema: "public", table: "people" }`. */
+function failedStatementTable(statement) {
+	const ident = String.raw`(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))`;
+	const match = new RegExp(String.raw`^\s*(?:ALTER\s+TABLE|CREATE\s+UNIQUE\s+INDEX\s+\S+\s+ON)\s+(?:ONLY\s+)?${ident}(?:\.${ident})?`, "i").exec(statement);
+	if (!match) return null;
+	const first = (match[1] ?? match[2]).replace(/""/g, "\"");
+	const second = match[3] ?? match[4];
+	return second === void 0 ? { table: first } : {
+		schema: first,
+		table: second.replace(/""/g, "\"")
+	};
+}
+/**
+* PostgreSQL refusing to retype a column a `GENERATED ALWAYS AS … STORED`
+* expression reads (0A000). `db push` moves Rebase's own search columns out of
+* the way before the apply; this is what is left when it could not.
+*/
+function parseGeneratedColumnRefusal(text) {
+	if (!/cannot alter type of a column used by a generated column/.test(text)) return null;
+	return { statement: parseFailedStatement(text) };
+}
+/**
+* Which generated columns read a column the failed statement retypes — read
+* from the catalogue, because PostgreSQL's DETAIL naming them does not survive
+* Atlas.
+*/
+async function generatedColumnsBlocking(databaseUrl, statement) {
+	if (!databaseUrl || !statement) return [];
+	const target = failedStatementTable(statement);
+	if (!target) return [];
+	const retyped = [...statement.matchAll(/ALTER\s+(?:COLUMN\s+)?"((?:[^"]|"")+)"\s+(?:SET\s+DATA\s+)?TYPE\b/gi)].map((match) => match[1].replace(/""/g, "\""));
+	if (retyped.length === 0) return [];
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({
+			connectionString: databaseUrl,
+			connectionTimeoutMillis: 5e3
+		});
+		await client.connect();
+		try {
+			return (await client.query(`
+                SELECT n.nspname AS "schema", c.relname AS "table", gen.attname AS "column", dep.attname AS "reads"
+                FROM pg_attrdef ad
+                JOIN pg_class c       ON c.oid = ad.adrelid
+                JOIN pg_namespace n   ON n.oid = c.relnamespace
+                JOIN pg_attribute gen ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum
+                JOIN pg_depend d      ON d.classid = 'pg_attrdef'::regclass AND d.objid = ad.oid
+                                     AND d.refclassid = 'pg_class'::regclass AND d.refobjid = ad.adrelid
+                JOIN pg_attribute dep ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid
+                WHERE gen.attgenerated <> '' AND c.relname = $1
+                  AND ($2::text IS NULL OR n.nspname = $2) AND dep.attname = ANY($3::text[])
+                ORDER BY 1, 2, 3, 4`, [
+				target.table,
+				target.schema ?? null,
+				retyped
+			])).rows;
+		} finally {
+			await client.end();
+		}
+	} catch {
+		return [];
+	}
+}
+/**
+* What to do when a generated column stops a retype.
+*
+* A collection's own search column should never reach this — `db push` drops
+* it before the apply and rebuilds it after — so seeing one named here means
+* that machinery missed it, which is a bug worth a report. Any other generated
+* column is somebody's, with an expression Rebase holds no copy of.
+*/
+function formatGeneratedColumnRefusalBanner(refusal, blockers) {
+	const named = blockers.length > 0 ? blockers.map((b) => `    ${chalk.bold(`${b.schema}.${b.table}.${b.column}`)} reads "${b.reads}"`).join("\n") + "\n\n" : refusal.statement ? `  The statement:\n    ${chalk.gray(refusal.statement.replace(/\s+/g, " "))}\n\n` : "";
+	const first = blockers[0];
+	const drop = first ? `ALTER TABLE "${first.schema}"."${first.table}" DROP COLUMN "${first.column}";` : "ALTER TABLE … DROP COLUMN <the generated column>;";
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  A generated column reads a column this push retypes\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + named + `  PostgreSQL will not retype a column while a GENERATED ALWAYS AS …
+  STORED expression reads it, and Atlas applies a push as one
+  transaction — ${chalk.yellow("nothing in this push was applied.")}\n\n  A collection's ${chalk.bold("search")} column is dropped and rebuilt around the apply\n  by the push itself. If that is the column named above, run the push\n  again, and please report it: it should not have got this far.\n\n  Any other generated column is yours. Drop it, push, and put it back\n  with its original expression:\n\n    ${chalk.gray(drop)}\n    ${chalk.gray("rebase db push")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* PostgreSQL refusing a retype it has no implicit cast for (42804): `string` →
+* `number`, `time` → `date`, an array back to a string. Atlas reports it from
+* the dry-run's analysis as well as from the apply, so without this a
+* `--dry-run` died with the raw error and showed no plan at all.
+*/
+function parseUncastableRetype(text) {
+	const match = /column "((?:[^"]|"")+)" cannot be cast automatically to type ([^\n(]+?)\s*(?:\(42804\)|$|\n)/m.exec(text);
+	if (!match) return null;
+	return {
+		column: match[1],
+		type: match[2].trim(),
+		statement: parseFailedStatement(text)
+	};
+}
+/** The `ALTER … USING` a developer would run, and the other ways past it. Boot's drift report says the same. */
+function formatUncastableRetypeBanner(refusal) {
+	const { column, type, statement } = refusal;
+	const target = statement ? failedStatementTable(statement) : null;
+	const table = target ? `${target.schema ? `"${target.schema}".` : ""}"${target.table}"` : "<table>";
+	const quotedColumn = `"${column.replace(/"/g, "\"\"")}"`;
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  ${table}.${quotedColumn} cannot be converted to ${type} automatically\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The collection now declares this column as ${type}, and PostgreSQL has\n  no implicit conversion from what the column holds today. Atlas stops\n  at the first such statement — ${chalk.yellow("nothing in this push was applied")}, and a\n  --dry-run cannot show the rest of the plan until this one is settled.\n\n  Three ways forward:\n\n    1. Convert the values yourself, saying how, then push again:\n         ${chalk.gray(`ALTER TABLE ${table} ALTER COLUMN ${quotedColumn} TYPE ${type} USING ${quotedColumn}::${type};`)}\n       ${chalk.gray("(adjust the USING expression to whatever turns each old value into a new one)")}\n    2. Add a new property for the new type, copy the values over with an\n       UPDATE, then remove the old property.\n    3. Keep the column as it is — put the property's type back, or pin the\n       database type with ${chalk.bold("columnType")}.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* A unique constraint or index PostgreSQL could not build because the rows
+* already repeat a value (23505). The DETAIL naming the value does not survive
+* Atlas, so the duplicates are read back from the table.
+*/
+function parseUniqueBuildFailure(text) {
+	const match = /could not create unique index "((?:[^"]|"")+)"/.exec(text);
+	if (!match) return null;
+	const statement = parseFailedStatement(text);
+	let columns = [];
+	if (statement) {
+		const list = /UNIQUE\s*\(([^)]*)\)/i.exec(statement) ?? /\bON\s+(?:ONLY\s+)?(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)(?:\.(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*))?\s*(?:USING\s+\w+\s*)?\(([^)]*)\)/i.exec(statement);
+		if (list) columns = [...list[1].matchAll(/"((?:[^"]|"")+)"|([A-Za-z_][\w$]*)/g)].map((m) => (m[1] ?? m[2]).replace(/""/g, "\""));
+	}
+	return {
+		index: match[1],
+		statement,
+		columns
+	};
+}
+/** Up to five repeated values, read from the database, or `[]` when we cannot say. */
+async function duplicateValues(databaseUrl, target, columns) {
+	if (!databaseUrl || !target || columns.length === 0) return [];
+	const ident = (name) => `"${name.replace(/"/g, "\"\"")}"`;
+	const table = `${target.schema ? `${ident(target.schema)}.` : ""}${ident(target.table)}`;
+	const cols = columns.map(ident).join(", ");
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({
+			connectionString: databaseUrl,
+			connectionTimeoutMillis: 5e3
+		});
+		await client.connect();
+		try {
+			return (await client.query(`SELECT concat_ws(', ', ${columns.map((c) => `${ident(c)}::text`).join(", ")}) AS "values", count(*)::int AS "count"
+                 FROM ${table} GROUP BY ${cols} HAVING count(*) > 1 ORDER BY count(*) DESC LIMIT 5`)).rows;
+		} finally {
+			await client.end();
+		}
+	} catch {
+		return [];
+	}
+}
+function formatUniqueBuildFailureBanner(failure, duplicates) {
+	const target = failure.statement ? failedStatementTable(failure.statement) : null;
+	const table = target ? `${target.schema ? `"${target.schema}".` : ""}"${target.table}"` : "<table>";
+	const cols = failure.columns.length > 0 ? failure.columns.map((c) => `"${c}"`).join(", ") : "<column>";
+	const listed = duplicates.length > 0 ? `  Repeated values:\n` + duplicates.map((d) => `    ${chalk.bold(d.values)}  ${chalk.gray(`× ${d.count}`)}`).join("\n") + `\n\n` : "";
+	return `
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  ❌  Cannot make ${table} (${cols}) unique: rows already repeat a value\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + listed + `  PostgreSQL will not build "${failure.index}" while two rows share a\n  value, and Atlas applies a push as one transaction — ${chalk.yellow("nothing in")}\n  ${chalk.yellow("this push was applied.")}\n\n  Find them:\n    ${chalk.gray(`SELECT ${cols}, count(*) FROM ${table} GROUP BY ${cols} HAVING count(*) > 1;`)}\n\n  Then change or delete the repeats and push again, or take ${chalk.bold("unique")} off\n  the property.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/** How many rows a table holds, or `null` when we cannot say. */
+async function countRows(databaseUrl, table) {
+	if (!databaseUrl) return null;
+	try {
+		const { Client } = await import("pg");
+		const client = new Client({
+			connectionString: databaseUrl,
+			connectionTimeoutMillis: 5e3
+		});
+		await client.connect();
+		try {
+			return (await client.query(`SELECT count(*)::int AS n FROM "${table.replace(/"/g, "\"\"")}"`)).rows[0]?.n ?? null;
+		} finally {
+			await client.end();
+		}
+	} catch {
+		return null;
+	}
+}
+/**
+* A hand-written generated column reading a column the plan wants to retype or
+* drop.
+*
+* Rebase's own generated columns are dropped and rebuilt around the apply — it
+* holds their definition in `search.sql`. This one it does not: PostgreSQL
+* stores a generated expression only in the catalogue, so dropping it to let
+* the apply through would destroy the only copy. Refuse instead, and say what
+* the operator can do about it.
+*/
+function formatForeignGeneratedColumnBanner(conflicts) {
+	const lines = conflicts.map((c) => {
+		const reads = c.blocking.map((b) => `"${b.column}"`).join(", ");
+		return `    ${chalk.bold(`${c.schema}.${c.table}.${c.column}`)} reads ${reads}`;
+	});
+	const first = conflicts[0];
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  A generated column depends on a column this push changes\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + lines.join("\n") + `
+
+  PostgreSQL refuses to retype or drop a column while a GENERATED
+  ALWAYS AS … STORED expression reads it, and an Atlas apply is one
+  transaction — so this refusal would roll back every other statement
+  in the push with it.
+
+  ${chalk.yellow("Nothing was applied.")} Rebase rebuilds the generated columns it made\n  itself (a collection's ${chalk.bold("search")} block) around the apply. It has no\n  definition for this one, and a dropped generated expression is not\n  recoverable from anywhere but your own migration.\n\n  Drop it, push, and put it back:\n\n    ${chalk.gray(`ALTER TABLE "${first.schema}"."${first.table}" DROP COLUMN "${first.column}";`)}\n    ${chalk.gray("rebase db push")}\n    ${chalk.gray("-- then re-create the column with its original expression")}\n\n  Or declare it through a ${chalk.bold("search")} block, and Rebase will own it.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+}
+/**
+* The remedy for an Atlas invocation that failed, or `null`.
+*
+* Scoped by the invocation, because the same database state means different
+* things to different subcommands: "already exists" under `migrate apply` wants
+* a baseline, while under `schema apply` it is a genuine conflict.
+*/
+async function diagnoseAtlasFailure(context) {
+	const { domain, args, stderr, databaseUrl } = context;
+	if (parseConnectionEof(stderr)) return formatConnectionEofBanner(context.managedDatabase === true);
+	if (domain === "migrate" && args.includes("apply")) {
+		const provisioned = parseAlreadyProvisioned(stderr);
+		if (provisioned) return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object, parseFailedMigrationVersion(stderr));
+	}
+	if (domain === "schema" && args.includes("apply")) {
+		const enumDrop = parseEnumLabelDrop(stderr);
+		if (enumDrop) return formatEnumLabelDropBanner(enumDrop);
+		const notNull = parseNotNullViolation(stderr);
+		if (notNull) return formatNotNullViolationBanner(notNull, await countRows(databaseUrl, notNull.table), notNullColumnIsNew(stderr, notNull.column));
+		const uncastable = parseUncastableRetype(stderr);
+		if (uncastable) return formatUncastableRetypeBanner(uncastable);
+		const unique = parseUniqueBuildFailure(stderr);
+		if (unique) return formatUniqueBuildFailureBanner(unique, await duplicateValues(databaseUrl, unique.statement ? failedStatementTable(unique.statement) : null, unique.columns));
+		const generated = parseGeneratedColumnRefusal(stderr);
+		if (generated) return formatGeneratedColumnRefusalBanner(generated, await generatedColumnsBlocking(databaseUrl, generated.statement));
+	}
+	return null;
+}
+//#endregion
+export { queryColumnTypes as A, generatedSqlDir as B, getForeignIndexExcludes as C, getUndeclaredConstraintExcludes as D, getTriggerExcludes as E, readVectorDdl as F, extractPlanStatements as G, decidePushSafety as H, resolveLocalBin as I, forLibpq as J, fromAlterTable as K, withAppClient as L, queryUndeclarableConstraints as M, readSearchDdl as N, getVectorExcludes as O, readTriggersDdl as P, DESIRED_STATE_URL as R, ensureDevDatabaseExists as S, getTableExcludes as T, destructiveOptInFlag as U, prepareGeneratedSqlDir as V, detectDestructiveStatements as W, splitPassword as X, redactConnectionPasswords as Y, extractCauseMessage as Z, describeReinstallCommand as _, formatForeignGeneratedColumnBanner as a, dropDevDatabase as b, reportCommandFailure as c, applyTriggersDdl as d, applyVectorDdl as f, describeDevAddCommand as g, describeBuildScriptRemedy as h, diagnoseDbError as i, queryGeneratedColumnDependencies as j, loadCollectionsForCli as k, ExcludeIntrospectionError as l, closeAppClients as m, deepestErrorMessage as n, isEconnrefused as o, atlasDevDatabaseUrl as p, isSyncedPlan as q, diagnoseAtlasFailure as r, parseHostInfo as s, checkDatabaseConnectivity as t, applySearchDdl as u, detectProjectPackageManager as v, getSearchExcludes as w, dropGeneratedColumns as x, diagnoseMissingBin as y, GENERATED_SQL_DIR as z };
+
+//# sourceMappingURL=cli-errors-oVUuD8k0.js.map