@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g19596ef

package/dist/cli-errors.d.ts

@@ -89,22 +89,36 @@ export declare function diagnoseDbError(err: unknown, databaseUrl?: string): str
  *   it resolved to and the cwd it resolved against, and then throws so the entry
  *   point owns the exit code. Repeating its one-line summary underneath would
  *   undo the "printed once" this whole path exists for.
+ *
+ * Whatever is printed has its connection-string passwords replaced (see
+ * `redactConnectionPasswords`): a driver or tool error can quote the URL it was
+ * given, and this line lands in terminals and CI logs.
  */
 export declare function reportCommandFailure(error: unknown): void;
 /**
  * `migrate apply` refusing because the database already has the schema.
  *
- * `42710` (duplicate_object) and `42P07` (duplicate_table) are what a migration
- * hits when boot-ensure — or a `db push` — has already provisioned the objects
- * it was going to create. Since boot-ensure provisions *every* production
+ * `42710` (duplicate_object), `42P07` (duplicate_table), `42701`
+ * (duplicate_column) and `42P06` (duplicate_schema) are what a migration hits
+ * when boot-ensure — or a `db push` — has already provisioned the objects it
+ * was going to create. Since boot-ensure provisions *every* production
  * database, this is the normal case rather than the exotic one, and the raw
  * failure (`pq: type "posts_status" already exists (42710)`, then `sql/migrate:
  * write revision: … current transaction is aborted`) names no way forward.
+ *
+ * `42701` is the everyday one in development: `rebase dev` adds a new
+ * column at boot, `db generate` writes the migration that adds it, and
+ * `db migrate` then finds it there. A column is named `table.column`.
  */
 export declare function parseAlreadyProvisioned(text: string): {
     object: string;
     code: string;
 } | null;
+/**
+ * The migration Atlas was running when it failed: `from version "<v>"` in
+ * `sql/migrate: executing statement "…" from version "20261013201353": …`.
+ */
+export declare function parseFailedMigrationVersion(text: string): string | null;
 /**
  * What to do about it: tell Atlas the database is already at a version.
  *
@@ -112,25 +126,56 @@ export declare function parseAlreadyProvisioned(text: string): {
  * ours — it writes the revision row Atlas reads, so every later `rebase db
  * migrate` is an ordinary one.
  */
-export declare function formatBaselineRemedy(version: string | null, object?: string): string;
+export declare function formatBaselineRemedy(version: string | null, object?: string, failedVersion?: string | null): string;
+/**
+ * Atlas's whole report when a connection was closed before it answered:
+ * `Error: EOF`, sometimes with the step in front (`Error: postgres: querying
+ * system variables: EOF`). The line names neither the database nor the
+ * connection, so on its own it reads like a crash.
+ */
+export declare function parseConnectionEof(text: string): boolean;
+/**
+ * What a closed connection means, and that running the command again is safe.
+ *
+ * On the managed development database it is almost always the connection
+ * limit. PGlite is one session behind a socket server that accepts only a few
+ * connections; a running `rebase dev` holds some, `atlas schema apply` opens
+ * two, and the one over the limit is closed unanswered. Measured: with the
+ * daemon's limit of four and three held, `db push --dry-run` failed with a
+ * bare `Error: EOF`; with two held it passed. The dev server's pool lets an
+ * idle connection go after 30 seconds (`idleTimeoutMillis` in connection.ts),
+ * which is why a later attempt usually works.
+ */
+export declare function formatConnectionEofBanner(managed: boolean): string;
 /** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */
 export declare function parseNotNullViolation(text: string): {
     table: string;
     column: string;
 } | null;
 /**
- * The three ways out, because there is no fourth.
+ * Whether the column that refused NOT NULL was being added by this push, read
+ * from the statement Atlas was running: `true` for `ADD COLUMN "<column>"`,
+ * `false` for any other statement that names it (`ALTER COLUMN … SET NOT
+ * NULL`), `null` when the error carried no statement.
+ */
+export declare function notNullColumnIsNew(stderr: string, column: string): boolean | null;
+/**
+ * The ways out, and only the ones that work for this column.
+ *
+ * A `defaultValue` backfills only a column the push is adding: PostgreSQL
+ * fills `ADD COLUMN … NOT NULL DEFAULT …` for every existing row, but `ALTER
+ * COLUMN … SET DEFAULT` touches no row that is already there, so for an
+ * existing column that remedy fails exactly as before. When the error does not
+ * say which it was (`isNew` null), the default is offered with that caveat.
  *
  * Boot-ensure handles this case — it adds the column nullable and sets NOT NULL
  * only when the table is empty — so a push that dies here is strictly worse
- * than the boot that would have run instead, and the developer deserves to be
- * told which of the three they want rather than left with `pq: … contains null
- * values (23502)` and no next step.
+ * than the boot that would have run instead.
  */
 export declare function formatNotNullViolationBanner(violation: {
     table: string;
     column: string;
-}, rowCount: number | null): string;
+}, rowCount: number | null, isNew?: boolean | null): string;
 /** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */
 export declare function parseEnumLabelDrop(text: string): {
     label: string;
@@ -148,6 +193,83 @@ export declare function formatEnumLabelDropBanner(drop: {
     label: string;
     enumType: string;
 }): string;
+/**
+ * The statement Atlas was running when it failed, unescaped.
+ *
+ * Two spellings, one per phase: the apply quotes it
+ * (`executing statement "ALTER TABLE \"public\".\"people\" …;": pq: …`), and
+ * the dry-run's analysis does not
+ * (`analyzing plan: executing statement: ALTER TABLE "public"."people" …;: pq: …`).
+ */
+export declare function parseFailedStatement(text: string): string | null;
+/** `ALTER TABLE "public"."people" …` → `{ schema: "public", table: "people" }`. */
+export declare function failedStatementTable(statement: string): {
+    schema?: string;
+    table: string;
+} | null;
+/** A generated column standing in the way of a retype, as the catalogue has it. */
+export interface GeneratedColumnBlocker {
+    schema: string;
+    table: string;
+    /** The generated column. */
+    column: string;
+    /** The column it reads, which the statement retypes. */
+    reads: string;
+}
+/**
+ * PostgreSQL refusing to retype a column a `GENERATED ALWAYS AS … STORED`
+ * expression reads (0A000). `db push` moves Rebase's own search columns out of
+ * the way before the apply; this is what is left when it could not.
+ */
+export declare function parseGeneratedColumnRefusal(text: string): {
+    statement: string | null;
+} | null;
+/**
+ * What to do when a generated column stops a retype.
+ *
+ * A collection's own search column should never reach this — `db push` drops
+ * it before the apply and rebuilds it after — so seeing one named here means
+ * that machinery missed it, which is a bug worth a report. Any other generated
+ * column is somebody's, with an expression Rebase holds no copy of.
+ */
+export declare function formatGeneratedColumnRefusalBanner(refusal: {
+    statement: string | null;
+}, blockers: GeneratedColumnBlocker[]): string;
+/**
+ * PostgreSQL refusing a retype it has no implicit cast for (42804): `string` →
+ * `number`, `time` → `date`, an array back to a string. Atlas reports it from
+ * the dry-run's analysis as well as from the apply, so without this a
+ * `--dry-run` died with the raw error and showed no plan at all.
+ */
+export declare function parseUncastableRetype(text: string): {
+    column: string;
+    type: string;
+    statement: string | null;
+} | null;
+/** The `ALTER … USING` a developer would run, and the other ways past it. Boot's drift report says the same. */
+export declare function formatUncastableRetypeBanner(refusal: {
+    column: string;
+    type: string;
+    statement: string | null;
+}): string;
+/**
+ * A unique constraint or index PostgreSQL could not build because the rows
+ * already repeat a value (23505). The DETAIL naming the value does not survive
+ * Atlas, so the duplicates are read back from the table.
+ */
+export declare function parseUniqueBuildFailure(text: string): {
+    index: string;
+    statement: string | null;
+    columns: string[];
+} | null;
+export declare function formatUniqueBuildFailureBanner(failure: {
+    index: string;
+    statement: string | null;
+    columns: string[];
+}, duplicates: {
+    values: string;
+    count: number;
+}[]): string;
 /**
  * A hand-written generated column reading a column the plan wants to retype or
  * drop.
@@ -181,4 +303,6 @@ export declare function diagnoseAtlasFailure(context: {
     databaseUrl?: string;
     /** The newest migration version on disk, named in the baseline remedy. */
     latestMigrationVersion?: string | null;
+    /** DATABASE_URL is the managed development database (PGlite). */
+    managedDatabase?: boolean;
 }): Promise<string | null>;

package/dist/{cli-flags-BglvpjHv.js → cli-flags-DnPHXjRH.js}

@@ -1,7 +1,8 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
+import { n as require_arg } from "./cli-prompt-egtNKkZl.js";
+import { suggestNearMiss } from "@rebasepro/utils";
 //#region src/cli-flags.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
@@ -54,7 +55,10 @@ var DRIVER_FLAG_SPECS = {
 		"--collections": String,
 		"-c": "--collections"
 	},
-	"db migrate": { "--baseline": String },
+	"db migrate": {
+		"--baseline": String,
+		"--refuse-destructive": Boolean
+	},
 	"schema generate": {
 		"--collections": String,
 		"-c": "--collections",
@@ -128,11 +132,57 @@ function assertKnownFlags(domain, subcommand, args) {
 			...spec
 		}, { argv: args.slice(2) });
 	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		const unknown = unknownFlagIn(err);
+		if (unknown !== null && err instanceof Error) {
+			const suggestion = closestFlag(unknown, {
+				...RELAYED_FLAGS,
+				...spec
+			});
+			throw new Error(`${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : ""} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		}
 		throw err;
 	}
 }
+/** The flag `arg` refused as undeclared, or `null` for any other failure. */
+function unknownFlagIn(err) {
+	if (!(err instanceof Error) || !("code" in err) || err.code !== "ARG_UNKNOWN_OPTION") return null;
+	return /option: (\S+)$/.exec(err.message)?.[1] ?? null;
+}
+/** The declared long flag `typed` is one edit away from, if there is one. */
+function closestFlag(typed, spec) {
+	const name = typed.split("=")[0];
+	return suggestNearMiss(Object.keys(spec).filter((flag) => flag.startsWith("--")), name);
+}
+/**
+* Parse a command that owns its argument handling, refusing what it does not
+* declare.
+*
+* `db backup`, `db restore` and `db backups list` parsed permissively, so an
+* undeclared flag became a positional and was ignored: `db restore <dump>
+* --targt-db x --create-db --yes` dropped the misspelled target and restored
+* into the live database. A typo is refused here before anything runs, naming
+* the declared flag it is one edit from, or every flag the command takes when
+* none is that close.
+*
+* @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+* @param command the command as typed, for the message: `"db restore"`.
+*/
+function parseCommandFlags(spec, argv, command) {
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	try {
+		return (0, import_arg.default)(full, { argv });
+	} catch (err) {
+		const unknown = unknownFlagIn(err);
+		if (unknown === null) throw err;
+		const suggestion = closestFlag(unknown, full);
+		const flags = Object.keys(spec).filter((flag) => flag.startsWith("--"));
+		throw new Error(`\`rebase ${command}\` has no option ${unknown}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(", ")}.`) + ` Nothing was run. See \`rebase ${command} --help\`.`);
+	}
+}
 //#endregion
-export { collectionsPathIn as n, parseDriverLine as r, assertKnownFlags as t };
+export { parseDriverLine as a, parseCommandFlags as i, assertKnownFlags as n, collectionsPathIn as r, RELAYED_FLAGS as t };
 
-//# sourceMappingURL=cli-flags-BglvpjHv.js.map
+//# sourceMappingURL=cli-flags-DnPHXjRH.js.map

package/dist/cli-flags-DnPHXjRH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-flags-DnPHXjRH.js","names":[],"sources":["../src/cli-flags.ts"],"sourcesContent":["/**\n * The flags each driver command takes, in one place, and the check that\n * enforces them.\n *\n * Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not\n * mean \"be lenient\" — it means **an undeclared flag becomes a positional**. So\n * `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the\n * push ran with the destructive gate still closed, and the developer read the\n * refusal as Rebase ignoring the flag they had just typed. `rebase schema\n * generate --ouput src/schema.ts` was worse — it wrote the default path and\n * said nothing, so the next build compiled a file nobody had regenerated.\n *\n * The check has to live at the entry point rather than in those parsers, and\n * that is not a detail: `db push` and `db generate` re-enter `schemaCommand`\n * and `generatePostgresDdlCommand` with the *db* line, so a strict parser\n * inside either of them would reject `--allow-destructive` on a line where it\n * is correct. One validation, once, against the spec for the command the user\n * actually named; the inner parsers keep reading an already-validated line.\n *\n * Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),\n * `db backup`, `db restore`, `db backups` — are deliberately absent: they own\n * their spec, and a second list here would be one more thing to keep in step.\n * An absent entry is \"not checked here\", never \"takes nothing\".\n */\nimport arg from \"arg\";\nimport { suggestNearMiss } from \"@rebasepro/utils\";\n\n/**\n * Flags that reach this process on a line it did not compose.\n *\n * `rebase db …` hands the driver the user's whole line: the CLI *reads*\n * `--database-url` and `--docker` to resolve the database and then relays them\n * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as\n * the thing to re-run with. Rejecting any of the three would make the driver\n * refuse commands the CLI documents.\n */\nexport const RELAYED_FLAGS = {\n    \"--database-url\": String,\n    \"--docker\": Boolean,\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} satisfies arg.Spec;\n\n/**\n * Parse a driver command's line — `[\"db\", \"<subcommand>\", …]` — with the\n * relayed flags declared alongside the command's own.\n *\n * Every driver parser is permissive, and an undeclared flag in a permissive\n * parse is a positional. The positionals are what `db migrate` hands\n * `atlas migrate apply`, what `db generate` names its migration after and\n * which backup `db restore` restores, so a relayed flag left undeclared was\n * read as one of those: `rebase db migrate --docker` died on Atlas's\n * `unknown flag: --docker` after it had already written the auth schema.\n */\nexport function parseDriverLine<S extends arg.Spec>(\n    spec: S,\n    args: string[]\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    return arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2), permissive: true });\n}\n\n/** Keyed by `\"<domain> <subcommand>\"`, the way the user types it. */\nexport const DRIVER_FLAG_SPECS: Record<string, arg.Spec> = {\n    \"db push\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--dry-run\": Boolean,\n        \"--allow-destructive\": Boolean,\n        \"--yes\": Boolean,\n        \"-y\": \"--yes\"\n    },\n    \"db generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\"\n    },\n    // Bare positionals still pass through to `atlas migrate apply`, which takes\n    // an optional amount; flags do not, apart from `--baseline`.\n    //\n    // `--baseline <version>` is the escape hatch for the normal case, not an\n    // exotic one: every Rebase boot ensures the schema, so a production\n    // database has the tables before its first migration ever runs, and\n    // `migrate apply` then dies on `type \"…\" already exists (42710)`. It maps\n    // onto Atlas's own `migrate apply --baseline`, which writes the revision\n    // row Atlas reads — no ledger of ours.\n    //\n    // `--refuse-destructive` is opt-in: it dry-runs the pending files and exits\n    // 1, applying nothing, when one drops or narrows data — the gate `db push`\n    // has always had, for the path that had none.\n    \"db migrate\": {\n        \"--baseline\": String,\n        \"--refuse-destructive\": Boolean\n    },\n    \"schema generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--watch\": Boolean,\n        \"-w\": \"--watch\"\n    },\n    \"schema introspect\": {\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--force\": Boolean,\n        \"-f\": \"--force\",\n        \"--schema\": String\n    },\n    \"schema stale\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--fix\": Boolean\n    }\n};\n\n/**\n * One destination flag, two spellings, everywhere.\n *\n * `--out` is the primary on `rebase build`, an alias on `generate-sdk`, `db\n * backup` and `cloud env pull`, and was refused outright by the three `schema`\n * commands — so the spelling a user learned on one command was an\n * \"unknown or unexpected option\" on the next. Neither name can be retired (both\n * are shipped), so both are accepted, and {@link assertOutputAliasesPaired}\n * makes that the rule rather than a habit.\n */\nexport const OUTPUT_FLAG_ALIASES = [\"--out\", \"--output\"] as const;\n\n/**\n * Every spec that names one of the pair names both.\n *\n * Exported so the CLI's own specs can be held to it too: the drift this fixes\n * ran across two packages, and a check that only reads this file would let the\n * next `--out`-only command through.\n */\nexport function assertOutputAliasesPaired(specs: Record<string, arg.Spec>): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const present = OUTPUT_FLAG_ALIASES.filter(flag => flag in spec);\n        if (present.length === 0 || present.length === OUTPUT_FLAG_ALIASES.length) continue;\n        const missing = OUTPUT_FLAG_ALIASES.filter(flag => !(flag in spec));\n        problems.push(`\\`${command}\\` takes ${present.join(\", \")} but not ${missing.join(\", \")}`);\n    }\n    return problems;\n}\n\n/**\n * The `--collections` path the user typed, or `null` if they typed none.\n *\n * Read once, at the entry point, because every command that takes it re-enters\n * the generators with the same line and each of them resolved it again — which\n * is how \"Collections path not found\" came to be printed four times before the\n * real output, and how a path that does not exist got as far as *writing* an\n * empty schema.\n *\n * Permissive, and it has to be: {@link assertKnownFlags} has already judged the\n * line, and `db push` carries flags the `--collections` spec does not name.\n */\nexport function collectionsPathIn(args: string[]): string | null {\n    try {\n        const parsed = arg(\n            { \"--collections\": String, \"-c\": \"--collections\" },\n            { argv: args.slice(2), permissive: true }\n        );\n\n        return parsed[\"--collections\"] ?? null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The long flags a `--help` usage line documents.\n *\n * `\"rebase db push [--collections <dir>] [--dry-run] …\"` → `[\"--collections\",\n * \"--dry-run\"]`. Placeholders (`<dir>`) and the alternation inside a positional\n * (`<create|list|switch>`) are not flags and are not returned.\n */\nexport function flagsInUsage(usage: string): string[] {\n    return [...new Set(usage.match(/--[a-z][a-z0-9-]*/g) ?? [])];\n}\n\n/**\n * Every flag the help documents is accepted, and every flag accepted is documented.\n *\n * The drift this catches shipped: `rebase db push --help` has printed\n * `[--dry-run]` since the flag was written, `DRIVER_FLAG_SPECS[\"db push\"]` never\n * listed it, and {@link assertKnownFlags} — added later to stop typos being\n * swallowed — turned the documented flag into `unknown or unexpected option`.\n * The only way to see a push's SQL was to trip the destructive gate, which is\n * the exact problem `--dry-run` was written to solve. Worse in a project on an\n * older driver, whose permissive parser *applied* the schema on that line.\n *\n * Two hand-maintained lists in two packages cannot be kept in step by care, so\n * they are held to each other instead: `usages` is keyed the way\n * {@link DRIVER_FLAG_SPECS} is (`\"db push\"`), and comes from the CLI's own help\n * pages. A key in only one of the two is not this function's business — the\n * help covers commands that parse their own lines (`db branch`, `db backup`),\n * and an absent spec entry means \"not checked here\".\n *\n * Aliases (`\"-c\": \"--collections\"`, `\"--out\": \"--output\"`) need no line of their\n * own: they are spellings of a documented flag. Neither do {@link RELAYED_FLAGS},\n * which every driver command accepts because the CLI relays them.\n */\nexport function assertSpecMatchesUsage(\n    specs: Record<string, arg.Spec>,\n    usages: Record<string, string>\n): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const usage = usages[command];\n        if (usage === undefined) continue;\n\n        const documented = flagsInUsage(usage);\n        const accepted = Object.entries(spec);\n        // An alias resolves to the flag it spells; only the target needs a line.\n        const canonical = new Set(\n            accepted\n                .map(([flag, kind]) => (typeof kind === \"string\" ? kind : flag))\n                .filter(flag => flag.startsWith(\"--\"))\n        );\n\n        for (const flag of documented) {\n            if (flag in spec || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` documents ${flag} in its usage line but the spec rejects it`);\n        }\n        for (const flag of canonical) {\n            if (documented.includes(flag) || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` accepts ${flag} but no usage line documents it`);\n        }\n    }\n    return problems;\n}\n\n/**\n * Reject a flag the named command does not take.\n *\n * `args` is the driver's whole line — `[\"db\", \"push\", …]` — so the flags are\n * read from `args.slice(2)`, past the two command words.\n *\n * Throws rather than exiting: `runPluginCommand`'s caller already turns a\n * thrown error into one red line and exit 1, and a thrown error is what the\n * tests can see.\n */\nexport function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void {\n    if (!subcommand) return;\n    const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];\n    if (!spec) return;\n\n    try {\n        arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2) });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown !== null && err instanceof Error) {\n            const suggestion = closestFlag(unknown, { ...RELAYED_FLAGS, ...spec });\n            throw new Error(\n                `${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : \"\"} — run ` +\n                `\\`rebase ${domain} --help\\` for the options \\`${domain} ${subcommand}\\` takes.`\n            );\n        }\n        throw err;\n    }\n}\n\n/** The flag `arg` refused as undeclared, or `null` for any other failure. */\nfunction unknownFlagIn(err: unknown): string | null {\n    if (!(err instanceof Error) || !(\"code\" in err) || err.code !== \"ARG_UNKNOWN_OPTION\") return null;\n    // arg's wording: `unknown or unexpected option: --targt-db`.\n    return /option: (\\S+)$/.exec(err.message)?.[1] ?? null;\n}\n\n/** The declared long flag `typed` is one edit away from, if there is one. */\nfunction closestFlag(typed: string, spec: arg.Spec): string | undefined {\n    const name = typed.split(\"=\")[0];\n    return suggestNearMiss(Object.keys(spec).filter(flag => flag.startsWith(\"--\")), name);\n}\n\n/**\n * Parse a command that owns its argument handling, refusing what it does not\n * declare.\n *\n * `db backup`, `db restore` and `db backups list` parsed permissively, so an\n * undeclared flag became a positional and was ignored: `db restore <dump>\n * --targt-db x --create-db --yes` dropped the misspelled target and restored\n * into the live database. A typo is refused here before anything runs, naming\n * the declared flag it is one edit from, or every flag the command takes when\n * none is that close.\n *\n * @param argv the words after the command, e.g. `rawArgs.slice(2)`.\n * @param command the command as typed, for the message: `\"db restore\"`.\n */\nexport function parseCommandFlags<S extends arg.Spec>(\n    spec: S,\n    argv: string[],\n    command: string\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    const full = { ...RELAYED_FLAGS, ...spec };\n    try {\n        return arg(full, { argv });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown === null) throw err;\n        const suggestion = closestFlag(unknown, full);\n        const flags = Object.keys(spec).filter(flag => flag.startsWith(\"--\"));\n        throw new Error(\n            `\\`rebase ${command}\\` has no option ${unknown}` +\n            (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(\", \")}.`) +\n            ` Nothing was run. See \\`rebase ${command} --help\\`.`\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,IAAa,gBAAgB;CACzB,kBAAkB;CAClB,YAAY;CACZ,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;;;;;;;AAaA,SAAgB,gBACZ,MACA,MACoC;CACpC,QAAA,GAAA,WAAA,QAAA,CAAW;EAAE,GAAG;EAAe,GAAG;CAAK,GAAG;EAAE,MAAM,KAAK,MAAM,CAAC;EAAG,YAAY;CAAK,CAAC;AACvF;;AAGA,IAAa,oBAA8C;CACvD,WAAW;EACP,iBAAiB;EACjB,MAAM;EACN,aAAa;EACb,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV;CACA,eAAe;EACX,iBAAiB;EACjB,MAAM;CACV;CAcA,cAAc;EACV,cAAc;EACd,wBAAwB;CAC5B;CACA,mBAAmB;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,WAAW;EACX,MAAM;CACV;CACA,qBAAqB;EACjB,YAAY;EACZ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,MAAM;EACN,WAAW;EACX,MAAM;EACN,YAAY;CAChB;CACA,gBAAgB;EACZ,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,SAAS;CACb;AACJ;;;;;;;;;;;;;AA4CA,SAAgB,kBAAkB,MAA+B;CAC7D,IAAI;EAMA,QAAA,GAAA,WAAA,QAAA,CAJI;GAAE,iBAAiB;GAAQ,MAAM;EAAgB,GACjD;GAAE,MAAM,KAAK,MAAM,CAAC;GAAG,YAAY;EAAK,CAGrC,CAAA,CAAO,oBAAoB;CACtC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AA2EA,SAAgB,iBAAiB,QAAgB,YAAgC,MAAsB;CACnG,IAAI,CAAC,YAAY;CACjB,MAAM,OAAO,kBAAkB,GAAG,OAAO,GAAG;CAC5C,IAAI,CAAC,MAAM;CAEX,IAAI;EACA,CAAA,GAAA,WAAA,QAAA,CAAI;GAAE,GAAG;GAAe,GAAG;EAAK,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CAC9D,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,QAAQ,eAAe,OAAO;GAC1C,MAAM,aAAa,YAAY,SAAS;IAAE,GAAG;IAAe,GAAG;GAAK,CAAC;GACrE,MAAM,IAAI,MACN,GAAG,IAAI,UAAU,aAAa,kBAAkB,WAAW,MAAM,GAAG,kBACxD,OAAO,8BAA8B,OAAO,GAAG,WAAW,UAC1E;EACJ;EACA,MAAM;CACV;AACJ;;AAGA,SAAS,cAAc,KAA6B;CAChD,IAAI,EAAE,eAAe,UAAU,EAAE,UAAU,QAAQ,IAAI,SAAS,sBAAsB,OAAO;CAE7F,OAAO,iBAAiB,KAAK,IAAI,OAAO,CAAC,GAAG,MAAM;AACtD;;AAGA,SAAS,YAAY,OAAe,MAAoC;CACpE,MAAM,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC;CAC9B,OAAO,gBAAgB,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC,GAAG,IAAI;AACxF;;;;;;;;;;;;;;;AAgBA,SAAgB,kBACZ,MACA,MACA,SACoC;CACpC,MAAM,OAAO;EAAE,GAAG;EAAe,GAAG;CAAK;CACzC,IAAI;EACA,QAAA,GAAA,WAAA,QAAA,CAAW,MAAM,EAAE,KAAK,CAAC;CAC7B,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,MAAM,MAAM;EAC5B,MAAM,aAAa,YAAY,SAAS,IAAI;EAC5C,MAAM,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC;EACpE,MAAM,IAAI,MACN,YAAY,QAAQ,mBAAmB,aACtC,aAAa,mBAAmB,WAAW,KAAK,eAAe,MAAM,KAAK,IAAI,EAAE,MACjF,kCAAkC,QAAQ,WAC9C;CACJ;AACJ"}

package/dist/cli-flags.d.ts

@@ -127,3 +127,18 @@ export declare function assertSpecMatchesUsage(specs: Record<string, arg.Spec>,
  * tests can see.
  */
 export declare function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void;
+/**
+ * Parse a command that owns its argument handling, refusing what it does not
+ * declare.
+ *
+ * `db backup`, `db restore` and `db backups list` parsed permissively, so an
+ * undeclared flag became a positional and was ignored: `db restore <dump>
+ * --targt-db x --create-db --yes` dropped the misspelled target and restored
+ * into the live database. A typo is refused here before anything runs, naming
+ * the declared flag it is one edit from, or every flag the command takes when
+ * none is that close.
+ *
+ * @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+ * @param command the command as typed, for the message: `"db restore"`.
+ */
+export declare function parseCommandFlags<S extends arg.Spec>(spec: S, argv: string[], command: string): arg.Result<typeof RELAYED_FLAGS & S>;

package/dist/cli-helpers.d.ts

@@ -1,5 +1,6 @@
 import type { GeneratedColumnDependency } from "./schema/generated-column-conflicts.js";
 import { type ExistingColumnType } from "./schema/destructive-sql.js";
+import { type ExistingConstraint } from "./schema/undeclarable-constraints.js";
 import type { CollectionConfig } from "@rebasepro/types";
 /**
  * Why is a dependency's binary missing — never installed, or installed with its
@@ -84,6 +85,45 @@ export declare function resolveLocalBin(binName: string): string | null;
 export declare function getTableIncludesFromCollections(allCollections: CollectionConfig[]): Promise<string[]>;
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function loadCollectionsForCli(collectionsPath: string): Promise<CollectionConfig[]>;
+type PgClient = import("pg").Client;
+/**
+ * Run one step on this process's connection to the app database.
+ *
+ * Every step leaves the session as it found it, which is what a connection of
+ * its own used to guarantee by being closed. None of them sets anything for
+ * the session — `SET LOCAL` inside their own transaction, or `RESET` — and one
+ * that fails part-way through a transaction it opened is rolled back here, so
+ * the next step does not meet `current transaction is aborted`.
+ *
+ * @param options.connectionTimeoutMillis applies only when this call is the one
+ *        that connects.
+ */
+export declare function withAppClient<T>(databaseUrl: string, step: (client: PgClient) => Promise<T>, options?: {
+    connectionTimeoutMillis?: number;
+}): Promise<T>;
+/** Close every connection {@link withAppClient} opened. Called once, as the command ends. */
+export declare function closeAppClients(): Promise<void>;
+/**
+ * Names the empty database Atlas plans against, instead of `<db>_dev_diff`.
+ *
+ * The derived one is made with `CREATE DATABASE` beside the real database,
+ * which assumes a server that holds more than one. PGlite — the managed
+ * development database — serves exactly one: the CREATE succeeds and creates
+ * nothing, so Atlas connected straight back to the database it was comparing
+ * and refused it as "not clean". `rebase db push` on the managed database now
+ * starts a second, throwaway PGlite and names it here. Anyone can name their
+ * own the same way; a named database is neither created nor dropped.
+ */
+export declare const ATLAS_DEV_URL_ENV = "REBASE_ATLAS_DEV_URL";
+/**
+ * The database Atlas replays the desired schema into: the one
+ * {@link ATLAS_DEV_URL_ENV} names (`named: true` — not ours to create or
+ * drop), else `<db>_dev_diff`.
+ */
+export declare function atlasDevDatabaseUrl(databaseUrl: string, env: Readonly<Record<string, string | undefined>>): {
+    url: string;
+    named: boolean;
+};
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 /**
  * Create the scratch database Atlas plans against, and say so when we cannot.
@@ -127,10 +167,10 @@ export declare function dropDevDatabase(databaseUrl: string, devDatabaseUrl: str
 /**
  * The generated SQL for the project's `search` blocks, if it has any.
  *
- * @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
- *        under the working directory.
+ * @param sqlDir directory holding the generated SQL. Defaults to
+ *        `.rebase/sql` under the working directory.
  */
-export declare function readSearchDdl(drizzleDir?: string): string;
+export declare function readSearchDdl(sqlDir?: string): string;
 /**
  * Bring the search column, its index and their helpers up to date.
  *
@@ -144,7 +184,7 @@ export declare function readSearchDdl(drizzleDir?: string): string;
  * silently pushing a schema whose search column never appeared is how a
  * collection ends up with search configured, no error anywhere, and no results.
  */
-export declare function applySearchDdl(databaseUrl: string, drizzleDir?: string): Promise<void>;
+export declare function applySearchDdl(databaseUrl: string, sqlDir?: string): Promise<void>;
 /**
  * Glob patterns keeping Atlas away from the search objects.
  *
@@ -181,10 +221,10 @@ export declare function dropGeneratedColumns(databaseUrl: string, statements: st
 /**
  * The generated SQL for the project's `vector` properties, if it has any.
  *
- * @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
- *        under the working directory.
+ * @param sqlDir directory holding the generated SQL. Defaults to
+ *        `.rebase/sql` under the working directory.
  */
-export declare function readVectorDdl(drizzleDir?: string): string;
+export declare function readVectorDdl(sqlDir?: string): string;
 /**
  * Install pgvector and bring the vector columns and their ANN indexes up to
  * date.
@@ -200,7 +240,7 @@ export declare function readVectorDdl(drizzleDir?: string): string;
  * appeared is how a project ends up with vector search configured, no error
  * anywhere, and no results.
  */
-export declare function applyVectorDdl(databaseUrl: string, drizzleDir?: string): Promise<void>;
+export declare function applyVectorDdl(databaseUrl: string, sqlDir?: string): Promise<void>;
 /**
  * Glob patterns keeping Atlas away from the vector objects.
  *
@@ -212,10 +252,10 @@ export declare function getVectorExcludes(collectionsPath: string): Promise<stri
  * The generated SQL for the project's `autoValue: "on_update"` properties, if
  * it has any.
  *
- * @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
- *        under the working directory.
+ * @param sqlDir directory holding the generated SQL. Defaults to
+ *        `.rebase/sql` under the working directory.
  */
-export declare function readTriggersDdl(drizzleDir?: string): string;
+export declare function readTriggersDdl(sqlDir?: string): string;
 /**
  * Install the `updated_at` trigger function and bind it to every column that
  * asked for one.
@@ -230,7 +270,7 @@ export declare function readTriggersDdl(drizzleDir?: string): string;
  * appeared is how `updated_at` ends up silently stale for every writer that is
  * not the driver, which is the whole reason the trigger exists.
  */
-export declare function applyTriggersDdl(databaseUrl: string, drizzleDir?: string): Promise<void>;
+export declare function applyTriggersDdl(databaseUrl: string, sqlDir?: string): Promise<void>;
 /** @see getSearchExcludes */
 export declare function getTriggerExcludes(collectionsPath: string): Promise<string[]>;
 /**
@@ -238,15 +278,21 @@ export declare function getTriggerExcludes(collectionsPath: string): Promise<str
  * catalogs. Separated from {@link getTableExcludes} so its failure mode can
  * be handled explicitly (fail closed) and so tests can inject a stub.
  */
+/** An index as the catalogue names it: its schema, its table and its own name. */
+export interface ExistingIndex {
+    schema: string;
+    table: string;
+    index: string;
+}
 /**
- * Every index Postgres holds on a table Rebase manages, as
- * `schema.table.index`.
+ * Every index Postgres holds on a table, by its parts — never joined with `.`,
+ * which a name may itself contain.
  *
  * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
  * *constraint* to Atlas, diffed from the constraint declaration, and naming its
  * index in an exclude would shield the constraint itself.
  */
-export declare function queryExistingIndexes(databaseUrl: string): Promise<string[]>;
+export declare function queryExistingIndexes(databaseUrl: string): Promise<ExistingIndex[]>;
 /**
  * Glob patterns keeping Atlas away from indexes that are not Rebase's.
  *
@@ -273,13 +319,35 @@ export declare function queryExistingIndexes(databaseUrl: string): Promise<strin
  *
  * Three-part `schema.table.index`, never two: a two-part pattern reads as a
  * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
- * reports no error — the trap already recorded for the search excludes.
+ * reports no error — the trap already recorded for the search excludes. And
+ * spelled by `atlasExcludePattern`: a raw `orders_idx[v1]` is a glob that
+ * matches `orders_idxv`, so that index was dropped with no prompt.
  */
 export declare function getForeignIndexExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingIndexes?: (databaseUrl: string) => Promise<ExistingIndex[]>;
     getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;
 }): Promise<string[]>;
-export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/** Every CHECK and EXCLUDE constraint the database holds. @see UNDECLARABLE_CONSTRAINTS_SQL */
+export declare function queryUndeclarableConstraints(databaseUrl: string): Promise<ExistingConstraint[]>;
+/**
+ * Patterns keeping Atlas away from the CHECK and EXCLUDE constraints the
+ * collections do not declare — which, since a collection cannot declare
+ * either, is all of them. See `schema/undeclarable-constraints.ts`.
+ *
+ * Fails CLOSED, like {@link getTableExcludes}: without the catalogue nothing
+ * says which constraints are there, and a partial list lets the push drop a
+ * rule the database enforces. `desiredSql` is the `schema.sql` Atlas is about
+ * to diff against; a constraint it declares is Atlas's to manage.
+ */
+export declare function getUndeclaredConstraintExcludes(databaseUrl: string, desiredSql: string, deps?: {
+    queryConstraints?: (databaseUrl: string) => Promise<ExistingConstraint[]>;
+}): Promise<string[]>;
+/** A table or view as the catalogue names it. */
+export interface ExistingTable {
+    schema: string;
+    table: string;
+}
+export declare function queryExistingTables(databaseUrl: string): Promise<ExistingTable[]>;
 /**
  * Raised when the exclude list could not be built. `db push` MUST abort on
  * this rather than continue: the exclude list is the only thing shielding
@@ -304,21 +372,7 @@ export declare class ExcludeIntrospectionError extends Error {
  * `deps` is injectable for tests; production uses the real pg-backed queries.
  */
 export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingTables?: (databaseUrl: string) => Promise<ExistingTable[]>;
     getIncludes?: (collectionsPath: string) => Promise<string[]>;
 }): Promise<string[]>;
-/**
- * Ask a yes/no question on an interactive terminal.
- *
- * The `isTTY` guard is the contract, not an optimisation: non-interactive
- * shells (CI, pipes, agents) can never answer, and `readline` on a
- * non-TTY stdin resolves with whatever the pipe happens to contain — or never
- * resolves at all. Returning false there is what makes an unattended
- * `db push` abort instead of auto-confirming a destructive change. Callers
- * should already have gone through {@link decidePushSafety}, which decides
- * whether interactive confirmation is even possible; this is the backstop.
- *
- * Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
- * `import.meta` and cannot be imported by the jest runner.
- */
-export declare function promptConfirm(question: string): Promise<boolean>;
+export {};

package/dist/cli-output.d.ts

@@ -1,34 +1,22 @@
-/**
- * Terminal output for the `rebase db|schema|doctor` commands.
- *
- * These commands used to write every line through `logger`, and that is a
- * category error with three separate consequences:
- *
- *  - `logger` prefixes each line with its own level, so a box-drawn report
- *    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
- *    lined up with anything;
- *  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
- *    `.env.example` — a developer who quietened their dev server with
- *    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
- *    still exited non-zero, indistinguishable from a crash;
- *  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
- *    became log records with the chalk escape codes embedded in them.
- *
- * A CLI's report *is* its return value. It goes to the terminal unconditionally
- * and unadorned. `packages/cli` has always written its output this way; this is
- * the same three functions for the plugin CLI that `rebase` delegates to.
- *
- * `logger` still belongs in this package's *runtime* — a request handler has no
- * terminal and its lines want levels, timestamps and redaction. The rule is the
- * caller, not the severity: anything a developer reads because they typed a
- * command goes here, anything a server emits while running goes to `logger`.
- *
- * Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
- * diagnosis on the terminal where it is readable.
- */
 /** One line of human-facing output on stdout. */
 export declare const out: (line?: string) => void;
 /** One line of human-facing warning output on stderr. */
 export declare const outWarn: (line?: string) => void;
 /** One line of human-facing error output on stderr. */
 export declare const outError: (line?: string) => void;
+/**
+ * Whether a failure should be printed with its stack — `rebase --debug`, which
+ * the launcher passes down as `REBASE_DEBUG`, or `REBASE_DEBUG` set by hand.
+ */
+export declare const wantsStack: () => boolean;
+/**
+ * An error as a person reads it: its message, and its stack only under
+ * `--debug`.
+ *
+ * The rule `rebase` itself follows (`bin/rebase.js`). These commands run in a
+ * child process the launcher's handler never sees, so a syntax error in a
+ * collection file reached the terminal as `Doctor failed CollectionConfigError:`
+ * followed by twenty frames of loader internals, under a sentence that already
+ * said which file and which line.
+ */
+export declare const describeFailure: (error: unknown) => string;

package/dist/{arg-Dni7MzLB.js → cli-prompt-egtNKkZl.js}

@@ -1,6 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { n as __commonJSMin } from "./__vite-browser-external-BnuHet1e.js";
+import { t as __commonJSMin } from "./rolldown-runtime-V7rFbMRe.js";
+import readline from "readline";
 //#region ../../node_modules/.pnpm/arg@5.0.2/node_modules/arg/index.js
 var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var flagSymbol = Symbol("arg flag");
@@ -82,6 +83,51 @@ var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = arg;
 }));
 //#endregion
-export { require_arg as t };
+//#region src/cli-prompt.ts
+/**
+* The one yes/no question the driver CLI asks: before a destructive `db push`,
+* before a `db restore` without `--yes`, before `db branch prune` removes
+* anything, and before `schema introspect` samples rows.
+*/
+/**
+* Ask a yes/no question on an interactive terminal; `true` only for "y" or
+* "yes".
+*
+* The `isTTY` guard is the contract, not an optimisation: non-interactive
+* shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY
+* stdin resolves with whatever the pipe happens to contain, or never resolves
+* at all. Returning false there is what makes an unattended `db push` abort
+* instead of auto-confirming a destructive change. Callers decide first
+* whether interactive confirmation is possible (`decidePushSafety` for a
+* push); this is the backstop.
+*
+* Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,
+* not as a signal, and with nothing listening it only pauses the input: the
+* question never resolves, and the open database connections behind it keep
+* the process alive, so the command hung instead of stopping. Answering no
+* sends it down the path that says "Aborted" and cleans up.
+*/
+async function promptConfirm(question) {
+	if (!process.stdin.isTTY) return false;
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const answer = await new Promise((resolve) => {
+			rl.once("SIGINT", () => {
+				process.stdout.write("\n");
+				resolve("");
+			});
+			rl.once("close", () => resolve(""));
+			rl.question(question, resolve);
+		});
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+export { require_arg as n, promptConfirm as t };
 
-//# sourceMappingURL=arg-Dni7MzLB.js.map
+//# sourceMappingURL=cli-prompt-egtNKkZl.js.map