@rebasepro/server-postgres 0.23.0 → 0.24.1-canary.g56af4a4

package/dist/cli.js

@@ -1,20 +1,41 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { a as formatForeignGeneratedColumnBanner, c as reportCommandFailure, i as diagnoseDbError, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity } from "./cli-errors-B8qHg02P.js";
-import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { A as resolveLocalBin, C as loadCollectionsForCli, D as readSearchDdl, E as queryGeneratedColumnDependencies, F as forLibpq, M as detectDestructiveStatements, N as splitSqlStatements, O as readTriggersDdl, P as execa, S as getVectorExcludes, T as queryColumnTypes, _ as getDevDatabaseUrl, a as ExcludeIntrospectionError, b as getTableExcludes, c as applyVectorDdl, d as describeReinstallCommand, f as detectProjectPackageManager, g as ensureDevDatabaseExists, h as dropGeneratedColumns, j as decidePushSafety, k as readVectorDdl, l as describeBuildScriptRemedy, m as dropDevDatabase, o as applySearchDdl, p as diagnoseMissingBin, r as dropLegacyAuthSchema, s as applyTriggersDdl, t as RLS_BOOTSTRAP_SQL, u as describeDevAddCommand, v as getForeignIndexExcludes, w as promptConfirm, x as getTriggerExcludes, y as getSearchExcludes } from "./rls-bootstrap-sql-B8EclDyM.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
+import { A as queryColumnTypes, B as prepareGeneratedSqlDir, C as getForeignIndexExcludes, D as getVectorExcludes, E as getTriggerExcludes, F as resolveLocalBin, G as isSyncedPlan, H as detectDestructiveStatements, I as withAppClient, L as DESIRED_STATE_URL, M as readSearchDdl, N as readTriggersDdl, O as loadCollectionsForCli, P as readVectorDdl, R as GENERATED_SQL_DIR, S as ensureDevDatabaseExists, T as getTableExcludes, U as extractPlanStatements, V as decidePushSafety, W as fromAlterTable, _ as describeReinstallCommand, a as formatForeignGeneratedColumnBanner, b as dropDevDatabase, c as reportCommandFailure, d as applyTriggersDdl, f as applyVectorDdl, g as describeDevAddCommand, h as describeBuildScriptRemedy, i as diagnoseDbError, j as queryGeneratedColumnDependencies, k as promptConfirm, l as ExcludeIntrospectionError, m as closeAppClients, p as atlasDevDatabaseUrl, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity, u as applySearchDdl, v as detectProjectPackageManager, w as getSearchExcludes, x as dropGeneratedColumns, y as diagnoseMissingBin, z as generatedSqlDir } from "./cli-errors-CaI4ntyD.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
+import { o as execa, r as dropLegacyAuthSchema, s as forLibpq, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-RQUljnJ1.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-BglvpjHv.js";
-import { logger } from "@rebasepro/server";
+import { n as collectionsPathIn, r as parseDriverLine, t as assertKnownFlags } from "./cli-flags-B-Dawocl.js";
 import { formatRelativeTime } from "@rebasepro/utils";
-import fs from "fs";
 import path from "path";
-import { fileURLToPath } from "url";
-//#region src/schema/generated-column-conflicts.ts
+import fs from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createRequire } from "module";
+//#region src/tsx-loader.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
+* tsx's loader, as the URL `node --import` takes, or null when none resolves.
+*
+* For running one of this driver's scripts in one Node process. The `tsx`
+* binary is a relay — pnpm's `.bin/tsx` shell shim, then tsx's CLI in one Node,
+* which spawns a second Node with this same loader to run the script — so
+* spawning through it costs a shell and a Node start (~50–100 ms) per child.
+*
+* Resolved the way Node resolves the package: from the project the driver
+* runs in first (its cwd is the backend, where a scaffold declares tsx), then
+* from this package. A URL rather than a path: a Windows path is not a valid
+* `--import` specifier.
+*/
+function resolveTsxLoader() {
+	const bases = [path.join(process.cwd(), "noop.js"), import.meta.url];
+	for (const base of bases) try {
+		return pathToFileURL(createRequire(base).resolve("tsx")).href;
+	} catch {}
+	return null;
+}
+//#endregion
+//#region src/schema/generated-column-conflicts.ts
+/**
 * Which columns an Atlas plan cannot touch, because a generated column reads
 * them.
 *
@@ -51,16 +72,6 @@ var ALTER_COLUMN_RE = new RegExp(String.raw`\bALTER\s+(?:COLUMN\s+)?(${IDENT$1})
 var DROP_COLUMN_RE$1 = new RegExp(String.raw`\bDROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT$1})`, "gi");
 var unquote = (ident) => ident.startsWith("\"") ? ident.slice(1, -1) : ident;
 /**
-* Strip Atlas's plan rendering from a statement.
-*
-* What `schema apply --dry-run` prints is not a SQL file: each statement is
-* indented under a `-- modify "posts" table` heading and prefixed with `-> `,
-* with an `-- ok (12µs)` line after it. `splitSqlStatements` drops the comment
-* lines, and this drops the arrow — without it an anchored `^ALTER TABLE`
-* matches nothing at all, which is a silent no-op rather than an error.
-*/
-var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
-/**
 * Every column an Atlas plan retypes or drops, with the table it belongs to.
 *
 * One statement carries many clauses — Atlas emits `ALTER TABLE "public"."posts"
@@ -69,8 +80,8 @@ var stripPlanMarker = (statement) => statement.replace(/^\s*->\s*/, "").trim();
 */
 function parseColumnMutations(planSql) {
 	const mutations = [];
-	for (const raw of splitSqlStatements(planSql)) {
-		const statement = stripPlanMarker(raw);
+	for (const raw of extractPlanStatements(planSql)) {
+		const statement = fromAlterTable(raw);
 		const table = TABLE_RE.exec(statement);
 		if (!table) continue;
 		const [schema, name] = table[2] ? [unquote(table[1]), unquote(table[2])] : [void 0, unquote(table[1])];
@@ -543,6 +554,60 @@ function tidy(sql) {
 	return trimmed.length === 0 ? "" : `${trimmed}\n`;
 }
 //#endregion
+//#region src/schema/migration-post-process.ts
+/**
+* Run the steps that finish a migration Atlas just wrote — the search, vector
+* and trigger DDL, the RLS bootstrap and policies, the re-hash — and take the
+* migration back out when any of them fails.
+*
+* Atlas's own file creates the tables and nothing else: no `ENABLE ROW LEVEL
+* SECURITY`, no policy. Those arrive in the append. A failure here used to be a
+* yellow warning followed by "You can now run rebase db migrate", and when it
+* struck before the file was rewritten the checksum still matched — so the
+* migration applied cleanly and created every new table with RLS off while
+* the schema's default privileges handed `rebase_user` full DML on it. On a
+* deployment that runs migrations and never provisions at boot
+* (`REBASE_MIGRATE_ON_BOOT=none`), nothing closed it again.
+*
+* Deleting the file is safe because it is the one this run created: running
+* `db generate` again, once the cause is fixed, writes the same diff.
+*/
+async function finishNewMigration(file, steps, rehash) {
+	try {
+		await steps();
+		return { ok: true };
+	} catch (err) {
+		const error = err instanceof Error ? err.message : String(err);
+		let removed = false;
+		try {
+			if (fs.existsSync(file)) fs.unlinkSync(file);
+			removed = !fs.existsSync(file);
+		} catch {
+			removed = false;
+		}
+		if (!removed) return {
+			ok: false,
+			error,
+			removed
+		};
+		try {
+			await rehash();
+			return {
+				ok: false,
+				error,
+				removed
+			};
+		} catch (hashErr) {
+			return {
+				ok: false,
+				error,
+				removed,
+				rehashError: hashErr instanceof Error ? hashErr.message : String(hashErr)
+			};
+		}
+	}
+}
+//#endregion
 //#region src/schema/atlas-argv.ts
 /**
 * Does this Atlas invocation accept `--exclude`?
@@ -637,6 +702,90 @@ var ScratchDatabase = class {
 	}
 };
 //#endregion
+//#region src/cli-push.ts
+/**
+* Apply a planned push.
+*
+* A dry-run that answered "Schema is synced" skips the second Atlas run: that
+* run would plan the same diff again (≈0.9 s at 111 tables, 5.5 s at 411 —
+* Atlas's cost grows faster than the table count) and then apply nothing. The
+* steps after it still run, because Atlas cannot see what they own. A plan with
+* anything in it keeps the old flow, including Atlas re-planning at apply time.
+*
+* @returns `"synced"` when Atlas was not run again, `"applied"` otherwise.
+*/
+async function applyPushPlan(plan, steps) {
+	const synced = isSyncedPlan(plan.dryRun) && plan.rebuildable === 0;
+	if (synced) steps.reportSynced();
+	else {
+		if (plan.rebuildable > 0) await steps.dropRebuildable();
+		try {
+			await steps.atlasApply();
+		} catch (err) {
+			if (plan.rebuildable > 0) await steps.rebuildAfterFailure();
+			throw err;
+		}
+	}
+	await steps.afterApply();
+	return synced ? "synced" : "applied";
+}
+/**
+* The tables whose stamp `db push` may write: those every one of whose planned
+* statements `policies.sql` carries, verbatim.
+*
+* A stamp says "this stored definition is what the plan's statement made". It
+* is only true of a policy the statement *did* make — and since both are
+* rendered by the same function from the same collections, a table whose
+* statements are all in the file is one whose policies the file just created.
+* Anything else (a hand-edited file, a file generated elsewhere) is not
+* stamped, and the next boot re-applies that table, as before.
+*/
+function stampableTables(plans, policiesSql) {
+	return plans.filter((plan) => plan.policyStatements.length > 0 && plan.policyStatements.every((statement) => policiesSql.includes(statement)));
+}
+/**
+* Run `policies.sql`, then stamp the policies it created the way a boot does,
+* in the same transaction.
+*
+* Before stamps the push's policies carried none, so the first boot after
+* every push re-applied them all — a DROP and a CREATE per policy, an ACCESS
+* EXCLUSIVE lock per table. Stamped here, that boot finds them current.
+*
+* The file runs in one transaction, as it did as one implicit one: a policy
+* that fails leaves the previous ones in place. The stamps run after it, under
+* a savepoint: a stamp that cannot be written costs the next boot a re-apply,
+* which is what it did before, so it is reported and the policies are kept.
+* Nothing is left set on the connection: `SET LOCAL` ends with the transaction.
+*/
+async function applyPoliciesFile(client, policiesSql, stamping) {
+	await client.query("BEGIN");
+	let stamped = 0;
+	let stampError;
+	try {
+		await client.query(policiesSql);
+		if (stamping.statements.length > 0) {
+			await client.query("SAVEPOINT rebase_policy_stamps");
+			try {
+				if (stamping.searchPath) await client.query(`SET LOCAL search_path TO ${stamping.searchPath}`);
+				await client.query(stamping.statements.join("\n"));
+				await client.query("RELEASE SAVEPOINT rebase_policy_stamps");
+				stamped = stamping.statements.length;
+			} catch (err) {
+				await client.query("ROLLBACK TO SAVEPOINT rebase_policy_stamps");
+				stampError = err instanceof Error ? err.message : String(err);
+			}
+		}
+		await client.query("COMMIT");
+	} catch (err) {
+		await client.query("ROLLBACK").catch(() => void 0);
+		throw err;
+	}
+	return {
+		stamped,
+		stampError
+	};
+}
+//#endregion
 //#region src/branch-argv.ts
 /**
 * Argument shapes for `rebase db branch`, with no dependencies.
@@ -705,8 +854,8 @@ var TAKES_A_VALUE = /* @__PURE__ */ new Set([
 * `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv assembly
 * each re-enter the loader with the same line — and then both generators wrote
 * an *empty* schema: `drizzle/schema.sql` truncated to `CREATE SCHEMA IF NOT
-* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both are committed
-* artifacts. The push that followed planned a `DROP TABLE` for every table in
+* EXISTS "rebase";`, `src/schema.generated.ts` to ten lines. Both were committed
+* artifacts then. The push that followed planned a `DROP TABLE` for every table in
 * the database, and the only thing between a typo and that was the destructive
 * gate.
 *
@@ -851,6 +1000,11 @@ var __cliDirname = path.dirname(fileURLToPath(import.meta.url));
 * tsx maps it back. Running the built `.js` under plain `node` therefore fails
 * on the user's code rather than on ours, one directory further from anything
 * the error mentions.
+*
+* tsx's loader in one Node (`node --import`) when it resolves, rather than the
+* `tsx` binary, which is a shell shim and a relay Node in front of that same
+* loader (see `tsx-loader.ts`). The binary stays the fallback — a global tsx.
+* `args` is everything after `bin`, the script included.
 */
 function resolveChildScript(name) {
 	const built = path.join(__cliDirname, "schema", `${name}.js`);
@@ -860,6 +1014,16 @@ function resolveChildScript(name) {
 		ok: false,
 		reason: "script"
 	};
+	const tsxLoader = resolveTsxLoader();
+	if (tsxLoader) return {
+		ok: true,
+		bin: process.execPath,
+		args: [
+			"--import",
+			tsxLoader,
+			script
+		]
+	};
 	const tsxBin = resolveLocalBin("tsx");
 	if (!tsxBin) return {
 		ok: false,
@@ -868,7 +1032,7 @@ function resolveChildScript(name) {
 	return {
 		ok: true,
 		bin: tsxBin,
-		script
+		args: [script]
 	};
 }
 /** What to print when {@link resolveChildScript} cannot produce a command. */
@@ -876,6 +1040,40 @@ function childScriptError(what, reason) {
 	if (reason === "tsx") return `✗ Could not find the tsx binary, which ${what} needs to read your collection files. Install your project's dependencies and try again.`;
 	return `✗ The driver's ${what} is missing. This copy of @rebasepro/server-postgres is incomplete — reinstall it, or run its build if you are working in the monorepo.`;
 }
+/**
+* Whether this process can run the generators itself — that is, whether it
+* runs under tsx, the interpreter the project's collection files need (see
+* {@link resolveChildScript}). `rebase` always starts the driver that way when
+* tsx is installed, which a scaffold guarantees; a driver started with plain
+* `node` keeps the child process, which brings its own tsx.
+*/
+function generatesInProcess() {
+	return [...process.execArgv, process.env.NODE_OPTIONS ?? ""].some((flag) => /(?:^|[\s\\/=])tsx(?:$|[\s\\/@])/.test(flag));
+}
+/**
+* Run one of the generators in this process — see `schema/generate-files.ts`
+* for why a one-shot generation no longer gets a process of its own.
+*
+* The messages and the exit code are the child's: a generator that failed has
+* printed its own error, and this adds the one-line verdict; one that could not
+* even be loaded is reported the way a child that never started was.
+*/
+async function generateInProcess(what, label, run) {
+	let generators;
+	try {
+		generators = await import("./generate-files-CdEckX6c.js").then((n) => n.t);
+	} catch (err) {
+		outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	try {
+		await run(generators);
+	} catch (err) {
+		if (err instanceof generators.GenerationFailed) outError(chalk.red(`✗ ${label} generation failed — nothing was applied.`));
+		else outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+}
 async function loadEnv() {
 	try {
 		const dotenv = await import("dotenv");
@@ -904,12 +1102,16 @@ async function runPluginCommand(args) {
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
-	if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
-	else if (domain === "schema") await schemaCommand(subcommand, args);
-	else if (domain === "doctor") await doctorPluginCommand(args);
-	else {
-		outError(chalk.red(`Unknown domain command: ${domain}`));
-		process.exit(1);
+	try {
+		if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
+		else if (domain === "schema") await schemaCommand(subcommand, args);
+		else if (domain === "doctor") await doctorPluginCommand(args);
+		else {
+			outError(chalk.red(`Unknown domain command: ${domain}`));
+			process.exit(1);
+		}
+	} finally {
+		await closeAppClients();
 	}
 }
 /** The migration files on disk, sorted, or none if the directory is absent. */
@@ -982,6 +1184,48 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 	return !result.empty;
 }
 /**
+* One line per destructive statement, as `db push` prints them — shared by
+* push, `db generate` and `db migrate --refuse-destructive`, so the three
+* describe the same statement the same way.
+*/
+function destructiveLines(destructive) {
+	return destructive.map((d) => chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+}
+/**
+* The column types `detectDestructiveStatements` reads a type change against,
+* or none when the database cannot be asked — every type change then counts
+* as destructive, which is the safe side of a report.
+*/
+async function columnTypesOrNone(databaseUrl) {
+	if (!databaseUrl) return [];
+	try {
+		return await queryColumnTypes(databaseUrl);
+	} catch {
+		return [];
+	}
+}
+/**
+* Say what in the migration `db generate` just wrote destroys data.
+*
+* `db push` stops before a destructive change; `db generate` wrote the same
+* `DROP COLUMN` into a file without a word, and `db migrate` applied it. Only
+* the part Atlas planned is read: what is appended after it (the search
+* rebuild, policies, triggers) is Rebase's own and puts back what it drops.
+* A report, not a refusal — the exit code is unchanged.
+*/
+async function reportDestructiveMigration(migrationSql, migrationFile, databaseUrl) {
+	const destructive = detectDestructiveStatements(migrationSql, await columnTypesOrNone(databaseUrl));
+	if (destructive.length === 0) return;
+	outWarn("");
+	outWarn(chalk.yellow(`  ⚠️  ${migrationFile} includes ${destructive.length} destructive change(s) that will DESTROY data when applied:`));
+	outWarn("");
+	for (const line of destructiveLines(destructive)) outWarn(line);
+	outWarn("");
+	outWarn(chalk.yellow("  Review it before `rebase db migrate`. `rebase db migrate --refuse-destructive` will not apply it."));
+	outWarn(chalk.yellow("  Back up first: rebase db backup"));
+	outWarn("");
+}
+/**
 * The flags `rebase db` reads for the subcommands it parses itself. Hoisted
 * and named `…FLAGS` so the documentation verifier, which reads specs out of
 * this source, sees them.
@@ -989,6 +1233,7 @@ async function stripCarvedOutFromNewestMigration(collectionsPath) {
 var DB_FLAGS = {
 	"--collections": String,
 	"--allow-destructive": Boolean,
+	"--refuse-destructive": Boolean,
 	"--dry-run": Boolean,
 	"--yes": Boolean,
 	"--baseline": String,
@@ -1021,7 +1266,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-24v4OlSp.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-aUfRv16h.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1035,7 +1280,7 @@ async function dbCommand(subcommand, rawArgs) {
 		out(chalk.bold("  📦 Rebase DB Generate"));
 		out(chalk.gray("  Step 1/2: Generating Drizzle schema & Postgres DDL from collections..."));
 		out("");
-		await schemaCommand("generate", rawArgs);
+		await schemaCommand("generate", rawArgs, { nextStep: false });
 		await generatePostgresDdlCommand(rawArgs);
 		out("");
 		out(chalk.gray("  Step 2/2: Generating SQL migration files with Atlas..."));
@@ -1048,60 +1293,74 @@ async function dbCommand(subcommand, rawArgs) {
 			"--dir",
 			"file://drizzle/migrations",
 			"--to",
-			"file://drizzle/schema.sql"
+			DESIRED_STATE_URL
 		], collectionsPath);
 		let wroteNewMigration = listMigrationFiles().length > migrationsBefore.length;
 		if (wroteNewMigration) wroteNewMigration = await stripCarvedOutFromNewestMigration(collectionsPath);
-		try {
-			const migrationsDir = path.resolve(process.cwd(), "drizzle", "migrations");
-			if (fs.existsSync(migrationsDir) && wroteNewMigration) {
-				const sqlFiles = fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort();
-				if (sqlFiles.length > 0) {
-					const newestMigrationFile = path.join(migrationsDir, sqlFiles[sqlFiles.length - 1]);
-					let migrationContent = fs.readFileSync(newestMigrationFile, "utf-8");
-					migrationContent = migrationContent.replace(/CREATE SCHEMA (?!IF NOT EXISTS)("[^"]+");/g, "CREATE SCHEMA IF NOT EXISTS $1;");
-					const vectorContent = readVectorDdl();
-					if (vectorContent) {
-						migrationContent = `${migrationContent}\n\n${vectorContent}`;
-						out(chalk.gray("  ✓ Appended vector DDL to the migration"));
-					}
-					const searchContent = readSearchDdl();
-					if (searchContent) {
-						const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-Bt2d2mRH.js").then((n) => n.o);
-						const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
-						const preamble = migrationDropPreamble(migrationConflicts);
-						if (preamble) {
-							migrationContent = `${preamble}\n${migrationContent}`;
-							for (const conflict of migrationConflicts) out(chalk.gray(`  ✓ ${describeConflict(conflict)} is dropped and rebuilt inside the migration`));
-						}
-						migrationContent = `${migrationContent}\n\n${searchContent}`;
-						out(chalk.gray("  ✓ Appended search DDL to the migration"));
-					}
-					const triggersContent = readTriggersDdl();
-					if (triggersContent) {
-						migrationContent = `${migrationContent}\n\n${triggersContent}`;
-						out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
-					}
-					fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
-					const policiesFile = path.resolve(process.cwd(), "drizzle", "policies.sql");
-					if (fs.existsSync(policiesFile)) {
-						const policiesContent = fs.readFileSync(policiesFile, "utf-8");
-						fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
-						out(chalk.gray(`  ✓ Appended RLS policies to migration file: ${path.basename(newestMigrationFile)}`));
-						out(chalk.gray("  Re-hashing migration files..."));
-						await runAtlas("migrate", [
-							"hash",
-							"--dir",
-							"file://drizzle/migrations"
-						], collectionsPath);
-						out(chalk.gray("  ✓ Migration directory checksum updated successfully."));
+		const newestWritten = wroteNewMigration ? listMigrationFiles().at(-1) : void 0;
+		if (newestWritten) await reportDestructiveMigration(fs.readFileSync(path.resolve(process.cwd(), "drizzle", "migrations", newestWritten), "utf-8"), newestWritten, process.env.DATABASE_URL);
+		const migrationsDir = path.resolve(process.cwd(), "drizzle", "migrations");
+		const newestSql = fs.existsSync(migrationsDir) && wroteNewMigration ? fs.readdirSync(migrationsDir).filter((f) => f.endsWith(".sql")).sort().at(-1) : void 0;
+		if (newestSql) {
+			const newestMigrationFile = path.join(migrationsDir, newestSql);
+			const finished = await finishNewMigration(newestMigrationFile, async () => {
+				let migrationContent = fs.readFileSync(newestMigrationFile, "utf-8");
+				migrationContent = migrationContent.replace(/CREATE SCHEMA (?!IF NOT EXISTS)("[^"]+");/g, "CREATE SCHEMA IF NOT EXISTS $1;");
+				const vectorContent = readVectorDdl();
+				if (vectorContent) {
+					migrationContent = `${migrationContent}\n\n${vectorContent}`;
+					out(chalk.gray("  ✓ Appended vector DDL to the migration"));
+				}
+				const searchContent = readSearchDdl();
+				if (searchContent) {
+					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+					const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
+					const preamble = migrationDropPreamble(migrationConflicts);
+					if (preamble) {
+						migrationContent = `${preamble}\n${migrationContent}`;
+						for (const conflict of migrationConflicts) out(chalk.gray(`  ✓ ${describeConflict(conflict)} is dropped and rebuilt inside the migration`));
 					}
+					migrationContent = `${migrationContent}\n\n${searchContent}`;
+					out(chalk.gray("  ✓ Appended search DDL to the migration"));
 				}
+				const triggersContent = readTriggersDdl();
+				if (triggersContent) {
+					migrationContent = `${migrationContent}\n\n${triggersContent}`;
+					out(chalk.gray("  ✓ Appended `updated_at` triggers to the migration"));
+				}
+				fs.writeFileSync(newestMigrationFile, migrationContent, "utf-8");
+				const policiesFile = path.join(generatedSqlDir(), "policies.sql");
+				if (fs.existsSync(policiesFile)) {
+					const policiesContent = fs.readFileSync(policiesFile, "utf-8");
+					fs.appendFileSync(newestMigrationFile, "\n\n" + RLS_BOOTSTRAP_SQL + "\n" + policiesContent);
+					out(chalk.gray(`  ✓ Appended RLS policies to migration file: ${path.basename(newestMigrationFile)}`));
+					out(chalk.gray("  Re-hashing migration files..."));
+					await runAtlas("migrate", [
+						"hash",
+						"--dir",
+						"file://drizzle/migrations"
+					], collectionsPath, { throwOnFailure: true });
+					out(chalk.gray("  ✓ Migration directory checksum updated successfully."));
+				}
+			}, async () => {
+				await runAtlas("migrate", [
+					"hash",
+					"--dir",
+					"file://drizzle/migrations"
+				], collectionsPath, { throwOnFailure: true });
+			});
+			if (!finished.ok) {
+				outError(chalk.red(`\n  ✗ Could not finish ${newestSql}: ${finished.error}`));
+				outError(chalk.gray("    Atlas's half of a migration creates the tables; the part that failed adds their\n    row-level security, policies, search, vector and trigger DDL. Applied alone, it\n    would serve the new tables with no row filtering."));
+				outError(chalk.gray(finished.removed ? `    ${newestSql} was removed. Fix the cause and run \`rebase db generate\` again.` : `    ${newestSql} could not be removed — delete it by hand before \`rebase db migrate\`.`));
+				if (finished.rehashError) outError(chalk.gray(`    Re-hashing failed too (${finished.rehashError}); run \`atlas migrate hash\` or generate again.`));
+				process.exit(1);
 			}
-		} catch (err) {
-			outWarn(chalk.yellow(`  ⚠️  Failed to append policies or re-hash migration: ${err instanceof Error ? err.message : String(err)}`));
 		}
-		if (!wroteNewMigration) out(chalk.gray("  ℹ No migration written — nothing in this change is visible to Atlas.\n    Search, vector, trigger and RLS DDL are applied by `rebase db push`, and at\n    boot by the schema ensure. For a migration-only deployment, add\n    drizzle/search.sql, drizzle/vector.sql, drizzle/triggers.sql and\n    drizzle/policies.sql to a migration by hand."));
+		if (!wroteNewMigration) out(chalk.gray(`  ℹ No migration written — nothing in this change is visible to Atlas.
+    Search, vector, trigger and RLS DDL are applied by \`rebase db push\`, and at
+    boot by the schema ensure. For a migration-only deployment, add
+    ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
 		out("");
 		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
 		out("");
@@ -1110,32 +1369,46 @@ async function dbCommand(subcommand, rawArgs) {
 		out(chalk.bold(`  🗄️  Rebase DB ${subcommand.charAt(0).toUpperCase() + subcommand.slice(1)}`));
 		out("");
 		if (subcommand === "push") {
-			out(chalk.gray("  Step 1/3: Generating Drizzle schema & Postgres DDL from collections..."));
+			const dryRun = argsList["--dry-run"] === true;
+			out(chalk.gray(dryRun ? "  Step 1/3: Generating the Postgres DDL from collections (the plan's input)..." : "  Step 1/3: Generating Drizzle schema & Postgres DDL from collections..."));
 			out("");
-			await schemaCommand("generate", rawArgs);
-			await generatePostgresDdlCommand(rawArgs);
+			if (dryRun) out(chalk.gray("  --dry-run: src/schema.generated.ts is left as it is."));
+			else await schemaCommand("generate", rawArgs, { nextStep: false });
+			await generatePostgresDdlCommand(rawArgs, { retireLegacyCopies: !dryRun });
 			out("");
-			const dryRun = argsList["--dry-run"] === true;
 			out(chalk.gray(dryRun ? "  Step 2/3: Planning the change against the database (nothing is applied)..." : "  Step 2/3: Pushing schema to database with Atlas..."));
 			out("");
 			const databaseUrl = process.env.DATABASE_URL;
 			if (databaseUrl && !dryRun) await ensureAuthSchemaAndFunctions(databaseUrl);
+			if (databaseUrl) await renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun);
+			const prebuilt = databaseUrl ? await prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) : [];
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
-				"file://drizzle/schema.sql",
+				DESIRED_STATE_URL,
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
 			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
+			const unreadable = destructive.some((d) => d.kind === "UNREADABLE PLAN");
+			const planStatements = extractPlanStatements(plan);
+			const planListing = unreadable ? plan.trim() : planStatements.map((statement) => `${statement};`).join("\n");
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
+			if (databaseUrl) await reportKeptEnumLabels(databaseUrl, collectionsPath);
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
 				out("");
-				if (plan.trim()) {
+				if (planStatements.length > 0 || unreadable) {
 					out(chalk.bold("  Planned changes:"));
-					out(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+					out(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
 				out("");
+				if (prebuilt.length > 0) {
+					out(chalk.gray(`  ${prebuilt.length} foreign-key index(es) on existing tables would be built first,`));
+					out(chalk.gray("  CONCURRENTLY, so the apply would not build them under a write lock (the plan"));
+					out(chalk.gray("  above lists them because they do not exist yet):"));
+					for (const name of prebuilt) out(chalk.gray(`       ${name}`));
+					out("");
+				}
 				if (rebuildable.length > 0) {
 					out(chalk.gray(`  ${rebuildable.length} generated column(s) would be dropped before the apply and`));
 					out(chalk.gray("  rebuilt from search.sql after it — Postgres cannot retype a column"));
@@ -1146,7 +1419,7 @@ async function dbCommand(subcommand, rawArgs) {
 				if (unowned.length > 0) outWarn(formatForeignGeneratedColumnBanner(unowned));
 				if (destructive.length > 0) {
 					outWarn(chalk.yellow(`  ⚠️  ${destructive.length} of those DESTROY data:`));
-					for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+					for (const line of destructiveLines(destructive)) outWarn(line);
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
 					outWarn("");
@@ -1168,10 +1441,10 @@ async function dbCommand(subcommand, rawArgs) {
 			if (destructive.length > 0) {
 				outWarn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
 				outWarn("");
-				for (const d of destructive) outWarn(chalk.red(`       ${d.kind}${d.detail ? ` (${d.detail})` : ""}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+				for (const line of destructiveLines(destructive)) outWarn(line);
 				outWarn("");
 				outWarn(chalk.yellow("  Full planned changes:"));
-				outWarn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+				outWarn(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
 				outWarn("");
 				if (decision === "refuse") {
 					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
@@ -1185,39 +1458,65 @@ async function dbCommand(subcommand, rawArgs) {
 					}
 				} else outWarn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
 			}
-			if (rebuildable.length > 0 && databaseUrl) {
-				for (const conflict of rebuildable) out(chalk.gray(`  Dropping ${describeConflict(conflict)} — it reads a column this push retypes.`));
-				await dropGeneratedColumns(databaseUrl, dropGeneratedColumnStatements(rebuildable));
-			}
-			try {
-				await runAtlas("schema", [
-					"apply",
-					"--to",
-					"file://drizzle/schema.sql",
-					"--auto-approve"
-				], collectionsPath);
-			} catch (err) {
-				if (rebuildable.length > 0 && databaseUrl) {
+			await applyPushPlan({
+				dryRun: plan,
+				rebuildable: databaseUrl ? rebuildable.length : 0
+			}, {
+				dropRebuildable: async () => {
+					if (!databaseUrl) return;
+					for (const conflict of rebuildable) out(chalk.gray(`  Dropping ${describeConflict(conflict)} — it reads a column this push retypes.`));
+					await dropGeneratedColumns(databaseUrl, dropGeneratedColumnStatements(rebuildable));
+				},
+				atlasApply: async () => {
+					await runAtlas("schema", [
+						"apply",
+						"--to",
+						DESIRED_STATE_URL,
+						"--auto-approve"
+					], collectionsPath, { throwOnFailure: true });
+				},
+				reportSynced: () => out("Schema is synced, no changes to be made"),
+				rebuildAfterFailure: async () => {
+					if (!databaseUrl) return;
 					out(chalk.gray("  The apply failed — rebuilding the generated columns it needed out of the way."));
 					await applySearchDdl(databaseUrl);
+				},
+				afterApply: async () => {
+					out("");
+					if (!databaseUrl) {
+						outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
+						return;
+					}
+					await lockManagedTables(databaseUrl, collectionsPath);
+					await ensureAuthTables(databaseUrl, collectionsPath);
+					await applyVectorDdl(databaseUrl);
+					await applySearchDdl(databaseUrl);
+					await applyTriggersDdl(databaseUrl);
+					await applyPolicies(databaseUrl, collectionsPath);
+					await reconcilePolicies(databaseUrl, collectionsPath);
+					await ensureRlsUserRole(databaseUrl);
+					await retireLegacyAuthSchema(databaseUrl);
 				}
-				throw err;
-			}
-			out("");
-			if (databaseUrl) {
-				await ensureAuthTables(databaseUrl, collectionsPath);
-				await applyVectorDdl(databaseUrl);
-				await applySearchDdl(databaseUrl);
-				await applyTriggersDdl(databaseUrl);
-				await applyPolicies(databaseUrl);
-				await reconcilePolicies(databaseUrl, collectionsPath);
-				await ensureRlsUserRole(databaseUrl);
-				await retireLegacyAuthSchema(databaseUrl);
-			} else outWarn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
+			});
 		} else if (subcommand === "migrate") {
 			const databaseUrl = process.env.DATABASE_URL;
-			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
 			const baseline = argsList["--baseline"];
+			if (argsList["--refuse-destructive"] === true) {
+				const plan = await runAtlas("migrate", [...migrateApplyArgs(argsList._, baseline), "--dry-run"], collectionsPath, { captureStdout: true });
+				const destructive = detectDestructiveStatements(plan, await columnTypesOrNone(databaseUrl));
+				if (destructive.length > 0) {
+					outError(chalk.red(`  ✗ Refusing to migrate: the pending migrations include ${destructive.length} destructive change(s):`));
+					outError("");
+					for (const line of destructiveLines(destructive)) outError(line);
+					outError("");
+					outError(chalk.gray("    Nothing was applied. Run `rebase db migrate` without --refuse-destructive to apply them."));
+					outError(chalk.gray("    Back up first: rebase db backup"));
+					process.exit(1);
+				}
+				out(chalk.gray(`  --refuse-destructive: ${extractPlanStatements(plan).length} pending statement(s), none destructive.`));
+				out("");
+			}
+			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
 			if (baseline) {
 				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
 				out("");
@@ -1233,21 +1532,129 @@ async function dbCommand(subcommand, rawArgs) {
 		out("");
 	}
 }
+/**
+* Build, CONCURRENTLY and before Atlas plans, the derived foreign-key indexes
+* an existing table is missing — see `schema/push-index-prebuild.ts`. With
+* `dryRun`, only find them.
+*
+* Never fatal: an index not built here is one Atlas builds inside the push, as
+* it always did.
+*
+* @returns `schema.index` of each one missing when this started.
+*/
+/** Renames relation columns that carry their pre-0.13 derived name, as boot does; a dry-run only names them. */
+async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
+	let renames;
+	try {
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-BK6ilQq2.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+	} catch {
+		return;
+	}
+	if (renames.length === 0) return;
+	out(chalk.gray(dryRun ? `  ${renames.length} relation column(s) carry the name Rebase derived before 0.13; a push renames them first,` : `  Renaming ${renames.length} relation column(s) that carry the name Rebase derived before 0.13 (data, indexes and`));
+	out(chalk.gray(dryRun ? "  keeping their data (the plan below still shows them as a drop and an add, because nothing ran):" : "  constraints are kept — the same rename `rebase dev` runs):"));
+	for (const rename of renames) out(chalk.gray(`       ${rename.table}: "${rename.legacy}" → "${rename.expected}"`));
+	if (!dryRun) await withAppClient(databaseUrl, async (client) => {
+		for (const rename of renames) await client.query(rename.sql);
+	});
+	out(chalk.gray("  To keep an old name instead, name the column on the relation (`localKey`, or `through` on a many-to-many)."));
+	out("");
+}
+/** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
+async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
+	try {
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-D8fI1MoX.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
+	} catch {}
+}
+async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
+	let missing;
+	try {
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-Db4AQF4i.js");
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
+	} catch {
+		return [];
+	}
+	const names = missing.map((index) => `${index.schema}.${index.indexName}`);
+	if (missing.length === 0 || dryRun) return names;
+	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
+	try {
+		const { buildDeferredIndexes } = await import("./deferred-index-build-DP1_SNFo.js").then((n) => n.r);
+		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
+			dedicated: true,
+			query: async (text) => ({ rows: (await client.query(text)).rows }),
+			release: () => void 0
+		}), missing, { log: (message) => out(chalk.gray(`    ${message}`)) }));
+		for (const failure of outcome.failed) outWarn(chalk.yellow(`  ⚠️  ${failure.index} was not built ahead (${failure.error}); the push builds it inside its transaction instead.`));
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  The foreign-key indexes were not built ahead (${err instanceof Error ? err.message : String(err)}); the push builds them inside its transaction instead.`));
+	}
+	out("");
+	return names;
+}
 async function ensureAuthSchemaAndFunctions(databaseUrl) {
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			await client.query(RLS_BOOTSTRAP_SQL);
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Failed to bootstrap the RLS helper functions: ${err instanceof Error ? err.message : String(err)}`));
 	}
 }
 /**
+* Switch row-level security on for every table the collections declare, right
+* after Atlas has applied the schema.
+*
+* Atlas cannot carry `ENABLE ROW LEVEL SECURITY` in `schema.sql`: its free tier
+* neither plans it nor reads it back, so a table it creates is born with RLS
+* off — and `rebase_user`, the role every authenticated request runs as, holds
+* DML on it from that moment through the schema's default privileges. RLS used
+* to arrive with the policies, the last step of the push; a refusal from the
+* vector, search or trigger step in between left the new table readable and
+* writable by every caller, with no policy, until a later push or boot fixed
+* it — and a deployment with `REBASE_MIGRATE_ON_BOOT=none` never did. Locked
+* first, a failure later leaves a table that denies, not one that is open.
+*
+* Fatal when a table cannot be locked, and before the steps that follow: the
+* role provisioning at the end re-grants on every table in the schema, which
+* would undo the revoke that is the fallback here.
+*/
+async function lockManagedTables(databaseUrl, collectionsPath) {
+	let unsecured;
+	let userRole;
+	try {
+		const { lockCollectionTables } = await import("./ensure-collection-policies-CXpbeNag.js");
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-DvzqlaL1.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
+	} catch (err) {
+		outError(chalk.red(`\n  ✗ The schema was applied, but row-level security could not be switched on for its tables: ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("    A table this push created may be readable and writable by every authenticated request\n    until it is. Re-run `rebase db push` — it locks every collection table before anything else."));
+		process.exit(1);
+	}
+	if (unsecured.length === 0) return;
+	outError(chalk.red("\n  ✗ The schema was applied, but row-level security could not be switched on for:"));
+	for (const u of unsecured) {
+		outError(chalk.red(`      ${u.table}: ${u.error}`));
+		outError(chalk.gray(u.grantWithdrawn ? `        Its privileges were taken back from ${userRole}, so it is unreachable rather than unprotected.` : `        ${userRole} still holds its privileges: every authenticated request can read and write every row.`));
+	}
+	outError(chalk.gray("    Nothing after the schema apply ran. Fix the cause — the connection role must own these\n    tables, or be able to ALTER them — and run `rebase db push` again, or as their owner:"));
+	for (const u of unsecured) {
+		const [schema, ...table] = u.table.split(".");
+		outError(chalk.bold(`      ALTER TABLE "${schema}"."${table.join(".")}" ENABLE ROW LEVEL SECURITY;`));
+	}
+	process.exit(1);
+}
+/**
 * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
 * policies reference, before `applyPolicies` runs. Mirrors what the server does
 * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
@@ -1261,20 +1668,13 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Dhn9KM3B.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
-		const { Client } = await import("pg");
+		const { ensureAuthTablesExist } = await import("./ensure-tables-CHsgyLqg.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
 		});
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await ensureAuthTablesExist(drizzle(client), authCollection);
-		} finally {
-			await client.end();
-		}
+		await withAppClient(databaseUrl, (client) => ensureAuthTablesExist(drizzle(client), authCollection));
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Failed to ensure framework auth tables: ${err instanceof Error ? err.message : String(err)}`));
 	}
@@ -1289,24 +1689,19 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-C6Xk0lA6.js").then((n) => n.a);
+		rls = await import("./rls-enforcement-DvzqlaL1.js").then((n) => n.c);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
 	}
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			const runSql = async (text) => (await client.query(text)).rows;
 			if ((await rls.detectConnectionPosture(runSql)).privileged) {
 				await rls.ensureAppRole(runSql, schemas);
 				out(chalk.gray(`  ✓ RLS role "${rls.REBASE_USER_ROLE}" provisioned/refreshed.`));
 			}
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ The schema change was applied, but the "${rls.REBASE_USER_ROLE}" role could not be provisioned: ${err instanceof Error ? err.message : String(err)}`));
 		outError(chalk.gray(rls.appRoleSetupInstructions("your database user", schemas)));
@@ -1323,35 +1718,23 @@ async function ensureRlsUserRole(databaseUrl) {
 */
 async function retireLegacyAuthSchema(databaseUrl) {
 	try {
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await dropLegacyAuthSchema(async (text) => (await client.query(text)).rows, {
-				info: (m) => out(chalk.gray(`  ${m}`)),
-				warn: (m) => outWarn(chalk.yellow(`  ⚠️  ${m}`))
-			});
-		} finally {
-			await client.end();
-		}
+		await withAppClient(databaseUrl, (client) => dropLegacyAuthSchema(async (text) => (await client.query(text)).rows, {
+			info: (m) => out(chalk.gray(`  ${m}`)),
+			warn: (m) => outWarn(chalk.yellow(`  ⚠️  ${m}`))
+		}));
 	} catch {}
 }
-async function applyPolicies(databaseUrl) {
+async function applyPolicies(databaseUrl, collectionsPath) {
 	try {
-		const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
+		const policiesPath = path.join(generatedSqlDir(), "policies.sql");
 		if (!fs.existsSync(policiesPath)) return;
 		out(chalk.gray("  Step 3/3: Applying RLS policies to database..."));
 		out("");
 		const policiesContent = fs.readFileSync(policiesPath, "utf-8");
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
-			await client.query(policiesContent);
-			out(chalk.green("  ✓ RLS policies applied successfully."));
-		} finally {
-			await client.end();
-		}
+		const stamping = await policyStamping(databaseUrl, collectionsPath, policiesContent);
+		const { stampError } = await withAppClient(databaseUrl, (client) => applyPoliciesFile(client, policiesContent, stamping));
+		out(chalk.green("  ✓ RLS policies applied successfully."));
+		if (stampError) outWarn(chalk.yellow(`  ⚠️  The policies could not be stamped (${stampError}); the next boot applies them again.`));
 	} catch (err) {
 		const hint = diagnoseDbError(err, databaseUrl);
 		if (hint) outError(hint);
@@ -1360,6 +1743,25 @@ async function applyPolicies(databaseUrl) {
 	}
 }
 /**
+* The stamps a boot looks for, for the policies `policies.sql` is about to
+* create — see `applyPoliciesFile`. None when the collections cannot be read
+* here, which costs only the shortcut: the next boot re-applies, as before.
+*/
+async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
+	try {
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+		const { policyStampSql } = await import("./ensure-collection-policies-CXpbeNag.js");
+		const { pinSearchPath } = await import("./connection-BPoNILnD.js").then((n) => n.n);
+		return {
+			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
+			searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public"
+		};
+	} catch {
+		return { statements: [] };
+	}
+}
+/**
 * Remove the policies an earlier push superseded but never dropped.
 *
 * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
@@ -1374,13 +1776,10 @@ async function applyPolicies(databaseUrl) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-DljYdrpW.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-Dm8i-s1J.js").then((n) => n.a);
+		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
-		const { Client } = await import("pg");
-		const client = new Client({ connectionString: databaseUrl });
-		await client.connect();
-		try {
+		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
 			const { dropped, kept } = await dropOrphanedPolicies(client, drift, collections);
 			for (const p of dropped) out(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
@@ -1401,9 +1800,7 @@ async function reconcilePolicies(databaseUrl, collectionsPath) {
 					orphaned: []
 				}));
 			}
-		} finally {
-			await client.end();
-		}
+		});
 	} catch (err) {
 		outWarn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
 	}
@@ -1456,8 +1853,8 @@ async function branchCommand(rawArgs) {
 		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
 		process.exit(1);
 	}
-	const { DatabasePoolManager } = await import("./databasePoolManager-Bj5FbeAs.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-DGPL6G_C.js").then((n) => n.n);
+	const { DatabasePoolManager } = await import("./databasePoolManager-BkEy2w18.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-Bsn2wfaj.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const pool = new Pool({
@@ -1746,8 +2143,15 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 		process.exit(1);
 	}
 	await checkDatabaseConnectivity(databaseUrl);
-	const devDatabaseUrl = getDevDatabaseUrl(databaseUrl);
-	if (takesDevUrl(domain, args)) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
+	let devDatabase;
+	try {
+		devDatabase = atlasDevDatabaseUrl(databaseUrl, env);
+	} catch (err) {
+		outError(chalk.red(`✗ ${err instanceof Error ? err.message : String(err)}`));
+		process.exit(1);
+	}
+	const devDatabaseUrl = devDatabase.url;
+	if (takesDevUrl(domain, args) && !devDatabase.named) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
 	const atlasUrl = forLibpq(databaseUrl);
 	const atlasDevUrl = forLibpq(devDatabaseUrl);
 	const excludes = [];
@@ -1816,12 +2220,13 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 			latestMigrationVersion: latestMigrationVersion()
 		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
 		if (hint) outError(hint);
+		if (opts.throwOnFailure) throw Object.assign(/* @__PURE__ */ new Error(`atlas ${domain} ${args.join(" ")} failed`), { alreadyReported: true });
 		process.exit(1);
 	}
 	if (opts.captureStdout) return stdoutText.trim().length > 0 ? stdoutText : stderrText;
 	return "";
 }
-async function generatePostgresDdlCommand(rawArgs) {
+async function generatePostgresDdlCommand(rawArgs, options = {}) {
 	const argsList = (0, import_arg.default)({
 		"--collections": String,
 		"--output": String,
@@ -1831,16 +2236,31 @@ async function generatePostgresDdlCommand(rawArgs) {
 		argv: rawArgs.slice(2),
 		permissive: true
 	});
-	const ddl = resolveChildScript("generate-postgres-ddl");
-	if (!ddl.ok) {
+	const ddl = generatesInProcess() ? void 0 : resolveChildScript("generate-postgres-ddl");
+	if (ddl && !ddl.ok) {
 		outError(chalk.red(childScriptError("DDL generator", ddl.reason)));
 		process.exit(1);
 	}
 	const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-	const outputPath = argsList["--output"] || path.join("drizzle", "schema.sql");
+	const outputPath = argsList["--output"] || path.join(".rebase/sql", "schema.sql");
+	if (!argsList["--output"]) {
+		const retire = options.retireLegacyCopies !== false;
+		const retired = prepareGeneratedSqlDir(process.cwd(), { retire });
+		if (retired.length > 0 && !retire) out(chalk.gray(`  The next \`rebase db push\` or \`rebase db generate\` removes the old copies an earlier release committed:\n    ${retired.join(", ")}`));
+		else if (retired.length > 0) out(chalk.gray(`  Generated SQL is written to ${GENERATED_SQL_DIR}/ now, which is not committed. Removed the old copies — commit the deletion:\n    ${retired.join(", ")}`));
+	}
+	if (!ddl) {
+		await generateInProcess("Postgres DDL generator", "Postgres DDL", async ({ writePostgresDdl }) => {
+			await writePostgresDdl({
+				collectionsPath: path.resolve(process.cwd(), collectionsPath),
+				outputPath: path.resolve(process.cwd(), outputPath)
+			});
+		});
+		return;
+	}
 	const cmdParts = [
 		ddl.bin,
-		ddl.script,
+		...ddl.args,
 		`--collections=${collectionsPath}`,
 		`--output=${outputPath}`
 	];
@@ -1889,9 +2309,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-Cb2thZ8s.js").then((n) => n.t);
+	const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
 	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-BfzK7UQd.js").then((n) => n.n);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-B74WN37S.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];
@@ -1904,6 +2324,7 @@ async function schemaStaleCommand(rawArgs) {
 		if (postgresCollections.length > 0) differences = compareGeneratedDeclarations(generateSchema(postgresCollections), onDisk);
 	} catch (err) {
 		unreadable = err instanceof Error ? err.message : String(err);
+		const { logger } = await import("@rebasepro/server");
 		logger.debug(`schema stale: skipped (${unreadable})`);
 	}
 	const verdict = staleVerdict({
@@ -1928,7 +2349,7 @@ async function schemaStaleCommand(rawArgs) {
 		`--output=${outputPath}`
 	]);
 }
-async function schemaCommand(subcommand, rawArgs) {
+async function schemaCommand(subcommand, rawArgs, options = {}) {
 	if (subcommand && (rawArgs.includes("--help") || rawArgs.includes("-h"))) {
 		out("");
 		out(chalk.bold(`  rebase schema ${subcommand}`));
@@ -1953,24 +2374,38 @@ async function schemaCommand(subcommand, rawArgs) {
 			argv: rawArgs.slice(2),
 			permissive: true
 		});
+		const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
+		const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
+		const watch = argsList["--watch"] || false;
+		if (!watch && generatesInProcess()) {
+			out("");
+			out(chalk.bold("  🔧 Rebase Schema Generator"));
+			out("");
+			await generateInProcess("schema generator", "Drizzle schema", async ({ writeDrizzleSchema }) => {
+				await writeDrizzleSchema({
+					collectionsPath: path.resolve(process.cwd(), collectionsPath),
+					outputPath: path.resolve(process.cwd(), outputPath),
+					nextStep: options.nextStep
+				});
+			});
+			return;
+		}
 		const generator = resolveChildScript("generate-drizzle-schema");
 		if (!generator.ok) {
 			outError(chalk.red(childScriptError("schema generator", generator.reason)));
 			process.exit(1);
 		}
-		const collectionsPath = argsList["--collections"] || path.join("..", "config", "collections");
-		const outputPath = argsList["--output"] || path.join("src", "schema.generated.ts");
-		const watch = argsList["--watch"] || false;
 		out("");
 		out(chalk.bold("  🔧 Rebase Schema Generator"));
 		out("");
 		const cmdParts = [
 			generator.bin,
-			generator.script,
+			...generator.args,
 			`--collections=${collectionsPath}`,
 			`--output=${outputPath}`
 		];
 		if (watch) cmdParts.push("--watch");
+		if (options.nextStep === false) cmdParts.push("--no-next-step");
 		try {
 			await execa(cmdParts[0], cmdParts.slice(1), {
 				cwd: process.cwd(),
@@ -2007,7 +2442,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		out("");
 		const cmdParts = [
 			introspect.bin,
-			introspect.script,
+			...introspect.args,
 			`--output=${outputPath}`,
 			...argsList["--force"] ? ["--force"] : [],
 			...argsList["--schema"] ? [`--schema=${argsList["--schema"]}`] : []
@@ -2050,7 +2485,7 @@ async function doctorPluginCommand(rawArgs) {
 	const sdkPath = parsedArgs["--sdk"] || path.join("..", "generated", "sdk", "database.types.ts");
 	const cmdParts = [
 		doctor.bin,
-		doctor.script,
+		...doctor.args,
 		`--collections=${collectionsPath}`,
 		`--schema=${schemaPath}`,
 		`--sdk=${sdkPath}`,