@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.g19596ef

package/dist/schema/ensure-collection-tables.d.ts

@@ -22,8 +22,9 @@
  * See `diff-plan.ts` for the whole of that argument.
  */
 import { type CollectionConfig } from "@rebasepro/types";
-import { type ConstraintPolicy, type DiffOptions, type EnsureAction, type EnsurePlan, type ExistingSchema, type LegacyForeignKey, type OrphanedRequiredColumn, type SearchColumnDrift, type WithheldConstraint } from "./plan/diff-plan.js";
-export type { ConstraintPolicy, EnsureAction, EnsurePlan, ExistingSchema, LegacyForeignKey, OrphanedRequiredColumn, SearchColumnDrift, WithheldConstraint };
+import { type ConstraintPolicy, type DeferredIndexBuild, type DiffOptions, type EnsureAction, type EnsurePlan, type ExistingSchema, type LegacyForeignKey, type OrphanedRequiredColumn, type SearchColumnDrift, type WithheldConstraint } from "./plan/diff-plan.js";
+import { type DeferredIndexOutcome, type OpenIndexBuildSession } from "./deferred-index-build.js";
+export type { ConstraintPolicy, DeferredIndexBuild, EnsureAction, EnsurePlan, ExistingSchema, LegacyForeignKey, OrphanedRequiredColumn, SearchColumnDrift, WithheldConstraint };
 /**
  * The subset of a database handle this needs: run a statement, get rows back.
  *
@@ -51,6 +52,36 @@ export interface EnsureOptions extends DiffOptions {
      * reads the world.
      */
     databaseExtensions?: readonly string[];
+    /**
+     * Run each statement that changes an existing table under this
+     * `lock_timeout` (ms), retrying a timeout with backoff — see
+     * `schema/boot-ddl`. The boot sets it; absent, statements wait on locks for
+     * as long as the connection's `statement_timeout` allows, as the live schema
+     * editor's confirmed changes do.
+     */
+    lockTimeoutMs?: number;
+    /**
+     * Apply the statements that build tables this run creates — and the enum
+     * types they use — in transactions of up to {@link NEW_TABLE_BATCH}
+     * statements instead of one autocommit each. The boot sets it; see
+     * `ensureCollectionTables`.
+     */
+    batchNewTables?: boolean;
+    /**
+     * Leave the indexes a live table is missing (or holds INVALID) to the
+     * caller, in {@link EnsureOutcome.deferredIndexes}, instead of building
+     * them before returning. The boot sets it and builds them in the
+     * background once it serves — see `deferred-index-build`. A UNIQUE one is
+     * built before returning either way: see {@link DeferredIndexBuild.unique}.
+     */
+    deferIndexBuilds?: boolean;
+    /**
+     * The connection those builds run on when they are not deferred. Absent,
+     * they share `client` — fine for a small table, and cut short by the
+     * pool's `statement_timeout` on a large one, which is why the boot hands
+     * over a dedicated connection.
+     */
+    openIndexBuildSession?: OpenIndexBuildSession;
 }
 export interface EnsureOutcome extends EnsurePlan {
     /**
@@ -68,6 +99,14 @@ export interface EnsureOutcome extends EnsurePlan {
         target: string;
         error: string;
     }[];
+    /**
+     * What happened to the indexes built here rather than left to the caller —
+     * every one of {@link EnsurePlan.deferredIndexes}, or under
+     * `deferIndexBuilds` the UNIQUE ones only; absent when there were none.
+     * An index on a table that already exists reports here, not in
+     * {@link failures}.
+     */
+    indexBuilds?: DeferredIndexOutcome;
 }
 /**
  * Decide what to add. Pure — the caller supplies what exists and runs the
@@ -82,8 +121,22 @@ export interface EnsureOutcome extends EnsurePlan {
  * with no developer in the loop.
  */
 export declare function planCollectionSchemaEnsure(allCollections: CollectionConfig[], existing: ExistingSchema, options?: EnsureOptions): EnsurePlan;
+export interface ReadSchemaOptions {
+    /**
+     * The existing tables worth probing for rows, given every table's columns.
+     *
+     * Whether a table holds rows decides one thing: whether a NOT NULL or a
+     * UNIQUE can be added with a column *being added* to it. So the boot asks
+     * only about tables gaining a column — none at all on a boot that changes
+     * nothing — rather than probing every table in the schema, adopted and
+     * unmanaged ones included, on every boot. A table that is not probed is
+     * reported as holding rows: the answer that never plans a constraint that
+     * could fail against data. Absent, every table is probed.
+     */
+    probeTables?: (tables: ReadonlyMap<string, ReadonlySet<string>>) => Iterable<string>;
+}
 /** Read what the database has, for the schemas the collections live in. */
-export declare function readExistingSchema(client: Queryable, schemas: string[]): Promise<ExistingSchema>;
+export declare function readExistingSchema(client: Queryable, schemas: string[], options?: ReadSchemaOptions): Promise<ExistingSchema>;
 /**
  * Read what the database looks like, for the schemas a set of collections
  * lives in.

package/dist/schema/enum-labels-kept.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Enum labels the database holds and the collections no longer declare.
+ *
+ * PostgreSQL has no `ALTER TYPE … DROP VALUE`, and Atlas plans nothing for a
+ * removed label — `db push` reported success while the database kept the old
+ * label, so writes of it (by SQL, or an older client) went on succeeding, and
+ * `rebase doctor` sent the developer back to the same push. Boot behaves the
+ * same way by design: it adds labels and never removes one. So this is not a
+ * refusal — the push stays what boot would do — but the push says it, with the
+ * real way to retire a label.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import type { EnumPlan } from "./plan/types.js";
+import { type Queryable } from "./ensure-collection-tables.js";
+export interface KeptEnumLabels {
+    /** `schema.type`, as the catalogue names it. */
+    type: string;
+    /** Labels in the database that no collection declares, in the type's order. */
+    labels: string[];
+}
+/** Pure: the declared enums against the catalogue's labels, keyed `schema.type`. */
+export declare function findKeptEnumLabels(declared: Pick<EnumPlan, "qualified" | "labels">[], existing: ReadonlyMap<string, string[]>): KeptEnumLabels[];
+/** Plans the collections and reads the catalogue's enum labels. */
+export declare function keptEnumLabels(client: Queryable, collections: CollectionConfig[]): Promise<KeptEnumLabels[]>;
+/** What the push prints: which labels stay, and how one is actually retired. */
+export declare function formatKeptEnumLabelsNotice(kept: KeptEnumLabels[]): string;

package/dist/schema/generate-drizzle-schema.js

@@ -1,6 +1,6 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { t as main } from "../generate-drizzle-schema-93M0lUxK.js";
+import { t as main } from "../generate-drizzle-schema-DrA-YgXv.js";
 //#region src/schema/bin/generate-drizzle-schema.ts
 /**
 * The built entry point for `generate-drizzle-schema`.

package/dist/schema/generate-files.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The two generators `rebase db push` runs as its step 1, as functions.
+ *
+ * They used to exist only as scripts, each its own `tsx` process: the driver
+ * (itself a `tsx` process) spawned one for the Drizzle schema and then one for
+ * the DDL, and each paid a Node start, tsx's loader and an import of the whole
+ * server package before reading a single collection — about 0.5 s apiece, a
+ * second per push. The driver process is one-shot, so a fresh module graph per
+ * generation bought nothing: the collections cannot change under it.
+ *
+ * The scripts remain (`generate-drizzle-schema.ts`, `generate-postgres-ddl.ts`)
+ * for `--watch`, which re-imports the collections on every save and does need a
+ * process of its own — Node's module cache would serve it the first version
+ * forever.
+ *
+ * Both functions print their own success lines and their own error, exactly as
+ * the scripts did, and throw {@link GenerationFailed} after printing — so a
+ * caller can tell "the generator said why" from "the generator never ran".
+ */
+/** Thrown once the generator has printed why it failed. */
+export declare class GenerationFailed extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export interface GenerateFileOptions {
+    /** The collections directory (or single module), resolved against the cwd. */
+    collectionsPath: string;
+    /** Where to write. Absent: print to stdout instead. */
+    outputPath?: string;
+    /**
+     * End on the line that says what to run next. Only `rebase schema
+     * generate` itself wants it: inside `db push` it told the push to run
+     * `db generate`, and inside `db generate` to run itself.
+     */
+    nextStep?: boolean;
+}
+/** `src/schema.generated.ts`, from the collections. */
+export declare function writeDrizzleSchema(options: GenerateFileOptions): Promise<void>;
+/**
+ * `schema.sql` (Atlas's desired state) and, beside it, `policies.sql`,
+ * `search.sql`, `vector.sql` and `triggers.sql` — the parts Atlas does not own.
+ */
+export declare function writePostgresDdl(options: GenerateFileOptions): Promise<void>;

package/dist/schema/generate-next-step.d.ts

@@ -1,16 +1,3 @@
-/**
- * The line `rebase schema generate` ends on.
- *
- * Its own module because `generate-drizzle-schema.ts` uses `import.meta` to
- * decide whether it was executed directly, which the driver's jest suite cannot
- * load at all — so the one sentence in that file with a decision in it had no
- * test and could not have one where it stood.
- */
-export declare const formatTerminalText: (text: string, options?: {
-    bold?: boolean;
-    backgroundColor?: "blue" | "green" | "red" | "yellow" | "cyan" | "magenta";
-    textColor?: "white" | "black" | "red" | "green" | "yellow" | "blue" | "magenta" | "cyan";
-}) => string;
 /**
  * What to do with the file that was just generated.
  *

package/dist/schema/generate-postgres-ddl.js

@@ -1,94 +1,23 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as generatePostgresVectorDdl, i as generatePostgresTriggersDdl, n as generatePostgresPoliciesDdl, r as generatePostgresSearchDdl, t as generatePostgresDdl } from "../generate-postgres-ddl-logic-BJsLaVNX.js";
-import { n as outError, t as out } from "../cli-output-CNdMql-L.js";
-import { loadCollectionsFromDirectory } from "@rebasepro/server";
-import { declaredDatabaseExtensions } from "@rebasepro/types";
-import * as fs$1 from "fs";
-import { promises } from "fs";
+import { r as out } from "../source-DB6xJv3p.js";
+import { r as writePostgresDdl } from "../generate-files-OoRJLEdk.js";
 import path from "path";
-import { pathToFileURL } from "url";
 //#region src/schema/generate-postgres-ddl.ts
-/** Where a project declares its resources, relative to the config directory. */
-var RESOURCE_ENTRIES = [
-	"resources.ts",
-	"resources.js",
-	"resources/index.ts",
-	"resources/index.js"
-];
 /**
-* Evaluate the project's `resources.ts`, so `declaredDatabaseExtensions()` can
-* answer.
-*
-* This generator runs as its own tsx subprocess and loads only the collections
-* directory, so nothing else in it would ever import the resources module — and
-* a permission that reads as absent because nobody loaded it is the worst shape
-* this could take: the push succeeds, `vector.sql` quietly omits the
-* `CREATE EXTENSION`, and the failure lands one statement later looking like a
-* database problem.
-*
-* Imported directly rather than through the config index, for the reason
-* `boot/resource-loading.ts` gives: re-exporting from the index would work only
-* for projects that remember to.
-*
-* A project with no resources module is the normal case and declares nothing.
-* An import that *throws* is not swallowed — a resources module that does not
-* evaluate is a configuration error, and treating it as "declared nothing"
-* would turn it into a silently missing extension.
+* The generator as its own process — what `--watch` runs, because a watch has
+* to re-import the collections on every save and Node's module cache would
+* serve it the first version forever. One-shot generation runs in the driver's
+* own process instead; see `generate-files.ts`.
 */
-async function loadDeclaredResources(configDir) {
-	const entry = RESOURCE_ENTRIES.map((name) => path.join(configDir, name)).find((candidate) => fs$1.existsSync(candidate));
-	if (!entry) return;
-	await import(pathToFileURL(entry).href);
-}
 var runGeneration = async (collectionsFilePath, outputPath) => {
+	if (!collectionsFilePath) throw new Error("No collections file path provided.");
 	try {
-		if (!collectionsFilePath) throw new Error("No collections file path provided.");
-		const resolvedPath = path.resolve(collectionsFilePath);
-		await loadDeclaredResources(path.dirname(resolvedPath));
-		let collections = await loadCollectionsFromDirectory(resolvedPath);
-		if (!collections || !Array.isArray(collections)) collections = [];
-		collections.sort((a, b) => a.slug.localeCompare(b.slug));
-		const ddlContent = generatePostgresDdl(collections, {
-			includePolicies: false,
-			includeSearch: false,
-			includeVector: false
+		await writePostgresDdl({
+			collectionsPath: path.resolve(collectionsFilePath),
+			outputPath
 		});
-		const policiesContent = generatePostgresPoliciesDdl(collections);
-		const searchContent = generatePostgresSearchDdl(collections);
-		const vectorContent = generatePostgresVectorDdl(collections, { extensions: declaredDatabaseExtensions() });
-		const triggersContent = generatePostgresTriggersDdl(collections);
-		if (outputPath) {
-			const outputDir = path.dirname(outputPath);
-			await promises.mkdir(outputDir, { recursive: true });
-			await promises.writeFile(outputPath, ddlContent);
-			out(`✅ PostgreSQL DDL generated successfully at ${outputPath}`);
-			const policiesPath = path.join(outputDir, "policies.sql");
-			await promises.writeFile(policiesPath, policiesContent);
-			out(`✅ PostgreSQL Policies DDL generated successfully at ${policiesPath}`);
-			const searchPath = path.join(outputDir, "search.sql");
-			if (searchContent) {
-				await promises.writeFile(searchPath, searchContent);
-				out(`✅ PostgreSQL search DDL generated successfully at ${searchPath}`);
-			} else if (fs$1.existsSync(searchPath)) await promises.rm(searchPath);
-			const vectorPath = path.join(outputDir, "vector.sql");
-			if (vectorContent) {
-				await promises.writeFile(vectorPath, vectorContent);
-				out(`✅ PostgreSQL vector DDL generated successfully at ${vectorPath}`);
-			} else if (fs$1.existsSync(vectorPath)) await promises.rm(vectorPath);
-			const triggersPath = path.join(outputDir, "triggers.sql");
-			if (triggersContent) {
-				await promises.writeFile(triggersPath, triggersContent);
-				out(`✅ PostgreSQL trigger DDL generated successfully at ${triggersPath}`);
-			} else if (fs$1.existsSync(triggersPath)) await promises.rm(triggersPath);
-		} else {
-			out("✅ PostgreSQL DDL generated successfully.");
-			out(String(ddlContent));
-			out("\n✅ PostgreSQL Policies DDL generated successfully.");
-			out(String(policiesContent));
-		}
 	} catch (error) {
-		outError(`Error generating DDL schema: ${error instanceof Error ? error.stack ?? error.message : String(error)}`);
 		process.exitCode = 1;
 		throw error;
 	}

package/dist/schema/generate-postgres-ddl.js.map

@@ -1 +1 @@
-{"version":3,"file":"generate-postgres-ddl.js","names":[],"sources":["../../src/schema/generate-postgres-ddl.ts","../../src/schema/bin/generate-postgres-ddl.ts"],"sourcesContent":["import { promises as fsPromises } from \"fs\";\nimport * as fs from \"fs\";\nimport path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport {\n    generatePostgresDdl,\n    generatePostgresPoliciesDdl,\n    generatePostgresSearchDdl,\n    generatePostgresTriggersDdl,\n    generatePostgresVectorDdl\n} from \"./generate-postgres-ddl-logic\";\nimport { CollectionConfig, declaredDatabaseExtensions } from \"@rebasepro/types\";\nimport { loadCollectionsFromDirectory } from \"@rebasepro/server\";\nimport { out, outError } from \"../cli-output\";\n\n/** Where a project declares its resources, relative to the config directory. */\nconst RESOURCE_ENTRIES = [\"resources.ts\", \"resources.js\", \"resources/index.ts\", \"resources/index.js\"];\n\n/**\n * Evaluate the project's `resources.ts`, so `declaredDatabaseExtensions()` can\n * answer.\n *\n * This generator runs as its own tsx subprocess and loads only the collections\n * directory, so nothing else in it would ever import the resources module — and\n * a permission that reads as absent because nobody loaded it is the worst shape\n * this could take: the push succeeds, `vector.sql` quietly omits the\n * `CREATE EXTENSION`, and the failure lands one statement later looking like a\n * database problem.\n *\n * Imported directly rather than through the config index, for the reason\n * `boot/resource-loading.ts` gives: re-exporting from the index would work only\n * for projects that remember to.\n *\n * A project with no resources module is the normal case and declares nothing.\n * An import that *throws* is not swallowed — a resources module that does not\n * evaluate is a configuration error, and treating it as \"declared nothing\"\n * would turn it into a silently missing extension.\n */\nasync function loadDeclaredResources(configDir: string): Promise<void> {\n    const entry = RESOURCE_ENTRIES\n        .map(name => path.join(configDir, name))\n        .find(candidate => fs.existsSync(candidate));\n    if (!entry) return;\n    await import(pathToFileURL(entry).href);\n}\n\nconst runGeneration = async (collectionsFilePath?: string, outputPath?: string) => {\n    try {\n        if (!collectionsFilePath) {\n            throw new Error(\"No collections file path provided.\");\n        }\n\n        const resolvedPath = path.resolve(collectionsFilePath);\n\n        // `<config>/collections` is the path this is given, so the config\n        // directory is its parent — the same relationship `rebase resources`\n        // and the boot loader assume.\n        await loadDeclaredResources(path.dirname(resolvedPath));\n\n        // Shared with the runtime and the doctor: what gets generated here must\n        // be exactly what the server serves, including directory-level defaults.\n        let collections: CollectionConfig[] = await loadCollectionsFromDirectory(resolvedPath);\n\n\n        if (!collections || !Array.isArray(collections)) {\n            collections = [];\n        }\n\n        // Sort collections by slug alphabetically to ensure deterministic DDL generation\n        collections.sort((a, b) => a.slug.localeCompare(b.slug));\n\n        // `schema.sql` is Atlas's desired state, and it carries neither the RLS\n        // policies, nor the search apparatus, nor the vector columns: Atlas\n        // manages none of them, and in the search and vector cases cannot. All\n        // three are written beside it and applied by the CLI in their own right.\n        const ddlContent = generatePostgresDdl(collections, {\n            includePolicies: false,\n            includeSearch: false,\n            includeVector: false\n        });\n        const policiesContent = generatePostgresPoliciesDdl(collections);\n        const searchContent = generatePostgresSearchDdl(collections);\n        const vectorContent = generatePostgresVectorDdl(collections, {\n            extensions: declaredDatabaseExtensions()\n        });\n        const triggersContent = generatePostgresTriggersDdl(collections);\n\n        if (outputPath) {\n            const outputDir = path.dirname(outputPath);\n            await fsPromises.mkdir(outputDir, { recursive: true });\n            await fsPromises.writeFile(outputPath, ddlContent);\n            out(`✅ PostgreSQL DDL generated successfully at ${outputPath}`);\n\n            const policiesPath = path.join(outputDir, \"policies.sql\");\n            await fsPromises.writeFile(policiesPath, policiesContent);\n            out(`✅ PostgreSQL Policies DDL generated successfully at ${policiesPath}`);\n\n            // Removed when the last `search` block goes: the CLI applies this\n            // file whenever it exists, and a stale one would keep re-creating\n            // functions for collections that no longer want them.\n            const searchPath = path.join(outputDir, \"search.sql\");\n            if (searchContent) {\n                await fsPromises.writeFile(searchPath, searchContent);\n                out(`✅ PostgreSQL search DDL generated successfully at ${searchPath}`);\n            } else if (fs.existsSync(searchPath)) {\n                await fsPromises.rm(searchPath);\n            }\n\n            // Removed when the last `vector` property goes, for the same reason\n            // `search.sql` is: the CLI applies whichever of these files exists,\n            // and a stale one would keep re-adding a column the collections no\n            // longer declare — which Atlas, no longer told to exclude it, would\n            // then plan a DROP for on the very next push.\n            const vectorPath = path.join(outputDir, \"vector.sql\");\n            if (vectorContent) {\n                await fsPromises.writeFile(vectorPath, vectorContent);\n                out(`✅ PostgreSQL vector DDL generated successfully at ${vectorPath}`);\n            } else if (fs.existsSync(vectorPath)) {\n                await fsPromises.rm(vectorPath);\n            }\n\n            // `autoValue: \"on_update\"`, on the same terms as the two above: a\n            // trigger is a function plus a binding, which Atlas's free tier\n            // will not parse, and a stale file would keep re-installing a\n            // trigger for a column nothing declares any more.\n            const triggersPath = path.join(outputDir, \"triggers.sql\");\n            if (triggersContent) {\n                await fsPromises.writeFile(triggersPath, triggersContent);\n                out(`✅ PostgreSQL trigger DDL generated successfully at ${triggersPath}`);\n            } else if (fs.existsSync(triggersPath)) {\n                await fsPromises.rm(triggersPath);\n            }\n        } else {\n            out(\"✅ PostgreSQL DDL generated successfully.\");\n            out(String(ddlContent));\n            out(\"\\n✅ PostgreSQL Policies DDL generated successfully.\");\n            out(String(policiesContent));\n        }\n\n    } catch (error) {\n        outError(`Error generating DDL schema: ${error instanceof Error ? (error.stack ?? error.message) : String(error)}`);\n        // Step 1 of `rebase db push` is this process, and its exit code is the\n        // only thing the push reads. Printing and exiting 0 made a resources\n        // module that does not evaluate — the single most common cause here —\n        // report `✓ rebase db push completed successfully` while Atlas applied\n        // whatever `drizzle/schema.sql` happened to be on disk, sometimes\n        // minutes old. With no prior file the same run died inside Atlas on\n        // `stat drizzle/schema.sql: no such file or directory`, which hides the\n        // real cause two screens up.\n        process.exitCode = 1;\n        throw error;\n    }\n};\n\nexport const main = async () => {\n    const collectionsFilePathArg = process.argv.find(arg => arg.startsWith(\"--collections=\"));\n    const collectionsFilePath = collectionsFilePathArg ? collectionsFilePathArg.split(\"=\")[1] : process.argv[2];\n\n    const outputPathArg = process.argv.find(arg => arg.startsWith(\"--output=\"));\n    const outputPath = outputPathArg ? outputPathArg.split(\"=\")[1] : undefined;\n\n    const watch = process.argv.includes(\"--watch\");\n\n    if (!collectionsFilePath) {\n        out(\"Usage: ts-node generate-postgres-ddl.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]\");\n        return;\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsFilePath);\n    const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : undefined;\n\n    if (watch) {\n        out(`Watching for changes in ${resolvedPath}...`);\n        // Imported here rather than at module scope, and this is not a style\n        // choice: chokidar is needed only by `--watch`, which is a\n        // schema-authoring path that never runs inside the runtime image. A\n        // top-level import puts it on the boot path of the published driver\n        // bundle, and the image installs a hand-listed set of runtime\n        // dependencies that does not include it — so the whole driver failed to\n        // load with \"Cannot find package 'chokidar'\", and every self-hosted\n        // container answered 500 with a stack trace about a file watcher.\n        //\n        // Same reasoning the image already applies to @ariga/atlas: an\n        // authoring-only dependency does not belong on a boot path.\n        const { default: chokidar } = await import(\"chokidar\");\n        const watcher = chokidar.watch(resolvedPath, {\n            persistent: true,\n            ignoreInitial: false\n        });\n\n        watcher.on(\"all\", (event, filePath) => {\n            out(`[${event}] ${filePath}. Regenerating DDL schema...`);\n            // A watch session outlives a bad edit: the cause is already on\n            // stderr, and the next save is the retry. Only the one-shot run\n            // below turns a failure into an exit code.\n            void runGeneration(resolvedPath, resolvedOutputPath).catch(() => undefined);\n        });\n    } else {\n        await runGeneration(resolvedPath, resolvedOutputPath);\n    }\n};\n\n// This check ensures the script only runs when executed directly\nif (import.meta.url.endsWith(process.argv[1])) {\n    // `runGeneration` has already printed the cause and set the exit code; the\n    // handler is here so the last thing on the terminal is that message rather\n    // than Node's unhandled-rejection dump of the same stack.\n    main().catch(() => {\n        process.exitCode = 1;\n    });\n}\n","/**\n * The built entry point for `generate-postgres-ddl`.\n *\n * `generate-postgres-ddl.ts` guards its own `main()` with\n * `import.meta.url.endsWith(process.argv[1])`, because `src/index.ts` re-exports\n * the module and importing the driver must not run the generator. That guard is\n * correct when the file IS the process entry — which is how it runs from source\n * under tsx — and silently false once the module is bundled: the executed file\n * is a stub, the code lives in a shared chunk, and the chunk's `import.meta.url`\n * is not the stub's path. The generator then did nothing, exited 0, and the\n * caller reported success over an unwritten schema.\n *\n * So the built path gets an entry that says what it means.\n */\nimport { main } from \"../generate-postgres-ddl\";\n\nmain().catch(() => {\n    process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;AAgBA,IAAM,mBAAmB;CAAC;CAAgB;CAAgB;CAAsB;AAAoB;;;;;;;;;;;;;;;;;;;;;AAsBpG,eAAe,sBAAsB,WAAkC;CACnE,MAAM,QAAQ,iBACT,KAAI,SAAQ,KAAK,KAAK,WAAW,IAAI,CAAC,CAAC,CACvC,MAAK,cAAa,KAAG,WAAW,SAAS,CAAC;CAC/C,IAAI,CAAC,OAAO;CACZ,MAAM,OAAO,cAAc,KAAK,CAAC,CAAC;AACtC;AAEA,IAAM,gBAAgB,OAAO,qBAA8B,eAAwB;CAC/E,IAAI;EACA,IAAI,CAAC,qBACD,MAAM,IAAI,MAAM,oCAAoC;EAGxD,MAAM,eAAe,KAAK,QAAQ,mBAAmB;EAKrD,MAAM,sBAAsB,KAAK,QAAQ,YAAY,CAAC;EAItD,IAAI,cAAkC,MAAM,6BAA6B,YAAY;EAGrF,IAAI,CAAC,eAAe,CAAC,MAAM,QAAQ,WAAW,GAC1C,cAAc,CAAC;EAInB,YAAY,MAAM,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC;EAMvD,MAAM,aAAa,oBAAoB,aAAa;GAChD,iBAAiB;GACjB,eAAe;GACf,eAAe;EACnB,CAAC;EACD,MAAM,kBAAkB,4BAA4B,WAAW;EAC/D,MAAM,gBAAgB,0BAA0B,WAAW;EAC3D,MAAM,gBAAgB,0BAA0B,aAAa,EACzD,YAAY,2BAA2B,EAC3C,CAAC;EACD,MAAM,kBAAkB,4BAA4B,WAAW;EAE/D,IAAI,YAAY;GACZ,MAAM,YAAY,KAAK,QAAQ,UAAU;GACzC,MAAM,SAAW,MAAM,WAAW,EAAE,WAAW,KAAK,CAAC;GACrD,MAAM,SAAW,UAAU,YAAY,UAAU;GACjD,IAAI,8CAA8C,YAAY;GAE9D,MAAM,eAAe,KAAK,KAAK,WAAW,cAAc;GACxD,MAAM,SAAW,UAAU,cAAc,eAAe;GACxD,IAAI,uDAAuD,cAAc;GAKzE,MAAM,aAAa,KAAK,KAAK,WAAW,YAAY;GACpD,IAAI,eAAe;IACf,MAAM,SAAW,UAAU,YAAY,aAAa;IACpD,IAAI,qDAAqD,YAAY;GACzE,OAAO,IAAI,KAAG,WAAW,UAAU,GAC/B,MAAM,SAAW,GAAG,UAAU;GAQlC,MAAM,aAAa,KAAK,KAAK,WAAW,YAAY;GACpD,IAAI,eAAe;IACf,MAAM,SAAW,UAAU,YAAY,aAAa;IACpD,IAAI,qDAAqD,YAAY;GACzE,OAAO,IAAI,KAAG,WAAW,UAAU,GAC/B,MAAM,SAAW,GAAG,UAAU;GAOlC,MAAM,eAAe,KAAK,KAAK,WAAW,cAAc;GACxD,IAAI,iBAAiB;IACjB,MAAM,SAAW,UAAU,cAAc,eAAe;IACxD,IAAI,sDAAsD,cAAc;GAC5E,OAAO,IAAI,KAAG,WAAW,YAAY,GACjC,MAAM,SAAW,GAAG,YAAY;EAExC,OAAO;GACH,IAAI,0CAA0C;GAC9C,IAAI,OAAO,UAAU,CAAC;GACtB,IAAI,qDAAqD;GACzD,IAAI,OAAO,eAAe,CAAC;EAC/B;CAEJ,SAAS,OAAO;EACZ,SAAS,gCAAgC,iBAAiB,QAAS,MAAM,SAAS,MAAM,UAAW,OAAO,KAAK,GAAG;EASlH,QAAQ,WAAW;EACnB,MAAM;CACV;AACJ;AAEA,IAAa,OAAO,YAAY;CAC5B,MAAM,yBAAyB,QAAQ,KAAK,MAAK,QAAO,IAAI,WAAW,gBAAgB,CAAC;CACxF,MAAM,sBAAsB,yBAAyB,uBAAuB,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,KAAK;CAEzG,MAAM,gBAAgB,QAAQ,KAAK,MAAK,QAAO,IAAI,WAAW,WAAW,CAAC;CAC1E,MAAM,aAAa,gBAAgB,cAAc,MAAM,GAAG,CAAC,CAAC,KAAK,KAAA;CAEjE,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;CAE7C,IAAI,CAAC,qBAAqB;EACtB,IAAI,+GAA+G;EACnH;CACJ;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;CACpE,MAAM,qBAAqB,aAAa,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU,IAAI,KAAA;CAElF,IAAI,OAAO;EACP,IAAI,2BAA2B,aAAa,IAAI;EAYhD,MAAM,EAAE,SAAS,aAAa,MAAM,OAAO;EAM3C,SALyB,MAAM,cAAc;GACzC,YAAY;GACZ,eAAe;EACnB,CAEA,CAAA,CAAQ,GAAG,QAAQ,OAAO,aAAa;GACnC,IAAI,IAAI,MAAM,IAAI,SAAS,6BAA6B;GAIxD,cAAmB,cAAc,kBAAkB,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9E,CAAC;CACL,OACI,MAAM,cAAc,cAAc,kBAAkB;AAE5D;AAGA,IAAI,OAAO,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE,GAIxC,KAAK,CAAC,CAAC,YAAY;CACf,QAAQ,WAAW;AACvB,CAAC;;;;;;;;;;;;;;;;;ACjML,KAAK,CAAC,CAAC,YAAY;CACf,QAAQ,WAAW;AACvB,CAAC"}
+{"version":3,"file":"generate-postgres-ddl.js","names":[],"sources":["../../src/schema/generate-postgres-ddl.ts","../../src/schema/bin/generate-postgres-ddl.ts"],"sourcesContent":["import path from \"path\";\nimport { out } from \"../cli-output\";\nimport { writePostgresDdl } from \"./generate-files\";\n\n/**\n * The generator as its own process — what `--watch` runs, because a watch has\n * to re-import the collections on every save and Node's module cache would\n * serve it the first version forever. One-shot generation runs in the driver's\n * own process instead; see `generate-files.ts`.\n */\nconst runGeneration = async (collectionsFilePath?: string, outputPath?: string) => {\n    if (!collectionsFilePath) {\n        throw new Error(\"No collections file path provided.\");\n    }\n    try {\n        await writePostgresDdl({ collectionsPath: path.resolve(collectionsFilePath), outputPath });\n    } catch (error) {\n        // A caller that reads nothing but this process's exit code must not\n        // see 0 after an error was printed — see `writePostgresDdl`.\n        process.exitCode = 1;\n        throw error;\n    }\n};\n\nexport const main = async () => {\n    const collectionsFilePathArg = process.argv.find(arg => arg.startsWith(\"--collections=\"));\n    const collectionsFilePath = collectionsFilePathArg ? collectionsFilePathArg.split(\"=\")[1] : process.argv[2];\n\n    const outputPathArg = process.argv.find(arg => arg.startsWith(\"--output=\"));\n    const outputPath = outputPathArg ? outputPathArg.split(\"=\")[1] : undefined;\n\n    const watch = process.argv.includes(\"--watch\");\n\n    if (!collectionsFilePath) {\n        out(\"Usage: ts-node generate-postgres-ddl.ts <path-to-collections-file> [--output <path-to-output-file>] [--watch]\");\n        return;\n    }\n\n    const resolvedPath = path.resolve(process.cwd(), collectionsFilePath);\n    const resolvedOutputPath = outputPath ? path.resolve(process.cwd(), outputPath) : undefined;\n\n    if (watch) {\n        out(`Watching for changes in ${resolvedPath}...`);\n        // Imported here rather than at module scope, and this is not a style\n        // choice: chokidar is needed only by `--watch`, which is a\n        // schema-authoring path that never runs inside the runtime image. A\n        // top-level import puts it on the boot path of the published driver\n        // bundle, and the image installs a hand-listed set of runtime\n        // dependencies that does not include it — so the whole driver failed to\n        // load with \"Cannot find package 'chokidar'\", and every self-hosted\n        // container answered 500 with a stack trace about a file watcher.\n        //\n        // Same reasoning the image already applies to @ariga/atlas: an\n        // authoring-only dependency does not belong on a boot path.\n        const { default: chokidar } = await import(\"chokidar\");\n        const watcher = chokidar.watch(resolvedPath, {\n            persistent: true,\n            ignoreInitial: false\n        });\n\n        watcher.on(\"all\", (event, filePath) => {\n            out(`[${event}] ${filePath}. Regenerating DDL schema...`);\n            // A watch session outlives a bad edit: the cause is already on\n            // stderr, and the next save is the retry. Only the one-shot run\n            // below turns a failure into an exit code.\n            void runGeneration(resolvedPath, resolvedOutputPath).catch(() => undefined);\n        });\n    } else {\n        await runGeneration(resolvedPath, resolvedOutputPath);\n    }\n};\n\n// This check ensures the script only runs when executed directly\nif (import.meta.url.endsWith(process.argv[1])) {\n    // `runGeneration` has already printed the cause and set the exit code; the\n    // handler is here so the last thing on the terminal is that message rather\n    // than Node's unhandled-rejection dump of the same stack.\n    main().catch(() => {\n        process.exitCode = 1;\n    });\n}\n","/**\n * The built entry point for `generate-postgres-ddl`.\n *\n * `generate-postgres-ddl.ts` guards its own `main()` with\n * `import.meta.url.endsWith(process.argv[1])`, because `src/index.ts` re-exports\n * the module and importing the driver must not run the generator. That guard is\n * correct when the file IS the process entry — which is how it runs from source\n * under tsx — and silently false once the module is bundled: the executed file\n * is a stub, the code lives in a shared chunk, and the chunk's `import.meta.url`\n * is not the stub's path. The generator then did nothing, exited 0, and the\n * caller reported success over an unwritten schema.\n *\n * So the built path gets an entry that says what it means.\n */\nimport { main } from \"../generate-postgres-ddl\";\n\nmain().catch(() => {\n    process.exitCode = 1;\n});\n"],"mappings":";;;;;;;;;;;;AAUA,IAAM,gBAAgB,OAAO,qBAA8B,eAAwB;CAC/E,IAAI,CAAC,qBACD,MAAM,IAAI,MAAM,oCAAoC;CAExD,IAAI;EACA,MAAM,iBAAiB;GAAE,iBAAiB,KAAK,QAAQ,mBAAmB;GAAG;EAAW,CAAC;CAC7F,SAAS,OAAO;EAGZ,QAAQ,WAAW;EACnB,MAAM;CACV;AACJ;AAEA,IAAa,OAAO,YAAY;CAC5B,MAAM,yBAAyB,QAAQ,KAAK,MAAK,QAAO,IAAI,WAAW,gBAAgB,CAAC;CACxF,MAAM,sBAAsB,yBAAyB,uBAAuB,MAAM,GAAG,CAAC,CAAC,KAAK,QAAQ,KAAK;CAEzG,MAAM,gBAAgB,QAAQ,KAAK,MAAK,QAAO,IAAI,WAAW,WAAW,CAAC;CAC1E,MAAM,aAAa,gBAAgB,cAAc,MAAM,GAAG,CAAC,CAAC,KAAK,KAAA;CAEjE,MAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;CAE7C,IAAI,CAAC,qBAAqB;EACtB,IAAI,+GAA+G;EACnH;CACJ;CAEA,MAAM,eAAe,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;CACpE,MAAM,qBAAqB,aAAa,KAAK,QAAQ,QAAQ,IAAI,GAAG,UAAU,IAAI,KAAA;CAElF,IAAI,OAAO;EACP,IAAI,2BAA2B,aAAa,IAAI;EAYhD,MAAM,EAAE,SAAS,aAAa,MAAM,OAAO;EAM3C,SALyB,MAAM,cAAc;GACzC,YAAY;GACZ,eAAe;EACnB,CAEA,CAAA,CAAQ,GAAG,QAAQ,OAAO,aAAa;GACnC,IAAI,IAAI,MAAM,IAAI,SAAS,6BAA6B;GAIxD,cAAmB,cAAc,kBAAkB,CAAC,CAAC,YAAY,KAAA,CAAS;EAC9E,CAAC;CACL,OACI,MAAM,cAAc,cAAc,kBAAkB;AAE5D;AAGA,IAAI,OAAO,KAAK,IAAI,SAAS,QAAQ,KAAK,EAAE,GAIxC,KAAK,CAAC,CAAC,YAAY;CACf,QAAQ,WAAW;AACvB,CAAC;;;;;;;;;;;;;;;;;AC/DL,KAAK,CAAC,CAAC,YAAY;CACf,QAAQ,WAAW;AACvB,CAAC"}

package/dist/schema/generated-schema-diff.d.ts

@@ -52,5 +52,12 @@ export declare function describeSchemaDifference(difference: SchemaDifference):
  * Per difference rather than one summary block on purpose: these are read out of
  * a log aggregator as often as a terminal, and a single multi-line message
  * cannot be filtered down to the one collection somebody is looking at.
+ *
+ * The fix it names is `rebase db push`. `rebase dev` rewrites
+ * schema.generated.ts from the collections on every change, and boot applies
+ * only additive changes, so what is still different at boot is the database
+ * behind the file: a rename, a dropped column, a narrowed type, a NOT NULL.
+ * `rebase schema generate` rewrites the file and leaves the database as it is,
+ * so it is named only for collections that changed since the file was written.
  */
 export declare function warnOnGeneratedSchemaDrift(differences: SchemaDifference[]): void;

package/dist/schema/introspect-db-logic.d.ts

@@ -56,6 +56,11 @@ export interface UniqueConstraintRow {
     constraint_name: string;
     column_names: string[];
 }
+/** One index, by name. */
+export interface IndexRow {
+    table_name: string;
+    index_name: string;
+}
 /** A CHECK constraint, as `pg_get_constraintdef` renders it. */
 export interface CheckConstraintRow {
     table_name: string;
@@ -68,6 +73,21 @@ export interface CommentRow {
     column_name: string | null;
     comment: string;
 }
+/** A row-level security policy, as `pg_policies` reports it. */
+export interface PolicyRow {
+    table_name: string;
+    policy_name: string;
+    /** `PERMISSIVE` or `RESTRICTIVE`. */
+    permissive: string;
+    /** The `TO` list: database roles, `public` for every role. */
+    roles: string[];
+    /** `SELECT`, `INSERT`, `UPDATE`, `DELETE` or `ALL`. */
+    cmd: string;
+    /** The `USING` expression, as Postgres renders it back. */
+    qual: string | null;
+    /** The `WITH CHECK` expression, as Postgres renders it back. */
+    with_check: string | null;
+}
 /**
  * Everything one introspection run reads from the database.
  *
@@ -83,8 +103,20 @@ export interface SchemaMetadata {
     pks: PrimaryKeyRow[];
     fks: ForeignKeyRow[];
     uniques: UniqueConstraintRow[];
+    /**
+     * Every index on the introspected tables, by name — how a foreign key
+     * whose column Rebase would index is told apart from one it already has.
+     * Absent when the caller did not read them, and then nothing is said
+     * about foreign-key indexes either way.
+     */
+    indexes?: IndexRow[];
     checks: CheckConstraintRow[];
     comments: CommentRow[];
+    /**
+     * The row-level security policies on the introspected tables. Absent when
+     * the caller did not read them, and then no collection is given rules.
+     */
+    policies?: PolicyRow[];
     /**
      * Row counts for the tables that needed one, capped — see `countRowsUpTo`.
      * Absent for every table introspection never had a reason to count.

package/dist/schema/introspect-db-queries.d.ts

@@ -116,6 +116,12 @@ export declare const FOREIGN_KEYS_QUERY = "\n    WITH fk AS (\n        SELECT co
  * `validation: { unique: true }` field makes.
  */
 export declare const UNIQUE_CONSTRAINTS_QUERY = "\n    SELECT t.relname AS table_name,\n           ic.relname AS constraint_name,\n           -- ::text, because the driver has no parser for an array of `name`\n           -- and hands back the raw `{a,b}` literal as a string. Every consumer\n           -- here indexes and compares it as an array, and a string of that\n           -- shape fails those silently rather than loudly.\n           array_agg(a.attname::text ORDER BY k.ord) AS column_names\n    FROM pg_index i\n    JOIN pg_class t ON t.oid = i.indrelid\n    JOIN pg_class ic ON ic.oid = i.indexrelid\n    JOIN pg_namespace n ON n.oid = t.relnamespace\n    CROSS JOIN LATERAL unnest(i.indkey) WITH ORDINALITY AS k(attnum, ord)\n    JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = k.attnum\n    WHERE i.indisunique\n      AND NOT i.indisprimary\n      AND i.indpred IS NULL\n      AND n.nspname = $1\n      AND NOT t.relispartition\n    GROUP BY t.relname, ic.relname\n    ORDER BY t.relname, ic.relname\n";
+/**
+ * Every index on the schema's tables, by name. Only the name is needed: it is
+ * what tells a foreign key Rebase already indexed apart from one it would
+ * index on the first push — see `foreignKeyIndexSpec`.
+ */
+export declare const INDEXES_QUERY = "\n    SELECT t.relname AS table_name, ic.relname AS index_name\n    FROM pg_index i\n    JOIN pg_class t ON t.oid = i.indrelid\n    JOIN pg_class ic ON ic.oid = i.indexrelid\n    JOIN pg_namespace n ON n.oid = t.relnamespace\n    WHERE n.nspname = $1\n      AND NOT t.relispartition\n    ORDER BY t.relname, ic.relname\n";
 /**
  * CHECK constraints, as the source text Postgres reproduces them from.
  *
@@ -127,8 +133,21 @@ export declare const CHECK_CONSTRAINTS_QUERY = "\n    SELECT DISTINCT\n
 /**
  * `COMMENT ON TABLE` / `COMMENT ON COLUMN`, which is documentation the author
  * already wrote and which nothing downstream has ever read.
+ *
+ * Only comments on relations: `pg_description` also holds the stamps boot
+ * writes on each policy (`rebase:<hash>`), and an OID is unique only within
+ * its own catalogue, so a policy's could name a table.
+ */
+export declare const COMMENTS_QUERY = "\n    SELECT t.relname AS table_name,\n           a.attname AS column_name,\n           d.description AS comment\n    FROM pg_description d\n    JOIN pg_class t ON t.oid = d.objoid\n    JOIN pg_namespace n ON n.oid = t.relnamespace\n    LEFT JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = d.objsubid\n    WHERE n.nspname = $1\n      AND d.classoid = 'pg_catalog.pg_class'::regclass\n      AND t.relkind IN ('r', 'p')\n      AND (d.objsubid = 0 OR a.attname IS NOT NULL)\n    ORDER BY t.relname, d.objsubid\n";
+/**
+ * Every row-level security policy in the schema, as `pg_policies` reports it.
+ *
+ * A table's policies are its access model. Introspection that leaves them out
+ * generates collections describing no rules, and the database's own policies
+ * then read as orphans: `doctor` fails on them, and a `db push` drops any
+ * whose name has the shape an unnamed rule compiles to.
  */
-export declare const COMMENTS_QUERY = "\n    SELECT t.relname AS table_name,\n           a.attname AS column_name,\n           d.description AS comment\n    FROM pg_description d\n    JOIN pg_class t ON t.oid = d.objoid\n    JOIN pg_namespace n ON n.oid = t.relnamespace\n    LEFT JOIN pg_attribute a ON a.attrelid = t.oid AND a.attnum = d.objsubid\n    WHERE n.nspname = $1\n      AND t.relkind IN ('r', 'p')\n      AND (d.objsubid = 0 OR a.attname IS NOT NULL)\n    ORDER BY t.relname, d.objsubid\n";
+export declare const POLICIES_QUERY = "\n    SELECT tablename AS table_name,\n           policyname AS policy_name,\n           permissive,\n           roles,\n           cmd,\n           qual,\n           with_check\n    FROM pg_policies\n    WHERE schemaname = $1\n    ORDER BY tablename, policyname\n";
 /**
  * Counts a table's rows, stopping once the answer can only be "more than
  * `limit`".

package/dist/schema/introspect-db-structure.d.ts

@@ -240,6 +240,16 @@ export declare function deriveTitleProperty(facts: Map<string, ColumnFacts>): st
  * is stable across runs.
  */
 export declare function deriveKanbanProperty(facts: Map<string, ColumnFacts>): string | undefined;
+/**
+ * The string column that can hold a board's card order, or nothing.
+ *
+ * A board without `orderProperty` cannot keep a card's position within a
+ * column, and the config validator says so on every generate — so a board is
+ * emitted only when the table already has somewhere to store the order. A
+ * legacy table almost never does; asking its owner to add a hidden column
+ * just to satisfy generated output was the wrong way round.
+ */
+export declare function deriveKanbanOrderProperty(facts: Map<string, ColumnFacts>): string | undefined;
 /**
  * The column a list should be sorted by, newest first.
  *

package/dist/schema/introspect-db.js

@@ -1,17 +1,16 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM, t as require___vite_browser_external } from "../__vite-browser-external-BnuHet1e.js";
-import { i as readSchemaMetadata, n as isUsableFileName, r as quoteRelation, t as countRowsUpTo } from "../introspect-db-queries-C_Q5VgQw.js";
-import { n as outError, r as outWarn, t as out } from "../cli-output-CNdMql-L.js";
-import { t as chalk } from "../source-Br7L7GOI.js";
-import { a as compositeKeySkipReason, d as safeHostFromUrl, i as buildTablesMap, m as lookupCandidates, o as generateCollectionFile, p as classifyTables, r as buildEnumMap, s as generateIndexContent, u as mergeIndexContent } from "../introspect-db-logic-kCETE8TY.js";
-import { t as require_arg } from "../arg-Dni7MzLB.js";
+import { i as __toESM } from "../rolldown-runtime-V7rFbMRe.js";
+import { i as diagnoseDbError } from "../cli-errors-oVUuD8k0.js";
+import { a as outWarn, i as outError, r as out, t as chalk } from "../source-DB6xJv3p.js";
+import { i as readSchemaMetadata, n as isUsableFileName, r as quoteRelation, t as countRowsUpTo } from "../introspect-db-queries-BhhJg0b8.js";
+import { a as compositeKeySkipReason, d as safeHostFromUrl, i as buildTablesMap, m as lookupCandidates, o as generateCollectionFile, p as classifyTables, r as buildEnumMap, s as generateIndexContent, u as mergeIndexContent } from "../introspect-db-logic-BCc1Jym2.js";
+import { n as require_arg, t as promptConfirm } from "../cli-prompt-egtNKkZl.js";
 import pg from "pg";
-import fs from "fs";
 import path from "path";
+import fs from "fs";
 import * as dotenv from "dotenv";
 //#region src/schema/introspect-db-project.ts
-var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
 * What the project being introspected into can actually import.
@@ -417,10 +416,9 @@ async function main() {
 	}, { permissive: true });
 	const cwd = process.cwd();
 	const defaultOutDir = path.basename(cwd) === "backend" ? path.resolve(cwd, "..", "config", "collections") : path.resolve(cwd, "config", "collections");
-	const outDir = args["--output"] || args["--collections"] || defaultOutDir;
+	const outDir = path.resolve(args["--output"] || args["--collections"] || defaultOutDir);
 	const force = args["--force"] || false;
 	const pgSchema = args["--schema"] || "public";
-	if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
 	const envPaths = [
 		process.env.DOTENV_CONFIG_PATH,
 		path.resolve(process.cwd(), ".env"),
@@ -443,10 +441,15 @@ async function main() {
 	try {
 		await client.connect();
 	} catch (err) {
-		outError(chalk.red(`✗ Failed to connect to database: ${err instanceof Error ? err.message : String(err)}`));
-		outError(chalk.gray("  Check your DATABASE_URL and ensure the database is reachable."));
+		const banner = diagnoseDbError(err, databaseUrl);
+		if (banner) outError(banner);
+		else {
+			outError(chalk.red(`✗ Failed to connect to database: ${err instanceof Error ? err.message : String(err)}`));
+			outError(chalk.gray("  Check your DATABASE_URL and ensure the database is reachable."));
+		}
 		process.exit(1);
 	}
+	if (!fs.existsSync(outDir)) fs.mkdirSync(outDir, { recursive: true });
 	const hostPart = safeHostFromUrl(databaseUrl);
 	out(chalk.gray(`Connected to database: ${hostPart}`));
 	out(chalk.gray(`Introspecting schema '${pgSchema}'...`));
@@ -475,14 +478,7 @@ async function main() {
 		if (args["--no-data-inference"]) runDataInference = false;
 		else if (args["--data-inference"] !== void 0) runDataInference = args["--data-inference"];
 		else if (!process.stdin.isTTY) out(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
-		else {
-			const rl = import___vite_browser_external.default.createInterface({
-				input: process.stdin,
-				output: process.stdout
-			});
-			runDataInference = (await new Promise((resolve) => rl.question(chalk.yellow("? Do you want to run comprehensive data inference on sampled rows to auto-detect types, formats, constraints, and UI configurations? (y/N) "), resolve))).trim().toLowerCase() === "y";
-			rl.close();
-		}
+		else runDataInference = await promptConfirm(chalk.yellow("? Do you want to run comprehensive data inference on sampled rows to auto-detect types, formats, constraints, and UI configurations? (y/N) "));
 		if (runDataInference) out(chalk.gray("Sampling database rows for data inference..."));
 		const generatedFiles = [];
 		const skippedFiles = [];