@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.g19596ef

package/dist/{cli-flags-BglvpjHv.js → cli-flags-DnPHXjRH.js}

@@ -1,7 +1,8 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
+import { n as require_arg } from "./cli-prompt-egtNKkZl.js";
+import { suggestNearMiss } from "@rebasepro/utils";
 //#region src/cli-flags.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
@@ -54,7 +55,10 @@ var DRIVER_FLAG_SPECS = {
 		"--collections": String,
 		"-c": "--collections"
 	},
-	"db migrate": { "--baseline": String },
+	"db migrate": {
+		"--baseline": String,
+		"--refuse-destructive": Boolean
+	},
 	"schema generate": {
 		"--collections": String,
 		"-c": "--collections",
@@ -128,11 +132,57 @@ function assertKnownFlags(domain, subcommand, args) {
 			...spec
 		}, { argv: args.slice(2) });
 	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		const unknown = unknownFlagIn(err);
+		if (unknown !== null && err instanceof Error) {
+			const suggestion = closestFlag(unknown, {
+				...RELAYED_FLAGS,
+				...spec
+			});
+			throw new Error(`${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : ""} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		}
 		throw err;
 	}
 }
+/** The flag `arg` refused as undeclared, or `null` for any other failure. */
+function unknownFlagIn(err) {
+	if (!(err instanceof Error) || !("code" in err) || err.code !== "ARG_UNKNOWN_OPTION") return null;
+	return /option: (\S+)$/.exec(err.message)?.[1] ?? null;
+}
+/** The declared long flag `typed` is one edit away from, if there is one. */
+function closestFlag(typed, spec) {
+	const name = typed.split("=")[0];
+	return suggestNearMiss(Object.keys(spec).filter((flag) => flag.startsWith("--")), name);
+}
+/**
+* Parse a command that owns its argument handling, refusing what it does not
+* declare.
+*
+* `db backup`, `db restore` and `db backups list` parsed permissively, so an
+* undeclared flag became a positional and was ignored: `db restore <dump>
+* --targt-db x --create-db --yes` dropped the misspelled target and restored
+* into the live database. A typo is refused here before anything runs, naming
+* the declared flag it is one edit from, or every flag the command takes when
+* none is that close.
+*
+* @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+* @param command the command as typed, for the message: `"db restore"`.
+*/
+function parseCommandFlags(spec, argv, command) {
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	try {
+		return (0, import_arg.default)(full, { argv });
+	} catch (err) {
+		const unknown = unknownFlagIn(err);
+		if (unknown === null) throw err;
+		const suggestion = closestFlag(unknown, full);
+		const flags = Object.keys(spec).filter((flag) => flag.startsWith("--"));
+		throw new Error(`\`rebase ${command}\` has no option ${unknown}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(", ")}.`) + ` Nothing was run. See \`rebase ${command} --help\`.`);
+	}
+}
 //#endregion
-export { collectionsPathIn as n, parseDriverLine as r, assertKnownFlags as t };
+export { parseDriverLine as a, parseCommandFlags as i, assertKnownFlags as n, collectionsPathIn as r, RELAYED_FLAGS as t };
 
-//# sourceMappingURL=cli-flags-BglvpjHv.js.map
+//# sourceMappingURL=cli-flags-DnPHXjRH.js.map

package/dist/cli-flags-DnPHXjRH.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-flags-DnPHXjRH.js","names":[],"sources":["../src/cli-flags.ts"],"sourcesContent":["/**\n * The flags each driver command takes, in one place, and the check that\n * enforces them.\n *\n * Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not\n * mean \"be lenient\" — it means **an undeclared flag becomes a positional**. So\n * `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the\n * push ran with the destructive gate still closed, and the developer read the\n * refusal as Rebase ignoring the flag they had just typed. `rebase schema\n * generate --ouput src/schema.ts` was worse — it wrote the default path and\n * said nothing, so the next build compiled a file nobody had regenerated.\n *\n * The check has to live at the entry point rather than in those parsers, and\n * that is not a detail: `db push` and `db generate` re-enter `schemaCommand`\n * and `generatePostgresDdlCommand` with the *db* line, so a strict parser\n * inside either of them would reject `--allow-destructive` on a line where it\n * is correct. One validation, once, against the spec for the command the user\n * actually named; the inner parsers keep reading an already-validated line.\n *\n * Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),\n * `db backup`, `db restore`, `db backups` — are deliberately absent: they own\n * their spec, and a second list here would be one more thing to keep in step.\n * An absent entry is \"not checked here\", never \"takes nothing\".\n */\nimport arg from \"arg\";\nimport { suggestNearMiss } from \"@rebasepro/utils\";\n\n/**\n * Flags that reach this process on a line it did not compose.\n *\n * `rebase db …` hands the driver the user's whole line: the CLI *reads*\n * `--database-url` and `--docker` to resolve the database and then relays them\n * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as\n * the thing to re-run with. Rejecting any of the three would make the driver\n * refuse commands the CLI documents.\n */\nexport const RELAYED_FLAGS = {\n    \"--database-url\": String,\n    \"--docker\": Boolean,\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} satisfies arg.Spec;\n\n/**\n * Parse a driver command's line — `[\"db\", \"<subcommand>\", …]` — with the\n * relayed flags declared alongside the command's own.\n *\n * Every driver parser is permissive, and an undeclared flag in a permissive\n * parse is a positional. The positionals are what `db migrate` hands\n * `atlas migrate apply`, what `db generate` names its migration after and\n * which backup `db restore` restores, so a relayed flag left undeclared was\n * read as one of those: `rebase db migrate --docker` died on Atlas's\n * `unknown flag: --docker` after it had already written the auth schema.\n */\nexport function parseDriverLine<S extends arg.Spec>(\n    spec: S,\n    args: string[]\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    return arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2), permissive: true });\n}\n\n/** Keyed by `\"<domain> <subcommand>\"`, the way the user types it. */\nexport const DRIVER_FLAG_SPECS: Record<string, arg.Spec> = {\n    \"db push\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--dry-run\": Boolean,\n        \"--allow-destructive\": Boolean,\n        \"--yes\": Boolean,\n        \"-y\": \"--yes\"\n    },\n    \"db generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\"\n    },\n    // Bare positionals still pass through to `atlas migrate apply`, which takes\n    // an optional amount; flags do not, apart from `--baseline`.\n    //\n    // `--baseline <version>` is the escape hatch for the normal case, not an\n    // exotic one: every Rebase boot ensures the schema, so a production\n    // database has the tables before its first migration ever runs, and\n    // `migrate apply` then dies on `type \"…\" already exists (42710)`. It maps\n    // onto Atlas's own `migrate apply --baseline`, which writes the revision\n    // row Atlas reads — no ledger of ours.\n    //\n    // `--refuse-destructive` is opt-in: it dry-runs the pending files and exits\n    // 1, applying nothing, when one drops or narrows data — the gate `db push`\n    // has always had, for the path that had none.\n    \"db migrate\": {\n        \"--baseline\": String,\n        \"--refuse-destructive\": Boolean\n    },\n    \"schema generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--watch\": Boolean,\n        \"-w\": \"--watch\"\n    },\n    \"schema introspect\": {\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--force\": Boolean,\n        \"-f\": \"--force\",\n        \"--schema\": String\n    },\n    \"schema stale\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--fix\": Boolean\n    }\n};\n\n/**\n * One destination flag, two spellings, everywhere.\n *\n * `--out` is the primary on `rebase build`, an alias on `generate-sdk`, `db\n * backup` and `cloud env pull`, and was refused outright by the three `schema`\n * commands — so the spelling a user learned on one command was an\n * \"unknown or unexpected option\" on the next. Neither name can be retired (both\n * are shipped), so both are accepted, and {@link assertOutputAliasesPaired}\n * makes that the rule rather than a habit.\n */\nexport const OUTPUT_FLAG_ALIASES = [\"--out\", \"--output\"] as const;\n\n/**\n * Every spec that names one of the pair names both.\n *\n * Exported so the CLI's own specs can be held to it too: the drift this fixes\n * ran across two packages, and a check that only reads this file would let the\n * next `--out`-only command through.\n */\nexport function assertOutputAliasesPaired(specs: Record<string, arg.Spec>): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const present = OUTPUT_FLAG_ALIASES.filter(flag => flag in spec);\n        if (present.length === 0 || present.length === OUTPUT_FLAG_ALIASES.length) continue;\n        const missing = OUTPUT_FLAG_ALIASES.filter(flag => !(flag in spec));\n        problems.push(`\\`${command}\\` takes ${present.join(\", \")} but not ${missing.join(\", \")}`);\n    }\n    return problems;\n}\n\n/**\n * The `--collections` path the user typed, or `null` if they typed none.\n *\n * Read once, at the entry point, because every command that takes it re-enters\n * the generators with the same line and each of them resolved it again — which\n * is how \"Collections path not found\" came to be printed four times before the\n * real output, and how a path that does not exist got as far as *writing* an\n * empty schema.\n *\n * Permissive, and it has to be: {@link assertKnownFlags} has already judged the\n * line, and `db push` carries flags the `--collections` spec does not name.\n */\nexport function collectionsPathIn(args: string[]): string | null {\n    try {\n        const parsed = arg(\n            { \"--collections\": String, \"-c\": \"--collections\" },\n            { argv: args.slice(2), permissive: true }\n        );\n\n        return parsed[\"--collections\"] ?? null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The long flags a `--help` usage line documents.\n *\n * `\"rebase db push [--collections <dir>] [--dry-run] …\"` → `[\"--collections\",\n * \"--dry-run\"]`. Placeholders (`<dir>`) and the alternation inside a positional\n * (`<create|list|switch>`) are not flags and are not returned.\n */\nexport function flagsInUsage(usage: string): string[] {\n    return [...new Set(usage.match(/--[a-z][a-z0-9-]*/g) ?? [])];\n}\n\n/**\n * Every flag the help documents is accepted, and every flag accepted is documented.\n *\n * The drift this catches shipped: `rebase db push --help` has printed\n * `[--dry-run]` since the flag was written, `DRIVER_FLAG_SPECS[\"db push\"]` never\n * listed it, and {@link assertKnownFlags} — added later to stop typos being\n * swallowed — turned the documented flag into `unknown or unexpected option`.\n * The only way to see a push's SQL was to trip the destructive gate, which is\n * the exact problem `--dry-run` was written to solve. Worse in a project on an\n * older driver, whose permissive parser *applied* the schema on that line.\n *\n * Two hand-maintained lists in two packages cannot be kept in step by care, so\n * they are held to each other instead: `usages` is keyed the way\n * {@link DRIVER_FLAG_SPECS} is (`\"db push\"`), and comes from the CLI's own help\n * pages. A key in only one of the two is not this function's business — the\n * help covers commands that parse their own lines (`db branch`, `db backup`),\n * and an absent spec entry means \"not checked here\".\n *\n * Aliases (`\"-c\": \"--collections\"`, `\"--out\": \"--output\"`) need no line of their\n * own: they are spellings of a documented flag. Neither do {@link RELAYED_FLAGS},\n * which every driver command accepts because the CLI relays them.\n */\nexport function assertSpecMatchesUsage(\n    specs: Record<string, arg.Spec>,\n    usages: Record<string, string>\n): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const usage = usages[command];\n        if (usage === undefined) continue;\n\n        const documented = flagsInUsage(usage);\n        const accepted = Object.entries(spec);\n        // An alias resolves to the flag it spells; only the target needs a line.\n        const canonical = new Set(\n            accepted\n                .map(([flag, kind]) => (typeof kind === \"string\" ? kind : flag))\n                .filter(flag => flag.startsWith(\"--\"))\n        );\n\n        for (const flag of documented) {\n            if (flag in spec || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` documents ${flag} in its usage line but the spec rejects it`);\n        }\n        for (const flag of canonical) {\n            if (documented.includes(flag) || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` accepts ${flag} but no usage line documents it`);\n        }\n    }\n    return problems;\n}\n\n/**\n * Reject a flag the named command does not take.\n *\n * `args` is the driver's whole line — `[\"db\", \"push\", …]` — so the flags are\n * read from `args.slice(2)`, past the two command words.\n *\n * Throws rather than exiting: `runPluginCommand`'s caller already turns a\n * thrown error into one red line and exit 1, and a thrown error is what the\n * tests can see.\n */\nexport function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void {\n    if (!subcommand) return;\n    const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];\n    if (!spec) return;\n\n    try {\n        arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2) });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown !== null && err instanceof Error) {\n            const suggestion = closestFlag(unknown, { ...RELAYED_FLAGS, ...spec });\n            throw new Error(\n                `${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : \"\"} — run ` +\n                `\\`rebase ${domain} --help\\` for the options \\`${domain} ${subcommand}\\` takes.`\n            );\n        }\n        throw err;\n    }\n}\n\n/** The flag `arg` refused as undeclared, or `null` for any other failure. */\nfunction unknownFlagIn(err: unknown): string | null {\n    if (!(err instanceof Error) || !(\"code\" in err) || err.code !== \"ARG_UNKNOWN_OPTION\") return null;\n    // arg's wording: `unknown or unexpected option: --targt-db`.\n    return /option: (\\S+)$/.exec(err.message)?.[1] ?? null;\n}\n\n/** The declared long flag `typed` is one edit away from, if there is one. */\nfunction closestFlag(typed: string, spec: arg.Spec): string | undefined {\n    const name = typed.split(\"=\")[0];\n    return suggestNearMiss(Object.keys(spec).filter(flag => flag.startsWith(\"--\")), name);\n}\n\n/**\n * Parse a command that owns its argument handling, refusing what it does not\n * declare.\n *\n * `db backup`, `db restore` and `db backups list` parsed permissively, so an\n * undeclared flag became a positional and was ignored: `db restore <dump>\n * --targt-db x --create-db --yes` dropped the misspelled target and restored\n * into the live database. A typo is refused here before anything runs, naming\n * the declared flag it is one edit from, or every flag the command takes when\n * none is that close.\n *\n * @param argv the words after the command, e.g. `rawArgs.slice(2)`.\n * @param command the command as typed, for the message: `\"db restore\"`.\n */\nexport function parseCommandFlags<S extends arg.Spec>(\n    spec: S,\n    argv: string[],\n    command: string\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    const full = { ...RELAYED_FLAGS, ...spec };\n    try {\n        return arg(full, { argv });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown === null) throw err;\n        const suggestion = closestFlag(unknown, full);\n        const flags = Object.keys(spec).filter(flag => flag.startsWith(\"--\"));\n        throw new Error(\n            `\\`rebase ${command}\\` has no option ${unknown}` +\n            (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(\", \")}.`) +\n            ` Nothing was run. See \\`rebase ${command} --help\\`.`\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,IAAa,gBAAgB;CACzB,kBAAkB;CAClB,YAAY;CACZ,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;;;;;;;AAaA,SAAgB,gBACZ,MACA,MACoC;CACpC,QAAA,GAAA,WAAA,QAAA,CAAW;EAAE,GAAG;EAAe,GAAG;CAAK,GAAG;EAAE,MAAM,KAAK,MAAM,CAAC;EAAG,YAAY;CAAK,CAAC;AACvF;;AAGA,IAAa,oBAA8C;CACvD,WAAW;EACP,iBAAiB;EACjB,MAAM;EACN,aAAa;EACb,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV;CACA,eAAe;EACX,iBAAiB;EACjB,MAAM;CACV;CAcA,cAAc;EACV,cAAc;EACd,wBAAwB;CAC5B;CACA,mBAAmB;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,WAAW;EACX,MAAM;CACV;CACA,qBAAqB;EACjB,YAAY;EACZ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,MAAM;EACN,WAAW;EACX,MAAM;EACN,YAAY;CAChB;CACA,gBAAgB;EACZ,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,SAAS;CACb;AACJ;;;;;;;;;;;;;AA4CA,SAAgB,kBAAkB,MAA+B;CAC7D,IAAI;EAMA,QAAA,GAAA,WAAA,QAAA,CAJI;GAAE,iBAAiB;GAAQ,MAAM;EAAgB,GACjD;GAAE,MAAM,KAAK,MAAM,CAAC;GAAG,YAAY;EAAK,CAGrC,CAAA,CAAO,oBAAoB;CACtC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AA2EA,SAAgB,iBAAiB,QAAgB,YAAgC,MAAsB;CACnG,IAAI,CAAC,YAAY;CACjB,MAAM,OAAO,kBAAkB,GAAG,OAAO,GAAG;CAC5C,IAAI,CAAC,MAAM;CAEX,IAAI;EACA,CAAA,GAAA,WAAA,QAAA,CAAI;GAAE,GAAG;GAAe,GAAG;EAAK,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CAC9D,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,QAAQ,eAAe,OAAO;GAC1C,MAAM,aAAa,YAAY,SAAS;IAAE,GAAG;IAAe,GAAG;GAAK,CAAC;GACrE,MAAM,IAAI,MACN,GAAG,IAAI,UAAU,aAAa,kBAAkB,WAAW,MAAM,GAAG,kBACxD,OAAO,8BAA8B,OAAO,GAAG,WAAW,UAC1E;EACJ;EACA,MAAM;CACV;AACJ;;AAGA,SAAS,cAAc,KAA6B;CAChD,IAAI,EAAE,eAAe,UAAU,EAAE,UAAU,QAAQ,IAAI,SAAS,sBAAsB,OAAO;CAE7F,OAAO,iBAAiB,KAAK,IAAI,OAAO,CAAC,GAAG,MAAM;AACtD;;AAGA,SAAS,YAAY,OAAe,MAAoC;CACpE,MAAM,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC;CAC9B,OAAO,gBAAgB,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC,GAAG,IAAI;AACxF;;;;;;;;;;;;;;;AAgBA,SAAgB,kBACZ,MACA,MACA,SACoC;CACpC,MAAM,OAAO;EAAE,GAAG;EAAe,GAAG;CAAK;CACzC,IAAI;EACA,QAAA,GAAA,WAAA,QAAA,CAAW,MAAM,EAAE,KAAK,CAAC;CAC7B,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,MAAM,MAAM;EAC5B,MAAM,aAAa,YAAY,SAAS,IAAI;EAC5C,MAAM,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC;EACpE,MAAM,IAAI,MACN,YAAY,QAAQ,mBAAmB,aACtC,aAAa,mBAAmB,WAAW,KAAK,eAAe,MAAM,KAAK,IAAI,EAAE,MACjF,kCAAkC,QAAQ,WAC9C;CACJ;AACJ"}

package/dist/cli-flags.d.ts

@@ -127,3 +127,18 @@ export declare function assertSpecMatchesUsage(specs: Record<string, arg.Spec>,
  * tests can see.
  */
 export declare function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void;
+/**
+ * Parse a command that owns its argument handling, refusing what it does not
+ * declare.
+ *
+ * `db backup`, `db restore` and `db backups list` parsed permissively, so an
+ * undeclared flag became a positional and was ignored: `db restore <dump>
+ * --targt-db x --create-db --yes` dropped the misspelled target and restored
+ * into the live database. A typo is refused here before anything runs, naming
+ * the declared flag it is one edit from, or every flag the command takes when
+ * none is that close.
+ *
+ * @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+ * @param command the command as typed, for the message: `"db restore"`.
+ */
+export declare function parseCommandFlags<S extends arg.Spec>(spec: S, argv: string[], command: string): arg.Result<typeof RELAYED_FLAGS & S>;

package/dist/cli-helpers.d.ts

@@ -1,5 +1,6 @@
 import type { GeneratedColumnDependency } from "./schema/generated-column-conflicts.js";
 import { type ExistingColumnType } from "./schema/destructive-sql.js";
+import { type ExistingConstraint } from "./schema/undeclarable-constraints.js";
 import type { CollectionConfig } from "@rebasepro/types";
 /**
  * Why is a dependency's binary missing — never installed, or installed with its
@@ -84,6 +85,45 @@ export declare function resolveLocalBin(binName: string): string | null;
 export declare function getTableIncludesFromCollections(allCollections: CollectionConfig[]): Promise<string[]>;
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function loadCollectionsForCli(collectionsPath: string): Promise<CollectionConfig[]>;
+type PgClient = import("pg").Client;
+/**
+ * Run one step on this process's connection to the app database.
+ *
+ * Every step leaves the session as it found it, which is what a connection of
+ * its own used to guarantee by being closed. None of them sets anything for
+ * the session — `SET LOCAL` inside their own transaction, or `RESET` — and one
+ * that fails part-way through a transaction it opened is rolled back here, so
+ * the next step does not meet `current transaction is aborted`.
+ *
+ * @param options.connectionTimeoutMillis applies only when this call is the one
+ *        that connects.
+ */
+export declare function withAppClient<T>(databaseUrl: string, step: (client: PgClient) => Promise<T>, options?: {
+    connectionTimeoutMillis?: number;
+}): Promise<T>;
+/** Close every connection {@link withAppClient} opened. Called once, as the command ends. */
+export declare function closeAppClients(): Promise<void>;
+/**
+ * Names the empty database Atlas plans against, instead of `<db>_dev_diff`.
+ *
+ * The derived one is made with `CREATE DATABASE` beside the real database,
+ * which assumes a server that holds more than one. PGlite — the managed
+ * development database — serves exactly one: the CREATE succeeds and creates
+ * nothing, so Atlas connected straight back to the database it was comparing
+ * and refused it as "not clean". `rebase db push` on the managed database now
+ * starts a second, throwaway PGlite and names it here. Anyone can name their
+ * own the same way; a named database is neither created nor dropped.
+ */
+export declare const ATLAS_DEV_URL_ENV = "REBASE_ATLAS_DEV_URL";
+/**
+ * The database Atlas replays the desired schema into: the one
+ * {@link ATLAS_DEV_URL_ENV} names (`named: true` — not ours to create or
+ * drop), else `<db>_dev_diff`.
+ */
+export declare function atlasDevDatabaseUrl(databaseUrl: string, env: Readonly<Record<string, string | undefined>>): {
+    url: string;
+    named: boolean;
+};
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 /**
  * Create the scratch database Atlas plans against, and say so when we cannot.
@@ -238,15 +278,21 @@ export declare function getTriggerExcludes(collectionsPath: string): Promise<str
  * catalogs. Separated from {@link getTableExcludes} so its failure mode can
  * be handled explicitly (fail closed) and so tests can inject a stub.
  */
+/** An index as the catalogue names it: its schema, its table and its own name. */
+export interface ExistingIndex {
+    schema: string;
+    table: string;
+    index: string;
+}
 /**
- * Every index Postgres holds on a table Rebase manages, as
- * `schema.table.index`.
+ * Every index Postgres holds on a table, by its parts — never joined with `.`,
+ * which a name may itself contain.
  *
  * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
  * *constraint* to Atlas, diffed from the constraint declaration, and naming its
  * index in an exclude would shield the constraint itself.
  */
-export declare function queryExistingIndexes(databaseUrl: string): Promise<string[]>;
+export declare function queryExistingIndexes(databaseUrl: string): Promise<ExistingIndex[]>;
 /**
  * Glob patterns keeping Atlas away from indexes that are not Rebase's.
  *
@@ -273,13 +319,35 @@ export declare function queryExistingIndexes(databaseUrl: string): Promise<strin
  *
  * Three-part `schema.table.index`, never two: a two-part pattern reads as a
  * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
- * reports no error — the trap already recorded for the search excludes.
+ * reports no error — the trap already recorded for the search excludes. And
+ * spelled by `atlasExcludePattern`: a raw `orders_idx[v1]` is a glob that
+ * matches `orders_idxv`, so that index was dropped with no prompt.
  */
 export declare function getForeignIndexExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingIndexes?: (databaseUrl: string) => Promise<ExistingIndex[]>;
     getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;
 }): Promise<string[]>;
-export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/** Every CHECK and EXCLUDE constraint the database holds. @see UNDECLARABLE_CONSTRAINTS_SQL */
+export declare function queryUndeclarableConstraints(databaseUrl: string): Promise<ExistingConstraint[]>;
+/**
+ * Patterns keeping Atlas away from the CHECK and EXCLUDE constraints the
+ * collections do not declare — which, since a collection cannot declare
+ * either, is all of them. See `schema/undeclarable-constraints.ts`.
+ *
+ * Fails CLOSED, like {@link getTableExcludes}: without the catalogue nothing
+ * says which constraints are there, and a partial list lets the push drop a
+ * rule the database enforces. `desiredSql` is the `schema.sql` Atlas is about
+ * to diff against; a constraint it declares is Atlas's to manage.
+ */
+export declare function getUndeclaredConstraintExcludes(databaseUrl: string, desiredSql: string, deps?: {
+    queryConstraints?: (databaseUrl: string) => Promise<ExistingConstraint[]>;
+}): Promise<string[]>;
+/** A table or view as the catalogue names it. */
+export interface ExistingTable {
+    schema: string;
+    table: string;
+}
+export declare function queryExistingTables(databaseUrl: string): Promise<ExistingTable[]>;
 /**
  * Raised when the exclude list could not be built. `db push` MUST abort on
  * this rather than continue: the exclude list is the only thing shielding
@@ -304,21 +372,7 @@ export declare class ExcludeIntrospectionError extends Error {
  * `deps` is injectable for tests; production uses the real pg-backed queries.
  */
 export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingTables?: (databaseUrl: string) => Promise<ExistingTable[]>;
     getIncludes?: (collectionsPath: string) => Promise<string[]>;
 }): Promise<string[]>;
-/**
- * Ask a yes/no question on an interactive terminal.
- *
- * The `isTTY` guard is the contract, not an optimisation: non-interactive
- * shells (CI, pipes, agents) can never answer, and `readline` on a
- * non-TTY stdin resolves with whatever the pipe happens to contain — or never
- * resolves at all. Returning false there is what makes an unattended
- * `db push` abort instead of auto-confirming a destructive change. Callers
- * should already have gone through {@link decidePushSafety}, which decides
- * whether interactive confirmation is even possible; this is the backstop.
- *
- * Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
- * `import.meta` and cannot be imported by the jest runner.
- */
-export declare function promptConfirm(question: string): Promise<boolean>;
+export {};

package/dist/cli-output.d.ts

@@ -1,34 +1,22 @@
-/**
- * Terminal output for the `rebase db|schema|doctor` commands.
- *
- * These commands used to write every line through `logger`, and that is a
- * category error with three separate consequences:
- *
- *  - `logger` prefixes each line with its own level, so a box-drawn report
- *    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
- *    lined up with anything;
- *  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
- *    `.env.example` — a developer who quietened their dev server with
- *    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
- *    still exited non-zero, indistinguishable from a crash;
- *  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
- *    became log records with the chalk escape codes embedded in them.
- *
- * A CLI's report *is* its return value. It goes to the terminal unconditionally
- * and unadorned. `packages/cli` has always written its output this way; this is
- * the same three functions for the plugin CLI that `rebase` delegates to.
- *
- * `logger` still belongs in this package's *runtime* — a request handler has no
- * terminal and its lines want levels, timestamps and redaction. The rule is the
- * caller, not the severity: anything a developer reads because they typed a
- * command goes here, anything a server emits while running goes to `logger`.
- *
- * Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
- * diagnosis on the terminal where it is readable.
- */
 /** One line of human-facing output on stdout. */
 export declare const out: (line?: string) => void;
 /** One line of human-facing warning output on stderr. */
 export declare const outWarn: (line?: string) => void;
 /** One line of human-facing error output on stderr. */
 export declare const outError: (line?: string) => void;
+/**
+ * Whether a failure should be printed with its stack — `rebase --debug`, which
+ * the launcher passes down as `REBASE_DEBUG`, or `REBASE_DEBUG` set by hand.
+ */
+export declare const wantsStack: () => boolean;
+/**
+ * An error as a person reads it: its message, and its stack only under
+ * `--debug`.
+ *
+ * The rule `rebase` itself follows (`bin/rebase.js`). These commands run in a
+ * child process the launcher's handler never sees, so a syntax error in a
+ * collection file reached the terminal as `Doctor failed CollectionConfigError:`
+ * followed by twenty frames of loader internals, under a sentence that already
+ * said which file and which line.
+ */
+export declare const describeFailure: (error: unknown) => string;

package/dist/{arg-Dni7MzLB.js → cli-prompt-egtNKkZl.js}

@@ -1,6 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { n as __commonJSMin } from "./__vite-browser-external-BnuHet1e.js";
+import { t as __commonJSMin } from "./rolldown-runtime-V7rFbMRe.js";
+import readline from "readline";
 //#region ../../node_modules/.pnpm/arg@5.0.2/node_modules/arg/index.js
 var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var flagSymbol = Symbol("arg flag");
@@ -82,6 +83,51 @@ var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = arg;
 }));
 //#endregion
-export { require_arg as t };
+//#region src/cli-prompt.ts
+/**
+* The one yes/no question the driver CLI asks: before a destructive `db push`,
+* before a `db restore` without `--yes`, before `db branch prune` removes
+* anything, and before `schema introspect` samples rows.
+*/
+/**
+* Ask a yes/no question on an interactive terminal; `true` only for "y" or
+* "yes".
+*
+* The `isTTY` guard is the contract, not an optimisation: non-interactive
+* shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY
+* stdin resolves with whatever the pipe happens to contain, or never resolves
+* at all. Returning false there is what makes an unattended `db push` abort
+* instead of auto-confirming a destructive change. Callers decide first
+* whether interactive confirmation is possible (`decidePushSafety` for a
+* push); this is the backstop.
+*
+* Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,
+* not as a signal, and with nothing listening it only pauses the input: the
+* question never resolves, and the open database connections behind it keep
+* the process alive, so the command hung instead of stopping. Answering no
+* sends it down the path that says "Aborted" and cleans up.
+*/
+async function promptConfirm(question) {
+	if (!process.stdin.isTTY) return false;
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const answer = await new Promise((resolve) => {
+			rl.once("SIGINT", () => {
+				process.stdout.write("\n");
+				resolve("");
+			});
+			rl.once("close", () => resolve(""));
+			rl.question(question, resolve);
+		});
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+export { require_arg as n, promptConfirm as t };
 
-//# sourceMappingURL=arg-Dni7MzLB.js.map
+//# sourceMappingURL=cli-prompt-egtNKkZl.js.map

package/dist/cli-prompt-egtNKkZl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-prompt-egtNKkZl.js","names":[],"sources":["../../../node_modules/.pnpm/arg@5.0.2/node_modules/arg/index.js","../src/cli-prompt.ts"],"sourcesContent":["const flagSymbol = Symbol('arg flag');\n\nclass ArgError extends Error {\n\tconstructor(msg, code) {\n\t\tsuper(msg);\n\t\tthis.name = 'ArgError';\n\t\tthis.code = code;\n\n\t\tObject.setPrototypeOf(this, ArgError.prototype);\n\t}\n}\n\nfunction arg(\n\topts,\n\t{\n\t\targv = process.argv.slice(2),\n\t\tpermissive = false,\n\t\tstopAtPositional = false\n\t} = {}\n) {\n\tif (!opts) {\n\t\tthrow new ArgError(\n\t\t\t'argument specification object is required',\n\t\t\t'ARG_CONFIG_NO_SPEC'\n\t\t);\n\t}\n\n\tconst result = { _: [] };\n\n\tconst aliases = {};\n\tconst handlers = {};\n\n\tfor (const key of Object.keys(opts)) {\n\t\tif (!key) {\n\t\t\tthrow new ArgError(\n\t\t\t\t'argument key cannot be an empty string',\n\t\t\t\t'ARG_CONFIG_EMPTY_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (key[0] !== '-') {\n\t\t\tthrow new ArgError(\n\t\t\t\t`argument key must start with '-' but found: '${key}'`,\n\t\t\t\t'ARG_CONFIG_NONOPT_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (key.length === 1) {\n\t\t\tthrow new ArgError(\n\t\t\t\t`argument key must have a name; singular '-' keys are not allowed: ${key}`,\n\t\t\t\t'ARG_CONFIG_NONAME_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (typeof opts[key] === 'string') {\n\t\t\taliases[key] = opts[key];\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet type = opts[key];\n\t\tlet isFlag = false;\n\n\t\tif (\n\t\t\tArray.isArray(type) &&\n\t\t\ttype.length === 1 &&\n\t\t\ttypeof type[0] === 'function'\n\t\t) {\n\t\t\tconst [fn] = type;\n\t\t\ttype = (value, name, prev = []) => {\n\t\t\t\tprev.push(fn(value, name, prev[prev.length - 1]));\n\t\t\t\treturn prev;\n\t\t\t};\n\t\t\tisFlag = fn === Boolean || fn[flagSymbol] === true;\n\t\t} else if (typeof type === 'function') {\n\t\t\tisFlag = type === Boolean || type[flagSymbol] === true;\n\t\t} else {\n\t\t\tthrow new ArgError(\n\t\t\t\t`type missing or not a function or valid array type: ${key}`,\n\t\t\t\t'ARG_CONFIG_VAD_TYPE'\n\t\t\t);\n\t\t}\n\n\t\tif (key[1] !== '-' && key.length > 2) {\n\t\t\tthrow new ArgError(\n\t\t\t\t`short argument keys (with a single hyphen) must have only one character: ${key}`,\n\t\t\t\t'ARG_CONFIG_SHORTOPT_TOOLONG'\n\t\t\t);\n\t\t}\n\n\t\thandlers[key] = [type, isFlag];\n\t}\n\n\tfor (let i = 0, len = argv.length; i < len; i++) {\n\t\tconst wholeArg = argv[i];\n\n\t\tif (stopAtPositional && result._.length > 0) {\n\t\t\tresult._ = result._.concat(argv.slice(i));\n\t\t\tbreak;\n\t\t}\n\n\t\tif (wholeArg === '--') {\n\t\t\tresult._ = result._.concat(argv.slice(i + 1));\n\t\t\tbreak;\n\t\t}\n\n\t\tif (wholeArg.length > 1 && wholeArg[0] === '-') {\n\t\t\t/* eslint-disable operator-linebreak */\n\t\t\tconst separatedArguments =\n\t\t\t\twholeArg[1] === '-' || wholeArg.length === 2\n\t\t\t\t\t? [wholeArg]\n\t\t\t\t\t: wholeArg\n\t\t\t\t\t\t\t.slice(1)\n\t\t\t\t\t\t\t.split('')\n\t\t\t\t\t\t\t.map((a) => `-${a}`);\n\t\t\t/* eslint-enable operator-linebreak */\n\n\t\t\tfor (let j = 0; j < separatedArguments.length; j++) {\n\t\t\t\tconst arg = separatedArguments[j];\n\t\t\t\tconst [originalArgName, argStr] =\n\t\t\t\t\targ[1] === '-' ? arg.split(/=(.*)/, 2) : [arg, undefined];\n\n\t\t\t\tlet argName = originalArgName;\n\t\t\t\twhile (argName in aliases) {\n\t\t\t\t\targName = aliases[argName];\n\t\t\t\t}\n\n\t\t\t\tif (!(argName in handlers)) {\n\t\t\t\t\tif (permissive) {\n\t\t\t\t\t\tresult._.push(arg);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t\t`unknown or unexpected option: ${originalArgName}`,\n\t\t\t\t\t\t\t'ARG_UNKNOWN_OPTION'\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst [type, isFlag] = handlers[argName];\n\n\t\t\t\tif (!isFlag && j + 1 < separatedArguments.length) {\n\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t`option requires argument (but was followed by another short argument): ${originalArgName}`,\n\t\t\t\t\t\t'ARG_MISSING_REQUIRED_SHORTARG'\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tif (isFlag) {\n\t\t\t\t\tresult[argName] = type(true, argName, result[argName]);\n\t\t\t\t} else if (argStr === undefined) {\n\t\t\t\t\tif (\n\t\t\t\t\t\targv.length < i + 2 ||\n\t\t\t\t\t\t(argv[i + 1].length > 1 &&\n\t\t\t\t\t\t\targv[i + 1][0] === '-' &&\n\t\t\t\t\t\t\t!(\n\t\t\t\t\t\t\t\targv[i + 1].match(/^-?\\d*(\\.(?=\\d))?\\d*$/) &&\n\t\t\t\t\t\t\t\t(type === Number ||\n\t\t\t\t\t\t\t\t\t// eslint-disable-next-line no-undef\n\t\t\t\t\t\t\t\t\t(typeof BigInt !== 'undefined' && type === BigInt))\n\t\t\t\t\t\t\t))\n\t\t\t\t\t) {\n\t\t\t\t\t\tconst extended =\n\t\t\t\t\t\t\toriginalArgName === argName ? '' : ` (alias for ${argName})`;\n\t\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t\t`option requires argument: ${originalArgName}${extended}`,\n\t\t\t\t\t\t\t'ARG_MISSING_REQUIRED_LONGARG'\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tresult[argName] = type(argv[i + 1], argName, result[argName]);\n\t\t\t\t\t++i;\n\t\t\t\t} else {\n\t\t\t\t\tresult[argName] = type(argStr, argName, result[argName]);\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tresult._.push(wholeArg);\n\t\t}\n\t}\n\n\treturn result;\n}\n\narg.flag = (fn) => {\n\tfn[flagSymbol] = true;\n\treturn fn;\n};\n\n// Utility types\narg.COUNT = arg.flag((v, name, existingCount) => (existingCount || 0) + 1);\n\n// Expose error class\narg.ArgError = ArgError;\n\nmodule.exports = arg;\n","/**\n * The one yes/no question the driver CLI asks: before a destructive `db push`,\n * before a `db restore` without `--yes`, before `db branch prune` removes\n * anything, and before `schema introspect` samples rows.\n */\nimport readline from \"readline\";\n\n/**\n * Ask a yes/no question on an interactive terminal; `true` only for \"y\" or\n * \"yes\".\n *\n * The `isTTY` guard is the contract, not an optimisation: non-interactive\n * shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY\n * stdin resolves with whatever the pipe happens to contain, or never resolves\n * at all. Returning false there is what makes an unattended `db push` abort\n * instead of auto-confirming a destructive change. Callers decide first\n * whether interactive confirmation is possible (`decidePushSafety` for a\n * push); this is the backstop.\n *\n * Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,\n * not as a signal, and with nothing listening it only pauses the input: the\n * question never resolves, and the open database connections behind it keep\n * the process alive, so the command hung instead of stopping. Answering no\n * sends it down the path that says \"Aborted\" and cleans up.\n */\nexport async function promptConfirm(question: string): Promise<boolean> {\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer = await new Promise<string>((resolve) => {\n            rl.once(\"SIGINT\", () => {\n                process.stdout.write(\"\\n\");\n                resolve(\"\");\n            });\n            rl.once(\"close\", () => resolve(\"\"));\n            rl.question(question, resolve);\n        });\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n"],"x_google_ignoreList":[0],"mappings":";;;;;;CAAA,IAAM,aAAa,OAAO,UAAU;CAEpC,IAAM,WAAN,MAAM,iBAAiB,MAAM;EAC5B,YAAY,KAAK,MAAM;GACtB,MAAM,GAAG;GACT,KAAK,OAAO;GACZ,KAAK,OAAO;GAEZ,OAAO,eAAe,MAAM,SAAS,SAAS;EAC/C;CACD;CAEA,SAAS,IACR,MACA,EACC,OAAO,QAAQ,KAAK,MAAM,CAAC,GAC3B,aAAa,OACb,mBAAmB,UAChB,CAAC,GACJ;EACD,IAAI,CAAC,MACJ,MAAM,IAAI,SACT,6CACA,oBACD;EAGD,MAAM,SAAS,EAAE,GAAG,CAAC,EAAE;EAEvB,MAAM,UAAU,CAAC;EACjB,MAAM,WAAW,CAAC;EAElB,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,GAAG;GACpC,IAAI,CAAC,KACJ,MAAM,IAAI,SACT,0CACA,sBACD;GAGD,IAAI,IAAI,OAAO,KACd,MAAM,IAAI,SACT,gDAAgD,IAAI,IACpD,uBACD;GAGD,IAAI,IAAI,WAAW,GAClB,MAAM,IAAI,SACT,qEAAqE,OACrE,uBACD;GAGD,IAAI,OAAO,KAAK,SAAS,UAAU;IAClC,QAAQ,OAAO,KAAK;IACpB;GACD;GAEA,IAAI,OAAO,KAAK;GAChB,IAAI,SAAS;GAEb,IACC,MAAM,QAAQ,IAAI,KAClB,KAAK,WAAW,KAChB,OAAO,KAAK,OAAO,YAClB;IACD,MAAM,CAAC,MAAM;IACb,QAAQ,OAAO,MAAM,OAAO,CAAC,MAAM;KAClC,KAAK,KAAK,GAAG,OAAO,MAAM,KAAK,KAAK,SAAS,EAAE,CAAC;KAChD,OAAO;IACR;IACA,SAAS,OAAO,WAAW,GAAG,gBAAgB;GAC/C,OAAO,IAAI,OAAO,SAAS,YAC1B,SAAS,SAAS,WAAW,KAAK,gBAAgB;QAElD,MAAM,IAAI,SACT,uDAAuD,OACvD,qBACD;GAGD,IAAI,IAAI,OAAO,OAAO,IAAI,SAAS,GAClC,MAAM,IAAI,SACT,4EAA4E,OAC5E,6BACD;GAGD,SAAS,OAAO,CAAC,MAAM,MAAM;EAC9B;EAEA,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,QAAQ,IAAI,KAAK,KAAK;GAChD,MAAM,WAAW,KAAK;GAEtB,IAAI,oBAAoB,OAAO,EAAE,SAAS,GAAG;IAC5C,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IACxC;GACD;GAEA,IAAI,aAAa,MAAM;IACtB,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;IAC5C;GACD;GAEA,IAAI,SAAS,SAAS,KAAK,SAAS,OAAO,KAAK;IAE/C,MAAM,qBACL,SAAS,OAAO,OAAO,SAAS,WAAW,IACxC,CAAC,QAAQ,IACT,SACC,MAAM,CAAC,CAAC,CACR,MAAM,EAAE,CAAC,CACT,KAAK,MAAM,IAAI,GAAG;IAGvB,KAAK,IAAI,IAAI,GAAG,IAAI,mBAAmB,QAAQ,KAAK;KACnD,MAAM,MAAM,mBAAmB;KAC/B,MAAM,CAAC,iBAAiB,UACvB,IAAI,OAAO,MAAM,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,KAAA,CAAS;KAEzD,IAAI,UAAU;KACd,OAAO,WAAW,SACjB,UAAU,QAAQ;KAGnB,IAAI,EAAE,WAAW,WAChB,IAAI,YAAY;MACf,OAAO,EAAE,KAAK,GAAG;MACjB;KACD,OACC,MAAM,IAAI,SACT,iCAAiC,mBACjC,oBACD;KAIF,MAAM,CAAC,MAAM,UAAU,SAAS;KAEhC,IAAI,CAAC,UAAU,IAAI,IAAI,mBAAmB,QACzC,MAAM,IAAI,SACT,0EAA0E,mBAC1E,+BACD;KAGD,IAAI,QACH,OAAO,WAAW,KAAK,MAAM,SAAS,OAAO,QAAQ;UAC/C,IAAI,WAAW,KAAA,GAAW;MAChC,IACC,KAAK,SAAS,IAAI,KACjB,KAAK,IAAI,EAAE,CAAC,SAAS,KACrB,KAAK,IAAI,EAAE,CAAC,OAAO,OACnB,EACC,KAAK,IAAI,EAAE,CAAC,MAAM,uBAAuB,MACxC,SAAS,UAER,OAAO,WAAW,eAAe,SAAS,UAK9C,MAAM,IAAI,SACT,6BAA6B,kBAF7B,oBAAoB,UAAU,KAAK,eAAe,QAAQ,MAG1D,8BACD;MAGD,OAAO,WAAW,KAAK,KAAK,IAAI,IAAI,SAAS,OAAO,QAAQ;MAC5D,EAAE;KACH,OACC,OAAO,WAAW,KAAK,QAAQ,SAAS,OAAO,QAAQ;IAEzD;GACD,OACC,OAAO,EAAE,KAAK,QAAQ;EAExB;EAEA,OAAO;CACR;CAEA,IAAI,QAAQ,OAAO;EAClB,GAAG,cAAc;EACjB,OAAO;CACR;CAGA,IAAI,QAAQ,IAAI,MAAM,GAAG,MAAM,mBAAmB,iBAAiB,KAAK,CAAC;CAGzE,IAAI,WAAW;CAEf,OAAO,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzKjB,eAAsB,cAAc,UAAoC;CACpE,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,SAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAS,MAAM,IAAI,SAAiB,YAAY;GAClD,GAAG,KAAK,gBAAgB;IACpB,QAAQ,OAAO,MAAM,IAAI;IACzB,QAAQ,EAAE;GACd,CAAC;GACD,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC;GAClC,GAAG,SAAS,UAAU,OAAO;EACjC,CAAC;EACD,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ"}

package/dist/cli-prompt.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Ask a yes/no question on an interactive terminal; `true` only for "y" or
+ * "yes".
+ *
+ * The `isTTY` guard is the contract, not an optimisation: non-interactive
+ * shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY
+ * stdin resolves with whatever the pipe happens to contain, or never resolves
+ * at all. Returning false there is what makes an unattended `db push` abort
+ * instead of auto-confirming a destructive change. Callers decide first
+ * whether interactive confirmation is possible (`decidePushSafety` for a
+ * push); this is the backstop.
+ *
+ * Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,
+ * not as a signal, and with nothing listening it only pauses the input: the
+ * question never resolves, and the open database connections behind it keep
+ * the process alive, so the command hung instead of stopping. Answering no
+ * sends it down the path that says "Aborted" and cleans up.
+ */
+export declare function promptConfirm(question: string): Promise<boolean>;

package/dist/cli-push.d.ts

@@ -0,0 +1,87 @@
+/**
+ * The steps `rebase db push` takes once the dry-run has been read and gated.
+ *
+ * Callbacks rather than calls, so the order is testable without a database or
+ * an Atlas binary: `cli.ts` itself cannot be loaded by the jest suite.
+ */
+export interface PushApplySteps {
+    /** Drop the generated columns that read a column the plan retypes. */
+    dropRebuildable: () => Promise<void>;
+    /** `atlas schema apply --auto-approve`: Atlas plans again, then applies. */
+    atlasApply: () => Promise<void>;
+    /** Say what the skipped apply would have printed. */
+    reportSynced: () => void;
+    /** Put those generated columns back after a failed apply. */
+    rebuildAfterFailure: () => Promise<void>;
+    /**
+     * Everything Atlas cannot see: RLS locks, auth tables, vector, search,
+     * triggers, policies, the user role. Runs whether or not Atlas had work.
+     */
+    afterApply: () => Promise<void>;
+}
+/**
+ * Apply a planned push.
+ *
+ * A dry-run that answered "Schema is synced" skips the second Atlas run: that
+ * run would plan the same diff again (≈0.9 s at 111 tables, 5.5 s at 411 —
+ * Atlas's cost grows faster than the table count) and then apply nothing. The
+ * steps after it still run, because Atlas cannot see what they own. A plan with
+ * anything in it keeps the old flow, including Atlas re-planning at apply time.
+ *
+ * @returns `"synced"` when Atlas was not run again, `"applied"` otherwise.
+ */
+export declare function applyPushPlan(plan: {
+    dryRun: string;
+    rebuildable: number;
+}, steps: PushApplySteps): Promise<"applied" | "synced">;
+/** The one call {@link applyPoliciesFile} needs from a connection. */
+export interface PolicyConnection {
+    query(text: string): Promise<unknown>;
+}
+/** What {@link applyPoliciesFile} stamps, and how to read the definitions back. */
+export interface PolicyStamping {
+    /**
+     * `policyStampSql` of every table whose policies `policies.sql` creates
+     * exactly as the boot would — see {@link stampableTables}.
+     */
+    statements: string[];
+    /**
+     * The `search_path` a boot reads policies under, when the connection's own
+     * differs. A stamp hashes `pg_get_expr`, which spells a function on the
+     * path unqualified: read under `"$user", public` with a `rebase` role, the
+     * boot's `rebase.uid()` prints as `uid()` and no stamp would ever match.
+     */
+    searchPath?: string;
+}
+/**
+ * The tables whose stamp `db push` may write: those every one of whose planned
+ * statements `policies.sql` carries, verbatim.
+ *
+ * A stamp says "this stored definition is what the plan's statement made". It
+ * is only true of a policy the statement *did* make — and since both are
+ * rendered by the same function from the same collections, a table whose
+ * statements are all in the file is one whose policies the file just created.
+ * Anything else (a hand-edited file, a file generated elsewhere) is not
+ * stamped, and the next boot re-applies that table, as before.
+ */
+export declare function stampableTables<T extends {
+    policyStatements: string[];
+}>(plans: readonly T[], policiesSql: string): T[];
+/**
+ * Run `policies.sql`, then stamp the policies it created the way a boot does,
+ * in the same transaction.
+ *
+ * Before stamps the push's policies carried none, so the first boot after
+ * every push re-applied them all — a DROP and a CREATE per policy, an ACCESS
+ * EXCLUSIVE lock per table. Stamped here, that boot finds them current.
+ *
+ * The file runs in one transaction, as it did as one implicit one: a policy
+ * that fails leaves the previous ones in place. The stamps run after it, under
+ * a savepoint: a stamp that cannot be written costs the next boot a re-apply,
+ * which is what it did before, so it is reported and the policies are kept.
+ * Nothing is left set on the connection: `SET LOCAL` ends with the transaction.
+ */
+export declare function applyPoliciesFile(client: PolicyConnection, policiesSql: string, stamping: PolicyStamping): Promise<{
+    stamped: number;
+    stampError?: string;
+}>;

package/dist/cli-scratch-database.d.ts

@@ -8,11 +8,16 @@
  * `db push`: a `--dry-run` that left one behind while saying nothing was
  * applied, and `db generate`, left one per target on the server.
  *
- * Two cases keep it. A command that fails leaves it as the state Atlas was
- * planning against, which is the one thing worth inspecting. And one this
- * process did not create — made by hand, the remedy for a role without
- * `CREATEDB` — is the user's, and dropping it would put them back at the same
- * refusal next time.
+ * It is dropped on every way out of the command: success, a destructive push
+ * the user declined or that had no terminal to ask, and a crash. A crash that
+ * kept it left it for good, because the next push finds it already there and
+ * takes it for one made by hand.
+ *
+ * Two cases keep it. An Atlas run that failed against it leaves the state Atlas
+ * was planning, which is the one thing worth inspecting. And one this process
+ * did not create (made by hand, the remedy for a role without `CREATEDB`) is
+ * the user's, and dropping it would put them back at the same refusal next
+ * time.
  */
 export interface ScratchDatabaseOps {
     /** Create it if it is missing; `true` only when this call created it. */
@@ -22,13 +27,33 @@ export interface ScratchDatabaseOps {
 export declare class ScratchDatabase {
     private readonly ops;
     private created;
+    private keptAsEvidence;
     constructor(ops: ScratchDatabaseOps);
     /** Make sure it exists before an Atlas call that plans against it. */
     ensure(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
+    /** An Atlas run against it failed: keep it, whatever the command does next. */
+    keepAsEvidence(): void;
     /**
-     * Run a command, then drop the scratch database if the command created it.
-     * A command that throws skips the drop; one that exits the process never
-     * returns here, which is the same thing.
+     * Run a command, then drop the scratch database if the command created it,
+     * whether the command returned or threw. A throw after
+     * {@link keepAsEvidence} keeps it. A command that wants to stop with exit 1
+     * throws {@link CommandStopped} rather than calling `process.exit`, which
+     * would skip this.
      */
     around<T>(command: () => Promise<T>): Promise<T>;
+    /** Drop it now if this process created it. Safe to call twice. */
+    release(): Promise<void>;
+}
+/**
+ * A db command stopping with exit 1 after it has said why: a destructive push
+ * the user declined, or one with no terminal to ask on.
+ *
+ * Thrown instead of `process.exit(1)`, so it unwinds through
+ * {@link ScratchDatabase.around} and the scratch database is dropped on the way
+ * out. `alreadyReported` tells `reportCommandFailure` the explanation is on the
+ * terminal already; the entry point sets the exit code.
+ */
+export declare class CommandStopped extends Error {
+    readonly alreadyReported = true;
+    constructor(reason: string);
 }