@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/cli-errors-DsA-K9uP.js

@@ -1,893 +0,0 @@
-import { createRequire as __createRequire } from "module";
-__createRequire(import.meta.url);
-import { n as outError, r as outWarn } from "./cli-output-CNdMql-L.js";
-import { t as chalk } from "./source-Br7L7GOI.js";
-import { declaredErrorAnswer, logger } from "@rebasepro/server";
-import { fieldKeyForColumn, getTableName } from "@rebasepro/common";
-//#region src/utils/pg-error-utils.ts
-/**
-* Shared PostgreSQL error extraction and user-friendly message formatting.
-*
-* Drizzle wraps native PG errors in a `.cause` chain. These utilities
-* unwrap that chain to get the real PostgreSQL error (identified by a
-* 5-character alphanumeric `code` such as `42P01`) and translate it into
-* a message that is safe and helpful to show to end-users.
-*/
-/**
-* Return the error when it is a deliberate 4xx, otherwise null.
-*
-* A thrown `ApiError` is a decision the server made about the request, not a
-* database failure: its message and code are already written for the client.
-*
-* So is a `RebaseApiError` — what a collection callback throws, since a
-* collection file cannot import the server package. It spells its status
-* `status`, and reading only `statusCode` here turned an `afterRead` that
-* refused with a 403 into "Could not load data … Check server logs" on a
-* subscription, where REST and the socket's own requests answer the 403.
-* Recognised by the predicate those doors use, `declaredErrorAnswer`.
-*/
-function asClientFacingError(error) {
-	const answer = declaredErrorAnswer(error);
-	if (answer) {
-		if (answer.status < 400 || answer.status >= 500) return null;
-		return {
-			statusCode: answer.status,
-			code: answer.code,
-			message: answer.message,
-			expected: answer.expected
-		};
-	}
-	if (!(error instanceof Error)) return null;
-	const e = error;
-	if (typeof e.statusCode !== "number" || e.statusCode < 400 || e.statusCode >= 500) return null;
-	return e;
-}
-/**
-* Extract the underlying PostgreSQL error from a Drizzle wrapper.
-* Drizzle wraps PG errors in a `cause` property — this function
-* recursively walks the chain until it finds an object with a PG
-* error code (5-char alphanumeric, e.g. `42P01`).
-*/
-function extractPgError(error) {
-	if (!error || typeof error !== "object") return null;
-	if (!(error instanceof Error)) {
-		if ("cause" in error && error.cause && typeof error.cause === "object") return extractPgError(error.cause);
-		return null;
-	}
-	if ("code" in error && typeof error.code === "string" && /^[0-9A-Z]{5}$/.test(error.code)) return error;
-	if (error.cause && typeof error.cause === "object") return extractPgError(error.cause);
-	return null;
-}
-/**
-* Whether the failure came back from Postgres rather than from building the
-* query — which decides whether a fallback query is worth issuing.
-*
-* Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
-* RLS). Once a statement raises, that transaction is aborted, and every later
-* statement on it returns `25P02` — "current transaction is aborted, commands
-* ignored until end of transaction block". So a retry after a database error
-* cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
-* for type uuid") with a generic one. Rethrow instead.
-*
-* A query the driver could not even build — a missing reciprocal relation, say
-* — never reached Postgres, leaves the transaction usable, and is exactly what
-* the fallback paths exist for.
-*/
-function reachedDatabase(error) {
-	return extractPgError(error) !== null;
-}
-/**
-* Walk the error cause chain and return the deepest meaningful message.
-*/
-function extractCauseMessage(error) {
-	if (!error || typeof error !== "object") return null;
-	if (!(error instanceof Error)) return null;
-	if (error.cause && typeof error.cause === "object") {
-		const deeper = extractCauseMessage(error.cause);
-		if (deeper) return deeper;
-		if (error.cause instanceof Error && error.cause.message) return error.cause.message;
-	}
-	return null;
-}
-/**
-* Codes that mean "this connection will never work as configured".
-*
-* A wrong password or a database that does not exist is a settled fact about
-* the connection string, not a transient fault — retrying produces the same
-* answer forever.
-*/
-var UNRECOVERABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
-	"28P01",
-	"28000",
-	"3D000",
-	"42501"
-]);
-/**
-* Describe a failed connection attempt in terms a developer can act on.
-*
-* The error a caller catches is Drizzle's wrapper: its message is
-* `Failed query: SELECT 1` and its stack runs through drizzle internals, while
-* the sentence that says what is actually wrong — "password authentication
-* failed for user …", "database … does not exist" — sits in `.cause`. Logging
-* the wrapper, as the bootstrapper used to, tells a developer with a typo in
-* their `DATABASE_URL` nothing at all.
-*/
-function classifyConnectFailure(error) {
-	const pgError = extractPgError(error);
-	const reason = pgError?.message ?? extractCauseMessage(error) ?? (error instanceof Error ? error.message : String(error));
-	return {
-		fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
-		reason,
-		code: pgError?.code
-	};
-}
-/**
-* Detect whether an error is specifically a role-switching permission failure
-* (e.g. "permission denied to set role" or "must be member of role"),
-* as opposed to a table-level permission denial.
-*
-* This is used by the backend driver to auto-disable role switching when the
-* connection user lacks SET ROLE privileges, rather than surfacing a confusing
-* error to the Studio SQL Editor user.
-*/
-function isRoleSwitchingPermissionError(error) {
-	const pgError = extractPgError(error);
-	if (!pgError || pgError.code !== "42501") return false;
-	const msg = pgError.message.toLowerCase();
-	return msg.includes("set role") || msg.includes("member of role");
-}
-/**
-* Was this `42501` the *caller* being refused by a policy, rather than the
-* server lacking a privilege?
-*
-* Both arrive as `insufficient_privilege`, and they are opposite kinds of
-* problem. A row-level-security refusal is a working access-control system
-* doing its job: the caller asked for something their policies do not permit,
-* which is a 403 and nobody's bug. A missing `GRANT` is the deployment being
-* wrong — the connection role cannot touch the table at all, no policy is
-* involved, and nothing the caller changes about the request will help.
-*
-* Postgres distinguishes them in the message, so this does too:
-*
-*     new row violates row-level security policy for table "notes"  → the caller
-*     permission denied for table notes                             → the server
-*
-* Only writes reach this. A read that RLS excludes is not an error — the rows
-* are filtered and the caller gets an empty page — so the erroring case is
-* specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.
-*
-* Matched on the message because that is the only thing carrying the
-* distinction; the SQLSTATE is identical either way. Narrow by design: anything
-* not naming row-level security stays the server's problem, since reporting a
-* genuine privilege misconfiguration as "forbidden" would send an operator
-* hunting for a policy bug that does not exist.
-*/
-function isRowLevelSecurityDenial(error) {
-	const pgError = extractPgError(error);
-	if (!pgError || pgError.code !== "42501") return false;
-	return pgError.message.toLowerCase().includes("row-level security policy");
-}
-/**
-* The physical column names a Postgres error is about.
-*
-* Postgres puts one in `column` for `23502` and nowhere else, so the rest are
-* read out of the two places that do carry them:
-*
-* - `detail` — `Key (author_id)=(9) is not present in table "authors".` and
-*   `Key (email, tenant_id)=(…) already exists.` Only the parenthesised column
-*   list is read; the values after `=` are never touched.
-* - `constraint` — `users_email_key`, `posts_author_id_fkey`. The table prefix
-*   and the constraint suffix are stripped, leaving the columns joined by `_`,
-*   which is ambiguous for multi-column constraints and is therefore only used
-*   when `detail` gave nothing.
-*
-* `22P02` carries neither, because an invalid literal fails during parse rather
-* than against a constraint. Its message names the *type*, and an enum type is
-* generated as `<table>_<column>` — which is the one case worth decoding,
-* because a value outside an enum's labels is the most common 22P02 anyone
-* hits and the least legible one.
-*/
-function offendingColumns(pgError, collection) {
-	if (pgError.column) return [pgError.column];
-	const detail = pgError.detail;
-	if (detail) {
-		const keyed = /Key \(([^)]+)\)=/.exec(detail);
-		if (keyed) return keyed[1].split(",").map((part) => part.trim().replace(/^"|"$/g, "")).filter(Boolean);
-	}
-	if (pgError.code === "22P02") {
-		const enumType = /invalid input value for enum ([^:\s]+)/i.exec(pgError.message ?? "");
-		if (enumType && collection) {
-			const typeName = enumType[1].replace(/^.*\./, "").replace(/"/g, "");
-			const table = getTableName(collection);
-			if (typeName.startsWith(`${table}_`)) return [typeName.slice(table.length + 1)];
-		}
-		return [];
-	}
-	const constraint = pgError.constraint;
-	if (constraint && collection) {
-		const table = getTableName(collection);
-		const stripped = constraint.replace(new RegExp(`^${table}_`), "").replace(/_(pkey|key|fkey|unique|check|excl|idx)$/, "");
-		if (stripped && stripped !== constraint) {
-			const columns = /* @__PURE__ */ new Set();
-			for (const [key, prop] of Object.entries(collection.properties ?? {})) columns.add(prop?.columnName ?? key);
-			if (columns.has(stripped)) return [stripped];
-			const wire = fieldKeyForColumn(collection, stripped);
-			if (collection.properties && wire in collection.properties) return [stripped];
-		}
-	}
-	return [];
-}
-/**
-* The fields a Postgres error is about, for `details.violations`.
-*
-* Only the four SQLSTATEs that describe *the caller's data*: a missing value, a
-* duplicate, a bad literal, a foreign key pointing at nothing. Everything else
-* — a dropped connection, a missing table, a privilege problem — is the
-* deployment's, and naming a field for it would send the reader to the wrong
-* place.
-*
-* Empty when the collection is unknown or the column cannot be recovered. An
-* empty list is the honest answer; inventing a field is worse than saying
-* nothing, because a form will mark the wrong input red.
-*/
-function pgFieldViolations(pgError, collection) {
-	const code = pgError.code;
-	if (code !== "23502" && code !== "23505" && code !== "22P02" && code !== "23503") return [];
-	if (!collection) return [];
-	const columns = offendingColumns(pgError, collection);
-	if (columns.length === 0) return [];
-	return columns.map((column) => ({
-		field: fieldKeyForColumn(collection, column),
-		code
-	}));
-}
-/**
-* Translate a raw PostgreSQL error into a user-friendly message.
-*
-* @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
-* @param context  - A human-readable context string (e.g. collection slug or path)
-* @returns An object with a `message` safe for the client and the PG `code`.
-*/
-function pgErrorToFriendlyMessage(pgError, context, options = {}) {
-	const verbose = options.verbose ?? process.env.NODE_ENV !== "production";
-	const detail = verbose ? pgError.detail : void 0;
-	const hint = verbose ? pgError.hint : void 0;
-	const constraint = pgError.constraint;
-	const column = pgError.column;
-	const table = pgError.table;
-	const dataType = verbose ? pgError.dataType : void 0;
-	const rawMessage = pgError.message || "Unknown database error";
-	const pgMessage = verbose ? rawMessage : "";
-	const code = pgError.code || "UNKNOWN";
-	const violations = pgFieldViolations(pgError, options.collection);
-	const suffix = hint ? ` Hint: ${hint}` : "";
-	const tableRef = table ?? context;
-	/** `": <postgres said>"`, or nothing when the details are withheld. */
-	const said = pgMessage ? `: ${pgMessage}` : "";
-	switch (pgError.code) {
-		case "23503": return {
-			message: detail ? `Foreign key constraint violated: ${detail}${suffix}` : `Cannot complete operation: a foreign key constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
-			code,
-			violations
-		};
-		case "23001": return {
-			message: `Cannot complete operation: rows in "${table ?? "another table"}" still reference this row in "${context}", and their foreign key${constraint ? ` (${constraint})` : ""} does not allow it to be deleted or its key changed. Delete or reassign those rows first.${detail ? ` ${detail}` : ""}${suffix}`,
-			code,
-			violations
-		};
-		case "23505": return {
-			message: detail ? `Duplicate value: ${detail}${suffix}` : `Cannot complete operation: a unique constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
-			code,
-			violations
-		};
-		case "23502": return {
-			message: `Missing required field: "${violations[0]?.field ?? column ?? "unknown"}" in "${tableRef}" cannot be empty.${suffix}`,
-			code,
-			violations
-		};
-		case "23514": return {
-			message: `Validation failed: a check constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
-			code,
-			violations
-		};
-		case "22P02": return {
-			message: `Invalid data format in "${context}"${said}.${suffix}`,
-			code,
-			violations
-		};
-		case "22001": return {
-			message: `Value too long for column "${column ?? "unknown"}" in "${tableRef}"${said}.${suffix}`,
-			code,
-			violations
-		};
-		case "22003": return {
-			message: `Numeric value out of range for column "${column ?? "unknown"}" in "${tableRef}"${said}.${suffix}`,
-			code,
-			violations
-		};
-		case "42703": return {
-			message: `Unknown column in "${tableRef}"${said}. Check if your schema is up to date (run migrations).${suffix}`,
-			code,
-			violations
-		};
-		case "42P01": return {
-			message: `Table not found for "${context}"${said}. Check if your schema is up to date (run migrations).${suffix}`,
-			code,
-			violations
-		};
-		case "42501": return rawMessage.toLowerCase().includes("row-level security policy") ? {
-			message: `Not permitted to write this row in "${tableRef}": it does not satisfy the row-level security policy.${suffix}`,
-			code,
-			violations
-		} : {
-			message: `Permission denied on "${tableRef}": the database role this server connects as lacks privileges on it.${suffix}`,
-			code,
-			violations
-		};
-		case "28000": return {
-			message: `Authorization failed for "${context}". Check your database credentials.${suffix}`,
-			code,
-			violations
-		};
-		default: {
-			const parts = [`Database error in "${context}" [${code}]${said}`];
-			if (detail) parts.push(`Detail: ${detail}`);
-			if (column) parts.push(`Column: ${column}`);
-			if (dataType) parts.push(`Data type: ${dataType}`);
-			if (constraint) parts.push(`Constraint: ${constraint}`);
-			if (hint) parts.push(`Hint: ${hint}`);
-			return {
-				message: parts.join(". "),
-				code,
-				violations
-			};
-		}
-	}
-}
-/**
-* Sanitize any error into a message safe and helpful for the client.
-*
-* A deliberate 4xx (`ApiError`) passes through untouched — the server already
-* decided what the client should read. Otherwise the PG error is extracted
-* from the Drizzle cause chain, falling back to a generic message that
-* doesn't leak SQL.
-*
-* @param error   - The raw caught error
-* @param context - A human-readable context string (e.g. collection path)
-* @returns An object with `message` (user-friendly) and optional `code`
-*          (the `ApiError` code, or the PG SQLSTATE).
-*/
-function sanitizeErrorForClient(error, context, options = {}) {
-	const clientError = asClientFacingError(error);
-	if (clientError) {
-		const line = `[API ${clientError.statusCode} ${clientError.code ?? "BAD_REQUEST"}] in "${context}": ${clientError.message}`;
-		if (clientError.expected) logger.debug(line);
-		else logger.warn(`⚠️ ${line}`);
-		return {
-			message: clientError.message,
-			...clientError.code && { code: clientError.code }
-		};
-	}
-	const pgError = extractPgError(error);
-	if (pgError) {
-		logger.error(`[PG ${pgError.code}] Error in "${context}"`, {
-			code: pgError.code,
-			message: pgError.message,
-			detail: pgError.detail,
-			hint: pgError.hint,
-			column: pgError.column,
-			table: pgError.table,
-			constraint: pgError.constraint,
-			dataType: pgError.dataType
-		});
-		const { message, code, violations } = pgErrorToFriendlyMessage(pgError, context, { collection: options.collection });
-		return {
-			message,
-			code,
-			...violations.length > 0 && { violations }
-		};
-	}
-	logger.error(`Database error in "${context}" (no PG error extracted)`, {
-		error: error instanceof Error ? error.message : String(error),
-		stack: error instanceof Error ? error.stack : void 0,
-		cause: error instanceof Error && error.cause ? error.cause instanceof Error ? error.cause.message : String(error.cause) : void 0
-	});
-	const causeMessage = extractCauseMessage(error);
-	if (causeMessage) return { message: `Database error in "${context}": ${causeMessage}` };
-	return { message: `Could not load data for "${context}". Check server logs for details.` };
-}
-//#endregion
-//#region src/cli-errors.ts
-/**
-* Detect whether an error (or AggregateError wrapping multiple attempts)
-* represents an ECONNREFUSED — i.e. the database is simply not running.
-*
-* Handles:
-* - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
-* - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
-* - Drizzle's `cause`-wrapped pg errors
-*/
-function isEconnrefused(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (e.code === "ECONNREFUSED") return true;
-	if (Array.isArray(e.errors)) return e.errors.some((inner) => inner && typeof inner === "object" && inner.code === "ECONNREFUSED");
-	if (e.cause && typeof e.cause === "object") return isEconnrefused(e.cause);
-	return false;
-}
-/**
-* Detect PostgreSQL authentication failures.
-* PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)
-*/
-function isAuthFailure(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (e.code === "28P01" || e.code === "28000") return true;
-	if (e.cause && typeof e.cause === "object") return isAuthFailure(e.cause);
-	if ("message" in e && typeof e.message === "string") {
-		const msg = e.message.toLowerCase();
-		if (msg.includes("password authentication failed") || msg.includes("no pg_hba.conf entry")) return true;
-	}
-	return false;
-}
-/**
-* Detect the "SSL is not enabled on the server" failure — the client attempted
-* an SSL handshake against a Postgres server that doesn't support it (common
-* with a plain local dev database). The fix is `?sslmode=disable` on the URL.
-*/
-function isSslNotEnabled(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (typeof e.message === "string" && e.message.toLowerCase().includes("ssl is not enabled on the server")) return true;
-	if (e.cause && typeof e.cause === "object") return isSslNotEnabled(e.cause);
-	return false;
-}
-/**
-* Detect PostgreSQL "cannot drop ... because other objects depend on it"
-* (error code 2BP01, dependent_objects_still_exist). This is the failure that
-* strands a declarative `db push` half-applied when a collection is removed but
-* an enum type it defined is still referenced by another object.
-*/
-function isDependencyDropError(err) {
-	if (!err || typeof err !== "object") return false;
-	const e = err;
-	if (e.code === "2BP01") return true;
-	if (typeof e.message === "string") {
-		const msg = e.message.toLowerCase();
-		if (msg.includes("other objects depend on it") || msg.includes("cannot drop type")) return true;
-	}
-	if (e.cause && typeof e.cause === "object") return isDependencyDropError(e.cause);
-	return false;
-}
-/**
-* Parse host:port from a DATABASE_URL for display purposes.
-*
-* Exported because every message about a connection has to name the thing it
-* could not reach, and the boot path needs the same rendering the CLI banners
-* use — including the same refusal to print the URL itself, which carries the
-* password.
-*/
-function parseHostInfo(databaseUrl) {
-	try {
-		const parsed = new URL(databaseUrl);
-		return `${parsed.hostname}:${parsed.port || 5432}`;
-	} catch {
-		return "unknown";
-	}
-}
-/**
-* The sentence the operating system actually produced, dug out of the wrappers.
-*
-* `connect ECONNREFUSED 127.0.0.1:5432` is written by `net`, then wrapped by
-* `pg`, then wrapped again by Drizzle as `Failed query: …` — and on a
-* dual-stack host it is not in `.cause` at all but inside the
-* `AggregateError.errors` array of one attempt per resolved address. Printing
-* the banner without it loses the one token every search engine, runbook and
-* colleague recognises.
-*/
-function deepestErrorMessage(err) {
-	if (!err || typeof err !== "object") return null;
-	const e = err;
-	if (Array.isArray(e.errors)) for (const inner of e.errors) {
-		const deeper = deepestErrorMessage(inner);
-		if (deeper) return deeper;
-	}
-	if (e.cause) {
-		const deeper = deepestErrorMessage(e.cause);
-		if (deeper) return deeper;
-	}
-	if (typeof e.message === "string" && e.message && !e.message.startsWith("Failed query:")) return e.code ? `${e.message} (${e.code})` : e.message;
-	return null;
-}
-/** One indented line naming the driver's own reason, or nothing. */
-function driverReasonLine(err) {
-	const reason = err === void 0 ? null : deepestErrorMessage(err);
-	return reason ? `  The driver said: ${reason}\n\n` : "";
-}
-/**
-* Format a diagnostic banner for ECONNREFUSED errors.
-*/
-function formatConnectionRefusedBanner(databaseUrl, err) {
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Cannot connect to PostgreSQL at ${parseHostInfo(databaseUrl)}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + "  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • docker compose up -d db          (the service a Rebase scaffold ships)\n    • brew services start postgresql@18\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
-}
-/**
-* Format a diagnostic banner for authentication failures.
-*/
-function formatAuthFailureBanner(databaseUrl, err) {
-	const hostInfo = parseHostInfo(databaseUrl);
-	let username = "unknown";
-	try {
-		username = new URL(databaseUrl).username || "unknown";
-	} catch {}
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Authentication failed for user "${username}" at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + `  PostgreSQL rejected the credentials. Common fixes:
-
-    • Check the username and password in DATABASE_URL
-    • Verify the user exists:  psql -c "\\du"
-    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/**
-* Format a diagnostic banner for "SSL is not enabled on the server".
-*/
-function formatSslNotEnabledBanner(databaseUrl) {
-	const hostInfo = parseHostInfo(databaseUrl);
-	const suggestion = databaseUrl.includes("?") ? "&sslmode=disable" : "?sslmode=disable";
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  SSL is not enabled on the PostgreSQL server at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  The client tried to connect over SSL, but the server does not\n  support it. This is normal for a plain local dev database.\n\n  Fix: append ${chalk.bold("sslmode=disable")} to DATABASE_URL, e.g.\n\n    DATABASE_URL=...${suggestion}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/**
-* Format a diagnostic banner for a dependency-drop failure during `db push`.
-* Explains that the database may be left partially migrated and how to recover.
-*/
-function formatDependencyDropBanner() {
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Schema push failed: a type/table could not be dropped
-      because other objects still depend on it.
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-  ${chalk.yellow("The database may now be partially migrated.")} Atlas applies\n  statements individually, so earlier changes in this push may\n  already be committed while later ones failed.\n\n  This commonly happens when a collection is removed but an enum\n  type it defined is still referenced. To recover:\n\n    1. Inspect the leftover object named in the error above.\n    2. Drop it with CASCADE, e.g.:\n         psql "$DATABASE_URL" -c 'DROP TYPE "<name>" CASCADE;'\n    3. Re-run:  ${chalk.bold.green("rebase db push")}\n\n  Prefer a safe, versioned workflow? Use ${chalk.bold("rebase db generate")}\n  + ${chalk.bold("rebase db migrate")} instead of push for destructive changes.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/**
-* Pre-flight check: verify that the database is reachable before running
-* a heavy subprocess (Atlas, migrations, etc.).
-*
-* Exits with code 1 and a friendly banner on known failure modes.
-* On unknown errors, logs a warning and allows the caller to proceed.
-*/
-async function checkDatabaseConnectivity(databaseUrl) {
-	let client;
-	try {
-		const { Client } = await import("pg");
-		client = new Client({
-			connectionString: databaseUrl,
-			connectionTimeoutMillis: 5e3
-		});
-		await client.connect();
-		await client.query("SELECT 1");
-	} catch (err) {
-		if (isEconnrefused(err)) {
-			outError(formatConnectionRefusedBanner(databaseUrl, err));
-			process.exit(1);
-		}
-		if (isAuthFailure(err)) {
-			outError(formatAuthFailureBanner(databaseUrl, err));
-			process.exit(1);
-		}
-		if (isSslNotEnabled(err)) {
-			outError(formatSslNotEnabledBanner(databaseUrl));
-			process.exit(1);
-		}
-		outWarn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
-		outWarn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
-	} finally {
-		try {
-			await client?.end();
-		} catch {}
-	}
-}
-/**
-* Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).
-* Returns a formatted diagnostic string if the error matches a known pattern,
-* or null if unrecognized.
-*/
-function diagnoseDbError(err, databaseUrl) {
-	if (isEconnrefused(err)) return formatConnectionRefusedBanner(databaseUrl || "", err);
-	if (isAuthFailure(err)) return formatAuthFailureBanner(databaseUrl || "", err);
-	if (isSslNotEnabled(err)) return formatSslNotEnabledBanner(databaseUrl || "");
-	if (isDependencyDropError(err)) return formatDependencyDropBanner();
-	return null;
-}
-/**
-* Say why the command failed, on the way out.
-*
-* The entry point below used to be `.catch(() => process.exit(1))`, which threw
-* the error away. Every message this file and its services raise — "Branch
-* \"x\" already exists.", "the source database has active connections", "Branch
-* name is too long" — was written, wrapped in the right PG error code, and then
-* discarded one frame before it reached a terminal. What a developer saw was a
-* header line, no error, and exit 1.
-*
-* Two shapes are deliberately kept quiet:
-*
-* - **A child process that already spoke.** Atlas, `pg_dump` and `psql` run
-*   with inherited stdio, so their diagnosis is on the terminal already and
-*   execa's wrapper adds only `Command failed with exit code 1: atlas …`.
-*   `packages/cli` filters exactly these two phrasings one level up
-*   (`runDbCommand`), and this is that filter, for the process that is actually
-*   throwing.
-*
-* - **A message that is only a query.** Drizzle reports failures as
-*   `Failed query: <sql> params:` and hides the real PostgreSQL error in
-*   `cause`, so the wrapper alone tells a reader nothing they can act on. The
-*   cause is appended when it says something the message does not.
-*
-* - **An error that has already printed its own diagnosis**, marked
-*   `alreadyReported`. `CollectionsPathMissing` is one: it prints the path, what
-*   it resolved to and the cwd it resolved against, and then throws so the entry
-*   point owns the exit code. Repeating its one-line summary underneath would
-*   undo the "printed once" this whole path exists for.
-*/
-function reportCommandFailure(error) {
-	const message = error instanceof Error ? error.message : String(error ?? "");
-	if (error?.alreadyReported) return;
-	if (!message || /Command failed|exited with code/i.test(message)) return;
-	outError("");
-	outError(chalk.red(`  ✗ ${message}`));
-	const cause = extractCauseMessage(error);
-	if (cause && !message.includes(cause)) outError(chalk.gray(`    ${cause}`));
-	outError("");
-}
-/**
-* `migrate apply` refusing because the database already has the schema.
-*
-* `42710` (duplicate_object) and `42P07` (duplicate_table) are what a migration
-* hits when boot-ensure — or a `db push` — has already provisioned the objects
-* it was going to create. Since boot-ensure provisions *every* production
-* database, this is the normal case rather than the exotic one, and the raw
-* failure (`pq: type "posts_status" already exists (42710)`, then `sql/migrate:
-* write revision: … current transaction is aborted`) names no way forward.
-*/
-function parseAlreadyProvisioned(text) {
-	const withCode = /(?:type|relation|constraint|schema) "([^"]+)" already exists \((42710|42P07)\)/.exec(text);
-	if (withCode) return {
-		object: withCode[1],
-		code: withCode[2]
-	};
-	const bare = /(?:type|relation|constraint|schema) "([^"]+)" already exists/.exec(text);
-	if (bare && /42710|42P07/.test(text)) return {
-		object: bare[1],
-		code: /42P07/.test(text) ? "42P07" : "42710"
-	};
-	return null;
-}
-/**
-* What to do about it: tell Atlas the database is already at a version.
-*
-* Atlas's own mechanism (`migrate apply --baseline <version>`), not a ledger of
-* ours — it writes the revision row Atlas reads, so every later `rebase db
-* migrate` is an ordinary one.
-*/
-function formatBaselineRemedy(version, object) {
-	const versionToken = version ?? "<version>";
-	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  This database already has the schema this migration creates\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + (object ? `  ${chalk.gray(`"${object}" is already there, so the migration cannot create it.`)}\n\n` : "") + `  Nothing is wrong with the migration — the database was provisioned\n  another way. Every Rebase boot ensures the schema, and ${chalk.bold("rebase db push")}\n  applies it directly, so a database that has ever run either one is\n  ahead of a migration history that was never recorded.\n\n  Record where it already is, then migrate normally:\n\n    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\n    ${chalk.bold.green("rebase db migrate")}\n\n  The baseline is the version already applied — the numeric prefix of\n  the migration file describing what is in the database now. Migrations\n  after it run; it and everything before it are marked done.\n\n  On a database nothing has ever booted against, none of this is needed.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */
-function parseNotNullViolation(text) {
-	const match = /column "([^"]+)" of relation "([^"]+)" contains null values/.exec(text);
-	return match ? {
-		table: match[2],
-		column: match[1]
-	} : null;
-}
-/**
-* The three ways out, because there is no fourth.
-*
-* Boot-ensure handles this case — it adds the column nullable and sets NOT NULL
-* only when the table is empty — so a push that dies here is strictly worse
-* than the boot that would have run instead, and the developer deserves to be
-* told which of the three they want rather than left with `pq: … contains null
-* values (23502)` and no next step.
-*/
-function formatNotNullViolationBanner(violation, rowCount) {
-	const { table, column } = violation;
-	const rows = rowCount === null ? `  "${table}" already holds rows, and none of them has a value for "${column}".\n` : `  "${table}" already holds ${rowCount} row${rowCount === 1 ? "" : "s"}, and they have no value for "${column}".\n`;
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Cannot make "${table}"."${column}" required: existing rows are null\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + rows + `  PostgreSQL will not add the NOT NULL until every one of them does.
-
-  Three ways forward:
-
-    1. Give the property a default, so the push can backfill:
-         ${chalk.gray(`{ type: "string", defaultValue: "…", validation: { required: true } }`)}\n    2. Backfill by hand first, then push again:\n         ${chalk.gray(`psql "$DATABASE_URL" -c 'UPDATE "${table}" SET "${column}" = … WHERE "${column}" IS NULL;'`)}\n    3. Leave it optional — take \`validation.required\` off the property.\n\n  ${chalk.gray("Nothing was applied for this column. `rebase dev` would have added it")}\n  ${chalk.gray("nullable instead: boot sets NOT NULL only when it is safe.")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */
-function parseEnumLabelDrop(text) {
-	const match = /dropping (?:enum )?value "([^"]+)" from enum "([^"]+)" is not supported/.exec(text);
-	return match ? {
-		label: match[1],
-		enumType: match[2]
-	} : null;
-}
-/**
-* Why the two paths disagree, and what retiring an option id actually costs.
-*
-* Boot-ensure adds enum labels and never removes one, so `rebase dev` accepts
-* the very edit that stops `db push` dead. PostgreSQL has no `ALTER TYPE …
-* DROP VALUE`: a label goes only by rewriting the type, which is a data
-* migration and not a schema push.
-*/
-function formatEnumLabelDropBanner(drop) {
-	const { label, enumType } = drop;
-	return `
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  "${label}" cannot be removed from the enum "${enumType}"\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n  PostgreSQL has no ALTER TYPE … DROP VALUE. An option id can be added\n  to an enum but never taken out of one, so renaming an id reads as a\n  removal and a push cannot carry it.\n\n  ${chalk.yellow("Nothing was applied.")} ${chalk.bold("rebase dev")} accepts this same edit — boot adds\n  new labels and never removes one — so the two paths disagree by\n  design, and the old label would simply have stayed behind, unused.\n\n  To keep the id: put "${label}" back and change only its label text.\n\n  To retire it for real, it is a data migration:\n\n    1. Add the new id alongside the old one, and push.\n    2. Move the rows:  ${chalk.gray(`UPDATE … SET … = '<new>' WHERE … = '${label}';`)}\n    3. Rewrite the type, which is what actually drops the label:\n       ${chalk.gray("rebase db generate retire_option && rebase db migrate")}\n       ${chalk.gray("(a migration can CREATE TYPE …, ALTER TABLE … TYPE … USING, DROP TYPE)")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/**
-* The statement Atlas was running when it failed, unescaped.
-*
-* Two spellings, one per phase: the apply quotes it
-* (`executing statement "ALTER TABLE \"public\".\"people\" …;": pq: …`), and
-* the dry-run's analysis does not
-* (`analyzing plan: executing statement: ALTER TABLE "public"."people" …;: pq: …`).
-*/
-function parseFailedStatement(text) {
-	const quoted = /executing statement "((?:[^"\\]|\\.)*)"/.exec(text);
-	if (quoted) return quoted[1].replace(/\\(.)/g, "$1");
-	const bare = /executing statement: ([\s\S]*?;): pq:/.exec(text);
-	return bare ? bare[1] : null;
-}
-/** `ALTER TABLE "public"."people" …` → `{ schema: "public", table: "people" }`. */
-function failedStatementTable(statement) {
-	const ident = String.raw`(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))`;
-	const match = new RegExp(String.raw`^\s*(?:ALTER\s+TABLE|CREATE\s+UNIQUE\s+INDEX\s+\S+\s+ON)\s+(?:ONLY\s+)?${ident}(?:\.${ident})?`, "i").exec(statement);
-	if (!match) return null;
-	const first = (match[1] ?? match[2]).replace(/""/g, "\"");
-	const second = match[3] ?? match[4];
-	return second === void 0 ? { table: first } : {
-		schema: first,
-		table: second.replace(/""/g, "\"")
-	};
-}
-/**
-* PostgreSQL refusing to retype a column a `GENERATED ALWAYS AS … STORED`
-* expression reads (0A000). `db push` moves Rebase's own search columns out of
-* the way before the apply; this is what is left when it could not.
-*/
-function parseGeneratedColumnRefusal(text) {
-	if (!/cannot alter type of a column used by a generated column/.test(text)) return null;
-	return { statement: parseFailedStatement(text) };
-}
-/**
-* Which generated columns read a column the failed statement retypes — read
-* from the catalogue, because PostgreSQL's DETAIL naming them does not survive
-* Atlas.
-*/
-async function generatedColumnsBlocking(databaseUrl, statement) {
-	if (!databaseUrl || !statement) return [];
-	const target = failedStatementTable(statement);
-	if (!target) return [];
-	const retyped = [...statement.matchAll(/ALTER\s+(?:COLUMN\s+)?"((?:[^"]|"")+)"\s+(?:SET\s+DATA\s+)?TYPE\b/gi)].map((match) => match[1].replace(/""/g, "\""));
-	if (retyped.length === 0) return [];
-	try {
-		const { Client } = await import("pg");
-		const client = new Client({
-			connectionString: databaseUrl,
-			connectionTimeoutMillis: 5e3
-		});
-		await client.connect();
-		try {
-			return (await client.query(`
-                SELECT n.nspname AS "schema", c.relname AS "table", gen.attname AS "column", dep.attname AS "reads"
-                FROM pg_attrdef ad
-                JOIN pg_class c       ON c.oid = ad.adrelid
-                JOIN pg_namespace n   ON n.oid = c.relnamespace
-                JOIN pg_attribute gen ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum
-                JOIN pg_depend d      ON d.classid = 'pg_attrdef'::regclass AND d.objid = ad.oid
-                                     AND d.refclassid = 'pg_class'::regclass AND d.refobjid = ad.adrelid
-                JOIN pg_attribute dep ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid
-                WHERE gen.attgenerated <> '' AND c.relname = $1
-                  AND ($2::text IS NULL OR n.nspname = $2) AND dep.attname = ANY($3::text[])
-                ORDER BY 1, 2, 3, 4`, [
-				target.table,
-				target.schema ?? null,
-				retyped
-			])).rows;
-		} finally {
-			await client.end();
-		}
-	} catch {
-		return [];
-	}
-}
-/**
-* What to do when a generated column stops a retype.
-*
-* A collection's own search column should never reach this — `db push` drops
-* it before the apply and rebuilds it after — so seeing one named here means
-* that machinery missed it, which is a bug worth a report. Any other generated
-* column is somebody's, with an expression Rebase holds no copy of.
-*/
-function formatGeneratedColumnRefusalBanner(refusal, blockers) {
-	const named = blockers.length > 0 ? blockers.map((b) => `    ${chalk.bold(`${b.schema}.${b.table}.${b.column}`)} reads "${b.reads}"`).join("\n") + "\n\n" : refusal.statement ? `  The statement:\n    ${chalk.gray(refusal.statement.replace(/\s+/g, " "))}\n\n` : "";
-	const first = blockers[0];
-	const drop = first ? `ALTER TABLE "${first.schema}"."${first.table}" DROP COLUMN "${first.column}";` : "ALTER TABLE … DROP COLUMN <the generated column>;";
-	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  A generated column reads a column this push retypes\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + named + `  PostgreSQL will not retype a column while a GENERATED ALWAYS AS …
-  STORED expression reads it, and Atlas applies a push as one
-  transaction — ${chalk.yellow("nothing in this push was applied.")}\n\n  A collection's ${chalk.bold("search")} column is dropped and rebuilt around the apply\n  by the push itself. If that is the column named above, run the push\n  again, and please report it: it should not have got this far.\n\n  Any other generated column is yours. Drop it, push, and put it back\n  with its original expression:\n\n    ${chalk.gray(drop)}\n    ${chalk.gray("rebase db push")}\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/** How many rows a table holds, or `null` when we cannot say. */
-async function countRows(databaseUrl, table) {
-	if (!databaseUrl) return null;
-	try {
-		const { Client } = await import("pg");
-		const client = new Client({
-			connectionString: databaseUrl,
-			connectionTimeoutMillis: 5e3
-		});
-		await client.connect();
-		try {
-			return (await client.query(`SELECT count(*)::int AS n FROM "${table.replace(/"/g, "\"\"")}"`)).rows[0]?.n ?? null;
-		} finally {
-			await client.end();
-		}
-	} catch {
-		return null;
-	}
-}
-/**
-* A hand-written generated column reading a column the plan wants to retype or
-* drop.
-*
-* Rebase's own generated columns are dropped and rebuilt around the apply — it
-* holds their definition in `search.sql`. This one it does not: PostgreSQL
-* stores a generated expression only in the catalogue, so dropping it to let
-* the apply through would destroy the only copy. Refuse instead, and say what
-* the operator can do about it.
-*/
-function formatForeignGeneratedColumnBanner(conflicts) {
-	const lines = conflicts.map((c) => {
-		const reads = c.blocking.map((b) => `"${b.column}"`).join(", ");
-		return `    ${chalk.bold(`${c.schema}.${c.table}.${c.column}`)} reads ${reads}`;
-	});
-	const first = conflicts[0];
-	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  A generated column depends on a column this push changes\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + lines.join("\n") + `
-
-  PostgreSQL refuses to retype or drop a column while a GENERATED
-  ALWAYS AS … STORED expression reads it, and an Atlas apply is one
-  transaction — so this refusal would roll back every other statement
-  in the push with it.
-
-  ${chalk.yellow("Nothing was applied.")} Rebase rebuilds the generated columns it made\n  itself (a collection's ${chalk.bold("search")} block) around the apply. It has no\n  definition for this one, and a dropped generated expression is not\n  recoverable from anywhere but your own migration.\n\n  Drop it, push, and put it back:\n\n    ${chalk.gray(`ALTER TABLE "${first.schema}"."${first.table}" DROP COLUMN "${first.column}";`)}\n    ${chalk.gray("rebase db push")}\n    ${chalk.gray("-- then re-create the column with its original expression")}\n\n  Or declare it through a ${chalk.bold("search")} block, and Rebase will own it.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
-}
-/**
-* The remedy for an Atlas invocation that failed, or `null`.
-*
-* Scoped by the invocation, because the same database state means different
-* things to different subcommands: "already exists" under `migrate apply` wants
-* a baseline, while under `schema apply` it is a genuine conflict.
-*/
-async function diagnoseAtlasFailure(context) {
-	const { domain, args, stderr, databaseUrl } = context;
-	if (domain === "migrate" && args.includes("apply")) {
-		const provisioned = parseAlreadyProvisioned(stderr);
-		if (provisioned) return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object);
-	}
-	if (domain === "schema" && args.includes("apply")) {
-		const enumDrop = parseEnumLabelDrop(stderr);
-		if (enumDrop) return formatEnumLabelDropBanner(enumDrop);
-		const notNull = parseNotNullViolation(stderr);
-		if (notNull) return formatNotNullViolationBanner(notNull, await countRows(databaseUrl, notNull.table));
-		const generated = parseGeneratedColumnRefusal(stderr);
-		if (generated) return formatGeneratedColumnRefusalBanner(generated, await generatedColumnsBlocking(databaseUrl, generated.statement));
-	}
-	return null;
-}
-//#endregion
-export { formatForeignGeneratedColumnBanner as a, reportCommandFailure as c, extractPgError as d, isRoleSwitchingPermissionError as f, sanitizeErrorForClient as g, reachedDatabase as h, diagnoseDbError as i, classifyConnectFailure as l, pgErrorToFriendlyMessage as m, deepestErrorMessage as n, isEconnrefused as o, isRowLevelSecurityDenial as p, diagnoseAtlasFailure as r, parseHostInfo as s, checkDatabaseConnectivity as t, extractCauseMessage as u };
-
-//# sourceMappingURL=cli-errors-DsA-K9uP.js.map