@rebasepro/server-postgres 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/cli-errors-CaI4ntyD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-errors-CaI4ntyD.js","names":[],"sources":["../src/utils/error-cause.ts","../src/schema/destructive-sql.ts","../src/module-dir.ts","../src/generated-sql.ts","../src/cli-helpers.ts","../src/cli-errors.ts"],"sourcesContent":["/**\n * Walk the error cause chain and return the deepest meaningful message.\n *\n * A leaf module, imported by the driver CLI: `pg-error-utils.ts`, where it used\n * to live, imports `@rebasepro/server`, and the CLI must start without it.\n */\nexport function extractCauseMessage(error: unknown): string | null {\n    if (!error || typeof error !== \"object\") return null;\n    if (!(error instanceof Error)) return null;\n\n    if (error.cause && typeof error.cause === \"object\") {\n        const deeper = extractCauseMessage(error.cause);\n        if (deeper) return deeper;\n        // The cause itself has a message\n        if (error.cause instanceof Error && error.cause.message) {\n            return error.cause.message;\n        }\n    }\n    return null;\n}\n","/**\n * Pure helpers that classify an Atlas declarative-apply plan as destructive\n * or not, and decide what `rebase db push` should do about it.\n *\n * `db push` runs `atlas schema apply` to make the live database match the\n * generated `schema.sql`. Removing a collection field compiles to\n * `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.\n * We first run the apply with `--dry-run` to obtain the planned SQL, scan it\n * here, and refuse to auto-approve anything destructive without an explicit\n * opt-in.\n *\n * A type change is a destructive plan that names no DROP. `ALTER COLUMN\n * \"price\" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away\n * every timestamp's time of day, in a statement that reads like a routine\n * alter. So a type change is gated too, unless it is a widening every value\n * survives unchanged — which needs the column's current type, read from the\n * catalogue by the caller.\n *\n * A primary key change names no DROP of data either: `DROP CONSTRAINT\n * \"<table>_pkey\", ADD PRIMARY KEY (\"id\", \"locale\")` keeps every value and\n * gives every row a new address. It is gated like a drop.\n *\n * Everything in this file is side-effect free so it can be unit-tested\n * without Atlas or a database.\n */\n\n/**\n * SQL fragments that destroy data or data-bearing objects. Matched\n * case-insensitively against each statement of the plan. `IF EXISTS` /\n * whitespace variations are tolerated by the regexes below.\n */\nconst DESTRUCTIVE_PATTERNS: { label: string; re: RegExp }[] = [\n    { label: \"DROP TABLE\", re: /\\bDROP\\s+TABLE\\b/i },\n    { label: \"DROP COLUMN\", re: /\\bDROP\\s+COLUMN\\b/i },\n    { label: \"DROP SCHEMA\", re: /\\bDROP\\s+SCHEMA\\b/i },\n    { label: \"DROP VIEW\", re: /\\bDROP\\s+(MATERIALIZED\\s+)?VIEW\\b/i },\n    { label: \"DROP TYPE\", re: /\\bDROP\\s+TYPE\\b/i },\n    { label: \"TRUNCATE\", re: /\\bTRUNCATE\\b/i }\n];\n\n/**\n * Split a SQL script into individual statements, dropping blank lines and\n * `--` comment lines. Deliberately simple: Atlas emits one plain statement\n * per `;`, without string literals that contain semicolons in a schema DDL\n * plan, so a naive split is safe and keeps this dependency-free.\n */\nexport function splitSqlStatements(sql: string): string[] {\n    // Strip full-line SQL comments so a commented-out DROP never trips the\n    // detector, then split on semicolons.\n    const withoutComments = sql\n        .split(\"\\n\")\n        .filter((line) => !line.trim().startsWith(\"--\"))\n        .join(\"\\n\");\n    return withoutComments\n        .split(\";\")\n        .map((s) => s.trim())\n        .filter((s) => s.length > 0);\n}\n\n/** `->`, the marker Atlas prints in front of the first line of every statement. */\nconst PLAN_MARKER_RE = /^\\s*->\\s?/;\n/** `-------`, both the rule between sections and the one above a summary. */\nconst PLAN_RULE_RE = /^\\s*-{5,}\\s*$/;\n/** `Planning migration statements (3 in total):` — and the count it announces. */\nconst PLAN_HEADING_RE = /^Planning migration statements \\((\\d+) in total\\):/m;\n/**\n * What Atlas prints, and nothing else, when there is nothing to plan — from\n * `schema apply`, or from `migrate apply` with no file pending.\n */\nconst PLAN_SYNCED_RE = /^\\s*(?:Schema is synced, no changes to be made|No migration files to execute)\\s*$/;\n\n/** What {@link readPlan} could make of a plan. */\ninterface ReadPlan {\n    statements: string[];\n    /** The `(N in total)` Atlas announced, when its report said one. */\n    announced?: number;\n}\n\n/**\n * Read the statements out of whatever Atlas printed.\n *\n * `atlas schema apply --dry-run` does not print SQL. It prints a report, and\n * the same statements appear in it twice:\n *\n *     Planning migration statements (2 in total):\n *\n *       -- modify \"people\" table:\n *         -> ALTER TABLE \"public\".\"people\" ALTER COLUMN \"rating\" TYPE numeric(4,1);\n *       -- create \"notes\" table:\n *         -> CREATE TABLE \"public\".\"notes\" (\n *              \"body\" text NULL DEFAULT 'a;b',\n *              …\n *            );\n *\n *     -------------------------------------------\n *\n *     Analyzing planned statements (2 in total):\n *       …\n *     Running dry-run migration (2 statements in total):\n *       -- modify \"people\" table\n *         -> ALTER TABLE …;          ← the same statement, again\n *       -- ok (19µs)\n *\n * Splitting that on `;` is how the push gate went blind: the heading has no\n * `;` and does not start with `--`, so it became the first line of the first\n * statement, and an `ALTER TABLE` parse anchored at the start of a statement\n * read nothing — every narrowing type change applied without a prompt. Reading\n * both sections was a second bug, counting every destructive statement twice.\n *\n * So the report is read as a report: a statement is a `->` line and the lines\n * indented under it, up to the next `--` heading, `->`, blank line or rule;\n * only the first section that holds a `->` is read; and `;` plays no part,\n * because a default like `'a;b'` contains one.\n *\n * Plain SQL — a migration file, or an Atlas that printed SQL — has no `->`\n * and is split the old way.\n */\nfunction readPlan(plan: string): ReadPlan {\n    if (PLAN_SYNCED_RE.test(plan)) return { statements: [] };\n    const lines = plan.split(/\\r?\\n/);\n    if (!lines.some(line => PLAN_MARKER_RE.test(line))) return { statements: splitSqlStatements(plan) };\n\n    const heading = PLAN_HEADING_RE.exec(plan);\n    const statements: string[] = [];\n    let current: string[] | null = null;\n    const flush = () => {\n        if (current) statements.push(current.join(\"\\n\").trim().replace(/;\\s*$/, \"\").trimEnd());\n        current = null;\n    };\n\n    for (const line of lines) {\n        if (PLAN_MARKER_RE.test(line)) {\n            flush();\n            current = [line.replace(PLAN_MARKER_RE, \"\")];\n            continue;\n        }\n        // A section heading sits in column 0 and is neither a marker nor a\n        // `--` line; the rule between sections is dashes. Either one after a\n        // statement has been read means the plan is over and what follows is\n        // Atlas re-printing it.\n        const sectionEnds = PLAN_RULE_RE.test(line) || (/^\\S/.test(line) && !line.startsWith(\"--\"));\n        if (sectionEnds) {\n            flush();\n            if (statements.length > 0) break;\n            continue;\n        }\n        if (!current) continue;\n        if (line.trim() === \"\" || line.trim().startsWith(\"--\")) {\n            flush();\n            continue;\n        }\n        current.push(line);\n    }\n    flush();\n\n    return { statements, announced: heading ? Number(heading[1]) : undefined };\n}\n\n/**\n * The statements of an Atlas plan, each exactly once, without Atlas's\n * rendering and without the trailing `;`. See {@link readPlan} for the shape\n * it reads; `test/fixtures/atlas-dry-run/` holds real captures of it.\n */\nexport function extractPlanStatements(plan: string): string[] {\n    return readPlan(plan).statements;\n}\n\n/**\n * Whether Atlas answered the dry-run with \"Schema is synced\" and nothing else.\n *\n * Positive evidence only: an empty or unreadable report also yields no\n * statements, and is not the same answer.\n */\nexport function isSyncedPlan(plan: string): boolean {\n    return PLAN_SYNCED_RE.test(plan);\n}\n\nexport interface DestructiveStatement {\n    /** The offending statement (trimmed, without the trailing `;`). */\n    statement: string;\n    /** Which destructive operation it was flagged for, e.g. \"DROP COLUMN\". */\n    kind: string;\n    /**\n     * What in the statement loses data, when the kind alone does not say:\n     * for `ALTER COLUMN TYPE`, each lossy column with its old and new type.\n     */\n    detail?: string;\n}\n\n/** A column as the database has it now, with its type as `format_type` spells it. */\nexport interface ExistingColumnType {\n    schema: string;\n    table: string;\n    column: string;\n    /** e.g. `character varying(255)`, `numeric(10,2)`, `timestamp with time zone`. */\n    type: string;\n}\n\n/**\n * Every column of every ordinary table outside the system schemas, with its\n * type. What {@link detectDestructiveStatements} compares a planned type\n * change against; `format_type` because it carries the modifier (`(255)`,\n * `(10,2)`) that decides whether a change widens or narrows.\n */\nexport const COLUMN_TYPES_SQL = `\n    SELECT n.nspname AS \"schema\",\n           c.relname AS \"table\",\n           a.attname AS \"column\",\n           format_type(a.atttypid, a.atttypmod) AS \"type\"\n    FROM pg_attribute a\n    JOIN pg_class c     ON c.oid = a.attrelid\n    JOIN pg_namespace n ON n.oid = c.relnamespace\n    WHERE c.relkind IN ('r', 'p')\n      AND a.attnum > 0\n      AND NOT a.attisdropped\n      AND n.nspname NOT IN ('pg_catalog', 'information_schema')\n      AND n.nspname NOT LIKE 'pg\\\\_%'\n`;\n\n/**\n * Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return\n * the statements that would destroy data. An empty array means the plan is\n * safe to auto-approve.\n *\n * `columnTypes` is what the database holds now. A type change to a column it\n * does not list is flagged: not knowing what a column is means not knowing\n * whether the change keeps its values.\n */\nexport function detectDestructiveStatements(\n    planSql: string,\n    columnTypes: readonly ExistingColumnType[] = []\n): DestructiveStatement[] {\n    const found: DestructiveStatement[] = [];\n    const { statements, announced } = readPlan(planSql);\n    // Fail closed on a plan this could not read. Atlas says how many statements\n    // it planned; reading a different number means its rendering changed under\n    // us, and a gate that has not read the plan cannot call it safe. Reported\n    // as one more destructive finding, so it takes the same road: a prompt on\n    // a terminal, a refusal elsewhere, `--allow-destructive` to go ahead.\n    if (announced !== undefined && announced !== statements.length) {\n        found.push({\n            statement: `Planning migration statements (${announced} in total)`,\n            kind: \"UNREADABLE PLAN\",\n            detail: `Atlas announced ${announced} statement(s) and ${statements.length} could be read — `\n                + \"read the plan yourself before allowing it\"\n        });\n    }\n    for (const statement of statements) {\n        // One finding per statement, under the label that says the most, with\n        // everything else it does in the detail: Atlas folds a key change, a\n        // retype and a drop into one `ALTER TABLE`, and a reader shown only\n        // the first would approve the rest unread.\n        const dropped = DESTRUCTIVE_PATTERNS.find(({ re }) => re.test(statement));\n        const rekeyed = describePrimaryKeyChange(statement);\n        const lossy = parseColumnTypeChanges(statement)\n            .map(change => ({ change, from: currentTypeOf(change, columnTypes) }))\n            .filter(({ change, from }) => from === undefined || !isLosslessTypeChange(from, change.to))\n            .map(({ change, from }) => `\"${change.column}\" ${from ?? \"(current type unknown)\"} → ${change.to}`)\n            .join(\"; \");\n        const kind = dropped?.label ?? (rekeyed ? \"PRIMARY KEY CHANGE\" : lossy ? \"ALTER COLUMN TYPE\" : undefined);\n        if (!kind) continue;\n        const detail = [rekeyed, lossy].filter(Boolean).join(\"; \");\n        found.push(detail ? { statement, kind, detail } : { statement, kind });\n    }\n    return found;\n}\n\n/** A column an `ALTER TABLE` retypes, with the type the plan gives it. */\ninterface ColumnTypeChange {\n    /** Absent when the plan did not qualify the table. */\n    schema?: string;\n    table: string;\n    column: string;\n    /** As the plan writes it, without any `USING` or `COLLATE`. */\n    to: string;\n}\n\nconst IDENT = String.raw`(?:\"(?:[^\"]|\"\")+\"|[A-Za-z_][A-Za-z0-9_$]*)`;\nconst ALTER_TABLE_RE = new RegExp(\n    String.raw`^ALTER\\s+TABLE\\s+(?:IF\\s+EXISTS\\s+)?(?:ONLY\\s+)?(${IDENT})(?:\\.(${IDENT}))?\\s+([\\s\\S]*)$`, \"i\"\n);\nconst TYPE_CLAUSE_RE = new RegExp(\n    String.raw`^ALTER\\s+(?:COLUMN\\s+)?(${IDENT})\\s+(?:SET\\s+DATA\\s+)?TYPE\\s+([\\s\\S]+)$`, \"i\"\n);\n\nconst unquote = (ident: string): string =>\n    ident.startsWith(\"\\\"\") ? ident.slice(1, -1).replace(/\"\"/g, \"\\\"\") : ident;\n\n/**\n * Split an `ALTER TABLE`'s clause list on its top-level commas — the ones\n * outside parentheses and quotes, so `TYPE numeric(10, 2)` stays one clause.\n */\nfunction splitClauses(body: string): string[] {\n    const clauses: string[] = [];\n    let depth = 0;\n    let quote: string | undefined;\n    let start = 0;\n    for (let i = 0; i < body.length; i++) {\n        const ch = body[i];\n        if (quote) {\n            if (ch === quote) quote = undefined;\n        } else if (ch === \"\\\"\" || ch === \"'\") {\n            quote = ch;\n        } else if (ch === \"(\") {\n            depth++;\n        } else if (ch === \")\") {\n            depth--;\n        } else if (ch === \",\" && depth === 0) {\n            clauses.push(body.slice(start, i).trim());\n            start = i + 1;\n        }\n    }\n    clauses.push(body.slice(start).trim());\n    return clauses.filter(clause => clause.length > 0);\n}\n\n/**\n * The statement from its `ALTER TABLE` on, wherever on a line that starts.\n *\n * {@link readPlan} hands over clean statements. This is the second line of\n * defence for text it could not clean — a rendering it does not know yet —\n * where a line of prose above the statement must not hide the statement, which\n * is exactly how an anchored match once read Atlas's whole plan as safe.\n */\nexport function fromAlterTable(statement: string): string {\n    const start = /(?:^|\\n)[ \\t]*(?:->[ \\t]*)?(ALTER\\s+TABLE\\b)/i.exec(statement);\n    return start ? statement.slice(start.index + start[0].length - start[1].length).trim() : statement.trim();\n}\n\n/**\n * Every `ALTER COLUMN … [SET DATA] TYPE` in one statement. Atlas prints its\n * dry-run statements under a `-> ` marker and puts several clauses in one\n * `ALTER TABLE`, so both are handled.\n */\nfunction parseColumnTypeChanges(statement: string): ColumnTypeChange[] {\n    const table = ALTER_TABLE_RE.exec(fromAlterTable(statement));\n    if (!table) return [];\n    const [schema, name] = table[2]\n        ? [unquote(table[1]), unquote(table[2])]\n        : [undefined, unquote(table[1])];\n    const changes: ColumnTypeChange[] = [];\n    for (const clause of splitClauses(table[3])) {\n        const match = TYPE_CLAUSE_RE.exec(clause);\n        if (!match) continue;\n        const to = match[2].split(/\\s+(?:USING|COLLATE)\\s/i)[0].trim();\n        changes.push({ schema, table: name, column: unquote(match[1]), to });\n    }\n    return changes;\n}\n\n/** `ADD [CONSTRAINT \"x\"] PRIMARY KEY (\"a\", \"b\")`, one clause of an `ALTER TABLE`. */\nconst ADD_PRIMARY_KEY_RE = new RegExp(\n    String.raw`^ADD\\s+(?:CONSTRAINT\\s+${IDENT}\\s+)?PRIMARY\\s+KEY\\b\\s*(?:\\(([^)]*)\\))?`, \"i\"\n);\n/** `DROP CONSTRAINT [IF EXISTS] \"x\"`, one clause of an `ALTER TABLE`. */\nconst DROP_CONSTRAINT_RE = new RegExp(\n    String.raw`^DROP\\s+CONSTRAINT\\s+(?:IF\\s+EXISTS\\s+)?(${IDENT})`, \"i\"\n);\n\n/** What a row loses when the columns that address it change. */\nconst ROW_ADDRESS_LOST = \"every row's id changes, so anything that refers to a row by its id — a URL, \" +\n    \"a foreign key, an id stored elsewhere — stops finding it\";\n\n/**\n * What an `ALTER TABLE` does to the table's primary key, in a sentence — or\n * `undefined` when it leaves the key alone.\n *\n * The key is a row's address: Rebase reads, links and routes every row by it.\n * Atlas plans a key change as `DROP CONSTRAINT \"<table>_pkey\", ADD PRIMARY KEY\n * (…)` — one routine-looking statement that names no DROP of data — so moving\n * a collection from `(id)` to `(id, locale)` re-keyed a populated table with\n * no prompt. A `CREATE TABLE`'s own `PRIMARY KEY` is not a change and is never\n * read here: only an `ALTER TABLE`'s clauses are. A dropped constraint counts\n * as the key when it carries Postgres's default name for one, `<table>_pkey`;\n * a key under another name is caught by the `ADD PRIMARY KEY` that replaces it.\n */\nfunction describePrimaryKeyChange(statement: string): string | undefined {\n    const alter = ALTER_TABLE_RE.exec(fromAlterTable(statement));\n    if (!alter) return undefined;\n    const table = alter[2] ? `${alter[1]}.${alter[2]}` : alter[1];\n\n    let added: string | undefined;\n    let dropped: string | undefined;\n    for (const clause of splitClauses(alter[3])) {\n        const add = ADD_PRIMARY_KEY_RE.exec(clause);\n        if (add) {\n            added = add[1] === undefined ? \"a new key\" : `(${add[1].split(\",\").map(c => c.trim()).join(\", \")})`;\n            continue;\n        }\n        const drop = DROP_CONSTRAINT_RE.exec(clause);\n        if (drop && unquote(drop[1]).endsWith(\"_pkey\")) dropped = drop[1];\n    }\n\n    if (added && dropped) return `${table} is re-keyed on ${added}: ${ROW_ADDRESS_LOST}`;\n    if (added) {\n        return `${table} gets the primary key ${added}: rows are addressed by it from now on, ` +\n            \"and the push fails if two rows share a value\";\n    }\n    if (dropped) return `${table} loses its primary key ${dropped}: ${ROW_ADDRESS_LOST}`;\n    return undefined;\n}\n\n/**\n * The column's current type. A table named without its schema matches in any\n * schema, but only when every match agrees — two same-named tables with\n * different types leave the answer unknown.\n */\nfunction currentTypeOf(change: ColumnTypeChange, columnTypes: readonly ExistingColumnType[]): string | undefined {\n    const types = new Set(columnTypes\n        .filter(col => col.table === change.table && col.column === change.column\n            && (change.schema === undefined || col.schema === change.schema))\n        .map(col => col.type));\n    return types.size === 1 ? [...types][0] : undefined;\n}\n\n/** Spellings of one type, mapped to one name. Anything absent compares verbatim. */\nconst TYPE_ALIASES: Record<string, string> = {\n    \"int\": \"integer\",\n    \"int4\": \"integer\",\n    \"int2\": \"smallint\",\n    \"int8\": \"bigint\",\n    \"character varying\": \"varchar\",\n    \"decimal\": \"numeric\",\n    \"timestamp without time zone\": \"timestamp\",\n    \"timestamp with time zone\": \"timestamptz\",\n    \"time without time zone\": \"time\",\n    \"time with time zone\": \"timetz\",\n    \"bool\": \"boolean\",\n    \"float4\": \"real\",\n    \"float8\": \"double precision\",\n    \"character\": \"bpchar\",\n    \"char\": \"bpchar\"\n};\n\n/** Decimal digits each integer type holds, which is what a `numeric` must hold too. */\nconst INTEGER_DIGITS: Record<string, number> = { smallint: 5, integer: 10, bigint: 19 };\n\n/** Types whose modifier is a fractional-seconds precision, 6 when absent. */\nconst SECONDS_PRECISION = new Set([\"timestamp\", \"timestamptz\", \"time\", \"timetz\"]);\n\ninterface ParsedType {\n    base: string;\n    /** The modifier, e.g. `[10, 2]` for `numeric(10,2)`. */\n    args?: number[];\n    /** Array dimensions. */\n    dims: number;\n}\n\nfunction parseType(raw: string): ParsedType {\n    let text = raw.trim().replace(/\\s+/g, \" \");\n    let dims = 0;\n    for (let suffix = /\\s*\\[\\d*\\]$/.exec(text); suffix; suffix = /\\s*\\[\\d*\\]$/.exec(text)) {\n        dims++;\n        text = text.slice(0, suffix.index);\n    }\n    // A quoted name is a user-defined type, compared exactly as written.\n    if (text.includes(\"\\\"\")) return { base: text, dims };\n    text = text.toLowerCase().replace(/^pg_catalog\\./, \"\");\n    let args: number[] | undefined;\n    const modifier = /\\(([^)]*)\\)/.exec(text);\n    if (modifier) {\n        args = modifier[1].split(\",\").map(part => Number(part.trim()));\n        text = `${text.slice(0, modifier.index)} ${text.slice(modifier.index + modifier[0].length)}`\n            .replace(/\\s+/g, \" \")\n            .trim();\n    }\n    return { base: TYPE_ALIASES[text] ?? text, args, dims };\n}\n\n/** Does moving from one modifier to another, on the same type, keep every value? */\nfunction modifierWidens(base: string, from: number[] | undefined, to: number[] | undefined): boolean {\n    if (JSON.stringify(from) === JSON.stringify(to)) return true;\n    if (base === \"varchar\") {\n        return to === undefined || (from !== undefined && to[0] >= from[0]);\n    }\n    if (base === \"numeric\") {\n        if (to === undefined) return true;\n        if (from === undefined) return false;\n        const [p1, s1 = 0] = from;\n        const [p2, s2 = 0] = to;\n        return s2 >= s1 && p2 - s2 >= p1 - s1;\n    }\n    if (SECONDS_PRECISION.has(base)) {\n        return (to?.[0] ?? 6) >= (from?.[0] ?? 6);\n    }\n    return false;\n}\n\n/**\n * Is `ALTER COLUMN … TYPE to` a widening, one that keeps every value exactly\n * as it was?\n *\n * Deliberately short. Everything not listed needs a confirmation, including\n * changes that are usually harmless: `timestamp` → `timestamptz` reads each\n * value in the session's time zone, `json` → `jsonb` drops duplicate keys,\n * `real` → `double precision` prints 0.1 as 0.100000001490116, and `integer` →\n * `text` keeps the digits but changes what the column is.\n *\n *  - the same type, with a modifier at least as wide (`varchar(100)` →\n *    `varchar(255)`, `numeric(10,2)` → `numeric(12,2)` or unbounded,\n *    `timestamptz(3)` → `timestamptz`);\n *  - `smallint` → `integer` → `bigint`, and any of them to a `numeric` with\n *    room for all their digits;\n *  - `varchar(n)` → `text`, and `text` → an unbounded `varchar`.\n *\n * Arrays follow their element type, and never gain or lose a dimension.\n */\nexport function isLosslessTypeChange(from: string, to: string): boolean {\n    const a = parseType(from);\n    const b = parseType(to);\n    if (a.dims !== b.dims) return false;\n    if (a.args?.some(Number.isNaN) || b.args?.some(Number.isNaN)) return false;\n    if (a.base === b.base) return modifierWidens(a.base, a.args, b.args);\n\n    const fromDigits = INTEGER_DIGITS[a.base];\n    if (fromDigits !== undefined) {\n        const toDigits = INTEGER_DIGITS[b.base];\n        if (toDigits !== undefined) return toDigits >= fromDigits;\n        if (b.base === \"numeric\") {\n            return b.args === undefined || b.args[0] - (b.args[1] ?? 0) >= fromDigits;\n        }\n        return false;\n    }\n    if (a.base === \"varchar\" && b.base === \"text\") return true;\n    if (a.base === \"text\" && b.base === \"varchar\") return b.args === undefined;\n    return false;\n}\n\nexport type PushDecision = \"apply\" | \"confirm\" | \"refuse\";\n\n/**\n * Decide how `db push` should proceed given the plan's destructiveness and\n * the invocation context.\n *\n *  - No destructive statements → `apply` (safe to auto-approve).\n *  - Destructive + `--allow-destructive` → `apply` (operator opted in).\n *  - Destructive + interactive TTY → `confirm` (prompt before applying).\n *  - Destructive + non-interactive → `refuse` (never silently drop data in\n *    CI / scripts / agents).\n */\nexport function decidePushSafety(opts: {\n    destructiveCount: number;\n    allowDestructive: boolean;\n    interactive: boolean;\n}): PushDecision {\n    if (opts.destructiveCount === 0) return \"apply\";\n    if (opts.allowDestructive) return \"apply\";\n    return opts.interactive ? \"confirm\" : \"refuse\";\n}\n","import path from \"path\";\nimport { fileURLToPath } from \"url\";\n\n// Isolated in its own module so the jest CommonJS transform can swap it for a\n// __dirname shim via moduleNameMapper — `import.meta` is a syntax error once\n// ts-jest transpiles to CJS.\nexport const moduleDir = path.dirname(fileURLToPath(import.meta.url));\n","/**\n * Where `db push` and `db generate` put the SQL they render from the collections.\n *\n * Five files — `schema.sql` (Atlas's desired state), `policies.sql`,\n * `search.sql`, `vector.sql` and `triggers.sql` — and every one of them is\n * scratch. Both commands regenerate all five before reading any of them, and\n * nothing else reads them at all. They used to be written into `drizzle/`, beside\n * the migrations, and committed: a copy nobody read, which every collection\n * change rewrote in the diff and every two branches touching collections\n * conflicted on.\n *\n * Relative to the directory the command runs in (the backend), like the\n * migrations are.\n */\nimport fs from \"fs\";\nimport path from \"path\";\n\n/** The directory, relative to the working directory. POSIX, because it is also a URL path. */\nexport const GENERATED_SQL_DIR = \".rebase/sql\";\n\n/**\n * `schema.sql` as Atlas takes it. Relative on purpose, like the\n * `file://drizzle/migrations` beside it: Atlas joins the URL's host and path, so\n * `.rebase` is read as the first path segment, measured against the pinned 1.2.3.\n */\nexport const DESIRED_STATE_URL = `file://${GENERATED_SQL_DIR}/schema.sql`;\n\n/** The files the DDL generator writes, all of them derived from the collections. */\nexport const GENERATED_SQL_FILES = [\"schema.sql\", \"policies.sql\", \"search.sql\", \"vector.sql\", \"triggers.sql\"] as const;\n\n/** The absolute directory, for the working directory the command runs in. */\nexport function generatedSqlDir(cwd: string = process.cwd()): string {\n    return path.resolve(cwd, GENERATED_SQL_DIR);\n}\n\n/**\n * The first line of every file the generator writes, in every release that\n * wrote them into `drizzle/`. Matching it is what makes removing the old copy\n * safe: a file there under one of these names that does not open this way was\n * written by a person, and is left alone.\n */\nconst GENERATED_HEADER = /^-- This file (is auto-generated by the Rebase DDL generator|contains RLS policies generated by Rebase)\\./;\n\n/**\n * Get the directory ready to be written, and retire the copies an older release\n * committed.\n *\n * The directory ignores itself, rather than relying on the project's\n * `.gitignore`: a scaffold ignores `.rebase/`, but a project created before it\n * did would otherwise start committing these files from their new home.\n *\n * The old copies in `drizzle/` are deleted, not left behind. Nothing writes them\n * any more, so from the first push after an upgrade they only fall further\n * behind — and a stale `policies.sql` in the repository is exactly what someone\n * reviewing the project's RLS would read.\n *\n * With `retire: false` (`db push --dry-run`, which writes nothing of the\n * project's) the old copies are only found, not removed.\n *\n * @returns the old files it removed — or, with `retire: false`, would remove —\n *   relative to the working directory.\n */\nexport function prepareGeneratedSqlDir(\n    cwd: string = process.cwd(),\n    options: { retire?: boolean } = {}\n): string[] {\n    const dir = generatedSqlDir(cwd);\n    fs.mkdirSync(dir, { recursive: true });\n    const ignore = path.join(dir, \".gitignore\");\n    if (!fs.existsSync(ignore)) {\n        fs.writeFileSync(ignore, \"# Generated by `rebase db push` / `rebase db generate` from the collections.\\n*\\n\");\n    }\n\n    const removed: string[] = [];\n    for (const name of GENERATED_SQL_FILES) {\n        const legacy = path.join(cwd, \"drizzle\", name);\n        if (!fs.existsSync(legacy)) continue;\n        const firstLine = fs.readFileSync(legacy, \"utf-8\").split(\"\\n\", 1)[0];\n        if (!GENERATED_HEADER.test(firstLine)) continue;\n        if (options.retire !== false) fs.rmSync(legacy);\n        removed.push(path.posix.join(\"drizzle\", name));\n    }\n    return removed;\n}\n","import path from \"path\";\nimport fs from \"fs\";\nimport { execSync } from \"child_process\";\nimport { createRequire } from \"module\";\nimport readline from \"readline\";\nimport { pathToFileURL } from \"url\";\nimport chalk from \"chalk\";\nimport { isRebaseIndexName } from \"./schema/collection-index\";\nimport type { GeneratedColumnDependency } from \"./schema/generated-column-conflicts\";\nimport { COLUMN_TYPES_SQL, type ExistingColumnType } from \"./schema/destructive-sql\";\nimport { out, outWarn } from \"./cli-output\";\nimport type { CollectionConfig } from \"@rebasepro/types\";\nimport { moduleDir as __helpersDirname } from \"./module-dir\";\nimport { generatedSqlDir } from \"./generated-sql\";\n\n\n\n/**\n * Why is a dependency's binary missing — never installed, or installed with its\n * build script blocked?\n *\n * These need opposite advice, and getting it wrong is not a cosmetic miss. pnpm\n * 10+ refuses to run a dependency's lifecycle scripts unless it is allowlisted\n * (`pnpm.onlyBuiltDependencies`, or `allowBuilds` in `pnpm-workspace.yaml`).\n * `@ariga/atlas` downloads its platform binary in `preinstall`, so a blocked\n * script leaves a state that looks like a successful install: the package is on\n * disk with its `install.js` and `package.json`, `node_modules/.bin` is empty,\n * the install exits 0, and the only signal is `ERR_PNPM_IGNORED_BUILDS` several\n * screens up.\n *\n * Telling somebody in that state to install the package again sends them round\n * the same loop forever — the add succeeds, the script is blocked again,\n * nothing changes. Verified by doing it: `pnpm add @ariga/atlas` into a bare\n * project yields exactly this, three \"Failed to create bin … ENOENT\" warnings\n * and no binary.\n *\n * Resolution is attempted from the user's project first and this package\n * second, matching the order {@link resolveLocalBin} searches — the driver may\n * be installed a level up from where the command runs.\n */\nexport type ProjectPackageManager = \"pnpm\" | \"npm\" | \"yarn\" | \"bun\" | \"unknown\";\n\n/**\n * Which package manager installed this project, read off its lockfile.\n *\n * Every remedy for a blocked build script is package-manager specific, and\n * naming the wrong one is the same failure as naming none: `pnpm approve-builds`\n * is not a thing an npm user can run, and `pnpm.onlyBuiltDependencies` is a key\n * npm does not read. This existed as a pnpm-only message for long enough that\n * npm 12 — which blocks dependency lifecycle scripts by default, the way pnpm 10\n * does — could ship and leave every npm reader three unfollowable commands deep.\n *\n * The lockfile, not `npm_config_user_agent`: the question is how the project's\n * `node_modules` was built, not which binary happens to be invoking us. Walks up\n * because commands run from `backend/` in a scaffolded project, and the lockfile\n * is at the workspace root.\n */\nexport function detectProjectPackageManager(startDir: string = process.cwd()): ProjectPackageManager {\n    const lockfiles: Array<[string, ProjectPackageManager]> = [\n        [\"pnpm-lock.yaml\", \"pnpm\"],\n        [\"bun.lock\", \"bun\"],\n        [\"bun.lockb\", \"bun\"],\n        [\"yarn.lock\", \"yarn\"],\n        [\"package-lock.json\", \"npm\"]\n    ];\n\n    let dir = path.resolve(startDir);\n    while (true) {\n        for (const [file, manager] of lockfiles) {\n            if (fs.existsSync(path.join(dir, file))) return manager;\n        }\n        const parent = path.dirname(dir);\n        if (parent === dir) return \"unknown\";\n        dir = parent;\n    }\n}\n\n/**\n * How to let `@ariga/atlas` run its `preinstall`, in the reader's own package\n * manager.\n *\n * Returns the lines to print after \"the binary is missing but the package is\n * installed\". Kept next to {@link detectProjectPackageManager} so the two move\n * together, and returned rather than printed so it can be asserted on.\n */\nexport function describeBuildScriptRemedy(\n    packageName: string,\n    manager: ProjectPackageManager = detectProjectPackageManager()\n): string[] {\n    switch (manager) {\n        case \"npm\":\n            // npm 12 blocks dependency install scripts unless the root\n            // package.json allowlists them. `rebase init` scaffolds the entry;\n            // a project that predates it, or one that vendored its own\n            // package.json, needs to add it.\n            return [\n                `    npm install-scripts approve ${packageName}`,\n                \"\",\n                \"  or, to record it in the project (what `rebase init` scaffolds):\",\n                \"\",\n                \"    // package.json\",\n                `    \"allowScripts\": { \"${packageName}\": true }`,\n                \"\",\n                \"  Then re-run `npm install`.\"\n            ];\n        case \"yarn\":\n            return [\n                \"    // .yarnrc.yml\",\n                \"    enableScripts: true\",\n                \"\",\n                \"  Then re-run `yarn install`.\"\n            ];\n        case \"bun\":\n            return [\n                \"    // package.json\",\n                `    \"trustedDependencies\": [\"${packageName}\"]`,\n                \"\",\n                \"  Then re-run `bun install`.\"\n            ];\n        case \"pnpm\":\n        default:\n            return [\n                \"    pnpm approve-builds\",\n                \"\",\n                \"  or, to record it in the project (what `rebase init` scaffolds):\",\n                \"\",\n                \"    // package.json\",\n                `    \"pnpm\": { \"onlyBuiltDependencies\": [\"${packageName}\"] }`,\n                \"\",\n                \"  Then re-run `pnpm install`.\"\n            ];\n    }\n}\n\n/**\n * \"Install again, from scratch\", in the reader's own package manager.\n *\n * For the `bin-link-missing` state: the tree is half-written, and re-resolving\n * it is what recreates the `.bin` shim. `--force` on pnpm is what makes it\n * relink rather than decide the tree is already up to date.\n */\nexport function describeReinstallCommand(\n    manager: ProjectPackageManager = detectProjectPackageManager()\n): string {\n    switch (manager) {\n        case \"npm\": return \"rm -rf node_modules && npm install\";\n        case \"yarn\": return \"yarn install --force\";\n        case \"bun\": return \"rm -rf node_modules && bun install\";\n        case \"pnpm\":\n        default: return \"pnpm install --force\";\n    }\n}\n\n/** `add <pkg>` as a dev dependency, in the reader's own package manager. */\nexport function describeDevAddCommand(\n    packageName: string,\n    manager: ProjectPackageManager = detectProjectPackageManager()\n): string {\n    switch (manager) {\n        case \"npm\": return `npm install -D ${packageName}`;\n        case \"yarn\": return `yarn add -D ${packageName}`;\n        case \"bun\": return `bun add -d ${packageName}`;\n        case \"pnpm\":\n        default: return `pnpm add -D ${packageName}`;\n    }\n}\n\n/**\n * Why a dependency's binary is not on `PATH`.\n *\n * `bin-link-missing` is the third state, and the reason this is not a boolean.\n * The `preinstall` did run and the binary IS on disk — only the\n * `node_modules/.bin` shim that points at it is absent. pnpm produces exactly\n * that when it writes the link before the script that creates the target\n * (\"Failed to create bin … ENOENT\"), and so does a tree copied without its\n * symlinks. Telling that reader their build scripts are blocked sends them to\n * `approve-builds`, which does nothing, because nothing is blocked.\n */\nexport type MissingBinDiagnosis = \"not-installed\" | \"build-script-blocked\" | \"bin-link-missing\";\n\n/**\n * Where a package's own manifest lives, or null if it is not installed here.\n *\n * `package.json` rather than the package root: a package with an `exports` map\n * that omits `.` is unresolvable by name even when it is perfectly installed,\n * which would misreport it as absent.\n */\nfunction resolvePackageManifest(packageName: string): string | null {\n    const bases = [\n        pathToFileURL(path.join(process.cwd(), \"package.json\")),\n        pathToFileURL(path.join(__helpersDirname, \"package.json\"))\n    ];\n    for (const base of bases) {\n        try {\n            return createRequire(base).resolve(`${packageName}/package.json`);\n        } catch {\n            // Try the next base.\n        }\n    }\n    return null;\n}\n\n/**\n * The binaries a package's own manifest declares, as absolute paths.\n *\n * `bin` is a string for a single binary named after the package, or a map.\n * Both forms appear in the wild and `@ariga/atlas` uses the map.\n */\nexport function declaredBinaries(manifestPath: string): string[] {\n    let manifest: { name?: string; bin?: string | Record<string, string> };\n    try {\n        manifest = JSON.parse(fs.readFileSync(manifestPath, \"utf8\")) as typeof manifest;\n    } catch {\n        return [];\n    }\n    const dir = path.dirname(manifestPath);\n    if (typeof manifest.bin === \"string\") return [path.resolve(dir, manifest.bin)];\n    if (manifest.bin && typeof manifest.bin === \"object\") {\n        return Object.values(manifest.bin)\n            .filter((target): target is string => typeof target === \"string\")\n            .map(target => path.resolve(dir, target));\n    }\n    return [];\n}\n\nexport function diagnoseMissingBin(packageName: string): MissingBinDiagnosis {\n    const manifestPath = resolvePackageManifest(packageName);\n    if (!manifestPath) return \"not-installed\";\n\n    // Installed — but \"installed\" was the whole verdict, and it is not enough.\n    // `@ariga/atlas` downloads its platform binary in `preinstall`, so a blocked\n    // script leaves the package on disk with its `install.js` and manifest and\n    // no binary: the state this branch was written for. It is NOT the state of\n    // a tree whose binary exists and whose `.bin` shim does not, and those two\n    // need opposite advice. Ask the manifest which file the binary is, and look.\n    const binaries = declaredBinaries(manifestPath);\n    if (binaries.length === 0) return \"build-script-blocked\";\n    return binaries.some(file => fs.existsSync(file)) ? \"bin-link-missing\" : \"build-script-blocked\";\n}\n\nexport function resolveLocalBin(binName: string): string | null {\n    // Try to find node_modules/.bin upwards from __helpersDirname first (package-relative)\n    let dir = __helpersDirname;\n    while (true) {\n        const candidate = path.join(dir, \"node_modules\", \".bin\", binName);\n        if (fs.existsSync(candidate)) return candidate;\n        const parent = path.dirname(dir);\n        if (parent === dir) break;\n        dir = parent;\n    }\n\n    let cwd = process.cwd();\n    // Try to find node_modules/.bin upwards from process.cwd()\n    while (true) {\n        const candidate = path.join(cwd, \"node_modules\", \".bin\", binName);\n        if (fs.existsSync(candidate)) return candidate;\n        const parent = path.dirname(cwd);\n        if (parent === cwd) break;\n        cwd = parent;\n    }\n    // Fall back to globally installed binary via which/where\n    try {\n        const cmd = process.platform === \"win32\" ? `where ${binName}` : `which ${binName}`;\n        const globalPath = execSync(cmd, { encoding: \"utf-8\" }).trim().split(\"\\n\")[0].trim();\n        if (globalPath && fs.existsSync(globalPath)) return globalPath;\n    } catch {\n        // not found globally\n    }\n    return null;\n}\n\nexport async function getTableIncludesFromCollections(allCollections: CollectionConfig[]): Promise<string[]> {\n    const { getTableName, relationalCollections, resolveJunctionSpecs } = await import(\"@rebasepro/common\");\n    const { isPostgresCollectionConfig } = await import(\"@rebasepro/types\");\n\n    // The include list is the inverse of {@link getTableExcludes}: a name on it\n    // is a name Atlas is allowed to drop. A Firestore collection called\n    // `exercises` must not put `public.exercises` here — a real, unrelated table\n    // of that name would lose its protection and be dropped by the next\n    // auto-approved `db push`.\n    const collections = relationalCollections(allCollections);\n    const includes: string[] = [];\n    for (const col of collections) {\n        const tableName = getTableName(col);\n        const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : \"public\";\n        if (tableName) {\n            includes.push(`${schema}.${tableName}`);\n        }\n    }\n    // Junctions where they are created — `public`, whatever schema either\n    // endpoint is in. Qualifying one with an endpoint's schema left the real\n    // junction excluded, invisible to Atlas, and planned for creation again.\n    for (const junction of resolveJunctionSpecs(collections).values()) {\n        includes.push(`${junction.schema}.${junction.table}`);\n    }\n\n    return Array.from(new Set(includes));\n}\n\nexport async function getTableIncludes(collectionsPath: string): Promise<string[]> {\n    return getTableIncludesFromCollections(await loadCollectionsForCli(collectionsPath));\n}\n\n/**\n * Load a project's collections the way the Atlas-facing commands need them.\n *\n * Deliberately forgiving — a file that fails to import is skipped rather than\n * fatal — because the callers use this to *narrow* what Atlas may touch, and a\n * hard failure here would block a push over an unrelated broken file. Callers\n * that cannot tolerate a partial answer (the table excludes, which fail closed)\n * check the result themselves.\n */\n/** Paths this process has already complained about. See {@link loadCollectionsForCli}. */\nconst warnedMissingCollectionsPaths = new Set<string>();\n\nexport async function loadCollectionsForCli(collectionsPath: string): Promise<CollectionConfig[]> {\n    // Note: a relative --collections path resolves against the *current working\n    // directory*, not the backend package. When invoked via the generated npm\n    // script (cwd = backend/), the script uses \"../config/collections\" to\n    // compensate — so running the CLI directly from the repo root with a\n    // different relative path can silently point at the wrong place.\n    const resolvedPath = path.resolve(collectionsPath);\n    const collections: CollectionConfig[] = [];\n    if (!fs.existsSync(resolvedPath) && !warnedMissingCollectionsPaths.has(resolvedPath)) {\n        // Once per path per process. `db push` re-enters this from\n        // `schemaCommand`, `generatePostgresDdlCommand` and the Atlas argv\n        // assembly, so the same four lines were printed four times — sixteen\n        // lines of identical text ahead of the real output.\n        //\n        // An explicitly typed `--collections` never reaches here at all: it is\n        // refused at the entry point, before anything is generated. See\n        // `cli-collections-path.ts`. What is left is the default, which a\n        // headless project legitimately does not have.\n        warnedMissingCollectionsPaths.add(resolvedPath);\n        outWarn(chalk.yellow(\n            `  ⚠  Collections path not found: \"${collectionsPath}\"\\n` +\n            `     Resolved to: ${resolvedPath}\\n` +\n            `     (relative to cwd: ${process.cwd()})\\n` +\n            `     Pass an absolute path, or a path relative to where you run the command.`\n        ));\n    }\n    if (fs.existsSync(resolvedPath)) {\n        const stats = fs.statSync(resolvedPath);\n        if (stats.isDirectory()) {\n            const files = fs.readdirSync(resolvedPath);\n            for (const file of files) {\n                if ((file.endsWith(\".ts\") || file.endsWith(\".js\")) &&\n                    !file.includes(\".test.\") &&\n                    !file.endsWith(\".d.ts\") &&\n                    file !== \"index.ts\" && file !== \"index.js\") {\n                    try {\n                        const filePath = path.join(resolvedPath, file);\n                        const fileUrl = pathToFileURL(filePath).href;\n                        const module = await import(fileUrl);\n                        if (module && module.default) {\n                            collections.push(module.default);\n                        }\n                    } catch {\n                        // ignore\n                    }\n                }\n            }\n        }\n    }\n\n    return collections;\n}\n\n/**\n * The app database connections this process has open, by URL — one each.\n *\n * `rebase db push` used to open a connection per step: the auth bootstrap, the\n * connectivity probe, each catalogue read behind the Atlas excludes, the\n * column types, the generated-column edges, and then every post-step — RLS\n * lock, auth tables, vector, search, triggers, policies, reconcile, role,\n * legacy schema. 18 of them on a push that changed nothing. Locally each costs\n * a few milliseconds; against a hosted Postgres over TLS a connect is four or\n * five round trips (TCP, TLS 1.3, startup, SCRAM twice) — about 4 s of every\n * push at 40 ms, and more on a serverless database that wakes per connection.\n *\n * Opened on first use and closed by {@link closeAppClients} when the command\n * ends. The scratch database Atlas plans in is created and dropped through the\n * `postgres` database, on a connection of its own: it is not this one.\n */\nconst appClients = new Map<string, Promise<PgClient>>();\n\ntype PgClient = import(\"pg\").Client;\n\nasync function openAppClient(databaseUrl: string, connectionTimeoutMillis?: number): Promise<PgClient> {\n    const open = appClients.get(databaseUrl);\n    if (open) return open;\n    const opening = (async () => {\n        const { Client } = await import(\"pg\");\n        const client = new Client({\n            connectionString: databaseUrl,\n            ...(connectionTimeoutMillis ? { connectionTimeoutMillis } : {})\n        });\n        // A connection can die while it sits idle between steps — Atlas runs\n        // for seconds with this one open. Unheard, that `error` is an uncaught\n        // exception and kills the process; heard, the next step opens another,\n        // and a step running on it fails with its own error, as before.\n        const forget = (): void => {\n            if (appClients.get(databaseUrl) === opening) appClients.delete(databaseUrl);\n        };\n        client.on(\"error\", forget);\n        client.on(\"end\", forget);\n        await client.connect();\n        return client;\n    })();\n    appClients.set(databaseUrl, opening);\n    try {\n        return await opening;\n    } catch (err) {\n        // Not kept: the next step tries again, and reports its own failure the\n        // way it did when every step connected for itself.\n        appClients.delete(databaseUrl);\n        throw err;\n    }\n}\n\n/**\n * Run one step on this process's connection to the app database.\n *\n * Every step leaves the session as it found it, which is what a connection of\n * its own used to guarantee by being closed. None of them sets anything for\n * the session — `SET LOCAL` inside their own transaction, or `RESET` — and one\n * that fails part-way through a transaction it opened is rolled back here, so\n * the next step does not meet `current transaction is aborted`.\n *\n * @param options.connectionTimeoutMillis applies only when this call is the one\n *        that connects.\n */\nexport async function withAppClient<T>(\n    databaseUrl: string,\n    step: (client: PgClient) => Promise<T>,\n    options: { connectionTimeoutMillis?: number } = {}\n): Promise<T> {\n    const client = await openAppClient(databaseUrl, options.connectionTimeoutMillis);\n    try {\n        return await step(client);\n    } catch (err) {\n        // Outside a transaction this is a warning Postgres sends and nobody\n        // reads; on a dead connection it fails too, which changes nothing.\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        throw err;\n    }\n}\n\n/** Close every connection {@link withAppClient} opened. Called once, as the command ends. */\nexport async function closeAppClients(): Promise<void> {\n    const open = [...appClients.values()];\n    appClients.clear();\n    await Promise.all(open.map(async opening => {\n        try {\n            await (await opening).end();\n        } catch {\n            // Already gone, or never connected: nothing to close.\n        }\n    }));\n}\n\n/**\n * Names the empty database Atlas plans against, instead of `<db>_dev_diff`.\n *\n * The derived one is made with `CREATE DATABASE` beside the real database,\n * which assumes a server that holds more than one. PGlite — the managed\n * development database — serves exactly one: the CREATE succeeds and creates\n * nothing, so Atlas connected straight back to the database it was comparing\n * and refused it as \"not clean\". `rebase db push` on the managed database now\n * starts a second, throwaway PGlite and names it here. Anyone can name their\n * own the same way; a named database is neither created nor dropped.\n */\nexport const ATLAS_DEV_URL_ENV = \"REBASE_ATLAS_DEV_URL\";\n\n/**\n * The database Atlas replays the desired schema into: the one\n * {@link ATLAS_DEV_URL_ENV} names (`named: true` — not ours to create or\n * drop), else `<db>_dev_diff`.\n */\nexport function atlasDevDatabaseUrl(\n    databaseUrl: string,\n    env: Readonly<Record<string, string | undefined>>\n): { url: string; named: boolean } {\n    const named = env[ATLAS_DEV_URL_ENV]?.trim();\n    if (!named) return { url: getDevDatabaseUrl(databaseUrl), named: false };\n    if (named === databaseUrl.trim()) {\n        // Atlas would replay the schema into the database it is about to change.\n        throw new Error(\n            `${ATLAS_DEV_URL_ENV} names the same database as DATABASE_URL. It must be a separate, empty ` +\n            \"database that Atlas may fill and clear.\"\n        );\n    }\n    return { url: named, named: true };\n}\n\nexport function getDevDatabaseUrl(databaseUrl: string): string {\n    try {\n        const parsed = new URL(databaseUrl);\n        const dbName = parsed.pathname.slice(1);\n        parsed.pathname = `/${dbName}_dev_diff`;\n        return parsed.toString();\n    } catch {\n        return databaseUrl + \"_dev_diff\";\n    }\n}\n\n/**\n * Create the scratch database Atlas plans against, and say so when we cannot.\n *\n * Atlas needs a `--dev-url` — an empty database it can build the desired state\n * in — and this makes `<db>_dev_diff` next to the real one. The whole body used\n * to be wrapped in an empty catch commented \"Ignore, let Atlas handle\n * connection failures\", and Atlas's version of handling it is `postgres:\n * querying system variables: pq: database \"app_dev_diff\" does not exist\n * (3D000)` — the symptom, four frames downstream of the cause, with the cause\n * thrown away.\n *\n * The cause is almost always `42501`: `CREATE DATABASE` is a privilege managed\n * providers do not grant, so this is the first thing a hosted user hits and the\n * one they can do least with.\n *\n * @returns whether the scratch database was created by *this* call — the only\n *          case in which dropping it afterwards is ours to do.\n */\nexport async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string): Promise<boolean> {\n    let devDbName = \"\";\n    try {\n        const { Client } = await import(\"pg\");\n        const parsed = new URL(databaseUrl);\n        devDbName = new URL(devDatabaseUrl).pathname.slice(1);\n\n        parsed.pathname = \"/postgres\";\n        const client = new Client({ connectionString: parsed.toString() });\n        await client.connect();\n        try {\n            const res = await client.query(\"SELECT 1 FROM pg_database WHERE datname = $1\", [devDbName]);\n            if (res.rowCount === 0) {\n                await client.query(`CREATE DATABASE \"${devDbName}\"`);\n                out(chalk.gray(`  ✓ Created validation database \"${devDbName}\"`));\n\n                return true;\n            }\n        } finally {\n            await client.end();\n        }\n    } catch (err) {\n        outWarn(describeDevDatabaseFailure(err, devDbName || \"<db>_dev_diff\"));\n    }\n\n    return false;\n}\n\n/**\n * What went wrong creating the scratch database, and what to do about it.\n *\n * Exported for its test: the `42501` branch is the one that matters and it\n * cannot be provoked without a non-superuser role.\n */\nexport function describeDevDatabaseFailure(err: unknown, devDbName: string): string {\n    const code = (err as { code?: string } | null)?.code;\n    const message = err instanceof Error ? err.message : String(err);\n\n    const lines = [\n        chalk.yellow(`  ⚠  Could not create the Atlas scratch database \"${devDbName}\": ${message}`)\n    ];\n    if (code === \"42501\") {\n        lines.push(chalk.gray(\n            \"     Atlas plans every change in a throwaway copy of the schema, and CREATE DATABASE\\n\" +\n            \"     is a privilege most managed providers withhold. Two ways forward:\\n\" +\n            `       • GRANT the role CREATEDB:  ALTER ROLE \"<role>\" CREATEDB;\\n` +\n            `       • or create it once by hand:  CREATE DATABASE \"${devDbName}\";`\n        ));\n    } else {\n        lines.push(chalk.gray(\"     Atlas will fail next with `database \\\"\" + devDbName + \"\\\" does not exist (3D000)`, which is this.\"));\n    }\n\n    return lines.join(\"\\n\");\n}\n\n/**\n * Drop the scratch database again, after the command that needed it succeeded.\n *\n * It is a full copy of the schema — no rows, but every table, type and index —\n * and it was left behind per target forever. The only notice anyone got was\n * `rebase db branch prune` reporting \"3 Atlas scratch database(s) left over\n * from db push\", and on a provider that bills per database it is a silent cost.\n *\n * Deliberately NOT called on the failure path: after a failed push the scratch\n * database holds the state Atlas was planning against, which is the one thing\n * worth inspecting.\n */\nexport async function dropDevDatabase(databaseUrl: string, devDatabaseUrl: string): Promise<void> {\n    try {\n        const { Client } = await import(\"pg\");\n        const parsed = new URL(databaseUrl);\n        const devDbName = new URL(devDatabaseUrl).pathname.slice(1);\n\n        parsed.pathname = \"/postgres\";\n        const client = new Client({ connectionString: parsed.toString() });\n        await client.connect();\n        try {\n            await client.query(`DROP DATABASE IF EXISTS \"${devDbName}\"`);\n            out(chalk.gray(`  ✓ Removed validation database \"${devDbName}\"`));\n        } finally {\n            await client.end();\n        }\n    } catch (err) {\n        // Not fatal, and not silent: the push has already succeeded, so the\n        // worst case is one database left where `prune` can find it.\n        outWarn(chalk.gray(\n            `  ⚠  Could not remove the Atlas scratch database: ${err instanceof Error ? err.message : String(err)}\\n` +\n            \"     `rebase db branch prune --include-dev-diff` clears them.\"\n        ));\n    }\n}\n\n/**\n * The generated SQL for the project's `search` blocks, if it has any.\n *\n * @param sqlDir directory holding the generated SQL. Defaults to\n *        `.rebase/sql` under the working directory.\n */\nexport function readSearchDdl(sqlDir: string = generatedSqlDir()): string {\n    const searchFile = path.join(sqlDir, \"search.sql\");\n    if (!fs.existsSync(searchFile)) return \"\";\n    return fs.readFileSync(searchFile, \"utf-8\").trim();\n}\n\n/**\n * Bring the search column, its index and their helpers up to date.\n *\n * Runs *after* Atlas, not before: the statements are `ALTER TABLE ... ADD\n * COLUMN`, so the table has to exist. Atlas is told to ignore these objects\n * entirely (`getSearchExcludes`) — it cannot manage them, and left to itself it\n * would plan a `DROP COLUMN` for every one, since they are absent from the\n * desired state it was given.\n *\n * A no-op when no collection declared `search`. A failure is *not* swallowed:\n * silently pushing a schema whose search column never appeared is how a\n * collection ends up with search configured, no error anywhere, and no results.\n */\nexport async function applySearchDdl(\n    databaseUrl: string,\n    sqlDir: string = generatedSqlDir()\n): Promise<void> {\n    const sql = readSearchDdl(sqlDir);\n    if (!sql) return;\n\n    await withAppClient(databaseUrl, client => client.query(sql));\n    out(chalk.gray(\"  ✓ Applied full-text search columns and indexes\"));\n}\n\n/**\n * Glob patterns keeping Atlas away from the search objects.\n *\n * Returns an empty list — and so changes nothing — for a project with no\n * `search` block, which is every project that has not opted in.\n */\nexport async function getSearchExcludes(collectionsPath: string): Promise<string[]> {\n    const { searchExcludePatterns } = await import(\"./schema/generate-postgres-ddl-logic\");\n    return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));\n}\n\n/**\n * Every `generated column → column it reads` edge in the database.\n *\n * Read from `pg_depend` rather than by matching names in the expression text:\n * a generated column's `pg_attrdef` row carries one `deptype = 'n'` dependency\n * per column its expression references, which is the catalogue's own answer and\n * cannot be fooled by a column name that also appears inside a string literal\n * or as part of a longer identifier.\n *\n * Used by `db push` to find what has to come out of the way before Atlas runs —\n * see `generated-column-conflicts.ts` for why that is necessary at all.\n */\nexport async function queryGeneratedColumnDependencies(\n    databaseUrl: string\n): Promise<GeneratedColumnDependency[]> {\n    return withAppClient(databaseUrl, async client => {\n        const res = await client.query(`\n            SELECT n.nspname       AS \"schema\",\n                   c.relname       AS \"table\",\n                   gen.attname     AS \"column\",\n                   dep.attname     AS \"dependsOn\"\n            FROM pg_attrdef ad\n            JOIN pg_class c         ON c.oid = ad.adrelid\n            JOIN pg_namespace n     ON n.oid = c.relnamespace\n            JOIN pg_attribute gen   ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum\n            JOIN pg_depend d        ON d.classid = 'pg_attrdef'::regclass\n                                   AND d.objid = ad.oid\n                                   AND d.refclassid = 'pg_class'::regclass\n                                   AND d.refobjid = ad.adrelid\n                                   AND d.deptype = 'n'\n            JOIN pg_attribute dep   ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid\n            WHERE gen.attgenerated <> ''\n              AND NOT gen.attisdropped\n              AND NOT dep.attisdropped;\n        `);\n        return res.rows as GeneratedColumnDependency[];\n    });\n}\n\n/**\n * Every column in the database with its current type, for the destructive\n * gate to tell a widening `ALTER COLUMN … TYPE` from one that loses data.\n */\nexport async function queryColumnTypes(databaseUrl: string): Promise<ExistingColumnType[]> {\n    return withAppClient(databaseUrl, async client => (await client.query<ExistingColumnType>(COLUMN_TYPES_SQL)).rows);\n}\n\n/**\n * Drop the generated columns standing in the way of an apply.\n *\n * Their indexes and their `COMMENT ON COLUMN` stamp go with them, which is\n * exactly right: `applySearchDdl` rebuilds all three from `search.sql` and a\n * surviving stamp would make the rebuilt column look like drift.\n */\nexport async function dropGeneratedColumns(\n    databaseUrl: string,\n    statements: string[]\n): Promise<void> {\n    if (statements.length === 0) return;\n    await withAppClient(databaseUrl, async client => {\n        for (const statement of statements) {\n            await client.query(statement);\n        }\n    });\n}\n\n/**\n * The generated SQL for the project's `vector` properties, if it has any.\n *\n * @param sqlDir directory holding the generated SQL. Defaults to\n *        `.rebase/sql` under the working directory.\n */\nexport function readVectorDdl(sqlDir: string = generatedSqlDir()): string {\n    const vectorFile = path.join(sqlDir, \"vector.sql\");\n    if (!fs.existsSync(vectorFile)) return \"\";\n    return fs.readFileSync(vectorFile, \"utf-8\").trim();\n}\n\n/**\n * Install pgvector and bring the vector columns and their ANN indexes up to\n * date.\n *\n * Runs *after* Atlas, like {@link applySearchDdl} and for the same reason: the\n * statements are `ALTER TABLE … ADD COLUMN`, so the table has to exist. Atlas\n * is told to ignore these objects entirely ({@link getVectorExcludes}) — it\n * cannot manage a type its dev database is structurally incapable of having,\n * and left to itself it would plan a `DROP COLUMN` for every one.\n *\n * A no-op when no collection declares a `vector` property. A failure is *not*\n * swallowed: a push that reported success while the embedding column never\n * appeared is how a project ends up with vector search configured, no error\n * anywhere, and no results.\n */\nexport async function applyVectorDdl(\n    databaseUrl: string,\n    sqlDir: string = generatedSqlDir()\n): Promise<void> {\n    const sql = readVectorDdl(sqlDir);\n    if (!sql) return;\n\n    const { vectorExtensionHint } = await import(\"./schema/vector-index\");\n    try {\n        await withAppClient(databaseUrl, client => client.query(sql));\n    } catch (err) {\n        // The boot ensure explains this failure and the push has to as well —\n        // it is the same missing extension, and a push is the *more* likely\n        // place to meet it. Without this the developer gets a bare\n        // `type \"vector\" does not exist`, which names nothing they can act on\n        // and reads like a broken database rather than a line of config.\n        const message = err instanceof Error ? err.message : String(err);\n        const hint = vectorExtensionHint(message);\n        if (!hint) throw err;\n        throw new Error(`${message}${hint}`, { cause: err });\n    }\n    out(chalk.gray(\"  ✓ Applied vector columns and ANN indexes\"));\n}\n\n/**\n * Glob patterns keeping Atlas away from the vector objects.\n *\n * Returns an empty list — and so changes nothing — for a project with no\n * `vector` property, which is every project that has not opted in.\n */\nexport async function getVectorExcludes(collectionsPath: string): Promise<string[]> {\n    const { vectorExcludePatterns } = await import(\"./schema/generate-postgres-ddl-logic\");\n    return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));\n}\n\n/**\n * The generated SQL for the project's `autoValue: \"on_update\"` properties, if\n * it has any.\n *\n * @param sqlDir directory holding the generated SQL. Defaults to\n *        `.rebase/sql` under the working directory.\n */\nexport function readTriggersDdl(sqlDir: string = generatedSqlDir()): string {\n    const triggersFile = path.join(sqlDir, \"triggers.sql\");\n    if (!fs.existsSync(triggersFile)) return \"\";\n    return fs.readFileSync(triggersFile, \"utf-8\").trim();\n}\n\n/**\n * Install the `updated_at` trigger function and bind it to every column that\n * asked for one.\n *\n * Runs *after* Atlas, like {@link applySearchDdl} and {@link applyVectorDdl}:\n * a trigger needs its table and its column to exist. Atlas is told to ignore\n * the triggers ({@link getTriggerExcludes}) because it cannot manage a function\n * at all — its free tier refuses to parse a desired state containing one.\n *\n * A no-op when no property declares `autoValue: \"on_update\"`. A failure is\n * *not* swallowed: a push that reported success while the trigger never\n * appeared is how `updated_at` ends up silently stale for every writer that is\n * not the driver, which is the whole reason the trigger exists.\n */\nexport async function applyTriggersDdl(\n    databaseUrl: string,\n    sqlDir: string = generatedSqlDir()\n): Promise<void> {\n    const sql = readTriggersDdl(sqlDir);\n    if (!sql) return;\n\n    await withAppClient(databaseUrl, client => client.query(sql));\n    out(chalk.gray(\"  ✓ Applied `updated_at` triggers\"));\n}\n\n/** @see getSearchExcludes */\nexport async function getTriggerExcludes(collectionsPath: string): Promise<string[]> {\n    const { triggerExcludePatterns } = await import(\"./schema/generate-postgres-ddl-logic\");\n    return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));\n}\n\n/**\n * Query the live database for every user table/view outside the system\n * catalogs. Separated from {@link getTableExcludes} so its failure mode can\n * be handled explicitly (fail closed) and so tests can inject a stub.\n */\n/**\n * Every index Postgres holds on a table Rebase manages, as\n * `schema.table.index`.\n *\n * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a\n * *constraint* to Atlas, diffed from the constraint declaration, and naming its\n * index in an exclude would shield the constraint itself.\n */\nexport async function queryExistingIndexes(databaseUrl: string): Promise<string[]> {\n    return withAppClient(databaseUrl, async client => {\n        const res = await client.query(`\n            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name\n            FROM pg_index x\n            JOIN pg_class i ON i.oid = x.indexrelid\n            JOIN pg_class t ON t.oid = x.indrelid\n            JOIN pg_namespace n ON n.oid = t.relnamespace\n            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')\n              AND t.relkind IN ('r', 'p')\n              AND NOT EXISTS (\n                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid\n              );\n        `);\n        return res.rows.map((row: { full_name: string }) => row.full_name);\n    });\n}\n\n/**\n * Glob patterns keeping Atlas away from indexes that are not Rebase's.\n *\n * The problem this solves is live and predates the `indexes:` block. `db push`\n * is declarative, so an index on a managed table that is absent from\n * `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified\n * against atlas v1.2.3: create one by hand, re-run an unchanged push, and the\n * plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the\n * auto-approved apply took it without asking. Until now the only way to have\n * an index at all was to write it by hand, which made that the *only* outcome.\n *\n * Ownership rather than a prompt, because once indexes are declarable a drop\n * is usually correct: removing one from the config should remove it from the\n * database, quietly. What must never be dropped is an index Rebase never\n * created — a hand-written one, or one an introspected database arrived with.\n * {@link isRebaseIndexName} is the test, the same arrangement\n * `isGeneratedPolicyName` uses to let policy reconciliation drop only what it\n * generated.\n *\n * The named-in-the-desired-state check comes first and is what makes removal\n * work: a declared index that the author has just deleted still matches the\n * name pattern, is no longer in the plan, and so is *not* excluded — Atlas\n * drops it, as intended.\n *\n * Three-part `schema.table.index`, never two: a two-part pattern reads as a\n * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and\n * reports no error — the trap already recorded for the search excludes.\n */\nexport async function getForeignIndexExcludes(\n    databaseUrl: string,\n    collectionsPath: string,\n    deps: {\n        queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;\n        getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;\n    } = {}\n): Promise<string[]> {\n    const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;\n    const getManaged = deps.getManagedIndexNames ?? managedIndexNames;\n\n    const managed = await getManaged(collectionsPath);\n\n    let existing: string[];\n    try {\n        existing = await queryIndexes(databaseUrl);\n    } catch (err) {\n        // Fails CLOSED, like getTableExcludes: without the catalogue we cannot\n        // tell a foreign index from one of ours, and guessing wrong destroys\n        // an index somebody is relying on.\n        throw new ExcludeIntrospectionError(\n            `Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`,\n            err\n        );\n    }\n\n    return existing.filter(full => {\n        const indexName = full.slice(full.lastIndexOf(\".\") + 1);\n        if (managed.has(indexName)) return false;   // ours, and still declared\n        return !isRebaseIndexName(indexName);       // ours, but no longer declared -> let it drop\n    });\n}\n\n/**\n * The index names the current collections would create — search, vector and\n * declared alike. Anything Atlas would emit is by definition not foreign.\n */\nasync function managedIndexNames(collectionsPath: string): Promise<Set<string>> {\n    const collections = await loadCollectionsForCli(collectionsPath);\n    const { searchExcludePatterns, vectorExcludePatterns } =\n        await import(\"./schema/generate-postgres-ddl-logic\");\n    const { resolveColumnName } = await import(\"./schema/column-plan-helpers\");\n    const { buildCollectionIndexPlan } = await import(\"./schema/collection-index\");\n\n    const names = new Set<string>(\n        buildCollectionIndexPlan(collections, resolveColumnName).map(spec => spec.indexName)\n    );\n    // Search and vector objects are excluded from Atlas wholesale by their own\n    // patterns; listing them here too is harmless and keeps this the single\n    // answer to \"is this index one of ours\". The doc comment above claimed\n    // vector was here long before it was — so an ANN index answered that\n    // question with \"somebody else's\".\n    for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) {\n        names.add(pattern.slice(pattern.lastIndexOf(\".\") + 1));\n    }\n    return names;\n}\n\nexport async function queryExistingTables(databaseUrl: string): Promise<string[]> {\n    return withAppClient(databaseUrl, async client => {\n        const res = await client.query(`\n            SELECT table_schema || '.' || table_name AS full_name\n            FROM information_schema.tables\n            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')\n              AND table_type IN ('BASE TABLE', 'VIEW');\n        `);\n        return res.rows.map((row: { full_name: string }) => row.full_name);\n    });\n}\n\n/**\n * Raised when the exclude list could not be built. `db push` MUST abort on\n * this rather than continue: the exclude list is the only thing shielding\n * non-collection (user/system) tables from the auto-approved declarative\n * apply. A partial list — the old fail-open behaviour — meant a transient\n * introspection hiccup dropped every table not present in `schema.sql`.\n */\nexport class ExcludeIntrospectionError extends Error {\n    constructor(message: string, readonly cause?: unknown) {\n        super(message);\n        this.name = \"ExcludeIntrospectionError\";\n    }\n}\n\n/**\n * Build the `--exclude` list that protects tables Rebase doesn't manage from\n * the declarative apply. Anything not backing a collection (or its M2M\n * junctions) is excluded so Atlas never drops it.\n *\n * Fails **closed**: if the database can't be introspected we cannot know\n * which tables to protect, so we throw {@link ExcludeIntrospectionError}\n * instead of returning a near-empty list and letting the caller drop\n * everything.\n *\n * `deps` is injectable for tests; production uses the real pg-backed queries.\n */\nexport async function getTableExcludes(\n    databaseUrl: string,\n    collectionsPath: string,\n    deps: {\n        queryExistingTables?: (databaseUrl: string) => Promise<string[]>;\n        getIncludes?: (collectionsPath: string) => Promise<string[]>;\n    } = {}\n): Promise<string[]> {\n    const getIncludes = deps.getIncludes ?? getTableIncludes;\n    const queryTables = deps.queryExistingTables ?? queryExistingTables;\n\n    const includes = await getIncludes(collectionsPath);\n    // Schemas the declarative apply must never touch. `rebase` holds the auth\n    // tables (users, refresh_tokens, …), the RLS helper functions and Atlas's\n    // own revision table. Excluding both the schema object AND its contents\n    // keeps Atlas from planning a `DROP SCHEMA … CASCADE` — which on a live\n    // database would take the user/auth tables with it.\n    // `atlas_schema_revisions.*` covers a revision table living outside the\n    // `rebase` schema — an externally managed Atlas setup — which the apply\n    // must not plan changes against either.\n    //\n    // `auth` stays on this list even though Rebase no longer creates it, and\n    // that is the point: on a database still holding the pre-1.0 schema it must\n    // survive until the guarded cleanup retires it, and on a Supabase database\n    // it is somebody else's and must never be in scope at all. Removing it here\n    // would let a `db push` plan `DROP SCHEMA auth CASCADE` against a live\n    // Supabase installation.\n    const excludes: string[] = [\"atlas_schema_revisions.*\", \"auth\", \"auth.*\", \"rebase\", \"rebase.*\"];\n\n    let existingTables: string[];\n    try {\n        existingTables = await queryTables(databaseUrl);\n    } catch (err) {\n        throw new ExcludeIntrospectionError(\n            `Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`,\n            err\n        );\n    }\n\n    for (const table of existingTables) {\n        if (!includes.includes(table)) {\n            excludes.push(table);\n        }\n    }\n\n    return excludes;\n}\n\n\n/**\n * Ask a yes/no question on an interactive terminal.\n *\n * The `isTTY` guard is the contract, not an optimisation: non-interactive\n * shells (CI, pipes, agents) can never answer, and `readline` on a\n * non-TTY stdin resolves with whatever the pipe happens to contain — or never\n * resolves at all. Returning false there is what makes an unattended\n * `db push` abort instead of auto-confirming a destructive change. Callers\n * should already have gone through {@link decidePushSafety}, which decides\n * whether interactive confirmation is even possible; this is the backstop.\n *\n * Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses\n * `import.meta` and cannot be imported by the jest runner.\n */\nexport async function promptConfirm(question: string): Promise<boolean> {\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n","import chalk from \"chalk\";\nimport { outWarn, outError } from \"./cli-output\";\nimport { extractCauseMessage } from \"./utils/error-cause\";\nimport { withAppClient } from \"./cli-helpers\";\n\n/**\n * Detect whether an error (or AggregateError wrapping multiple attempts)\n * represents an ECONNREFUSED — i.e. the database is simply not running.\n *\n * Handles:\n * - Direct `{ code: \"ECONNREFUSED\" }` errors from Node `net`\n * - `AggregateError` from dual-stack IPv4+IPv6 connection attempts\n * - Drizzle's `cause`-wrapped pg errors\n */\nexport function isEconnrefused(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; cause?: unknown; errors?: unknown[] };\n    if (e.code === \"ECONNREFUSED\") return true;\n    // AggregateError from Node net (dual-stack IPv4 + IPv6)\n    if (Array.isArray(e.errors)) {\n        return e.errors.some(inner =>\n            inner && typeof inner === \"object\" && (inner as { code?: string }).code === \"ECONNREFUSED\"\n        );\n    }\n    // Drizzle wraps the pg error in `cause`\n    if (e.cause && typeof e.cause === \"object\") {\n        return isEconnrefused(e.cause);\n    }\n    return false;\n}\n\n/**\n * Detect PostgreSQL authentication failures.\n * PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)\n */\nexport function isAuthFailure(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; cause?: unknown };\n    if (e.code === \"28P01\" || e.code === \"28000\") return true;\n    if (e.cause && typeof e.cause === \"object\") {\n        return isAuthFailure(e.cause);\n    }\n    // Also check the message for common pg auth failure text\n    if (\"message\" in e && typeof (e as { message?: string }).message === \"string\") {\n        const msg = (e as { message: string }).message.toLowerCase();\n        if (msg.includes(\"password authentication failed\") || msg.includes(\"no pg_hba.conf entry\")) {\n            return true;\n        }\n    }\n    return false;\n}\n\n/**\n * Detect the \"SSL is not enabled on the server\" failure — the client attempted\n * an SSL handshake against a Postgres server that doesn't support it (common\n * with a plain local dev database). The fix is `?sslmode=disable` on the URL.\n */\nexport function isSslNotEnabled(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { message?: string; cause?: unknown };\n    if (typeof e.message === \"string\" && e.message.toLowerCase().includes(\"ssl is not enabled on the server\")) {\n        return true;\n    }\n    if (e.cause && typeof e.cause === \"object\") {\n        return isSslNotEnabled(e.cause);\n    }\n    return false;\n}\n\n/**\n * Detect PostgreSQL \"cannot drop ... because other objects depend on it\"\n * (error code 2BP01, dependent_objects_still_exist). This is the failure that\n * strands a declarative `db push` half-applied when a collection is removed but\n * an enum type it defined is still referenced by another object.\n */\nexport function isDependencyDropError(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; message?: string; cause?: unknown };\n    if (e.code === \"2BP01\") return true;\n    if (typeof e.message === \"string\") {\n        const msg = e.message.toLowerCase();\n        if (msg.includes(\"other objects depend on it\") || msg.includes(\"cannot drop type\")) {\n            return true;\n        }\n    }\n    if (e.cause && typeof e.cause === \"object\") {\n        return isDependencyDropError(e.cause);\n    }\n    return false;\n}\n\n/**\n * Parse host:port from a DATABASE_URL for display purposes.\n *\n * Exported because every message about a connection has to name the thing it\n * could not reach, and the boot path needs the same rendering the CLI banners\n * use — including the same refusal to print the URL itself, which carries the\n * password.\n */\nexport function parseHostInfo(databaseUrl: string): string {\n    try {\n        const parsed = new URL(databaseUrl);\n        return `${parsed.hostname}:${parsed.port || 5432}`;\n    } catch {\n        return \"unknown\";\n    }\n}\n\n/**\n * The sentence the operating system actually produced, dug out of the wrappers.\n *\n * `connect ECONNREFUSED 127.0.0.1:5432` is written by `net`, then wrapped by\n * `pg`, then wrapped again by Drizzle as `Failed query: …` — and on a\n * dual-stack host it is not in `.cause` at all but inside the\n * `AggregateError.errors` array of one attempt per resolved address. Printing\n * the banner without it loses the one token every search engine, runbook and\n * colleague recognises.\n */\nexport function deepestErrorMessage(err: unknown): string | null {\n    if (!err || typeof err !== \"object\") return null;\n    const e = err as { message?: string; code?: string; cause?: unknown; errors?: unknown[] };\n\n    if (Array.isArray(e.errors)) {\n        for (const inner of e.errors) {\n            const deeper = deepestErrorMessage(inner);\n            if (deeper) return deeper;\n        }\n    }\n    if (e.cause) {\n        const deeper = deepestErrorMessage(e.cause);\n        if (deeper) return deeper;\n    }\n    if (typeof e.message === \"string\" && e.message && !e.message.startsWith(\"Failed query:\")) {\n        return e.code ? `${e.message} (${e.code})` : e.message;\n    }\n    return null;\n}\n\n/** One indented line naming the driver's own reason, or nothing. */\nfunction driverReasonLine(err: unknown): string {\n    const reason = err === undefined ? null : deepestErrorMessage(err);\n    return reason ? `  The driver said: ${reason}\\n\\n` : \"\";\n}\n\n/**\n * Format a diagnostic banner for ECONNREFUSED errors.\n */\nfunction formatConnectionRefusedBanner(databaseUrl: string, err?: unknown): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Cannot connect to PostgreSQL at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        driverReasonLine(err) +\n        `  The database server is not running or is not accepting\\n` +\n        `  connections. Common fixes:\\n` +\n        `\\n` +\n        `    • docker compose up -d db          (the service a Rebase scaffold ships)\\n` +\n        `    • brew services start postgresql@18\\n` +\n        `    • Verify DATABASE_URL in your .env file\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for authentication failures.\n */\nfunction formatAuthFailureBanner(databaseUrl: string, err?: unknown): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    let username = \"unknown\";\n    try {\n        username = new URL(databaseUrl).username || \"unknown\";\n    } catch { /* ignore */ }\n\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Authentication failed for user \"${username}\" at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        driverReasonLine(err) +\n        `  PostgreSQL rejected the credentials. Common fixes:\\n` +\n        `\\n` +\n        `    • Check the username and password in DATABASE_URL\\n` +\n        `    • Verify the user exists:  psql -c \"\\\\du\"\\n` +\n        `    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for \"SSL is not enabled on the server\".\n */\nfunction formatSslNotEnabledBanner(databaseUrl: string): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    const suggestion = databaseUrl.includes(\"?\") ? \"&sslmode=disable\" : \"?sslmode=disable\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  SSL is not enabled on the PostgreSQL server at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  The client tried to connect over SSL, but the server does not\\n` +\n        `  support it. This is normal for a plain local dev database.\\n` +\n        `\\n` +\n        `  Fix: append ${chalk.bold(\"sslmode=disable\")} to DATABASE_URL, e.g.\\n` +\n        `\\n` +\n        `    DATABASE_URL=...${suggestion}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for a dependency-drop failure during `db push`.\n * Explains that the database may be left partially migrated and how to recover.\n */\nfunction formatDependencyDropBanner(): string {\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Schema push failed: a type/table could not be dropped\\n` +\n        `      because other objects still depend on it.\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"The database may now be partially migrated.\")} Atlas applies\\n` +\n        `  statements individually, so earlier changes in this push may\\n` +\n        `  already be committed while later ones failed.\\n` +\n        `\\n` +\n        `  This commonly happens when a collection is removed but an enum\\n` +\n        `  type it defined is still referenced. To recover:\\n` +\n        `\\n` +\n        `    1. Inspect the leftover object named in the error above.\\n` +\n        `    2. Drop it with CASCADE, e.g.:\\n` +\n        `         psql \"$DATABASE_URL\" -c 'DROP TYPE \"<name>\" CASCADE;'\\n` +\n        `    3. Re-run:  ${chalk.bold.green(\"rebase db push\")}\\n` +\n        `\\n` +\n        `  Prefer a safe, versioned workflow? Use ${chalk.bold(\"rebase db generate\")}\\n` +\n        `  + ${chalk.bold(\"rebase db migrate\")} instead of push for destructive changes.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Pre-flight check: verify that the database is reachable before running\n * a heavy subprocess (Atlas, migrations, etc.).\n *\n * Exits with code 1 and a friendly banner on known failure modes.\n * On unknown errors, logs a warning and allows the caller to proceed.\n */\nexport async function checkDatabaseConnectivity(databaseUrl: string): Promise<void> {\n    try {\n        // On the command's own connection, which every step after this uses\n        // too — so a probe that passes leaves it open rather than closing a\n        // connection the next step would reopen. See `withAppClient`.\n        await withAppClient(databaseUrl, client => client.query(\"SELECT 1\"), { connectionTimeoutMillis: 5000 });\n    } catch (err: unknown) {\n        if (isEconnrefused(err)) {\n            outError(formatConnectionRefusedBanner(databaseUrl, err));\n            process.exit(1);\n        }\n        if (isAuthFailure(err)) {\n            outError(formatAuthFailureBanner(databaseUrl, err));\n            process.exit(1);\n        }\n        if (isSslNotEnabled(err)) {\n            outError(formatSslNotEnabledBanner(databaseUrl));\n            process.exit(1);\n        }\n        // Unknown error — warn but don't block; let the downstream tool surface details\n        outWarn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));\n        outWarn(chalk.gray(\"    Proceeding anyway — the command may fail if the database is unreachable.\"));\n    }\n}\n\n/**\n * Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).\n * Returns a formatted diagnostic string if the error matches a known pattern,\n * or null if unrecognized.\n */\nexport function diagnoseDbError(err: unknown, databaseUrl?: string): string | null {\n    if (isEconnrefused(err)) {\n        return formatConnectionRefusedBanner(databaseUrl || \"\", err);\n    }\n    if (isAuthFailure(err)) {\n        return formatAuthFailureBanner(databaseUrl || \"\", err);\n    }\n    if (isSslNotEnabled(err)) {\n        return formatSslNotEnabledBanner(databaseUrl || \"\");\n    }\n    if (isDependencyDropError(err)) {\n        return formatDependencyDropBanner();\n    }\n    return null;\n}\n\n/**\n * Say why the command failed, on the way out.\n *\n * The entry point below used to be `.catch(() => process.exit(1))`, which threw\n * the error away. Every message this file and its services raise — \"Branch\n * \\\"x\\\" already exists.\", \"the source database has active connections\", \"Branch\n * name is too long\" — was written, wrapped in the right PG error code, and then\n * discarded one frame before it reached a terminal. What a developer saw was a\n * header line, no error, and exit 1.\n *\n * Two shapes are deliberately kept quiet:\n *\n * - **A child process that already spoke.** Atlas, `pg_dump` and `psql` run\n *   with inherited stdio, so their diagnosis is on the terminal already and\n *   execa's wrapper adds only `Command failed with exit code 1: atlas …`.\n *   `packages/cli` filters exactly these two phrasings one level up\n *   (`runDbCommand`), and this is that filter, for the process that is actually\n *   throwing.\n *\n * - **A message that is only a query.** Drizzle reports failures as\n *   `Failed query: <sql> params:` and hides the real PostgreSQL error in\n *   `cause`, so the wrapper alone tells a reader nothing they can act on. The\n *   cause is appended when it says something the message does not.\n *\n * - **An error that has already printed its own diagnosis**, marked\n *   `alreadyReported`. `CollectionsPathMissing` is one: it prints the path, what\n *   it resolved to and the cwd it resolved against, and then throws so the entry\n *   point owns the exit code. Repeating its one-line summary underneath would\n *   undo the \"printed once\" this whole path exists for.\n */\nexport function reportCommandFailure(error: unknown): void {\n    const message = error instanceof Error ? error.message : String(error ?? \"\");\n\n    if ((error as { alreadyReported?: boolean } | null)?.alreadyReported) return;\n    if (!message || /Command failed|exited with code/i.test(message)) return;\n\n    outError(\"\");\n    outError(chalk.red(`  ✗ ${message}`));\n\n    const cause = extractCauseMessage(error);\n    if (cause && !message.includes(cause)) {\n        outError(chalk.gray(`    ${cause}`));\n    }\n    outError(\"\");\n}\n\n/* ------------------------------------------------------------------------- *\n * Atlas failures that have a remedy\n *\n * Atlas runs with a teed stderr, so what reaches these is its output as text,\n * not a `pg` error object carrying a `code`. They are deliberately NOT part of\n * `diagnoseDbError`: that one is shared with the boot path, and \"record a\n * baseline with `rebase db migrate`\" is advice for somebody standing at a\n * terminal, not for a container that has just failed to start.\n * ------------------------------------------------------------------------- */\n\n/**\n * `migrate apply` refusing because the database already has the schema.\n *\n * `42710` (duplicate_object) and `42P07` (duplicate_table) are what a migration\n * hits when boot-ensure — or a `db push` — has already provisioned the objects\n * it was going to create. Since boot-ensure provisions *every* production\n * database, this is the normal case rather than the exotic one, and the raw\n * failure (`pq: type \"posts_status\" already exists (42710)`, then `sql/migrate:\n * write revision: … current transaction is aborted`) names no way forward.\n */\nexport function parseAlreadyProvisioned(text: string): { object: string; code: string } | null {\n    const withCode = /(?:type|relation|constraint|schema) \"([^\"]+)\" already exists \\((42710|42P07)\\)/.exec(text);\n    if (withCode) return { object: withCode[1], code: withCode[2] };\n    // Some Atlas builds keep the SQLSTATE on a following line instead.\n    const bare = /(?:type|relation|constraint|schema) \"([^\"]+)\" already exists/.exec(text);\n    if (bare && /42710|42P07/.test(text)) return { object: bare[1], code: /42P07/.test(text) ? \"42P07\" : \"42710\" };\n    return null;\n}\n\n/**\n * What to do about it: tell Atlas the database is already at a version.\n *\n * Atlas's own mechanism (`migrate apply --baseline <version>`), not a ledger of\n * ours — it writes the revision row Atlas reads, so every later `rebase db\n * migrate` is an ordinary one.\n */\nexport function formatBaselineRemedy(version: string | null, object?: string): string {\n    const versionToken = version ?? \"<version>\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  This database already has the schema this migration creates\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        (object ? `  ${chalk.gray(`\"${object}\" is already there, so the migration cannot create it.`)}\\n\\n` : \"\") +\n        `  Nothing is wrong with the migration — the database was provisioned\\n` +\n        `  another way. Every Rebase boot ensures the schema, and ${chalk.bold(\"rebase db push\")}\\n` +\n        `  applies it directly, so a database that has ever run either one is\\n` +\n        `  ahead of a migration history that was never recorded.\\n` +\n        `\\n` +\n        `  Record where it already is, then migrate normally:\\n` +\n        `\\n` +\n        `    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\\n` +\n        `    ${chalk.bold.green(\"rebase db migrate\")}\\n` +\n        `\\n` +\n        `  The baseline is the version already applied — the numeric prefix of\\n` +\n        `  the migration file describing what is in the database now. Migrations\\n` +\n        `  after it run; it and everything before it are marked done.\\n` +\n        `\\n` +\n        `  On a database nothing has ever booted against, none of this is needed.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */\nexport function parseNotNullViolation(text: string): { table: string; column: string } | null {\n    const match = /column \"([^\"]+)\" of relation \"([^\"]+)\" contains null values/.exec(text);\n    return match ? { table: match[2], column: match[1] } : null;\n}\n\n/**\n * Whether the column that refused NOT NULL was being added by this push, read\n * from the statement Atlas was running: `true` for `ADD COLUMN \"<column>\"`,\n * `false` for any other statement that names it (`ALTER COLUMN … SET NOT\n * NULL`), `null` when the error carried no statement.\n */\nexport function notNullColumnIsNew(stderr: string, column: string): boolean | null {\n    const statement = parseFailedStatement(stderr);\n    if (!statement) return null;\n    const quoted = column.replace(/\"/g, \"\\\"\\\"\").replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\");\n    return new RegExp(`ADD\\\\s+COLUMN\\\\s+(?:IF\\\\s+NOT\\\\s+EXISTS\\\\s+)?\"${quoted}\"`, \"i\").test(statement);\n}\n\n/**\n * The ways out, and only the ones that work for this column.\n *\n * A `defaultValue` backfills only a column the push is adding: PostgreSQL\n * fills `ADD COLUMN … NOT NULL DEFAULT …` for every existing row, but `ALTER\n * COLUMN … SET DEFAULT` touches no row that is already there, so for an\n * existing column that remedy fails exactly as before. When the error does not\n * say which it was (`isNew` null), the default is offered with that caveat.\n *\n * Boot-ensure handles this case — it adds the column nullable and sets NOT NULL\n * only when the table is empty — so a push that dies here is strictly worse\n * than the boot that would have run instead.\n */\nexport function formatNotNullViolationBanner(\n    violation: { table: string; column: string },\n    rowCount: number | null,\n    isNew: boolean | null = null\n): string {\n    const { table, column } = violation;\n    const rows = rowCount === null\n        ? `  \"${table}\" already holds rows, and none of them has a value for \"${column}\".\\n`\n        : `  \"${table}\" already holds ${rowCount} row${rowCount === 1 ? \"\" : \"s\"}, and they have no value for \"${column}\".\\n`;\n    const backfill =\n        `Backfill by hand first, then push again:\\n` +\n        `         ${chalk.gray(`psql \"$DATABASE_URL\" -c 'UPDATE \"${table}\" SET \"${column}\" = … WHERE \"${column}\" IS NULL;'`)}\\n`;\n    const leaveOptional = `Leave it optional — take \\`validation.required\\` off the property.\\n`;\n    const defaultLine = (caveat: string) =>\n        `Give the property a default, so the push can backfill${caveat}:\\n` +\n        `         ${chalk.gray(`{ type: \"string\", defaultValue: \"…\", validation: { required: true } }`)}\\n`;\n    const remedies = isNew === false\n        ? [backfill, leaveOptional]\n        : isNew === true\n            ? [defaultLine(\"\"), backfill, leaveOptional]\n            : [backfill, defaultLine(\" (only if this push adds the column — a default never fills rows that already exist)\"), leaveOptional];\n    const count = [\"\", \"One way\", \"Two ways\", \"Three ways\"][remedies.length];\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Cannot make \"${table}\".\"${column}\" required: existing rows are null\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        rows +\n        `  PostgreSQL will not add the NOT NULL until every one of them does.\\n` +\n        `\\n` +\n        `  ${count} forward:\\n` +\n        `\\n` +\n        remedies.map((r, i) => `    ${i + 1}. ${r}`).join(\"\") +\n        `\\n` +\n        `  ${chalk.gray(\"Nothing in this push was applied: Atlas applies it as one transaction.\")}\\n` +\n        `  ${chalk.gray(\"`rebase dev` would have kept the column nullable instead:\")}\\n` +\n        `  ${chalk.gray(\"boot sets NOT NULL only when it is safe.\")}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */\nexport function parseEnumLabelDrop(text: string): { label: string; enumType: string } | null {\n    const match = /dropping (?:enum )?value \"([^\"]+)\" from enum \"([^\"]+)\" is not supported/.exec(text);\n    return match ? { label: match[1], enumType: match[2] } : null;\n}\n\n/**\n * Why the two paths disagree, and what retiring an option id actually costs.\n *\n * Boot-ensure adds enum labels and never removes one, so `rebase dev` accepts\n * the very edit that stops `db push` dead. PostgreSQL has no `ALTER TYPE …\n * DROP VALUE`: a label goes only by rewriting the type, which is a data\n * migration and not a schema push.\n */\nexport function formatEnumLabelDropBanner(drop: { label: string; enumType: string }): string {\n    const { label, enumType } = drop;\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  \"${label}\" cannot be removed from the enum \"${enumType}\"\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  PostgreSQL has no ALTER TYPE … DROP VALUE. An option id can be added\\n` +\n        `  to an enum but never taken out of one, so renaming an id reads as a\\n` +\n        `  removal and a push cannot carry it.\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"Nothing was applied.\")} ${chalk.bold(\"rebase dev\")} accepts this same edit — boot adds\\n` +\n        `  new labels and never removes one — so the two paths disagree by\\n` +\n        `  design, and the old label would simply have stayed behind, unused.\\n` +\n        `\\n` +\n        `  To keep the id: put \"${label}\" back and change only its label text.\\n` +\n        `\\n` +\n        `  To retire it for real, it is a data migration:\\n` +\n        `\\n` +\n        `    1. Add the new id alongside the old one, and push.\\n` +\n        `    2. Move the rows:  ${chalk.gray(`UPDATE … SET … = '<new>' WHERE … = '${label}';`)}\\n` +\n        `    3. Rewrite the type, which is what actually drops the label:\\n` +\n        `       ${chalk.gray(\"rebase db generate retire_option && rebase db migrate\")}\\n` +\n        `       ${chalk.gray(\"(a migration can CREATE TYPE …, ALTER TABLE … TYPE … USING, DROP TYPE)\")}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * The statement Atlas was running when it failed, unescaped.\n *\n * Two spellings, one per phase: the apply quotes it\n * (`executing statement \"ALTER TABLE \\\"public\\\".\\\"people\\\" …;\": pq: …`), and\n * the dry-run's analysis does not\n * (`analyzing plan: executing statement: ALTER TABLE \"public\".\"people\" …;: pq: …`).\n */\nexport function parseFailedStatement(text: string): string | null {\n    const quoted = /executing statement \"((?:[^\"\\\\]|\\\\.)*)\"/.exec(text);\n    if (quoted) return quoted[1].replace(/\\\\(.)/g, \"$1\");\n    const bare = /executing statement: ([\\s\\S]*?;): pq:/.exec(text);\n    return bare ? bare[1] : null;\n}\n\n/** `ALTER TABLE \"public\".\"people\" …` → `{ schema: \"public\", table: \"people\" }`. */\nexport function failedStatementTable(statement: string): { schema?: string; table: string } | null {\n    const ident = String.raw`(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_$]*))`;\n    const match = new RegExp(String.raw`^\\s*(?:ALTER\\s+TABLE|CREATE\\s+UNIQUE\\s+INDEX\\s+\\S+\\s+ON)\\s+(?:ONLY\\s+)?${ident}(?:\\.${ident})?`, \"i\")\n        .exec(statement);\n    if (!match) return null;\n    const first = (match[1] ?? match[2]).replace(/\"\"/g, \"\\\"\");\n    const second = match[3] ?? match[4];\n    return second === undefined\n        ? { table: first }\n        : { schema: first, table: second.replace(/\"\"/g, \"\\\"\") };\n}\n\n/** A generated column standing in the way of a retype, as the catalogue has it. */\nexport interface GeneratedColumnBlocker {\n    schema: string;\n    table: string;\n    /** The generated column. */\n    column: string;\n    /** The column it reads, which the statement retypes. */\n    reads: string;\n}\n\n/**\n * PostgreSQL refusing to retype a column a `GENERATED ALWAYS AS … STORED`\n * expression reads (0A000). `db push` moves Rebase's own search columns out of\n * the way before the apply; this is what is left when it could not.\n */\nexport function parseGeneratedColumnRefusal(text: string): { statement: string | null } | null {\n    if (!/cannot alter type of a column used by a generated column/.test(text)) return null;\n    return { statement: parseFailedStatement(text) };\n}\n\n/**\n * Which generated columns read a column the failed statement retypes — read\n * from the catalogue, because PostgreSQL's DETAIL naming them does not survive\n * Atlas.\n */\nasync function generatedColumnsBlocking(\n    databaseUrl: string | undefined,\n    statement: string | null\n): Promise<GeneratedColumnBlocker[]> {\n    if (!databaseUrl || !statement) return [];\n    const target = failedStatementTable(statement);\n    if (!target) return [];\n    const retyped = [...statement.matchAll(/ALTER\\s+(?:COLUMN\\s+)?\"((?:[^\"]|\"\")+)\"\\s+(?:SET\\s+DATA\\s+)?TYPE\\b/gi)]\n        .map(match => match[1].replace(/\"\"/g, \"\\\"\"));\n    if (retyped.length === 0) return [];\n    try {\n        const { Client } = await import(\"pg\");\n        const client = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 5000 });\n        await client.connect();\n        try {\n            const res = await client.query<GeneratedColumnBlocker>(`\n                SELECT n.nspname AS \"schema\", c.relname AS \"table\", gen.attname AS \"column\", dep.attname AS \"reads\"\n                FROM pg_attrdef ad\n                JOIN pg_class c       ON c.oid = ad.adrelid\n                JOIN pg_namespace n   ON n.oid = c.relnamespace\n                JOIN pg_attribute gen ON gen.attrelid = ad.adrelid AND gen.attnum = ad.adnum\n                JOIN pg_depend d      ON d.classid = 'pg_attrdef'::regclass AND d.objid = ad.oid\n                                     AND d.refclassid = 'pg_class'::regclass AND d.refobjid = ad.adrelid\n                JOIN pg_attribute dep ON dep.attrelid = ad.adrelid AND dep.attnum = d.refobjsubid\n                WHERE gen.attgenerated <> '' AND c.relname = $1\n                  AND ($2::text IS NULL OR n.nspname = $2) AND dep.attname = ANY($3::text[])\n                ORDER BY 1, 2, 3, 4`, [target.table, target.schema ?? null, retyped]);\n            return res.rows;\n        } finally {\n            await client.end();\n        }\n    } catch {\n        return [];\n    }\n}\n\n/**\n * What to do when a generated column stops a retype.\n *\n * A collection's own search column should never reach this — `db push` drops\n * it before the apply and rebuilds it after — so seeing one named here means\n * that machinery missed it, which is a bug worth a report. Any other generated\n * column is somebody's, with an expression Rebase holds no copy of.\n */\nexport function formatGeneratedColumnRefusalBanner(\n    refusal: { statement: string | null },\n    blockers: GeneratedColumnBlocker[]\n): string {\n    const named = blockers.length > 0\n        ? blockers.map(b => `    ${chalk.bold(`${b.schema}.${b.table}.${b.column}`)} reads \"${b.reads}\"`).join(\"\\n\") + \"\\n\\n\"\n        : refusal.statement\n            ? `  The statement:\\n    ${chalk.gray(refusal.statement.replace(/\\s+/g, \" \"))}\\n\\n`\n            : \"\";\n    const first = blockers[0];\n    const drop = first\n        ? `ALTER TABLE \"${first.schema}\".\"${first.table}\" DROP COLUMN \"${first.column}\";`\n        : \"ALTER TABLE … DROP COLUMN <the generated column>;\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  A generated column reads a column this push retypes\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        named +\n        `  PostgreSQL will not retype a column while a GENERATED ALWAYS AS …\\n` +\n        `  STORED expression reads it, and Atlas applies a push as one\\n` +\n        `  transaction — ${chalk.yellow(\"nothing in this push was applied.\")}\\n` +\n        `\\n` +\n        `  A collection's ${chalk.bold(\"search\")} column is dropped and rebuilt around the apply\\n` +\n        `  by the push itself. If that is the column named above, run the push\\n` +\n        `  again, and please report it: it should not have got this far.\\n` +\n        `\\n` +\n        `  Any other generated column is yours. Drop it, push, and put it back\\n` +\n        `  with its original expression:\\n` +\n        `\\n` +\n        `    ${chalk.gray(drop)}\\n` +\n        `    ${chalk.gray(\"rebase db push\")}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * PostgreSQL refusing a retype it has no implicit cast for (42804): `string` →\n * `number`, `time` → `date`, an array back to a string. Atlas reports it from\n * the dry-run's analysis as well as from the apply, so without this a\n * `--dry-run` died with the raw error and showed no plan at all.\n */\nexport function parseUncastableRetype(text: string): { column: string; type: string; statement: string | null } | null {\n    const match = /column \"((?:[^\"]|\"\")+)\" cannot be cast automatically to type ([^\\n(]+?)\\s*(?:\\(42804\\)|$|\\n)/m.exec(text);\n    if (!match) return null;\n    return { column: match[1], type: match[2].trim(), statement: parseFailedStatement(text) };\n}\n\n/** The `ALTER … USING` a developer would run, and the other ways past it. Boot's drift report says the same. */\nexport function formatUncastableRetypeBanner(refusal: { column: string; type: string; statement: string | null }): string {\n    const { column, type, statement } = refusal;\n    const target = statement ? failedStatementTable(statement) : null;\n    const table = target ? `${target.schema ? `\"${target.schema}\".` : \"\"}\"${target.table}\"` : \"<table>\";\n    const quotedColumn = `\"${column.replace(/\"/g, \"\\\"\\\"\")}\"`;\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  ${table}.${quotedColumn} cannot be converted to ${type} automatically\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  The collection now declares this column as ${type}, and PostgreSQL has\\n` +\n        `  no implicit conversion from what the column holds today. Atlas stops\\n` +\n        `  at the first such statement — ${chalk.yellow(\"nothing in this push was applied\")}, and a\\n` +\n        `  --dry-run cannot show the rest of the plan until this one is settled.\\n` +\n        `\\n` +\n        `  Three ways forward:\\n` +\n        `\\n` +\n        `    1. Convert the values yourself, saying how, then push again:\\n` +\n        `         ${chalk.gray(`ALTER TABLE ${table} ALTER COLUMN ${quotedColumn} TYPE ${type} USING ${quotedColumn}::${type};`)}\\n` +\n        `       ${chalk.gray(\"(adjust the USING expression to whatever turns each old value into a new one)\")}\\n` +\n        `    2. Add a new property for the new type, copy the values over with an\\n` +\n        `       UPDATE, then remove the old property.\\n` +\n        `    3. Keep the column as it is — put the property's type back, or pin the\\n` +\n        `       database type with ${chalk.bold(\"columnType\")}.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * A unique constraint or index PostgreSQL could not build because the rows\n * already repeat a value (23505). The DETAIL naming the value does not survive\n * Atlas, so the duplicates are read back from the table.\n */\nexport function parseUniqueBuildFailure(text: string): { index: string; statement: string | null; columns: string[] } | null {\n    const match = /could not create unique index \"((?:[^\"]|\"\")+)\"/.exec(text);\n    if (!match) return null;\n    const statement = parseFailedStatement(text);\n    let columns: string[] = [];\n    if (statement) {\n        const list = /UNIQUE\\s*\\(([^)]*)\\)/i.exec(statement)\n            ?? /\\bON\\s+(?:ONLY\\s+)?(?:\"(?:[^\"]|\"\")+\"|[A-Za-z_][\\w$]*)(?:\\.(?:\"(?:[^\"]|\"\")+\"|[A-Za-z_][\\w$]*))?\\s*(?:USING\\s+\\w+\\s*)?\\(([^)]*)\\)/i.exec(statement);\n        if (list) {\n            columns = [...list[1].matchAll(/\"((?:[^\"]|\"\")+)\"|([A-Za-z_][\\w$]*)/g)]\n                .map(m => (m[1] ?? m[2]).replace(/\"\"/g, \"\\\"\"));\n        }\n    }\n    return { index: match[1], statement, columns };\n}\n\n/** Up to five repeated values, read from the database, or `[]` when we cannot say. */\nasync function duplicateValues(\n    databaseUrl: string | undefined,\n    target: { schema?: string; table: string } | null,\n    columns: string[]\n): Promise<{ values: string; count: number }[]> {\n    if (!databaseUrl || !target || columns.length === 0) return [];\n    const ident = (name: string) => `\"${name.replace(/\"/g, \"\\\"\\\"\")}\"`;\n    const table = `${target.schema ? `${ident(target.schema)}.` : \"\"}${ident(target.table)}`;\n    const cols = columns.map(ident).join(\", \");\n    try {\n        const { Client } = await import(\"pg\");\n        const client = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 5000 });\n        await client.connect();\n        try {\n            // Identifiers from the failed statement, quoted; no value is interpolated.\n            const res = await client.query<{ values: string; count: number }>(\n                `SELECT concat_ws(', ', ${columns.map(c => `${ident(c)}::text`).join(\", \")}) AS \"values\", count(*)::int AS \"count\"\n                 FROM ${table} GROUP BY ${cols} HAVING count(*) > 1 ORDER BY count(*) DESC LIMIT 5`);\n            return res.rows;\n        } finally {\n            await client.end();\n        }\n    } catch {\n        return [];\n    }\n}\n\nexport function formatUniqueBuildFailureBanner(\n    failure: { index: string; statement: string | null; columns: string[] },\n    duplicates: { values: string; count: number }[]\n): string {\n    const target = failure.statement ? failedStatementTable(failure.statement) : null;\n    const table = target ? `${target.schema ? `\"${target.schema}\".` : \"\"}\"${target.table}\"` : \"<table>\";\n    const cols = failure.columns.length > 0 ? failure.columns.map(c => `\"${c}\"`).join(\", \") : \"<column>\";\n    const listed = duplicates.length > 0\n        ? `  Repeated values:\\n` + duplicates.map(d => `    ${chalk.bold(d.values)}  ${chalk.gray(`× ${d.count}`)}`).join(\"\\n\") + `\\n\\n`\n        : \"\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Cannot make ${table} (${cols}) unique: rows already repeat a value\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        listed +\n        `  PostgreSQL will not build \"${failure.index}\" while two rows share a\\n` +\n        `  value, and Atlas applies a push as one transaction — ${chalk.yellow(\"nothing in\")}\\n` +\n        `  ${chalk.yellow(\"this push was applied.\")}\\n` +\n        `\\n` +\n        `  Find them:\\n` +\n        `    ${chalk.gray(`SELECT ${cols}, count(*) FROM ${table} GROUP BY ${cols} HAVING count(*) > 1;`)}\\n` +\n        `\\n` +\n        `  Then change or delete the repeats and push again, or take ${chalk.bold(\"unique\")} off\\n` +\n        `  the property.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** How many rows a table holds, or `null` when we cannot say. */\nasync function countRows(databaseUrl: string | undefined, table: string): Promise<number | null> {\n    if (!databaseUrl) return null;\n    try {\n        const { Client } = await import(\"pg\");\n        const client = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 5000 });\n        await client.connect();\n        try {\n            // Identifier interpolation, and it has to be: the name comes from\n            // PostgreSQL's own error text, and `count(*)` takes no parameter in\n            // that position. Quoted, with any embedded quote doubled.\n            const res = await client.query(`SELECT count(*)::int AS n FROM \"${table.replace(/\"/g, \"\\\"\\\"\")}\"`);\n            return (res.rows[0] as { n: number } | undefined)?.n ?? null;\n        } finally {\n            await client.end();\n        }\n    } catch {\n        return null;\n    }\n}\n\n/**\n * A hand-written generated column reading a column the plan wants to retype or\n * drop.\n *\n * Rebase's own generated columns are dropped and rebuilt around the apply — it\n * holds their definition in `search.sql`. This one it does not: PostgreSQL\n * stores a generated expression only in the catalogue, so dropping it to let\n * the apply through would destroy the only copy. Refuse instead, and say what\n * the operator can do about it.\n */\nexport function formatForeignGeneratedColumnBanner(\n    conflicts: { schema: string; table: string; column: string; blocking: { column: string; kind: string }[] }[]\n): string {\n    const lines = conflicts.map(c => {\n        const reads = c.blocking.map(b => `\"${b.column}\"`).join(\", \");\n        return `    ${chalk.bold(`${c.schema}.${c.table}.${c.column}`)} reads ${reads}`;\n    });\n    const first = conflicts[0];\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  A generated column depends on a column this push changes\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        lines.join(\"\\n\") + `\\n` +\n        `\\n` +\n        `  PostgreSQL refuses to retype or drop a column while a GENERATED\\n` +\n        `  ALWAYS AS … STORED expression reads it, and an Atlas apply is one\\n` +\n        `  transaction — so this refusal would roll back every other statement\\n` +\n        `  in the push with it.\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"Nothing was applied.\")} Rebase rebuilds the generated columns it made\\n` +\n        `  itself (a collection's ${chalk.bold(\"search\")} block) around the apply. It has no\\n` +\n        `  definition for this one, and a dropped generated expression is not\\n` +\n        `  recoverable from anywhere but your own migration.\\n` +\n        `\\n` +\n        `  Drop it, push, and put it back:\\n` +\n        `\\n` +\n        `    ${chalk.gray(`ALTER TABLE \"${first.schema}\".\"${first.table}\" DROP COLUMN \"${first.column}\";`)}\\n` +\n        `    ${chalk.gray(\"rebase db push\")}\\n` +\n        `    ${chalk.gray(\"-- then re-create the column with its original expression\")}\\n` +\n        `\\n` +\n        `  Or declare it through a ${chalk.bold(\"search\")} block, and Rebase will own it.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * The remedy for an Atlas invocation that failed, or `null`.\n *\n * Scoped by the invocation, because the same database state means different\n * things to different subcommands: \"already exists\" under `migrate apply` wants\n * a baseline, while under `schema apply` it is a genuine conflict.\n */\nexport async function diagnoseAtlasFailure(context: {\n    domain: string;\n    args: string[];\n    stderr: string;\n    databaseUrl?: string;\n    /** The newest migration version on disk, named in the baseline remedy. */\n    latestMigrationVersion?: string | null;\n}): Promise<string | null> {\n    const { domain, args, stderr, databaseUrl } = context;\n\n    if (domain === \"migrate\" && args.includes(\"apply\")) {\n        const provisioned = parseAlreadyProvisioned(stderr);\n        if (provisioned) {\n            return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object);\n        }\n    }\n\n    if (domain === \"schema\" && args.includes(\"apply\")) {\n        const enumDrop = parseEnumLabelDrop(stderr);\n        if (enumDrop) return formatEnumLabelDropBanner(enumDrop);\n\n        const notNull = parseNotNullViolation(stderr);\n        if (notNull) {\n            return formatNotNullViolationBanner(notNull, await countRows(databaseUrl, notNull.table), notNullColumnIsNew(stderr, notNull.column));\n        }\n\n        const uncastable = parseUncastableRetype(stderr);\n        if (uncastable) return formatUncastableRetypeBanner(uncastable);\n\n        const unique = parseUniqueBuildFailure(stderr);\n        if (unique) {\n            const target = unique.statement ? failedStatementTable(unique.statement) : null;\n            return formatUniqueBuildFailureBanner(unique, await duplicateValues(databaseUrl, target, unique.columns));\n        }\n\n        const generated = parseGeneratedColumnRefusal(stderr);\n        if (generated) {\n            return formatGeneratedColumnRefusalBanner(generated, await generatedColumnsBlocking(databaseUrl, generated.statement));\n        }\n    }\n\n    return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAMA,SAAgB,oBAAoB,OAA+B;CAC/D,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CAEtC,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,UAAU;EAChD,MAAM,SAAS,oBAAoB,MAAM,KAAK;EAC9C,IAAI,QAAQ,OAAO;EAEnB,IAAI,MAAM,iBAAiB,SAAS,MAAM,MAAM,SAC5C,OAAO,MAAM,MAAM;CAE3B;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACYA,IAAM,uBAAwD;CAC1D;EAAE,OAAO;EAAc,IAAI;CAAoB;CAC/C;EAAE,OAAO;EAAe,IAAI;CAAqB;CACjD;EAAE,OAAO;EAAe,IAAI;CAAqB;CACjD;EAAE,OAAO;EAAa,IAAI;CAAqC;CAC/D;EAAE,OAAO;EAAa,IAAI;CAAmB;CAC7C;EAAE,OAAO;EAAY,IAAI;CAAgB;AAC7C;;;;;;;AAQA,SAAgB,mBAAmB,KAAuB;CAOtD,OAJwB,IACnB,MAAM,IAAI,CAAC,CACX,QAAQ,SAAS,CAAC,KAAK,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAC/C,KAAK,IACH,CAAA,CACF,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,QAAQ,MAAM,EAAE,SAAS,CAAC;AACnC;;AAGA,IAAM,iBAAiB;;AAEvB,IAAM,eAAe;;AAErB,IAAM,kBAAkB;;;;;AAKxB,IAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgDvB,SAAS,SAAS,MAAwB;CACtC,IAAI,eAAe,KAAK,IAAI,GAAG,OAAO,EAAE,YAAY,CAAC,EAAE;CACvD,MAAM,QAAQ,KAAK,MAAM,OAAO;CAChC,IAAI,CAAC,MAAM,MAAK,SAAQ,eAAe,KAAK,IAAI,CAAC,GAAG,OAAO,EAAE,YAAY,mBAAmB,IAAI,EAAE;CAElG,MAAM,UAAU,gBAAgB,KAAK,IAAI;CACzC,MAAM,aAAuB,CAAC;CAC9B,IAAI,UAA2B;CAC/B,MAAM,cAAc;EAChB,IAAI,SAAS,WAAW,KAAK,QAAQ,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC;EACrF,UAAU;CACd;CAEA,KAAK,MAAM,QAAQ,OAAO;EACtB,IAAI,eAAe,KAAK,IAAI,GAAG;GAC3B,MAAM;GACN,UAAU,CAAC,KAAK,QAAQ,gBAAgB,EAAE,CAAC;GAC3C;EACJ;EAMA,IADoB,aAAa,KAAK,IAAI,KAAM,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,WAAW,IAAI,GACxE;GACb,MAAM;GACN,IAAI,WAAW,SAAS,GAAG;GAC3B;EACJ;EACA,IAAI,CAAC,SAAS;EACd,IAAI,KAAK,KAAK,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC,WAAW,IAAI,GAAG;GACpD,MAAM;GACN;EACJ;EACA,QAAQ,KAAK,IAAI;CACrB;CACA,MAAM;CAEN,OAAO;EAAE;EAAY,WAAW,UAAU,OAAO,QAAQ,EAAE,IAAI,KAAA;CAAU;AAC7E;;;;;;AAOA,SAAgB,sBAAsB,MAAwB;CAC1D,OAAO,SAAS,IAAI,CAAC,CAAC;AAC1B;;;;;;;AAQA,SAAgB,aAAa,MAAuB;CAChD,OAAO,eAAe,KAAK,IAAI;AACnC;;;;;;;AA6BA,IAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;AAwBhC,SAAgB,4BACZ,SACA,cAA6C,CAAC,GACxB;CACtB,MAAM,QAAgC,CAAC;CACvC,MAAM,EAAE,YAAY,cAAc,SAAS,OAAO;CAMlD,IAAI,cAAc,KAAA,KAAa,cAAc,WAAW,QACpD,MAAM,KAAK;EACP,WAAW,kCAAkC,UAAU;EACvD,MAAM;EACN,QAAQ,mBAAmB,UAAU,oBAAoB,WAAW,OAAO;CAE/E,CAAC;CAEL,KAAK,MAAM,aAAa,YAAY;EAKhC,MAAM,UAAU,qBAAqB,MAAM,EAAE,SAAS,GAAG,KAAK,SAAS,CAAC;EACxE,MAAM,UAAU,yBAAyB,SAAS;EAClD,MAAM,QAAQ,uBAAuB,SAAS,CAAC,CAC1C,KAAI,YAAW;GAAE;GAAQ,MAAM,cAAc,QAAQ,WAAW;EAAE,EAAE,CAAC,CACrE,QAAQ,EAAE,QAAQ,WAAW,SAAS,KAAA,KAAa,CAAC,qBAAqB,MAAM,OAAO,EAAE,CAAC,CAAC,CAC1F,KAAK,EAAE,QAAQ,WAAW,IAAI,OAAO,OAAO,IAAI,QAAQ,yBAAyB,KAAK,OAAO,IAAI,CAAC,CAClG,KAAK,IAAI;EACd,MAAM,OAAO,SAAS,UAAU,UAAU,uBAAuB,QAAQ,sBAAsB,KAAA;EAC/F,IAAI,CAAC,MAAM;EACX,MAAM,SAAS,CAAC,SAAS,KAAK,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI;EACzD,MAAM,KAAK,SAAS;GAAE;GAAW;GAAM;EAAO,IAAI;GAAE;GAAW;EAAK,CAAC;CACzE;CACA,OAAO;AACX;AAYA,IAAM,QAAQ,OAAO,GAAG;AACxB,IAAM,iBAAiB,IAAI,OACvB,OAAO,GAAG,oDAAoD,MAAM,SAAS,MAAM,mBAAmB,GAC1G;AACA,IAAM,iBAAiB,IAAI,OACvB,OAAO,GAAG,2BAA2B,MAAM,0CAA0C,GACzF;AAEA,IAAM,WAAW,UACb,MAAM,WAAW,IAAI,IAAI,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,OAAO,IAAI,IAAI;;;;;AAMvE,SAAS,aAAa,MAAwB;CAC1C,MAAM,UAAoB,CAAC;CAC3B,IAAI,QAAQ;CACZ,IAAI;CACJ,IAAI,QAAQ;CACZ,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EAClC,MAAM,KAAK,KAAK;EAChB,IAAI;OACI,OAAO,OAAO,QAAQ,KAAA;EAAA,OACvB,IAAI,OAAO,QAAQ,OAAO,KAC7B,QAAQ;OACL,IAAI,OAAO,KACd;OACG,IAAI,OAAO,KACd;OACG,IAAI,OAAO,OAAO,UAAU,GAAG;GAClC,QAAQ,KAAK,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;GACxC,QAAQ,IAAI;EAChB;CACJ;CACA,QAAQ,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC;CACrC,OAAO,QAAQ,QAAO,WAAU,OAAO,SAAS,CAAC;AACrD;;;;;;;;;AAUA,SAAgB,eAAe,WAA2B;CACtD,MAAM,QAAQ,gDAAgD,KAAK,SAAS;CAC5E,OAAO,QAAQ,UAAU,MAAM,MAAM,QAAQ,MAAM,EAAE,CAAC,SAAS,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,UAAU,KAAK;AAC5G;;;;;;AAOA,SAAS,uBAAuB,WAAuC;CACnE,MAAM,QAAQ,eAAe,KAAK,eAAe,SAAS,CAAC;CAC3D,IAAI,CAAC,OAAO,OAAO,CAAC;CACpB,MAAM,CAAC,QAAQ,QAAQ,MAAM,KACvB,CAAC,QAAQ,MAAM,EAAE,GAAG,QAAQ,MAAM,EAAE,CAAC,IACrC,CAAC,KAAA,GAAW,QAAQ,MAAM,EAAE,CAAC;CACnC,MAAM,UAA8B,CAAC;CACrC,KAAK,MAAM,UAAU,aAAa,MAAM,EAAE,GAAG;EACzC,MAAM,QAAQ,eAAe,KAAK,MAAM;EACxC,IAAI,CAAC,OAAO;EACZ,MAAM,KAAK,MAAM,EAAE,CAAC,MAAM,yBAAyB,CAAC,CAAC,EAAE,CAAC,KAAK;EAC7D,QAAQ,KAAK;GAAE;GAAQ,OAAO;GAAM,QAAQ,QAAQ,MAAM,EAAE;GAAG;EAAG,CAAC;CACvE;CACA,OAAO;AACX;;AAGA,IAAM,qBAAqB,IAAI,OAC3B,OAAO,GAAG,0BAA0B,MAAM,0CAA0C,GACxF;;AAEA,IAAM,qBAAqB,IAAI,OAC3B,OAAO,GAAG,4CAA4C,MAAM,IAAI,GACpE;;AAGA,IAAM,mBAAmB;;;;;;;;;;;;;;AAgBzB,SAAS,yBAAyB,WAAuC;CACrE,MAAM,QAAQ,eAAe,KAAK,eAAe,SAAS,CAAC;CAC3D,IAAI,CAAC,OAAO,OAAO,KAAA;CACnB,MAAM,QAAQ,MAAM,KAAK,GAAG,MAAM,GAAG,GAAG,MAAM,OAAO,MAAM;CAE3D,IAAI;CACJ,IAAI;CACJ,KAAK,MAAM,UAAU,aAAa,MAAM,EAAE,GAAG;EACzC,MAAM,MAAM,mBAAmB,KAAK,MAAM;EAC1C,IAAI,KAAK;GACL,QAAQ,IAAI,OAAO,KAAA,IAAY,cAAc,IAAI,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,MAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE;GACjG;EACJ;EACA,MAAM,OAAO,mBAAmB,KAAK,MAAM;EAC3C,IAAI,QAAQ,QAAQ,KAAK,EAAE,CAAC,CAAC,SAAS,OAAO,GAAG,UAAU,KAAK;CACnE;CAEA,IAAI,SAAS,SAAS,OAAO,GAAG,MAAM,kBAAkB,MAAM,IAAI;CAClE,IAAI,OACA,OAAO,GAAG,MAAM,wBAAwB,MAAM;CAGlD,IAAI,SAAS,OAAO,GAAG,MAAM,yBAAyB,QAAQ,IAAI;AAEtE;;;;;;AAOA,SAAS,cAAc,QAA0B,aAAgE;CAC7G,MAAM,QAAQ,IAAI,IAAI,YACjB,QAAO,QAAO,IAAI,UAAU,OAAO,SAAS,IAAI,WAAW,OAAO,WAC3D,OAAO,WAAW,KAAA,KAAa,IAAI,WAAW,OAAO,OAAO,CAAC,CACpE,KAAI,QAAO,IAAI,IAAI,CAAC;CACzB,OAAO,MAAM,SAAS,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK,KAAA;AAC9C;;AAGA,IAAM,eAAuC;CACzC,OAAO;CACP,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,qBAAqB;CACrB,WAAW;CACX,+BAA+B;CAC/B,4BAA4B;CAC5B,0BAA0B;CAC1B,uBAAuB;CACvB,QAAQ;CACR,UAAU;CACV,UAAU;CACV,aAAa;CACb,QAAQ;AACZ;;AAGA,IAAM,iBAAyC;CAAE,UAAU;CAAG,SAAS;CAAI,QAAQ;AAAG;;AAGtF,IAAM,oCAAoB,IAAI,IAAI;CAAC;CAAa;CAAe;CAAQ;AAAQ,CAAC;AAUhF,SAAS,UAAU,KAAyB;CACxC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG;CACzC,IAAI,OAAO;CACX,KAAK,IAAI,SAAS,cAAc,KAAK,IAAI,GAAG,QAAQ,SAAS,cAAc,KAAK,IAAI,GAAG;EACnF;EACA,OAAO,KAAK,MAAM,GAAG,OAAO,KAAK;CACrC;CAEA,IAAI,KAAK,SAAS,IAAI,GAAG,OAAO;EAAE,MAAM;EAAM;CAAK;CACnD,OAAO,KAAK,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CACrD,IAAI;CACJ,MAAM,WAAW,cAAc,KAAK,IAAI;CACxC,IAAI,UAAU;EACV,OAAO,SAAS,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,SAAQ,OAAO,KAAK,KAAK,CAAC,CAAC;EAC7D,OAAO,GAAG,KAAK,MAAM,GAAG,SAAS,KAAK,EAAE,GAAG,KAAK,MAAM,SAAS,QAAQ,SAAS,EAAE,CAAC,MAAM,IACpF,QAAQ,QAAQ,GAAG,CAAC,CACpB,KAAK;CACd;CACA,OAAO;EAAE,MAAM,aAAa,SAAS;EAAM;EAAM;CAAK;AAC1D;;AAGA,SAAS,eAAe,MAAc,MAA4B,IAAmC;CACjG,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,EAAE,GAAG,OAAO;CACxD,IAAI,SAAS,WACT,OAAO,OAAO,KAAA,KAAc,SAAS,KAAA,KAAa,GAAG,MAAM,KAAK;CAEpE,IAAI,SAAS,WAAW;EACpB,IAAI,OAAO,KAAA,GAAW,OAAO;EAC7B,IAAI,SAAS,KAAA,GAAW,OAAO;EAC/B,MAAM,CAAC,IAAI,KAAK,KAAK;EACrB,MAAM,CAAC,IAAI,KAAK,KAAK;EACrB,OAAO,MAAM,MAAM,KAAK,MAAM,KAAK;CACvC;CACA,IAAI,kBAAkB,IAAI,IAAI,GAC1B,QAAQ,KAAK,MAAM,OAAO,OAAO,MAAM;CAE3C,OAAO;AACX;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,qBAAqB,MAAc,IAAqB;CACpE,MAAM,IAAI,UAAU,IAAI;CACxB,MAAM,IAAI,UAAU,EAAE;CACtB,IAAI,EAAE,SAAS,EAAE,MAAM,OAAO;CAC9B,IAAI,EAAE,MAAM,KAAK,OAAO,KAAK,KAAK,EAAE,MAAM,KAAK,OAAO,KAAK,GAAG,OAAO;CACrE,IAAI,EAAE,SAAS,EAAE,MAAM,OAAO,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI;CAEnE,MAAM,aAAa,eAAe,EAAE;CACpC,IAAI,eAAe,KAAA,GAAW;EAC1B,MAAM,WAAW,eAAe,EAAE;EAClC,IAAI,aAAa,KAAA,GAAW,OAAO,YAAY;EAC/C,IAAI,EAAE,SAAS,WACX,OAAO,EAAE,SAAS,KAAA,KAAa,EAAE,KAAK,MAAM,EAAE,KAAK,MAAM,MAAM;EAEnE,OAAO;CACX;CACA,IAAI,EAAE,SAAS,aAAa,EAAE,SAAS,QAAQ,OAAO;CACtD,IAAI,EAAE,SAAS,UAAU,EAAE,SAAS,WAAW,OAAO,EAAE,SAAS,KAAA;CACjE,OAAO;AACX;;;;;;;;;;;AAcA,SAAgB,iBAAiB,MAIhB;CACb,IAAI,KAAK,qBAAqB,GAAG,OAAO;CACxC,IAAI,KAAK,kBAAkB,OAAO;CAClC,OAAO,KAAK,cAAc,YAAY;AAC1C;;;AC9hBA,IAAa,YAAY,KAAK,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC;;;;;;;;;;;;;;;;;;ACYpE,IAAa,oBAAoB;;;;;;AAOjC,IAAa,oBAAoB,UAAU,kBAAkB;;AAG7D,IAAa,sBAAsB;CAAC;CAAc;CAAgB;CAAc;CAAc;AAAc;;AAG5G,SAAgB,gBAAgB,MAAc,QAAQ,IAAI,GAAW;CACjE,OAAO,KAAK,QAAQ,KAAK,iBAAiB;AAC9C;;;;;;;AAQA,IAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;AAqBzB,SAAgB,uBACZ,MAAc,QAAQ,IAAI,GAC1B,UAAgC,CAAC,GACzB;CACR,MAAM,MAAM,gBAAgB,GAAG;CAC/B,GAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CACrC,MAAM,SAAS,KAAK,KAAK,KAAK,YAAY;CAC1C,IAAI,CAAC,GAAG,WAAW,MAAM,GACrB,GAAG,cAAc,QAAQ,mFAAmF;CAGhH,MAAM,UAAoB,CAAC;CAC3B,KAAK,MAAM,QAAQ,qBAAqB;EACpC,MAAM,SAAS,KAAK,KAAK,KAAK,WAAW,IAAI;EAC7C,IAAI,CAAC,GAAG,WAAW,MAAM,GAAG;EAC5B,MAAM,YAAY,GAAG,aAAa,QAAQ,OAAO,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,CAAC;EAClE,IAAI,CAAC,iBAAiB,KAAK,SAAS,GAAG;EACvC,IAAI,QAAQ,WAAW,OAAO,GAAG,OAAO,MAAM;EAC9C,QAAQ,KAAK,KAAK,MAAM,KAAK,WAAW,IAAI,CAAC;CACjD;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;AC1BA,SAAgB,4BAA4B,WAAmB,QAAQ,IAAI,GAA0B;CACjG,MAAM,YAAoD;EACtD,CAAC,kBAAkB,MAAM;EACzB,CAAC,YAAY,KAAK;EAClB,CAAC,aAAa,KAAK;EACnB,CAAC,aAAa,MAAM;EACpB,CAAC,qBAAqB,KAAK;CAC/B;CAEA,IAAI,MAAM,KAAK,QAAQ,QAAQ;CAC/B,OAAO,MAAM;EACT,KAAK,MAAM,CAAC,MAAM,YAAY,WAC1B,IAAI,GAAG,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,GAAG,OAAO;EAEpD,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK,OAAO;EAC3B,MAAM;CACV;AACJ;;;;;;;;;AAUA,SAAgB,0BACZ,aACA,UAAiC,4BAA4B,GACrD;CACR,QAAQ,SAAR;EACI,KAAK,OAKD,OAAO;GACH,mCAAmC;GACnC;GACA;GACA;GACA;GACA,0BAA0B,YAAY;GACtC;GACA;EACJ;EACJ,KAAK,QACD,OAAO;GACH;GACA;GACA;GACA;EACJ;EACJ,KAAK,OACD,OAAO;GACH;GACA,gCAAgC,YAAY;GAC5C;GACA;EACJ;EAEJ,SACI,OAAO;GACH;GACA;GACA;GACA;GACA;GACA,4CAA4C,YAAY;GACxD;GACA;EACJ;CACR;AACJ;;;;;;;;AASA,SAAgB,yBACZ,UAAiC,4BAA4B,GACvD;CACN,QAAQ,SAAR;EACI,KAAK,OAAO,OAAO;EACnB,KAAK,QAAQ,OAAO;EACpB,KAAK,OAAO,OAAO;EAEnB,SAAS,OAAO;CACpB;AACJ;;AAGA,SAAgB,sBACZ,aACA,UAAiC,4BAA4B,GACvD;CACN,QAAQ,SAAR;EACI,KAAK,OAAO,OAAO,kBAAkB;EACrC,KAAK,QAAQ,OAAO,eAAe;EACnC,KAAK,OAAO,OAAO,cAAc;EAEjC,SAAS,OAAO,eAAe;CACnC;AACJ;;;;;;;;AAsBA,SAAS,uBAAuB,aAAoC;CAChE,MAAM,QAAQ,CACV,cAAc,KAAK,KAAK,QAAQ,IAAI,GAAG,cAAc,CAAC,GACtD,cAAc,KAAK,KAAK,WAAkB,cAAc,CAAC,CAC7D;CACA,KAAK,MAAM,QAAQ,OACf,IAAI;EACA,OAAO,cAAc,IAAI,CAAC,CAAC,QAAQ,GAAG,YAAY,cAAc;CACpE,QAAQ,CAER;CAEJ,OAAO;AACX;;;;;;;AAQA,SAAgB,iBAAiB,cAAgC;CAC7D,IAAI;CACJ,IAAI;EACA,WAAW,KAAK,MAAM,GAAG,aAAa,cAAc,MAAM,CAAC;CAC/D,QAAQ;EACJ,OAAO,CAAC;CACZ;CACA,MAAM,MAAM,KAAK,QAAQ,YAAY;CACrC,IAAI,OAAO,SAAS,QAAQ,UAAU,OAAO,CAAC,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;CAC7E,IAAI,SAAS,OAAO,OAAO,SAAS,QAAQ,UACxC,OAAO,OAAO,OAAO,SAAS,GAAG,CAAC,CAC7B,QAAQ,WAA6B,OAAO,WAAW,QAAQ,CAAC,CAChE,KAAI,WAAU,KAAK,QAAQ,KAAK,MAAM,CAAC;CAEhD,OAAO,CAAC;AACZ;AAEA,SAAgB,mBAAmB,aAA0C;CACzE,MAAM,eAAe,uBAAuB,WAAW;CACvD,IAAI,CAAC,cAAc,OAAO;CAQ1B,MAAM,WAAW,iBAAiB,YAAY;CAC9C,IAAI,SAAS,WAAW,GAAG,OAAO;CAClC,OAAO,SAAS,MAAK,SAAQ,GAAG,WAAW,IAAI,CAAC,IAAI,qBAAqB;AAC7E;AAEA,SAAgB,gBAAgB,SAAgC;CAE5D,IAAI,MAAM;CACV,OAAO,MAAM;EACT,MAAM,YAAY,KAAK,KAAK,KAAK,gBAAgB,QAAQ,OAAO;EAChE,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;EACrC,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK;EACpB,MAAM;CACV;CAEA,IAAI,MAAM,QAAQ,IAAI;CAEtB,OAAO,MAAM;EACT,MAAM,YAAY,KAAK,KAAK,KAAK,gBAAgB,QAAQ,OAAO;EAChE,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;EACrC,MAAM,SAAS,KAAK,QAAQ,GAAG;EAC/B,IAAI,WAAW,KAAK;EACpB,MAAM;CACV;CAEA,IAAI;EAEA,MAAM,aAAa,SADP,QAAQ,aAAa,UAAU,SAAS,YAAY,SAAS,WACxC,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK;EACnF,IAAI,cAAc,GAAG,WAAW,UAAU,GAAG,OAAO;CACxD,QAAQ,CAER;CACA,OAAO;AACX;AAEA,eAAsB,gCAAgC,gBAAuD;CACzG,MAAM,EAAE,cAAc,uBAAuB,yBAAyB,MAAM,OAAO;CACnF,MAAM,EAAE,+BAA+B,MAAM,OAAO;CAOpD,MAAM,cAAc,sBAAsB,cAAc;CACxD,MAAM,WAAqB,CAAC;CAC5B,KAAK,MAAM,OAAO,aAAa;EAC3B,MAAM,YAAY,aAAa,GAAG;EAClC,MAAM,SAAS,2BAA2B,GAAG,KAAK,IAAI,SAAS,IAAI,SAAS;EAC5E,IAAI,WACA,SAAS,KAAK,GAAG,OAAO,GAAG,WAAW;CAE9C;CAIA,KAAK,MAAM,YAAY,qBAAqB,WAAW,CAAC,CAAC,OAAO,GAC5D,SAAS,KAAK,GAAG,SAAS,OAAO,GAAG,SAAS,OAAO;CAGxD,OAAO,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC;AACvC;AAEA,eAAsB,iBAAiB,iBAA4C;CAC/E,OAAO,gCAAgC,MAAM,sBAAsB,eAAe,CAAC;AACvF;;;;;;;;;;;AAYA,IAAM,gDAAgC,IAAI,IAAY;AAEtD,eAAsB,sBAAsB,iBAAsD;CAM9F,MAAM,eAAe,KAAK,QAAQ,eAAe;CACjD,MAAM,cAAkC,CAAC;CACzC,IAAI,CAAC,GAAG,WAAW,YAAY,KAAK,CAAC,8BAA8B,IAAI,YAAY,GAAG;EAUlF,8BAA8B,IAAI,YAAY;EAC9C,QAAQ,MAAM,OACV,qCAAqC,gBAAgB,uBAChC,aAAa,2BACR,QAAQ,IAAI,EAAE,gFAE5C,CAAC;CACL;CACA,IAAI,GAAG,WAAW,YAAY;MACZ,GAAG,SAAS,YACtB,CAAA,CAAM,YAAY,GAAG;GACrB,MAAM,QAAQ,GAAG,YAAY,YAAY;GACzC,KAAK,MAAM,QAAQ,OACf,KAAK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK,MAC5C,CAAC,KAAK,SAAS,QAAQ,KACvB,CAAC,KAAK,SAAS,OAAO,KACtB,SAAS,cAAc,SAAS,YAChC,IAAI;IAGA,MAAM,SAAS,MAAM,OADL,cADC,KAAK,KAAK,cAAc,IACX,CAAQ,CAAC,CAAC;IAExC,IAAI,UAAU,OAAO,SACjB,YAAY,KAAK,OAAO,OAAO;GAEvC,QAAQ,CAER;EAGZ;;CAGJ,OAAO;AACX;;;;;;;;;;;;;;;;;AAkBA,IAAM,6BAAa,IAAI,IAA+B;AAItD,eAAe,cAAc,aAAqB,yBAAqD;CACnG,MAAM,OAAO,WAAW,IAAI,WAAW;CACvC,IAAI,MAAM,OAAO;CACjB,MAAM,WAAW,YAAY;EACzB,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,OAAO;GACtB,kBAAkB;GAClB,GAAI,0BAA0B,EAAE,wBAAwB,IAAI,CAAC;EACjE,CAAC;EAKD,MAAM,eAAqB;GACvB,IAAI,WAAW,IAAI,WAAW,MAAM,SAAS,WAAW,OAAO,WAAW;EAC9E;EACA,OAAO,GAAG,SAAS,MAAM;EACzB,OAAO,GAAG,OAAO,MAAM;EACvB,MAAM,OAAO,QAAQ;EACrB,OAAO;CACX,EAAA,CAAG;CACH,WAAW,IAAI,aAAa,OAAO;CACnC,IAAI;EACA,OAAO,MAAM;CACjB,SAAS,KAAK;EAGV,WAAW,OAAO,WAAW;EAC7B,MAAM;CACV;AACJ;;;;;;;;;;;;;AAcA,eAAsB,cAClB,aACA,MACA,UAAgD,CAAC,GACvC;CACV,MAAM,SAAS,MAAM,cAAc,aAAa,QAAQ,uBAAuB;CAC/E,IAAI;EACA,OAAO,MAAM,KAAK,MAAM;CAC5B,SAAS,KAAK;EAGV,MAAM,OAAO,MAAM,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;EACpD,MAAM;CACV;AACJ;;AAGA,eAAsB,kBAAiC;CACnD,MAAM,OAAO,CAAC,GAAG,WAAW,OAAO,CAAC;CACpC,WAAW,MAAM;CACjB,MAAM,QAAQ,IAAI,KAAK,IAAI,OAAM,YAAW;EACxC,IAAI;GACA,OAAO,MAAM,QAAA,CAAS,IAAI;EAC9B,QAAQ,CAER;CACJ,CAAC,CAAC;AACN;;;;;;;;;;;;AAaA,IAAa,oBAAoB;;;;;;AAOjC,SAAgB,oBACZ,aACA,KAC+B;CAC/B,MAAM,QAAQ,IAAI,kBAAkB,EAAE,KAAK;CAC3C,IAAI,CAAC,OAAO,OAAO;EAAE,KAAK,kBAAkB,WAAW;EAAG,OAAO;CAAM;CACvE,IAAI,UAAU,YAAY,KAAK,GAE3B,MAAM,IAAI,MACN,GAAG,kBAAkB,+GAEzB;CAEJ,OAAO;EAAE,KAAK;EAAO,OAAO;CAAK;AACrC;AAEA,SAAgB,kBAAkB,aAA6B;CAC3D,IAAI;EACA,MAAM,SAAS,IAAI,IAAI,WAAW;EAElC,OAAO,WAAW,IADH,OAAO,SAAS,MAAM,CACf,EAAO;EAC7B,OAAO,OAAO,SAAS;CAC3B,QAAQ;EACJ,OAAO,cAAc;CACzB;AACJ;;;;;;;;;;;;;;;;;;;AAoBA,eAAsB,wBAAwB,aAAqB,gBAA0C;CACzG,IAAI,YAAY;CAChB,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,IAAI,WAAW;EAClC,YAAY,IAAI,IAAI,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC;EAEpD,OAAO,WAAW;EAClB,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,SAAS,EAAE,CAAC;EACjE,MAAM,OAAO,QAAQ;EACrB,IAAI;GAEA,KAAI,MADc,OAAO,MAAM,gDAAgD,CAAC,SAAS,CAAC,EAAA,CAClF,aAAa,GAAG;IACpB,MAAM,OAAO,MAAM,oBAAoB,UAAU,EAAE;IACnD,IAAI,MAAM,KAAK,oCAAoC,UAAU,EAAE,CAAC;IAEhE,OAAO;GACX;EACJ,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,SAAS,KAAK;EACV,QAAQ,2BAA2B,KAAK,aAAa,eAAe,CAAC;CACzE;CAEA,OAAO;AACX;;;;;;;AAQA,SAAgB,2BAA2B,KAAc,WAA2B;CAChF,MAAM,OAAQ,KAAkC;CAChD,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAE/D,MAAM,QAAQ,CACV,MAAM,OAAO,qDAAqD,UAAU,KAAK,SAAS,CAC9F;CACA,IAAI,SAAS,SACT,MAAM,KAAK,MAAM,KACb;;;wDAGyD,UAAU,GACvE,CAAC;MAED,MAAM,KAAK,MAAM,KAAK,gDAAgD,YAAY,4CAA4C,CAAC;CAGnI,OAAO,MAAM,KAAK,IAAI;AAC1B;;;;;;;;;;;;;AAcA,eAAsB,gBAAgB,aAAqB,gBAAuC;CAC9F,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,IAAI,WAAW;EAClC,MAAM,YAAY,IAAI,IAAI,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC;EAE1D,OAAO,WAAW;EAClB,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,SAAS,EAAE,CAAC;EACjE,MAAM,OAAO,QAAQ;EACrB,IAAI;GACA,MAAM,OAAO,MAAM,4BAA4B,UAAU,EAAE;GAC3D,IAAI,MAAM,KAAK,oCAAoC,UAAU,EAAE,CAAC;EACpE,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,SAAS,KAAK;EAGV,QAAQ,MAAM,KACV,qDAAqD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,kEAE1G,CAAC;CACL;AACJ;;;;;;;AAQA,SAAgB,cAAc,SAAiB,gBAAgB,GAAW;CACtE,MAAM,aAAa,KAAK,KAAK,QAAQ,YAAY;CACjD,IAAI,CAAC,GAAG,WAAW,UAAU,GAAG,OAAO;CACvC,OAAO,GAAG,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK;AACrD;;;;;;;;;;;;;;AAeA,eAAsB,eAClB,aACA,SAAiB,gBAAgB,GACpB;CACb,MAAM,MAAM,cAAc,MAAM;CAChC,IAAI,CAAC,KAAK;CAEV,MAAM,cAAc,cAAa,WAAU,OAAO,MAAM,GAAG,CAAC;CAC5D,IAAI,MAAM,KAAK,kDAAkD,CAAC;AACtE;;;;;;;AAQA,eAAsB,kBAAkB,iBAA4C;CAChF,MAAM,EAAE,0BAA0B,MAAM,OAAO,4CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAC/C,OAAO,sBAAsB,MAAM,sBAAsB,eAAe,CAAC;AAC7E;;;;;;;;;;;;;AAcA,eAAsB,iCAClB,aACoC;CACpC,OAAO,cAAc,aAAa,OAAM,WAAU;EAoB9C,QAAO,MAnBW,OAAO,MAAM;;;;;;;;;;;;;;;;;;SAkB9B,EAAA,CACU;CACf,CAAC;AACL;;;;;AAMA,eAAsB,iBAAiB,aAAoD;CACvF,OAAO,cAAc,aAAa,OAAM,YAAW,MAAM,OAAO,MAA0B,gBAAgB,EAAA,CAAG,IAAI;AACrH;;;;;;;;AASA,eAAsB,qBAClB,aACA,YACa;CACb,IAAI,WAAW,WAAW,GAAG;CAC7B,MAAM,cAAc,aAAa,OAAM,WAAU;EAC7C,KAAK,MAAM,aAAa,YACpB,MAAM,OAAO,MAAM,SAAS;CAEpC,CAAC;AACL;;;;;;;AAQA,SAAgB,cAAc,SAAiB,gBAAgB,GAAW;CACtE,MAAM,aAAa,KAAK,KAAK,QAAQ,YAAY;CACjD,IAAI,CAAC,GAAG,WAAW,UAAU,GAAG,OAAO;CACvC,OAAO,GAAG,aAAa,YAAY,OAAO,CAAC,CAAC,KAAK;AACrD;;;;;;;;;;;;;;;;AAiBA,eAAsB,eAClB,aACA,SAAiB,gBAAgB,GACpB;CACb,MAAM,MAAM,cAAc,MAAM;CAChC,IAAI,CAAC,KAAK;CAEV,MAAM,EAAE,wBAAwB,MAAM,OAAO,6BAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAC7C,IAAI;EACA,MAAM,cAAc,cAAa,WAAU,OAAO,MAAM,GAAG,CAAC;CAChE,SAAS,KAAK;EAMV,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAC/D,MAAM,OAAO,oBAAoB,OAAO;EACxC,IAAI,CAAC,MAAM,MAAM;EACjB,MAAM,IAAI,MAAM,GAAG,UAAU,QAAQ,EAAE,OAAO,IAAI,CAAC;CACvD;CACA,IAAI,MAAM,KAAK,4CAA4C,CAAC;AAChE;;;;;;;AAQA,eAAsB,kBAAkB,iBAA4C;CAChF,MAAM,EAAE,0BAA0B,MAAM,OAAO,4CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAC/C,OAAO,sBAAsB,MAAM,sBAAsB,eAAe,CAAC;AAC7E;;;;;;;;AASA,SAAgB,gBAAgB,SAAiB,gBAAgB,GAAW;CACxE,MAAM,eAAe,KAAK,KAAK,QAAQ,cAAc;CACrD,IAAI,CAAC,GAAG,WAAW,YAAY,GAAG,OAAO;CACzC,OAAO,GAAG,aAAa,cAAc,OAAO,CAAC,CAAC,KAAK;AACvD;;;;;;;;;;;;;;;AAgBA,eAAsB,iBAClB,aACA,SAAiB,gBAAgB,GACpB;CACb,MAAM,MAAM,gBAAgB,MAAM;CAClC,IAAI,CAAC,KAAK;CAEV,MAAM,cAAc,cAAa,WAAU,OAAO,MAAM,GAAG,CAAC;CAC5D,IAAI,MAAM,KAAK,mCAAmC,CAAC;AACvD;;AAGA,eAAsB,mBAAmB,iBAA4C;CACjF,MAAM,EAAE,2BAA2B,MAAM,OAAO,4CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAChD,OAAO,uBAAuB,MAAM,sBAAsB,eAAe,CAAC;AAC9E;;;;;;;;;;;;;;AAeA,eAAsB,qBAAqB,aAAwC;CAC/E,OAAO,cAAc,aAAa,OAAM,WAAU;EAa9C,QAAO,MAZW,OAAO,MAAM;;;;;;;;;;;SAW9B,EAAA,CACU,KAAK,KAAK,QAA+B,IAAI,SAAS;CACrE,CAAC;AACL;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,wBAClB,aACA,iBACA,OAGI,CAAC,GACY;CACjB,MAAM,eAAe,KAAK,wBAAwB;CAGlD,MAAM,UAAU,OAFG,KAAK,wBAAwB,kBAAA,CAEf,eAAe;CAEhD,IAAI;CACJ,IAAI;EACA,WAAW,MAAM,aAAa,WAAW;CAC7C,SAAS,KAAK;EAIV,MAAM,IAAI,0BACN,4DAA4D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,KAC3G,GACJ;CACJ;CAEA,OAAO,SAAS,QAAO,SAAQ;EAC3B,MAAM,YAAY,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC;EACtD,IAAI,QAAQ,IAAI,SAAS,GAAG,OAAO;EACnC,OAAO,CAAC,kBAAkB,SAAS;CACvC,CAAC;AACL;;;;;AAMA,eAAe,kBAAkB,iBAA+C;CAC5E,MAAM,cAAc,MAAM,sBAAsB,eAAe;CAC/D,MAAM,EAAE,uBAAuB,0BAC3B,MAAM,OAAO,4CAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACjB,MAAM,EAAE,sBAAsB,MAAM,OAAO,oCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAC3C,MAAM,EAAE,6BAA6B,MAAM,OAAO,uBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAElD,MAAM,QAAQ,IAAI,IACd,yBAAyB,aAAa,iBAAiB,CAAC,CAAC,KAAI,SAAQ,KAAK,SAAS,CACvF;CAMA,KAAK,MAAM,WAAW,CAAC,GAAG,sBAAsB,WAAW,GAAG,GAAG,sBAAsB,WAAW,CAAC,GAC/F,MAAM,IAAI,QAAQ,MAAM,QAAQ,YAAY,GAAG,IAAI,CAAC,CAAC;CAEzD,OAAO;AACX;AAEA,eAAsB,oBAAoB,aAAwC;CAC9E,OAAO,cAAc,aAAa,OAAM,WAAU;EAO9C,QAAO,MANW,OAAO,MAAM;;;;;SAK9B,EAAA,CACU,KAAK,KAAK,QAA+B,IAAI,SAAS;CACrE,CAAC;AACL;;;;;;;;AASA,IAAa,4BAAb,cAA+C,MAAM;CACX;CAAtC,YAAY,SAAiB,OAA0B;EACnD,MAAM,OAAO;EADqB,KAAA,QAAA;EAElC,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;AAcA,eAAsB,iBAClB,aACA,iBACA,OAGI,CAAC,GACY;CACjB,MAAM,cAAc,KAAK,eAAe;CACxC,MAAM,cAAc,KAAK,uBAAuB;CAEhD,MAAM,WAAW,MAAM,YAAY,eAAe;CAgBlD,MAAM,WAAqB;EAAC;EAA4B;EAAQ;EAAU;EAAU;CAAU;CAE9F,IAAI;CACJ,IAAI;EACA,iBAAiB,MAAM,YAAY,WAAW;CAClD,SAAS,KAAK;EACV,MAAM,IAAI,0BACN,0DAA0D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,KACzG,GACJ;CACJ;CAEA,KAAK,MAAM,SAAS,gBAChB,IAAI,CAAC,SAAS,SAAS,KAAK,GACxB,SAAS,KAAK,KAAK;CAI3B,OAAO;AACX;;;;;;;;;;;;;;;AAiBA,eAAsB,cAAc,UAAoC;CACpE,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;;;;;;;;;;;;ACxhCA,SAAgB,eAAe,KAAuB;CAClD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,gBAAgB,OAAO;CAEtC,IAAI,MAAM,QAAQ,EAAE,MAAM,GACtB,OAAO,EAAE,OAAO,MAAK,UACjB,SAAS,OAAO,UAAU,YAAa,MAA4B,SAAS,cAChF;CAGJ,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,eAAe,EAAE,KAAK;CAEjC,OAAO;AACX;;;;;AAMA,SAAgB,cAAc,KAAuB;CACjD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,WAAW,EAAE,SAAS,SAAS,OAAO;CACrD,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,cAAc,EAAE,KAAK;CAGhC,IAAI,aAAa,KAAK,OAAQ,EAA2B,YAAY,UAAU;EAC3E,MAAM,MAAO,EAA0B,QAAQ,YAAY;EAC3D,IAAI,IAAI,SAAS,gCAAgC,KAAK,IAAI,SAAS,sBAAsB,GACrF,OAAO;CAEf;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,gBAAgB,KAAuB;CACnD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,YAAY,CAAC,CAAC,SAAS,kCAAkC,GACpG,OAAO;CAEX,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,gBAAgB,EAAE,KAAK;CAElC,OAAO;AACX;;;;;;;AAQA,SAAgB,sBAAsB,KAAuB;CACzD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,SAAS,OAAO;CAC/B,IAAI,OAAO,EAAE,YAAY,UAAU;EAC/B,MAAM,MAAM,EAAE,QAAQ,YAAY;EAClC,IAAI,IAAI,SAAS,4BAA4B,KAAK,IAAI,SAAS,kBAAkB,GAC7E,OAAO;CAEf;CACA,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,sBAAsB,EAAE,KAAK;CAExC,OAAO;AACX;;;;;;;;;AAUA,SAAgB,cAAc,aAA6B;CACvD,IAAI;EACA,MAAM,SAAS,IAAI,IAAI,WAAW;EAClC,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,QAAQ;CAChD,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AAYA,SAAgB,oBAAoB,KAA6B;CAC7D,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CAEV,IAAI,MAAM,QAAQ,EAAE,MAAM,GACtB,KAAK,MAAM,SAAS,EAAE,QAAQ;EAC1B,MAAM,SAAS,oBAAoB,KAAK;EACxC,IAAI,QAAQ,OAAO;CACvB;CAEJ,IAAI,EAAE,OAAO;EACT,MAAM,SAAS,oBAAoB,EAAE,KAAK;EAC1C,IAAI,QAAQ,OAAO;CACvB;CACA,IAAI,OAAO,EAAE,YAAY,YAAY,EAAE,WAAW,CAAC,EAAE,QAAQ,WAAW,eAAe,GACnF,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,EAAE,KAAK,KAAK,EAAE;CAEnD,OAAO;AACX;;AAGA,SAAS,iBAAiB,KAAsB;CAC5C,MAAM,SAAS,QAAQ,KAAA,IAAY,OAAO,oBAAoB,GAAG;CACjE,OAAO,SAAS,sBAAsB,OAAO,QAAQ;AACzD;;;;AAKA,SAAS,8BAA8B,aAAqB,KAAuB;CAE/E,OACI;;uCAFa,cAAc,WAIa,EAAS,sEAGjD,iBAAiB,GAAG,IACpB;AASR;;;;AAKA,SAAS,wBAAwB,aAAqB,KAAuB;CACzE,MAAM,WAAW,cAAc,WAAW;CAC1C,IAAI,WAAW;CACf,IAAI;EACA,WAAW,IAAI,IAAI,WAAW,CAAC,CAAC,YAAY;CAChD,QAAQ,CAAe;CAEvB,OACI;;uCAEwC,SAAS,OAAO,SAAS,sEAGjE,iBAAiB,GAAG,IACpB;;;;wCAIyC,SAAS;AAI1D;;;;AAKA,SAAS,0BAA0B,aAA6B;CAC5D,MAAM,WAAW,cAAc,WAAW;CAC1C,MAAM,aAAa,YAAY,SAAS,GAAG,IAAI,qBAAqB;CACpE,OACI;;sDAEuD,SAAS,mNAM/C,MAAM,KAAK,iBAAiB,EAAE,gDAExB,WAAW;AAI1C;;;;;AAMA,SAAS,6BAAqC;CAC1C,OACI;;;;;;IAMK,MAAM,OAAO,6CAA6C,EAAE,+aAU9C,MAAM,KAAK,MAAM,gBAAgB,EAAE,+CAEV,MAAM,KAAK,oBAAoB,EAAE,QACtE,MAAM,KAAK,mBAAmB,EAAE;AAI/C;;;;;;;;AASA,eAAsB,0BAA0B,aAAoC;CAChF,IAAI;EAIA,MAAM,cAAc,cAAa,WAAU,OAAO,MAAM,UAAU,GAAG,EAAE,yBAAyB,IAAK,CAAC;CAC1G,SAAS,KAAc;EACnB,IAAI,eAAe,GAAG,GAAG;GACrB,SAAS,8BAA8B,aAAa,GAAG,CAAC;GACxD,QAAQ,KAAK,CAAC;EAClB;EACA,IAAI,cAAc,GAAG,GAAG;GACpB,SAAS,wBAAwB,aAAa,GAAG,CAAC;GAClD,QAAQ,KAAK,CAAC;EAClB;EACA,IAAI,gBAAgB,GAAG,GAAG;GACtB,SAAS,0BAA0B,WAAW,CAAC;GAC/C,QAAQ,KAAK,CAAC;EAClB;EAEA,QAAQ,MAAM,OAAO,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;EACxH,QAAQ,MAAM,KAAK,8EAA8E,CAAC;CACtG;AACJ;;;;;;AAOA,SAAgB,gBAAgB,KAAc,aAAqC;CAC/E,IAAI,eAAe,GAAG,GAClB,OAAO,8BAA8B,eAAe,IAAI,GAAG;CAE/D,IAAI,cAAc,GAAG,GACjB,OAAO,wBAAwB,eAAe,IAAI,GAAG;CAEzD,IAAI,gBAAgB,GAAG,GACnB,OAAO,0BAA0B,eAAe,EAAE;CAEtD,IAAI,sBAAsB,GAAG,GACzB,OAAO,2BAA2B;CAEtC,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,qBAAqB,OAAsB;CACvD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,EAAE;CAE3E,IAAK,OAAgD,iBAAiB;CACtE,IAAI,CAAC,WAAW,mCAAmC,KAAK,OAAO,GAAG;CAElE,SAAS,EAAE;CACX,SAAS,MAAM,IAAI,OAAO,SAAS,CAAC;CAEpC,MAAM,QAAQ,oBAAoB,KAAK;CACvC,IAAI,SAAS,CAAC,QAAQ,SAAS,KAAK,GAChC,SAAS,MAAM,KAAK,OAAO,OAAO,CAAC;CAEvC,SAAS,EAAE;AACf;;;;;;;;;;;AAsBA,SAAgB,wBAAwB,MAAuD;CAC3F,MAAM,WAAW,iFAAiF,KAAK,IAAI;CAC3G,IAAI,UAAU,OAAO;EAAE,QAAQ,SAAS;EAAI,MAAM,SAAS;CAAG;CAE9D,MAAM,OAAO,+DAA+D,KAAK,IAAI;CACrF,IAAI,QAAQ,cAAc,KAAK,IAAI,GAAG,OAAO;EAAE,QAAQ,KAAK;EAAI,MAAM,QAAQ,KAAK,IAAI,IAAI,UAAU;CAAQ;CAC7G,OAAO;AACX;;;;;;;;AASA,SAAgB,qBAAqB,SAAwB,QAAyB;CAClF,MAAM,eAAe,WAAW;CAChC,OACI,wMAKC,SAAS,KAAK,MAAM,KAAK,IAAI,OAAO,uDAAuD,EAAE,QAAQ,MACtG,kIAC4D,MAAM,KAAK,gBAAgB,EAAE,iMAMlF,MAAM,KAAK,MAAM,gCAAgC,cAAc,EAAE,QACjE,MAAM,KAAK,MAAM,mBAAmB,EAAE;AAUrD;;AAGA,SAAgB,sBAAsB,MAAwD;CAC1F,MAAM,QAAQ,8DAA8D,KAAK,IAAI;CACrF,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAI,QAAQ,MAAM;CAAG,IAAI;AAC3D;;;;;;;AAQA,SAAgB,mBAAmB,QAAgB,QAAgC;CAC/E,MAAM,YAAY,qBAAqB,MAAM;CAC7C,IAAI,CAAC,WAAW,OAAO;CACvB,MAAM,SAAS,OAAO,QAAQ,MAAM,MAAM,CAAC,CAAC,QAAQ,uBAAuB,MAAM;CACjF,OAAO,IAAI,OAAO,iDAAiD,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,SAAS;AACrG;;;;;;;;;;;;;;AAeA,SAAgB,6BACZ,WACA,UACA,QAAwB,MAClB;CACN,MAAM,EAAE,OAAO,WAAW;CAC1B,MAAM,OAAO,aAAa,OACpB,MAAM,MAAM,0DAA0D,OAAO,QAC7E,MAAM,MAAM,kBAAkB,SAAS,MAAM,aAAa,IAAI,KAAK,IAAI,gCAAgC,OAAO;CACpH,MAAM,WACF,sDACY,MAAM,KAAK,oCAAoC,MAAM,SAAS,OAAO,eAAe,OAAO,YAAY,EAAE;CACzH,MAAM,gBAAgB;CACtB,MAAM,eAAe,WACjB,wDAAwD,OAAO,cACnD,MAAM,KAAK,uEAAuE,EAAE;CACpG,MAAM,WAAW,UAAU,QACrB,CAAC,UAAU,aAAa,IACxB,UAAU,OACN;EAAC,YAAY,EAAE;EAAG;EAAU;CAAa,IACzC;EAAC;EAAU,YAAY,sFAAsF;EAAG;CAAa;CACvI,MAAM,QAAQ;EAAC;EAAI;EAAW;EAAY;CAAY,CAAC,CAAC,SAAS;CACjE,OACI;;oBAEqB,MAAM,KAAK,OAAO,wGAGvC,OACA;;IAEK,MAAM,iBAEX,SAAS,KAAK,GAAG,MAAM,OAAO,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,IACpD,OACK,MAAM,KAAK,wEAAwE,EAAE,MACrF,MAAM,KAAK,2DAA2D,EAAE,MACxE,MAAM,KAAK,0CAA0C,EAAE;AAIpE;;AAGA,SAAgB,mBAAmB,MAA0D;CACzF,MAAM,QAAQ,0EAA0E,KAAK,IAAI;CACjG,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAI,UAAU,MAAM;CAAG,IAAI;AAC7D;;;;;;;;;AAUA,SAAgB,0BAA0B,MAAmD;CACzF,MAAM,EAAE,OAAO,aAAa;CAC5B,OACI;;QAES,MAAM,qCAAqC,SAAS,+PAOxD,MAAM,OAAO,sBAAsB,EAAE,GAAG,MAAM,KAAK,YAAY,EAAE,yMAI5C,MAAM,+KAKN,MAAM,KAAK,uCAAuC,MAAM,GAAG,EAAE,6EAE7E,MAAM,KAAK,uDAAuD,EAAE,WACpE,MAAM,KAAK,wEAAwE,EAAE;AAIvG;;;;;;;;;AAUA,SAAgB,qBAAqB,MAA6B;CAC9D,MAAM,SAAS,0CAA0C,KAAK,IAAI;CAClE,IAAI,QAAQ,OAAO,OAAO,EAAE,CAAC,QAAQ,UAAU,IAAI;CACnD,MAAM,OAAO,wCAAwC,KAAK,IAAI;CAC9D,OAAO,OAAO,KAAK,KAAK;AAC5B;;AAGA,SAAgB,qBAAqB,WAA8D;CAC/F,MAAM,QAAQ,OAAO,GAAG;CACxB,MAAM,QAAQ,IAAI,OAAO,OAAO,GAAG,0EAA0E,MAAM,OAAO,MAAM,KAAK,GAAG,CAAC,CACpI,KAAK,SAAS;CACnB,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,SAAS,MAAM,MAAM,MAAM,GAAA,CAAI,QAAQ,OAAO,IAAI;CACxD,MAAM,SAAS,MAAM,MAAM,MAAM;CACjC,OAAO,WAAW,KAAA,IACZ,EAAE,OAAO,MAAM,IACf;EAAE,QAAQ;EAAO,OAAO,OAAO,QAAQ,OAAO,IAAI;CAAE;AAC9D;;;;;;AAiBA,SAAgB,4BAA4B,MAAmD;CAC3F,IAAI,CAAC,2DAA2D,KAAK,IAAI,GAAG,OAAO;CACnF,OAAO,EAAE,WAAW,qBAAqB,IAAI,EAAE;AACnD;;;;;;AAOA,eAAe,yBACX,aACA,WACiC;CACjC,IAAI,CAAC,eAAe,CAAC,WAAW,OAAO,CAAC;CACxC,MAAM,SAAS,qBAAqB,SAAS;CAC7C,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,UAAU,CAAC,GAAG,UAAU,SAAS,qEAAqE,CAAC,CAAC,CACzG,KAAI,UAAS,MAAM,EAAE,CAAC,QAAQ,OAAO,IAAI,CAAC;CAC/C,IAAI,QAAQ,WAAW,GAAG,OAAO,CAAC;CAClC,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,OAAO;GAAE,kBAAkB;GAAa,yBAAyB;EAAK,CAAC;EAC1F,MAAM,OAAO,QAAQ;EACrB,IAAI;GAaA,QAAO,MAZW,OAAO,MAA8B;;;;;;;;;;;sCAW7B;IAAC,OAAO;IAAO,OAAO,UAAU;IAAM;GAAO,CAAC,EAAA,CAC7D;EACf,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ;;;;;;;;;AAUA,SAAgB,mCACZ,SACA,UACM;CACN,MAAM,QAAQ,SAAS,SAAS,IAC1B,SAAS,KAAI,MAAK,OAAO,MAAM,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,SAC7G,QAAQ,YACJ,yBAAyB,MAAM,KAAK,QAAQ,UAAU,QAAQ,QAAQ,GAAG,CAAC,EAAE,QAC5E;CACV,MAAM,QAAQ,SAAS;CACvB,MAAM,OAAO,QACP,gBAAgB,MAAM,OAAO,KAAK,MAAM,MAAM,iBAAiB,MAAM,OAAO,MAC5E;CACN,OACI,+LAKA,QACA;;kBAEmB,MAAM,OAAO,mCAAmC,EAAE,uBAEjD,MAAM,KAAK,QAAQ,EAAE,2SAOlC,MAAM,KAAK,IAAI,EAAE,QACjB,MAAM,KAAK,gBAAgB,EAAE;AAI5C;;;;;;;AAQA,SAAgB,sBAAsB,MAAiF;CACnH,MAAM,QAAQ,gGAAgG,KAAK,IAAI;CACvH,IAAI,CAAC,OAAO,OAAO;CACnB,OAAO;EAAE,QAAQ,MAAM;EAAI,MAAM,MAAM,EAAE,CAAC,KAAK;EAAG,WAAW,qBAAqB,IAAI;CAAE;AAC5F;;AAGA,SAAgB,6BAA6B,SAA6E;CACtH,MAAM,EAAE,QAAQ,MAAM,cAAc;CACpC,MAAM,SAAS,YAAY,qBAAqB,SAAS,IAAI;CAC7D,MAAM,QAAQ,SAAS,GAAG,OAAO,SAAS,IAAI,OAAO,OAAO,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK;CAC1F,MAAM,eAAe,IAAI,OAAO,QAAQ,MAAM,MAAM,EAAE;CACtD,OACI;;OAEQ,MAAM,GAAG,aAAa,0BAA0B,KAAK,+HAGb,KAAK,gIAElB,MAAM,OAAO,kCAAkC,EAAE,0LAMxE,MAAM,KAAK,eAAe,MAAM,gBAAgB,aAAa,QAAQ,KAAK,SAAS,aAAa,IAAI,KAAK,EAAE,EAAE,WAC/G,MAAM,KAAK,+EAA+E,EAAE,kOAIzE,MAAM,KAAK,YAAY,EAAE;AAI9D;;;;;;AAOA,SAAgB,wBAAwB,MAAqF;CACzH,MAAM,QAAQ,iDAAiD,KAAK,IAAI;CACxE,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,YAAY,qBAAqB,IAAI;CAC3C,IAAI,UAAoB,CAAC;CACzB,IAAI,WAAW;EACX,MAAM,OAAO,wBAAwB,KAAK,SAAS,KAC5C,mIAAmI,KAAK,SAAS;EACxJ,IAAI,MACA,UAAU,CAAC,GAAG,KAAK,EAAE,CAAC,SAAS,qCAAqC,CAAC,CAAC,CACjE,KAAI,OAAM,EAAE,MAAM,EAAE,GAAA,CAAI,QAAQ,OAAO,IAAI,CAAC;CAEzD;CACA,OAAO;EAAE,OAAO,MAAM;EAAI;EAAW;CAAQ;AACjD;;AAGA,eAAe,gBACX,aACA,QACA,SAC4C;CAC5C,IAAI,CAAC,eAAe,CAAC,UAAU,QAAQ,WAAW,GAAG,OAAO,CAAC;CAC7D,MAAM,SAAS,SAAiB,IAAI,KAAK,QAAQ,MAAM,MAAM,EAAE;CAC/D,MAAM,QAAQ,GAAG,OAAO,SAAS,GAAG,MAAM,OAAO,MAAM,EAAE,KAAK,KAAK,MAAM,OAAO,KAAK;CACrF,MAAM,OAAO,QAAQ,IAAI,KAAK,CAAC,CAAC,KAAK,IAAI;CACzC,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,OAAO;GAAE,kBAAkB;GAAa,yBAAyB;EAAK,CAAC;EAC1F,MAAM,OAAO,QAAQ;EACrB,IAAI;GAKA,QAAO,MAHW,OAAO,MACrB,0BAA0B,QAAQ,KAAI,MAAK,GAAG,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE;wBACnE,MAAM,YAAY,KAAK,oDAAoD,EAAA,CAC5E;EACf,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ;AAEA,SAAgB,+BACZ,SACA,YACM;CACN,MAAM,SAAS,QAAQ,YAAY,qBAAqB,QAAQ,SAAS,IAAI;CAC7E,MAAM,QAAQ,SAAS,GAAG,OAAO,SAAS,IAAI,OAAO,OAAO,MAAM,GAAG,GAAG,OAAO,MAAM,KAAK;CAC1F,MAAM,OAAO,QAAQ,QAAQ,SAAS,IAAI,QAAQ,QAAQ,KAAI,MAAK,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;CAC1F,MAAM,SAAS,WAAW,SAAS,IAC7B,yBAAyB,WAAW,KAAI,MAAK,OAAO,MAAM,KAAK,EAAE,MAAM,EAAE,IAAI,MAAM,KAAK,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,SACxH;CACN,OACI;;mBAEoB,MAAM,IAAI,KAAK,2GAGnC,SACA,gCAAgC,QAAQ,MAAM,mFACY,MAAM,OAAO,YAAY,EAAE,MAChF,MAAM,OAAO,wBAAwB,EAAE,wBAGrC,MAAM,KAAK,UAAU,KAAK,kBAAkB,MAAM,YAAY,KAAK,sBAAsB,EAAE,kEAEnC,MAAM,KAAK,QAAQ,EAAE;AAK5F;;AAGA,eAAe,UAAU,aAAiC,OAAuC;CAC7F,IAAI,CAAC,aAAa,OAAO;CACzB,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,OAAO;GAAE,kBAAkB;GAAa,yBAAyB;EAAK,CAAC;EAC1F,MAAM,OAAO,QAAQ;EACrB,IAAI;GAKA,QAAQ,MADU,OAAO,MAAM,mCAAmC,MAAM,QAAQ,MAAM,MAAM,EAAE,EAAE,EAAA,CACpF,KAAK,EAAE,EAAgC,KAAK;EAC5D,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AAYA,SAAgB,mCACZ,WACM;CACN,MAAM,QAAQ,UAAU,KAAI,MAAK;EAC7B,MAAM,QAAQ,EAAE,SAAS,KAAI,MAAK,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI;EAC5D,OAAO,OAAO,MAAM,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ,EAAE,SAAS;CAC5E,CAAC;CACD,MAAM,QAAQ,UAAU;CACxB,OACI,oMAKA,MAAM,KAAK,IAAI,IAAI;;;;;;;IAOd,MAAM,OAAO,sBAAsB,EAAE,2EACd,MAAM,KAAK,QAAQ,EAAE,6MAM1C,MAAM,KAAK,gBAAgB,MAAM,OAAO,KAAK,MAAM,MAAM,iBAAiB,MAAM,OAAO,GAAG,EAAE,QAC5F,MAAM,KAAK,gBAAgB,EAAE,QAC7B,MAAM,KAAK,2DAA2D,EAAE,gCAElD,MAAM,KAAK,QAAQ,EAAE;AAI1D;;;;;;;;AASA,eAAsB,qBAAqB,SAOhB;CACvB,MAAM,EAAE,QAAQ,MAAM,QAAQ,gBAAgB;CAE9C,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,GAAG;EAChD,MAAM,cAAc,wBAAwB,MAAM;EAClD,IAAI,aACA,OAAO,qBAAqB,QAAQ,0BAA0B,MAAM,YAAY,MAAM;CAE9F;CAEA,IAAI,WAAW,YAAY,KAAK,SAAS,OAAO,GAAG;EAC/C,MAAM,WAAW,mBAAmB,MAAM;EAC1C,IAAI,UAAU,OAAO,0BAA0B,QAAQ;EAEvD,MAAM,UAAU,sBAAsB,MAAM;EAC5C,IAAI,SACA,OAAO,6BAA6B,SAAS,MAAM,UAAU,aAAa,QAAQ,KAAK,GAAG,mBAAmB,QAAQ,QAAQ,MAAM,CAAC;EAGxI,MAAM,aAAa,sBAAsB,MAAM;EAC/C,IAAI,YAAY,OAAO,6BAA6B,UAAU;EAE9D,MAAM,SAAS,wBAAwB,MAAM;EAC7C,IAAI,QAEA,OAAO,+BAA+B,QAAQ,MAAM,gBAAgB,aADrD,OAAO,YAAY,qBAAqB,OAAO,SAAS,IAAI,MACc,OAAO,OAAO,CAAC;EAG5G,MAAM,YAAY,4BAA4B,MAAM;EACpD,IAAI,WACA,OAAO,mCAAmC,WAAW,MAAM,yBAAyB,aAAa,UAAU,SAAS,CAAC;CAE7H;CAEA,OAAO;AACX"}

package/dist/cli-errors.d.ts

@@ -119,18 +119,29 @@ export declare function parseNotNullViolation(text: string): {
     column: string;
 } | null;
 /**
- * The three ways out, because there is no fourth.
+ * Whether the column that refused NOT NULL was being added by this push, read
+ * from the statement Atlas was running: `true` for `ADD COLUMN "<column>"`,
+ * `false` for any other statement that names it (`ALTER COLUMN … SET NOT
+ * NULL`), `null` when the error carried no statement.
+ */
+export declare function notNullColumnIsNew(stderr: string, column: string): boolean | null;
+/**
+ * The ways out, and only the ones that work for this column.
+ *
+ * A `defaultValue` backfills only a column the push is adding: PostgreSQL
+ * fills `ADD COLUMN … NOT NULL DEFAULT …` for every existing row, but `ALTER
+ * COLUMN … SET DEFAULT` touches no row that is already there, so for an
+ * existing column that remedy fails exactly as before. When the error does not
+ * say which it was (`isNew` null), the default is offered with that caveat.
  *
  * Boot-ensure handles this case — it adds the column nullable and sets NOT NULL
  * only when the table is empty — so a push that dies here is strictly worse
- * than the boot that would have run instead, and the developer deserves to be
- * told which of the three they want rather than left with `pq: … contains null
- * values (23502)` and no next step.
+ * than the boot that would have run instead.
  */
 export declare function formatNotNullViolationBanner(violation: {
     table: string;
     column: string;
-}, rowCount: number | null): string;
+}, rowCount: number | null, isNew?: boolean | null): string;
 /** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */
 export declare function parseEnumLabelDrop(text: string): {
     label: string;
@@ -190,6 +201,41 @@ export declare function parseGeneratedColumnRefusal(text: string): {
 export declare function formatGeneratedColumnRefusalBanner(refusal: {
     statement: string | null;
 }, blockers: GeneratedColumnBlocker[]): string;
+/**
+ * PostgreSQL refusing a retype it has no implicit cast for (42804): `string` →
+ * `number`, `time` → `date`, an array back to a string. Atlas reports it from
+ * the dry-run's analysis as well as from the apply, so without this a
+ * `--dry-run` died with the raw error and showed no plan at all.
+ */
+export declare function parseUncastableRetype(text: string): {
+    column: string;
+    type: string;
+    statement: string | null;
+} | null;
+/** The `ALTER … USING` a developer would run, and the other ways past it. Boot's drift report says the same. */
+export declare function formatUncastableRetypeBanner(refusal: {
+    column: string;
+    type: string;
+    statement: string | null;
+}): string;
+/**
+ * A unique constraint or index PostgreSQL could not build because the rows
+ * already repeat a value (23505). The DETAIL naming the value does not survive
+ * Atlas, so the duplicates are read back from the table.
+ */
+export declare function parseUniqueBuildFailure(text: string): {
+    index: string;
+    statement: string | null;
+    columns: string[];
+} | null;
+export declare function formatUniqueBuildFailureBanner(failure: {
+    index: string;
+    statement: string | null;
+    columns: string[];
+}, duplicates: {
+    values: string;
+    count: number;
+}[]): string;
 /**
  * A hand-written generated column reading a column the plan wants to retype or
  * drop.

package/dist/{cli-flags-BglvpjHv.js → cli-flags-JNI-pwSf.js}

@@ -54,7 +54,10 @@ var DRIVER_FLAG_SPECS = {
 		"--collections": String,
 		"-c": "--collections"
 	},
-	"db migrate": { "--baseline": String },
+	"db migrate": {
+		"--baseline": String,
+		"--refuse-destructive": Boolean
+	},
 	"schema generate": {
 		"--collections": String,
 		"-c": "--collections",
@@ -133,6 +136,6 @@ function assertKnownFlags(domain, subcommand, args) {
 	}
 }
 //#endregion
-export { collectionsPathIn as n, parseDriverLine as r, assertKnownFlags as t };
+export { parseDriverLine as i, assertKnownFlags as n, collectionsPathIn as r, RELAYED_FLAGS as t };
 
-//# sourceMappingURL=cli-flags-BglvpjHv.js.map
+//# sourceMappingURL=cli-flags-JNI-pwSf.js.map

package/dist/cli-flags-JNI-pwSf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-flags-JNI-pwSf.js","names":[],"sources":["../src/cli-flags.ts"],"sourcesContent":["/**\n * The flags each driver command takes, in one place, and the check that\n * enforces them.\n *\n * Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not\n * mean \"be lenient\" — it means **an undeclared flag becomes a positional**. So\n * `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the\n * push ran with the destructive gate still closed, and the developer read the\n * refusal as Rebase ignoring the flag they had just typed. `rebase schema\n * generate --ouput src/schema.ts` was worse — it wrote the default path and\n * said nothing, so the next build compiled a file nobody had regenerated.\n *\n * The check has to live at the entry point rather than in those parsers, and\n * that is not a detail: `db push` and `db generate` re-enter `schemaCommand`\n * and `generatePostgresDdlCommand` with the *db* line, so a strict parser\n * inside either of them would reject `--allow-destructive` on a line where it\n * is correct. One validation, once, against the spec for the command the user\n * actually named; the inner parsers keep reading an already-validated line.\n *\n * Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),\n * `db backup`, `db restore`, `db backups` — are deliberately absent: they own\n * their spec, and a second list here would be one more thing to keep in step.\n * An absent entry is \"not checked here\", never \"takes nothing\".\n */\nimport arg from \"arg\";\n\n/**\n * Flags that reach this process on a line it did not compose.\n *\n * `rebase db …` hands the driver the user's whole line: the CLI *reads*\n * `--database-url` and `--docker` to resolve the database and then relays them\n * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as\n * the thing to re-run with. Rejecting any of the three would make the driver\n * refuse commands the CLI documents.\n */\nexport const RELAYED_FLAGS = {\n    \"--database-url\": String,\n    \"--docker\": Boolean,\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} satisfies arg.Spec;\n\n/**\n * Parse a driver command's line — `[\"db\", \"<subcommand>\", …]` — with the\n * relayed flags declared alongside the command's own.\n *\n * Every driver parser is permissive, and an undeclared flag in a permissive\n * parse is a positional. The positionals are what `db migrate` hands\n * `atlas migrate apply`, what `db generate` names its migration after and\n * which backup `db restore` restores, so a relayed flag left undeclared was\n * read as one of those: `rebase db migrate --docker` died on Atlas's\n * `unknown flag: --docker` after it had already written the auth schema.\n */\nexport function parseDriverLine<S extends arg.Spec>(\n    spec: S,\n    args: string[]\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    return arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2), permissive: true });\n}\n\n/** Keyed by `\"<domain> <subcommand>\"`, the way the user types it. */\nexport const DRIVER_FLAG_SPECS: Record<string, arg.Spec> = {\n    \"db push\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--dry-run\": Boolean,\n        \"--allow-destructive\": Boolean,\n        \"--yes\": Boolean,\n        \"-y\": \"--yes\"\n    },\n    \"db generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\"\n    },\n    // Bare positionals still pass through to `atlas migrate apply`, which takes\n    // an optional amount; flags do not, apart from `--baseline`.\n    //\n    // `--baseline <version>` is the escape hatch for the normal case, not an\n    // exotic one: every Rebase boot ensures the schema, so a production\n    // database has the tables before its first migration ever runs, and\n    // `migrate apply` then dies on `type \"…\" already exists (42710)`. It maps\n    // onto Atlas's own `migrate apply --baseline`, which writes the revision\n    // row Atlas reads — no ledger of ours.\n    //\n    // `--refuse-destructive` is opt-in: it dry-runs the pending files and exits\n    // 1, applying nothing, when one drops or narrows data — the gate `db push`\n    // has always had, for the path that had none.\n    \"db migrate\": {\n        \"--baseline\": String,\n        \"--refuse-destructive\": Boolean\n    },\n    \"schema generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--watch\": Boolean,\n        \"-w\": \"--watch\"\n    },\n    \"schema introspect\": {\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--force\": Boolean,\n        \"-f\": \"--force\",\n        \"--schema\": String\n    },\n    \"schema stale\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--fix\": Boolean\n    }\n};\n\n/**\n * One destination flag, two spellings, everywhere.\n *\n * `--out` is the primary on `rebase build`, an alias on `generate-sdk`, `db\n * backup` and `cloud env pull`, and was refused outright by the three `schema`\n * commands — so the spelling a user learned on one command was an\n * \"unknown or unexpected option\" on the next. Neither name can be retired (both\n * are shipped), so both are accepted, and {@link assertOutputAliasesPaired}\n * makes that the rule rather than a habit.\n */\nexport const OUTPUT_FLAG_ALIASES = [\"--out\", \"--output\"] as const;\n\n/**\n * Every spec that names one of the pair names both.\n *\n * Exported so the CLI's own specs can be held to it too: the drift this fixes\n * ran across two packages, and a check that only reads this file would let the\n * next `--out`-only command through.\n */\nexport function assertOutputAliasesPaired(specs: Record<string, arg.Spec>): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const present = OUTPUT_FLAG_ALIASES.filter(flag => flag in spec);\n        if (present.length === 0 || present.length === OUTPUT_FLAG_ALIASES.length) continue;\n        const missing = OUTPUT_FLAG_ALIASES.filter(flag => !(flag in spec));\n        problems.push(`\\`${command}\\` takes ${present.join(\", \")} but not ${missing.join(\", \")}`);\n    }\n    return problems;\n}\n\n/**\n * The `--collections` path the user typed, or `null` if they typed none.\n *\n * Read once, at the entry point, because every command that takes it re-enters\n * the generators with the same line and each of them resolved it again — which\n * is how \"Collections path not found\" came to be printed four times before the\n * real output, and how a path that does not exist got as far as *writing* an\n * empty schema.\n *\n * Permissive, and it has to be: {@link assertKnownFlags} has already judged the\n * line, and `db push` carries flags the `--collections` spec does not name.\n */\nexport function collectionsPathIn(args: string[]): string | null {\n    try {\n        const parsed = arg(\n            { \"--collections\": String, \"-c\": \"--collections\" },\n            { argv: args.slice(2), permissive: true }\n        );\n\n        return parsed[\"--collections\"] ?? null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The long flags a `--help` usage line documents.\n *\n * `\"rebase db push [--collections <dir>] [--dry-run] …\"` → `[\"--collections\",\n * \"--dry-run\"]`. Placeholders (`<dir>`) and the alternation inside a positional\n * (`<create|list|switch>`) are not flags and are not returned.\n */\nexport function flagsInUsage(usage: string): string[] {\n    return [...new Set(usage.match(/--[a-z][a-z0-9-]*/g) ?? [])];\n}\n\n/**\n * Every flag the help documents is accepted, and every flag accepted is documented.\n *\n * The drift this catches shipped: `rebase db push --help` has printed\n * `[--dry-run]` since the flag was written, `DRIVER_FLAG_SPECS[\"db push\"]` never\n * listed it, and {@link assertKnownFlags} — added later to stop typos being\n * swallowed — turned the documented flag into `unknown or unexpected option`.\n * The only way to see a push's SQL was to trip the destructive gate, which is\n * the exact problem `--dry-run` was written to solve. Worse in a project on an\n * older driver, whose permissive parser *applied* the schema on that line.\n *\n * Two hand-maintained lists in two packages cannot be kept in step by care, so\n * they are held to each other instead: `usages` is keyed the way\n * {@link DRIVER_FLAG_SPECS} is (`\"db push\"`), and comes from the CLI's own help\n * pages. A key in only one of the two is not this function's business — the\n * help covers commands that parse their own lines (`db branch`, `db backup`),\n * and an absent spec entry means \"not checked here\".\n *\n * Aliases (`\"-c\": \"--collections\"`, `\"--out\": \"--output\"`) need no line of their\n * own: they are spellings of a documented flag. Neither do {@link RELAYED_FLAGS},\n * which every driver command accepts because the CLI relays them.\n */\nexport function assertSpecMatchesUsage(\n    specs: Record<string, arg.Spec>,\n    usages: Record<string, string>\n): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const usage = usages[command];\n        if (usage === undefined) continue;\n\n        const documented = flagsInUsage(usage);\n        const accepted = Object.entries(spec);\n        // An alias resolves to the flag it spells; only the target needs a line.\n        const canonical = new Set(\n            accepted\n                .map(([flag, kind]) => (typeof kind === \"string\" ? kind : flag))\n                .filter(flag => flag.startsWith(\"--\"))\n        );\n\n        for (const flag of documented) {\n            if (flag in spec || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` documents ${flag} in its usage line but the spec rejects it`);\n        }\n        for (const flag of canonical) {\n            if (documented.includes(flag) || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` accepts ${flag} but no usage line documents it`);\n        }\n    }\n    return problems;\n}\n\n/**\n * Reject a flag the named command does not take.\n *\n * `args` is the driver's whole line — `[\"db\", \"push\", …]` — so the flags are\n * read from `args.slice(2)`, past the two command words.\n *\n * Throws rather than exiting: `runPluginCommand`'s caller already turns a\n * thrown error into one red line and exit 1, and a thrown error is what the\n * tests can see.\n */\nexport function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void {\n    if (!subcommand) return;\n    const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];\n    if (!spec) return;\n\n    try {\n        arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2) });\n    } catch (err) {\n        if (err instanceof Error && (err as arg.ArgError).code === \"ARG_UNKNOWN_OPTION\") {\n            throw new Error(\n                `${err.message} — run \\`rebase ${domain} --help\\` for the options ` +\n                `\\`${domain} ${subcommand}\\` takes.`\n            );\n        }\n        throw err;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAmCA,IAAa,gBAAgB;CACzB,kBAAkB;CAClB,YAAY;CACZ,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;;;;;;;AAaA,SAAgB,gBACZ,MACA,MACoC;CACpC,QAAA,GAAA,WAAA,QAAA,CAAW;EAAE,GAAG;EAAe,GAAG;CAAK,GAAG;EAAE,MAAM,KAAK,MAAM,CAAC;EAAG,YAAY;CAAK,CAAC;AACvF;;AAGA,IAAa,oBAA8C;CACvD,WAAW;EACP,iBAAiB;EACjB,MAAM;EACN,aAAa;EACb,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV;CACA,eAAe;EACX,iBAAiB;EACjB,MAAM;CACV;CAcA,cAAc;EACV,cAAc;EACd,wBAAwB;CAC5B;CACA,mBAAmB;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,WAAW;EACX,MAAM;CACV;CACA,qBAAqB;EACjB,YAAY;EACZ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,MAAM;EACN,WAAW;EACX,MAAM;EACN,YAAY;CAChB;CACA,gBAAgB;EACZ,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,SAAS;CACb;AACJ;;;;;;;;;;;;;AA4CA,SAAgB,kBAAkB,MAA+B;CAC7D,IAAI;EAMA,QAAA,GAAA,WAAA,QAAA,CAJI;GAAE,iBAAiB;GAAQ,MAAM;EAAgB,GACjD;GAAE,MAAM,KAAK,MAAM,CAAC;GAAG,YAAY;EAAK,CAGrC,CAAA,CAAO,oBAAoB;CACtC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AA2EA,SAAgB,iBAAiB,QAAgB,YAAgC,MAAsB;CACnG,IAAI,CAAC,YAAY;CACjB,MAAM,OAAO,kBAAkB,GAAG,OAAO,GAAG;CAC5C,IAAI,CAAC,MAAM;CAEX,IAAI;EACA,CAAA,GAAA,WAAA,QAAA,CAAI;GAAE,GAAG;GAAe,GAAG;EAAK,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CAC9D,SAAS,KAAK;EACV,IAAI,eAAe,SAAU,IAAqB,SAAS,sBACvD,MAAM,IAAI,MACN,GAAG,IAAI,QAAQ,kBAAkB,OAAO,8BACnC,OAAO,GAAG,WAAW,UAC9B;EAEJ,MAAM;CACV;AACJ"}

package/dist/cli-helpers.d.ts

@@ -84,6 +84,45 @@ export declare function resolveLocalBin(binName: string): string | null;
 export declare function getTableIncludesFromCollections(allCollections: CollectionConfig[]): Promise<string[]>;
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function loadCollectionsForCli(collectionsPath: string): Promise<CollectionConfig[]>;
+type PgClient = import("pg").Client;
+/**
+ * Run one step on this process's connection to the app database.
+ *
+ * Every step leaves the session as it found it, which is what a connection of
+ * its own used to guarantee by being closed. None of them sets anything for
+ * the session — `SET LOCAL` inside their own transaction, or `RESET` — and one
+ * that fails part-way through a transaction it opened is rolled back here, so
+ * the next step does not meet `current transaction is aborted`.
+ *
+ * @param options.connectionTimeoutMillis applies only when this call is the one
+ *        that connects.
+ */
+export declare function withAppClient<T>(databaseUrl: string, step: (client: PgClient) => Promise<T>, options?: {
+    connectionTimeoutMillis?: number;
+}): Promise<T>;
+/** Close every connection {@link withAppClient} opened. Called once, as the command ends. */
+export declare function closeAppClients(): Promise<void>;
+/**
+ * Names the empty database Atlas plans against, instead of `<db>_dev_diff`.
+ *
+ * The derived one is made with `CREATE DATABASE` beside the real database,
+ * which assumes a server that holds more than one. PGlite — the managed
+ * development database — serves exactly one: the CREATE succeeds and creates
+ * nothing, so Atlas connected straight back to the database it was comparing
+ * and refused it as "not clean". `rebase db push` on the managed database now
+ * starts a second, throwaway PGlite and names it here. Anyone can name their
+ * own the same way; a named database is neither created nor dropped.
+ */
+export declare const ATLAS_DEV_URL_ENV = "REBASE_ATLAS_DEV_URL";
+/**
+ * The database Atlas replays the desired schema into: the one
+ * {@link ATLAS_DEV_URL_ENV} names (`named: true` — not ours to create or
+ * drop), else `<db>_dev_diff`.
+ */
+export declare function atlasDevDatabaseUrl(databaseUrl: string, env: Readonly<Record<string, string | undefined>>): {
+    url: string;
+    named: boolean;
+};
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 /**
  * Create the scratch database Atlas plans against, and say so when we cannot.
@@ -322,3 +361,4 @@ export declare function getTableExcludes(databaseUrl: string, collectionsPath: s
  * `import.meta` and cannot be imported by the jest runner.
  */
 export declare function promptConfirm(question: string): Promise<boolean>;
+export {};

package/dist/cli-output.d.ts

@@ -1,34 +1,22 @@
-/**
- * Terminal output for the `rebase db|schema|doctor` commands.
- *
- * These commands used to write every line through `logger`, and that is a
- * category error with three separate consequences:
- *
- *  - `logger` prefixes each line with its own level, so a box-drawn report
- *    arrived as `ℹ️ [INFO]   ┌─ ✗ Missing Column ───` and the frame no longer
- *    lined up with anything;
- *  - `logger` is gated by `LOG_LEVEL`, which ships in the scaffold's own
- *    `.env.example` — a developer who quietened their dev server with
- *    `LOG_LEVEL=warn` got a `rebase db push` that printed almost nothing and
- *    still exited non-zero, indistinguishable from a crash;
- *  - under `NODE_ENV=production` `logger` emits JSON, so the whole report
- *    became log records with the chalk escape codes embedded in them.
- *
- * A CLI's report *is* its return value. It goes to the terminal unconditionally
- * and unadorned. `packages/cli` has always written its output this way; this is
- * the same three functions for the plugin CLI that `rebase` delegates to.
- *
- * `logger` still belongs in this package's *runtime* — a request handler has no
- * terminal and its lines want levels, timestamps and redaction. The rule is the
- * caller, not the severity: anything a developer reads because they typed a
- * command goes here, anything a server emits while running goes to `logger`.
- *
- * Errors and warnings go to stderr so `rebase db push > plan.txt` keeps the
- * diagnosis on the terminal where it is readable.
- */
 /** One line of human-facing output on stdout. */
 export declare const out: (line?: string) => void;
 /** One line of human-facing warning output on stderr. */
 export declare const outWarn: (line?: string) => void;
 /** One line of human-facing error output on stderr. */
 export declare const outError: (line?: string) => void;
+/**
+ * Whether a failure should be printed with its stack — `rebase --debug`, which
+ * the launcher passes down as `REBASE_DEBUG`, or `REBASE_DEBUG` set by hand.
+ */
+export declare const wantsStack: () => boolean;
+/**
+ * An error as a person reads it: its message, and its stack only under
+ * `--debug`.
+ *
+ * The rule `rebase` itself follows (`bin/rebase.js`). These commands run in a
+ * child process the launcher's handler never sees, so a syntax error in a
+ * collection file reached the terminal as `Doctor failed CollectionConfigError:`
+ * followed by twenty frames of loader internals, under a sentence that already
+ * said which file and which line.
+ */
+export declare const describeFailure: (error: unknown) => string;