@rebasepro/server-postgres 0.24.1-canary.gcb918fc → 0.25.0-canary.ge06257e

package/dist/{cli-errors-CaI4ntyD.js → cli-errors-mx4sSjB8.js}

@@ -1,7 +1,6 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
-import { a as outWarn, f as isRebaseIndexName, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
+import { a as outWarn, i as outError, m as isRebaseIndexName, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-DB6xJv3p.js";
 import path from "path";
 import fs from "fs";
 import { fileURLToPath, pathToFileURL } from "url";
@@ -25,33 +24,165 @@ function extractCauseMessage(error) {
 	return null;
 }
 //#endregion
-//#region src/schema/destructive-sql.ts
-var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
+//#region src/utils/connection-string.ts
 /**
-* Pure helpers that classify an Atlas declarative-apply plan as destructive
-* or not, and decide what `rebase db push` should do about it.
+* Connection-string rewrites for the tools Rebase shells out to.
 *
-* `db push` runs `atlas schema apply` to make the live database match the
-* generated `schema.sql`. Removing a collection field compiles to
-* `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
-* We first run the apply with `--dry-run` to obtain the planned SQL, scan it
-* here, and refuse to auto-approve anything destructive without an explicit
-* opt-in.
+* Pure and dependency-free: `pg-tools` builds argument vectors without a live
+* server, and these have to be usable from there.
+*/
+/**
+* The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+*/
+var LIBPQ_SSLMODES = /* @__PURE__ */ new Set([
+	"disable",
+	"allow",
+	"prefer",
+	"require",
+	"verify-ca",
+	"verify-full"
+]);
+/**
+* Make a connection string safe to hand to a libpq program.
+*
+* `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+* the certificate — and libpq does not have it. It does not degrade or warn:
 *
-* A type change is a destructive plan that names no DROP. `ALTER COLUMN
-* "price" TYPE integer` rounds every 19.99 to 20, and `TYPE date` throws away
-* every timestamp's time of day, in a statement that reads like a routine
-* alter. So a type change is gated too, unless it is a widening every value
-* survives unchanged — which needs the column's current type, read from the
-* catalogue by the caller.
+*     psql: error: invalid sslmode value: "no-verify"
 *
-* A primary key change names no DROP of data either: `DROP CONSTRAINT
-* "<table>_pkey", ADD PRIMARY KEY ("id", "locale")` keeps every value and
-* gives every row a new address. It is gated like a drop.
+* which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+* `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+* points at the value rather than at the convention it comes from. It has cost
+* this project time more than once.
 *
-* Everything in this file is side-effect free so it can be unit-tested
-* without Atlas or a database.
+* `require` is the honest translation: libpq's `require` encrypts and does not
+* verify the certificate either, which is exactly what `no-verify` asks for.
+* Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+* alone, so a connection string that asked for verification still gets it.
+*
+* Only `sslmode` is touched, and only when it is a value libpq would reject.
+* Anything unparseable is returned as given: a connection that works
+* unverified beats one this corrupted.
 */
+function forLibpq(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return connectionString;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+	const sslmode = url.searchParams.get("sslmode");
+	if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+	url.searchParams.set("sslmode", "require");
+	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return url.toString();
+}
+/** Hosts that are this machine: `localhost`, `127.0.0.0/8`, `::1` and `0.0.0.0`. */
+var isLoopbackHost = (hostname) => hostname === "localhost" || hostname === "[::1]" || hostname === "0.0.0.0" || /^127(\.\d{1,3}){3}$/.test(hostname);
+/**
+* A connection string for Atlas: {@link forLibpq}, and `sslmode=disable` for a
+* database on this machine whose URL says nothing about SSL.
+*
+* Atlas connects through lib/pq, whose default `sslmode` is `require`.
+* node-postgres — the app, and every step of these commands — asks for no SSL
+* when the URL names none. So a URL that served the app from a local Postgres
+* without SSL (the Docker image, a Homebrew install) failed every schema
+* command with `pq: SSL is not enabled on the server`. Given here, Atlas
+* connects the way the app already does.
+*
+* Nothing that asked for something is touched: a URL naming `sslmode`, `ssl`,
+* `host` or `hostaddr`, any other host, and anything that is not a postgres
+* URL are returned as {@link forLibpq} returns them.
+*/
+function forAtlas(connectionString) {
+	const libpq = forLibpq(connectionString);
+	let url;
+	try {
+		url = new URL(libpq);
+	} catch {
+		return libpq;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return libpq;
+	if (!isLoopbackHost(url.hostname)) return libpq;
+	if ([
+		"sslmode",
+		"ssl",
+		"host",
+		"hostaddr"
+	].some((key) => url.searchParams.has(key))) return libpq;
+	url.searchParams.set("sslmode", "disable");
+	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return url.toString();
+}
+/**
+* A connection string with its password taken out, and the password.
+*
+* For a libpq program: the URL goes on its command line, and the password goes
+* in `PGPASSWORD`. On the command line it was readable by anyone who can list
+* processes, and it came back verbatim in every failure, because execa's error
+* message repeats the command: `Command failed with exit code 1: pg_restore
+* '--dbname=postgresql://app:s3cret@…'`, in a terminal, a CI log and the
+* scheduled backup's run history.
+*
+* libpq takes the password from the URL's user info or a `password` parameter,
+* so both are removed. The value is percent-decoded, because `PGPASSWORD` is
+* read literally. Anything that is not a URL is returned as given, with no
+* password: a key/value DSN keeps its own.
+*/
+function splitPassword(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return {
+			connectionString,
+			password: null
+		};
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return {
+		connectionString,
+		password: null
+	};
+	const fromUserInfo = url.password ? decodePercent(url.password) : null;
+	const fromParameter = url.searchParams.get("password");
+	if (fromUserInfo === null && fromParameter === null) return {
+		connectionString,
+		password: null
+	};
+	url.password = "";
+	if (fromParameter !== null) {
+		url.searchParams.delete("password");
+		url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	}
+	return {
+		connectionString: url.toString(),
+		password: fromUserInfo ?? fromParameter
+	};
+}
+function decodePercent(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* Every password a line of text carries in a connection string, replaced with
+* `***`.
+*
+* For whatever is about to be printed or logged and may have a connection
+* string in it: an error a client tool or a driver raised, a message that
+* quotes a command line. Covers the URL user-info form (`scheme://user:pass@`,
+* any scheme, a password with a raw `@` in it included) and `password=` in a
+* query string or a key/value DSN. The user, host and database stay, because
+* they are what a reader needs to tell which database it was.
+*/
+function redactConnectionPasswords(text) {
+	return text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^\s/?#@'"]*):[^\s/?#'"]*@/gi, "$1:***@").replace(/(\bpassword\s*=\s*)('[^']*'|[^\s&'"]+)/gi, "$1***");
+}
+//#endregion
+//#region src/schema/destructive-sql.ts
 /**
 * SQL fragments that destroy data or data-bearing objects. Matched
 * case-insensitively against each statement of the plan. `IF EXISTS` /
@@ -222,8 +353,12 @@ var COLUMN_TYPES_SQL = `
 * `columnTypes` is what the database holds now. A type change to a column it
 * does not list is flagged: not knowing what a column is means not knowing
 * whether the change keeps its values.
+*
+* `constraints` are the CHECK and EXCLUDE constraints the database holds now.
+* A `DROP CONSTRAINT` of one of them is flagged; of any other constraint (a
+* foreign key, a `UNIQUE`) it is not, as before.
 */
-function detectDestructiveStatements(planSql, columnTypes = []) {
+function detectDestructiveStatements(planSql, columnTypes = [], constraints = []) {
 	const found = [];
 	const { statements, announced } = readPlan(planSql);
 	if (announced !== void 0 && announced !== statements.length) found.push({
@@ -238,9 +373,14 @@ function detectDestructiveStatements(planSql, columnTypes = []) {
 			change,
 			from: currentTypeOf(change, columnTypes)
 		})).filter(({ change, from }) => from === void 0 || !isLosslessTypeChange(from, change.to)).map(({ change, from }) => `"${change.column}" ${from ?? "(current type unknown)"} → ${change.to}`).join("; ");
-		const kind = dropped?.label ?? (rekeyed ? "PRIMARY KEY CHANGE" : lossy ? "ALTER COLUMN TYPE" : void 0);
+		const unenforced = describeConstraintDrops(statement, constraints);
+		const kind = dropped?.label ?? (rekeyed ? "PRIMARY KEY CHANGE" : lossy ? "ALTER COLUMN TYPE" : unenforced ? "DROP CONSTRAINT" : void 0);
 		if (!kind) continue;
-		const detail = [rekeyed, lossy].filter(Boolean).join("; ");
+		const detail = [
+			rekeyed,
+			lossy,
+			unenforced
+		].filter(Boolean).join("; ");
 		found.push(detail ? {
 			statement,
 			kind,
@@ -354,6 +494,30 @@ function describePrimaryKeyChange(statement) {
 	if (dropped) return `${table} loses its primary key ${dropped}: ${ROW_ADDRESS_LOST}`;
 }
 /**
+* The CHECK and EXCLUDE constraints an `ALTER TABLE` drops, in a sentence — or
+* `undefined` when it drops none.
+*
+* Matched by name on the statement's table, in its schema when the plan names
+* one (Atlas always does). A constraint the catalogue does not list as a CHECK
+* or an EXCLUDE — a foreign key, a `UNIQUE`, the primary key — is not this.
+*/
+function describeConstraintDrops(statement, constraints) {
+	if (constraints.length === 0) return void 0;
+	const alter = ALTER_TABLE_RE.exec(fromAlterTable(statement));
+	if (!alter) return void 0;
+	const [schema, table] = alter[2] ? [unquote(alter[1]), unquote(alter[2])] : [void 0, unquote(alter[1])];
+	const lost = [];
+	for (const clause of splitClauses(alter[3])) {
+		const drop = DROP_CONSTRAINT_RE.exec(clause);
+		if (!drop) continue;
+		const name = unquote(drop[1]);
+		const constraint = constraints.find((c) => c.table === table && c.name === name && (schema === void 0 || c.schema === schema));
+		if (constraint) lost.push(`${constraint.kind === "check" ? "CHECK" : "EXCLUDE"} "${name}"`);
+	}
+	if (lost.length === 0) return void 0;
+	return `${schema ? `${schema}.${table}` : table} loses ${lost.join(", ")}: no row is lost, and the database accepts every row ${lost.length === 1 ? "it refuses" : "they refuse"} today`;
+}
+/**
 * The column's current type. A table named without its schema matches in any
 * schema, but only when every match agrees — two same-named tables with
 * different types leave the answer unknown.
@@ -468,6 +632,17 @@ function isLosslessTypeChange(from, to) {
 	return false;
 }
 /**
+* The flag that opted a push into destructive changes, as it was given —
+* `--allow-destructive`, or its alias `--yes` / `-y` — or `undefined` for
+* none. The line that says why a destructive push went ahead names the one
+* the user typed: "because --allow-destructive was passed" to someone who
+* typed `--yes` reads like a flag they never set.
+*/
+function destructiveOptInFlag(args) {
+	if (args["--allow-destructive"] === true) return "--allow-destructive";
+	if (args["--yes"] === true) return "--yes";
+}
+/**
 * Decide how `db push` should proceed given the plan's destructiveness and
 * the invocation context.
 *
@@ -483,6 +658,78 @@ function decidePushSafety(opts) {
 	return opts.interactive ? "confirm" : "refuse";
 }
 //#endregion
+//#region src/schema/undeclarable-constraints.ts
+/**
+* The constraints a collection cannot declare, and how `db push` keeps Atlas
+* from dropping them.
+*
+* `db push` is declarative: Atlas makes each managed table match `schema.sql`,
+* and anything on the table that `schema.sql` does not mention is planned as a
+* drop. The collection model declares a table's primary key, its columns'
+* `NOT NULL`, `UNIQUE` and foreign keys, and nothing else. So a hand-written
+* `CHECK (total >= 0)` — or one an adopted database arrived with, which
+* `schema introspect` reads as `validation.min: 0` — was dropped by the first
+* push, in the same `ALTER TABLE` as whatever else the push changed, with no
+* prompt. From then on the database accepted every row the constraint used to
+* refuse, while the form still enforced the rule and so hid that it had gone.
+*
+* EXCLUDE constraints are the same case: Atlas inspects them and plans their
+* drop the same way. Triggers and functions are not: Atlas's free tier does
+* not inspect either, so it never plans a drop for one. Measured on the pinned
+* atlas 1.2.3 against PG 18; `introspect-check-constraints-e2e` pins all four.
+*
+* Ownership, as with indexes (`getForeignIndexExcludes` in `cli-helpers.ts`)
+* and policies: a constraint the desired state declares is
+* Atlas's to manage, and every other CHECK or EXCLUDE is somebody else's and is
+* kept out of the plan with `--exclude`. Today the desired state declares
+* neither kind, so every one is kept. A rule nobody wants any more is dropped
+* by hand (`ALTER TABLE … DROP CONSTRAINT …`), which is the only statement that
+* can say so.
+*
+* Side-effect free, so it is unit-tested without Atlas or a database.
+*/
+/**
+* Every CHECK and EXCLUDE constraint on an ordinary or partitioned table
+* outside the system schemas.
+*
+* `contype` `c` and `x` only. A primary key (`p`), `UNIQUE` (`u`), foreign key
+* (`f`) and, from PG 18, a catalogued `NOT NULL` (`n`) are what a collection
+* declares, so Atlas keeps managing them.
+*/
+var UNDECLARABLE_CONSTRAINTS_SQL = `
+    SELECT n.nspname AS "schema",
+           c.relname AS "table",
+           con.conname AS "name",
+           CASE con.contype WHEN 'c' THEN 'check' ELSE 'exclude' END AS "kind"
+    FROM pg_constraint con
+    JOIN pg_class c     ON c.oid = con.conrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE con.contype IN ('c', 'x')
+      AND c.relkind IN ('r', 'p')
+      AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND n.nspname NOT LIKE 'pg\\_%'
+`;
+var DECLARED_CONSTRAINT_RE = /\bCONSTRAINT\s+"((?:[^"]|"")+)"\s+(?:CHECK|EXCLUDE)\b/gi;
+/**
+* The CHECK and EXCLUDE constraint names a desired state (`schema.sql`)
+* declares — Atlas's to manage, and so never excluded.
+*/
+function declaredConstraintNames(desiredSql) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of desiredSql.matchAll(DECLARED_CONSTRAINT_RE)) names.add(match[1].replace(/""/g, "\""));
+	return names;
+}
+/**
+* The `--exclude` patterns that keep Atlas from dropping the CHECK and EXCLUDE
+* constraints the desired state does not declare. Three-part
+* `schema.table.constraint`, which is what Atlas matches a constraint by: a
+* two-part pattern reads as a table, matches nothing, and reports no error.
+*/
+function undeclaredConstraintExcludes(existing, desiredSql) {
+	const declared = declaredConstraintNames(desiredSql);
+	return existing.filter((constraint) => !declared.has(constraint.name)).map((constraint) => atlasExcludePattern(constraint.schema, constraint.table, constraint.name));
+}
+//#endregion
 //#region src/module-dir.ts
 var moduleDir = path.dirname(fileURLToPath(import.meta.url));
 //#endregion
@@ -655,15 +902,53 @@ function describeReinstallCommand(manager = detectProjectPackageManager()) {
 		default: return "pnpm install --force";
 	}
 }
-/** `add <pkg>` as a dev dependency, in the reader's own package manager. */
-function describeDevAddCommand(packageName, manager = detectProjectPackageManager()) {
+/**
+* The workspace member a command runs in, relative to the workspace's root —
+* `backend` in a scaffolded project — or null at that root and outside any
+* workspace.
+*
+* The member is the nearest directory at or above `startDir` holding a
+* `package.json`; the root is the nearest one above it holding a
+* `pnpm-workspace.yaml`, or a `package.json` that declares `workspaces`.
+*/
+function workspaceMemberDir(startDir = process.cwd()) {
+	let member = path.resolve(startDir);
+	while (!fs.existsSync(path.join(member, "package.json"))) {
+		const parent = path.dirname(member);
+		if (parent === member) return null;
+		member = parent;
+	}
+	for (let dir = path.dirname(member);; dir = path.dirname(dir)) {
+		if (isWorkspaceRoot(dir)) return path.relative(dir, member).split(path.sep).join("/");
+		if (path.dirname(dir) === dir) return null;
+	}
+}
+function isWorkspaceRoot(dir) {
+	if (fs.existsSync(path.join(dir, "pnpm-workspace.yaml"))) return true;
+	try {
+		const manifest = JSON.parse(fs.readFileSync(path.join(dir, "package.json"), "utf8"));
+		return typeof manifest === "object" && manifest !== null && "workspaces" in manifest;
+	} catch {
+		return false;
+	}
+}
+/**
+* `add <pkg>` as a dev dependency, in the reader's own package manager, typed
+* from the project root: into `workspaceDir` when the command runs in a
+* workspace member, where a bare `pnpm add -D` at the root refuses with
+* `ERR_PNPM_ADDING_TO_ROOT`.
+*/
+function describeDevAddCommand(packageName, manager = detectProjectPackageManager(), workspaceDir = workspaceMemberDir()) {
+	const dir = workspaceDir === null ? null : shellWord(workspaceDir);
 	switch (manager) {
-		case "npm": return `npm install -D ${packageName}`;
-		case "yarn": return `yarn add -D ${packageName}`;
-		case "bun": return `bun add -d ${packageName}`;
-		default: return `pnpm add -D ${packageName}`;
+		case "npm": return dir ? `npm install -D ${packageName} -w ${dir}` : `npm install -D ${packageName}`;
+		case "yarn": return dir ? `yarn --cwd ${dir} add -D ${packageName}` : `yarn add -D ${packageName}`;
+		case "bun": return dir ? `bun add -d ${packageName} --cwd ${dir}` : `bun add -d ${packageName}`;
+		default: return dir ? `pnpm --dir ${dir} add -D ${packageName}` : `pnpm add -D ${packageName}`;
 	}
 }
+/** A path as one shell word: as it is when it needs no quoting, single-quoted otherwise. */
+var shellWord = (value) => /^[\w./-]+$/.test(value) ? value : `'${value.replace(/'/g, "'\\''")}'`;
 /**
 * Where a package's own manifest lives, or null if it is not installed here.
 *
@@ -1007,7 +1292,7 @@ async function applySearchDdl(databaseUrl, sqlDir = generatedSqlDir()) {
 * `search` block, which is every project that has not opted in.
 */
 async function getSearchExcludes(collectionsPath) {
-	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
 	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -1094,7 +1379,7 @@ function readVectorDdl(sqlDir = generatedSqlDir()) {
 async function applyVectorDdl(databaseUrl, sqlDir = generatedSqlDir()) {
 	const sql = readVectorDdl(sqlDir);
 	if (!sql) return;
-	const { vectorExtensionHint } = await import("./vector-index-CMJKb3C9.js").then((n) => n.f);
+	const { vectorExtensionHint } = await import("./vector-index-BFhyEaiz.js").then((n) => n.f);
 	try {
 		await withAppClient(databaseUrl, (client) => client.query(sql));
 	} catch (err) {
@@ -1112,7 +1397,7 @@ async function applyVectorDdl(databaseUrl, sqlDir = generatedSqlDir()) {
 * `vector` property, which is every project that has not opted in.
 */
 async function getVectorExcludes(collectionsPath) {
-	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
 	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
@@ -1149,17 +1434,12 @@ async function applyTriggersDdl(databaseUrl, sqlDir = generatedSqlDir()) {
 }
 /** @see getSearchExcludes */
 async function getTriggerExcludes(collectionsPath) {
-	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+	const { triggerExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
 	return triggerExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
-* Query the live database for every user table/view outside the system
-* catalogs. Separated from {@link getTableExcludes} so its failure mode can
-* be handled explicitly (fail closed) and so tests can inject a stub.
-*/
-/**
-* Every index Postgres holds on a table Rebase manages, as
-* `schema.table.index`.
+* Every index Postgres holds on a table, by its parts — never joined with `.`,
+* which a name may itself contain.
 *
 * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
 * *constraint* to Atlas, diffed from the constraint declaration, and naming its
@@ -1168,7 +1448,7 @@ async function getTriggerExcludes(collectionsPath) {
 async function queryExistingIndexes(databaseUrl) {
 	return withAppClient(databaseUrl, async (client) => {
 		return (await client.query(`
-            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name
+            SELECT n.nspname AS "schema", t.relname AS "table", i.relname AS "index"
             FROM pg_index x
             JOIN pg_class i ON i.oid = x.indexrelid
             JOIN pg_class t ON t.oid = x.indrelid
@@ -1178,7 +1458,7 @@ async function queryExistingIndexes(databaseUrl) {
               AND NOT EXISTS (
                   SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
               );
-        `)).rows.map((row) => row.full_name);
+        `)).rows;
 	});
 }
 /**
@@ -1207,7 +1487,9 @@ async function queryExistingIndexes(databaseUrl) {
 *
 * Three-part `schema.table.index`, never two: a two-part pattern reads as a
 * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
-* reports no error — the trap already recorded for the search excludes.
+* reports no error — the trap already recorded for the search excludes. And
+* spelled by `atlasExcludePattern`: a raw `orders_idx[v1]` is a glob that
+* matches `orders_idxv`, so that index was dropped with no prompt.
 */
 async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {}) {
 	const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
@@ -1218,11 +1500,10 @@ async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {})
 	} catch (err) {
 		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`, err);
 	}
-	return existing.filter((full) => {
-		const indexName = full.slice(full.lastIndexOf(".") + 1);
-		if (managed.has(indexName)) return false;
-		return !isRebaseIndexName(indexName);
-	});
+	return existing.filter(({ index }) => {
+		if (managed.has(index)) return false;
+		return !isRebaseIndexName(index);
+	}).map(({ schema, table, index }) => atlasExcludePattern(schema, table, index));
 }
 /**
 * The index names the current collections would create — search, vector and
@@ -1230,21 +1511,48 @@ async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {})
 */
 async function managedIndexNames(collectionsPath) {
 	const collections = await loadCollectionsForCli(collectionsPath);
-	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
-	const { resolveColumnName } = await import("./column-plan-helpers-drZIsSNf.js").then((n) => n.t);
-	const { buildCollectionIndexPlan } = await import("./source-DBDbBTL4.js").then((n) => n.l);
+	const { searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+	const { resolveColumnName } = await import("./column-plan-helpers-D_V4oaZh.js").then((n) => n.t);
+	const { buildCollectionIndexPlan } = await import("./source-DB6xJv3p.js").then((n) => n.d);
 	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
-	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
+	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) {
+		const object = excludePatternParts(pattern)?.[2];
+		if (object !== void 0) names.add(object);
+	}
 	return names;
 }
+/** Every CHECK and EXCLUDE constraint the database holds. @see UNDECLARABLE_CONSTRAINTS_SQL */
+async function queryUndeclarableConstraints(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => (await client.query(UNDECLARABLE_CONSTRAINTS_SQL)).rows);
+}
+/**
+* Patterns keeping Atlas away from the CHECK and EXCLUDE constraints the
+* collections do not declare — which, since a collection cannot declare
+* either, is all of them. See `schema/undeclarable-constraints.ts`.
+*
+* Fails CLOSED, like {@link getTableExcludes}: without the catalogue nothing
+* says which constraints are there, and a partial list lets the push drop a
+* rule the database enforces. `desiredSql` is the `schema.sql` Atlas is about
+* to diff against; a constraint it declares is Atlas's to manage.
+*/
+async function getUndeclaredConstraintExcludes(databaseUrl, desiredSql, deps = {}) {
+	const queryConstraints = deps.queryConstraints ?? queryUndeclarableConstraints;
+	let existing;
+	try {
+		existing = await queryConstraints(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for CHECK and EXCLUDE constraints: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	return undeclaredConstraintExcludes(existing, desiredSql);
+}
 async function queryExistingTables(databaseUrl) {
 	return withAppClient(databaseUrl, async (client) => {
 		return (await client.query(`
-            SELECT table_schema || '.' || table_name AS full_name
+            SELECT table_schema AS "schema", table_name AS "table"
             FROM information_schema.tables
             WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
               AND table_type IN ('BASE TABLE', 'VIEW');
-        `)).rows.map((row) => row.full_name);
+        `)).rows;
 	});
 }
 /**
@@ -1291,36 +1599,9 @@ async function getTableExcludes(databaseUrl, collectionsPath, deps = {}) {
 	} catch (err) {
 		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`, err);
 	}
-	for (const table of existingTables) if (!includes.includes(table)) excludes.push(table);
+	for (const { schema, table } of existingTables) if (!includes.includes(`${schema}.${table}`)) excludes.push(atlasExcludePattern(schema, table));
 	return excludes;
 }
-/**
-* Ask a yes/no question on an interactive terminal.
-*
-* The `isTTY` guard is the contract, not an optimisation: non-interactive
-* shells (CI, pipes, agents) can never answer, and `readline` on a
-* non-TTY stdin resolves with whatever the pipe happens to contain — or never
-* resolves at all. Returning false there is what makes an unattended
-* `db push` abort instead of auto-confirming a destructive change. Callers
-* should already have gone through {@link decidePushSafety}, which decides
-* whether interactive confirmation is even possible; this is the backstop.
-*
-* Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
-* `import.meta` and cannot be imported by the jest runner.
-*/
-async function promptConfirm(question) {
-	if (!process.stdin.isTTY) return false;
-	const rl = import___vite_browser_external.default.createInterface({
-		input: process.stdin,
-		output: process.stdout
-	});
-	try {
-		const answer = await new Promise((resolve) => rl.question(question, resolve));
-		return /^y(es)?$/i.test(answer.trim());
-	} finally {
-		rl.close();
-	}
-}
 //#endregion
 //#region src/cli-errors.ts
 /**
@@ -1430,12 +1711,49 @@ function driverReasonLine(err) {
 	return reason ? `  The driver said: ${reason}\n\n` : "";
 }
 /**
+* What named the database a db command connects to, as the CLI resolved it
+* and says in `REBASE_DATABASE_SOURCE`: `flag` (`--database-url`),
+* `environment` (the shell's DATABASE_URL), `env-file` (`.env`), `branch` (a
+* `db branch switch`), `docker` / `last-dev` (the compose `db` service) or
+* `managed` (the managed development database). `undefined` when nothing
+* says — a boot, or the driver run by hand.
+*/
+function databaseSource() {
+	const source = process.env.REBASE_DATABASE_SOURCE?.trim();
+	return source ? source : void 0;
+}
+/** Where the connection string is, in the words a reader looks for it by. */
+function connectionStringPlace(source) {
+	switch (source) {
+		case "flag": return "the URL passed with --database-url";
+		case "environment": return "DATABASE_URL in this shell's environment";
+		default: return "DATABASE_URL";
+	}
+}
+/** The fixes for a database that does not answer, for what named it. */
+function connectionRefusedFixes(source) {
+	switch (source) {
+		case "flag": return ["Check the URL passed with --database-url, and that its server is running"];
+		case "environment": return ["Check DATABASE_URL in this shell's environment, and that its server is running"];
+		case "env-file": return ["Verify DATABASE_URL in your .env file, and that its server is running"];
+		case "branch": return ["The branch's database is on the server DATABASE_URL in .env names: start that server", "Or leave the branch: rebase db branch switch --off"];
+		case "docker":
+		case "last-dev": return ["docker compose up -d db          (the project's Postgres in Docker)"];
+		case "managed": return ["Restart the managed development database: rebase db stop, then run the command again"];
+		default: return [
+			"docker compose up -d db          (the service a Rebase scaffold ships)",
+			"brew services start postgresql@18",
+			"Verify DATABASE_URL in your .env file"
+		];
+	}
+}
+/**
 * Format a diagnostic banner for ECONNREFUSED errors.
 */
 function formatConnectionRefusedBanner(databaseUrl, err) {
 	return `
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-  ❌  Cannot connect to PostgreSQL at ${parseHostInfo(databaseUrl)}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + "  The database server is not running or is not accepting\n  connections. Common fixes:\n\n    • docker compose up -d db          (the service a Rebase scaffold ships)\n    • brew services start postgresql@18\n    • Verify DATABASE_URL in your .env file\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
+  ❌  Cannot connect to PostgreSQL at ${parseHostInfo(databaseUrl)}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + "  The database server is not running or is not accepting\n  connections. Common fixes:\n\n" + connectionRefusedFixes(databaseSource()).map((fix) => `    • ${fix}\n`).join("") + "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
 }
 /**
 * Format a diagnostic banner for authentication failures.
@@ -1450,9 +1768,7 @@ function formatAuthFailureBanner(databaseUrl, err) {
 ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
   ❌  Authentication failed for user "${username}" at ${hostInfo}\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n` + driverReasonLine(err) + `  PostgreSQL rejected the credentials. Common fixes:
 
-    • Check the username and password in DATABASE_URL
-    • Verify the user exists:  psql -c "\\du"
-    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+    • Check the username and password in ${connectionStringPlace(databaseSource())}\n    • Verify the user exists:  psql -c "\\du"\n    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
 }
 /**
 * Format a diagnostic banner for "SSL is not enabled on the server".
@@ -1545,50 +1861,107 @@ function diagnoseDbError(err, databaseUrl) {
 *   it resolved to and the cwd it resolved against, and then throws so the entry
 *   point owns the exit code. Repeating its one-line summary underneath would
 *   undo the "printed once" this whole path exists for.
+*
+* Whatever is printed has its connection-string passwords replaced (see
+* `redactConnectionPasswords`): a driver or tool error can quote the URL it was
+* given, and this line lands in terminals and CI logs.
 */
 function reportCommandFailure(error) {
-	const message = error instanceof Error ? error.message : String(error ?? "");
+	const message = redactConnectionPasswords(error instanceof Error ? error.message : String(error ?? ""));
 	if (error?.alreadyReported) return;
 	if (!message || /Command failed|exited with code/i.test(message)) return;
 	outError("");
 	outError(chalk.red(`  ✗ ${message}`));
-	const cause = extractCauseMessage(error);
+	const rawCause = extractCauseMessage(error);
+	const cause = rawCause ? redactConnectionPasswords(rawCause) : rawCause;
 	if (cause && !message.includes(cause)) outError(chalk.gray(`    ${cause}`));
 	outError("");
 }
+/** The table Atlas keeps its migration history in, in the `rebase` schema. */
+var ATLAS_REVISIONS_TABLE = "atlas_schema_revisions";
 /**
 * `migrate apply` refusing because the database already has the schema.
 *
-* `42710` (duplicate_object) and `42P07` (duplicate_table) are what a migration
-* hits when boot-ensure — or a `db push` — has already provisioned the objects
-* it was going to create. Since boot-ensure provisions *every* production
+* `42710` (duplicate_object), `42P07` (duplicate_table), `42701`
+* (duplicate_column) and `42P06` (duplicate_schema) are what a migration hits
+* when boot-ensure — or a `db push` — has already provisioned the objects it
+* was going to create. Since boot-ensure provisions *every* production
 * database, this is the normal case rather than the exotic one, and the raw
 * failure (`pq: type "posts_status" already exists (42710)`, then `sql/migrate:
 * write revision: … current transaction is aborted`) names no way forward.
+*
+* `42701` is the everyday one in development: `rebase dev` adds a new
+* column at boot, `db generate` writes the migration that adds it, and
+* `db migrate` then finds it there. A column is named `table.column`.
 */
 function parseAlreadyProvisioned(text) {
-	const withCode = /(?:type|relation|constraint|schema) "([^"]+)" already exists \((42710|42P07)\)/.exec(text);
+	const column = /column "([^"]+)" of relation "([^"]+)" already exists/.exec(text);
+	if (column && /42701/.test(text)) return {
+		object: `${column[2]}.${column[1]}`,
+		code: "42701"
+	};
+	const withCode = /(?:type|relation|constraint|schema) "([^"]+)" already exists \((42710|42P07|42P06)\)/.exec(text);
+	const bare = /(?:type|relation|constraint|schema) "([^"]+)" already exists/.exec(text);
+	if ((withCode ?? bare)?.[1] === ATLAS_REVISIONS_TABLE) return null;
 	if (withCode) return {
 		object: withCode[1],
 		code: withCode[2]
 	};
-	const bare = /(?:type|relation|constraint|schema) "([^"]+)" already exists/.exec(text);
-	if (bare && /42710|42P07/.test(text)) return {
+	const code = /42P07|42P06|42710/.exec(text)?.[0];
+	if (bare && code) return {
 		object: bare[1],
-		code: /42P07/.test(text) ? "42P07" : "42710"
+		code
 	};
 	return null;
 }
 /**
+* The migration Atlas was running when it failed: `from version "<v>"` in
+* `sql/migrate: executing statement "…" from version "20261013201353": …`.
+*/
+function parseFailedMigrationVersion(text) {
+	return /from version "([^"]+)"/.exec(text)?.[1] ?? null;
+}
+/**
 * What to do about it: tell Atlas the database is already at a version.
 *
 * Atlas's own mechanism (`migrate apply --baseline <version>`), not a ledger of
 * ours — it writes the revision row Atlas reads, so every later `rebase db
 * migrate` is an ordinary one.
 */
-function formatBaselineRemedy(version, object) {
+function formatBaselineRemedy(version, object, failedVersion) {
 	const versionToken = version ?? "<version>";
-	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  This database already has the schema this migration creates\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + (object ? `  ${chalk.gray(`"${object}" is already there, so the migration cannot create it.`)}\n\n` : "") + `  Nothing is wrong with the migration — the database was provisioned\n  another way. Every Rebase boot ensures the schema, and ${chalk.bold("rebase db push")}\n  applies it directly, so a database that has ever run either one is\n  ahead of a migration history that was never recorded.\n\n  Record where it already is, then migrate normally:\n\n    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\n    ${chalk.bold.green("rebase db migrate")}\n\n  The baseline is the version already applied — the numeric prefix of\n  the migration file describing what is in the database now. Migrations\n  after it run; it and everything before it are marked done.\n\n  On a database nothing has ever booted against, none of this is needed.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+	const onlyTheFailedOne = failedVersion && failedVersion !== version ? `  To mark only the migration that failed, and run the ones after it:
+
+    ${chalk.bold.green(`rebase db migrate --baseline ${failedVersion}`)}\n\n` : "";
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  This database already has the schema this migration creates\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + (object ? `  ${chalk.gray(`"${object}" is already there, so the migration cannot create it.`)}\n\n` : "") + `  Nothing is wrong with the migration — the database was provisioned\n  another way. Every Rebase boot ensures the schema, and ${chalk.bold("rebase db push")}\n  applies it directly, so a database that has ever run either one is\n  ahead of the migrations recorded on it.\n\n  Record where it already is, then migrate normally:\n\n    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\n    ${chalk.bold.green("rebase db migrate")}\n\n  The baseline is the version already applied — the numeric prefix of\n  the migration file describing what is in the database now. Migrations\n  after it run; it and everything before it are marked done.\n\n` + onlyTheFailedOne + "  On a database nothing has ever booted against, none of this is needed.\n\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
+}
+/**
+* Atlas's whole report when a connection was closed before it answered:
+* `Error: EOF`, sometimes with the step in front (`Error: postgres: querying
+* system variables: EOF`). The line names neither the database nor the
+* connection, so on its own it reads like a crash.
+*/
+function parseConnectionEof(text) {
+	return /^Error: (?:.*: )?EOF\s*$/m.test(text);
+}
+/**
+* What a closed connection means, and that running the command again is safe.
+*
+* On the managed development database it is almost always the connection
+* limit. PGlite is one session behind a socket server that accepts only a few
+* connections; a running `rebase dev` holds some, `atlas schema apply` opens
+* two, and the one over the limit is closed unanswered. Measured: with the
+* daemon's limit of four and three held, `db push --dry-run` failed with a
+* bare `Error: EOF`; with two held it passed. The dev server's pool lets an
+* idle connection go after 30 seconds (`idleTimeoutMillis` in connection.ts),
+* which is why a later attempt usually works.
+*/
+function formatConnectionEofBanner(managed) {
+	const why = managed ? `  The managed development database accepts only a few connections at a\n  time, and a running ${chalk.bold("rebase dev")} holds some of them. Atlas opened one more,\n  and it was closed before the database answered.\n` : "  The server, or a proxy or pooler in front of it, closed the connection:\n  a restart, a connection limit, or a reaper for idle connections.\n";
+	const next = managed ? `  Run the command again in a moment: it is safe to repeat, and the dev
+  server lets an idle connection go after 30 seconds. If it keeps failing,
+  stop ${chalk.bold("rebase dev")} while you run it.\n` : `  Run the command again: it is safe to repeat. If it keeps failing, check\n  the server's connection limit and that it is up: ${chalk.bold("rebase doctor")}.\n`;
+	return "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n  ❌  Atlas lost its connection to the database (EOF)\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n" + why + `\n` + next + "\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n";
 }
 /** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */
 function parseNotNullViolation(text) {
@@ -1895,9 +2268,10 @@ function formatForeignGeneratedColumnBanner(conflicts) {
 */
 async function diagnoseAtlasFailure(context) {
 	const { domain, args, stderr, databaseUrl } = context;
+	if (parseConnectionEof(stderr)) return formatConnectionEofBanner(context.managedDatabase === true);
 	if (domain === "migrate" && args.includes("apply")) {
 		const provisioned = parseAlreadyProvisioned(stderr);
-		if (provisioned) return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object);
+		if (provisioned) return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object, parseFailedMigrationVersion(stderr));
 	}
 	if (domain === "schema" && args.includes("apply")) {
 		const enumDrop = parseEnumLabelDrop(stderr);
@@ -1914,6 +2288,6 @@ async function diagnoseAtlasFailure(context) {
 	return null;
 }
 //#endregion
-export { queryColumnTypes as A, prepareGeneratedSqlDir as B, getForeignIndexExcludes as C, getVectorExcludes as D, getTriggerExcludes as E, resolveLocalBin as F, isSyncedPlan as G, detectDestructiveStatements as H, withAppClient as I, extractCauseMessage as K, DESIRED_STATE_URL as L, readSearchDdl as M, readTriggersDdl as N, loadCollectionsForCli as O, readVectorDdl as P, GENERATED_SQL_DIR as R, ensureDevDatabaseExists as S, getTableExcludes as T, extractPlanStatements as U, decidePushSafety as V, fromAlterTable as W, describeReinstallCommand as _, formatForeignGeneratedColumnBanner as a, dropDevDatabase as b, reportCommandFailure as c, applyTriggersDdl as d, applyVectorDdl as f, describeDevAddCommand as g, describeBuildScriptRemedy as h, diagnoseDbError as i, queryGeneratedColumnDependencies as j, promptConfirm as k, ExcludeIntrospectionError as l, closeAppClients as m, deepestErrorMessage as n, isEconnrefused as o, atlasDevDatabaseUrl as p, diagnoseAtlasFailure as r, parseHostInfo as s, checkDatabaseConnectivity as t, applySearchDdl as u, detectProjectPackageManager as v, getSearchExcludes as w, dropGeneratedColumns as x, diagnoseMissingBin as y, generatedSqlDir as z };
+export { redactConnectionPasswords as $, getVectorExcludes as A, workspaceMemberDir as B, dropGeneratedColumns as C, getTableExcludes as D, getSearchExcludes as E, readSearchDdl as F, decidePushSafety as G, GENERATED_SQL_DIR as H, readTriggersDdl as I, extractPlanStatements as J, destructiveOptInFlag as K, readVectorDdl as L, queryColumnTypes as M, queryGeneratedColumnDependencies as N, getTriggerExcludes as O, queryUndeclarableConstraints as P, forLibpq as Q, resolveLocalBin as R, dropDevDatabase as S, getForeignIndexExcludes as T, generatedSqlDir as U, DESIRED_STATE_URL as V, prepareGeneratedSqlDir as W, isSyncedPlan as X, fromAlterTable as Y, forAtlas as Z, describeBuildScriptRemedy as _, formatForeignGeneratedColumnBanner as a, detectProjectPackageManager as b, isSslNotEnabled as c, ExcludeIntrospectionError as d, splitPassword as et, applySearchDdl as f, closeAppClients as g, atlasDevDatabaseUrl as h, diagnoseDbError as i, loadCollectionsForCli as j, getUndeclaredConstraintExcludes as k, parseHostInfo as l, applyVectorDdl as m, deepestErrorMessage as n, isAuthFailure as o, applyTriggersDdl as p, detectDestructiveStatements as q, diagnoseAtlasFailure as r, isEconnrefused as s, checkDatabaseConnectivity as t, extractCauseMessage as tt, reportCommandFailure as u, describeDevAddCommand as v, ensureDevDatabaseExists as w, diagnoseMissingBin as x, describeReinstallCommand as y, withAppClient as z };
 
-//# sourceMappingURL=cli-errors-CaI4ntyD.js.map
+//# sourceMappingURL=cli-errors-mx4sSjB8.js.map