@rebasepro/server-postgres 0.24.1-canary.gcb918fc → 0.25.0-canary.ge06257e

package/dist/{cli-flags-JNI-pwSf.js → cli-flags-DUozBFyK.js}

@@ -1,7 +1,8 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
+import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
+import { n as require_arg } from "./cli-prompt-egtNKkZl.js";
+import { suggestNearMiss } from "@rebasepro/utils";
 //#region src/cli-flags.ts
 var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
 /**
@@ -75,7 +76,9 @@ var DRIVER_FLAG_SPECS = {
 		"-c": "--collections",
 		"--force": Boolean,
 		"-f": "--force",
-		"--schema": String
+		"--schema": String,
+		"--data-inference": Boolean,
+		"--no-data-inference": Boolean
 	},
 	"schema stale": {
 		"--collections": String,
@@ -131,11 +134,72 @@ function assertKnownFlags(domain, subcommand, args) {
 			...spec
 		}, { argv: args.slice(2) });
 	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		const unknown = unknownFlagIn(err);
+		if (unknown !== null && err instanceof Error) {
+			const suggestion = closestFlag(unknown, {
+				...RELAYED_FLAGS,
+				...spec
+			});
+			throw new Error(`${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : ""} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		}
 		throw err;
 	}
 }
+/** The flag `arg` refused as undeclared, or `null` for any other failure. */
+function unknownFlagIn(err) {
+	if (!(err instanceof Error) || !("code" in err) || err.code !== "ARG_UNKNOWN_OPTION") return null;
+	return /option: (\S+)$/.exec(err.message)?.[1] ?? null;
+}
+/** The declared long flag `typed` is one edit or one swap away from, if there is one. */
+function closestFlag(typed, spec) {
+	const name = typed.split("=")[0];
+	return closestWord(name, Object.keys(spec).filter((flag) => flag.startsWith("--")));
+}
+/**
+* The word in `known` that `typed` was probably meant to be: one edit away
+* (`--targt-db`), or two neighbouring letters swapped (`--clena`, `--froce`),
+* which `suggestNearMiss` counts as two edits and so never offers.
+*/
+function closestWord(typed, known) {
+	return suggestNearMiss(known, typed) ?? transposedFrom(known, typed);
+}
+function transposedFrom(known, typed) {
+	return known.find((candidate) => {
+		if (candidate.length !== typed.length || candidate === typed) return false;
+		const differ = [...candidate].flatMap((letter, index) => letter === typed[index] ? [] : [index]);
+		return differ.length === 2 && differ[1] === differ[0] + 1 && candidate[differ[0]] === typed[differ[1]] && candidate[differ[1]] === typed[differ[0]];
+	});
+}
+/**
+* Parse a command that owns its argument handling, refusing what it does not
+* declare.
+*
+* `db backup`, `db restore` and `db backups list` parsed permissively, so an
+* undeclared flag became a positional and was ignored: `db restore <dump>
+* --targt-db x --create-db --yes` dropped the misspelled target and restored
+* into the live database. A typo is refused here before anything runs, naming
+* the declared flag it is one edit from, or every flag the command takes when
+* none is that close.
+*
+* @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+* @param command the command as typed, for the message: `"db restore"`.
+*/
+function parseCommandFlags(spec, argv, command) {
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	try {
+		return (0, import_arg.default)(full, { argv });
+	} catch (err) {
+		const unknown = unknownFlagIn(err);
+		if (unknown === null) throw err;
+		const suggestion = closestFlag(unknown, full);
+		const flags = Object.keys(spec).filter((flag) => flag.startsWith("--"));
+		throw new Error(`\`rebase ${command}\` has no option ${unknown}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(", ")}.`) + ` Nothing was run. See \`rebase ${command} --help\`.`);
+	}
+}
 //#endregion
-export { parseDriverLine as i, assertKnownFlags as n, collectionsPathIn as r, RELAYED_FLAGS as t };
+export { parseCommandFlags as a, collectionsPathIn as i, assertKnownFlags as n, parseDriverLine as o, closestWord as r, RELAYED_FLAGS as t };
 
-//# sourceMappingURL=cli-flags-JNI-pwSf.js.map
+//# sourceMappingURL=cli-flags-DUozBFyK.js.map

package/dist/cli-flags-DUozBFyK.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-flags-DUozBFyK.js","names":[],"sources":["../src/cli-flags.ts"],"sourcesContent":["/**\n * The flags each driver command takes, in one place, and the check that\n * enforces them.\n *\n * Every parser in `cli.ts` runs `arg(..., { permissive: true })`, which does not\n * mean \"be lenient\" — it means **an undeclared flag becomes a positional**. So\n * `rebase db push --alow-destructive` did not fail: the typo landed in `_`, the\n * push ran with the destructive gate still closed, and the developer read the\n * refusal as Rebase ignoring the flag they had just typed. `rebase schema\n * generate --ouput src/schema.ts` was worse — it wrote the default path and\n * said nothing, so the next build compiled a file nobody had regenerated.\n *\n * The check has to live at the entry point rather than in those parsers, and\n * that is not a detail: `db push` and `db generate` re-enter `schemaCommand`\n * and `generatePostgresDdlCommand` with the *db* line, so a strict parser\n * inside either of them would reject `--allow-destructive` on a line where it\n * is correct. One validation, once, against the spec for the command the user\n * actually named; the inner parsers keep reading an already-validated line.\n *\n * Commands with their own argument handling — `db branch` (`unexpectedBranchArgs`),\n * `db backup`, `db restore`, `db backups` — are deliberately absent: they own\n * their spec, and a second list here would be one more thing to keep in step.\n * An absent entry is \"not checked here\", never \"takes nothing\".\n */\nimport arg from \"arg\";\nimport { suggestNearMiss } from \"@rebasepro/utils\";\n\n/**\n * Flags that reach this process on a line it did not compose.\n *\n * `rebase db …` hands the driver the user's whole line: the CLI *reads*\n * `--database-url` and `--docker` to resolve the database and then relays them\n * verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as\n * the thing to re-run with. Rejecting any of the three would make the driver\n * refuse commands the CLI documents.\n */\nexport const RELAYED_FLAGS = {\n    \"--database-url\": String,\n    \"--docker\": Boolean,\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} satisfies arg.Spec;\n\n/**\n * Parse a driver command's line — `[\"db\", \"<subcommand>\", …]` — with the\n * relayed flags declared alongside the command's own.\n *\n * Every driver parser is permissive, and an undeclared flag in a permissive\n * parse is a positional. The positionals are what `db migrate` hands\n * `atlas migrate apply`, what `db generate` names its migration after and\n * which backup `db restore` restores, so a relayed flag left undeclared was\n * read as one of those: `rebase db migrate --docker` died on Atlas's\n * `unknown flag: --docker` after it had already written the auth schema.\n */\nexport function parseDriverLine<S extends arg.Spec>(\n    spec: S,\n    args: string[]\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    return arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2), permissive: true });\n}\n\n/** Keyed by `\"<domain> <subcommand>\"`, the way the user types it. */\nexport const DRIVER_FLAG_SPECS: Record<string, arg.Spec> = {\n    \"db push\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--dry-run\": Boolean,\n        \"--allow-destructive\": Boolean,\n        \"--yes\": Boolean,\n        \"-y\": \"--yes\"\n    },\n    \"db generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\"\n    },\n    // Bare positionals still pass through to `atlas migrate apply`, which takes\n    // an optional amount; flags do not, apart from `--baseline`.\n    //\n    // `--baseline <version>` is the escape hatch for the normal case, not an\n    // exotic one: every Rebase boot ensures the schema, so a production\n    // database has the tables before its first migration ever runs, and\n    // `migrate apply` then dies on `type \"…\" already exists (42710)`. It maps\n    // onto Atlas's own `migrate apply --baseline`, which writes the revision\n    // row Atlas reads — no ledger of ours.\n    //\n    // `--refuse-destructive` is opt-in: it dry-runs the pending files and exits\n    // 1, applying nothing, when one drops or narrows data — the gate `db push`\n    // has always had, for the path that had none.\n    \"db migrate\": {\n        \"--baseline\": String,\n        \"--refuse-destructive\": Boolean\n    },\n    \"schema generate\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--watch\": Boolean,\n        \"-w\": \"--watch\"\n    },\n    \"schema introspect\": {\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--force\": Boolean,\n        \"-f\": \"--force\",\n        \"--schema\": String,\n        // Whether rows are sampled at all: without a terminal the prompt is\n        // skipped, and the skip line names `--data-inference`.\n        \"--data-inference\": Boolean,\n        \"--no-data-inference\": Boolean\n    },\n    \"schema stale\": {\n        \"--collections\": String,\n        \"-c\": \"--collections\",\n        \"--output\": String,\n        \"-o\": \"--output\",\n        \"--out\": \"--output\",\n        \"--fix\": Boolean\n    }\n};\n\n/**\n * One destination flag, two spellings, everywhere.\n *\n * `--out` is the primary on `rebase build`, an alias on `generate-sdk`, `db\n * backup` and `cloud env pull`, and was refused outright by the three `schema`\n * commands — so the spelling a user learned on one command was an\n * \"unknown or unexpected option\" on the next. Neither name can be retired (both\n * are shipped), so both are accepted, and {@link assertOutputAliasesPaired}\n * makes that the rule rather than a habit.\n */\nexport const OUTPUT_FLAG_ALIASES = [\"--out\", \"--output\"] as const;\n\n/**\n * Every spec that names one of the pair names both.\n *\n * Exported so the CLI's own specs can be held to it too: the drift this fixes\n * ran across two packages, and a check that only reads this file would let the\n * next `--out`-only command through.\n */\nexport function assertOutputAliasesPaired(specs: Record<string, arg.Spec>): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const present = OUTPUT_FLAG_ALIASES.filter(flag => flag in spec);\n        if (present.length === 0 || present.length === OUTPUT_FLAG_ALIASES.length) continue;\n        const missing = OUTPUT_FLAG_ALIASES.filter(flag => !(flag in spec));\n        problems.push(`\\`${command}\\` takes ${present.join(\", \")} but not ${missing.join(\", \")}`);\n    }\n    return problems;\n}\n\n/**\n * The `--collections` path the user typed, or `null` if they typed none.\n *\n * Read once, at the entry point, because every command that takes it re-enters\n * the generators with the same line and each of them resolved it again — which\n * is how \"Collections path not found\" came to be printed four times before the\n * real output, and how a path that does not exist got as far as *writing* an\n * empty schema.\n *\n * Permissive, and it has to be: {@link assertKnownFlags} has already judged the\n * line, and `db push` carries flags the `--collections` spec does not name.\n */\nexport function collectionsPathIn(args: string[]): string | null {\n    try {\n        const parsed = arg(\n            { \"--collections\": String, \"-c\": \"--collections\" },\n            { argv: args.slice(2), permissive: true }\n        );\n\n        return parsed[\"--collections\"] ?? null;\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The long flags a `--help` usage line documents.\n *\n * `\"rebase db push [--collections <dir>] [--dry-run] …\"` → `[\"--collections\",\n * \"--dry-run\"]`. Placeholders (`<dir>`) and the alternation inside a positional\n * (`<create|list|switch>`) are not flags and are not returned.\n */\nexport function flagsInUsage(usage: string): string[] {\n    return [...new Set(usage.match(/--[a-z][a-z0-9-]*/g) ?? [])];\n}\n\n/**\n * Every flag the help documents is accepted, and every flag accepted is documented.\n *\n * The drift this catches shipped: `rebase db push --help` has printed\n * `[--dry-run]` since the flag was written, `DRIVER_FLAG_SPECS[\"db push\"]` never\n * listed it, and {@link assertKnownFlags} — added later to stop typos being\n * swallowed — turned the documented flag into `unknown or unexpected option`.\n * The only way to see a push's SQL was to trip the destructive gate, which is\n * the exact problem `--dry-run` was written to solve. Worse in a project on an\n * older driver, whose permissive parser *applied* the schema on that line.\n *\n * Two hand-maintained lists in two packages cannot be kept in step by care, so\n * they are held to each other instead: `usages` is keyed the way\n * {@link DRIVER_FLAG_SPECS} is (`\"db push\"`), and comes from the CLI's own help\n * pages. A key in only one of the two is not this function's business — the\n * help covers commands that parse their own lines (`db branch`, `db backup`),\n * and an absent spec entry means \"not checked here\".\n *\n * Aliases (`\"-c\": \"--collections\"`, `\"--out\": \"--output\"`) need no line of their\n * own: they are spellings of a documented flag. Neither do {@link RELAYED_FLAGS},\n * which every driver command accepts because the CLI relays them.\n */\nexport function assertSpecMatchesUsage(\n    specs: Record<string, arg.Spec>,\n    usages: Record<string, string>\n): string[] {\n    const problems: string[] = [];\n    for (const [command, spec] of Object.entries(specs)) {\n        const usage = usages[command];\n        if (usage === undefined) continue;\n\n        const documented = flagsInUsage(usage);\n        const accepted = Object.entries(spec);\n        // An alias resolves to the flag it spells; only the target needs a line.\n        const canonical = new Set(\n            accepted\n                .map(([flag, kind]) => (typeof kind === \"string\" ? kind : flag))\n                .filter(flag => flag.startsWith(\"--\"))\n        );\n\n        for (const flag of documented) {\n            if (flag in spec || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` documents ${flag} in its usage line but the spec rejects it`);\n        }\n        for (const flag of canonical) {\n            if (documented.includes(flag) || flag in RELAYED_FLAGS) continue;\n            problems.push(`\\`${command}\\` accepts ${flag} but no usage line documents it`);\n        }\n    }\n    return problems;\n}\n\n/**\n * Reject a flag the named command does not take.\n *\n * `args` is the driver's whole line — `[\"db\", \"push\", …]` — so the flags are\n * read from `args.slice(2)`, past the two command words.\n *\n * Throws rather than exiting: `runPluginCommand`'s caller already turns a\n * thrown error into one red line and exit 1, and a thrown error is what the\n * tests can see.\n */\nexport function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void {\n    if (!subcommand) return;\n    const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];\n    if (!spec) return;\n\n    try {\n        arg({ ...RELAYED_FLAGS, ...spec }, { argv: args.slice(2) });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown !== null && err instanceof Error) {\n            const suggestion = closestFlag(unknown, { ...RELAYED_FLAGS, ...spec });\n            throw new Error(\n                `${err.message}${suggestion ? ` (did you mean ${suggestion}?)` : \"\"} — run ` +\n                `\\`rebase ${domain} --help\\` for the options \\`${domain} ${subcommand}\\` takes.`\n            );\n        }\n        throw err;\n    }\n}\n\n/** The flag `arg` refused as undeclared, or `null` for any other failure. */\nfunction unknownFlagIn(err: unknown): string | null {\n    if (!(err instanceof Error) || !(\"code\" in err) || err.code !== \"ARG_UNKNOWN_OPTION\") return null;\n    // arg's wording: `unknown or unexpected option: --targt-db`.\n    return /option: (\\S+)$/.exec(err.message)?.[1] ?? null;\n}\n\n/** The declared long flag `typed` is one edit or one swap away from, if there is one. */\nfunction closestFlag(typed: string, spec: arg.Spec): string | undefined {\n    const name = typed.split(\"=\")[0];\n    return closestWord(name, Object.keys(spec).filter(flag => flag.startsWith(\"--\")));\n}\n\n/**\n * The word in `known` that `typed` was probably meant to be: one edit away\n * (`--targt-db`), or two neighbouring letters swapped (`--clena`, `--froce`),\n * which `suggestNearMiss` counts as two edits and so never offers.\n */\nexport function closestWord(typed: string, known: readonly string[]): string | undefined {\n    return suggestNearMiss(known, typed) ?? transposedFrom(known, typed);\n}\n\nfunction transposedFrom(known: readonly string[], typed: string): string | undefined {\n    return known.find((candidate) => {\n        if (candidate.length !== typed.length || candidate === typed) return false;\n        const differ = [...candidate].flatMap((letter, index) => (letter === typed[index] ? [] : [index]));\n        return differ.length === 2 && differ[1] === differ[0] + 1\n            && candidate[differ[0]] === typed[differ[1]] && candidate[differ[1]] === typed[differ[0]];\n    });\n}\n\n/**\n * Parse a command that owns its argument handling, refusing what it does not\n * declare.\n *\n * `db backup`, `db restore` and `db backups list` parsed permissively, so an\n * undeclared flag became a positional and was ignored: `db restore <dump>\n * --targt-db x --create-db --yes` dropped the misspelled target and restored\n * into the live database. A typo is refused here before anything runs, naming\n * the declared flag it is one edit from, or every flag the command takes when\n * none is that close.\n *\n * @param argv the words after the command, e.g. `rawArgs.slice(2)`.\n * @param command the command as typed, for the message: `\"db restore\"`.\n */\nexport function parseCommandFlags<S extends arg.Spec>(\n    spec: S,\n    argv: string[],\n    command: string\n): arg.Result<typeof RELAYED_FLAGS & S> {\n    const full = { ...RELAYED_FLAGS, ...spec };\n    try {\n        return arg(full, { argv });\n    } catch (err) {\n        const unknown = unknownFlagIn(err);\n        if (unknown === null) throw err;\n        const suggestion = closestFlag(unknown, full);\n        const flags = Object.keys(spec).filter(flag => flag.startsWith(\"--\"));\n        throw new Error(\n            `\\`rebase ${command}\\` has no option ${unknown}` +\n            (suggestion ? ` — did you mean ${suggestion}?` : ` — it takes ${flags.join(\", \")}.`) +\n            ` Nothing was run. See \\`rebase ${command} --help\\`.`\n        );\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAoCA,IAAa,gBAAgB;CACzB,kBAAkB;CAClB,YAAY;CACZ,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;;;;;;;AAaA,SAAgB,gBACZ,MACA,MACoC;CACpC,QAAA,GAAA,WAAA,QAAA,CAAW;EAAE,GAAG;EAAe,GAAG;CAAK,GAAG;EAAE,MAAM,KAAK,MAAM,CAAC;EAAG,YAAY;CAAK,CAAC;AACvF;;AAGA,IAAa,oBAA8C;CACvD,WAAW;EACP,iBAAiB;EACjB,MAAM;EACN,aAAa;EACb,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV;CACA,eAAe;EACX,iBAAiB;EACjB,MAAM;CACV;CAcA,cAAc;EACV,cAAc;EACd,wBAAwB;CAC5B;CACA,mBAAmB;EACf,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,WAAW;EACX,MAAM;CACV;CACA,qBAAqB;EACjB,YAAY;EACZ,MAAM;EACN,SAAS;EACT,iBAAiB;EACjB,MAAM;EACN,WAAW;EACX,MAAM;EACN,YAAY;EAGZ,oBAAoB;EACpB,uBAAuB;CAC3B;CACA,gBAAgB;EACZ,iBAAiB;EACjB,MAAM;EACN,YAAY;EACZ,MAAM;EACN,SAAS;EACT,SAAS;CACb;AACJ;;;;;;;;;;;;;AA4CA,SAAgB,kBAAkB,MAA+B;CAC7D,IAAI;EAMA,QAAA,GAAA,WAAA,QAAA,CAJI;GAAE,iBAAiB;GAAQ,MAAM;EAAgB,GACjD;GAAE,MAAM,KAAK,MAAM,CAAC;GAAG,YAAY;EAAK,CAGrC,CAAA,CAAO,oBAAoB;CACtC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AA2EA,SAAgB,iBAAiB,QAAgB,YAAgC,MAAsB;CACnG,IAAI,CAAC,YAAY;CACjB,MAAM,OAAO,kBAAkB,GAAG,OAAO,GAAG;CAC5C,IAAI,CAAC,MAAM;CAEX,IAAI;EACA,CAAA,GAAA,WAAA,QAAA,CAAI;GAAE,GAAG;GAAe,GAAG;EAAK,GAAG,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;CAC9D,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,QAAQ,eAAe,OAAO;GAC1C,MAAM,aAAa,YAAY,SAAS;IAAE,GAAG;IAAe,GAAG;GAAK,CAAC;GACrE,MAAM,IAAI,MACN,GAAG,IAAI,UAAU,aAAa,kBAAkB,WAAW,MAAM,GAAG,kBACxD,OAAO,8BAA8B,OAAO,GAAG,WAAW,UAC1E;EACJ;EACA,MAAM;CACV;AACJ;;AAGA,SAAS,cAAc,KAA6B;CAChD,IAAI,EAAE,eAAe,UAAU,EAAE,UAAU,QAAQ,IAAI,SAAS,sBAAsB,OAAO;CAE7F,OAAO,iBAAiB,KAAK,IAAI,OAAO,CAAC,GAAG,MAAM;AACtD;;AAGA,SAAS,YAAY,OAAe,MAAoC;CACpE,MAAM,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC;CAC9B,OAAO,YAAY,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC,CAAC;AACpF;;;;;;AAOA,SAAgB,YAAY,OAAe,OAA8C;CACrF,OAAO,gBAAgB,OAAO,KAAK,KAAK,eAAe,OAAO,KAAK;AACvE;AAEA,SAAS,eAAe,OAA0B,OAAmC;CACjF,OAAO,MAAM,MAAM,cAAc;EAC7B,IAAI,UAAU,WAAW,MAAM,UAAU,cAAc,OAAO,OAAO;EACrE,MAAM,SAAS,CAAC,GAAG,SAAS,CAAC,CAAC,SAAS,QAAQ,UAAW,WAAW,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,CAAE;EACjG,OAAO,OAAO,WAAW,KAAK,OAAO,OAAO,OAAO,KAAK,KACjD,UAAU,OAAO,QAAQ,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ,MAAM,OAAO;CAC9F,CAAC;AACL;;;;;;;;;;;;;;;AAgBA,SAAgB,kBACZ,MACA,MACA,SACoC;CACpC,MAAM,OAAO;EAAE,GAAG;EAAe,GAAG;CAAK;CACzC,IAAI;EACA,QAAA,GAAA,WAAA,QAAA,CAAW,MAAM,EAAE,KAAK,CAAC;CAC7B,SAAS,KAAK;EACV,MAAM,UAAU,cAAc,GAAG;EACjC,IAAI,YAAY,MAAM,MAAM;EAC5B,MAAM,aAAa,YAAY,SAAS,IAAI;EAC5C,MAAM,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC;EACpE,MAAM,IAAI,MACN,YAAY,QAAQ,mBAAmB,aACtC,aAAa,mBAAmB,WAAW,KAAK,eAAe,MAAM,KAAK,IAAI,EAAE,MACjF,kCAAkC,QAAQ,WAC9C;CACJ;AACJ"}

package/dist/cli-flags.d.ts

@@ -127,3 +127,24 @@ export declare function assertSpecMatchesUsage(specs: Record<string, arg.Spec>,
  * tests can see.
  */
 export declare function assertKnownFlags(domain: string, subcommand: string | undefined, args: string[]): void;
+/**
+ * The word in `known` that `typed` was probably meant to be: one edit away
+ * (`--targt-db`), or two neighbouring letters swapped (`--clena`, `--froce`),
+ * which `suggestNearMiss` counts as two edits and so never offers.
+ */
+export declare function closestWord(typed: string, known: readonly string[]): string | undefined;
+/**
+ * Parse a command that owns its argument handling, refusing what it does not
+ * declare.
+ *
+ * `db backup`, `db restore` and `db backups list` parsed permissively, so an
+ * undeclared flag became a positional and was ignored: `db restore <dump>
+ * --targt-db x --create-db --yes` dropped the misspelled target and restored
+ * into the live database. A typo is refused here before anything runs, naming
+ * the declared flag it is one edit from, or every flag the command takes when
+ * none is that close.
+ *
+ * @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+ * @param command the command as typed, for the message: `"db restore"`.
+ */
+export declare function parseCommandFlags<S extends arg.Spec>(spec: S, argv: string[], command: string): arg.Result<typeof RELAYED_FLAGS & S>;

package/dist/cli-helpers.d.ts

@@ -1,5 +1,6 @@
 import type { GeneratedColumnDependency } from "./schema/generated-column-conflicts.js";
 import { type ExistingColumnType } from "./schema/destructive-sql.js";
+import { type ExistingConstraint } from "./schema/undeclarable-constraints.js";
 import type { CollectionConfig } from "@rebasepro/types";
 /**
  * Why is a dependency's binary missing — never installed, or installed with its
@@ -58,8 +59,23 @@ export declare function describeBuildScriptRemedy(packageName: string, manager?:
  * relink rather than decide the tree is already up to date.
  */
 export declare function describeReinstallCommand(manager?: ProjectPackageManager): string;
-/** `add <pkg>` as a dev dependency, in the reader's own package manager. */
-export declare function describeDevAddCommand(packageName: string, manager?: ProjectPackageManager): string;
+/**
+ * The workspace member a command runs in, relative to the workspace's root —
+ * `backend` in a scaffolded project — or null at that root and outside any
+ * workspace.
+ *
+ * The member is the nearest directory at or above `startDir` holding a
+ * `package.json`; the root is the nearest one above it holding a
+ * `pnpm-workspace.yaml`, or a `package.json` that declares `workspaces`.
+ */
+export declare function workspaceMemberDir(startDir?: string): string | null;
+/**
+ * `add <pkg>` as a dev dependency, in the reader's own package manager, typed
+ * from the project root: into `workspaceDir` when the command runs in a
+ * workspace member, where a bare `pnpm add -D` at the root refuses with
+ * `ERR_PNPM_ADDING_TO_ROOT`.
+ */
+export declare function describeDevAddCommand(packageName: string, manager?: ProjectPackageManager, workspaceDir?: string | null): string;
 /**
  * Why a dependency's binary is not on `PATH`.
  *
@@ -277,15 +293,21 @@ export declare function getTriggerExcludes(collectionsPath: string): Promise<str
  * catalogs. Separated from {@link getTableExcludes} so its failure mode can
  * be handled explicitly (fail closed) and so tests can inject a stub.
  */
+/** An index as the catalogue names it: its schema, its table and its own name. */
+export interface ExistingIndex {
+    schema: string;
+    table: string;
+    index: string;
+}
 /**
- * Every index Postgres holds on a table Rebase manages, as
- * `schema.table.index`.
+ * Every index Postgres holds on a table, by its parts — never joined with `.`,
+ * which a name may itself contain.
  *
  * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
  * *constraint* to Atlas, diffed from the constraint declaration, and naming its
  * index in an exclude would shield the constraint itself.
  */
-export declare function queryExistingIndexes(databaseUrl: string): Promise<string[]>;
+export declare function queryExistingIndexes(databaseUrl: string): Promise<ExistingIndex[]>;
 /**
  * Glob patterns keeping Atlas away from indexes that are not Rebase's.
  *
@@ -312,13 +334,35 @@ export declare function queryExistingIndexes(databaseUrl: string): Promise<strin
  *
  * Three-part `schema.table.index`, never two: a two-part pattern reads as a
  * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
- * reports no error — the trap already recorded for the search excludes.
+ * reports no error — the trap already recorded for the search excludes. And
+ * spelled by `atlasExcludePattern`: a raw `orders_idx[v1]` is a glob that
+ * matches `orders_idxv`, so that index was dropped with no prompt.
  */
 export declare function getForeignIndexExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingIndexes?: (databaseUrl: string) => Promise<ExistingIndex[]>;
     getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;
 }): Promise<string[]>;
-export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/** Every CHECK and EXCLUDE constraint the database holds. @see UNDECLARABLE_CONSTRAINTS_SQL */
+export declare function queryUndeclarableConstraints(databaseUrl: string): Promise<ExistingConstraint[]>;
+/**
+ * Patterns keeping Atlas away from the CHECK and EXCLUDE constraints the
+ * collections do not declare — which, since a collection cannot declare
+ * either, is all of them. See `schema/undeclarable-constraints.ts`.
+ *
+ * Fails CLOSED, like {@link getTableExcludes}: without the catalogue nothing
+ * says which constraints are there, and a partial list lets the push drop a
+ * rule the database enforces. `desiredSql` is the `schema.sql` Atlas is about
+ * to diff against; a constraint it declares is Atlas's to manage.
+ */
+export declare function getUndeclaredConstraintExcludes(databaseUrl: string, desiredSql: string, deps?: {
+    queryConstraints?: (databaseUrl: string) => Promise<ExistingConstraint[]>;
+}): Promise<string[]>;
+/** A table or view as the catalogue names it. */
+export interface ExistingTable {
+    schema: string;
+    table: string;
+}
+export declare function queryExistingTables(databaseUrl: string): Promise<ExistingTable[]>;
 /**
  * Raised when the exclude list could not be built. `db push` MUST abort on
  * this rather than continue: the exclude list is the only thing shielding
@@ -343,22 +387,7 @@ export declare class ExcludeIntrospectionError extends Error {
  * `deps` is injectable for tests; production uses the real pg-backed queries.
  */
 export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
-    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    queryExistingTables?: (databaseUrl: string) => Promise<ExistingTable[]>;
     getIncludes?: (collectionsPath: string) => Promise<string[]>;
 }): Promise<string[]>;
-/**
- * Ask a yes/no question on an interactive terminal.
- *
- * The `isTTY` guard is the contract, not an optimisation: non-interactive
- * shells (CI, pipes, agents) can never answer, and `readline` on a
- * non-TTY stdin resolves with whatever the pipe happens to contain — or never
- * resolves at all. Returning false there is what makes an unattended
- * `db push` abort instead of auto-confirming a destructive change. Callers
- * should already have gone through {@link decidePushSafety}, which decides
- * whether interactive confirmation is even possible; this is the backstop.
- *
- * Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
- * `import.meta` and cannot be imported by the jest runner.
- */
-export declare function promptConfirm(question: string): Promise<boolean>;
 export {};

package/dist/{arg-Dni7MzLB.js → cli-prompt-egtNKkZl.js}

@@ -1,6 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { n as __commonJSMin } from "./__vite-browser-external-BnuHet1e.js";
+import { t as __commonJSMin } from "./rolldown-runtime-V7rFbMRe.js";
+import readline from "readline";
 //#region ../../node_modules/.pnpm/arg@5.0.2/node_modules/arg/index.js
 var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	var flagSymbol = Symbol("arg flag");
@@ -82,6 +83,51 @@ var require_arg = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = arg;
 }));
 //#endregion
-export { require_arg as t };
+//#region src/cli-prompt.ts
+/**
+* The one yes/no question the driver CLI asks: before a destructive `db push`,
+* before a `db restore` without `--yes`, before `db branch prune` removes
+* anything, and before `schema introspect` samples rows.
+*/
+/**
+* Ask a yes/no question on an interactive terminal; `true` only for "y" or
+* "yes".
+*
+* The `isTTY` guard is the contract, not an optimisation: non-interactive
+* shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY
+* stdin resolves with whatever the pipe happens to contain, or never resolves
+* at all. Returning false there is what makes an unattended `db push` abort
+* instead of auto-confirming a destructive change. Callers decide first
+* whether interactive confirmation is possible (`decidePushSafety` for a
+* push); this is the backstop.
+*
+* Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,
+* not as a signal, and with nothing listening it only pauses the input: the
+* question never resolves, and the open database connections behind it keep
+* the process alive, so the command hung instead of stopping. Answering no
+* sends it down the path that says "Aborted" and cleans up.
+*/
+async function promptConfirm(question) {
+	if (!process.stdin.isTTY) return false;
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		const answer = await new Promise((resolve) => {
+			rl.once("SIGINT", () => {
+				process.stdout.write("\n");
+				resolve("");
+			});
+			rl.once("close", () => resolve(""));
+			rl.question(question, resolve);
+		});
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+export { require_arg as n, promptConfirm as t };
 
-//# sourceMappingURL=arg-Dni7MzLB.js.map
+//# sourceMappingURL=cli-prompt-egtNKkZl.js.map

package/dist/cli-prompt-egtNKkZl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-prompt-egtNKkZl.js","names":[],"sources":["../../../node_modules/.pnpm/arg@5.0.2/node_modules/arg/index.js","../src/cli-prompt.ts"],"sourcesContent":["const flagSymbol = Symbol('arg flag');\n\nclass ArgError extends Error {\n\tconstructor(msg, code) {\n\t\tsuper(msg);\n\t\tthis.name = 'ArgError';\n\t\tthis.code = code;\n\n\t\tObject.setPrototypeOf(this, ArgError.prototype);\n\t}\n}\n\nfunction arg(\n\topts,\n\t{\n\t\targv = process.argv.slice(2),\n\t\tpermissive = false,\n\t\tstopAtPositional = false\n\t} = {}\n) {\n\tif (!opts) {\n\t\tthrow new ArgError(\n\t\t\t'argument specification object is required',\n\t\t\t'ARG_CONFIG_NO_SPEC'\n\t\t);\n\t}\n\n\tconst result = { _: [] };\n\n\tconst aliases = {};\n\tconst handlers = {};\n\n\tfor (const key of Object.keys(opts)) {\n\t\tif (!key) {\n\t\t\tthrow new ArgError(\n\t\t\t\t'argument key cannot be an empty string',\n\t\t\t\t'ARG_CONFIG_EMPTY_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (key[0] !== '-') {\n\t\t\tthrow new ArgError(\n\t\t\t\t`argument key must start with '-' but found: '${key}'`,\n\t\t\t\t'ARG_CONFIG_NONOPT_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (key.length === 1) {\n\t\t\tthrow new ArgError(\n\t\t\t\t`argument key must have a name; singular '-' keys are not allowed: ${key}`,\n\t\t\t\t'ARG_CONFIG_NONAME_KEY'\n\t\t\t);\n\t\t}\n\n\t\tif (typeof opts[key] === 'string') {\n\t\t\taliases[key] = opts[key];\n\t\t\tcontinue;\n\t\t}\n\n\t\tlet type = opts[key];\n\t\tlet isFlag = false;\n\n\t\tif (\n\t\t\tArray.isArray(type) &&\n\t\t\ttype.length === 1 &&\n\t\t\ttypeof type[0] === 'function'\n\t\t) {\n\t\t\tconst [fn] = type;\n\t\t\ttype = (value, name, prev = []) => {\n\t\t\t\tprev.push(fn(value, name, prev[prev.length - 1]));\n\t\t\t\treturn prev;\n\t\t\t};\n\t\t\tisFlag = fn === Boolean || fn[flagSymbol] === true;\n\t\t} else if (typeof type === 'function') {\n\t\t\tisFlag = type === Boolean || type[flagSymbol] === true;\n\t\t} else {\n\t\t\tthrow new ArgError(\n\t\t\t\t`type missing or not a function or valid array type: ${key}`,\n\t\t\t\t'ARG_CONFIG_VAD_TYPE'\n\t\t\t);\n\t\t}\n\n\t\tif (key[1] !== '-' && key.length > 2) {\n\t\t\tthrow new ArgError(\n\t\t\t\t`short argument keys (with a single hyphen) must have only one character: ${key}`,\n\t\t\t\t'ARG_CONFIG_SHORTOPT_TOOLONG'\n\t\t\t);\n\t\t}\n\n\t\thandlers[key] = [type, isFlag];\n\t}\n\n\tfor (let i = 0, len = argv.length; i < len; i++) {\n\t\tconst wholeArg = argv[i];\n\n\t\tif (stopAtPositional && result._.length > 0) {\n\t\t\tresult._ = result._.concat(argv.slice(i));\n\t\t\tbreak;\n\t\t}\n\n\t\tif (wholeArg === '--') {\n\t\t\tresult._ = result._.concat(argv.slice(i + 1));\n\t\t\tbreak;\n\t\t}\n\n\t\tif (wholeArg.length > 1 && wholeArg[0] === '-') {\n\t\t\t/* eslint-disable operator-linebreak */\n\t\t\tconst separatedArguments =\n\t\t\t\twholeArg[1] === '-' || wholeArg.length === 2\n\t\t\t\t\t? [wholeArg]\n\t\t\t\t\t: wholeArg\n\t\t\t\t\t\t\t.slice(1)\n\t\t\t\t\t\t\t.split('')\n\t\t\t\t\t\t\t.map((a) => `-${a}`);\n\t\t\t/* eslint-enable operator-linebreak */\n\n\t\t\tfor (let j = 0; j < separatedArguments.length; j++) {\n\t\t\t\tconst arg = separatedArguments[j];\n\t\t\t\tconst [originalArgName, argStr] =\n\t\t\t\t\targ[1] === '-' ? arg.split(/=(.*)/, 2) : [arg, undefined];\n\n\t\t\t\tlet argName = originalArgName;\n\t\t\t\twhile (argName in aliases) {\n\t\t\t\t\targName = aliases[argName];\n\t\t\t\t}\n\n\t\t\t\tif (!(argName in handlers)) {\n\t\t\t\t\tif (permissive) {\n\t\t\t\t\t\tresult._.push(arg);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t} else {\n\t\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t\t`unknown or unexpected option: ${originalArgName}`,\n\t\t\t\t\t\t\t'ARG_UNKNOWN_OPTION'\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst [type, isFlag] = handlers[argName];\n\n\t\t\t\tif (!isFlag && j + 1 < separatedArguments.length) {\n\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t`option requires argument (but was followed by another short argument): ${originalArgName}`,\n\t\t\t\t\t\t'ARG_MISSING_REQUIRED_SHORTARG'\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tif (isFlag) {\n\t\t\t\t\tresult[argName] = type(true, argName, result[argName]);\n\t\t\t\t} else if (argStr === undefined) {\n\t\t\t\t\tif (\n\t\t\t\t\t\targv.length < i + 2 ||\n\t\t\t\t\t\t(argv[i + 1].length > 1 &&\n\t\t\t\t\t\t\targv[i + 1][0] === '-' &&\n\t\t\t\t\t\t\t!(\n\t\t\t\t\t\t\t\targv[i + 1].match(/^-?\\d*(\\.(?=\\d))?\\d*$/) &&\n\t\t\t\t\t\t\t\t(type === Number ||\n\t\t\t\t\t\t\t\t\t// eslint-disable-next-line no-undef\n\t\t\t\t\t\t\t\t\t(typeof BigInt !== 'undefined' && type === BigInt))\n\t\t\t\t\t\t\t))\n\t\t\t\t\t) {\n\t\t\t\t\t\tconst extended =\n\t\t\t\t\t\t\toriginalArgName === argName ? '' : ` (alias for ${argName})`;\n\t\t\t\t\t\tthrow new ArgError(\n\t\t\t\t\t\t\t`option requires argument: ${originalArgName}${extended}`,\n\t\t\t\t\t\t\t'ARG_MISSING_REQUIRED_LONGARG'\n\t\t\t\t\t\t);\n\t\t\t\t\t}\n\n\t\t\t\t\tresult[argName] = type(argv[i + 1], argName, result[argName]);\n\t\t\t\t\t++i;\n\t\t\t\t} else {\n\t\t\t\t\tresult[argName] = type(argStr, argName, result[argName]);\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tresult._.push(wholeArg);\n\t\t}\n\t}\n\n\treturn result;\n}\n\narg.flag = (fn) => {\n\tfn[flagSymbol] = true;\n\treturn fn;\n};\n\n// Utility types\narg.COUNT = arg.flag((v, name, existingCount) => (existingCount || 0) + 1);\n\n// Expose error class\narg.ArgError = ArgError;\n\nmodule.exports = arg;\n","/**\n * The one yes/no question the driver CLI asks: before a destructive `db push`,\n * before a `db restore` without `--yes`, before `db branch prune` removes\n * anything, and before `schema introspect` samples rows.\n */\nimport readline from \"readline\";\n\n/**\n * Ask a yes/no question on an interactive terminal; `true` only for \"y\" or\n * \"yes\".\n *\n * The `isTTY` guard is the contract, not an optimisation: non-interactive\n * shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY\n * stdin resolves with whatever the pipe happens to contain, or never resolves\n * at all. Returning false there is what makes an unattended `db push` abort\n * instead of auto-confirming a destructive change. Callers decide first\n * whether interactive confirmation is possible (`decidePushSafety` for a\n * push); this is the backstop.\n *\n * Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,\n * not as a signal, and with nothing listening it only pauses the input: the\n * question never resolves, and the open database connections behind it keep\n * the process alive, so the command hung instead of stopping. Answering no\n * sends it down the path that says \"Aborted\" and cleans up.\n */\nexport async function promptConfirm(question: string): Promise<boolean> {\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer = await new Promise<string>((resolve) => {\n            rl.once(\"SIGINT\", () => {\n                process.stdout.write(\"\\n\");\n                resolve(\"\");\n            });\n            rl.once(\"close\", () => resolve(\"\"));\n            rl.question(question, resolve);\n        });\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n"],"x_google_ignoreList":[0],"mappings":";;;;;;CAAA,IAAM,aAAa,OAAO,UAAU;CAEpC,IAAM,WAAN,MAAM,iBAAiB,MAAM;EAC5B,YAAY,KAAK,MAAM;GACtB,MAAM,GAAG;GACT,KAAK,OAAO;GACZ,KAAK,OAAO;GAEZ,OAAO,eAAe,MAAM,SAAS,SAAS;EAC/C;CACD;CAEA,SAAS,IACR,MACA,EACC,OAAO,QAAQ,KAAK,MAAM,CAAC,GAC3B,aAAa,OACb,mBAAmB,UAChB,CAAC,GACJ;EACD,IAAI,CAAC,MACJ,MAAM,IAAI,SACT,6CACA,oBACD;EAGD,MAAM,SAAS,EAAE,GAAG,CAAC,EAAE;EAEvB,MAAM,UAAU,CAAC;EACjB,MAAM,WAAW,CAAC;EAElB,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,GAAG;GACpC,IAAI,CAAC,KACJ,MAAM,IAAI,SACT,0CACA,sBACD;GAGD,IAAI,IAAI,OAAO,KACd,MAAM,IAAI,SACT,gDAAgD,IAAI,IACpD,uBACD;GAGD,IAAI,IAAI,WAAW,GAClB,MAAM,IAAI,SACT,qEAAqE,OACrE,uBACD;GAGD,IAAI,OAAO,KAAK,SAAS,UAAU;IAClC,QAAQ,OAAO,KAAK;IACpB;GACD;GAEA,IAAI,OAAO,KAAK;GAChB,IAAI,SAAS;GAEb,IACC,MAAM,QAAQ,IAAI,KAClB,KAAK,WAAW,KAChB,OAAO,KAAK,OAAO,YAClB;IACD,MAAM,CAAC,MAAM;IACb,QAAQ,OAAO,MAAM,OAAO,CAAC,MAAM;KAClC,KAAK,KAAK,GAAG,OAAO,MAAM,KAAK,KAAK,SAAS,EAAE,CAAC;KAChD,OAAO;IACR;IACA,SAAS,OAAO,WAAW,GAAG,gBAAgB;GAC/C,OAAO,IAAI,OAAO,SAAS,YAC1B,SAAS,SAAS,WAAW,KAAK,gBAAgB;QAElD,MAAM,IAAI,SACT,uDAAuD,OACvD,qBACD;GAGD,IAAI,IAAI,OAAO,OAAO,IAAI,SAAS,GAClC,MAAM,IAAI,SACT,4EAA4E,OAC5E,6BACD;GAGD,SAAS,OAAO,CAAC,MAAM,MAAM;EAC9B;EAEA,KAAK,IAAI,IAAI,GAAG,MAAM,KAAK,QAAQ,IAAI,KAAK,KAAK;GAChD,MAAM,WAAW,KAAK;GAEtB,IAAI,oBAAoB,OAAO,EAAE,SAAS,GAAG;IAC5C,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC;IACxC;GACD;GAEA,IAAI,aAAa,MAAM;IACtB,OAAO,IAAI,OAAO,EAAE,OAAO,KAAK,MAAM,IAAI,CAAC,CAAC;IAC5C;GACD;GAEA,IAAI,SAAS,SAAS,KAAK,SAAS,OAAO,KAAK;IAE/C,MAAM,qBACL,SAAS,OAAO,OAAO,SAAS,WAAW,IACxC,CAAC,QAAQ,IACT,SACC,MAAM,CAAC,CAAC,CACR,MAAM,EAAE,CAAC,CACT,KAAK,MAAM,IAAI,GAAG;IAGvB,KAAK,IAAI,IAAI,GAAG,IAAI,mBAAmB,QAAQ,KAAK;KACnD,MAAM,MAAM,mBAAmB;KAC/B,MAAM,CAAC,iBAAiB,UACvB,IAAI,OAAO,MAAM,IAAI,MAAM,SAAS,CAAC,IAAI,CAAC,KAAK,KAAA,CAAS;KAEzD,IAAI,UAAU;KACd,OAAO,WAAW,SACjB,UAAU,QAAQ;KAGnB,IAAI,EAAE,WAAW,WAChB,IAAI,YAAY;MACf,OAAO,EAAE,KAAK,GAAG;MACjB;KACD,OACC,MAAM,IAAI,SACT,iCAAiC,mBACjC,oBACD;KAIF,MAAM,CAAC,MAAM,UAAU,SAAS;KAEhC,IAAI,CAAC,UAAU,IAAI,IAAI,mBAAmB,QACzC,MAAM,IAAI,SACT,0EAA0E,mBAC1E,+BACD;KAGD,IAAI,QACH,OAAO,WAAW,KAAK,MAAM,SAAS,OAAO,QAAQ;UAC/C,IAAI,WAAW,KAAA,GAAW;MAChC,IACC,KAAK,SAAS,IAAI,KACjB,KAAK,IAAI,EAAE,CAAC,SAAS,KACrB,KAAK,IAAI,EAAE,CAAC,OAAO,OACnB,EACC,KAAK,IAAI,EAAE,CAAC,MAAM,uBAAuB,MACxC,SAAS,UAER,OAAO,WAAW,eAAe,SAAS,UAK9C,MAAM,IAAI,SACT,6BAA6B,kBAF7B,oBAAoB,UAAU,KAAK,eAAe,QAAQ,MAG1D,8BACD;MAGD,OAAO,WAAW,KAAK,KAAK,IAAI,IAAI,SAAS,OAAO,QAAQ;MAC5D,EAAE;KACH,OACC,OAAO,WAAW,KAAK,QAAQ,SAAS,OAAO,QAAQ;IAEzD;GACD,OACC,OAAO,EAAE,KAAK,QAAQ;EAExB;EAEA,OAAO;CACR;CAEA,IAAI,QAAQ,OAAO;EAClB,GAAG,cAAc;EACjB,OAAO;CACR;CAGA,IAAI,QAAQ,IAAI,MAAM,GAAG,MAAM,mBAAmB,iBAAiB,KAAK,CAAC;CAGzE,IAAI,WAAW;CAEf,OAAO,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;ACzKjB,eAAsB,cAAc,UAAoC;CACpE,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,SAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAS,MAAM,IAAI,SAAiB,YAAY;GAClD,GAAG,KAAK,gBAAgB;IACpB,QAAQ,OAAO,MAAM,IAAI;IACzB,QAAQ,EAAE;GACd,CAAC;GACD,GAAG,KAAK,eAAe,QAAQ,EAAE,CAAC;GAClC,GAAG,SAAS,UAAU,OAAO;EACjC,CAAC;EACD,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ"}

package/dist/cli-prompt.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Ask a yes/no question on an interactive terminal; `true` only for "y" or
+ * "yes".
+ *
+ * The `isTTY` guard is the contract, not an optimisation: non-interactive
+ * shells (CI, pipes, agents) can never answer, and `readline` on a non-TTY
+ * stdin resolves with whatever the pipe happens to contain, or never resolves
+ * at all. Returning false there is what makes an unattended `db push` abort
+ * instead of auto-confirming a destructive change. Callers decide first
+ * whether interactive confirmation is possible (`decidePushSafety` for a
+ * push); this is the backstop.
+ *
+ * Ctrl-C and Ctrl-D answer no. On a terminal readline reads Ctrl-C as a key,
+ * not as a signal, and with nothing listening it only pauses the input: the
+ * question never resolves, and the open database connections behind it keep
+ * the process alive, so the command hung instead of stopping. Answering no
+ * sends it down the path that says "Aborted" and cleans up.
+ */
+export declare function promptConfirm(question: string): Promise<boolean>;

package/dist/cli-scratch-database.d.ts

@@ -8,11 +8,17 @@
  * `db push`: a `--dry-run` that left one behind while saying nothing was
  * applied, and `db generate`, left one per target on the server.
  *
- * Two cases keep it. A command that fails leaves it as the state Atlas was
- * planning against, which is the one thing worth inspecting. And one this
- * process did not create — made by hand, the remedy for a role without
- * `CREATEDB` — is the user's, and dropping it would put them back at the same
- * refusal next time.
+ * It is dropped on every way out of the command: success, a destructive push
+ * the user declined or that had no terminal to ask, and a crash. A crash that
+ * kept it left it for good, because the next push finds it already there and
+ * takes it for one made by hand.
+ *
+ * Two cases keep it. An Atlas run that failed while planning against it leaves
+ * the state Atlas was planning, which is the one thing worth inspecting. And
+ * one this process did not create (made by hand, the remedy for a role without
+ * `CREATEDB`) is the user's, and dropping it would put them back at the same
+ * refusal next time. An Atlas run that failed before planning (see
+ * {@link atlasFailedBeforePlanning}) left nothing in it, and it is dropped.
  */
 export interface ScratchDatabaseOps {
     /** Create it if it is missing; `true` only when this call created it. */
@@ -22,13 +28,46 @@ export interface ScratchDatabaseOps {
 export declare class ScratchDatabase {
     private readonly ops;
     private created;
+    private keptAsEvidence;
     constructor(ops: ScratchDatabaseOps);
     /** Make sure it exists before an Atlas call that plans against it. */
     ensure(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
+    /** An Atlas run against it failed: keep it, whatever the command does next. */
+    keepAsEvidence(): void;
+    /**
+     * An Atlas run failed with `stderr`. Failing before it planned, it left
+     * nothing here to read, so the database is dropped now — before the
+     * command exits, which may not unwind through {@link around}. Otherwise
+     * it is kept as the evidence.
+     */
+    afterAtlasFailure(stderr: string): Promise<void>;
     /**
-     * Run a command, then drop the scratch database if the command created it.
-     * A command that throws skips the drop; one that exits the process never
-     * returns here, which is the same thing.
+     * Run a command, then drop the scratch database if the command created it,
+     * whether the command returned or threw. A throw after
+     * {@link keepAsEvidence} keeps it. A command that wants to stop with exit 1
+     * throws {@link CommandStopped} rather than calling `process.exit`, which
+     * would skip this.
      */
     around<T>(command: () => Promise<T>): Promise<T>;
+    /** Drop it now if this process created it. Safe to call twice. */
+    release(): Promise<void>;
+}
+/**
+ * Whether Atlas failed before it planned anything: on connecting, which it
+ * reports as `querying system variables: …` — SSL the server does not offer, a
+ * login refused, a socket that closed or never opened.
+ */
+export declare function atlasFailedBeforePlanning(stderr: string): boolean;
+/**
+ * A db command stopping with exit 1 after it has said why: a destructive push
+ * the user declined, or one with no terminal to ask on.
+ *
+ * Thrown instead of `process.exit(1)`, so it unwinds through
+ * {@link ScratchDatabase.around} and the scratch database is dropped on the way
+ * out. `alreadyReported` tells `reportCommandFailure` the explanation is on the
+ * terminal already; the entry point sets the exit code.
+ */
+export declare class CommandStopped extends Error {
+    readonly alreadyReported = true;
+    constructor(reason: string);
 }