@rebasepro/server-postgres 0.24.1-canary.gcb918fc → 0.25.0-canary.ge06257e

package/dist/cli.js

@@ -1,11 +1,12 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
-import { A as queryColumnTypes, B as prepareGeneratedSqlDir, C as getForeignIndexExcludes, D as getVectorExcludes, E as getTriggerExcludes, F as resolveLocalBin, G as isSyncedPlan, H as detectDestructiveStatements, I as withAppClient, L as DESIRED_STATE_URL, M as readSearchDdl, N as readTriggersDdl, O as loadCollectionsForCli, P as readVectorDdl, R as GENERATED_SQL_DIR, S as ensureDevDatabaseExists, T as getTableExcludes, U as extractPlanStatements, V as decidePushSafety, W as fromAlterTable, _ as describeReinstallCommand, a as formatForeignGeneratedColumnBanner, b as dropDevDatabase, c as reportCommandFailure, d as applyTriggersDdl, f as applyVectorDdl, g as describeDevAddCommand, h as describeBuildScriptRemedy, i as diagnoseDbError, j as queryGeneratedColumnDependencies, k as promptConfirm, l as ExcludeIntrospectionError, m as closeAppClients, p as atlasDevDatabaseUrl, r as diagnoseAtlasFailure, t as checkDatabaseConnectivity, u as applySearchDdl, v as detectProjectPackageManager, w as getSearchExcludes, x as dropGeneratedColumns, y as diagnoseMissingBin, z as generatedSqlDir } from "./cli-errors-CaI4ntyD.js";
-import { a as outWarn, i as outError, r as out, t as chalk } from "./source-DBDbBTL4.js";
-import { o as execa, r as dropLegacyAuthSchema, s as forLibpq, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-RQUljnJ1.js";
-import { t as require_arg } from "./arg-Dni7MzLB.js";
-import { i as parseDriverLine, n as assertKnownFlags, r as collectionsPathIn } from "./cli-flags-JNI-pwSf.js";
+import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
+import { $ as redactConnectionPasswords, A as getVectorExcludes, B as workspaceMemberDir, C as dropGeneratedColumns, D as getTableExcludes, E as getSearchExcludes, F as readSearchDdl, G as decidePushSafety, H as GENERATED_SQL_DIR, I as readTriggersDdl, J as extractPlanStatements, K as destructiveOptInFlag, L as readVectorDdl, M as queryColumnTypes, N as queryGeneratedColumnDependencies, O as getTriggerExcludes, P as queryUndeclarableConstraints, R as resolveLocalBin, S as dropDevDatabase, T as getForeignIndexExcludes, U as generatedSqlDir, V as DESIRED_STATE_URL, W as prepareGeneratedSqlDir, X as isSyncedPlan, Y as fromAlterTable, Z as forAtlas, _ as describeBuildScriptRemedy, a as formatForeignGeneratedColumnBanner, b as detectProjectPackageManager, c as isSslNotEnabled, d as ExcludeIntrospectionError, f as applySearchDdl, g as closeAppClients, h as atlasDevDatabaseUrl, i as diagnoseDbError, j as loadCollectionsForCli, k as getUndeclaredConstraintExcludes, m as applyVectorDdl, o as isAuthFailure, p as applyTriggersDdl, q as detectDestructiveStatements, r as diagnoseAtlasFailure, s as isEconnrefused, t as checkDatabaseConnectivity, u as reportCommandFailure, v as describeDevAddCommand, w as ensureDevDatabaseExists, x as diagnoseMissingBin, y as describeReinstallCommand, z as withAppClient } from "./cli-errors-mx4sSjB8.js";
+import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-DB6xJv3p.js";
+import { t as nextStepAfterDbGenerate } from "./generate-next-step-DCd7yiJ2.js";
+import { o as execa, r as dropLegacyAuthSchema, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-Bd-hJk08.js";
+import { n as require_arg, t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
+import { i as collectionsPathIn, n as assertKnownFlags, o as parseDriverLine, r as closestWord, t as RELAYED_FLAGS } from "./cli-flags-DUozBFyK.js";
 import { formatRelativeTime } from "@rebasepro/utils";
 import path from "path";
 import fs from "fs";
@@ -147,7 +148,7 @@ function partitionByOwnership(conflicts, excludePatterns) {
 	const managed = [];
 	const foreign = [];
 	for (const conflict of conflicts) {
-		const target = `${conflict.schema}.${conflict.table}.${conflict.column}`;
+		const target = atlasExcludePattern(conflict.schema, conflict.table, conflict.column);
 		(owned.has(target) ? managed : foreign).push(conflict);
 	}
 	return {
@@ -242,16 +243,17 @@ var DROP_INDEX_RE = new RegExp(`^DROP\\s+INDEX\\s+(?:CONCURRENTLY\\s+)?(?:IF\\s+
 */
 var MENTIONS_DROP = /\bDROP\b/i;
 /**
-* Split `schema.table.object` patterns. Anything not in three parts is
-* ignored rather than guessed at — the two-part form is the one Atlas itself
-* silently mis-reads, and repeating that mistake here would be worse than
-* doing nothing.
+* Split `schema.table.object` patterns back into the names they were built
+* from (`excludePatternParts`, the inverse of how every exclude is spelled).
+* Anything not in three parts is ignored rather than guessed at — the two-part
+* form is the one Atlas itself silently mis-reads, and repeating that mistake
+* here would be worse than doing nothing.
 */
 function parseExcludePatterns(patterns) {
 	const parsed = [];
 	for (const pattern of patterns) {
-		const parts = pattern.split(".");
-		if (parts.length !== 3) continue;
+		const parts = excludePatternParts(pattern);
+		if (parts === void 0 || parts.length !== 3) continue;
 		if (parts.some((p) => p.length === 0)) continue;
 		parsed.push({
 			schema: parts[0],
@@ -638,18 +640,36 @@ function acceptsExcludeFlag(domain, args) {
 function takesDevUrl(domain, args) {
 	return domain === "schema" && args.includes("apply") || domain === "migrate" && args.includes("diff");
 }
-/** Assemble the full argv, connection flags and all. */
+/**
+* Does this Atlas invocation read or write the revisions table
+* (`rebase.atlas_schema_revisions`)? `migrate apply`, `set` and `status` do;
+* they are the ones handed `--revisions-schema`.
+*/
+function readsRevisions(domain, args) {
+	return domain === "migrate" && (args.includes("apply") || args.includes("status") || args.includes("set"));
+}
+/**
+* Assemble the full argv, connection flags and all.
+*
+* On a single-session database `migrate apply` skips its advisory lock. The
+* lock is session-level, and a session every connection shares grants it to
+* all of them, so it excludes no one; what it does cost there is a connection.
+* The managed database accepts four and a running `rebase dev` holds two, so
+* `migrate apply`'s third — its own, the lock's, the revisions table's — was
+* closed unanswered and Atlas said only `Error: EOF`.
+*/
 function buildAtlasArgs(invocation) {
-	const { domain, args, url, devUrl, excludes = [] } = invocation;
+	const { domain, args, url, devUrl, excludes = [], singleSession = false } = invocation;
 	const argv = [domain, ...args];
 	if (domain === "schema") {
 		if (args.includes("apply")) argv.push("--url", url, "--dev-url", devUrl);
 		else if (args.includes("clean") || args.includes("inspect")) argv.push("--url", url);
 	} else if (domain === "migrate") {
 		if (args.includes("diff")) argv.push("--dev-url", devUrl);
-		else if (args.includes("apply") || args.includes("status")) {
+		else if (readsRevisions(domain, args)) {
 			argv.push("--url", url, "--revisions-schema", "rebase");
 			if (args.includes("apply") && !args.includes("--baseline")) argv.push("--allow-dirty");
+			if (args.includes("apply") && singleSession) argv.push("--skip-lock");
 		}
 	}
 	if (acceptsExcludeFlag(domain, args)) for (const exclude of excludes) argv.push("--exclude", exclude);
@@ -672,10 +692,111 @@ function migrateApplyArgs(positionals, baseline) {
 	];
 }
 //#endregion
+//#region src/schema/atlas-revisions.ts
+/**
+* Atlas's revisions table on the managed development database, made by Rebase.
+*
+* `rebase db migrate` passes `--revisions-schema rebase`, so Atlas keeps its
+* history in `rebase.atlas_schema_revisions`. Atlas finds that table by
+* qualified name, but creates it through a second connection whose startup
+* message sets `search_path=rebase`, with an unqualified `CREATE TABLE`. The
+* managed database is one PGlite session that every connection shares, so a
+* connection's own `search_path` is never applied: the table landed in
+* `public`, the read that followed failed on `relation
+* "rebase.atlas_schema_revisions" does not exist (42P01)`, and every later run
+* failed on `relation "atlas_schema_revisions" already exists (42P07)`, with or
+* without `--baseline`.
+*
+* So on that database the table is created here first, qualified, and Atlas
+* finds it where it looks. The definition is Atlas's own for the pinned
+* `@ariga/atlas`, read off a table Atlas created on PostgreSQL 18. Should a
+* later Atlas want a different one, it alters the table through the same
+* unqualified path and fails loudly there, and the managed `db migrate`
+* integration test fails with it.
+*
+* Not used on any other database: there the connection's `search_path` holds,
+* and Atlas creates and maintains its table itself.
+*/
+/** Atlas's revisions table, in the schema `--revisions-schema rebase` names. */
+var ATLAS_REVISIONS_TABLE_SQL = `CREATE SCHEMA IF NOT EXISTS "rebase";
+CREATE TABLE IF NOT EXISTS "rebase"."atlas_schema_revisions" (
+    "version" character varying NOT NULL,
+    "description" character varying NOT NULL,
+    "type" bigint NOT NULL DEFAULT 2,
+    "applied" bigint NOT NULL DEFAULT 0,
+    "total" bigint NOT NULL DEFAULT 0,
+    "executed_at" timestamp with time zone NOT NULL,
+    "execution_time" bigint NOT NULL,
+    "error" text NULL,
+    "error_stmt" text NULL,
+    "hash" character varying NOT NULL,
+    "partial_hashes" jsonb NULL,
+    "operator_version" character varying NOT NULL,
+    PRIMARY KEY ("version")
+);`;
+/** Create `rebase.atlas_schema_revisions` if it is not there yet. */
+async function ensureAtlasRevisionsTable(databaseUrl) {
+	await withAppClient(databaseUrl, (client) => client.query(ATLAS_REVISIONS_TABLE_SQL));
+}
+//#endregion
+//#region src/schema/atlas-apply-report.ts
+/**
+* Atlas's `schema apply --auto-approve` report, as `rebase db push` shows it.
+*
+* Atlas prints its plan ("Planning migration statements …"), a separator, and
+* then the run ("Applying approved migration …"), echoing every statement in
+* both. The push has planned already — the plan it gated on, which a
+* destructive change listed in full — so the first section is a repeat, and a
+* reader saw each statement twice in a row. The run's section is kept: it is
+* the progress, the `-- ok` per statement and the summary.
+*/
+var PLANNING_HEADER = /^Planning migration statements\b/;
+/** The separator Atlas ends a section with, at the start of a line. */
+var SECTION_SEPARATOR = /^-{3,}\s*$/;
+/**
+* A stream filter that drops the planning section of an apply report, its
+* separator and the blank line after it, and passes everything else through
+* unchanged. A report with no planning section (`Schema is synced…`, an
+* error) comes out as it went in.
+*/
+function createApplyReportFilter() {
+	let pending = "";
+	let state = "pass";
+	const keep = (line) => {
+		if (state === "pass" && PLANNING_HEADER.test(line)) {
+			state = "planning";
+			return false;
+		}
+		if (state === "planning") {
+			if (SECTION_SEPARATOR.test(line)) state = "after-separator";
+			return false;
+		}
+		if (state === "after-separator") {
+			state = "pass";
+			if (line.trim() === "") return false;
+		}
+		return true;
+	};
+	return {
+		push(chunk) {
+			pending += chunk;
+			const lines = pending.split("\n");
+			pending = lines.pop() ?? "";
+			return lines.filter(keep).map((line) => `${line}\n`).join("");
+		},
+		flush() {
+			const rest = pending;
+			pending = "";
+			return rest !== "" && keep(rest) ? rest : "";
+		}
+	};
+}
+//#endregion
 //#region src/cli-scratch-database.ts
 var ScratchDatabase = class {
 	ops;
 	created;
+	keptAsEvidence = false;
 	constructor(ops) {
 		this.ops = ops;
 	}
@@ -686,21 +807,166 @@ var ScratchDatabase = class {
 			devDatabaseUrl
 		};
 	}
+	/** An Atlas run against it failed: keep it, whatever the command does next. */
+	keepAsEvidence() {
+		this.keptAsEvidence = true;
+	}
 	/**
-	* Run a command, then drop the scratch database if the command created it.
-	* A command that throws skips the drop; one that exits the process never
-	* returns here, which is the same thing.
+	* An Atlas run failed with `stderr`. Failing before it planned, it left
+	* nothing here to read, so the database is dropped now — before the
+	* command exits, which may not unwind through {@link around}. Otherwise
+	* it is kept as the evidence.
+	*/
+	async afterAtlasFailure(stderr) {
+		if (atlasFailedBeforePlanning(stderr)) await this.release();
+		else this.keepAsEvidence();
+	}
+	/**
+	* Run a command, then drop the scratch database if the command created it,
+	* whether the command returned or threw. A throw after
+	* {@link keepAsEvidence} keeps it. A command that wants to stop with exit 1
+	* throws {@link CommandStopped} rather than calling `process.exit`, which
+	* would skip this.
 	*/
 	async around(command) {
-		const result = await command();
-		const created = this.created;
-		if (created) {
-			this.created = void 0;
-			await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+		let result;
+		try {
+			result = await command();
+		} catch (err) {
+			if (!this.keptAsEvidence) await this.release();
+			throw err;
 		}
+		await this.release();
 		return result;
 	}
+	/** Drop it now if this process created it. Safe to call twice. */
+	async release() {
+		const created = this.created;
+		if (!created) return;
+		this.created = void 0;
+		await this.ops.drop(created.databaseUrl, created.devDatabaseUrl);
+	}
 };
+/**
+* Whether Atlas failed before it planned anything: on connecting, which it
+* reports as `querying system variables: …` — SSL the server does not offer, a
+* login refused, a socket that closed or never opened.
+*/
+function atlasFailedBeforePlanning(stderr) {
+	return /querying system variables:/.test(stderr);
+}
+/**
+* A db command stopping with exit 1 after it has said why: a destructive push
+* the user declined, or one with no terminal to ask on.
+*
+* Thrown instead of `process.exit(1)`, so it unwinds through
+* {@link ScratchDatabase.around} and the scratch database is dropped on the way
+* out. `alreadyReported` tells `reportCommandFailure` the explanation is on the
+* terminal already; the entry point sets the exit code.
+*/
+var CommandStopped = class extends Error {
+	alreadyReported = true;
+	constructor(reason) {
+		super(reason);
+		this.name = "CommandStopped";
+	}
+};
+//#endregion
+//#region src/schema/migrate-baseline.ts
+/**
+* What `rebase db migrate --baseline <version>` does, given the history the
+* database already has.
+*
+* The flag promises to record `<version>` as applied and migrate from the next
+* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
+* database with no revision history: once one row exists it ignores the flag
+* without a word, applies the migration anyway, and the CLI had already printed
+* "Recording … as already applied". That is the normal second time: a project
+* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
+* the migration for it, and `db migrate` fails on `column … already exists
+* (42701)` however the baseline is spelled.
+*
+* So the history is read first. With none, Atlas's baseline does the work.
+* Behind `<version>`, `atlas migrate set` marks every migration up to it as
+* applied, which is what a baseline means. At or past it, there is nothing to
+* record, and the command says so instead of claiming it recorded something.
+*/
+/**
+* Atlas's version order for the versions Rebase writes: numeric timestamps,
+* compared as numbers so a shorter one is not read as later; anything else as
+* text.
+*/
+function compareMigrationVersions(a, b) {
+	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
+		const x = BigInt(a);
+		const y = BigInt(b);
+		return x === y ? 0 : x < y ? -1 : 1;
+	}
+	return a.localeCompare(b);
+}
+/**
+* The version Atlas records for a migration file: its numeric prefix
+* (`20260906101530_init.sql` → `20260906101530`), or the name without `.sql`.
+*/
+function migrationVersionOf(file) {
+	return /^(\d+)/.exec(file)?.[1] ?? file.replace(/\.sql$/, "");
+}
+/** How many versions a refused baseline names, newest last. */
+var VERSIONS_NAMED = 5;
+/**
+* Why `--baseline <version>` cannot run, or `null` when it names a migration
+* file in `drizzle/migrations`.
+*
+* Asked before anything else, the database included. A version no file has
+* was refused only by Atlas, after the command had said "Marking every
+* migration up to abc as applied…"; and one older than every file read
+* "Nothing to record" and migrated on, though it named nothing to baseline.
+*
+* @param files the migration files, sorted oldest first.
+* @returns the refusal, its first line the error and the rest the detail.
+*/
+function baselineVersionProblem(version, files) {
+	const versions = files.map(migrationVersionOf);
+	if (versions.length === 0) return `--baseline ${version}: There are no migrations in drizzle/migrations to baseline. Nothing was run.\nRun \`rebase db generate\` to write the first one.`;
+	if (versions.includes(version)) return null;
+	const named = versions.slice(-5).join(", ");
+	return `--baseline ${version} names no migration in drizzle/migrations. Nothing was run.\n${versions.length > VERSIONS_NAMED ? `The newest ${VERSIONS_NAMED} of the ${versions.length} versions there` : "The versions there"}: ${named}. A baseline is one of them: the newest migration the database already holds.`;
+}
+/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
+function planBaseline(version, latestRecorded) {
+	if (latestRecorded === null) return { kind: "atlas-baseline" };
+	if (compareMigrationVersions(version, latestRecorded) > 0) return {
+		kind: "set",
+		latest: latestRecorded
+	};
+	return {
+		kind: "already-recorded",
+		latest: latestRecorded
+	};
+}
+/** What the command says before it migrates, for each plan. */
+function describeBaselinePlan(version, plan) {
+	switch (plan.kind) {
+		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
+		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
+		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
+	}
+}
+/**
+* The newest version Atlas has recorded on this database, or `null` when it
+* has recorded none (no revisions table yet included).
+*
+* The table is `rebase.atlas_schema_revisions`: the CLI passes
+* `--revisions-schema rebase` to every `migrate apply`.
+*/
+async function latestRecordedMigration(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
+		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
+		if (versions.length === 0) return null;
+		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
+	});
+}
 //#endregion
 //#region src/cli-push.ts
 /**
@@ -788,7 +1054,7 @@ async function applyPoliciesFile(client, policiesSql, stamping) {
 //#endregion
 //#region src/branch-argv.ts
 /**
-* Argument shapes for `rebase db branch`, with no dependencies.
+* Argument shapes for `rebase db branch`, with no runtime dependencies.
 *
 * Its own module for the same reason `schema/atlas-argv.ts` is: `cli.ts` pulls
 * in chalk, execa and the driver runtime, so a unit test that imports it cannot
@@ -796,6 +1062,58 @@ async function applyPoliciesFile(client, policiesSql, stamping) {
 * of any of that.
 */
 /**
+* The flags each driver-side `db branch` action takes, besides the ones the CLI
+* relays on every line (`--database-url`, `--docker`, `--debug`).
+*
+* `switch` is absent: the CLI answers it before the driver is ever spawned.
+* An action not listed here is not checked, so the dispatch can say it does
+* not exist in its own words.
+*/
+var BRANCH_ACTION_FLAGS = {
+	create: {
+		"--from": String,
+		"--force": Boolean
+	},
+	list: {},
+	info: {},
+	delete: {
+		"--force": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	},
+	prune: {
+		"--older-than": String,
+		"--include-dev-diff": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	}
+};
+/**
+* Refuse a flag `action` does not take, naming the one it was probably meant
+* to be — the same sentence `db backup` and `db restore` say.
+*
+* Throws: the driver's entry turns a thrown error into one red line and exit 1,
+* and this runs before anything connects.
+*/
+function assertKnownBranchFlags(action, rest) {
+	const spec = BRANCH_ACTION_FLAGS[action];
+	if (!spec) return;
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	try {
+		(0, import_arg.default)(full, { argv: [...rest] });
+	} catch (error) {
+		if (!(error instanceof Error) || !("code" in error) || error.code !== "ARG_UNKNOWN_OPTION") throw error;
+		const typed = (/option: (\S+)$/.exec(error.message)?.[1] ?? error.message).split("=")[0];
+		const suggestion = closestWord(typed, Object.keys(full).filter((flag) => flag.startsWith("--")));
+		const own = Object.keys(spec).filter((flag) => flag.startsWith("--"));
+		const takes = own.length > 0 ? `it takes ${own.join(", ")}` : "it takes no options of its own";
+		throw new Error(`\`rebase db branch ${action}\` has no option ${typed}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — ${takes}.`) + " Nothing was run. See `rebase db branch --help`.");
+	}
+}
+/**
 * Words on a `db branch` command line that no argument accounts for.
 *
 * `rebase db branch create alpha beta` created a branch called `alpha` and
@@ -806,15 +1124,18 @@ async function applyPoliciesFile(client, policiesSql, stamping) {
 * the branch is not the one asked for — and branch names are the thing you
 * later type to switch, delete, or point a deploy at.
 *
-* Anything starting with `-` is left alone rather than validated. This runs on
-* every branch subcommand, including ones added later with flags this function
-* has never heard of, and rejecting an unrecognised flag here would break them
-* from a distance. The value after a flag that takes one is skipped for the
-* same reason: it is that flag's argument, not a stray word.
+* A flag the action does not take is refused outright, by throwing — see
+* {@link BRANCH_ACTION_FLAGS}. It was let through on the reasoning that a
+* subcommand added later might take flags this file had never heard of; what
+* that bought was every typo running without the flag it meant:
+* `prune --older-then 1d --yes` pruned by no age, `create x --froce` ran
+* without --force. A new action gets its line in the table. The value after a
+* flag that takes one is skipped: it is that flag's argument, not a stray word.
 *
 * @param words The command's own arguments: action, name, then the rest.
 */
 function unexpectedBranchArgs(words) {
+	if (words[0]) assertKnownBranchFlags(words[0], words.slice(1));
 	const extras = [];
 	let seenName = false;
 	for (let index = 1; index < words.length; index += 1) {
@@ -1061,7 +1382,7 @@ function generatesInProcess() {
 async function generateInProcess(what, label, run) {
 	let generators;
 	try {
-		generators = await import("./generate-files-CdEckX6c.js").then((n) => n.t);
+		generators = await import("./generate-files-D50Pxw1G.js").then((n) => n.t);
 	} catch (err) {
 		outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
 		process.exit(1);
@@ -1107,7 +1428,7 @@ async function runPluginCommand(args) {
 		else if (domain === "schema") await schemaCommand(subcommand, args);
 		else if (domain === "doctor") await doctorPluginCommand(args);
 		else if (domain === "console") {
-			const { consoleCommand } = await import("./cli-console-Ca6ZlAVU.js");
+			const { consoleCommand } = await import("./cli-console-C_ISGwJo.js");
 			process.exitCode = await consoleCommand(args);
 		} else {
 			outError(chalk.red(`Unknown domain command: ${domain}`));
@@ -1208,6 +1529,20 @@ async function columnTypesOrNone(databaseUrl) {
 	}
 }
 /**
+* The CHECK and EXCLUDE constraints `detectDestructiveStatements` reads a
+* `DROP CONSTRAINT` against, or none when the database cannot be asked. A
+* report then cannot tell a dropped CHECK from a dropped foreign key, and says
+* nothing about either, as before.
+*/
+async function constraintsOrNone(databaseUrl) {
+	if (!databaseUrl) return [];
+	try {
+		return await queryUndeclarableConstraints(databaseUrl);
+	} catch {
+		return [];
+	}
+}
+/**
 * Say what in the migration `db generate` just wrote destroys data.
 *
 * `db push` stops before a destructive change; `db generate` wrote the same
@@ -1217,7 +1552,7 @@ async function columnTypesOrNone(databaseUrl) {
 * A report, not a refusal — the exit code is unchanged.
 */
 async function reportDestructiveMigration(migrationSql, migrationFile, databaseUrl) {
-	const destructive = detectDestructiveStatements(migrationSql, await columnTypesOrNone(databaseUrl));
+	const destructive = detectDestructiveStatements(migrationSql, await columnTypesOrNone(databaseUrl), await constraintsOrNone(databaseUrl));
 	if (destructive.length === 0) return;
 	outWarn("");
 	outWarn(chalk.yellow(`  ⚠️  ${migrationFile} includes ${destructive.length} destructive change(s) that will DESTROY data when applied:`));
@@ -1269,7 +1604,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-DnpJi6I7.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-HCEkPcQj.js");
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1316,7 +1651,7 @@ async function dbCommand(subcommand, rawArgs) {
 				}
 				const searchContent = readSearchDdl();
 				if (searchContent) {
-					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
+					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
 					const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 					const preamble = migrationDropPreamble(migrationConflicts);
 					if (preamble) {
@@ -1365,7 +1700,7 @@ async function dbCommand(subcommand, rawArgs) {
     boot by the schema ensure. For a migration-only deployment, add
     ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
 		out("");
-		out(`  You can now run ${chalk.bold.green("rebase db migrate")} to apply the migrations to your database.`);
+		for (const line of nextStepAfterDbGenerate(latestMigrationVersion())) out(line);
 		out("");
 	} else {
 		out("");
@@ -1391,20 +1726,44 @@ async function dbCommand(subcommand, rawArgs) {
 				DESIRED_STATE_URL,
 				"--dry-run"
 			], collectionsPath, { captureStdout: true });
-			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : []);
+			const destructive = detectDestructiveStatements(plan, databaseUrl ? await queryColumnTypes(databaseUrl) : [], databaseUrl ? await queryUndeclarableConstraints(databaseUrl) : []);
 			const unreadable = destructive.some((d) => d.kind === "UNREADABLE PLAN");
 			const planStatements = extractPlanStatements(plan);
 			const planListing = unreadable ? plan.trim() : planStatements.map((statement) => `${statement};`).join("\n");
 			const { managed: rebuildable, foreign: unowned } = partitionByOwnership(databaseUrl ? findGeneratedColumnConflicts(parseColumnMutations(plan), await queryGeneratedColumnDependencies(databaseUrl)) : [], collectionsPath ? await getSearchExcludes(collectionsPath) : []);
 			if (databaseUrl) await reportKeptEnumLabels(databaseUrl, collectionsPath);
+			const policyPlan = databaseUrl ? await readPolicyPushPlan(databaseUrl, collectionsPath) : void 0;
+			const policyLines = policyPlan ?? {
+				changes: [],
+				notes: []
+			};
 			if (dryRun) {
 				out(chalk.gray("  Step 3/3: --dry-run — nothing was applied."));
 				out("");
-				if (planStatements.length > 0 || unreadable) {
+				const schemaChanges = planStatements.length > 0 || unreadable;
+				if (schemaChanges) {
 					out(chalk.bold("  Planned changes:"));
 					out(chalk.gray(planListing.split("\n").map((l) => `       ${l}`).join("\n")));
-				} else out(chalk.green("  ✓ No changes: the database already matches these collections."));
-				out("");
+					out("");
+				}
+				const [rlsHeading, ...rlsChanges] = policyLines.changes;
+				if (rlsHeading) {
+					out(chalk.bold(rlsHeading));
+					for (const line of rlsChanges) out(chalk.gray(line));
+					out("");
+				}
+				if (!schemaChanges && !rlsHeading) {
+					out(chalk.green(policyPlan ? "  ✓ No changes: the database already matches these collections." : "  ✓ No schema changes: the tables already match these collections."));
+					out("");
+				}
+				if (databaseUrl && !policyPlan) {
+					outWarn(chalk.yellow("  ⚠️  The row-level security the push would change could not be read, so none is listed."));
+					outWarn("");
+				}
+				if (policyLines.notes.length > 0) {
+					for (const line of policyLines.notes) out(chalk.gray(line));
+					out("");
+				}
 				if (prebuilt.length > 0) {
 					out(chalk.gray(`  ${prebuilt.length} foreign-key index(es) on existing tables would be built first,`));
 					out(chalk.gray("  CONCURRENTLY, so the apply would not build them under a write lock (the plan"));
@@ -1433,12 +1792,12 @@ async function dbCommand(subcommand, rawArgs) {
 			}
 			if (unowned.length > 0) {
 				outError(formatForeignGeneratedColumnBanner(unowned));
-				process.exit(1);
+				throw new CommandStopped("A generated column Rebase does not own blocks the push.");
 			}
-			const allowDestructive = argsList["--allow-destructive"] === true || argsList["--yes"] === true;
+			const optIn = destructiveOptInFlag(argsList);
 			const decision = decidePushSafety({
 				destructiveCount: destructive.length,
-				allowDestructive,
+				allowDestructive: optIn !== void 0,
 				interactive: process.stdin.isTTY === true
 			});
 			if (destructive.length > 0) {
@@ -1452,14 +1811,18 @@ async function dbCommand(subcommand, rawArgs) {
 				if (decision === "refuse") {
 					outError(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
 					outError(chalk.gray("    Re-run interactively, or pass --allow-destructive to proceed. Back up first: rebase db backup"));
-					process.exit(1);
+					throw new CommandStopped("Destructive changes need confirmation.");
 				}
 				if (decision === "confirm") {
 					if (!await promptConfirm(chalk.yellow("  Type 'yes' to apply these destructive changes (this cannot be undone): "))) {
 						out(chalk.gray("  Aborted. No changes were made."));
-						process.exit(1);
+						throw new CommandStopped("The destructive push was declined.");
 					}
-				} else outWarn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
+				} else outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
+			}
+			if (policyPlan?.summary) {
+				out(chalk.gray(policyPlan.summary));
+				out("");
 			}
 			await applyPushPlan({
 				dryRun: plan,
@@ -1476,7 +1839,10 @@ async function dbCommand(subcommand, rawArgs) {
 						"--to",
 						DESIRED_STATE_URL,
 						"--auto-approve"
-					], collectionsPath, { throwOnFailure: true });
+					], collectionsPath, {
+						throwOnFailure: true,
+						omitPlanEcho: true
+					});
 				},
 				reportSynced: () => out("Schema is synced, no changes to be made"),
 				rebuildAfterFailure: async () => {
@@ -1504,9 +1870,18 @@ async function dbCommand(subcommand, rawArgs) {
 		} else if (subcommand === "migrate") {
 			const databaseUrl = process.env.DATABASE_URL;
 			const baseline = argsList["--baseline"];
+			const baselineProblem = baseline ? baselineVersionProblem(baseline, listMigrationFiles()) : null;
+			if (baselineProblem) {
+				const [message, ...detail] = baselineProblem.split("\n");
+				outError(chalk.red(`  ✗ ${message}`));
+				for (const line of detail) outError(chalk.gray(`    ${line}`));
+				throw new CommandStopped("The baseline names no migration.");
+			}
+			const baselinePlan = baseline ? planBaseline(baseline, databaseUrl ? await latestRecordedMigration(databaseUrl) : null) : null;
+			const atlasBaseline = baselinePlan?.kind === "atlas-baseline" ? baseline : void 0;
 			if (argsList["--refuse-destructive"] === true) {
-				const plan = await runAtlas("migrate", [...migrateApplyArgs(argsList._, baseline), "--dry-run"], collectionsPath, { captureStdout: true });
-				const destructive = detectDestructiveStatements(plan, await columnTypesOrNone(databaseUrl));
+				const plan = await runAtlas("migrate", [...migrateApplyArgs(argsList._, atlasBaseline), "--dry-run"], collectionsPath, { captureStdout: true });
+				const destructive = detectDestructiveStatements(plan, await columnTypesOrNone(databaseUrl), await constraintsOrNone(databaseUrl));
 				if (destructive.length > 0) {
 					outError(chalk.red(`  ✗ Refusing to migrate: the pending migrations include ${destructive.length} destructive change(s):`));
 					outError("");
@@ -1520,11 +1895,17 @@ async function dbCommand(subcommand, rawArgs) {
 				out("");
 			}
 			if (databaseUrl) await ensureAuthSchemaAndFunctions(databaseUrl);
-			if (baseline) {
-				out(chalk.gray(`  Recording ${baseline} as already applied, then migrating from the next one.`));
+			if (baseline && baselinePlan) {
+				out(chalk.gray(`  ${describeBaselinePlan(baseline, baselinePlan)}`));
 				out("");
+				if (baselinePlan.kind === "set") await runAtlas("migrate", [
+					"set",
+					baseline,
+					"--dir",
+					"file://drizzle/migrations"
+				], collectionsPath);
 			}
-			await runAtlas("migrate", migrateApplyArgs(argsList._, baseline), collectionsPath);
+			await runAtlas("migrate", migrateApplyArgs(argsList._, atlasBaseline), collectionsPath);
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
@@ -1549,8 +1930,8 @@ async function dbCommand(subcommand, rawArgs) {
 async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 	let renames;
 	try {
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-BK6ilQq2.js");
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-D4bvMWAb.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1569,8 +1950,8 @@ async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 /** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
 async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 	try {
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-D8fI1MoX.js");
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-D9eTIWCz.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
@@ -1579,8 +1960,8 @@ async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	let missing;
 	try {
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-Db4AQF4i.js");
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-BDFcfRPo.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1590,7 +1971,7 @@ async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	if (missing.length === 0 || dryRun) return names;
 	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
 	try {
-		const { buildDeferredIndexes } = await import("./deferred-index-build-DP1_SNFo.js").then((n) => n.r);
+		const { buildDeferredIndexes } = await import("./deferred-index-build-Ca6OqKyR.js").then((n) => n.r);
 		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
 			dedicated: true,
 			query: async (text) => ({ rows: (await client.query(text)).rows }),
@@ -1609,6 +1990,10 @@ async function ensureAuthSchemaAndFunctions(databaseUrl) {
 			await client.query(RLS_BOOTSTRAP_SQL);
 		});
 	} catch (err) {
+		if (isEconnrefused(err) || isAuthFailure(err) || isSslNotEnabled(err)) {
+			outError(diagnoseDbError(err, databaseUrl) ?? `  ✗ ${err instanceof Error ? err.message : String(err)}`);
+			process.exit(1);
+		}
 		outWarn(chalk.yellow(`  ⚠️  Failed to bootstrap the RLS helper functions: ${err instanceof Error ? err.message : String(err)}`));
 	}
 }
@@ -1634,9 +2019,9 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 	let unsecured;
 	let userRole;
 	try {
-		const { lockCollectionTables } = await import("./ensure-collection-policies-CXpbeNag.js");
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-		userRole = (await import("./rls-enforcement-DvzqlaL1.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const { lockCollectionTables } = await import("./ensure-collection-policies-C1ux3V_z.js");
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c)).REBASE_USER_ROLE;
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
 	} catch (err) {
@@ -1671,8 +2056,8 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-CVm_yvzb.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-Dl_Eh9ow.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
@@ -1692,7 +2077,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-DvzqlaL1.js").then((n) => n.c);
+		rls = await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -1752,10 +2137,10 @@ async function applyPolicies(databaseUrl, collectionsPath) {
 */
 async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 	try {
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-B64O2oZF.js").then((n) => n.o);
-		const { policyStampSql } = await import("./ensure-collection-policies-CXpbeNag.js");
-		const { pinSearchPath } = await import("./connection-C9mT8bgf.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+		const { policyStampSql } = await import("./ensure-collection-policies-C1ux3V_z.js");
+		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
 		return {
 			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
 			searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public"
@@ -1765,6 +2150,28 @@ async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 	}
 }
 /**
+* `planPolicyPush` for this database and these collections, read under the
+* `search_path` the push stamps policies under, as the lines the dry run
+* prints and the one the push does; `undefined`, having said why, when it
+* cannot be read.
+*/
+async function readPolicyPushPlan(databaseUrl, collectionsPath) {
+	try {
+		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-DTXE6aVa.js");
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+		const plan = await withAppClient(databaseUrl, (client) => planPolicyPush({ query: async (text, values) => ({ rows: (await client.query(text, values)).rows }) }, collections, { searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public" }));
+		return {
+			...formatPolicyPushPlan(plan),
+			summary: summarizePolicyPushPlan(plan)
+		};
+	} catch (err) {
+		outWarn(chalk.yellow(`  ⚠️  Could not read the database's row-level security: ${err instanceof Error ? err.message : String(err)}`));
+		return;
+	}
+}
+/**
 * Remove the policies an earlier push superseded but never dropped.
 *
 * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
@@ -1779,8 +2186,8 @@ async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-Dm8i-s1J.js").then((n) => n.a);
-		const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-CY5P1ZRu.js").then((n) => n.s);
+		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
@@ -1790,7 +2197,8 @@ async function reconcilePolicies(databaseUrl, collectionsPath) {
 			if (kept.length > 0) {
 				outWarn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
 				for (const p of kept) outWarn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
-				outWarn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+				outWarn(chalk.yellow("       Each is still in force. To keep one, describe it in its collection's `securityRules`"));
+				outWarn(chalk.yellow("       (Studio's RLS view imports it); if it is stale, drop it by hand."));
 			}
 			const remaining = {
 				...drift,
@@ -1856,10 +2264,12 @@ async function branchCommand(rawArgs) {
 		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
 		process.exit(1);
 	}
-	const { DatabasePoolManager } = await import("./databasePoolManager-BIuewidb.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-Bsn2wfaj.js").then((n) => n.n);
+	const { DatabasePoolManager } = await import("./databasePoolManager-Yqdw14wY.js").then((n) => n.n);
+	const { BranchService } = await import("./BranchService-DNg4txyf.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
+	await checkDatabaseConnectivity(databaseUrl);
+	await closeAppClients();
 	const pool = new Pool({
 		connectionString: databaseUrl,
 		max: 3
@@ -1867,8 +2277,8 @@ async function branchCommand(rawArgs) {
 	const db = drizzle(pool);
 	const poolManager = new DatabasePoolManager(databaseUrl);
 	const branchService = new BranchService(db, poolManager);
-	await branchService.ensureBranchMetadataTable();
 	try {
+		if (branchAction === "create" || branchAction === "delete" || branchAction === "prune") await branchService.ensureBranchMetadataTable();
 		switch (branchAction) {
 			case "create": {
 				const name = rawArgs[3];
@@ -1898,7 +2308,7 @@ async function branchCommand(rawArgs) {
 				break;
 			}
 			case "list": {
-				const branches = await branchService.listBranches();
+				const branches = await branchService.hasBranchRegistry() ? await branchService.listBranches() : [];
 				out("");
 				if (branches.length === 0) out(chalk.gray("  No branches found. Create one with: rebase db branch create <name>"));
 				else {
@@ -1935,7 +2345,7 @@ async function branchCommand(rawArgs) {
 					out(chalk.gray("  Usage: rebase db branch info <name>"));
 					process.exit(1);
 				}
-				const info = await branchService.getBranchInfo(name);
+				const info = await branchService.hasBranchRegistry() ? await branchService.getBranchInfo(name) : void 0;
 				out("");
 				if (!info) {
 					outError(chalk.red(`  ✗ Branch "${name}" not found.`));
@@ -1990,6 +2400,12 @@ async function branchCommand(rawArgs) {
 				else if (plan.devDiff.length > 0) out(chalk.gray(`  (${plan.devDiff.length} Atlas scratch database(s) not listed — --include-dev-diff)`));
 				out("");
 				if (parsed["--yes"] !== true) {
+					if (!process.stdin.isTTY) {
+						outError(chalk.red("  ✗ Nothing was pruned: there is no terminal to confirm on."));
+						outError(chalk.gray("    Re-run with --yes to remove what is listed above."));
+						outError("");
+						process.exit(1);
+					}
 					if (!await promptConfirm("  Remove these? (y/N) ")) {
 						out(chalk.gray("  Nothing was changed."));
 						out("");
@@ -2088,6 +2504,13 @@ function timeAgo(date) {
 	return formatRelativeTime(date, { maxMs: Number.POSITIVE_INFINITY }) ?? "unknown";
 }
 /**
+* Whether DATABASE_URL is the managed development database (PGlite), as the
+* CLI resolved it and says in `REBASE_DEV_DATABASE_KIND`.
+*/
+function managedDatabase() {
+	return process.env.REBASE_DEV_DATABASE_KIND === "managed";
+}
+/**
 * The Atlas scratch database this process created, dropped once the db
 * command that needed it succeeds — see `ScratchDatabase`.
 */
@@ -2114,8 +2537,9 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 			outError("");
 		} else {
 			outError(chalk.gray("  It is not installed in this project.\n"));
-			outError("  Install it with:\n");
-			outError(chalk.bold(`    ${describeDevAddCommand("@ariga/atlas", manager)}\n`));
+			const member = workspaceMemberDir();
+			outError(member === null ? "  Install it with:\n" : "  Install it with (from the project root):\n");
+			outError(chalk.bold(`    ${describeDevAddCommand("@ariga/atlas", manager, member)}\n`));
 			outError(chalk.gray("  If the install then reports blocked or ignored build scripts, allow them too —\n  the package carries a `preinstall` script that fetches the binary.\n"));
 		}
 		process.exit(1);
@@ -2155,8 +2579,8 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	}
 	const devDatabaseUrl = devDatabase.url;
 	if (takesDevUrl(domain, args) && !devDatabase.named) await scratchDatabase.ensure(databaseUrl, devDatabaseUrl);
-	const atlasUrl = forLibpq(databaseUrl);
-	const atlasDevUrl = forLibpq(devDatabaseUrl);
+	const atlasUrl = forAtlas(databaseUrl);
+	const atlasDevUrl = forAtlas(devDatabaseUrl);
 	const excludes = [];
 	if (collectionsPath && acceptsExcludeFlag(domain, args)) {
 		excludes.push(...await getSearchExcludes(collectionsPath));
@@ -2171,7 +2595,7 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop tables Rebase does not manage."));
 				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
 				if (hint) outError(hint);
-				process.exit(1);
+				throw new CommandStopped("Could not determine which tables to protect.");
 			}
 			throw err;
 		}
@@ -2184,20 +2608,39 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop an index Rebase does not manage."));
 				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
 				if (hint) outError(hint);
-				process.exit(1);
+				throw new CommandStopped("Could not determine which indexes to protect.");
+			}
+			throw err;
+		}
+		try {
+			const desiredSqlFile = path.join(generatedSqlDir(), "schema.sql");
+			const desiredSql = fs.existsSync(desiredSqlFile) ? fs.readFileSync(desiredSqlFile, "utf-8") : "";
+			excludes.push(...await getUndeclaredConstraintExcludes(databaseUrl, desiredSql));
+		} catch (err) {
+			if (err instanceof ExcludeIntrospectionError) {
+				outError(chalk.red("\n✗ Aborting push: could not determine which constraints to protect."));
+				outError(chalk.gray(`  ${err.message}`));
+				outError(chalk.gray("  Refusing to apply — a partial exclude list could drop a CHECK or EXCLUDE constraint the database enforces."));
+				const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+				if (hint) outError(hint);
+				throw new CommandStopped("Could not determine which constraints to protect.");
 			}
 			throw err;
 		}
 	}
-	const subprocess = execa(atlasBin, buildAtlasArgs({
+	const atlasArgs = buildAtlasArgs({
 		domain,
 		args,
 		url: atlasUrl,
 		devUrl: atlasDevUrl,
-		excludes
-	}), {
+		excludes,
+		singleSession: managedDatabase()
+	});
+	if (managedDatabase() && readsRevisions(domain, args)) await ensureAtlasRevisionsTable(databaseUrl);
+	if (managedDatabase()) await closeAppClients();
+	const subprocess = execa(atlasBin, atlasArgs, {
 		cwd: process.cwd(),
-		stdout: opts.captureStdout ? "pipe" : "inherit",
+		stdout: opts.captureStdout || opts.omitPlanEcho ? "pipe" : "inherit",
 		stderr: "pipe",
 		env
 	});
@@ -2205,22 +2648,29 @@ async function runAtlas(domain, args, collectionsPath, opts = {}) {
 	if (opts.captureStdout) subprocess.stdout?.on("data", (chunk) => {
 		stdoutText += chunk.toString();
 	});
+	else if (opts.omitPlanEcho) {
+		const report = createApplyReportFilter();
+		subprocess.stdout?.on("data", (chunk) => process.stdout.write(report.push(chunk.toString())));
+		subprocess.stdout?.on("end", () => process.stdout.write(report.flush()));
+	}
 	let stderrText = "";
 	subprocess.stderr?.on("data", (chunk) => {
 		const text = chunk.toString();
 		stderrText += text;
-		process.stderr.write(text);
+		process.stderr.write(redactConnectionPasswords(text));
 	});
 	try {
 		await subprocess;
 	} catch {
+		await scratchDatabase.afterAtlasFailure(stderrText);
 		outError(chalk.red(`\n✗ atlas ${domain} ${args.join(" ")} failed.\n`));
 		const hint = await diagnoseAtlasFailure({
 			domain,
 			args,
 			stderr: stderrText,
 			databaseUrl,
-			latestMigrationVersion: latestMigrationVersion()
+			latestMigrationVersion: latestMigrationVersion(),
+			managedDatabase: managedDatabase()
 		}) ?? diagnoseDbError({ message: stderrText }, databaseUrl);
 		if (hint) outError(hint);
 		if (opts.throwOnFailure) throw Object.assign(/* @__PURE__ */ new Error(`atlas ${domain} ${args.join(" ")} failed`), { alreadyReported: true });
@@ -2312,9 +2762,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-C4WiftHm.js").then((n) => n.t);
-	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-Di9c4ZxN.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-B74WN37S.js").then((n) => n.n);
+	const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-FlxM2i4i.js").then((n) => n.r);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-BaT0H7Gq.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];
@@ -2426,6 +2876,8 @@ async function schemaCommand(subcommand, rawArgs, options = {}) {
 			"--collections": String,
 			"--force": Boolean,
 			"--schema": String,
+			"--data-inference": Boolean,
+			"--no-data-inference": Boolean,
 			"-o": "--output",
 			"--out": "--output",
 			"-c": "--collections",
@@ -2448,7 +2900,9 @@ async function schemaCommand(subcommand, rawArgs, options = {}) {
 			...introspect.args,
 			`--output=${outputPath}`,
 			...argsList["--force"] ? ["--force"] : [],
-			...argsList["--schema"] ? [`--schema=${argsList["--schema"]}`] : []
+			...argsList["--schema"] ? [`--schema=${argsList["--schema"]}`] : [],
+			...argsList["--data-inference"] ? ["--data-inference"] : [],
+			...argsList["--no-data-inference"] ? ["--no-data-inference"] : []
 		];
 		try {
 			await execa(cmdParts[0], cmdParts.slice(1), {
@@ -2457,7 +2911,7 @@ async function schemaCommand(subcommand, rawArgs, options = {}) {
 				env: { ...process.env }
 			});
 		} catch (err) {
-			outError(chalk.red(`✗ Failed to run schema introspector: ${err instanceof Error ? err.message : String(err)}`));
+			if (typeof (typeof err === "object" && err !== null ? Reflect.get(err, "exitCode") : void 0) !== "number") outError(chalk.red(`✗ Failed to run schema introspector: ${err instanceof Error ? err.message : String(err)}`));
 			process.exit(1);
 		}
 	} else {