@rebasepro/server-postgres 0.25.0-canary.ge06257e → 0.25.1

package/dist/cli.js

@@ -1,12 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
-import { $ as redactConnectionPasswords, A as getVectorExcludes, B as workspaceMemberDir, C as dropGeneratedColumns, D as getTableExcludes, E as getSearchExcludes, F as readSearchDdl, G as decidePushSafety, H as GENERATED_SQL_DIR, I as readTriggersDdl, J as extractPlanStatements, K as destructiveOptInFlag, L as readVectorDdl, M as queryColumnTypes, N as queryGeneratedColumnDependencies, O as getTriggerExcludes, P as queryUndeclarableConstraints, R as resolveLocalBin, S as dropDevDatabase, T as getForeignIndexExcludes, U as generatedSqlDir, V as DESIRED_STATE_URL, W as prepareGeneratedSqlDir, X as isSyncedPlan, Y as fromAlterTable, Z as forAtlas, _ as describeBuildScriptRemedy, a as formatForeignGeneratedColumnBanner, b as detectProjectPackageManager, c as isSslNotEnabled, d as ExcludeIntrospectionError, f as applySearchDdl, g as closeAppClients, h as atlasDevDatabaseUrl, i as diagnoseDbError, j as loadCollectionsForCli, k as getUndeclaredConstraintExcludes, m as applyVectorDdl, o as isAuthFailure, p as applyTriggersDdl, q as detectDestructiveStatements, r as diagnoseAtlasFailure, s as isEconnrefused, t as checkDatabaseConnectivity, u as reportCommandFailure, v as describeDevAddCommand, w as ensureDevDatabaseExists, x as diagnoseMissingBin, y as describeReinstallCommand, z as withAppClient } from "./cli-errors-mx4sSjB8.js";
-import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-DB6xJv3p.js";
-import { t as nextStepAfterDbGenerate } from "./generate-next-step-DCd7yiJ2.js";
-import { o as execa, r as dropLegacyAuthSchema, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-Bd-hJk08.js";
-import { n as require_arg, t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
-import { i as collectionsPathIn, n as assertKnownFlags, o as parseDriverLine, r as closestWord, t as RELAYED_FLAGS } from "./cli-flags-DUozBFyK.js";
+import { n as require_arg, o as __toESM, t as promptConfirm } from "./cli-prompt-DXG0yk-h.js";
+import { A as getUndeclaredConstraintExcludes, B as withAppClient, C as dropDevDatabase, D as getSearchExcludes, E as getForeignIndexExcludes, F as queryUndeclarableConstraints, G as prepareGeneratedSqlDir, H as DESIRED_STATE_URL, I as readSearchDdl, J as detectDestructiveStatements, K as decidePushSafety, L as readTriggersDdl, M as loadCollectionsForCli, N as queryColumnTypes, O as getTableExcludes, P as queryGeneratedColumnDependencies, Q as forAtlas, R as readVectorDdl, S as diagnoseMissingBin, T as ensureDevDatabaseExists, U as GENERATED_SQL_DIR, V as workspaceMemberDir, W as generatedSqlDir, X as fromAlterTable, Y as extractPlanStatements, Z as isSyncedPlan, _ as closeAppClients, a as diagnoseDbError, b as describeReinstallCommand, c as isEconnrefused, d as reportCommandFailure, et as redactConnectionPasswords, f as ExcludeIntrospectionError, g as atlasDevDatabaseUrl, h as applyVectorDdl, i as diagnoseAtlasFailure, j as getVectorExcludes, k as getTriggerExcludes, l as isSslNotEnabled, m as applyTriggersDdl, o as formatForeignGeneratedColumnBanner, p as applySearchDdl, q as destructiveOptInFlag, s as isAuthFailure, t as checkDatabaseConnectivity, v as describeBuildScriptRemedy, w as dropGeneratedColumns, x as detectProjectPackageManager, y as describeDevAddCommand, z as resolveLocalBin } from "./cli-errors-DiA0XFIS.js";
+import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-fZb92pN8.js";
+import { t as nextStepAfterDbGenerate } from "./generate-next-step-DgK5BlBn.js";
+import { a as resolveBranchSwitches, c as assertKnownFlags, f as parseDriverLine, g as dropLegacyAuthSchema, m as RLS_BOOTSTRAP_SQL, n as isDriverDbSubcommand, o as unexpectedBranchArgs, p as resolveDriverSwitches, r as backupActionOf, t as DRIVER_DB_SUBCOMMANDS, u as collectionsPathIn, y as execa } from "./db-subcommands-BPoHCxJR.js";
 import { formatRelativeTime } from "@rebasepro/utils";
 import path from "path";
 import fs from "fs";
@@ -656,7 +654,9 @@ function readsRevisions(domain, args) {
 * all of them, so it excludes no one; what it does cost there is a connection.
 * The managed database accepts four and a running `rebase dev` holds two, so
 * `migrate apply`'s third — its own, the lock's, the revisions table's — was
-* closed unanswered and Atlas said only `Error: EOF`.
+* closed unanswered and Atlas said only `Error: EOF`. `migrate set`, which has
+* no `--skip-lock`, is bound to the revisions schema instead, which spares it
+* the revisions table's connection.
 */
 function buildAtlasArgs(invocation) {
 	const { domain, args, url, devUrl, excludes = [], singleSession = false } = invocation;
@@ -666,6 +666,7 @@ function buildAtlasArgs(invocation) {
 		else if (args.includes("clean") || args.includes("inspect")) argv.push("--url", url);
 	} else if (domain === "migrate") {
 		if (args.includes("diff")) argv.push("--dev-url", devUrl);
+		else if (args.includes("set") && singleSession) argv.push("--url", withSearchPath(url, "rebase"));
 		else if (readsRevisions(domain, args)) {
 			argv.push("--url", url, "--revisions-schema", "rebase");
 			if (args.includes("apply") && !args.includes("--baseline")) argv.push("--allow-dirty");
@@ -676,6 +677,23 @@ function buildAtlasArgs(invocation) {
 	return argv;
 }
 /**
+* The URL with its `search_path` set to `schema`: an Atlas URL bound to that
+* schema. Every other parameter is kept as written. A URL that does not
+* parse is returned unchanged.
+*/
+function withSearchPath(url, schema) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return url;
+	}
+	const params = Array.from(parsed.searchParams.entries()).filter(([key]) => key !== "search_path");
+	params.push(["search_path", schema]);
+	parsed.search = params.map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return parsed.toString();
+}
+/**
 * `atlas migrate apply`'s own arguments for `rebase db migrate`.
 *
 * `positionals` are what is left of the user's line once every flag the
@@ -1052,121 +1070,6 @@ async function applyPoliciesFile(client, policiesSql, stamping) {
 	};
 }
 //#endregion
-//#region src/branch-argv.ts
-/**
-* Argument shapes for `rebase db branch`, with no runtime dependencies.
-*
-* Its own module for the same reason `schema/atlas-argv.ts` is: `cli.ts` pulls
-* in chalk, execa and the driver runtime, so a unit test that imports it cannot
-* run. Argv parsing is the part most worth testing and the part least in need
-* of any of that.
-*/
-/**
-* The flags each driver-side `db branch` action takes, besides the ones the CLI
-* relays on every line (`--database-url`, `--docker`, `--debug`).
-*
-* `switch` is absent: the CLI answers it before the driver is ever spawned.
-* An action not listed here is not checked, so the dispatch can say it does
-* not exist in its own words.
-*/
-var BRANCH_ACTION_FLAGS = {
-	create: {
-		"--from": String,
-		"--force": Boolean
-	},
-	list: {},
-	info: {},
-	delete: {
-		"--force": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	},
-	prune: {
-		"--older-than": String,
-		"--include-dev-diff": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	}
-};
-/**
-* Refuse a flag `action` does not take, naming the one it was probably meant
-* to be — the same sentence `db backup` and `db restore` say.
-*
-* Throws: the driver's entry turns a thrown error into one red line and exit 1,
-* and this runs before anything connects.
-*/
-function assertKnownBranchFlags(action, rest) {
-	const spec = BRANCH_ACTION_FLAGS[action];
-	if (!spec) return;
-	const full = {
-		...RELAYED_FLAGS,
-		...spec
-	};
-	try {
-		(0, import_arg.default)(full, { argv: [...rest] });
-	} catch (error) {
-		if (!(error instanceof Error) || !("code" in error) || error.code !== "ARG_UNKNOWN_OPTION") throw error;
-		const typed = (/option: (\S+)$/.exec(error.message)?.[1] ?? error.message).split("=")[0];
-		const suggestion = closestWord(typed, Object.keys(full).filter((flag) => flag.startsWith("--")));
-		const own = Object.keys(spec).filter((flag) => flag.startsWith("--"));
-		const takes = own.length > 0 ? `it takes ${own.join(", ")}` : "it takes no options of its own";
-		throw new Error(`\`rebase db branch ${action}\` has no option ${typed}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — ${takes}.`) + " Nothing was run. See `rebase db branch --help`.");
-	}
-}
-/**
-* Words on a `db branch` command line that no argument accounts for.
-*
-* `rebase db branch create alpha beta` created a branch called `alpha` and
-* threw `beta` away without a word. The shapes that produces are all quiet and
-* all wrong: an unquoted name (`create my feature` → `my`), a flag written
-* without its dashes (`create feat from main` → `feat`), a shell that split
-* something you thought was one token. In each case the command succeeds and
-* the branch is not the one asked for — and branch names are the thing you
-* later type to switch, delete, or point a deploy at.
-*
-* A flag the action does not take is refused outright, by throwing — see
-* {@link BRANCH_ACTION_FLAGS}. It was let through on the reasoning that a
-* subcommand added later might take flags this file had never heard of; what
-* that bought was every typo running without the flag it meant:
-* `prune --older-then 1d --yes` pruned by no age, `create x --froce` ran
-* without --force. A new action gets its line in the table. The value after a
-* flag that takes one is skipped: it is that flag's argument, not a stray word.
-*
-* @param words The command's own arguments: action, name, then the rest.
-*/
-function unexpectedBranchArgs(words) {
-	if (words[0]) assertKnownBranchFlags(words[0], words.slice(1));
-	const extras = [];
-	let seenName = false;
-	for (let index = 1; index < words.length; index += 1) {
-		const word = words[index];
-		if (word.startsWith("-")) {
-			if (TAKES_A_VALUE.has(word.split("=")[0])) index += 1;
-			continue;
-		}
-		if (!seenName) {
-			seenName = true;
-			continue;
-		}
-		extras.push(word);
-	}
-	return extras;
-}
-/**
-* Branch-line flags whose next word belongs to them.
-*
-* `--from` was the only one listed, and `--database-url` is the one that bit:
-* `rebase db branch list --database-url postgres://…` — which the CLI itself
-* appends when the checkout is on a branch, so `rebase.branches` is read in the
-* parent where it lives — answered `✗ Unexpected argument: postgres://…`. The
-* `=` form carries its value in the same word and needs no skip.
-*/
-var TAKES_A_VALUE = /* @__PURE__ */ new Set([
-	"--from",
-	"--older-than",
-	"--database-url"
-]);
-//#endregion
 //#region src/cli-collections-path.ts
 /**
 * `--collections <dir>`, checked once, before anything is written.
@@ -1243,15 +1146,14 @@ function assertCollectionsPathExists(typed) {
 	throw new CollectionsPathMissing(typed, resolved);
 }
 //#endregion
-//#region src/backup-argv.ts
+//#region src/branch-prune.ts
 /**
-* @param rawArgs the driver's whole line, `["db", "backup", …]`.
+* The variable the CLI hands the driver the database its checkout is switched
+* to in. The pointer is the CLI's (`dev-db/branch-pointer.ts`); the driver is
+* a child process that cannot read it. Spelled the same in
+* `packages/cli/src/commands/db.ts`.
 */
-function backupActionOf(rawArgs) {
-	return rawArgs[2] === "list" ? "list" : "create";
-}
-//#endregion
-//#region src/branch-prune.ts
+var ACTIVE_BRANCH_DATABASE_ENV = "REBASE_ACTIVE_BRANCH_DATABASE";
 /** True when nothing at all needs doing. */
 function planIsEmpty(plan, includeDevDiff) {
 	return plan.staleRows.length === 0 && plan.orphanDatabases.length === 0 && plan.expired.length === 0 && (!includeDevDiff || plan.devDiff.length === 0);
@@ -1284,14 +1186,31 @@ function planPrune(input, options = {}) {
 	const now = options.now ?? /* @__PURE__ */ new Date();
 	const present = new Set(input.databases);
 	const registered = new Set(input.rows.map((row) => row.dbName));
+	const isActive = (database) => options.activeDatabase != null && database === options.activeDatabase;
+	let active = null;
 	return {
 		staleRows: input.rows.filter((row) => !present.has(row.dbName)),
-		orphanDatabases: input.databases.filter((name) => name.startsWith(input.branchPrefix) && !registered.has(name)).sort(),
+		orphanDatabases: input.databases.filter((name) => name.startsWith(input.branchPrefix) && !registered.has(name)).filter((name) => {
+			if (!isActive(name)) return true;
+			active = {
+				name,
+				database: name
+			};
+			return false;
+		}).sort(),
 		expired: options.olderThanDays == null ? [] : input.rows.filter((row) => present.has(row.dbName)).map((branch) => ({
 			branch,
 			ageDays: ageInDays(branch.createdAt, now)
-		})).filter((entry) => entry.ageDays >= options.olderThanDays).sort((a, b) => b.ageDays - a.ageDays),
-		devDiff: input.databases.filter((name) => name.endsWith("_dev_diff")).sort()
+		})).filter((entry) => entry.ageDays >= options.olderThanDays).filter((entry) => {
+			if (!isActive(entry.branch.dbName)) return true;
+			active = {
+				name: entry.branch.name,
+				database: entry.branch.dbName
+			};
+			return false;
+		}).sort((a, b) => b.ageDays - a.ageDays),
+		devDiff: input.databases.filter((name) => name.endsWith("_dev_diff")).sort(),
+		active
 	};
 }
 //#endregion
@@ -1382,7 +1301,7 @@ function generatesInProcess() {
 async function generateInProcess(what, label, run) {
 	let generators;
 	try {
-		generators = await import("./generate-files-D50Pxw1G.js").then((n) => n.t);
+		generators = await import("./generate-files-BP-4W_gm.js").then((n) => n.t);
 	} catch (err) {
 		outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
 		process.exit(1);
@@ -1422,13 +1341,14 @@ async function runPluginCommand(args) {
 	const domain = args[0];
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
+	args = resolveDriverSwitches(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
 	try {
 		if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
 		else if (domain === "schema") await schemaCommand(subcommand, args);
 		else if (domain === "doctor") await doctorPluginCommand(args);
 		else if (domain === "console") {
-			const { consoleCommand } = await import("./cli-console-C_ISGwJo.js");
+			const { consoleCommand } = await import("./cli-console-CQrQ0lAY.js");
 			process.exitCode = await consoleCommand(args);
 		} else {
 			outError(chalk.red(`Unknown domain command: ${domain}`));
@@ -1579,17 +1499,8 @@ var DB_FLAGS = {
 	"-y": "--yes"
 };
 async function dbCommand(subcommand, rawArgs) {
-	const VALID_ACTIONS = [
-		"push",
-		"generate",
-		"migrate",
-		"branch",
-		"backup",
-		"restore",
-		"backups"
-	];
-	if (!subcommand || !VALID_ACTIONS.includes(subcommand)) {
-		outError(chalk.red(`Unknown db command. Valid: ${VALID_ACTIONS.join(", ")}`));
+	if (!isDriverDbSubcommand(subcommand)) {
+		outError(chalk.red(`Unknown db command. Valid: ${DRIVER_DB_SUBCOMMANDS.join(", ")}`));
 		process.exit(1);
 	}
 	if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
@@ -1604,7 +1515,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-HCEkPcQj.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-gijeXe0u.js").then((n) => n.t);
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1651,7 +1562,7 @@ async function dbCommand(subcommand, rawArgs) {
 				}
 				const searchContent = readSearchDdl();
 				if (searchContent) {
-					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
+					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-DPl1oH_z.js").then((n) => n.o);
 					const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 					const preamble = migrationDropPreamble(migrationConflicts);
 					if (preamble) {
@@ -1699,9 +1610,14 @@ async function dbCommand(subcommand, rawArgs) {
     Search, vector, trigger and RLS DDL are applied by \`rebase db push\`, and at
     boot by the schema ensure. For a migration-only deployment, add
     ${GENERATED_SQL_DIR}/search.sql, vector.sql, triggers.sql and\n    policies.sql to a migration by hand.`));
+		const nextStep = nextStepAfterDbGenerate({
+			newestVersion: latestMigrationVersion(),
+			wrote: wroteNewMigration,
+			first: migrationsBefore.length === 0
+		});
 		out("");
-		for (const line of nextStepAfterDbGenerate(latestMigrationVersion())) out(line);
-		out("");
+		for (const line of nextStep) out(line);
+		if (nextStep.length > 0) out("");
 	} else {
 		out("");
 		out(chalk.bold(`  🗄️  Rebase DB ${subcommand.charAt(0).toUpperCase() + subcommand.slice(1)}`));
@@ -1909,6 +1825,8 @@ async function dbCommand(subcommand, rawArgs) {
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
+				const { stampMigratedPolicies } = await import("./migrate-policy-stamps-3eqfhes6.js");
+				await stampMigratedPolicies(databaseUrl, collectionsPath);
 			}
 		}
 		out("");
@@ -1930,8 +1848,8 @@ async function dbCommand(subcommand, rawArgs) {
 async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 	let renames;
 	try {
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-D4bvMWAb.js");
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-CLgYYwPE.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1950,8 +1868,8 @@ async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 /** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
 async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 	try {
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-D9eTIWCz.js");
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-nheku1pB.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
@@ -1960,8 +1878,8 @@ async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	let missing;
 	try {
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-BDFcfRPo.js");
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-COd7i6wm.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1971,7 +1889,7 @@ async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	if (missing.length === 0 || dryRun) return names;
 	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
 	try {
-		const { buildDeferredIndexes } = await import("./deferred-index-build-Ca6OqKyR.js").then((n) => n.r);
+		const { buildDeferredIndexes } = await import("./deferred-index-build-BE0I6sYU.js").then((n) => n.r);
 		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
 			dedicated: true,
 			query: async (text) => ({ rows: (await client.query(text)).rows }),
@@ -2019,9 +1937,9 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 	let unsecured;
 	let userRole;
 	try {
-		const { lockCollectionTables } = await import("./ensure-collection-policies-C1ux3V_z.js");
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		userRole = (await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const { lockCollectionTables } = await import("./ensure-collection-policies-BnGOURpG.js");
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-DDyNoOSy.js").then((n) => n.c)).REBASE_USER_ROLE;
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
 	} catch (err) {
@@ -2056,8 +1974,8 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Dl_Eh9ow.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-l_OgFQjN.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
@@ -2077,7 +1995,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c);
+		rls = await import("./rls-enforcement-DDyNoOSy.js").then((n) => n.c);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -2137,10 +2055,10 @@ async function applyPolicies(databaseUrl, collectionsPath) {
 */
 async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 	try {
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-B4k9djAV.js").then((n) => n.o);
-		const { policyStampSql } = await import("./ensure-collection-policies-C1ux3V_z.js");
-		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-DPl1oH_z.js").then((n) => n.o);
+		const { policyStampSql } = await import("./ensure-collection-policies-BnGOURpG.js");
+		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		return {
 			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
 			searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public"
@@ -2157,9 +2075,9 @@ async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 */
 async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 	try {
-		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-DTXE6aVa.js");
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-D2gpQsdv.js");
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const plan = await withAppClient(databaseUrl, (client) => planPolicyPush({ query: async (text, values) => ({ rows: (await client.query(text, values)).rows }) }, collections, { searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public" }));
 		return {
@@ -2186,8 +2104,8 @@ async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-CY5P1ZRu.js").then((n) => n.s);
-		const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-X4A-xAzv.js").then((n) => n.s);
+		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
@@ -2233,6 +2151,11 @@ var BRANCH_FLAGS = {
 	"--yes": Boolean,
 	"-y": "--yes"
 };
+/** The source `branch create --from <source>` names, if it names one. */
+function createSource(rawArgs) {
+	const at = rawArgs.indexOf("--from");
+	return at !== -1 && rawArgs[at + 1] ? rawArgs[at + 1] : void 0;
+}
 async function branchCommand(rawArgs) {
 	const branchAction = rawArgs[2];
 	if (!branchAction || branchAction === "--help") {
@@ -2240,13 +2163,14 @@ async function branchCommand(rawArgs) {
 		return;
 	}
 	const extras = unexpectedBranchArgs(rawArgs.slice(2));
+	rawArgs = resolveBranchSwitches(rawArgs);
 	if (extras.length > 0) {
 		outError("");
-		outError(chalk.red(`  ✗ Unexpected argument${extras.length > 1 ? "s" : ""}: ${extras.join(" ")}`));
+		outError(chalk.red(`  ✗ Unexpected argument${extras.length > 1 ? "s" : ""}: ${redactConnectionPasswords(extras.join(" "))}`));
 		outError("");
 		outError(chalk.gray(`  ${chalk.bold("rebase db branch")} takes one name. A branch name may contain letters,`));
 		outError(chalk.gray("  digits, underscores and hyphens — no spaces."));
-		if (rawArgs[3]) outError(chalk.gray(`  Did you mean: ${chalk.cyan(`rebase db branch ${branchAction} ${[rawArgs[3], ...extras].join("-")}`)}`));
+		if (rawArgs[3]) outError(chalk.gray(`  Did you mean: ${chalk.cyan(redactConnectionPasswords(`rebase db branch ${branchAction} ${[rawArgs[3], ...extras].join("-")}`))}`));
 		outError("");
 		process.exit(1);
 	}
@@ -2264,10 +2188,12 @@ async function branchCommand(rawArgs) {
 		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
 		process.exit(1);
 	}
-	const { DatabasePoolManager } = await import("./databasePoolManager-Yqdw14wY.js").then((n) => n.n);
-	const { BranchService } = await import("./BranchService-DNg4txyf.js").then((n) => n.n);
+	const { DatabasePoolManager } = await import("./databasePoolManager-3stMNFL-.js").then((n) => n.n);
+	const { BranchService, reopenClosedDatabases, reopenedDatabasesNotice } = await import("./BranchService-ClklxyAQ.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
+	const healed = await reopenClosedDatabases(databaseUrl, [branchAction === "create" ? createSource(rawArgs) : void 0, process.env[ACTIVE_BRANCH_DATABASE_ENV]]);
+	for (const line of reopenedDatabasesNotice(healed)) outWarn(chalk.yellow(`  ${line}`));
 	await checkDatabaseConnectivity(databaseUrl);
 	await closeAppClients();
 	const pool = new Pool({
@@ -2287,9 +2213,7 @@ async function branchCommand(rawArgs) {
 					out(chalk.gray("  Usage: rebase db branch create <name> [--from <source>]"));
 					process.exit(1);
 				}
-				let source;
-				const fromIdx = rawArgs.indexOf("--from");
-				if (fromIdx !== -1 && rawArgs[fromIdx + 1]) source = rawArgs[fromIdx + 1];
+				const source = createSource(rawArgs);
 				const force = rawArgs.includes("--force");
 				out("");
 				out(chalk.bold("  🌿 Creating database branch..."));
@@ -2314,10 +2238,12 @@ async function branchCommand(rawArgs) {
 				else {
 					out(chalk.bold(`  🌿 ${branches.length} branch(es):`));
 					out("");
+					const current = process.env[ACTIVE_BRANCH_DATABASE_ENV]?.trim();
 					for (const b of branches) {
 						const size = b.sizeBytes != null ? chalk.gray(` (${formatBytes(b.sizeBytes)})`) : "";
 						const age = chalk.gray(` — created ${timeAgo(b.createdAt)}`);
-						out(`  ${chalk.green("●")} ${chalk.bold(b.name)}${size}${age}`);
+						const here = current && b.database === current ? chalk.cyan(" (current — this checkout is on it)") : "";
+						out(`  ${chalk.green("●")} ${chalk.bold(b.name)}${here}${size}${age}`);
 						out(chalk.gray(`    from ${b.parentDatabase}`));
 					}
 				}
@@ -2379,9 +2305,18 @@ async function branchCommand(rawArgs) {
 					rows,
 					databases,
 					branchPrefix: "rb_"
-				}, { olderThanDays });
+				}, {
+					olderThanDays,
+					activeDatabase: process.env["REBASE_ACTIVE_BRANCH_DATABASE"]?.trim() || null
+				});
+				const keptActive = () => {
+					if (!plan.active) return;
+					out(`  ${chalk.gray("○")} ${chalk.bold(plan.active.name)} ${chalk.gray("— this checkout is switched to it, so it is kept")}`);
+					out(chalk.gray(`    To prune it, leave it first: ${chalk.cyan("rebase db branch switch --off")}`));
+				};
 				out("");
 				if (planIsEmpty(plan, includeDevDiff)) {
+					keptActive();
 					out(chalk.gray("  Nothing to prune."));
 					if (!olderThanDays && rows.length > 0) out(chalk.gray(`  ${rows.length} branch(es) are healthy — --older-than 14 also removes old ones.`));
 					if (!includeDevDiff && plan.devDiff.length > 0) {
@@ -2396,6 +2331,7 @@ async function branchCommand(rawArgs) {
 				for (const row of plan.staleRows) out(`  ${chalk.yellow("○")} ${chalk.bold(row.name)} ${chalk.gray("— registered, but its database is gone; the entry will be removed")}`);
 				for (const dbName of plan.orphanDatabases) out(`  ${chalk.yellow("○")} ${chalk.bold(dbName)} ${chalk.gray("— a branch database with no entry; the database will be dropped")}`);
 				for (const { branch, ageDays } of plan.expired) out(`  ${chalk.red("●")} ${chalk.bold(branch.name)} ${chalk.gray(`— ${ageDays} days old; branch and database will be dropped`)}`);
+				keptActive();
 				if (includeDevDiff) for (const dbName of plan.devDiff) out(`  ${chalk.red("●")} ${chalk.bold(dbName)} ${chalk.gray("— Atlas scratch database; will be dropped")}`);
 				else if (plan.devDiff.length > 0) out(chalk.gray(`  (${plan.devDiff.length} Atlas scratch database(s) not listed — --include-dev-diff)`));
 				out("");
@@ -2762,9 +2698,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-CJyuhV1n.js").then((n) => n.t);
-	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-FlxM2i4i.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-BaT0H7Gq.js").then((n) => n.n);
+	const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-BvNF3i-s.js").then((n) => n.r);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-CPzCRD-8.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];