@rebasepro/server-postgres 0.25.0 → 0.26.0

package/dist/{rls-bootstrap-sql-Bd-hJk08.js → migrate-baseline-B-2Ef4Mv.js}

@@ -1,8 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as __toESM, n as __exportAll, r as __require, t as __commonJSMin } from "./rolldown-runtime-V7rFbMRe.js";
+import { a as __require, i as __exportAll, n as require_arg, o as __toESM, r as __commonJSMin } from "./cli-prompt-DXG0yk-h.js";
+import { B as withAppClient, tt as redactConnectionPasswords } from "./cli-errors-DsYyNYzd.js";
 import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
 import { sqlRows } from "@rebasepro/common";
+import { suggestNearMiss } from "@rebasepro/utils";
 import process$1, { execArgv, execPath, hrtime, platform } from "node:process";
 import { constants } from "node:os";
 import tty from "node:tty";
@@ -6192,6 +6194,7 @@ var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExpo
 //#region src/schema/rls-bootstrap-sql.ts
 var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
 	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
+	LEGACY_AUTH_SCHEMA_CONTENTS_SQL: () => LEGACY_AUTH_SCHEMA_CONTENTS_SQL,
 	LEGACY_RLS_DEPENDENTS_SQL: () => LEGACY_RLS_DEPENDENTS_SQL,
 	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
 	RLS_BOOTSTRAP_SQL: () => RLS_BOOTSTRAP_SQL,
@@ -6356,6 +6359,60 @@ async function rlsRuntimeIsCurrent(run) {
 /** The same statements as one script, for migration files and raw clients. */
 var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by the policies below)\n" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n") + "\n";
 /**
+* The three functions every pre-1.0 release put in `auth`. (The auth tables
+* lived in `rebase`, or wherever the users collection was declared.)
+*
+* `uid()` is matched on either spelling of the principal because Rebase wrote
+* both. Until v0.10.0 its body was
+* `SELECT NULLIF(current_setting('app.user_id', true), '')`; v0.10.0 renamed
+* the GUC to `app.uid` and kept `app.user_id` as a fallback; v0.14.0 moved the
+* helpers to `rebase`. A database last booted before v0.10.0 therefore holds an
+* `auth.uid()` that reads `app.user_id` alone — as does anything that copied
+* that body, the Rebase control plane included — and matching `app.uid` only
+* left every one of them in place, with the schema around it.
+*
+* This is the one place either spelling is listed: the drop and the report of
+* what it left are both generated from it, so they cannot disagree about which
+* functions are Rebase's.
+*/
+var LEGACY_AUTH_HELPERS = [
+	{
+		name: "uid",
+		returns: "text",
+		reads: ["app.uid", "app.user_id"]
+	},
+	{
+		name: "jwt",
+		returns: "jsonb",
+		reads: ["app.jwt"]
+	},
+	{
+		name: "roles",
+		returns: "text",
+		reads: ["app.user_roles"]
+	}
+];
+/**
+* `pg_proc p` has a Rebase helper's name, arity and result type: what
+* `CREATE OR REPLACE` would have left, whatever the body.
+*
+* Two things that share that shape are excluded outright: a body reading
+* `request.jwt` (Supabase's helpers and anything modelled on them) and a
+* function an extension installed (`pg_session_jwt` puts an `auth.jwt()
+* RETURNS jsonb` in the same schema).
+*/
+var isLegacyHelperShaped = (helper) => `(
+          p.proname = '${helper.name}' AND p.pronargs = 0
+          AND pg_get_function_result(p.oid) = '${helper.returns}'
+          AND strpos(p.prosrc, 'request.jwt') = 0
+          AND NOT EXISTS (
+              SELECT 1 FROM pg_depend e
+              WHERE e.classid = 'pg_proc'::regclass AND e.objid = p.oid AND e.deptype = 'e'
+          ))`;
+/** `pg_proc p` is a helper Rebase wrote: its shape, and a body reading one of its GUCs. */
+var isLegacyHelper = (helper) => `${isLegacyHelperShaped(helper)}
+          AND (${helper.reads.map((guc) => `strpos(p.prosrc, '${guc}') > 0`).join(" OR ")})`;
+/**
 * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
 *
 * ## Why this is safe against a Supabase database
@@ -6363,11 +6420,12 @@ var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by th
 * Two independent guards, and both have to pass:
 *
 *  1. **Each function is identified before it is dropped.** Ours returns `text`
-*     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
-*     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
-*     so a Supabase database — where our `CREATE OR REPLACE` could never have
-*     succeeded in the first place, Postgres refusing to change a return type —
-*     matches nothing and this is a no-op.
+*     and reads the `app.uid` or `app.user_id` GUC; Supabase's returns `uuid`
+*     and reads `request.jwt.claims`. Nothing is dropped on a signature we did
+*     not write, so a Supabase database — where our `CREATE OR REPLACE` could
+*     never have succeeded in the first place, Postgres refusing to change a
+*     return type — matches nothing and this is a no-op. See
+*     {@link LEGACY_AUTH_HELPERS} for exactly what is matched.
 *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
 *     lives in `auth` (Supabase's `users` table, its other helpers), the drop
 *     fails and the schema stays. CASCADE here would be unrecoverable.
@@ -6388,41 +6446,21 @@ DECLARE
 BEGIN
     -- Each function is matched on its own result type and body, so a schema
     -- that merely shares the name keeps everything it has.
-    IF EXISTS (
-        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'uid'
-          AND pg_get_function_result(p.oid) = 'text'
-          AND p.prosrc LIKE '%app.uid%'
-    ) THEN
-        DROP FUNCTION auth.uid();
-        dropped_any := true;
-    END IF;
-
-    IF EXISTS (
-        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
-          AND pg_get_function_result(p.oid) = 'jsonb'
-          AND p.prosrc LIKE '%app.jwt%'
-    ) THEN
-        DROP FUNCTION auth.jwt();
-        dropped_any := true;
-    END IF;
-
-    IF EXISTS (
+${LEGACY_AUTH_HELPERS.map((helper) => `    IF EXISTS (
         SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-        WHERE n.nspname = 'auth' AND p.proname = 'roles'
-          AND pg_get_function_result(p.oid) = 'text'
-          AND p.prosrc LIKE '%app.user_roles%'
+        WHERE n.nspname = '${LEGACY_RLS_SCHEMA}' AND ${isLegacyHelper(helper)}
     ) THEN
-        DROP FUNCTION auth.roles();
+        DROP FUNCTION ${LEGACY_RLS_SCHEMA}.${helper.name}();
         dropped_any := true;
-    END IF;
+    END IF;`).join("\n\n")}
 
     -- RESTRICT: only an empty schema goes. Anything else in there — including a
-    -- Supabase installation left untouched above — keeps it.
+    -- Supabase installation left untouched above — keeps it. Swallowed so the
+    -- helpers dropped above stay dropped; dropLegacyAuthSchema looks afterwards
+    -- and says what is left.
     IF dropped_any THEN
         BEGIN
-            EXECUTE 'DROP SCHEMA auth RESTRICT';
+            EXECUTE 'DROP SCHEMA ${LEGACY_RLS_SCHEMA} RESTRICT';
         EXCEPTION WHEN OTHERS THEN
             NULL;
         END;
@@ -6431,6 +6469,40 @@ END
 $rebase_drop_legacy$;
 `;
 /**
+* What the `auth` schema holds, one row per object keeping it alive.
+*
+* No rows: the schema does not exist. A single row with a `null` object: it
+* exists and is empty. Read from the namespace entries in `pg_depend`, which
+* are what `DROP SCHEMA … RESTRICT` itself consults — minus whatever goes with
+* its owner (a serial's sequence, an identity column's), which Postgres does not
+* name either.
+*/
+var LEGACY_AUTH_SCHEMA_CONTENTS_SQL = `
+    SELECT pg_describe_object(d.classid, d.objid, d.objsubid) AS object,
+           CASE
+               WHEN d.classid <> 'pg_proc'::regclass THEN NULL
+               WHEN EXISTS (
+                   SELECT 1 FROM pg_proc p
+                   WHERE p.oid = d.objid
+                     AND (${LEGACY_AUTH_HELPERS.map((helper) => `(${isLegacyHelper(helper)})`).join(" OR ")})
+               ) THEN 'ours'
+               WHEN EXISTS (
+                   SELECT 1 FROM pg_proc p
+                   WHERE p.oid = d.objid
+                     AND (${LEGACY_AUTH_HELPERS.map(isLegacyHelperShaped).join(" OR ")})
+               ) THEN 'lookalike'
+           END AS helper
+    FROM pg_namespace n
+    LEFT JOIN pg_depend d
+           ON d.refclassid = 'pg_namespace'::regclass AND d.refobjid = n.oid AND d.deptype = 'n'
+          AND NOT EXISTS (
+              SELECT 1 FROM pg_depend o
+              WHERE o.classid = d.classid AND o.objid = d.objid AND o.deptype IN ('a', 'i')
+          )
+    WHERE n.nspname = '${LEGACY_RLS_SCHEMA}'
+    ORDER BY helper NULLS LAST, object
+`;
+/**
 * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
 *
 * Postgres will not drop a function a policy depends on, so this is exactly the
@@ -6461,11 +6533,12 @@ var LEGACY_RLS_DEPENDENTS_SQL = `
 * exists, which fails at *query* time rather than at boot.
 *
 * A downstream project building on these helpers is not hypothetical: the Rebase
-* control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+* control plane defined `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
 * in this very schema, each calling `auth.uid()` in a string body, and eleven of
-* its row-level-security policies go through them. Every one of those would have
-* started failing the first time a recompile left no policy referencing
-* `auth.uid()` directly — the drop's own precondition.
+* its row-level-security policies went through them. Every one of those would
+* have started failing the first time a recompile left no policy referencing
+* `auth.uid()` directly — the drop's own precondition. (Its migration 0065 has
+* since moved both to `public`, calling `rebase.uid()`.)
 *
 * Matching on the body text is the only option available, and it is deliberately
 * broad: a false positive costs a schema that stays one release longer and says
@@ -6489,8 +6562,30 @@ var LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
 * table not recompiled *yet* — and wrong for the one that never resolves: a
 * hand-written policy nothing will ever rewrite. Then the schema stays forever
 * and nothing ever says why.
+*
+* The drop itself had the same blind spot. A helper it did not recognise as
+* Rebase's stayed, and so did anything else in the schema, behind a
+* `DROP SCHEMA … RESTRICT` whose failure is swallowed so the helpers it did
+* drop stay dropped. The control plane's `auth.uid()` was one such: it read
+* `app.user_id` alone, the drop looked for `app.uid`, and the schema stayed
+* with no word said. So the schema is read twice. Before, so that one with no
+* Rebase helper in it is left alone: one already gone, as on every boot after
+* the drop, or one that was never Rebase's, like Supabase's — whose own
+* policies the checks below would otherwise report as blockers. After, to name
+* whatever is still there.
 */
 async function dropLegacyAuthSchema(run, report) {
+	let before;
+	try {
+		before = sqlRows(await run(LEGACY_AUTH_SCHEMA_CONTENTS_SQL));
+	} catch {
+		return;
+	}
+	if (!before.some((o) => o.helper !== null)) return;
+	if (!before.some((o) => o.helper === "ours")) {
+		report.warn(describeLegacyAuthLeftovers(before, void 0));
+		return;
+	}
 	let blockers;
 	try {
 		blockers = sqlRows(await run(LEGACY_RLS_DEPENDENTS_SQL));
@@ -6511,13 +6606,595 @@ async function dropLegacyAuthSchema(run, report) {
 		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ${borrowers.length === 1 ? "function calls" : "functions call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency for that — a SQL body written as a string literal is never parsed — so dropping the helpers would leave these pointing at nothing, and they would fail when a query reached them rather than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` + borrowers.map((b) => `  • ${b.schema}.${b.function}()`).join("\n"));
 		return;
 	}
+	let failure;
 	try {
 		await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
 	} catch (err) {
-		report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` + (err instanceof Error ? err.message : String(err)));
+		const detail = err instanceof Error && "detail" in err && typeof err.detail === "string" ? err.detail : "";
+		failure = (err instanceof Error ? err.message : String(err)) + (detail ? ` (${detail.replace(/\n/g, "; ")})` : "");
+	}
+	let left;
+	try {
+		left = sqlRows(await run(LEGACY_AUTH_SCHEMA_CONTENTS_SQL));
+	} catch {
+		if (failure) report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ${failure}`);
+		return;
+	}
+	if (left.length === 0) return;
+	report.warn(describeLegacyAuthLeftovers(left, failure));
+}
+/** At most this many objects are named; a schema this full is plainly in use. */
+var MAX_LEFTOVERS_NAMED = 20;
+/**
+* The warning for an `auth` schema the drop left standing.
+*
+* Said once for objects that are not Rebase's: on the next boot the schema holds
+* no helper, so {@link dropLegacyAuthSchema} leaves it alone — it is somebody
+* else's schema by then. A helper that is still there, Rebase's or a lookalike,
+* keeps it said on every boot until it goes.
+*/
+function describeLegacyAuthLeftovers(left, failure) {
+	const schema = LEGACY_RLS_SCHEMA;
+	const objects = left.filter((o) => o.object !== null);
+	if (objects.length === 0) return `The pre-1.0 \`${schema}\` schema is empty, but this connection could not drop it — most likely because it does not own the schema. Run \`DROP SCHEMA ${schema};\` as its owner.`;
+	const why = failure ? `dropping Rebase's old helpers from it failed: ${failure}.` : "`DROP SCHEMA … RESTRICT` refuses a schema that is not empty, and Rebase drops only the helpers it can tell are its own.";
+	const lines = objects.slice(0, MAX_LEFTOVERS_NAMED).map((o) => o.helper === "ours" ? `  • ${o.object} — Rebase's old helper, which could not be dropped` : o.helper === "lookalike" ? `  • ${o.object} — named and typed like Rebase's old helper, but no release wrote this body, so it was left alone; drop it by hand if nothing of yours calls it` : `  • ${o.object}`);
+	if (objects.length > MAX_LEFTOVERS_NAMED) lines.push(`  • …and ${objects.length - MAX_LEFTOVERS_NAMED} more`);
+	return `The pre-1.0 \`${schema}\` schema is still here: ${why} Still in it:\n` + lines.join("\n") + `
+Anything of yours can stay where it is — Rebase no longer uses this schema — or move out with \`ALTER … SET SCHEMA\`. Once the schema is empty, \`DROP SCHEMA ${schema};\` removes it.`;
+}
+//#endregion
+//#region src/cli-flags.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
+/**
+* Flags that reach this process on a line it did not compose.
+*
+* `rebase db …` hands the driver the user's whole line: the CLI *reads*
+* `--database-url` and `--docker` to resolve the database and then relays them
+* verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
+* the thing to re-run with. Rejecting any of the three would make the driver
+* refuse commands the CLI documents.
+*/
+var RELAYED_FLAGS = {
+	"--database-url": String,
+	"--docker": Boolean,
+	"--debug": Boolean,
+	"--help": Boolean,
+	"-h": "--help"
+};
+/**
+* Parse a driver command's line — `["db", "<subcommand>", …]` — with the
+* relayed flags declared alongside the command's own.
+*
+* Every driver parser is permissive, and an undeclared flag in a permissive
+* parse is a positional. The positionals are what `db migrate` hands
+* `atlas migrate apply`, what `db generate` names its migration after and
+* which backup `db restore` restores, so a relayed flag left undeclared was
+* read as one of those: `rebase db migrate --docker` died on Atlas's
+* `unknown flag: --docker` after it had already written the auth schema.
+*/
+function parseDriverLine(spec, args) {
+	return (0, import_arg.default)({
+		...RELAYED_FLAGS,
+		...spec
+	}, {
+		argv: args.slice(2),
+		permissive: true
+	});
+}
+/** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
+var DRIVER_FLAG_SPECS = {
+	"db push": {
+		"--collections": String,
+		"-c": "--collections",
+		"--dry-run": Boolean,
+		"--allow-destructive": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	},
+	"db generate": {
+		"--collections": String,
+		"-c": "--collections"
+	},
+	"db migrate": {
+		"--baseline": String,
+		"--refuse-destructive": Boolean
+	},
+	"schema generate": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--watch": Boolean,
+		"-w": "--watch"
+	},
+	"schema introspect": {
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--collections": String,
+		"-c": "--collections",
+		"--force": Boolean,
+		"-f": "--force",
+		"--schema": String,
+		"--data-inference": Boolean,
+		"--no-data-inference": Boolean
+	},
+	"schema stale": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--fix": Boolean
+	}
+};
+/**
+* The `--collections` path the user typed, or `null` if they typed none.
+*
+* Read once, at the entry point, because every command that takes it re-enters
+* the generators with the same line and each of them resolved it again — which
+* is how "Collections path not found" came to be printed four times before the
+* real output, and how a path that does not exist got as far as *writing* an
+* empty schema.
+*
+* Permissive, and it has to be: {@link assertKnownFlags} has already judged the
+* line, and `db push` carries flags the `--collections` spec does not name.
+*/
+function collectionsPathIn(args) {
+	try {
+		return (0, import_arg.default)({
+			"--collections": String,
+			"-c": "--collections"
+		}, {
+			argv: args.slice(2),
+			permissive: true
+		})["--collections"] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Reject a flag the named command does not take.
+*
+* `args` is the driver's whole line — `["db", "push", …]` — so the flags are
+* read from `args.slice(2)`, past the two command words.
+*
+* Throws rather than exiting: `runPluginCommand`'s caller already turns a
+* thrown error into one red line and exit 1, and a thrown error is what the
+* tests can see.
+*/
+function assertKnownFlags(domain, subcommand, args) {
+	if (!subcommand) return;
+	const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];
+	if (!spec) return;
+	const argv = resolveSwitchValues({
+		...RELAYED_FLAGS,
+		...spec
+	}, args.slice(2), `${domain} ${subcommand}`, domain);
+	try {
+		(0, import_arg.default)({
+			...RELAYED_FLAGS,
+			...spec
+		}, { argv });
+	} catch (err) {
+		const unknown = unknownFlagIn(err, args.slice(2));
+		if (unknown === null) throw err;
+		throw new Error(unknownOptionSentence(`${domain} ${subcommand}`, domain, unknown, spec));
+	}
+}
+/**
+* The sentence an undeclared flag is refused with, in the words the CLI's own
+* parser uses: "`rebase db push` has no option --dry-rn — did you mean
+* --dry-run? Nothing was run."
+*
+* `token` is the whole argument `arg` refused, which is not always a flag: one
+* argument holding a flag and its value, quoted together
+* (`"--from postgres://u:pw@h/db"`), is refused whole. That one is named as
+* what it is, and what it quotes is password-masked; no other part of an
+* argument is quoted at all.
+*
+* @param command the command as typed: `"db push"`.
+* @param help the command whose `--help` the sentence names.
+* @param spec the command's own flags; the relayed ones are offered too.
+*/
+function unknownOptionSentence(command, help, token, spec) {
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	const name = token.split(/[=\s]/)[0];
+	const suggestion = closestWord(name, Object.keys(full).filter((flag) => flag.startsWith("--")));
+	const tail = ` Nothing was run. See \`rebase ${help} --help\`.`;
+	if (/\s/.test(token.trim())) {
+		const flag = name in full ? name : suggestion;
+		const how = flag ? ` Write them as two arguments, ${flag} <value>, or as ${flag}=<value>.` : " Write a flag and its value as two arguments.";
+		return `\`rebase ${command}\` has no option "${redactConnectionPasswords(token)}": that is a flag and a value in one argument, quoted together.${how}${tail}`;
+	}
+	const own = Object.keys(spec).filter((flag) => flag.startsWith("--"));
+	const takes = own.length > 0 ? `it takes ${own.join(", ")}` : "it takes no options of its own";
+	return `\`rebase ${command}\` has no option ${name}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — ${takes}.`) + tail;
+}
+/** What a flag resolves to, through its alias (`"-y": "--yes"`). */
+function handlerOf(spec, flag) {
+	const declared = spec[flag];
+	return typeof declared === "string" ? spec[declared] : declared;
+}
+/** A flag that takes no value: on when given, off when left out. */
+function isSwitch(handler) {
+	return handler === Boolean || Array.isArray(handler) && handler[0] === Boolean;
+}
+/** The values a switch reads as on, and as off, after its `=`. */
+var SWITCH_ON = /^(?:true|1)$/i;
+var SWITCH_OFF = /^(?:false|0)$/i;
+/**
+* A line with every `--switch=value` resolved, before `arg` reads it: `=true`
+* or `=1` is the switch alone, `=false` or `=0` drops it, and any other value
+* is refused.
+*
+* `arg` drops the value of a flag that takes none and turns the flag on, so
+* `db push --dry-run=false` was a dry run and `--allow-destructive=false`
+* allowed the destructive statements it was typed to forbid. `=true` kept
+* working by the same accident, and scripts write it, so both readings a value
+* can have are honoured and nothing else is guessed at. Past `--` every word
+* is a positional, so nothing there is read.
+*
+* @param command the command as typed, for the message: `"db push"`.
+* @param help the command whose `--help` the message names.
+*/
+function resolveSwitchValues(spec, argv, command, help = command) {
+	const resolved = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const word = argv[index];
+		if (word === "--") {
+			resolved.push(...argv.slice(index));
+			break;
+		}
+		const flag = word.startsWith("--") && word.includes("=") ? word.slice(0, word.indexOf("=")) : null;
+		if (flag === null || !isSwitch(handlerOf(spec, flag))) {
+			resolved.push(word);
+			continue;
+		}
+		const value = word.slice(flag.length + 1);
+		if (SWITCH_ON.test(value)) resolved.push(flag);
+		else if (!SWITCH_OFF.test(value)) throw new Error(`\`rebase ${command}\` cannot read ${redactConnectionPasswords(word)}: ${flag} is a switch, and after its = it takes true or 1 to turn it on, false or 0 to turn it off. Nothing was run. See \`rebase ${help} --help\`.`);
+	}
+	return resolved;
+}
+/**
+* A driver command's line, `["<domain>", "<subcommand>", …]`, with its
+* switches' values resolved by {@link resolveSwitchValues} against the
+* command's spec: what `runPluginCommand` hands every parser after it, so a
+* permissive one never reads `--allow-destructive=false` as on. A command with
+* no spec here comes back as it was.
+*/
+function resolveDriverSwitches(domain, subcommand, args) {
+	const spec = subcommand ? DRIVER_FLAG_SPECS[`${domain} ${subcommand}`] : void 0;
+	if (!spec) return [...args];
+	return [...args.slice(0, 2), ...resolveSwitchValues({
+		...RELAYED_FLAGS,
+		...spec
+	}, args.slice(2), `${domain} ${subcommand}`, domain)];
+}
+/**
+* The argument `arg` refused as undeclared, whole, or `null` for any other
+* failure.
+*
+* arg's wording is `unknown or unexpected option: --targt-db`, naming the
+* argument up to its first `=`. An argument with a space in it is named past
+* the space too, so the match runs to the end of the message; and the word
+* in `argv` it came from is returned, `=` and all, so a refusal that quotes it
+* quotes what was typed.
+*/
+function unknownFlagIn(err, argv) {
+	if (!(err instanceof Error) || !("code" in err) || err.code !== "ARG_UNKNOWN_OPTION") return null;
+	const named = /option: ([\s\S]+)$/.exec(err.message)?.[1];
+	if (named === void 0) return null;
+	return argv.find((word) => word === named || word.startsWith(`${named}=`)) ?? named;
+}
+/**
+* The word in `known` that `typed` was probably meant to be: one edit away
+* (`--targt-db`), or two neighbouring letters swapped (`--clena`, `--froce`),
+* which `suggestNearMiss` counts as two edits and so never offers.
+*/
+function closestWord(typed, known) {
+	return suggestNearMiss(known, typed) ?? transposedFrom(known, typed);
+}
+function transposedFrom(known, typed) {
+	return known.find((candidate) => {
+		if (candidate.length !== typed.length || candidate === typed) return false;
+		const differ = [...candidate].flatMap((letter, index) => letter === typed[index] ? [] : [index]);
+		return differ.length === 2 && differ[1] === differ[0] + 1 && candidate[differ[0]] === typed[differ[1]] && candidate[differ[1]] === typed[differ[0]];
+	});
+}
+/**
+* Parse a command that owns its argument handling, refusing what it does not
+* declare.
+*
+* `db backup`, `db restore` and `db backups list` parsed permissively, so an
+* undeclared flag became a positional and was ignored: `db restore <dump>
+* --targt-db x --create-db --yes` dropped the misspelled target and restored
+* into the live database. A typo is refused here before anything runs, naming
+* the declared flag it is one edit from, or every flag the command takes when
+* none is that close.
+*
+* @param argv the words after the command, e.g. `rawArgs.slice(2)`.
+* @param command the command as typed, for the message: `"db restore"`.
+*/
+function parseCommandFlags(spec, argv, command) {
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	try {
+		return (0, import_arg.default)(full, { argv: resolveSwitchValues(full, argv, command) });
+	} catch (err) {
+		const unknown = unknownFlagIn(err, argv);
+		if (unknown === null) throw err;
+		throw new Error(unknownOptionSentence(command, command, unknown, spec));
+	}
+}
+//#endregion
+//#region src/branch-argv.ts
+/**
+* Argument shapes for `rebase db branch`, with no runtime dependencies.
+*
+* Its own module for the same reason `schema/atlas-argv.ts` is: `cli.ts` pulls
+* in chalk, execa and the driver runtime, so a unit test that imports it cannot
+* run. Argv parsing is the part most worth testing and the part least in need
+* of any of that.
+*/
+/**
+* The flags each driver-side `db branch` action takes, besides the ones the CLI
+* relays on every line (`--database-url`, `--docker`, `--debug`).
+*
+* `switch` is absent: the CLI answers it before the driver is ever spawned.
+* An action not listed here is not checked, so the dispatch can say it does
+* not exist in its own words.
+*/
+var BRANCH_ACTION_FLAGS = {
+	create: {
+		"--from": String,
+		"--force": Boolean
+	},
+	list: {},
+	info: {},
+	diff: {
+		"--json": Boolean,
+		"--sample-limit": Number
+	},
+	delete: {
+		"--force": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	},
+	prune: {
+		"--older-than": String,
+		"--include-dev-diff": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	}
+};
+/**
+* Refuse a flag `action` does not take, naming the one it was probably meant
+* to be — the same sentence `db backup` and `db restore` say.
+*
+* Throws: the driver's entry turns a thrown error into one red line and exit 1,
+* and this runs before anything connects.
+*/
+function assertKnownBranchFlags(action, rest) {
+	const spec = BRANCH_ACTION_FLAGS[action];
+	if (!spec) return;
+	const full = {
+		...RELAYED_FLAGS,
+		...spec
+	};
+	const argv = resolveSwitchValues(full, rest, `db branch ${action}`, "db branch");
+	try {
+		(0, import_arg.default)(full, { argv });
+	} catch (error) {
+		const unknown = unknownFlagIn(error, rest);
+		if (unknown === null) throw error;
+		throw new Error(unknownOptionSentence(`db branch ${action}`, "db branch", unknown, spec));
 	}
 }
+/**
+* A `db branch` line, `["db", "branch", <action>, …]`, with its switches'
+* values resolved against the action's flags (see `resolveSwitchValues`):
+* what the branch dispatch reads, so `prune --yes=false` is not a yes. An
+* action the table does not list comes back as it was.
+*/
+function resolveBranchSwitches(rawArgs) {
+	const action = rawArgs[2];
+	const spec = action === void 0 ? void 0 : BRANCH_ACTION_FLAGS[action];
+	if (!spec) return [...rawArgs];
+	return [...rawArgs.slice(0, 3), ...resolveSwitchValues({
+		...RELAYED_FLAGS,
+		...spec
+	}, rawArgs.slice(3), `db branch ${action}`, "db branch")];
+}
+/**
+* Words on a `db branch` command line that no argument accounts for.
+*
+* `rebase db branch create alpha beta` created a branch called `alpha` and
+* threw `beta` away without a word. The shapes that produces are all quiet and
+* all wrong: an unquoted name (`create my feature` → `my`), a flag written
+* without its dashes (`create feat from main` → `feat`), a shell that split
+* something you thought was one token. In each case the command succeeds and
+* the branch is not the one asked for — and branch names are the thing you
+* later type to switch, delete, or point a deploy at.
+*
+* A flag the action does not take is refused outright, by throwing — see
+* {@link BRANCH_ACTION_FLAGS}. It was let through on the reasoning that a
+* subcommand added later might take flags this file had never heard of; what
+* that bought was every typo running without the flag it meant:
+* `prune --older-then 1d --yes` pruned by no age, `create x --froce` ran
+* without --force. A new action gets its line in the table. The value after a
+* flag that takes one is skipped: it is that flag's argument, not a stray word.
+*
+* @param words The command's own arguments: action, name, then the rest.
+*/
+function unexpectedBranchArgs(words) {
+	if (words[0]) assertKnownBranchFlags(words[0], words.slice(1));
+	const extras = [];
+	let seenName = false;
+	for (let index = 1; index < words.length; index += 1) {
+		const word = words[index];
+		if (word.startsWith("-")) {
+			if (TAKES_A_VALUE.has(word.split("=")[0])) index += 1;
+			continue;
+		}
+		if (!seenName) {
+			seenName = true;
+			continue;
+		}
+		extras.push(word);
+	}
+	return extras;
+}
+/**
+* Branch-line flags whose next word belongs to them.
+*
+* `--from` was the only one listed, and `--database-url` is the one that bit:
+* `rebase db branch list --database-url postgres://…` — which the CLI itself
+* appends when the checkout is on a branch, so `rebase.branches` is read in the
+* parent where it lives — answered `✗ Unexpected argument: postgres://…`. The
+* `=` form carries its value in the same word and needs no skip.
+*/
+var TAKES_A_VALUE = /* @__PURE__ */ new Set([
+	"--from",
+	"--older-than",
+	"--sample-limit",
+	"--database-url"
+]);
+//#endregion
+//#region src/backup-argv.ts
+/**
+* @param rawArgs the driver's whole line, `["db", "backup", …]`.
+*/
+function backupActionOf(rawArgs) {
+	return rawArgs[2] === "list" ? "list" : "create";
+}
+//#endregion
+//#region src/db-subcommands.ts
+/**
+* The `db` subcommands this driver dispatches, with no runtime dependencies.
+*
+* Its own module so the dispatch in `cli.ts` can name them without loading
+* what judges their lines (`db-command-line.ts` reaches the backup module,
+* which `cli.ts` imports only when a backup command runs).
+*/
+var DRIVER_DB_SUBCOMMANDS = [
+	"push",
+	"generate",
+	"migrate",
+	"branch",
+	"backup",
+	"restore",
+	"backups"
+];
+/** Is `word` a `db` subcommand this driver answers? */
+function isDriverDbSubcommand(word) {
+	return DRIVER_DB_SUBCOMMANDS.some((subcommand) => subcommand === word);
+}
+//#endregion
+//#region src/schema/migrate-baseline.ts
+/**
+* What `rebase db migrate --baseline <version>` does, given the history the
+* database already has.
+*
+* The flag promises to record `<version>` as applied and migrate from the next
+* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
+* database with no revision history: once one row exists it ignores the flag
+* without a word, applies the migration anyway, and the CLI had already printed
+* "Recording … as already applied". That is the normal second time: a project
+* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
+* the migration for it, and `db migrate` fails on `column … already exists
+* (42701)` however the baseline is spelled.
+*
+* So the history is read first. With none, Atlas's baseline does the work.
+* Behind `<version>`, `atlas migrate set` marks every migration up to it as
+* applied, which is what a baseline means. At or past it, there is nothing to
+* record, and the command says so instead of claiming it recorded something.
+*/
+/**
+* Atlas's version order for the versions Rebase writes: numeric timestamps,
+* compared as numbers so a shorter one is not read as later; anything else as
+* text.
+*/
+function compareMigrationVersions(a, b) {
+	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
+		const x = BigInt(a);
+		const y = BigInt(b);
+		return x === y ? 0 : x < y ? -1 : 1;
+	}
+	return a.localeCompare(b);
+}
+/**
+* The version Atlas records for a migration file: its numeric prefix
+* (`20260906101530_init.sql` → `20260906101530`), or the name without `.sql`.
+*/
+function migrationVersionOf(file) {
+	return /^(\d+)/.exec(file)?.[1] ?? file.replace(/\.sql$/, "");
+}
+/** How many versions a refused baseline names, newest last. */
+var VERSIONS_NAMED = 5;
+/**
+* Why `--baseline <version>` cannot run, or `null` when it names a migration
+* file in `drizzle/migrations`.
+*
+* Asked before anything else, the database included. A version no file has
+* was refused only by Atlas, after the command had said "Marking every
+* migration up to abc as applied…"; and one older than every file read
+* "Nothing to record" and migrated on, though it named nothing to baseline.
+*
+* @param files the migration files, sorted oldest first.
+* @returns the refusal, its first line the error and the rest the detail.
+*/
+function baselineVersionProblem(version, files) {
+	const versions = files.map(migrationVersionOf);
+	if (versions.length === 0) return `--baseline ${version}: There are no migrations in drizzle/migrations to baseline. Nothing was run.\nRun \`rebase db generate\` to write the first one.`;
+	if (versions.includes(version)) return null;
+	const named = versions.slice(-5).join(", ");
+	return `--baseline ${version} names no migration in drizzle/migrations. Nothing was run.\n${versions.length > VERSIONS_NAMED ? `The newest ${VERSIONS_NAMED} of the ${versions.length} versions there` : "The versions there"}: ${named}. A baseline is one of them: the newest migration the database already holds.`;
+}
+/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
+function planBaseline(version, latestRecorded) {
+	if (latestRecorded === null) return { kind: "atlas-baseline" };
+	if (compareMigrationVersions(version, latestRecorded) > 0) return {
+		kind: "set",
+		latest: latestRecorded
+	};
+	return {
+		kind: "already-recorded",
+		latest: latestRecorded
+	};
+}
+/** What the command says before it migrates, for each plan. */
+function describeBaselinePlan(version, plan) {
+	switch (plan.kind) {
+		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
+		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
+		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
+	}
+}
+/**
+* The newest version Atlas has recorded on this database, or `null` when it
+* has recorded none (no revisions table yet included).
+*
+* The table is `rebase.atlas_schema_revisions`: the CLI passes
+* `--revisions-schema rebase` to every `migrate apply`.
+*/
+async function latestRecordedMigration(databaseUrl) {
+	return withAppClient(databaseUrl, async (client) => {
+		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
+		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
+		if (versions.length === 0) return null;
+		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
+	});
+}
 //#endregion
-export { rls_bootstrap_sql_exports as a, rlsRuntimeIsCurrent as i, RLS_BOOTSTRAP_STATEMENTS as n, execa as o, dropLegacyAuthSchema as r, RLS_BOOTSTRAP_SQL as t };
+export { rlsRuntimeIsCurrent as C, dropLegacyAuthSchema as S, execa as T, parseCommandFlags as _, migrationVersionOf as a, RLS_BOOTSTRAP_SQL as b, isDriverDbSubcommand as c, resolveBranchSwitches as d, unexpectedBranchArgs as f, collectionsPathIn as g, closestWord as h, latestRecordedMigration as i, backupActionOf as l, assertKnownFlags as m, compareMigrationVersions as n, planBaseline as o, RELAYED_FLAGS as p, describeBaselinePlan as r, DRIVER_DB_SUBCOMMANDS as s, baselineVersionProblem as t, assertKnownBranchFlags as u, parseDriverLine as v, rls_bootstrap_sql_exports as w, RLS_BOOTSTRAP_STATEMENTS as x, resolveDriverSwitches as y };
 
-//# sourceMappingURL=rls-bootstrap-sql-Bd-hJk08.js.map
+//# sourceMappingURL=migrate-baseline-B-2Ef4Mv.js.map