@rebasepro/server-postgres 0.25.0 → 0.26.0

package/dist/cli.js

@@ -1,12 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { i as __toESM } from "./rolldown-runtime-V7rFbMRe.js";
-import { A as getUndeclaredConstraintExcludes, B as withAppClient, C as dropDevDatabase, D as getSearchExcludes, E as getForeignIndexExcludes, F as queryUndeclarableConstraints, G as prepareGeneratedSqlDir, H as DESIRED_STATE_URL, I as readSearchDdl, J as detectDestructiveStatements, K as decidePushSafety, L as readTriggersDdl, M as loadCollectionsForCli, N as queryColumnTypes, O as getTableExcludes, P as queryGeneratedColumnDependencies, Q as forAtlas, R as readVectorDdl, S as diagnoseMissingBin, T as ensureDevDatabaseExists, U as GENERATED_SQL_DIR, V as workspaceMemberDir, W as generatedSqlDir, X as fromAlterTable, Y as extractPlanStatements, Z as isSyncedPlan, _ as closeAppClients, a as diagnoseDbError, b as describeReinstallCommand, c as isEconnrefused, d as reportCommandFailure, et as redactConnectionPasswords, f as ExcludeIntrospectionError, g as atlasDevDatabaseUrl, h as applyVectorDdl, i as diagnoseAtlasFailure, j as getVectorExcludes, k as getTriggerExcludes, l as isSslNotEnabled, m as applyTriggersDdl, o as formatForeignGeneratedColumnBanner, p as applySearchDdl, q as destructiveOptInFlag, s as isAuthFailure, t as checkDatabaseConnectivity, v as describeBuildScriptRemedy, w as dropGeneratedColumns, x as detectProjectPackageManager, y as describeDevAddCommand, z as resolveLocalBin } from "./cli-errors-DwQnNATs.js";
-import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-Bv5KPeIx.js";
-import { t as nextStepAfterDbGenerate } from "./generate-next-step-DCeS4LrJ.js";
-import { o as execa, r as dropLegacyAuthSchema, t as RLS_BOOTSTRAP_SQL } from "./rls-bootstrap-sql-Bd-hJk08.js";
-import { n as require_arg, t as promptConfirm } from "./cli-prompt-egtNKkZl.js";
-import { i as collectionsPathIn, n as assertKnownFlags, o as parseDriverLine, r as closestWord, t as RELAYED_FLAGS } from "./cli-flags-D-b0qL9T.js";
+import { n as require_arg, o as __toESM, t as promptConfirm } from "./cli-prompt-DXG0yk-h.js";
+import { $ as forAtlas, A as getUndeclaredConstraintExcludes, B as withAppClient, C as dropDevDatabase, D as getSearchExcludes, E as getForeignIndexExcludes, F as queryUndeclarableConstraints, G as prepareGeneratedSqlDir, H as DESIRED_STATE_URL, I as readSearchDdl, J as detectDestructiveStatements, K as decidePushSafety, L as readTriggersDdl, M as loadCollectionsForCli, N as queryColumnTypes, O as getTableExcludes, P as queryGeneratedColumnDependencies, Q as warnIfYesApprovedDestructive, R as readVectorDdl, S as diagnoseMissingBin, T as ensureDevDatabaseExists, U as GENERATED_SQL_DIR, V as workspaceMemberDir, W as generatedSqlDir, X as fromAlterTable, Y as extractPlanStatements, Z as isSyncedPlan, _ as closeAppClients, a as diagnoseDbError, b as describeReinstallCommand, c as isEconnrefused, d as reportCommandFailure, f as ExcludeIntrospectionError, g as atlasDevDatabaseUrl, h as applyVectorDdl, i as diagnoseAtlasFailure, j as getVectorExcludes, k as getTriggerExcludes, l as isSslNotEnabled, m as applyTriggersDdl, o as formatForeignGeneratedColumnBanner, p as applySearchDdl, q as destructiveOptInFlag, s as isAuthFailure, t as checkDatabaseConnectivity, tt as redactConnectionPasswords, v as describeBuildScriptRemedy, w as dropGeneratedColumns, x as detectProjectPackageManager, y as describeDevAddCommand, z as resolveLocalBin } from "./cli-errors-DsYyNYzd.js";
+import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-fZb92pN8.js";
+import { t as nextStepAfterDbGenerate } from "./generate-next-step-DgK5BlBn.js";
+import { S as dropLegacyAuthSchema, T as execa, b as RLS_BOOTSTRAP_SQL, c as isDriverDbSubcommand, d as resolveBranchSwitches, f as unexpectedBranchArgs, g as collectionsPathIn, i as latestRecordedMigration, l as backupActionOf, m as assertKnownFlags, o as planBaseline, r as describeBaselinePlan, s as DRIVER_DB_SUBCOMMANDS, t as baselineVersionProblem, v as parseDriverLine, y as resolveDriverSwitches } from "./migrate-baseline-B-2Ef4Mv.js";
 import { formatRelativeTime } from "@rebasepro/utils";
 import path from "path";
 import fs from "fs";
@@ -892,102 +890,6 @@ var CommandStopped = class extends Error {
 	}
 };
 //#endregion
-//#region src/schema/migrate-baseline.ts
-/**
-* What `rebase db migrate --baseline <version>` does, given the history the
-* database already has.
-*
-* The flag promises to record `<version>` as applied and migrate from the next
-* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
-* database with no revision history: once one row exists it ignores the flag
-* without a word, applies the migration anyway, and the CLI had already printed
-* "Recording … as already applied". That is the normal second time: a project
-* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
-* the migration for it, and `db migrate` fails on `column … already exists
-* (42701)` however the baseline is spelled.
-*
-* So the history is read first. With none, Atlas's baseline does the work.
-* Behind `<version>`, `atlas migrate set` marks every migration up to it as
-* applied, which is what a baseline means. At or past it, there is nothing to
-* record, and the command says so instead of claiming it recorded something.
-*/
-/**
-* Atlas's version order for the versions Rebase writes: numeric timestamps,
-* compared as numbers so a shorter one is not read as later; anything else as
-* text.
-*/
-function compareMigrationVersions(a, b) {
-	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
-		const x = BigInt(a);
-		const y = BigInt(b);
-		return x === y ? 0 : x < y ? -1 : 1;
-	}
-	return a.localeCompare(b);
-}
-/**
-* The version Atlas records for a migration file: its numeric prefix
-* (`20260906101530_init.sql` → `20260906101530`), or the name without `.sql`.
-*/
-function migrationVersionOf(file) {
-	return /^(\d+)/.exec(file)?.[1] ?? file.replace(/\.sql$/, "");
-}
-/** How many versions a refused baseline names, newest last. */
-var VERSIONS_NAMED = 5;
-/**
-* Why `--baseline <version>` cannot run, or `null` when it names a migration
-* file in `drizzle/migrations`.
-*
-* Asked before anything else, the database included. A version no file has
-* was refused only by Atlas, after the command had said "Marking every
-* migration up to abc as applied…"; and one older than every file read
-* "Nothing to record" and migrated on, though it named nothing to baseline.
-*
-* @param files the migration files, sorted oldest first.
-* @returns the refusal, its first line the error and the rest the detail.
-*/
-function baselineVersionProblem(version, files) {
-	const versions = files.map(migrationVersionOf);
-	if (versions.length === 0) return `--baseline ${version}: There are no migrations in drizzle/migrations to baseline. Nothing was run.\nRun \`rebase db generate\` to write the first one.`;
-	if (versions.includes(version)) return null;
-	const named = versions.slice(-5).join(", ");
-	return `--baseline ${version} names no migration in drizzle/migrations. Nothing was run.\n${versions.length > VERSIONS_NAMED ? `The newest ${VERSIONS_NAMED} of the ${versions.length} versions there` : "The versions there"}: ${named}. A baseline is one of them: the newest migration the database already holds.`;
-}
-/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
-function planBaseline(version, latestRecorded) {
-	if (latestRecorded === null) return { kind: "atlas-baseline" };
-	if (compareMigrationVersions(version, latestRecorded) > 0) return {
-		kind: "set",
-		latest: latestRecorded
-	};
-	return {
-		kind: "already-recorded",
-		latest: latestRecorded
-	};
-}
-/** What the command says before it migrates, for each plan. */
-function describeBaselinePlan(version, plan) {
-	switch (plan.kind) {
-		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
-		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
-		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
-	}
-}
-/**
-* The newest version Atlas has recorded on this database, or `null` when it
-* has recorded none (no revisions table yet included).
-*
-* The table is `rebase.atlas_schema_revisions`: the CLI passes
-* `--revisions-schema rebase` to every `migrate apply`.
-*/
-async function latestRecordedMigration(databaseUrl) {
-	return withAppClient(databaseUrl, async (client) => {
-		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
-		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
-		if (versions.length === 0) return null;
-		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
-	});
-}
-//#endregion
 //#region src/cli-push.ts
 /**
 * Apply a planned push.
@@ -1072,121 +974,6 @@ async function applyPoliciesFile(client, policiesSql, stamping) {
 	};
 }
 //#endregion
-//#region src/branch-argv.ts
-/**
-* Argument shapes for `rebase db branch`, with no runtime dependencies.
-*
-* Its own module for the same reason `schema/atlas-argv.ts` is: `cli.ts` pulls
-* in chalk, execa and the driver runtime, so a unit test that imports it cannot
-* run. Argv parsing is the part most worth testing and the part least in need
-* of any of that.
-*/
-/**
-* The flags each driver-side `db branch` action takes, besides the ones the CLI
-* relays on every line (`--database-url`, `--docker`, `--debug`).
-*
-* `switch` is absent: the CLI answers it before the driver is ever spawned.
-* An action not listed here is not checked, so the dispatch can say it does
-* not exist in its own words.
-*/
-var BRANCH_ACTION_FLAGS = {
-	create: {
-		"--from": String,
-		"--force": Boolean
-	},
-	list: {},
-	info: {},
-	delete: {
-		"--force": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	},
-	prune: {
-		"--older-than": String,
-		"--include-dev-diff": Boolean,
-		"--yes": Boolean,
-		"-y": "--yes"
-	}
-};
-/**
-* Refuse a flag `action` does not take, naming the one it was probably meant
-* to be — the same sentence `db backup` and `db restore` say.
-*
-* Throws: the driver's entry turns a thrown error into one red line and exit 1,
-* and this runs before anything connects.
-*/
-function assertKnownBranchFlags(action, rest) {
-	const spec = BRANCH_ACTION_FLAGS[action];
-	if (!spec) return;
-	const full = {
-		...RELAYED_FLAGS,
-		...spec
-	};
-	try {
-		(0, import_arg.default)(full, { argv: [...rest] });
-	} catch (error) {
-		if (!(error instanceof Error) || !("code" in error) || error.code !== "ARG_UNKNOWN_OPTION") throw error;
-		const typed = (/option: (\S+)$/.exec(error.message)?.[1] ?? error.message).split("=")[0];
-		const suggestion = closestWord(typed, Object.keys(full).filter((flag) => flag.startsWith("--")));
-		const own = Object.keys(spec).filter((flag) => flag.startsWith("--"));
-		const takes = own.length > 0 ? `it takes ${own.join(", ")}` : "it takes no options of its own";
-		throw new Error(`\`rebase db branch ${action}\` has no option ${typed}` + (suggestion ? ` — did you mean ${suggestion}?` : ` — ${takes}.`) + " Nothing was run. See `rebase db branch --help`.");
-	}
-}
-/**
-* Words on a `db branch` command line that no argument accounts for.
-*
-* `rebase db branch create alpha beta` created a branch called `alpha` and
-* threw `beta` away without a word. The shapes that produces are all quiet and
-* all wrong: an unquoted name (`create my feature` → `my`), a flag written
-* without its dashes (`create feat from main` → `feat`), a shell that split
-* something you thought was one token. In each case the command succeeds and
-* the branch is not the one asked for — and branch names are the thing you
-* later type to switch, delete, or point a deploy at.
-*
-* A flag the action does not take is refused outright, by throwing — see
-* {@link BRANCH_ACTION_FLAGS}. It was let through on the reasoning that a
-* subcommand added later might take flags this file had never heard of; what
-* that bought was every typo running without the flag it meant:
-* `prune --older-then 1d --yes` pruned by no age, `create x --froce` ran
-* without --force. A new action gets its line in the table. The value after a
-* flag that takes one is skipped: it is that flag's argument, not a stray word.
-*
-* @param words The command's own arguments: action, name, then the rest.
-*/
-function unexpectedBranchArgs(words) {
-	if (words[0]) assertKnownBranchFlags(words[0], words.slice(1));
-	const extras = [];
-	let seenName = false;
-	for (let index = 1; index < words.length; index += 1) {
-		const word = words[index];
-		if (word.startsWith("-")) {
-			if (TAKES_A_VALUE.has(word.split("=")[0])) index += 1;
-			continue;
-		}
-		if (!seenName) {
-			seenName = true;
-			continue;
-		}
-		extras.push(word);
-	}
-	return extras;
-}
-/**
-* Branch-line flags whose next word belongs to them.
-*
-* `--from` was the only one listed, and `--database-url` is the one that bit:
-* `rebase db branch list --database-url postgres://…` — which the CLI itself
-* appends when the checkout is on a branch, so `rebase.branches` is read in the
-* parent where it lives — answered `✗ Unexpected argument: postgres://…`. The
-* `=` form carries its value in the same word and needs no skip.
-*/
-var TAKES_A_VALUE = /* @__PURE__ */ new Set([
-	"--from",
-	"--older-than",
-	"--database-url"
-]);
-//#endregion
 //#region src/cli-collections-path.ts
 /**
 * `--collections <dir>`, checked once, before anything is written.
@@ -1263,14 +1050,6 @@ function assertCollectionsPathExists(typed) {
 	throw new CollectionsPathMissing(typed, resolved);
 }
 //#endregion
-//#region src/backup-argv.ts
-/**
-* @param rawArgs the driver's whole line, `["db", "backup", …]`.
-*/
-function backupActionOf(rawArgs) {
-	return rawArgs[2] === "list" ? "list" : "create";
-}
-//#endregion
 //#region src/branch-prune.ts
 /**
 * The variable the CLI hands the driver the database its checkout is switched
@@ -1426,7 +1205,7 @@ function generatesInProcess() {
 async function generateInProcess(what, label, run) {
 	let generators;
 	try {
-		generators = await import("./generate-files-ClmOUHXj.js").then((n) => n.t);
+		generators = await import("./generate-files-BP-4W_gm.js").then((n) => n.t);
 	} catch (err) {
 		outError(chalk.red(`✗ Failed to run ${what}: ${err instanceof Error ? err.message : String(err)}`));
 		process.exit(1);
@@ -1466,13 +1245,14 @@ async function runPluginCommand(args) {
 	const domain = args[0];
 	const subcommand = args[1];
 	assertKnownFlags(domain, subcommand, args);
+	args = resolveDriverSwitches(domain, subcommand, args);
 	assertCollectionsPathExists(collectionsPathIn(args));
 	try {
 		if (domain === "db") await scratchDatabase.around(() => dbCommand(subcommand, args));
 		else if (domain === "schema") await schemaCommand(subcommand, args);
 		else if (domain === "doctor") await doctorPluginCommand(args);
 		else if (domain === "console") {
-			const { consoleCommand } = await import("./cli-console-DQ_K-sdM.js");
+			const { consoleCommand } = await import("./cli-console-f0k6_TsJ.js");
 			process.exitCode = await consoleCommand(args);
 		} else {
 			outError(chalk.red(`Unknown domain command: ${domain}`));
@@ -1623,17 +1403,8 @@ var DB_FLAGS = {
 	"-y": "--yes"
 };
 async function dbCommand(subcommand, rawArgs) {
-	const VALID_ACTIONS = [
-		"push",
-		"generate",
-		"migrate",
-		"branch",
-		"backup",
-		"restore",
-		"backups"
-	];
-	if (!subcommand || !VALID_ACTIONS.includes(subcommand)) {
-		outError(chalk.red(`Unknown db command. Valid: ${VALID_ACTIONS.join(", ")}`));
+	if (!isDriverDbSubcommand(subcommand)) {
+		outError(chalk.red(`Unknown db command. Valid: ${DRIVER_DB_SUBCOMMANDS.join(", ")}`));
 		process.exit(1);
 	}
 	if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
@@ -1648,7 +1419,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-B2CAn9fR.js");
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-PoRG-zEq.js").then((n) => n.t);
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1695,7 +1466,7 @@ async function dbCommand(subcommand, rawArgs) {
 				}
 				const searchContent = readSearchDdl();
 				if (searchContent) {
-					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-4eUP4t8w.js").then((n) => n.o);
+					const { searchColumnDependencies } = await import("./generate-postgres-ddl-logic-DPl1oH_z.js").then((n) => n.o);
 					const migrationConflicts = findGeneratedColumnConflicts(parseColumnMutations(migrationContent), searchColumnDependencies(await loadCollectionsForCli(collectionsPath)));
 					const preamble = migrationDropPreamble(migrationConflicts);
 					if (preamble) {
@@ -1769,6 +1540,7 @@ async function dbCommand(subcommand, rawArgs) {
 			if (databaseUrl && !dryRun) await ensureAuthSchemaAndFunctions(databaseUrl);
 			if (databaseUrl) await renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun);
 			const prebuilt = databaseUrl ? await prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) : [];
+			if (databaseUrl) await keepDatabaseOwnedDefaults(databaseUrl, collectionsPath);
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
@@ -1833,6 +1605,7 @@ async function dbCommand(subcommand, rawArgs) {
 					for (const line of destructiveLines(destructive)) outWarn(line);
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
+					outWarn(chalk.gray("  (`--yes` still approves them in this release, with a deprecation warning; from the next it will not.)"));
 					outWarn("");
 				}
 				out(chalk.gray("  The auth schema step was skipped, because it writes. A real push runs it first."));
@@ -1867,7 +1640,10 @@ async function dbCommand(subcommand, rawArgs) {
 						out(chalk.gray("  Aborted. No changes were made."));
 						throw new CommandStopped("The destructive push was declined.");
 					}
-				} else outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
+				} else {
+					outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
+					warnIfYesApprovedDestructive(optIn, destructive.length);
+				}
 			}
 			if (policyPlan?.summary) {
 				out(chalk.gray(policyPlan.summary));
@@ -1958,6 +1734,8 @@ async function dbCommand(subcommand, rawArgs) {
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
+				const { stampMigratedPolicies } = await import("./migrate-policy-stamps-BQtFHApx.js");
+				await stampMigratedPolicies(databaseUrl, collectionsPath);
 			}
 		}
 		out("");
@@ -1975,12 +1753,43 @@ async function dbCommand(subcommand, rawArgs) {
 *
 * @returns `schema.index` of each one missing when this started.
 */
+/**
+* Appends to `schema.sql` the live DEFAULT of every column declared
+* `databaseDefault: true`, so Atlas plans no `DROP DEFAULT` for it.
+*
+* Fails CLOSED, like the exclude lists: without the catalogue the desired state
+* says "no DEFAULT", and the push would drop each of them. A project declaring
+* no such column reads nothing.
+*/
+async function keepDatabaseOwnedDefaults(databaseUrl, collectionsPath) {
+	const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+	const { databaseOwnedDefaultColumns, readKeptDefaults, withKeptDefaults } = await import("./push-kept-defaults-BGOlOqRQ.js");
+	const columns = databaseOwnedDefaultColumns(await loadCollections(path.resolve(process.cwd(), collectionsPath)));
+	if (columns.length === 0) return;
+	let kept;
+	try {
+		kept = await withAppClient(databaseUrl, (client) => readKeptDefaults({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, columns));
+	} catch (err) {
+		outError(chalk.red("\n✗ Aborting push: could not read the DEFAULTs of the columns declared `databaseDefault: true`."));
+		outError(chalk.gray(`  ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("  Refusing to plan without them: the push would drop each of those DEFAULTs."));
+		const hint = diagnoseDbError(err, databaseUrl);
+		if (hint) outError(hint);
+		throw new CommandStopped("Could not read the DEFAULTs to keep.");
+	}
+	if (kept.length === 0) return;
+	const desiredSqlFile = path.join(generatedSqlDir(), "schema.sql");
+	fs.writeFileSync(desiredSqlFile, withKeptDefaults(fs.readFileSync(desiredSqlFile, "utf-8"), kept));
+	out(chalk.gray(`  Keeping ${kept.length} DEFAULT(s) the database holds, for columns declared \`databaseDefault: true\`:`));
+	for (const each of kept) out(chalk.gray(`       ${each.table}.${each.column}  DEFAULT ${each.expression}`));
+	out("");
+}
 /** Renames relation columns that carry their pre-0.13 derived name, as boot does; a dry-run only names them. */
 async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 	let renames;
 	try {
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-BqJut4F3.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-BwaKi8xF.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1999,8 +1808,8 @@ async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 /** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
 async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 	try {
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-CUlUlRkO.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-PcPW65xy.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
@@ -2009,8 +1818,8 @@ async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	let missing;
 	try {
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-DIequ4bV.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-UTvB5pqH.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -2020,7 +1829,7 @@ async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	if (missing.length === 0 || dryRun) return names;
 	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
 	try {
-		const { buildDeferredIndexes } = await import("./deferred-index-build-Cis_HoGn.js").then((n) => n.r);
+		const { buildDeferredIndexes } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
 			dedicated: true,
 			query: async (text) => ({ rows: (await client.query(text)).rows }),
@@ -2068,9 +1877,9 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 	let unsecured;
 	let userRole;
 	try {
-		const { lockCollectionTables } = await import("./ensure-collection-policies-CCqayoUz.js");
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		userRole = (await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const { lockCollectionTables } = await import("./ensure-collection-policies-DLWgabQ2.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-BOHuHVlc.js").then((n) => n.l)).REBASE_USER_ROLE;
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
 	} catch (err) {
@@ -2105,8 +1914,8 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-Dpgwx5sy.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-4nA-tfwi.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
@@ -2126,7 +1935,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-D7P4-ZYX.js").then((n) => n.c);
+		rls = await import("./rls-enforcement-BOHuHVlc.js").then((n) => n.l);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -2186,10 +1995,10 @@ async function applyPolicies(databaseUrl, collectionsPath) {
 */
 async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 	try {
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-4eUP4t8w.js").then((n) => n.o);
-		const { policyStampSql } = await import("./ensure-collection-policies-CCqayoUz.js");
-		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-DPl1oH_z.js").then((n) => n.o);
+		const { policyStampSql } = await import("./ensure-collection-policies-DLWgabQ2.js");
+		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		return {
 			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
 			searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public"
@@ -2206,9 +2015,9 @@ async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 */
 async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 	try {
-		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-CvX8hiPb.js");
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-		const { pinSearchPath } = await import("./connection-C938nR3E.js").then((n) => n.n);
+		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-DQ2tWceD.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const plan = await withAppClient(databaseUrl, (client) => planPolicyPush({ query: async (text, values) => ({ rows: (await client.query(text, values)).rows }) }, collections, { searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public" }));
 		return {
@@ -2235,8 +2044,8 @@ async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 */
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
-		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-vm0BcvcE.js").then((n) => n.s);
-		const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
+		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-X4A-xAzv.js").then((n) => n.s);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
@@ -2279,6 +2088,8 @@ var BRANCH_FLAGS = {
 	"--older-than": String,
 	"--include-dev-diff": Boolean,
 	"--from": String,
+	"--json": Boolean,
+	"--sample-limit": Number,
 	"--yes": Boolean,
 	"-y": "--yes"
 };
@@ -2294,13 +2105,14 @@ async function branchCommand(rawArgs) {
 		return;
 	}
 	const extras = unexpectedBranchArgs(rawArgs.slice(2));
+	rawArgs = resolveBranchSwitches(rawArgs);
 	if (extras.length > 0) {
 		outError("");
-		outError(chalk.red(`  ✗ Unexpected argument${extras.length > 1 ? "s" : ""}: ${extras.join(" ")}`));
+		outError(chalk.red(`  ✗ Unexpected argument${extras.length > 1 ? "s" : ""}: ${redactConnectionPasswords(extras.join(" "))}`));
 		outError("");
 		outError(chalk.gray(`  ${chalk.bold("rebase db branch")} takes one name. A branch name may contain letters,`));
 		outError(chalk.gray("  digits, underscores and hyphens — no spaces."));
-		if (rawArgs[3]) outError(chalk.gray(`  Did you mean: ${chalk.cyan(`rebase db branch ${branchAction} ${[rawArgs[3], ...extras].join("-")}`)}`));
+		if (rawArgs[3]) outError(chalk.gray(`  Did you mean: ${chalk.cyan(redactConnectionPasswords(`rebase db branch ${branchAction} ${[rawArgs[3], ...extras].join("-")}`))}`));
 		outError("");
 		process.exit(1);
 	}
@@ -2318,8 +2130,8 @@ async function branchCommand(rawArgs) {
 		outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
 		process.exit(1);
 	}
-	const { DatabasePoolManager } = await import("./databasePoolManager-Yqdw14wY.js").then((n) => n.n);
-	const { BranchService, reopenClosedDatabases, reopenedDatabasesNotice } = await import("./BranchService-iXXZeVYD.js").then((n) => n.n);
+	const { DatabasePoolManager } = await import("./databasePoolManager-3stMNFL-.js").then((n) => n.n);
+	const { BranchService, reopenClosedDatabases, reopenedDatabasesNotice } = await import("./BranchService-CWBnDhcv.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const healed = await reopenClosedDatabases(databaseUrl, [branchAction === "create" ? createSource(rawArgs) : void 0, process.env[ACTIVE_BRANCH_DATABASE_ENV]]);
@@ -2417,6 +2229,41 @@ async function branchCommand(rawArgs) {
 				out("");
 				break;
 			}
+			case "diff": {
+				const name = rawArgs[3];
+				if (!name || name.startsWith("-")) {
+					outError(chalk.red("✗ Branch name is required."));
+					out(chalk.gray("  Usage: rebase db branch diff <name> [--json] [--sample-limit <n>]"));
+					process.exit(1);
+				}
+				const parsed = (0, import_arg.default)(BRANCH_FLAGS, {
+					argv: rawArgs.slice(4),
+					permissive: true
+				});
+				const { diffDatabaseBranch } = await import("./branch-diff-CxE4VlxT.js").then((n) => n.r);
+				const { branchDiffReport } = await import("./branch-diff-report-DpvVf7hR.js");
+				const admin = {
+					executeSql: async (text, options) => (await poolManager.getPool(options?.database ?? poolManager.defaultDatabaseName).query(text, options?.params)).rows,
+					createBranch: (branchName, options) => branchService.createBranch(branchName, options),
+					deleteBranch: (branchName) => branchService.deleteBranch(branchName),
+					listBranches: () => branchService.listBranches(),
+					getBranchInfo: async (branchName) => await branchService.hasBranchRegistry() ? branchService.getBranchInfo(branchName) : void 0
+				};
+				let diff;
+				try {
+					diff = await diffDatabaseBranch(admin, name, { sampleLimit: parsed["--sample-limit"] });
+				} catch (error) {
+					outError(chalk.red(`  ✗ ${error instanceof Error ? error.message : String(error)}`));
+					process.exit(1);
+				}
+				if (parsed["--json"] === true) out(JSON.stringify(diff, null, 2));
+				else {
+					out("");
+					for (const line of branchDiffReport(diff)) out(`  ${line}`);
+					out("");
+				}
+				break;
+			}
 			case "prune": {
 				const parsed = (0, import_arg.default)(BRANCH_FLAGS, {
 					argv: rawArgs.slice(3),
@@ -2522,6 +2369,7 @@ ${chalk.green.bold("Commands")}
   ${chalk.blue.bold("switch")} [<name>|--off]             Point this checkout at a branch
   ${chalk.blue.bold("delete")} <name>                     Delete a branch
   ${chalk.blue.bold("info")} <name>                       Show branch details
+  ${chalk.blue.bold("diff")} <name> [--json]              What the branch changed: schema, policies, rows
   ${chalk.blue.bold("prune")} [--older-than <14|14d|2w>]  Remove branches nothing is using
 
 ${chalk.green.bold("Why prune")}
@@ -2535,6 +2383,8 @@ ${chalk.green.bold("Options")}
                                     Postgres refuses to copy or drop a database
                                     anything else is connected to — usually your
                                     own \`rebase dev\`.
+  ${chalk.blue.bold("--json")}                            diff: print the whole diff as JSON, with up
+                                    to --sample-limit rows a table (default 100).
   ${chalk.blue.bold("--include-dev-diff")}                Also prune the Atlas scratch databases
                                     \`db push\` leaves behind.
   ${chalk.blue.bold("--yes, -y")}                         Skip prune's confirmation prompt. Dropping a
@@ -2828,9 +2678,9 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-DvJH-IQG.js").then((n) => n.t);
-	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-FlxM2i4i.js").then((n) => n.r);
-	const { generateSchema } = await import("./generate-drizzle-schema-logic-DA3zM8zc.js").then((n) => n.n);
+	const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-BvNF3i-s.js").then((n) => n.r);
+	const { generateSchema } = await import("./generate-drizzle-schema-logic-CPzCRD-8.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");
 	let stale = [];
 	let differences = [];