@rebasepro/server-postgres 0.25.1 → 0.26.0

package/dist/cli.js

@@ -1,10 +1,10 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { n as require_arg, o as __toESM, t as promptConfirm } from "./cli-prompt-DXG0yk-h.js";
-import { A as getUndeclaredConstraintExcludes, B as withAppClient, C as dropDevDatabase, D as getSearchExcludes, E as getForeignIndexExcludes, F as queryUndeclarableConstraints, G as prepareGeneratedSqlDir, H as DESIRED_STATE_URL, I as readSearchDdl, J as detectDestructiveStatements, K as decidePushSafety, L as readTriggersDdl, M as loadCollectionsForCli, N as queryColumnTypes, O as getTableExcludes, P as queryGeneratedColumnDependencies, Q as forAtlas, R as readVectorDdl, S as diagnoseMissingBin, T as ensureDevDatabaseExists, U as GENERATED_SQL_DIR, V as workspaceMemberDir, W as generatedSqlDir, X as fromAlterTable, Y as extractPlanStatements, Z as isSyncedPlan, _ as closeAppClients, a as diagnoseDbError, b as describeReinstallCommand, c as isEconnrefused, d as reportCommandFailure, et as redactConnectionPasswords, f as ExcludeIntrospectionError, g as atlasDevDatabaseUrl, h as applyVectorDdl, i as diagnoseAtlasFailure, j as getVectorExcludes, k as getTriggerExcludes, l as isSslNotEnabled, m as applyTriggersDdl, o as formatForeignGeneratedColumnBanner, p as applySearchDdl, q as destructiveOptInFlag, s as isAuthFailure, t as checkDatabaseConnectivity, v as describeBuildScriptRemedy, w as dropGeneratedColumns, x as detectProjectPackageManager, y as describeDevAddCommand, z as resolveLocalBin } from "./cli-errors-DiA0XFIS.js";
+import { $ as forAtlas, A as getUndeclaredConstraintExcludes, B as withAppClient, C as dropDevDatabase, D as getSearchExcludes, E as getForeignIndexExcludes, F as queryUndeclarableConstraints, G as prepareGeneratedSqlDir, H as DESIRED_STATE_URL, I as readSearchDdl, J as detectDestructiveStatements, K as decidePushSafety, L as readTriggersDdl, M as loadCollectionsForCli, N as queryColumnTypes, O as getTableExcludes, P as queryGeneratedColumnDependencies, Q as warnIfYesApprovedDestructive, R as readVectorDdl, S as diagnoseMissingBin, T as ensureDevDatabaseExists, U as GENERATED_SQL_DIR, V as workspaceMemberDir, W as generatedSqlDir, X as fromAlterTable, Y as extractPlanStatements, Z as isSyncedPlan, _ as closeAppClients, a as diagnoseDbError, b as describeReinstallCommand, c as isEconnrefused, d as reportCommandFailure, f as ExcludeIntrospectionError, g as atlasDevDatabaseUrl, h as applyVectorDdl, i as diagnoseAtlasFailure, j as getVectorExcludes, k as getTriggerExcludes, l as isSslNotEnabled, m as applyTriggersDdl, o as formatForeignGeneratedColumnBanner, p as applySearchDdl, q as destructiveOptInFlag, s as isAuthFailure, t as checkDatabaseConnectivity, tt as redactConnectionPasswords, v as describeBuildScriptRemedy, w as dropGeneratedColumns, x as detectProjectPackageManager, y as describeDevAddCommand, z as resolveLocalBin } from "./cli-errors-DsYyNYzd.js";
 import { a as outWarn, i as outError, o as atlasExcludePattern, r as out, s as excludePatternParts, t as chalk } from "./source-fZb92pN8.js";
 import { t as nextStepAfterDbGenerate } from "./generate-next-step-DgK5BlBn.js";
-import { a as resolveBranchSwitches, c as assertKnownFlags, f as parseDriverLine, g as dropLegacyAuthSchema, m as RLS_BOOTSTRAP_SQL, n as isDriverDbSubcommand, o as unexpectedBranchArgs, p as resolveDriverSwitches, r as backupActionOf, t as DRIVER_DB_SUBCOMMANDS, u as collectionsPathIn, y as execa } from "./db-subcommands-BPoHCxJR.js";
+import { S as dropLegacyAuthSchema, T as execa, b as RLS_BOOTSTRAP_SQL, c as isDriverDbSubcommand, d as resolveBranchSwitches, f as unexpectedBranchArgs, g as collectionsPathIn, i as latestRecordedMigration, l as backupActionOf, m as assertKnownFlags, o as planBaseline, r as describeBaselinePlan, s as DRIVER_DB_SUBCOMMANDS, t as baselineVersionProblem, v as parseDriverLine, y as resolveDriverSwitches } from "./migrate-baseline-B-2Ef4Mv.js";
 import { formatRelativeTime } from "@rebasepro/utils";
 import path from "path";
 import fs from "fs";
@@ -890,102 +890,6 @@ var CommandStopped = class extends Error {
 	}
 };
 //#endregion
-//#region src/schema/migrate-baseline.ts
-/**
-* What `rebase db migrate --baseline <version>` does, given the history the
-* database already has.
-*
-* The flag promises to record `<version>` as applied and migrate from the next
-* one. Atlas's own `migrate apply --baseline` keeps that promise only on a
-* database with no revision history: once one row exists it ignores the flag
-* without a word, applies the migration anyway, and the CLI had already printed
-* "Recording … as already applied". That is the normal second time: a project
-* baselines once, then `rebase dev` adds a column at boot, `db generate` writes
-* the migration for it, and `db migrate` fails on `column … already exists
-* (42701)` however the baseline is spelled.
-*
-* So the history is read first. With none, Atlas's baseline does the work.
-* Behind `<version>`, `atlas migrate set` marks every migration up to it as
-* applied, which is what a baseline means. At or past it, there is nothing to
-* record, and the command says so instead of claiming it recorded something.
-*/
-/**
-* Atlas's version order for the versions Rebase writes: numeric timestamps,
-* compared as numbers so a shorter one is not read as later; anything else as
-* text.
-*/
-function compareMigrationVersions(a, b) {
-	if (/^\d+$/.test(a) && /^\d+$/.test(b)) {
-		const x = BigInt(a);
-		const y = BigInt(b);
-		return x === y ? 0 : x < y ? -1 : 1;
-	}
-	return a.localeCompare(b);
-}
-/**
-* The version Atlas records for a migration file: its numeric prefix
-* (`20260906101530_init.sql` → `20260906101530`), or the name without `.sql`.
-*/
-function migrationVersionOf(file) {
-	return /^(\d+)/.exec(file)?.[1] ?? file.replace(/\.sql$/, "");
-}
-/** How many versions a refused baseline names, newest last. */
-var VERSIONS_NAMED = 5;
-/**
-* Why `--baseline <version>` cannot run, or `null` when it names a migration
-* file in `drizzle/migrations`.
-*
-* Asked before anything else, the database included. A version no file has
-* was refused only by Atlas, after the command had said "Marking every
-* migration up to abc as applied…"; and one older than every file read
-* "Nothing to record" and migrated on, though it named nothing to baseline.
-*
-* @param files the migration files, sorted oldest first.
-* @returns the refusal, its first line the error and the rest the detail.
-*/
-function baselineVersionProblem(version, files) {
-	const versions = files.map(migrationVersionOf);
-	if (versions.length === 0) return `--baseline ${version}: There are no migrations in drizzle/migrations to baseline. Nothing was run.\nRun \`rebase db generate\` to write the first one.`;
-	if (versions.includes(version)) return null;
-	const named = versions.slice(-5).join(", ");
-	return `--baseline ${version} names no migration in drizzle/migrations. Nothing was run.\n${versions.length > VERSIONS_NAMED ? `The newest ${VERSIONS_NAMED} of the ${versions.length} versions there` : "The versions there"}: ${named}. A baseline is one of them: the newest migration the database already holds.`;
-}
-/** How to keep `--baseline <version>`'s promise, given the newest recorded version. */
-function planBaseline(version, latestRecorded) {
-	if (latestRecorded === null) return { kind: "atlas-baseline" };
-	if (compareMigrationVersions(version, latestRecorded) > 0) return {
-		kind: "set",
-		latest: latestRecorded
-	};
-	return {
-		kind: "already-recorded",
-		latest: latestRecorded
-	};
-}
-/** What the command says before it migrates, for each plan. */
-function describeBaselinePlan(version, plan) {
-	switch (plan.kind) {
-		case "atlas-baseline": return `Recording ${version} as already applied, then migrating from the next one.`;
-		case "set": return `This database already records migrations up to ${plan.latest}, and Atlas applies --baseline only to a database with none.\n  Marking every migration up to ${version} as applied with \`atlas migrate set\`, then migrating from the next one.`;
-		case "already-recorded": return `Nothing to record: this database already records migrations up to ${plan.latest}, which includes ${version}.\n  Migrating from the next one.`;
-	}
-}
-/**
-* The newest version Atlas has recorded on this database, or `null` when it
-* has recorded none (no revisions table yet included).
-*
-* The table is `rebase.atlas_schema_revisions`: the CLI passes
-* `--revisions-schema rebase` to every `migrate apply`.
-*/
-async function latestRecordedMigration(databaseUrl) {
-	return withAppClient(databaseUrl, async (client) => {
-		if (!(await client.query("SELECT to_regclass('rebase.atlas_schema_revisions') IS NOT NULL AS present")).rows[0]?.present) return null;
-		const versions = (await client.query("SELECT version FROM rebase.atlas_schema_revisions WHERE version NOT LIKE '.%'")).rows.map((row) => row.version);
-		if (versions.length === 0) return null;
-		return versions.reduce((latest, version) => compareMigrationVersions(version, latest) > 0 ? version : latest);
-	});
-}
-//#endregion
 //#region src/cli-push.ts
 /**
 * Apply a planned push.
@@ -1348,7 +1252,7 @@ async function runPluginCommand(args) {
 		else if (domain === "schema") await schemaCommand(subcommand, args);
 		else if (domain === "doctor") await doctorPluginCommand(args);
 		else if (domain === "console") {
-			const { consoleCommand } = await import("./cli-console-CQrQ0lAY.js");
+			const { consoleCommand } = await import("./cli-console-f0k6_TsJ.js");
 			process.exitCode = await consoleCommand(args);
 		} else {
 			outError(chalk.red(`Unknown domain command: ${domain}`));
@@ -1515,7 +1419,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	if (subcommand === "backup" || subcommand === "restore" || subcommand === "backups") {
-		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-gijeXe0u.js").then((n) => n.t);
+		const { backupCommand, restoreCommand, backupsCommand } = await import("./backup-cli-PoRG-zEq.js").then((n) => n.t);
 		if (subcommand === "backup" && backupActionOf(rawArgs) === "list") await backupsCommand(rawArgs);
 		else if (subcommand === "backup") await backupCommand(rawArgs);
 		else if (subcommand === "restore") await restoreCommand(rawArgs);
@@ -1636,6 +1540,7 @@ async function dbCommand(subcommand, rawArgs) {
 			if (databaseUrl && !dryRun) await ensureAuthSchemaAndFunctions(databaseUrl);
 			if (databaseUrl) await renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun);
 			const prebuilt = databaseUrl ? await prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) : [];
+			if (databaseUrl) await keepDatabaseOwnedDefaults(databaseUrl, collectionsPath);
 			const plan = await runAtlas("schema", [
 				"apply",
 				"--to",
@@ -1700,6 +1605,7 @@ async function dbCommand(subcommand, rawArgs) {
 					for (const line of destructiveLines(destructive)) outWarn(line);
 					outWarn("");
 					outWarn(chalk.yellow("  Applying them needs `rebase db push --allow-destructive`. Back up first: rebase db backup"));
+					outWarn(chalk.gray("  (`--yes` still approves them in this release, with a deprecation warning; from the next it will not.)"));
 					outWarn("");
 				}
 				out(chalk.gray("  The auth schema step was skipped, because it writes. A real push runs it first."));
@@ -1734,7 +1640,10 @@ async function dbCommand(subcommand, rawArgs) {
 						out(chalk.gray("  Aborted. No changes were made."));
 						throw new CommandStopped("The destructive push was declined.");
 					}
-				} else outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
+				} else {
+					outWarn(chalk.yellow(`  Proceeding because ${optIn ?? "--allow-destructive"} was passed.`));
+					warnIfYesApprovedDestructive(optIn, destructive.length);
+				}
 			}
 			if (policyPlan?.summary) {
 				out(chalk.gray(policyPlan.summary));
@@ -1825,7 +1734,7 @@ async function dbCommand(subcommand, rawArgs) {
 			if (databaseUrl) {
 				await ensureRlsUserRole(databaseUrl);
 				await retireLegacyAuthSchema(databaseUrl);
-				const { stampMigratedPolicies } = await import("./migrate-policy-stamps-3eqfhes6.js");
+				const { stampMigratedPolicies } = await import("./migrate-policy-stamps-BQtFHApx.js");
 				await stampMigratedPolicies(databaseUrl, collectionsPath);
 			}
 		}
@@ -1844,12 +1753,43 @@ async function dbCommand(subcommand, rawArgs) {
 *
 * @returns `schema.index` of each one missing when this started.
 */
+/**
+* Appends to `schema.sql` the live DEFAULT of every column declared
+* `databaseDefault: true`, so Atlas plans no `DROP DEFAULT` for it.
+*
+* Fails CLOSED, like the exclude lists: without the catalogue the desired state
+* says "no DEFAULT", and the push would drop each of them. A project declaring
+* no such column reads nothing.
+*/
+async function keepDatabaseOwnedDefaults(databaseUrl, collectionsPath) {
+	const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+	const { databaseOwnedDefaultColumns, readKeptDefaults, withKeptDefaults } = await import("./push-kept-defaults-BGOlOqRQ.js");
+	const columns = databaseOwnedDefaultColumns(await loadCollections(path.resolve(process.cwd(), collectionsPath)));
+	if (columns.length === 0) return;
+	let kept;
+	try {
+		kept = await withAppClient(databaseUrl, (client) => readKeptDefaults({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, columns));
+	} catch (err) {
+		outError(chalk.red("\n✗ Aborting push: could not read the DEFAULTs of the columns declared `databaseDefault: true`."));
+		outError(chalk.gray(`  ${err instanceof Error ? err.message : String(err)}`));
+		outError(chalk.gray("  Refusing to plan without them: the push would drop each of those DEFAULTs."));
+		const hint = diagnoseDbError(err, databaseUrl);
+		if (hint) outError(hint);
+		throw new CommandStopped("Could not read the DEFAULTs to keep.");
+	}
+	if (kept.length === 0) return;
+	const desiredSqlFile = path.join(generatedSqlDir(), "schema.sql");
+	fs.writeFileSync(desiredSqlFile, withKeptDefaults(fs.readFileSync(desiredSqlFile, "utf-8"), kept));
+	out(chalk.gray(`  Keeping ${kept.length} DEFAULT(s) the database holds, for columns declared \`databaseDefault: true\`:`));
+	for (const each of kept) out(chalk.gray(`       ${each.table}.${each.column}  DEFAULT ${each.expression}`));
+	out("");
+}
 /** Renames relation columns that carry their pre-0.13 derived name, as boot does; a dry-run only names them. */
 async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 	let renames;
 	try {
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
-		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-CLgYYwPE.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { legacyForeignKeyRenames } = await import("./push-legacy-renames-BwaKi8xF.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		renames = await withAppClient(databaseUrl, (client) => legacyForeignKeyRenames({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1868,8 +1808,8 @@ async function renameLegacyForeignKeys(databaseUrl, collectionsPath, dryRun) {
 /** Names the enum labels the database keeps after the collections dropped them. See `schema/enum-labels-kept.ts`. */
 async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 	try {
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
-		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-nheku1pB.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { keptEnumLabels, formatKeptEnumLabelsNotice } = await import("./enum-labels-kept-PcPW65xy.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const kept = await withAppClient(databaseUrl, (client) => keptEnumLabels({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 		if (kept.length > 0) outWarn(chalk.yellow(formatKeptEnumLabelsNotice(kept)));
@@ -1878,8 +1818,8 @@ async function reportKeptEnumLabels(databaseUrl, collectionsPath) {
 async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	let missing;
 	try {
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
-		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-COd7i6wm.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		const { missingForeignKeyIndexes } = await import("./push-index-prebuild-UTvB5pqH.js");
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		missing = await withAppClient(databaseUrl, (client) => missingForeignKeyIndexes({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections));
 	} catch {
@@ -1889,7 +1829,7 @@ async function prebuildForeignKeyIndexes(databaseUrl, collectionsPath, dryRun) {
 	if (missing.length === 0 || dryRun) return names;
 	out(chalk.gray(`  Building ${missing.length} foreign-key index(es) on existing tables first — CONCURRENTLY, so writes go on:`));
 	try {
-		const { buildDeferredIndexes } = await import("./deferred-index-build-BE0I6sYU.js").then((n) => n.r);
+		const { buildDeferredIndexes } = await import("./deferred-index-build-CqaOv1Xx.js").then((n) => n.r);
 		const outcome = await withAppClient(databaseUrl, (client) => buildDeferredIndexes(async () => ({
 			dedicated: true,
 			query: async (text) => ({ rows: (await client.query(text)).rows }),
@@ -1937,9 +1877,9 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 	let unsecured;
 	let userRole;
 	try {
-		const { lockCollectionTables } = await import("./ensure-collection-policies-BnGOURpG.js");
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
-		userRole = (await import("./rls-enforcement-DDyNoOSy.js").then((n) => n.c)).REBASE_USER_ROLE;
+		const { lockCollectionTables } = await import("./ensure-collection-policies-DLWgabQ2.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
+		userRole = (await import("./rls-enforcement-BOHuHVlc.js").then((n) => n.l)).REBASE_USER_ROLE;
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		({unsecured} = await withAppClient(databaseUrl, (client) => lockCollectionTables({ query: async (text) => ({ rows: (await client.query(text)).rows }) }, collections)));
 	} catch (err) {
@@ -1974,8 +1914,8 @@ async function lockManagedTables(databaseUrl, collectionsPath) {
 async function ensureAuthTables(databaseUrl, collectionsPath) {
 	try {
 		const { drizzle } = await import("drizzle-orm/node-postgres");
-		const { ensureAuthTablesExist } = await import("./ensure-tables-l_OgFQjN.js").then((n) => n.n);
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { ensureAuthTablesExist } = await import("./ensure-tables-4nA-tfwi.js").then((n) => n.n);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const authCollection = (await loadCollections(path.resolve(process.cwd(), collectionsPath))).find((c) => {
 			const a = c.auth;
 			return a === true || typeof a === "object" && a !== null && a.enabled === true;
@@ -1995,7 +1935,7 @@ async function ensureRlsUserRole(databaseUrl) {
 	const schemas = ["public", "rebase"];
 	let rls;
 	try {
-		rls = await import("./rls-enforcement-DDyNoOSy.js").then((n) => n.c);
+		rls = await import("./rls-enforcement-BOHuHVlc.js").then((n) => n.l);
 	} catch (err) {
 		outError(chalk.red(`\n  ✗ Could not load the RLS provisioning module: ${err instanceof Error ? err.message : String(err)}`));
 		return;
@@ -2055,9 +1995,9 @@ async function applyPolicies(databaseUrl, collectionsPath) {
 */
 async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 	try {
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const { planCollectionPolicies } = await import("./generate-postgres-ddl-logic-DPl1oH_z.js").then((n) => n.o);
-		const { policyStampSql } = await import("./ensure-collection-policies-BnGOURpG.js");
+		const { policyStampSql } = await import("./ensure-collection-policies-DLWgabQ2.js");
 		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		return {
 			statements: stampableTables(planCollectionPolicies(await loadCollections(path.resolve(process.cwd(), collectionsPath))), policiesSql).map((plan) => policyStampSql(plan)).filter((statement) => statement !== void 0),
@@ -2075,8 +2015,8 @@ async function policyStamping(databaseUrl, collectionsPath, policiesSql) {
 */
 async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 	try {
-		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-D2gpQsdv.js");
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { formatPolicyPushPlan, planPolicyPush, summarizePolicyPushPlan } = await import("./push-policy-plan-DQ2tWceD.js");
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const { pinSearchPath } = await import("./connection-czvI7TZL.js").then((n) => n.n);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		const plan = await withAppClient(databaseUrl, (client) => planPolicyPush({ query: async (text, values) => ({ rows: (await client.query(text, values)).rows }) }, collections, { searchPath: pinSearchPath(databaseUrl) === databaseUrl ? void 0 : "public" }));
@@ -2105,7 +2045,7 @@ async function readPolicyPushPlan(databaseUrl, collectionsPath) {
 async function reconcilePolicies(databaseUrl, collectionsPath) {
 	try {
 		const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } = await import("./policy-drift-X4A-xAzv.js").then((n) => n.s);
-		const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+		const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 		const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
 		await withAppClient(databaseUrl, async (client) => {
 			const drift = await checkPolicyDrift(client, collections);
@@ -2148,6 +2088,8 @@ var BRANCH_FLAGS = {
 	"--older-than": String,
 	"--include-dev-diff": Boolean,
 	"--from": String,
+	"--json": Boolean,
+	"--sample-limit": Number,
 	"--yes": Boolean,
 	"-y": "--yes"
 };
@@ -2189,7 +2131,7 @@ async function branchCommand(rawArgs) {
 		process.exit(1);
 	}
 	const { DatabasePoolManager } = await import("./databasePoolManager-3stMNFL-.js").then((n) => n.n);
-	const { BranchService, reopenClosedDatabases, reopenedDatabasesNotice } = await import("./BranchService-ClklxyAQ.js").then((n) => n.n);
+	const { BranchService, reopenClosedDatabases, reopenedDatabasesNotice } = await import("./BranchService-CWBnDhcv.js").then((n) => n.n);
 	const { drizzle } = await import("drizzle-orm/node-postgres");
 	const { Pool } = await import("pg");
 	const healed = await reopenClosedDatabases(databaseUrl, [branchAction === "create" ? createSource(rawArgs) : void 0, process.env[ACTIVE_BRANCH_DATABASE_ENV]]);
@@ -2287,6 +2229,41 @@ async function branchCommand(rawArgs) {
 				out("");
 				break;
 			}
+			case "diff": {
+				const name = rawArgs[3];
+				if (!name || name.startsWith("-")) {
+					outError(chalk.red("✗ Branch name is required."));
+					out(chalk.gray("  Usage: rebase db branch diff <name> [--json] [--sample-limit <n>]"));
+					process.exit(1);
+				}
+				const parsed = (0, import_arg.default)(BRANCH_FLAGS, {
+					argv: rawArgs.slice(4),
+					permissive: true
+				});
+				const { diffDatabaseBranch } = await import("./branch-diff-CxE4VlxT.js").then((n) => n.r);
+				const { branchDiffReport } = await import("./branch-diff-report-DpvVf7hR.js");
+				const admin = {
+					executeSql: async (text, options) => (await poolManager.getPool(options?.database ?? poolManager.defaultDatabaseName).query(text, options?.params)).rows,
+					createBranch: (branchName, options) => branchService.createBranch(branchName, options),
+					deleteBranch: (branchName) => branchService.deleteBranch(branchName),
+					listBranches: () => branchService.listBranches(),
+					getBranchInfo: async (branchName) => await branchService.hasBranchRegistry() ? branchService.getBranchInfo(branchName) : void 0
+				};
+				let diff;
+				try {
+					diff = await diffDatabaseBranch(admin, name, { sampleLimit: parsed["--sample-limit"] });
+				} catch (error) {
+					outError(chalk.red(`  ✗ ${error instanceof Error ? error.message : String(error)}`));
+					process.exit(1);
+				}
+				if (parsed["--json"] === true) out(JSON.stringify(diff, null, 2));
+				else {
+					out("");
+					for (const line of branchDiffReport(diff)) out(`  ${line}`);
+					out("");
+				}
+				break;
+			}
 			case "prune": {
 				const parsed = (0, import_arg.default)(BRANCH_FLAGS, {
 					argv: rawArgs.slice(3),
@@ -2392,6 +2369,7 @@ ${chalk.green.bold("Commands")}
   ${chalk.blue.bold("switch")} [<name>|--off]             Point this checkout at a branch
   ${chalk.blue.bold("delete")} <name>                     Delete a branch
   ${chalk.blue.bold("info")} <name>                       Show branch details
+  ${chalk.blue.bold("diff")} <name> [--json]              What the branch changed: schema, policies, rows
   ${chalk.blue.bold("prune")} [--older-than <14|14d|2w>]  Remove branches nothing is using
 
 ${chalk.green.bold("Why prune")}
@@ -2405,6 +2383,8 @@ ${chalk.green.bold("Options")}
                                     Postgres refuses to copy or drop a database
                                     anything else is connected to — usually your
                                     own \`rebase dev\`.
+  ${chalk.blue.bold("--json")}                            diff: print the whole diff as JSON, with up
+                                    to --sample-limit rows a table (default 100).
   ${chalk.blue.bold("--include-dev-diff")}                Also prune the Atlas scratch databases
                                     \`db push\` leaves behind.
   ${chalk.blue.bold("--yes, -y")}                         Skip prune's confirmation prompt. Dropping a
@@ -2698,7 +2678,7 @@ async function schemaStaleCommand(rawArgs) {
 	const schemaFile = path.resolve(process.cwd(), outputPath);
 	const fix = Boolean(argsList["--fix"]);
 	const generatedExists = fs.existsSync(schemaFile);
-	const { loadCollections } = await import("./doctor-BT--1kq3.js").then((n) => n.t);
+	const { loadCollections } = await import("./doctor-DW_mlTzz.js").then((n) => n.t);
 	const { findLegacyForeignKeyNames, compareGeneratedDeclarations, staleVerdict } = await import("./generated-schema-staleness-BvNF3i-s.js").then((n) => n.r);
 	const { generateSchema } = await import("./generate-drizzle-schema-logic-CPzCRD-8.js").then((n) => n.n);
 	const { relationalCollections } = await import("@rebasepro/common");