@superblocksteam/shared 0.9607.3 → 0.9608.1

package/dist-esm/types/response/index.d.ts

@@ -41,6 +41,7 @@ export * from './GetPublicApiResponseBody.js';
 export * from './GetPublicOrganizationSummaryResponseBody.js';
 export * from './IssueSuperblocksResponseBody.js';
 export * from './GetAllApplicationsResponseBody.js';
+export * from './GetRecentApplicationsResponseBody.js';
 export * from './PatchApplicationResponseBody.js';
 export * from './PatchHomePageItemsResponseBody.js';
 export * from './ListApplicationBuildsResponseBody.js';

package/dist-esm/types/response/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/response/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/types/response/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC"}

package/dist-esm/types/response/index.js

@@ -41,6 +41,7 @@ export * from './GetPublicApiResponseBody.js';
 export * from './GetPublicOrganizationSummaryResponseBody.js';
 export * from './IssueSuperblocksResponseBody.js';
 export * from './GetAllApplicationsResponseBody.js';
+export * from './GetRecentApplicationsResponseBody.js';
 export * from './PatchApplicationResponseBody.js';
 export * from './PatchHomePageItemsResponseBody.js';
 export * from './ListApplicationBuildsResponseBody.js';

package/dist-esm/types/response/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/response/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/types/response/index.ts"],"names":[],"mappings":"AAAA,cAAc,yCAAyC,CAAC;AACxD,cAAc,wCAAwC,CAAC;AACvD,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,gCAAgC,CAAC;AAC/C,cAAc,yBAAyB,CAAC;AACxC,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,iCAAiC,CAAC;AAChD,cAAc,oCAAoC,CAAC;AACnD,cAAc,0CAA0C,CAAC;AACzD,cAAc,qCAAqC,CAAC;AACpD,cAAc,gCAAgC,CAAC;AAC/C,cAAc,8CAA8C,CAAC;AAC7D,cAAc,sCAAsC,CAAC;AACrD,cAAc,8CAA8C,CAAC;AAC7D,cAAc,oDAAoD,CAAC;AACnE,cAAc,wCAAwC,CAAC;AACvD,cAAc,wCAAwC,CAAC;AACvD,cAAc,uCAAuC,CAAC;AACtD,cAAc,uCAAuC,CAAC;AACtD,cAAc,sCAAsC,CAAC;AACrD,cAAc,sCAAsC,CAAC;AACrD,cAAc,4CAA4C,CAAC;AAC3D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4CAA4C,CAAC;AAC3D,cAAc,oCAAoC,CAAC;AACnD,cAAc,wCAAwC,CAAC;AACvD,cAAc,yCAAyC,CAAC;AACxD,cAAc,6CAA6C,CAAC;AAC5D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,gCAAgC,CAAC;AAC/C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,uCAAuC,CAAC;AACtD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,+CAA+C,CAAC;AAC9D,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,mCAAmC,CAAC;AAClD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@superblocksteam/shared",
-  "version": "0.9607.3",
+  "version": "0.9608.1",
   "description": "Superblocks Shared Resources",
   "license": "Superblocks Community Software License",
   "repository": "https://github.com/superblocksteam/shared.git",

package/src/database-lifecycle/appDatabaseCompatibility.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from 'vitest';
+
+import { ViewMode } from '../types/event/index.js';
+import { type AppDatabaseTagCompatibility, rollUpAppDatabaseCompatibility } from './appDatabaseCompatibility.js';
+
+function tag(overrides: Partial<AppDatabaseTagCompatibility> & Pick<AppDatabaseTagCompatibility, 'profileKey' | 'supportState'>) {
+  return {
+    availableModes: [ViewMode.EDITOR],
+    missingOperations: [],
+    requiredOperations: ['ensure_database', 'migrate_schema'],
+    ...overrides
+  } satisfies AppDatabaseTagCompatibility;
+}
+
+describe('rolling up per-tag support into an app-wide verdict', () => {
+  test('an app whose every data tag is served is compatible', () => {
+    const rollUp = rollUpAppDatabaseCompatibility([
+      tag({ profileKey: 'staging', supportState: 'supported' }),
+      tag({ profileKey: 'production', supportState: 'supported' })
+    ]);
+
+    expect(rollUp).toEqual({ needsAttention: false, overallState: 'compatible' });
+  });
+
+  test('one unserved data tag makes the whole app incompatible even when siblings are served', () => {
+    const rollUp = rollUpAppDatabaseCompatibility([
+      tag({ profileKey: 'staging', supportState: 'supported' }),
+      tag({ missingOperations: ['ensure_database'], profileKey: 'restricted', supportState: 'unsupported' })
+    ]);
+
+    expect(rollUp).toEqual({ needsAttention: true, overallState: 'incompatible' });
+  });
+
+  test('a capability lookup outage is reported as temporary rather than as a missing capability', () => {
+    const rollUp = rollUpAppDatabaseCompatibility([
+      tag({ profileKey: 'staging', supportState: 'temporarily_unavailable' }),
+      tag({ profileKey: 'production', supportState: 'temporarily_unavailable' })
+    ]);
+
+    expect(rollUp).toEqual({ needsAttention: false, overallState: 'temporarily_unavailable' });
+  });
+
+  test('a permanently unserved tag is still reported while another tag is only temporarily unknown', () => {
+    const rollUp = rollUpAppDatabaseCompatibility([
+      tag({ profileKey: 'staging', supportState: 'temporarily_unavailable' }),
+      tag({ missingOperations: ['migrate_schema'], profileKey: 'restricted', supportState: 'unsupported' })
+    ]);
+
+    expect(rollUp).toEqual({ needsAttention: true, overallState: 'incompatible' });
+  });
+
+  test('an app with no data tags to check is compatible', () => {
+    expect(rollUpAppDatabaseCompatibility([])).toEqual({ needsAttention: false, overallState: 'compatible' });
+  });
+});

package/src/database-lifecycle/appDatabaseCompatibility.ts

@@ -0,0 +1,62 @@
+import type { ViewMode } from '../types/event/index.js';
+import type { LifecycleOperation } from './index.js';
+
+/**
+ * Whether lifecycle workers can serve App Database work for one data tag.
+ *
+ * `unsupported` is a standing gap: workers are connected, but none of them
+ * handles this tag. `temporarily_unavailable` means we could not tell —
+ * nothing is registered right now, or the lookup itself failed — so the tag
+ * may start working again without anyone changing the app.
+ */
+export const APP_DATABASE_TAG_SUPPORT_STATES = ['supported', 'temporarily_unavailable', 'unsupported'] as const;
+export type AppDatabaseTagSupportState = (typeof APP_DATABASE_TAG_SUPPORT_STATES)[number];
+
+export const APP_DATABASE_COMPATIBILITY_STATES = ['compatible', 'incompatible', 'temporarily_unavailable'] as const;
+export type AppDatabaseCompatibilityState = (typeof APP_DATABASE_COMPATIBILITY_STATES)[number];
+
+/** Lifecycle operations an App Database cannot work without. */
+export const APP_DATABASE_REQUIRED_OPERATIONS: readonly LifecycleOperation[] = ['ensure_database', 'migrate_schema'];
+
+export type AppDatabaseTagCompatibility = {
+  /** App view modes that offer this data tag, for messaging. */
+  availableModes: ViewMode[];
+  missingOperations: LifecycleOperation[];
+  profileKey: string;
+  requiredOperations: LifecycleOperation[];
+  supportState: AppDatabaseTagSupportState;
+};
+
+export type AppDatabaseCompatibility = {
+  applicationId: string;
+  /**
+   * Whether the app declares an App Database right now. An app without one is
+   * never blocked by a data tag gap, so callers use this to stay quiet instead
+   * of warning about a problem the user does not have.
+   */
+  hasAppDatabase: boolean;
+  /** True only when someone has to change the app for it to work again. */
+  needsAttention: boolean;
+  overallState: AppDatabaseCompatibilityState;
+  /** Every data tag the app can run App Database work for, sorted by key. */
+  tags: AppDatabaseTagCompatibility[];
+};
+
+/**
+ * Fold per-tag support into the app-wide verdict. A standing gap outranks a
+ * temporary one: a tag no worker serves has to be reported even while another
+ * tag's capability is momentarily unknown, otherwise the outage hides work the
+ * user actually has to do.
+ */
+export function rollUpAppDatabaseCompatibility(tags: readonly AppDatabaseTagCompatibility[]): {
+  needsAttention: boolean;
+  overallState: AppDatabaseCompatibilityState;
+} {
+  if (tags.some((tag) => tag.supportState === 'unsupported')) {
+    return { needsAttention: true, overallState: 'incompatible' };
+  }
+  if (tags.some((tag) => tag.supportState === 'temporarily_unavailable')) {
+    return { needsAttention: false, overallState: 'temporarily_unavailable' };
+  }
+  return { needsAttention: false, overallState: 'compatible' };
+}

package/src/database-lifecycle/destructiveMigrations.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, test } from 'vitest';
 
-import { analyzeDestructiveMigrations } from './destructiveMigrations.js';
+import { analyzeDestructiveMigrations, analyzeDestructiveMigrationsRequiringAck } from './destructiveMigrations.js';
 
 describe('analyzeDestructiveMigrations', () => {
   test('returns empty when SQL has no destructive statements', () => {
@@ -114,3 +114,110 @@ CREATE TABLE users (id int);
     expect(findings[1]).toMatchObject({ fileName: 'b.sql', kind: 'truncate' });
   });
 });
+
+describe('analyzeDestructiveMigrationsRequiringAck', () => {
+  test('does not require an ack for a drop of a table created earlier in the same batch', () => {
+    // The whole set runs as one batch. Dropping a table that this batch just
+    // created removes nothing that existed before the batch started.
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE users (id int);' },
+        { fileName: '0002_drop.sql', sql: 'DROP TABLE users;' }
+      ])
+    ).toEqual([]);
+  });
+
+  test('still requires an ack for a drop of a table the batch never created', () => {
+    // A ready database can hold tables written by the app with no migrate
+    // history. A DROP of those is genuinely destructive.
+    expect(analyzeDestructiveMigrationsRequiringAck([{ fileName: '0001_drop.sql', sql: 'DROP TABLE orders;' }])).toEqual([
+      expect.objectContaining({ fileName: '0001_drop.sql', kind: 'drop_table' })
+    ]);
+  });
+
+  test('still requires an ack when the drop appears before the create in the batch', () => {
+    // DROP then CREATE would wipe any pre-existing table of that name.
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_drop.sql', sql: 'DROP TABLE users;' },
+        { fileName: '0002_init.sql', sql: 'CREATE TABLE users (id int);' }
+      ])
+    ).toEqual([expect.objectContaining({ kind: 'drop_table' })]);
+  });
+
+  test('does not require an ack for truncate or drop column on a table created earlier in the batch', () => {
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        {
+          fileName: '0001_init.sql',
+          sql: 'CREATE TABLE users (id int, email text); ALTER TABLE users ADD COLUMN name text;'
+        },
+        {
+          fileName: '0002_cleanup.sql',
+          sql: 'TRUNCATE TABLE users; ALTER TABLE users DROP COLUMN email;'
+        }
+      ])
+    ).toEqual([]);
+  });
+
+  test('still requires an ack for drop database and drop schema even after creates in the batch', () => {
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001.sql', sql: 'CREATE SCHEMA app; CREATE DATABASE scratch;' },
+        { fileName: '0002.sql', sql: 'DROP SCHEMA app; DROP DATABASE scratch;' }
+      ])
+        .map((finding) => finding.kind)
+        .sort()
+    ).toEqual(['drop_database', 'drop_schema']);
+  });
+
+  test('still requires an ack for a multi-table drop when any target was not created in the batch', () => {
+    // DROP TABLE can list several names. Covering only the first must not
+    // suppress the statement — the other names may already hold customer data.
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE users (id int);' },
+        { fileName: '0002_drop.sql', sql: 'DROP TABLE IF EXISTS users, orders;' }
+      ])
+    ).toEqual([expect.objectContaining({ kind: 'drop_table' })]);
+  });
+
+  test('still requires an ack for a multi-table truncate when any target was not created in the batch', () => {
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE users (id int);' },
+        { fileName: '0002_cleanup.sql', sql: 'TRUNCATE TABLE users, orders;' }
+      ])
+    ).toEqual([expect.objectContaining({ kind: 'truncate' })]);
+  });
+
+  test('does not require an ack for a multi-table drop when every target was created in the batch', () => {
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE users (id int); CREATE TABLE orders (id int);' },
+        { fileName: '0002_drop.sql', sql: 'DROP TABLE users, orders;' }
+      ])
+    ).toEqual([]);
+  });
+
+  test('still requires an ack when create and drop use different schema qualification', () => {
+    // Exact identifier match only. public.users and users may be the same
+    // relation in Postgres, but we cannot prove that from the SQL text alone,
+    // so mismatched spelling stays acknowledged (fail closed).
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE users (id int);' },
+        { fileName: '0002_drop.sql', sql: 'DROP TABLE public.users;' }
+      ])
+    ).toEqual([expect.objectContaining({ kind: 'drop_table' })]);
+  });
+
+  test('does not require an ack when create and drop use the same schema-qualified name', () => {
+    expect(
+      analyzeDestructiveMigrationsRequiringAck([
+        { fileName: '0001_init.sql', sql: 'CREATE TABLE public.users (id int);' },
+        { fileName: '0002_drop.sql', sql: 'DROP TABLE public.users;' }
+      ])
+    ).toEqual([]);
+  });
+});

package/src/database-lifecycle/destructiveMigrations.ts

@@ -81,6 +81,99 @@ function classifyStatement(statement: string): DestructiveMigrationKind | undefi
   return undefined;
 }
 
+function normalizeSqlIdent(raw: string): string {
+  return raw.replace(/"/g, '').toLowerCase();
+}
+
+/** Optional schema-qualified identifier, with optional quoting on each part. */
+const SQL_IDENT = String.raw`(?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?`;
+
+function matchFirstIdent(statement: string, pattern: RegExp): string | undefined {
+  const match = pattern.exec(statement);
+  const raw = match?.[1];
+  return raw === undefined ? undefined : normalizeSqlIdent(raw);
+}
+
+/**
+ * Pull every table name from a comma-separated DROP TABLE / TRUNCATE list.
+ * Returns undefined when the list cannot be parsed safely — callers must then
+ * require acknowledgment (fail closed).
+ */
+function matchTableListTargets(statement: string, header: RegExp): string[] | undefined {
+  const headerMatch = header.exec(statement);
+  if (headerMatch === null) {
+    return undefined;
+  }
+  const afterHeader = statement.slice(headerMatch[0].length);
+  const listPart = afterHeader.split(/\b(?:CASCADE|RESTRICT|CONTINUE\s+IDENTITY|RESTART\s+IDENTITY)\b/i)[0] ?? '';
+  const tables: string[] = [];
+  for (const part of listPart.split(',')) {
+    const trimmed = part.trim();
+    if (trimmed.length === 0) {
+      continue;
+    }
+    // TRUNCATE allows ONLY before each name.
+    const raw = matchFirstIdent(trimmed, new RegExp(String.raw`^(?:ONLY\s+)?(${SQL_IDENT})`, 'i'));
+    if (raw === undefined) {
+      return undefined;
+    }
+    tables.push(raw);
+  }
+  return tables.length > 0 ? tables : undefined;
+}
+
+function allTablesCreatedInBatch(tables: string[] | undefined, createdTables: Set<string>): boolean {
+  return tables !== undefined && tables.length > 0 && tables.every((table) => createdTables.has(table));
+}
+
+function recordCreates(statement: string, createdTables: Set<string>, createdColumns: Set<string>): void {
+  const table = matchFirstIdent(statement, new RegExp(String.raw`^\s*CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(${SQL_IDENT})`, 'i'));
+  if (table !== undefined) {
+    createdTables.add(table);
+  }
+  const addColumn = new RegExp(String.raw`^\s*ALTER\s+TABLE\s+(${SQL_IDENT})\s+ADD\s+(?:COLUMN\s+)?(${SQL_IDENT})`, 'i').exec(statement);
+  if (addColumn?.[1] !== undefined && addColumn[2] !== undefined) {
+    createdColumns.add(`${normalizeSqlIdent(addColumn[1])}.${normalizeSqlIdent(addColumn[2])}`);
+  }
+}
+
+function isCoveredByEarlierCreate(
+  kind: DestructiveMigrationKind,
+  statement: string,
+  createdTables: Set<string>,
+  createdColumns: Set<string>
+): boolean {
+  switch (kind) {
+    case 'drop_table': {
+      return allTablesCreatedInBatch(matchTableListTargets(statement, /^\s*DROP\s+TABLE\s+(?:IF\s+EXISTS\s+)?/i), createdTables);
+    }
+    case 'truncate': {
+      return allTablesCreatedInBatch(matchTableListTargets(statement, /^\s*TRUNCATE\s+(?:TABLE\s+)?/i), createdTables);
+    }
+    case 'drop_column': {
+      const alterDrop = new RegExp(
+        String.raw`^\s*ALTER\s+TABLE\s+(${SQL_IDENT})\s+[\s\S]*?\bDROP\s+(?:COLUMN\s+)?(?!CONSTRAINT\b|INDEX\b|TRIGGER\b|RULE\b|POLICY\b|STATISTICS\b|IDENTITY\b|NOT\b|DEFAULT\b|EXPRESSION\b)(${SQL_IDENT})`,
+        'i'
+      ).exec(statement);
+      if (alterDrop?.[1] !== undefined && alterDrop[2] !== undefined) {
+        const table = normalizeSqlIdent(alterDrop[1]);
+        const column = normalizeSqlIdent(alterDrop[2]);
+        return createdTables.has(table) || createdColumns.has(`${table}.${column}`);
+      }
+      // Standalone DROP COLUMN has no table context — cannot prove coverage.
+      return false;
+    }
+    case 'drop_database':
+    case 'drop_schema':
+      // Creating the container in the same batch does not prove it is free of
+      // customer data, so these always require an acknowledgment.
+      return false;
+    default: {
+      return false;
+    }
+  }
+}
+
 /**
  * Scans migration SQL for schema-destroying statements that require an
  * explicit user acknowledgment before apply/deploy.
@@ -103,3 +196,39 @@ export function analyzeDestructiveMigrations(files: DestructiveMigrationFile[]):
   }
   return findings;
 }
+
+/**
+ * Like analyzeDestructiveMigrations, but omits drops/truncates of objects this
+ * same unscanned batch created earlier. Those remove nothing that existed before
+ * the batch started, so they are not acknowledged. A drop that appears before
+ * its create, or that targets an object the batch never creates, still requires
+ * an ack — including when the control plane has never migrated this binding,
+ * because a ready database can hold tables the app wrote without migrations.
+ *
+ * DROP DATABASE / DROP SCHEMA are never suppressed this way: creating the
+ * container in the same batch does not prove it is free of customer data.
+ */
+export function analyzeDestructiveMigrationsRequiringAck(files: DestructiveMigrationFile[]): DestructiveMigrationFinding[] {
+  const createdTables = new Set<string>();
+  const createdColumns = new Set<string>();
+  const findings: DestructiveMigrationFinding[] = [];
+  for (const file of files) {
+    const statements = splitStatements(stripSqlComments(file.sql));
+    for (const statement of statements) {
+      recordCreates(statement, createdTables, createdColumns);
+      const kind = classifyStatement(statement);
+      if (kind === undefined) {
+        continue;
+      }
+      if (isCoveredByEarlierCreate(kind, statement, createdTables, createdColumns)) {
+        continue;
+      }
+      findings.push({
+        fileName: file.fileName,
+        kind,
+        excerpt: excerptFor(statement)
+      });
+    }
+  }
+  return findings;
+}

package/src/database-lifecycle/index.ts

@@ -78,6 +78,7 @@ export const LIFECYCLE_ERROR_CODES = [
   'terraform_failed',
   'migration_failed',
   'callback_failed',
+  'configuration_conflict',
   // Server-side classification for a terminal callback that arrived for a
   // request whose desiredSpecHash no longer matches the binding (binding has
   // moved to a newer spec). The callback's metadata/state is discarded and
@@ -87,6 +88,176 @@ export const LIFECYCLE_ERROR_CODES = [
 
 export type LifecycleErrorCode = (typeof LIFECYCLE_ERROR_CODES)[number];
 
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_PHASES = ['apply', 'destroy', 'init', 'plan', 'unknown'] as const;
+export const MAX_LIFECYCLE_PROVIDER_DIAGNOSTICS = 3;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_SERVICE_PATTERN = /^[a-z][a-z0-9-]{0,31}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_OPERATION_PATTERN = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_ERROR_CODE_PATTERN = /^[A-Za-z][A-Za-z0-9.]{0,63}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_REQUEST_ID_PATTERN =
+  /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_S3_REQUEST_ID_PATTERN = /^[0-9A-Za-z]{16}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_DYNAMODB_REQUEST_ID_PATTERN = /^[0-9A-Za-z]{52}$/;
+export const LIFECYCLE_PROVIDER_DIAGNOSTIC_POSTGRESQL_SQL_STATE_PATTERN = /^[0-9A-Za-z]{5}$/;
+
+export function isLifecycleProviderDiagnosticAwsRequestId(service: string, requestId: unknown): requestId is string {
+  if (typeof requestId !== 'string') {
+    return false;
+  }
+  if (LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_REQUEST_ID_PATTERN.test(requestId)) {
+    return true;
+  }
+  if (service === 's3') {
+    return LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_S3_REQUEST_ID_PATTERN.test(requestId);
+  }
+  if (service === 'dynamodb') {
+    return LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_DYNAMODB_REQUEST_ID_PATTERN.test(requestId);
+  }
+  return false;
+}
+
+export type LifecycleProviderDiagnosticPhase = (typeof LIFECYCLE_PROVIDER_DIAGNOSTIC_PHASES)[number];
+
+type LifecycleProviderDiagnosticBase = {
+  phase: LifecycleProviderDiagnosticPhase;
+  retryable: boolean;
+};
+
+export type LifecycleAwsProviderDiagnostic = LifecycleProviderDiagnosticBase & {
+  provider: 'aws';
+  service: string;
+  operation: string;
+  errorCode: string;
+  requestId?: string;
+  nextAction: 'review_aws_operation';
+};
+
+export type LifecyclePostgresqlProviderDiagnostic = LifecycleProviderDiagnosticBase & {
+  provider: 'postgresql';
+  sqlState: string;
+  nextAction: 'review_database_operation';
+};
+
+// Sanitized, allowlisted provider facts emitted by the lifecycle worker.
+// Provider-authored summary/detail text is deliberately not part of this
+// contract; consumers can display these fields without forwarding raw
+// OpenTofu output.
+export type LifecycleProviderDiagnostic = LifecycleAwsProviderDiagnostic | LifecyclePostgresqlProviderDiagnostic;
+
+export type LifecycleProviderDiagnosticCandidateProvider = 'aws' | 'postgresql' | 'unknown';
+
+export type LifecycleProviderDiagnosticCandidateInspection = {
+  provider: LifecycleProviderDiagnosticCandidateProvider;
+  diagnostic?: LifecycleProviderDiagnostic;
+  rejectedFields?: string[];
+  sanitizedFields?: string[];
+};
+
+const lifecycleProviderDiagnosticPhases = new Set<string>(LIFECYCLE_PROVIDER_DIAGNOSTIC_PHASES);
+
+function lifecycleProviderDiagnosticCandidateProvider(value: unknown): LifecycleProviderDiagnosticCandidateProvider {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return 'unknown';
+  }
+  const provider = (value as Record<string, unknown>).provider;
+  return provider === 'aws' || provider === 'postgresql' ? provider : 'unknown';
+}
+
+function lifecycleProviderDiagnosticPhase(value: unknown): LifecycleProviderDiagnosticPhase {
+  return typeof value === 'string' && lifecycleProviderDiagnosticPhases.has(value)
+    ? (value as LifecycleProviderDiagnosticPhase)
+    : 'unknown';
+}
+
+function invalidDiagnosticString(value: unknown, pattern: RegExp): boolean {
+  return typeof value !== 'string' || !pattern.test(value);
+}
+
+/**
+ * Canonical validation boundary for one provider diagnostic. The output is
+ * rebuilt from allowlisted facts, provider-authored text and unknown fields are
+ * discarded, and decorative fields such as nextAction are derived locally.
+ */
+export function inspectLifecycleProviderDiagnosticCandidate(value: unknown): LifecycleProviderDiagnosticCandidateInspection {
+  const provider = lifecycleProviderDiagnosticCandidateProvider(value);
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return { provider, rejectedFields: ['(root)'] };
+  }
+  const candidate = value as Record<string, unknown>;
+  if (provider === 'unknown') {
+    return { provider, rejectedFields: ['provider'] };
+  }
+
+  if (provider === 'aws') {
+    const rejectedFields: string[] = [];
+    if (invalidDiagnosticString(candidate.errorCode, LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_ERROR_CODE_PATTERN)) {
+      rejectedFields.push('errorCode');
+    }
+    if (invalidDiagnosticString(candidate.operation, LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_OPERATION_PATTERN)) {
+      rejectedFields.push('operation');
+    }
+    if (typeof candidate.retryable !== 'boolean') {
+      rejectedFields.push('retryable');
+    }
+    if (invalidDiagnosticString(candidate.service, LIFECYCLE_PROVIDER_DIAGNOSTIC_AWS_SERVICE_PATTERN)) {
+      rejectedFields.push('service');
+    }
+    if (rejectedFields.length > 0) {
+      return { provider, rejectedFields };
+    }
+
+    const requestId = candidate.requestId;
+    const hasSafeRequestId = isLifecycleProviderDiagnosticAwsRequestId(candidate.service as string, requestId);
+    return {
+      diagnostic: {
+        errorCode: candidate.errorCode as string,
+        nextAction: 'review_aws_operation',
+        operation: candidate.operation as string,
+        phase: lifecycleProviderDiagnosticPhase(candidate.phase),
+        provider,
+        ...(hasSafeRequestId ? { requestId } : {}),
+        retryable: candidate.retryable as boolean,
+        service: candidate.service as string
+      },
+      provider,
+      ...(requestId !== undefined && !hasSafeRequestId ? { sanitizedFields: ['requestId'] } : {})
+    };
+  }
+
+  const rejectedFields: string[] = [];
+  if (typeof candidate.retryable !== 'boolean') {
+    rejectedFields.push('retryable');
+  }
+  if (invalidDiagnosticString(candidate.sqlState, LIFECYCLE_PROVIDER_DIAGNOSTIC_POSTGRESQL_SQL_STATE_PATTERN)) {
+    rejectedFields.push('sqlState');
+  }
+  if (rejectedFields.length > 0) {
+    return { provider, rejectedFields };
+  }
+  return {
+    diagnostic: {
+      nextAction: 'review_database_operation',
+      phase: lifecycleProviderDiagnosticPhase(candidate.phase),
+      provider,
+      retryable: candidate.retryable as boolean,
+      sqlState: candidate.sqlState as string
+    },
+    provider
+  };
+}
+
+export function sanitizeLifecycleProviderDiagnostics(value: unknown): LifecycleProviderDiagnostic[] | undefined {
+  if (!Array.isArray(value)) {
+    return undefined;
+  }
+  const diagnostics = value
+    .flatMap((candidate) => {
+      const diagnostic = inspectLifecycleProviderDiagnosticCandidate(candidate).diagnostic;
+      return diagnostic ? [diagnostic] : [];
+    })
+    .slice(0, MAX_LIFECYCLE_PROVIDER_DIAGNOSTICS);
+  return diagnostics.length > 0 ? diagnostics : undefined;
+}
+
 export type PhysicalMasterCredentialRef = {
   resolver: 'aws_secrets_manager';
   ref: string;
@@ -201,6 +372,7 @@ export type LifecycleMigration = {
 
 export {
   analyzeDestructiveMigrations,
+  analyzeDestructiveMigrationsRequiringAck,
   DESTRUCTIVE_MIGRATION_ACK_REQUIRED,
   DESTRUCTIVE_MIGRATION_ACK_REQUIRED_MESSAGE,
   DESTRUCTIVE_MIGRATION_SCAN_UNAVAILABLE
@@ -234,6 +406,7 @@ export type PhysicalPoolProvisioningActor = {
 
 export type PhysicalPoolProvisioningError = {
   code: string;
+  diagnostics?: LifecycleProviderDiagnostic[];
   message: string;
 };