@voltro/database 0.85.0 → 0.86.0

package/dist/migrations/postgresEnumCheck.js

@@ -0,0 +1,19 @@
+//#region src/migrations/postgresEnumCheck.ts
+var e = (e, t) => {
+	let n = (e.match(/'(?:''|[^'])*'|"(?:""|[^"])*"|::|[A-Za-z_][A-Za-z_0-9$]*|[^\s]/g) ?? []).filter((e) => e !== "(" && e !== ")"), r = 0, i = (e) => n[r]?.toLowerCase() === e && (r++, !0);
+	if (!i("check")) return null;
+	let a = n[r++];
+	if (a === void 0 || (a.startsWith("\"") ? a.slice(1, -1).replace(/""/g, "\"") : a.toLowerCase()) !== t) return null;
+	let o = () => !i("::") || i("text") || i("character") && i("varying");
+	if (!o() || !i("=")) return null;
+	let s = i("any");
+	if (s && (!i("array") || !i("["))) return null;
+	let c = [];
+	do {
+		let e = n[r++];
+		if (e === void 0 || !/^'(?:''|[^'])*'$/.test(e) || (c.push(e.slice(1, -1).replace(/''/g, "'")), !o())) return null;
+	} while (s && i(","));
+	return s && (!i("]") || i("::") && (!i("text") || !i("[") || !i("]"))) ? null : r === n.length ? c : null;
+};
+//#endregion
+export { e as postgresEnumCheckValues };

package/dist/migrations/reactiveTriggerDrift.js

@@ -0,0 +1,58 @@
+import { DEFAULT_CDC_CHANNEL as e, REACTIVE_TRIGGER_PREFIX as t, notifyFunctionName as n, storedReactiveTriggerName as r } from "./reactiveTriggerName.js";
+import { Effect as i } from "effect";
+//#region src/migrations/reactiveTriggerDrift.ts
+var a = (a, o, s = e) => i.gen(function* () {
+	let e = (yield* a`
+      SELECT p.prosrc
+      FROM pg_proc p
+      JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = current_schema()
+        AND p.proname = ${n(s)}
+    `)[0]?.prosrc, i = e !== void 0 && !e.includes("voltro:notify:v2"), c = (yield* a`SELECT current_schema() AS schema`)[0]?.schema ?? "";
+	if (o.length === 0) return {
+		missing: [],
+		stale: [],
+		functionOutdated: i,
+		compared: {
+			schema: c,
+			channel: s,
+			present: 0
+		}
+	};
+	let l = yield* a`
+      SELECT t.tgname, c.relname
+      FROM pg_trigger t
+      JOIN pg_class c ON c.oid = t.tgrelid
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE NOT t.tgisinternal
+        AND n.nspname = current_schema()
+        AND t.tgname LIKE ${`${t}%`}
+    `, u = (e, t) => `${e}\u0000${t}`, d = new Set(l.map((e) => u(e.relname, e.tgname))), f = [], p = [];
+	for (let e of o) {
+		let t = d.has(u(e.tableName, r(e.tableName, s))), n = e.isReactive !== !1;
+		n && !t && f.push(e.tableName), !n && t && p.push(e.tableName);
+	}
+	return {
+		missing: f.sort(),
+		stale: p.sort(),
+		functionOutdated: i,
+		compared: {
+			schema: c,
+			channel: s,
+			present: d.size
+		}
+	};
+}), o = (e) => {
+	let n = [];
+	if (e.missing.length > 0) {
+		let r = e.missing.slice(0, 8).join(", "), i = e.missing.length > 8 ? `, … (+${e.missing.length - 8})` : "";
+		n.push(`${e.missing.length} reactive table(s) have NO change trigger in the database — ${r}${i}. Writes to them will not reach CDC subscribers or wake idle queue dispatchers, including on a single instance. Run \`voltro db apply\` to install them.` + (e.compared === void 0 ? "" : ` (compared against ${e.compared.present} \`${t}*\` trigger(s) present in schema "${e.compared.schema}", channel "${e.compared.channel}")`));
+	}
+	if (e.stale.length > 0) {
+		let t = e.stale.slice(0, 8).join(", ");
+		n.push(`${e.stale.length} .nonReactive() table(s) still carry a change trigger — ${t}. They keep paying REPLICA IDENTITY FULL and a NOTIFY on every write for a subscription nobody receives. \`voltro db apply\` removes them.`);
+	}
+	return e.functionOutdated && n.push("The change-notify function in this database is OLDER than the framework installed here. Its triggers fire, so nothing looks wrong — but a row too large for a NOTIFY payload (postgres caps it at 8000 bytes) is emitted without its primary key, and a change that carries no key cannot be re-read: it reaches subscriptions as a re-query and reaches every TAP — search index, analytics mirror, cdc-out, row history — as nothing at all. Run `voltro db apply` to replace it."), n.length > 0 ? n.join("\n") : void 0;
+};
+//#endregion
+export { t as REACTIVE_TRIGGER_PREFIX, a as detectReactiveTriggerDrift, o as formatReactiveTriggerDrift };

package/dist/migrations/reactiveTriggerName.js

@@ -0,0 +1,7 @@
+//#region src/migrations/reactiveTriggerName.ts
+var e = "framework_changes", t = "framework_changes_", n = (e, n) => n === "framework_changes" ? `${t}${e}` : `${t}${n}_${e}`, r = (e, t) => a(n(e, t).replace(/[A-Z]/g, (e) => e.toLowerCase())), i = 63, a = (e) => {
+	let t = new TextEncoder().encode(e);
+	return t.length <= i ? e : new TextDecoder().decode(t.subarray(0, i)).replace(/�+$/u, "");
+}, o = (e) => e === "framework_changes" ? "framework_notify_change" : `framework_notify_change_${e}`, s = "voltro:notify:v2";
+//#endregion
+export { e as DEFAULT_CDC_CHANNEL, s as NOTIFY_BODY_MARKER, t as REACTIVE_TRIGGER_PREFIX, o as notifyFunctionName, n as reactiveTriggerName, r as storedReactiveTriggerName };

package/dist/migrations/renameMssqlCheck.js

@@ -0,0 +1,21 @@
+import { quoteIdent as e } from "../dialect.js";
+//#region src/migrations/renameMssqlCheck.ts
+var t = (t, n, r) => {
+	let i = t.match(/'(?:''|[^'])*'|\[(?:\]\]|[^\]])*\]|\s+|[^'\[\s]+/g) ?? [];
+	if (i.join("") !== t || i.some((e) => !e.startsWith("'") && !e.startsWith("[") && /"|\/\*|--/.test(e))) throw Error("Cannot safely rename CHECK: unsupported catalog SQL; use an explicit migration");
+	let a = i.map((e, t) => ({
+		value: e,
+		index: t
+	})).filter((e) => e.value.trim() !== ""), o = 0;
+	for (let t = 0; t < a.length; t++) {
+		let s = a[t];
+		if (s.value !== e(n, "mssql")) continue;
+		let c = a[t - 1]?.value ?? "", l = a[t + 1]?.value ?? "";
+		if (c.endsWith(".") || l.startsWith(".") || l.startsWith("(")) throw Error(`Cannot safely rename CHECK reference '${n}': qualified or callable identifier; use an explicit migration`);
+		i[s.index] = e(r, "mssql"), o++;
+	}
+	if (o === 0 || i.join("").length === 0) throw Error(`Cannot safely rename CHECK reference '${n}': no exact catalog column token; use an explicit migration`);
+	return i.join("");
+};
+//#endregion
+export { t as renameMssqlCheck };

package/dist/migrations/restoreSnapshots.js

@@ -0,0 +1,206 @@
+import { acquireMigrationLock as e } from "./lock.js";
+import { dialectOf as t, migrationAtomicityFor as n } from "./resumeLedger.js";
+import { introspectSchema as r } from "./introspect.js";
+import { readSoftDropSnapshot as i } from "./softDropSnapshot.js";
+import { withMigrationTransaction as a } from "./transactionCause.js";
+import { runMigrationOp as o } from "./applier.js";
+import { Effect as s } from "effect";
+import { SqlClient as c } from "effect/sql";
+//#region src/migrations/restoreSnapshots.ts
+var l = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) n.kind === "table" && !t.has(n.originalName) && t.set(n.originalName, n.snapshotName);
+	return t;
+}, u = (e, t) => {
+	if (Object.getPrototypeOf(e) !== Array.prototype || Object.getOwnPropertySymbols(e).length > 0 || Object.hasOwn(e, "find") || Object.hasOwn(e, "some") || Object.hasOwn(e, "map") || Object.hasOwn(e, "constructor")) return !1;
+	for (let n = 0; n < e.length; n++) {
+		let r = Object.getOwnPropertyDescriptor(e, String(n));
+		if (r === void 0 || !("value" in r)) return !1;
+		let i = r.value;
+		if (typeof i != "object" || !i) return !1;
+		let a = Object.getPrototypeOf(i);
+		if (a !== Object.prototype && a !== null) return !1;
+		for (let e of t) {
+			let t = Object.getOwnPropertyDescriptor(i, e);
+			if (t === void 0 || !("value" in t)) return !1;
+		}
+	}
+	return !0;
+}, d = (e) => s.gen(function* () {
+	let t = e.onDialectOrElse({
+		mysql: () => e`CAST(${e("operations")} AS CHAR)`,
+		mssql: () => e`CAST(${e("operations")} AS NVARCHAR(MAX))`,
+		orElse: () => e`CAST(${e("operations")} AS TEXT)`
+	}), n = e`(${t} LIKE ${"%softDropSnapshot%"} OR ${t} LIKE ${"%\\%"} ESCAPE '!')`, r = e.onDialectOrElse({
+		pg: () => e`CASE WHEN pg_typeof(${e("operations")})::text IN ('json', 'jsonb')
+      THEN jsonb_path_exists(${e("operations")}::jsonb, '$[*].softDropSnapshot')
+      ELSE ${n} END`,
+		orElse: () => n
+	}), i = [], a;
+	for (;;) {
+		let t = yield* e`
+      SELECT ${e("id")}, ${e("operations")} FROM ${e("_voltro_migration_plans")}
+      WHERE ${r} ${a === void 0 ? e`` : e`AND ${e("id")} > ${a}`}
+      ORDER BY ${e("id")}
+      ${e.onDialectOrElse({
+			mssql: () => e`OFFSET 0 ROWS FETCH NEXT 100 ROWS ONLY`,
+			orElse: () => e`LIMIT 100`
+		})}
+    `;
+		if (i.push(...t), t.length < 100) return i;
+		a = t[t.length - 1].id;
+	}
+}), f = (e, t) => {
+	let n = [], r = /* @__PURE__ */ new Map(), i = (e, t) => JSON.stringify(e.kind === "table" ? ["table", e.snapshotName] : [
+		"column",
+		t.get(e.table) ?? e.table,
+		e.snapshotName
+	]);
+	for (let a of e) {
+		let e;
+		try {
+			e = typeof a.operations == "string" ? JSON.parse(a.operations) : a.operations;
+		} catch {
+			continue;
+		}
+		if (!Array.isArray(e)) continue;
+		let o = [];
+		for (let t of e) m(t) && m(t.op) && typeof t.softDropSnapshot == "string" && typeof t.op.table == "string" && (t.op.kind === "drop-table" && o.push({
+			kind: "table",
+			table: t.op.table,
+			originalName: t.op.table,
+			snapshotName: t.softDropSnapshot
+		}), t.op.kind === "drop-column" && typeof t.op.column == "string" && o.push({
+			kind: "column",
+			table: t.op.table,
+			originalName: t.op.column,
+			snapshotName: t.softDropSnapshot
+		}));
+		let s = l(o);
+		for (let e of o) {
+			let t = i(e, s), n = r.get(t) ?? /* @__PURE__ */ new Set();
+			n.add(a.id), r.set(t, n);
+		}
+		try {
+			let r = g(e, t);
+			r.length > 0 && n.push({
+				planId: a.id,
+				objects: r
+			});
+		} catch {}
+	}
+	return n.filter((e) => {
+		let t = l(e.objects);
+		return e.objects.every((e) => r.get(i(e, t))?.size === 1);
+	});
+}, p = (e, t) => d(e).pipe(s.map((e) => f(e, t))), m = (e) => typeof e == "object" && !!e && !Array.isArray(e), h = {
+	postgres: !0,
+	mysql: !1,
+	mariadb: !1,
+	mssql: !0,
+	sqlite: !0
+}, g = (e, t) => {
+	let n = typeof e == "string" ? JSON.parse(e) : e;
+	if (!Array.isArray(n)) throw Error("Snapshot restoration requires an operation array");
+	let r = [], a = /* @__PURE__ */ new Set();
+	for (let e of n) {
+		if (!m(e) || !m(e.op) || typeof e.op.kind != "string") throw Error("Invalid migration operation history");
+		let t = e.op;
+		if (t.kind !== "drop-column" && t.kind !== "drop-table") {
+			if (e.softDropSnapshot !== void 0) throw Error("Snapshot metadata belongs to a non-drop operation");
+			continue;
+		}
+		if (typeof t.table != "string" || !t.table || t.kind === "drop-column" && (typeof t.column != "string" || !t.column)) throw Error("Invalid drop operation identity");
+		if (typeof e.softDropSnapshot != "string") throw Error("Snapshot ownership is unavailable for this plan. Its history has no exact soft-drop identity; automatic restoration is refused.");
+		let n = {
+			op: t.kind === "drop-table" ? {
+				kind: "drop-table",
+				table: t.table
+			} : {
+				kind: "drop-column",
+				table: t.table,
+				column: String(t.column)
+			},
+			classification: "lossy",
+			atomicByDialect: h,
+			softDropSnapshot: e.softDropSnapshot
+		}, o = i(n), s = {
+			kind: t.kind === "drop-table" ? "table" : "column",
+			table: t.table,
+			originalName: t.kind === "drop-table" ? t.table : String(t.column),
+			snapshotName: o
+		}, c = JSON.stringify([
+			s.kind,
+			s.table,
+			s.originalName
+		]);
+		if (a.has(c)) throw Error("Duplicate snapshot restoration target");
+		a.add(c), r.push(s);
+	}
+	r.sort((e, t) => Number(e.kind === "column") - Number(t.kind === "column"));
+	let o = /* @__PURE__ */ new Set(), s = r.length >= 64 && u(t.tables, ["name", "columns"]), c;
+	if (s) {
+		let e = /* @__PURE__ */ new Map();
+		for (let n of t.tables) e.has(n.name) || e.set(n.name, n);
+		let n = /* @__PURE__ */ new Set(), i = l(r);
+		for (let t of r) {
+			if (t.kind !== "column") continue;
+			let r = e.get(i.get(t.table) ?? t.table);
+			if (!(r === void 0 || n.has(r))) {
+				if (n.add(r), !u(r.columns, ["name"])) {
+					s = !1;
+					break;
+				}
+				o.add(r);
+			}
+		}
+		s && (c = e);
+	}
+	let d = (e) => c === void 0 ? t.tables.find((t) => t.name === e) : c.get(e), f = l(r), p = /* @__PURE__ */ new Map(), g = (e, t) => (s && e.columns.length >= 32 && !p.has(e) && p.set(e, o.has(e) ? new Set(e.columns.map((e) => e.name)) : void 0), p.get(e)?.has(t) ?? e.columns.some((e) => e.name === t));
+	for (let e of r) if (e.kind === "table") {
+		if (c === void 0 ? t.tables.some((t) => t.name === e.originalName) : c.has(e.originalName)) throw Error(`Restore target already exists: ${e.originalName}`);
+		if (!(c === void 0 ? t.tables.some((t) => t.name === e.snapshotName) : c.has(e.snapshotName))) throw Error(`Recorded snapshot is missing: ${e.snapshotName}`);
+	} else {
+		let t = d(f.get(e.table) ?? e.table);
+		if (!t) throw Error(`Restore table is missing: ${e.table}`);
+		if (g(t, e.originalName)) throw Error(`Restore target already exists: ${e.table}.${e.originalName}`);
+		if (!g(t, e.snapshotName)) throw Error(`Recorded snapshot is missing: ${e.table}.${e.snapshotName}`);
+	}
+	return r;
+}, _ = (i, l, u = {}) => s.acquireUseRelease(e(i), () => {
+	let e = s.gen(function* () {
+		let e = yield* c.SqlClient, t = yield* e`SELECT ${e("operations")} FROM ${e("_voltro_migration_plans")} WHERE ${e("id")} = ${l}`;
+		if (t.length !== 1) return yield* s.fail(/* @__PURE__ */ Error(`Snapshot plan not found: ${l}`));
+		let n = yield* r(e), i = yield* s.try({
+			try: () => g(t[0].operations, n),
+			catch: (e) => e instanceof Error ? e : Error(String(e))
+		});
+		if (i.length > 0 && !(yield* p(e, n)).some((e) => e.planId === l)) return yield* s.fail(/* @__PURE__ */ Error("Snapshot ownership is ambiguous across migration history; automatic restoration is refused."));
+		i.length > 0 && u.beforeExecute && (yield* u.beforeExecute(e));
+		for (let t of i) {
+			let n = {
+				op: t.kind === "table" ? {
+					kind: "rename-table",
+					from: t.snapshotName,
+					to: t.originalName
+				} : {
+					kind: "rename-column",
+					table: t.table,
+					from: t.snapshotName,
+					to: t.originalName
+				},
+				classification: "safe",
+				atomicByDialect: h
+			};
+			yield* o(e, n, []);
+		}
+		return {
+			restoredColumns: i.filter((e) => e.kind === "column").length,
+			restoredTables: i.filter((e) => e.kind === "table").length,
+			objects: i
+		};
+	});
+	return n(t(i)) === "plan-transactional" ? a(i, e) : e;
+}, (e) => e.release.pipe(s.orDie));
+//#endregion
+export { f as findMigrationSnapshotCandidates, g as planSnapshotRestoration, p as readMigrationSnapshotCandidates, _ as restoreMigrationSnapshots };

package/dist/migrations/resumeLedger.js

@@ -0,0 +1,86 @@
+import { id as e, integer as t, text as n, timestamp as r } from "../columns.js";
+import { table as i } from "../table.js";
+//#region src/migrations/resumeLedger.ts
+var a = (e) => e.onDialectOrElse({
+	pg: () => "postgres",
+	mysql: () => "mysql",
+	mssql: () => "mssql",
+	sqlite: () => "sqlite",
+	orElse: () => "sqlite"
+}), o = {
+	postgres: "plan-transactional",
+	mssql: "plan-transactional",
+	mysql: "per-operation",
+	mariadb: "per-operation",
+	sqlite: "per-operation",
+	turso: "per-operation"
+}, s = (e) => o[e], c = "_voltro_migration_ops", l = i(c, {
+	id: e({ prefix: "mop" }),
+	runId: n(),
+	planFingerprint: n(),
+	opIndex: t(),
+	opKind: n(),
+	opTarget: n(),
+	status: n(),
+	payload: n(),
+	startedAt: r().nullable(),
+	appliedAt: r().nullable(),
+	durationMs: t().nullable(),
+	createdAt: r().default("now")
+}), u = (e) => {
+	switch (e.kind) {
+		case "create-table": return /* @__PURE__ */ new Set([
+			`table:${e.table}`,
+			...e.columns.map((t) => `column:${e.table}.${t.name}`),
+			...e.indexes.map((t) => `index:${e.table}.${t.name}`)
+		]);
+		case "drop-table": return /* @__PURE__ */ new Set([`table:${e.table}`]);
+		case "add-enum-value": return /* @__PURE__ */ new Set([`enum:${e.enumName ?? `${e.table}.${e.column}`}.${e.value}`]);
+		case "rename-table": return /* @__PURE__ */ new Set([`table:${e.from}`, `table:${e.to}`]);
+		case "add-column": return /* @__PURE__ */ new Set([`column:${e.table}.${e.column.name}`]);
+		case "rename-column": return /* @__PURE__ */ new Set([`column:${e.table}.${e.from}`, `column:${e.table}.${e.to}`]);
+		case "drop-column":
+		case "alter-column-nullability":
+		case "alter-column-type":
+		case "alter-column-default":
+		case "add-unique":
+		case "drop-unique":
+		case "add-foreign-key":
+		case "drop-foreign-key":
+		case "add-check":
+		case "drop-check":
+		case "reconcile-json-check": return /* @__PURE__ */ new Set([`column:${e.table}.${e.column}`]);
+		case "add-index": return /* @__PURE__ */ new Set([`index:${e.table}.${e.index.name}`]);
+		case "drop-index": return /* @__PURE__ */ new Set([`index:${e.table}.${e.index}`]);
+		case "rename-index": return /* @__PURE__ */ new Set([`index:${e.table}.${e.from}`, `index:${e.table}.${e.to}`]);
+		case "add-unique-composite":
+		case "drop-unique-composite": return /* @__PURE__ */ new Set([`unique:${e.table}.${e.name}`]);
+		case "convert-charset": return /* @__PURE__ */ new Set([
+			`table:${e.table}`,
+			...e.columns.map((t) => `column:${e.table}.${t}`),
+			...e.foreignKeys.map((e) => `column:${e.table}.${e.column}`)
+		]);
+	}
+}, d = (e) => [...u(e)].join(" "), f = (e, t) => {
+	let n = u(t);
+	for (let t of u(e)) if (n.has(t)) return !0;
+	return !1;
+}, p = (e, t) => e.operations.some((e) => f(e.op, t)), m = "__voltro_rebuild", h = "__shadow", g = "__old", _ = /* @__PURE__ */ new Set([
+	"add-unique",
+	"drop-unique",
+	"add-unique-composite",
+	"drop-unique-composite",
+	"add-foreign-key",
+	"drop-foreign-key",
+	"add-check",
+	"drop-check",
+	"alter-column-nullability",
+	"alter-column-type",
+	"alter-column-default"
+]), v = /* @__PURE__ */ new Set(["alter-column-default", "alter-column-nullability"]), y = (e, t, n) => {
+	let r = n === "sqlite" || n === "turso";
+	return n === "postgres" && e.kind === "add-index" && t === "online-required" || e.kind === "alter-column-type" && t === "online-required" || r && _.has(e.kind) ? "artefact-repair" : v.has(e.kind) ? "idempotent" : "probe-then-replay";
+};
+Object.keys(o);
+//#endregion
+export { o as MIGRATION_ATOMICITY, c as MIGRATION_OPS_TABLE, h as SHADOW_COLUMN_SUFFIX, g as SHADOW_OLD_SUFFIX, m as SQLITE_REBUILD_SUFFIX, l as _voltroMigrationOpsTable, a as dialectOf, s as migrationAtomicityFor, p as opStillOutstanding, d as opTargetLabel, u as opTargets, f as opsShareTarget, y as resumeIdempotencyFor };

package/dist/migrations/rollingDeploy.js

@@ -0,0 +1,106 @@
+//#region src/migrations/rollingDeploy.ts
+var e = (e) => new Set(e.flatMap((e) => e.op.kind === "create-table" ? [e.op.table] : [])), t = (e, t) => t !== void 0 && "table" in e && t.createdTables.has(e.table), n = { safe: !0 }, r = (e, r) => {
+	if (t(e, r)) return n;
+	switch (e.kind) {
+		case "add-enum-value": return { safe: !0 };
+		case "drop-column": return {
+			safe: !1,
+			reason: `instances on the previous release still SELECT/INSERT "${e.table}"."${e.column}"; after the drop those queries error mid-rollout`,
+			remedy: "stop reading the column in code and deploy that first; drop it in a LATER deploy (expand/contract)"
+		};
+		case "drop-table": return {
+			safe: !1,
+			reason: `instances on the previous release still query table "${e.table}"; after the drop every such query errors mid-rollout`,
+			remedy: `remove all code that touches "${e.table}" and deploy that first; drop the table in a LATER deploy`
+		};
+		case "rename-column": return {
+			safe: !1,
+			reason: `instances on the previous release reference "${e.table}"."${e.from}", which no longer exists after the rename`,
+			remedy: `add "${e.to}" alongside "${e.from}" + backfill + dual-write, cut code over, then drop "${e.from}" in a LATER deploy`
+		};
+		case "rename-table": return {
+			safe: !1,
+			reason: `instances on the previous release query table "${e.from}", which no longer exists after the rename`,
+			remedy: `create "${e.to}" as a copy + dual-write, cut code over, then drop "${e.from}" in a LATER deploy`
+		};
+		case "alter-column-type": return e.from === e.to ? {
+			safe: !1,
+			reason: `instances on the previous release read/write "${e.table}"."${e.column}" against its current ${e.from} storage; changed parameters or encoding can reject writes or change the meaning of reads`,
+			remedy: "inspect the plan's storage-change reason: parameter narrowing needs every writer already producing values that fit; an encoding change requires verified data conversion and matching readers/writers, using expand/contract or a deployment with no overlap"
+		} : {
+			safe: !1,
+			reason: `instances on the previous release read/write "${e.table}"."${e.column}" as ${e.from}; the new ${e.to} type can reject their writes or fail to decode their reads`,
+			remedy: "add a new column of the target type + backfill + dual-write, cut code over, then drop the old column in a LATER deploy"
+		};
+		case "alter-column-nullability": return e.toNullable ? n : {
+			safe: !1,
+			reason: `instances on the previous release may INSERT "${e.table}" without (or with NULL in) "${e.column}", which the new NOT NULL rejects`,
+			remedy: `make code always write "${e.column}" and deploy that first; add NOT NULL in a LATER deploy (with a default to cover the gap)`
+		};
+		case "add-unique":
+		case "add-unique-composite": return {
+			safe: !1,
+			reason: `instances on the previous release still write "${e.table}" without honouring the new uniqueness; a colliding insert now fails mid-rollout`,
+			remedy: "make code enforce uniqueness first and deploy that; add the constraint in a LATER deploy once no old writer remains"
+		};
+		case "reconcile-json-check": return e.previousValidation === "container" && e.validation === "value" ? n : {
+			safe: !1,
+			reason: `instances on the previous release write "${e.table}"."${e.column}" without the new JSON validation, which now rejects them`,
+			remedy: "ensure all writers supply valid JSON in the required domain before enabling this check"
+		};
+		case "add-check": return e.table.startsWith("_voltro_") ? n : {
+			safe: !1,
+			reason: `instances on the previous release may write values to "${e.table}" the new CHECK rejects`,
+			remedy: "make code satisfy the constraint first and deploy that; add the CHECK in a LATER deploy"
+		};
+		case "add-foreign-key": return {
+			safe: !1,
+			reason: `instances on the previous release may write "${e.table}"."${e.column}" values with no matching parent row, which the new FK rejects`,
+			remedy: "make code guarantee the referent first and deploy that; add the FK in a LATER deploy"
+		};
+		case "convert-charset": return e.charset === "utf8mb4" ? n : {
+			safe: !1,
+			reason: `instances on the previous release may write 4-byte characters into "${e.table}", which utf8mb3 rejects with errno 1366`,
+			remedy: "keep utf8mb4 while any writer on the previous release remains; narrow in a LATER deploy, after every writer refuses such input itself"
+		};
+		case "create-table":
+		case "add-column":
+		case "add-index":
+		case "drop-index":
+		case "rename-index":
+		case "alter-column-default":
+		case "drop-unique":
+		case "drop-unique-composite":
+		case "drop-foreign-key":
+		case "drop-check": return n;
+	}
+}, i = (t) => {
+	let n = [], i = { createdTables: e(t) };
+	for (let e of t) {
+		let t = r(e.op, i);
+		t.safe || n.push({
+			op: e,
+			reason: t.reason,
+			remedy: t.remedy
+		});
+	}
+	return n;
+}, a = (e) => {
+	if (!e.enabled || e.unsafeCount === 0) return {
+		refuse: !1,
+		warnForced: !1,
+		message: ""
+	};
+	let t = `${e.unsafeCount} operation(s) are UNSAFE under a rolling deploy (VOLTRO_ROLLING_DEPLOY=1)`;
+	return e.forced ? {
+		refuse: !1,
+		warnForced: !0,
+		message: `${t} — proceeding anyway (--force). Old instances may error mid-rollout.`
+	} : {
+		refuse: !0,
+		warnForced: !1,
+		message: `${t}. Old instances would break against the new schema mid-rollout. Split into expand → deploy → contract (see the ⚠ list above), deploy with no overlap (maintenance window / scale-to-zero), or pass --force to override.`
+	};
+};
+//#endregion
+export { a as assessRollingDeployGate, r as classifyRollingDeploySafety, e as createdTablesOf, i as rollingDeployUnsafeOps };

package/dist/migrations/schemaOwner.js

@@ -0,0 +1,46 @@
+import { dialectOf as e } from "./resumeLedger.js";
+import { SCHEMA_OWNER_TABLE as t } from "./schemaOwnerTable.js";
+import { appliedAtValue as n } from "./appliedAtValue.js";
+import { ensureSchemaOwnerTable as r } from "./applier.js";
+import { Effect as i } from "effect";
+//#region src/migrations/schemaOwner.ts
+var a = "owner", o = (e) => i.map(e`SELECT ${e("appName")}, ${e("claimedAt")} FROM ${e(t)} WHERE ${e("id")} = ${a}`, (e) => e[0]), s = (e, t) => e.appName === t ? { kind: "owned" } : {
+	kind: "foreign",
+	owner: e.appName,
+	claimedAt: e.claimedAt === void 0 || e.claimedAt === null ? void 0 : String(e.claimedAt)
+}, c = (t, n) => r(t, e(t), n).pipe(i.catch(() => r(t, e(t), n))), l = (e, t, r) => i.gen(function* () {
+	if (!r.mayWrite) {
+		let n = yield* o(e).pipe(i.catch(() => i.succeed(void 0)));
+		return n === void 0 ? { kind: "unclaimed" } : s(n, t.appName);
+	}
+	yield* c(e, r.charset);
+	let l = yield* o(e);
+	if (l !== void 0) return s(l, t.appName);
+	let u = yield* n(e, (/* @__PURE__ */ new Date()).toISOString());
+	if (yield* e`INSERT INTO ${e("_voltro_schema_owner")} ${e.insert({
+		id: a,
+		appName: t.appName,
+		projectName: t.projectName ?? null,
+		frameworkVersion: t.frameworkVersion ?? null,
+		claimedAt: u
+	})}`.pipe(i.as(!0), i.catch(() => i.succeed(!1)))) return { kind: "claimed" };
+	let d = yield* o(e);
+	return d === void 0 ? { kind: "unclaimed" } : s(d, t.appName);
+}), u = (e, r, s) => i.gen(function* () {
+	yield* c(e, s);
+	let i = yield* o(e), l = yield* n(e, (/* @__PURE__ */ new Date()).toISOString());
+	return i === void 0 ? yield* e`INSERT INTO ${e(t)} ${e.insert({
+		id: a,
+		appName: r.appName,
+		projectName: r.projectName ?? null,
+		frameworkVersion: r.frameworkVersion ?? null,
+		claimedAt: l
+	})}` : yield* e`UPDATE ${e(t)} SET ${e.update({
+		appName: r.appName,
+		projectName: r.projectName ?? null,
+		frameworkVersion: r.frameworkVersion ?? null,
+		claimedAt: l
+	})} WHERE ${e("id")} = ${a}`, { previous: i?.appName };
+}), d = (e, t, n) => `this database belongs to the app '${t}'${n === void 0 ? "" : ` (claimed ${n})`}, and '${e}' is a different app. Two apps on one schema each plan to drop the other's tables, and their data is shared with no contract between them. Give this app its own database (DB_URL) or its own schema (DB_SCHEMA); if it needs the other app's data, call it — \`apis:\` on this app, \`service:\` procedures on the other. If this app was RENAMED from '${t}', run \`voltro db claim\` once to hand the schema over.`;
+//#endregion
+export { t as SCHEMA_OWNER_TABLE, l as checkSchemaOwner, d as foreignOwnerMessage, u as transferSchemaOwner };

package/dist/migrations/schemaOwnerTable.js

@@ -0,0 +1,4 @@
+//#region src/migrations/schemaOwnerTable.ts
+var e = "_voltro_schema_owner";
+//#endregion
+export { e as SCHEMA_OWNER_TABLE };

package/dist/migrations/softDropSnapshot.js

@@ -0,0 +1,20 @@
+//#region src/migrations/softDropSnapshot.ts
+var e = (e, t) => {
+	let n = e.op;
+	if (n.kind !== "drop-column" && n.kind !== "drop-table") return e;
+	let r = n.kind === "drop-column" ? n.column : n.table, i = t.replace(/[-:T.Z]/g, "").slice(0, 14);
+	if (!/^\d{14}$/.test(i)) throw Error("Invalid soft-drop snapshot timestamp");
+	return {
+		...e,
+		softDropSnapshot: `${r}__dropped_${i}`
+	};
+}, t = (e) => {
+	if (e.softDropSnapshot === void 0) return;
+	let t = e.op;
+	if (t.kind !== "drop-column" && t.kind !== "drop-table") throw Error("Soft-drop snapshot belongs to a non-drop operation");
+	let n = t.kind === "drop-column" ? t.column : t.table, r = e.softDropSnapshot;
+	if (typeof r != "string" || !r.startsWith(`${n}__dropped_`) || !/^\d{14}$/.test(r.slice(n.length + 10))) throw Error("Soft-drop snapshot does not identify the original object");
+	return r;
+};
+//#endregion
+export { e as bindSoftDropSnapshot, t as readSoftDropSnapshot };

package/dist/migrations/sqlLimit.js

@@ -0,0 +1,8 @@
+import { dialectOf as e } from "./resumeLedger.js";
+//#region src/migrations/sqlLimit.ts
+var t = (t, n) => {
+	let r = Math.max(1, Math.floor(Number.isFinite(n) ? n : 1));
+	return t.literal(e(t) === "mssql" ? `OFFSET 0 ROWS FETCH NEXT ${r} ROWS ONLY` : `LIMIT ${r}`);
+};
+//#endregion
+export { t as limitClause };