mandrel-platform 1.1.0 → 1.3.0

package/scripts/check-destructive-migration.mjs

@@ -27,6 +27,18 @@
  * Comment lines (`--`, `/* … *​/`, `//`) are stripped before matching so a
  * `DROP` mentioned only in a comment does not trip the guard.
  *
+ * ONE carve-out, and only one (Story #367): a `DROP INDEX <name>` whose index
+ * the SAME migration file recreates LATER in the file (`CREATE [UNIQUE] INDEX
+ * <name>`) is **lossless** and does not trip the guard. Narrowing a partial
+ * index cannot be expressed any other way on SQLite — it is necessarily a drop
+ * followed immediately by a create — so an ordinary, reversible migration was
+ * demanding a human acknowledgement label. The carve-out is deliberately
+ * narrow and fails closed: a drop with no matching recreate, a recreate that
+ * appears BEFORE the drop (the index is still gone at the end of the
+ * migration), a recreate in a different file, an unparseable index name, and
+ * every non-INDEX drop all still block. No table, column, constraint, or
+ * TRUNCATE detection is relaxed.
+ *
  * The guard only inspects files whose path matches a migration glob (default
  * `**​/migrations/**` and `**​/drizzle/**` plus a `*.sql` tail), so an
  * unrelated source file mentioning `DROP` in a string never blocks a PR.
@@ -133,9 +145,11 @@ export function isMigrationFile(filePath, globs = DEFAULT_MIGRATION_GLOBS) {
 /**
  * Strip SQL / JS comments from a single line so a `DROP` that appears only in a
  * comment does not trip the guard. Handles `--`, `//`, and a `/* … *​/` opened
- * and closed on the same line. (Multi-line block comments are rare in migration
- * files and conservatively left in — a false positive there is acknowledgeable
- * via the override label.)
+ * and closed on the same line. A multi-line block comment's residue is left in
+ * DELIBERATELY on this side: it can only cause a false positive, which the
+ * override label acknowledges. It is `maskNonExecutable` — applied only to the
+ * text the RECREATE scan reads — that must be exact, because there the same
+ * residue would cause a false NEGATIVE.
  *
  * @param {string} line
  * @returns {string}
@@ -149,16 +163,59 @@ export function stripComments(line) {
   return out;
 }
 
-// The destructive-signal matchers. Each entry names the signal it detects so a
-// block message can tell the reviewer exactly what tripped the guard. Order is
-// most-specific-first only for readability; all are tested per line.
+/**
+ * The whole-text, LENGTH-PRESERVING counterpart of {@link stripComments}: same
+ * comment syntaxes, blanked in place rather than sliced out, so offsets stay
+ * comparable across every scan derived from the same source text.
+ *
+ * @param {string} text
+ * @returns {string}  Same length as `text`.
+ */
+export function maskComments(text) {
+  return text
+    .split("\n")
+    .map((line) => {
+      let out = line.replace(/\/\*.*?\*\//g, (m) => " ".repeat(m.length));
+      const candidates = [out.indexOf("--"), out.indexOf("//")].filter((i) => i !== -1);
+      if (candidates.length > 0) {
+        const cut = Math.min(...candidates);
+        out = out.slice(0, cut) + " ".repeat(out.length - cut);
+      }
+      return out;
+    })
+    .join("\n");
+}
+
+// The direction markers of a bidirectional migration — goose, sql-migrate, and
+// dbmate. Each one starts a section that runs independently of its neighbours.
+const SECTION_DIRECTIVE_RE =
+  /^[ \t]*--[ \t]*(?:\+goose\s+(?:Up|Down)|\+migrate\s+(?:Up|Down)|migrate:(?:up|down))\b/gim;
+
+/**
+ * The offsets at which a bidirectional migration changes section. A recreate on
+ * the far side of one of these does not run in the same direction as the drop:
+ * a `CREATE INDEX` in the Down section cannot un-drop an index the Up section
+ * dropped. Read from the RAW text — the markers are `--` comments, so anything
+ * that has already masked comments has erased them.
+ *
+ * @param {string} text
+ * @returns {number[]}  Ascending offsets.
+ */
+export function sectionBoundaries(text) {
+  const re = new RegExp(SECTION_DIRECTIVE_RE.source, "gim");
+  const offsets = [];
+  let m;
+  while ((m = re.exec(text)) !== null) offsets.push(m.index);
+  return offsets;
+}
+
+// The destructive-signal matchers evaluated per line. `DROP <object>` is NOT
+// in this list — it is scanned over the whole file so a `DROP INDEX` can be
+// paired with a later recreate (see scanDropStatements below). Each entry names
+// the signal it detects so a block message can tell the reviewer exactly what
+// tripped the guard.
 const DESTRUCTIVE_PATTERNS = [
   { signal: "ALTER TABLE … DROP", re: /\bALTER\s+TABLE\b[\s\S]*?\bDROP\b/i },
-  {
-    signal: "DROP statement",
-    // DROP TABLE/COLUMN/INDEX/SCHEMA/CONSTRAINT/VIEW/DATABASE/TYPE …
-    re: /\bDROP\s+(TABLE|COLUMN|INDEX|SCHEMA|CONSTRAINT|VIEW|DATABASE|TYPE|SEQUENCE|TRIGGER|FUNCTION)\b/i,
-  },
   { signal: "TRUNCATE", re: /\bTRUNCATE\b/i },
   {
     signal: "drizzle destructive op",
@@ -166,6 +223,213 @@ const DESTRUCTIVE_PATTERNS = [
   },
 ];
 
+// One identifier segment: bare, or quoted with "…", `…`, or […].
+const IDENT_SEGMENT_SOURCE = '(?:"[^"]+"|`[^`]+`|\\[[^\\]]+\\]|[A-Za-z_][A-Za-z0-9_$]*)';
+
+// A possibly schema-qualified identifier — every segment may be quoted
+// independently (`"public"."idx_x"`).
+const IDENT_SOURCE = `${IDENT_SEGMENT_SOURCE}(?:\\.${IDENT_SEGMENT_SOURCE})*`;
+
+// `DROP TABLE/COLUMN/INDEX/SCHEMA/CONSTRAINT/VIEW/DATABASE/TYPE …`. Scanned
+// globally so every occurrence is judged, not just the first on a line.
+const DROP_OBJECT_SOURCE =
+  "\\bDROP\\s+(TABLE|COLUMN|INDEX|SCHEMA|CONSTRAINT|VIEW|DATABASE|TYPE|SEQUENCE|TRIGGER|FUNCTION)\\b";
+
+// The dropped index NAMES, anchored at the `DROP` that already matched.
+// Tolerates postgres' `CONCURRENTLY` and the `IF EXISTS` guard, and captures
+// the WHOLE comma-separated list — `DROP INDEX a, b;` is valid postgres, and
+// excusing it on the strength of the first name alone would let `b` be dropped
+// with no recreate and no acknowledgement.
+const DROP_INDEX_LIST_RE = new RegExp(
+  `^DROP\\s+INDEX\\s+(?:CONCURRENTLY\\s+)?(?:IF\\s+EXISTS\\s+)?(${IDENT_SOURCE}(?:\\s*,\\s*${IDENT_SOURCE})*)`,
+  "i"
+);
+
+/**
+ * The normalized names a `DROP INDEX` statement targets, or `null` when the
+ * statement's name list cannot be parsed (which fails closed at the call site).
+ *
+ * @param {string} tail  Text starting at the matched `DROP`.
+ * @returns {string[]|null}
+ */
+export function parseDroppedIndexNames(tail) {
+  const m = DROP_INDEX_LIST_RE.exec(tail);
+  if (!m) return null;
+  // Re-match identifiers rather than splitting on "," so a quoted name that
+  // itself contains a comma stays one identifier.
+  const names = m[1].match(new RegExp(IDENT_SOURCE, "g"));
+  if (!names || names.length === 0) return null;
+  return names.map(normalizeIndexName);
+}
+
+// `CREATE [UNIQUE] INDEX [CONCURRENTLY] [IF NOT EXISTS] <name>`.
+const CREATE_INDEX_SOURCE =
+  `\\bCREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+(?:CONCURRENTLY\\s+)?(?:IF\\s+NOT\\s+EXISTS\\s+)?(${IDENT_SOURCE})`;
+
+/**
+ * Normalize an index identifier for comparison: unquote, drop any schema
+ * qualifier, and lowercase (SQL identifiers are case-insensitive unquoted).
+ *
+ * @param {string} raw
+ * @returns {string}
+ */
+export function normalizeIndexName(raw) {
+  const unquoted = raw.replace(/["`[\]]/g, "");
+  const segments = unquoted.split(".");
+  return segments[segments.length - 1].toLowerCase();
+}
+
+// A postgres dollar-quote delimiter: `$$` or `$tag$`.
+const DOLLAR_QUOTE_RE = /^\$([A-Za-z_][A-Za-z0-9_]*)?\$/;
+
+/**
+ * Blank out the spans of `text` that cannot execute — multi-line `/* … *​/`
+ * block comments, single-quoted SQL string literals, and postgres
+ * dollar-quoted bodies (`$$ … $$` / `$tag$ … $tag$`, which is how a function
+ * body reaches the server as a literal) — preserving LENGTH so offsets stay
+ * comparable with the unmasked text.
+ *
+ * The two scans are deliberately asymmetric, and both directions fail closed:
+ * the DROP scan reads text with only per-line comments stripped (detect as much
+ * as possible), while the RECREATE scan reads this masked text (excuse as
+ * little as possible). Without it, a `CREATE INDEX idx_a …` that never runs —
+ * commented out as a rollback note, or quoted inside an INSERT — would excuse a
+ * real `DROP INDEX idx_a`, and the index would be gone at the end of the
+ * migration with no acknowledgement. An unterminated quote masks the remainder
+ * of the file, which withdraws excuses rather than granting them.
+ *
+ * @param {string} text
+ * @returns {string}  Same length as `text`.
+ */
+export function maskNonExecutable(text) {
+  const chars = text.split("");
+  const blank = (from, to) => {
+    for (let k = from; k < to; k++) if (chars[k] !== "\n") chars[k] = " ";
+  };
+  let i = 0;
+  while (i < text.length) {
+    if (text[i] === "/" && text[i + 1] === "*") {
+      const close = text.indexOf("*/", i + 2);
+      const end = close === -1 ? text.length : close + 2;
+      blank(i, end);
+      i = end;
+      continue;
+    }
+    // `#` is a MySQL line comment. It is masked on THIS side only: blanking it
+    // on the drop side would let `INSERT … '#'; DROP TABLE x;` hide a real drop.
+    if (text[i] === "#") {
+      const nl = text.indexOf("\n", i);
+      const end = nl === -1 ? text.length : nl;
+      blank(i, end);
+      i = end;
+      continue;
+    }
+    if (text[i] === "$") {
+      const tag = DOLLAR_QUOTE_RE.exec(text.slice(i))?.[0];
+      if (tag) {
+        const close = text.indexOf(tag, i + tag.length);
+        const end = close === -1 ? text.length : close + tag.length;
+        blank(i, end);
+        i = end;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (text[i] === "'") {
+      let k = i + 1;
+      while (k < text.length) {
+        // '' is an escaped quote inside a SQL string literal, not a close.
+        if (text[k] === "'" && text[k + 1] === "'") {
+          k += 2;
+          continue;
+        }
+        if (text[k] === "'") {
+          k++;
+          break;
+        }
+        k++;
+      }
+      blank(i, k);
+      i = k;
+      continue;
+    }
+    i++;
+  }
+  return chars.join("");
+}
+
+/**
+ * Every index this text (re)creates, with the offset at which the CREATE
+ * appears. Offsets are what make the pairing order-sensitive: only a create
+ * that lands AFTER the drop leaves the index in place at the end of the
+ * migration.
+ *
+ * @param {string} text  Comment-stripped migration text.
+ * @returns {Array<{name: string, index: number}>}
+ */
+export function collectCreatedIndexes(text) {
+  const re = new RegExp(CREATE_INDEX_SOURCE, "gi");
+  const created = [];
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    created.push({ name: normalizeIndexName(m[1]), index: m.index });
+  }
+  return created;
+}
+
+/**
+ * Scan a migration file's text for `DROP <object>` statements, pairing a
+ * `DROP INDEX` with a later recreate of the same index in the same text.
+ *
+ * Three texts, all the same length so their offsets are comparable:
+ *   • `text`       — raw; the only place the section directives survive.
+ *   • `dropText`   — comments masked; what the DROP scan reads (detect as much
+ *                    as possible; multi-line block residue left in on purpose).
+ *   • `createText` — additionally non-executable spans masked; what the RECREATE
+ *                    scan reads (excuse as little as possible).
+ *
+ * @param {string} text  Raw migration text.
+ * @returns {{ destructiveDrops: number, recreatedIndexes: string[] }}
+ *   `destructiveDrops` counts the drops that still trip the guard;
+ *   `recreatedIndexes` names the index drops excused as lossless.
+ */
+export function scanDropStatements(text) {
+  const dropText = maskComments(text);
+  // Only an executable CREATE counts as a recreate — see maskNonExecutable.
+  const created = collectCreatedIndexes(maskNonExecutable(dropText));
+  // A recreate on the far side of a direction marker runs in the other
+  // direction — a Down-section CREATE cannot un-drop what Up dropped.
+  const boundaries = sectionBoundaries(text);
+  const sameSection = (dropAt, createAt) =>
+    !boundaries.some((b) => b > dropAt && b <= createAt);
+  const re = new RegExp(DROP_OBJECT_SOURCE, "gi");
+  let destructiveDrops = 0;
+  const recreatedIndexes = [];
+  let m;
+  while ((m = re.exec(dropText)) !== null) {
+    if (m[1].toUpperCase() === "INDEX") {
+      const names = parseDroppedIndexNames(dropText.slice(m.index));
+      // An unparseable name list fails closed — counted as destructive below.
+      // EVERY name in the list must be recreated after the drop; one excused
+      // name never excuses its neighbours.
+      if (
+        names &&
+        names.every((name) =>
+          created.some(
+            (c) => c.name === name && c.index > m.index && sameSection(m.index, c.index)
+          )
+        )
+      ) {
+        recreatedIndexes.push(...names);
+        continue;
+      }
+    }
+    destructiveDrops++;
+  }
+  return { destructiveDrops, recreatedIndexes };
+}
+
 /**
  * Scan a single migration file's text for destructive signals.
  *
@@ -181,6 +445,8 @@ export function scanMigrationText(text) {
       if (re.test(line)) found.add(signal);
     }
   }
+  const { destructiveDrops } = scanDropStatements(text);
+  if (destructiveDrops > 0) found.add("DROP statement");
   return [...found];
 }
 

package/scripts/check-destructive-migration.test.mjs

@@ -24,12 +24,19 @@ import { test } from "node:test";
 import {
   DEFAULT_MIGRATION_GLOBS,
   DEFAULT_OVERRIDE_LABEL,
+  collectCreatedIndexes,
   detectDestructiveMigrations,
   formatStepSummary,
   globToRegExp,
   isMigrationFile,
+  maskComments,
+  maskNonExecutable,
+  normalizeIndexName,
   parseArgs,
+  parseDroppedIndexNames,
+  scanDropStatements,
   scanMigrationText,
+  sectionBoundaries,
   stripComments,
 } from "./check-destructive-migration.mjs";
 
@@ -160,6 +167,294 @@ test("scanMigrationText: de-duplicates repeated signals", () => {
   assert.deepEqual(signals, ["DROP statement"]);
 });
 
+// ── the recreated-index carve-out (Story #367) ─────────────────────────────
+//
+// Narrowing a partial index on SQLite is necessarily DROP-then-CREATE. Before
+// #367 that lossless, everyday migration tripped a human-in-the-loop gate and
+// needed an acknowledgement label, which is how operators learn to wave the
+// check through. The carve-out is one shape and one shape only; the tests below
+// pin both halves — what it excuses, and everything it must still stop.
+
+test("a DROP INDEX recreated later in the same migration is lossless", () => {
+  const sql = [
+    "DROP INDEX idx_orders_open;",
+    "CREATE INDEX idx_orders_open ON orders (customer_id) WHERE status = 'open';",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), []);
+});
+
+test("the recreate is matched on the index name, not merely on some CREATE INDEX", () => {
+  const sql = ["DROP INDEX idx_orders_open;", "CREATE INDEX idx_orders_closed ON orders (id);"].join(
+    "\n"
+  );
+  assert.deepEqual(scanMigrationText(sql), ["DROP statement"]);
+});
+
+test("a DROP INDEX with no recreate still trips the guard", () => {
+  assert.deepEqual(scanMigrationText("DROP INDEX idx_users_email;"), ["DROP statement"]);
+});
+
+test("a recreate BEFORE the drop is not a recreate — the index is gone at the end", () => {
+  const sql = ["CREATE INDEX idx_orders_open ON orders (id);", "DROP INDEX idx_orders_open;"].join(
+    "\n"
+  );
+  assert.deepEqual(scanMigrationText(sql), ["DROP statement"]);
+});
+
+test("the carve-out tolerates IF EXISTS / IF NOT EXISTS, UNIQUE, quoting and schema qualifiers", () => {
+  const sql = [
+    'DROP INDEX IF EXISTS "public"."idx_orders_open";',
+    "CREATE UNIQUE INDEX IF NOT EXISTS idx_orders_open ON orders (id) WHERE archived = 0;",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), []);
+});
+
+test("a recreate in a DIFFERENT file does not excuse the drop", () => {
+  const files = {
+    "db/migrations/0012_drop_idx.sql": "DROP INDEX idx_orders_open;",
+    "db/migrations/0013_add_idx.sql": "CREATE INDEX idx_orders_open ON orders (id);",
+  };
+  const res = detectDestructiveMigrations({
+    changedFiles: Object.keys(files),
+    readFile: fakeReader(files),
+  });
+  assert.equal(res.destructive, true);
+  assert.equal(res.findings.length, 1);
+  assert.equal(res.findings[0].file, "db/migrations/0012_drop_idx.sql");
+});
+
+test("only the INDEX drop is excused — a table drop in the same file still blocks", () => {
+  const sql = [
+    "DROP INDEX idx_orders_open;",
+    "CREATE INDEX idx_orders_open ON orders (id);",
+    "DROP TABLE legacy_orders;",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), ["DROP statement"]);
+});
+
+test("dropping a table, a column, a constraint, or truncating is untouched by the carve-out", () => {
+  // Each of these pairs the destructive statement with a CREATE INDEX that
+  // recreates an index name, proving the pairing cannot leak past DROP INDEX.
+  const recreate = "\nDROP INDEX idx_x;\nCREATE INDEX idx_x ON t (a);";
+  assert.deepEqual(scanMigrationText(`DROP TABLE users;${recreate}`), ["DROP statement"]);
+  assert.deepEqual(scanMigrationText(`DROP COLUMN email;${recreate}`), ["DROP statement"]);
+  assert.deepEqual(scanMigrationText(`ALTER TABLE users DROP CONSTRAINT fk_org;${recreate}`), [
+    "ALTER TABLE … DROP",
+    "DROP statement",
+  ]);
+  assert.deepEqual(scanMigrationText(`ALTER TABLE users DROP COLUMN legacy_id;${recreate}`), [
+    "ALTER TABLE … DROP",
+    "DROP statement",
+  ]);
+  assert.deepEqual(scanMigrationText(`TRUNCATE audit_log;${recreate}`), ["TRUNCATE"]);
+  assert.deepEqual(scanMigrationText(`table.dropIndex('idx_x');${recreate}`), [
+    "drizzle destructive op",
+  ]);
+});
+
+test("a comma-separated drop list is excused only when EVERY name is recreated", () => {
+  // `DROP INDEX a, b;` is valid postgres. Pairing on the first name alone would
+  // let idx_b be dropped with no recreate and no acknowledgement.
+  const partial = ["DROP INDEX idx_a, idx_b;", "CREATE INDEX idx_a ON t (x);"].join("\n");
+  assert.deepEqual(scanMigrationText(partial), ["DROP statement"]);
+
+  const reversed = ["DROP INDEX idx_b, idx_a;", "CREATE INDEX idx_a ON t (x);"].join("\n");
+  assert.deepEqual(scanMigrationText(reversed), ["DROP statement"]);
+
+  const whole = [
+    "DROP INDEX IF EXISTS idx_a, idx_b;",
+    "CREATE INDEX idx_a ON t (x);",
+    "CREATE INDEX idx_b ON t (y);",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(whole), []);
+});
+
+test("parseDroppedIndexNames reads the whole list, or nothing", () => {
+  assert.deepEqual(parseDroppedIndexNames("DROP INDEX idx_a"), ["idx_a"]);
+  assert.deepEqual(parseDroppedIndexNames("DROP INDEX CONCURRENTLY idx_a , idx_b;"), [
+    "idx_a",
+    "idx_b",
+  ]);
+  assert.deepEqual(parseDroppedIndexNames('DROP INDEX IF EXISTS "public"."idx_a", idx_b'), [
+    "idx_a",
+    "idx_b",
+  ]);
+  // MySQL's `DROP INDEX i ON t` — the table is not part of the name list.
+  assert.deepEqual(parseDroppedIndexNames("DROP INDEX idx_a ON orders"), ["idx_a"]);
+  assert.equal(parseDroppedIndexNames("DROP INDEX ;"), null);
+  assert.equal(parseDroppedIndexNames("DROP TABLE users"), null);
+});
+
+test("a CREATE INDEX that never executes does not excuse a real drop", () => {
+  // Both of these leave the index gone at the end of the migration. Only an
+  // executable CREATE counts as a recreate.
+  const inBlockComment = [
+    "DROP INDEX idx_a;",
+    "/* rollback:",
+    "CREATE INDEX idx_a ON t (x);",
+    "*/",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(inBlockComment), ["DROP statement"]);
+
+  const inStringLiteral = [
+    "DROP INDEX idx_a;",
+    "INSERT INTO audit (msg) VALUES ('CREATE INDEX idx_a ON t (x)');",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(inStringLiteral), ["DROP statement"]);
+
+  const inLineComment = ["DROP INDEX idx_a;", "-- CREATE INDEX idx_a ON t (x);"].join("\n");
+  assert.deepEqual(scanMigrationText(inLineComment), ["DROP statement"]);
+});
+
+test("masking preserves offsets so a real recreate after a masked span still pairs", () => {
+  const sql = [
+    "DROP INDEX idx_a;",
+    "/* the index below replaces it */",
+    "INSERT INTO audit (msg) VALUES ('dropping idx_a');",
+    "CREATE INDEX idx_a ON t (x) WHERE archived = 0;",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), []);
+});
+
+test("maskNonExecutable blanks non-executable spans without moving anything", () => {
+  const text = "a /* b\nc */ d 'e f' g";
+  const masked = maskNonExecutable(text);
+  assert.equal(masked.length, text.length);
+  assert.equal(masked.indexOf("d"), text.indexOf("d"), "offsets must be preserved");
+  assert.ok(!masked.includes("b") && !masked.includes("c"), "block comment blanked");
+  assert.ok(!masked.includes("e") && !masked.includes("f"), "string literal blanked");
+  assert.ok(masked.includes("a") && masked.includes("g"), "executable text survives");
+  assert.equal((masked.match(/\n/g) ?? []).length, 1, "newlines survive");
+});
+
+test("a CREATE INDEX inside a dollar-quoted body does not excuse a drop", () => {
+  // A postgres function body reaches the server as a string literal — it does
+  // not run at migration time, so idx_a really is gone.
+  const sql = [
+    "DROP INDEX idx_a;",
+    "CREATE FUNCTION rebuild() RETURNS void AS $$",
+    "BEGIN CREATE INDEX idx_a ON t (x); END;",
+    "$$ LANGUAGE plpgsql;",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), ["DROP statement"]);
+
+  const tagged = [
+    "DROP INDEX idx_a;",
+    "CREATE FUNCTION rebuild() RETURNS void AS $body$",
+    "BEGIN CREATE INDEX idx_a ON t (x); END;",
+    "$body$ LANGUAGE plpgsql;",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(tagged), ["DROP statement"]);
+});
+
+test("a CREATE INDEX in a `#` MySQL line comment does not excuse a drop", () => {
+  const sql = ["DROP INDEX idx_a;", "# CREATE INDEX idx_a ON t (x);"].join("\n");
+  assert.deepEqual(scanMigrationText(sql), ["DROP statement"]);
+});
+
+test("a `#` on the drop side is not treated as a comment", () => {
+  // Masking `#` for the DROP scan too would let a literal containing one hide
+  // everything after it on the line.
+  assert.deepEqual(scanMigrationText("INSERT INTO t (c) VALUES ('#'); DROP TABLE users;"), [
+    "DROP statement",
+  ]);
+});
+
+test("a recreate in the Down section does not excuse a drop in the Up section", () => {
+  // goose, sql-migrate and dbmate all run one direction at a time: the Down
+  // CREATE INDEX does not run when Up drops the index.
+  const goose = [
+    "-- +goose Up",
+    "DROP INDEX idx_a;",
+    "-- +goose Down",
+    "CREATE INDEX idx_a ON t (x);",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(goose), ["DROP statement"]);
+
+  const dbmate = [
+    "-- migrate:up",
+    "DROP INDEX idx_a;",
+    "-- migrate:down",
+    "CREATE INDEX idx_a ON t (x);",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(dbmate), ["DROP statement"]);
+
+  const sqlMigrate = [
+    "-- +migrate Up",
+    "DROP INDEX idx_a;",
+    "-- +migrate Down",
+    "CREATE INDEX idx_a ON t (x);",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sqlMigrate), ["DROP statement"]);
+});
+
+test("a bidirectional migration that narrows an index in BOTH directions passes", () => {
+  // Each section pairs within itself — the section rule must not block the
+  // legitimate case it exists to keep honest.
+  const sql = [
+    "-- +goose Up",
+    "DROP INDEX idx_a;",
+    "CREATE INDEX idx_a ON t (x) WHERE archived = 0;",
+    "-- +goose Down",
+    "DROP INDEX idx_a;",
+    "CREATE INDEX idx_a ON t (x);",
+  ].join("\n");
+  assert.deepEqual(scanMigrationText(sql), []);
+});
+
+test("sectionBoundaries finds the direction markers in the raw text", () => {
+  const sql = ["-- +goose Up", "SELECT 1;", "-- +goose Down", "SELECT 2;"].join("\n");
+  const offsets = sectionBoundaries(sql);
+  assert.equal(offsets.length, 2);
+  assert.equal(offsets[0], 0);
+  assert.equal(offsets[1], sql.indexOf("-- +goose Down"));
+  assert.deepEqual(sectionBoundaries("DROP INDEX idx_a;"), []);
+});
+
+test("maskComments preserves length and blanks the same syntaxes stripComments does", () => {
+  const text = "keep -- gone\nkeep2 // gone\na /* gone */ b";
+  const masked = maskComments(text);
+  assert.equal(masked.length, text.length);
+  assert.ok(!masked.includes("gone"));
+  assert.ok(masked.includes("keep") && masked.includes("keep2") && masked.includes("b"));
+});
+
+test("a `$` inside an identifier is not a dollar quote", () => {
+  // Masking from a bare `$` to the next one would swallow a real recreate.
+  const sql = ["DROP INDEX idx$a;", "CREATE INDEX idx$a ON t (x);"].join("\n");
+  assert.deepEqual(scanMigrationText(sql), []);
+});
+
+test("maskNonExecutable: an escaped '' does not close the literal early", () => {
+  const masked = maskNonExecutable("x 'it''s CREATE INDEX idx_a' y");
+  assert.ok(!masked.includes("CREATE"));
+  assert.ok(masked.includes("x") && masked.includes("y"));
+});
+
+test("scanDropStatements reports which index drops were excused", () => {
+  const res = scanDropStatements(
+    "DROP INDEX idx_a;\nCREATE INDEX idx_a ON t (x);\nDROP TABLE t2;"
+  );
+  assert.equal(res.destructiveDrops, 1);
+  assert.deepEqual(res.recreatedIndexes, ["idx_a"]);
+});
+
+test("normalizeIndexName unquotes, de-qualifies and lowercases", () => {
+  assert.equal(normalizeIndexName('"public"."IDX_A"'), "idx_a");
+  assert.equal(normalizeIndexName("public.IDX_A"), "idx_a");
+  assert.equal(normalizeIndexName("`idx_a`"), "idx_a");
+  assert.equal(normalizeIndexName("[idx_a]"), "idx_a");
+});
+
+test("collectCreatedIndexes records every create with its offset", () => {
+  const created = collectCreatedIndexes("CREATE INDEX a ON t (x);\nCREATE UNIQUE INDEX b ON t (y);");
+  assert.deepEqual(
+    created.map((c) => c.name),
+    ["a", "b"]
+  );
+  assert.ok(created[1].index > created[0].index);
+});
+
 // ── detectDestructiveMigrations: end-to-end over a changed set ─────────────
 
 test("detect: flags a destructive migration file", () => {
@@ -340,6 +635,45 @@ test("CLI: comment-only DROP does not trip the guard (exit 0)", () => {
   }
 });
 
+test("CLI: a narrowed partial index passes with NO acknowledgement label (exit 0)", () => {
+  // The end-to-end shape of the false positive #367 removes: on SQLite this is
+  // the only way to narrow a partial index, and it was demanding a label.
+  const root = mkdtempSync(join(tmpdir(), "destmig-"));
+  try {
+    mkdirSync(join(root, "db", "migrations"), { recursive: true });
+    writeFileSync(
+      join(root, "db", "migrations", "0012_narrow_idx.sql"),
+      "DROP INDEX idx_orders_open;\n" +
+        "CREATE INDEX idx_orders_open ON orders (customer_id) WHERE status = 'open';\n"
+    );
+    const res = runCli(["--changed-files", "-", "--repo-root", root], {
+      input: "db/migrations/0012_narrow_idx.sql\n",
+    });
+    assert.equal(res.code, 0);
+    assert.ok(res.stdout.includes("No destructive migration detected"));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+test("CLI: dropping an index WITHOUT recreating it still blocks (exit 1)", () => {
+  const root = mkdtempSync(join(tmpdir(), "destmig-"));
+  try {
+    mkdirSync(join(root, "db", "migrations"), { recursive: true });
+    writeFileSync(
+      join(root, "db", "migrations", "0013_drop_idx.sql"),
+      "DROP INDEX idx_orders_open;\n"
+    );
+    const res = runCli(["--changed-files", "-", "--repo-root", root], {
+      input: "db/migrations/0013_drop_idx.sql\n",
+    });
+    assert.equal(res.code, 1);
+    assert.ok(res.stderr.includes("DROP statement"));
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("CLI: missing --changed-files is a usage error (exit 2)", () => {
   const res = runCli([]);
   assert.equal(res.code, 2);