mgcheck 0.1.0

package/dist/chunk-7JBFSZBD.js

@@ -0,0 +1,1212 @@
+// src/core/config.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+var DEFAULT_CONFIG = {
+  shadowDb: {
+    provider: "docker",
+    dockerImage: "postgres:16-alpine"
+  },
+  rules: {},
+  output: {
+    format: "terminal",
+    verbose: false
+  },
+  confirmDestructive: false
+};
+var CONFIG_FILES = [
+  ".mgcheckrc.json",
+  ".mgcheckrc.yml",
+  ".mgcheckrc",
+  "mgcheck.config.json"
+];
+function loadConfig(overrides = {}, configPath) {
+  let config = structuredClone(DEFAULT_CONFIG);
+  const fileConfig = loadConfigFile(configPath);
+  if (fileConfig) {
+    config = mergeConfig(config, fileConfig);
+  }
+  config = applyEnvVars(config);
+  config = mergeConfig(config, overrides);
+  return config;
+}
+function loadConfigFile(explicitPath) {
+  if (explicitPath) {
+    const fullPath = resolve(explicitPath);
+    if (!existsSync(fullPath)) {
+      throw new Error(`Config file not found: ${fullPath}`);
+    }
+    return parseConfigFile(fullPath);
+  }
+  for (const name of CONFIG_FILES) {
+    const fullPath = resolve(process.cwd(), name);
+    if (existsSync(fullPath)) {
+      return parseConfigFile(fullPath);
+    }
+  }
+  return null;
+}
+function parseConfigFile(filePath) {
+  try {
+    const content = readFileSync(filePath, "utf-8");
+    return JSON.parse(content);
+  } catch (err) {
+    throw new Error(`Failed to parse config file ${filePath}: ${err.message}`);
+  }
+}
+function applyEnvVars(config) {
+  const result = structuredClone(config);
+  if (process.env.MGCHECK_DB_URL) {
+    result.shadowDb.dbUrl = process.env.MGCHECK_DB_URL;
+  }
+  if (process.env.MGCHECK_DOCKER_IMAGE) {
+    result.shadowDb.dockerImage = process.env.MGCHECK_DOCKER_IMAGE;
+  }
+  if (process.env.MGCHECK_PROVIDER) {
+    const provider = process.env.MGCHECK_PROVIDER;
+    if (provider === "docker" || provider === "pglite") {
+      result.shadowDb.provider = provider;
+    }
+  }
+  if (process.env.MGCHECK_LLM_PROVIDER || process.env.MGCHECK_LLM_API_KEY) {
+    result.llm = {
+      provider: process.env.MGCHECK_LLM_PROVIDER || "openai",
+      model: process.env.MGCHECK_LLM_MODEL || "gpt-4o",
+      apiKey: process.env.MGCHECK_LLM_API_KEY || "",
+      maxFixAttempts: 1
+    };
+  }
+  return result;
+}
+function mergeConfig(a, b) {
+  const result = structuredClone(a);
+  if (b.shadowDb) {
+    Object.assign(result.shadowDb, b.shadowDb);
+  }
+  if (b.rules) {
+    Object.assign(result.rules, b.rules);
+  }
+  if (b.output) {
+    Object.assign(result.output, b.output);
+  }
+  if (b.confirmDestructive !== void 0) {
+    result.confirmDestructive = b.confirmDestructive;
+  }
+  if (b.llm) {
+    result.llm = { ...result.llm, ...b.llm };
+  }
+  return result;
+}
+function getRuleSeverity(ruleId, defaultSeverity, config) {
+  const override = config.rules[ruleId];
+  if (override === "off") return null;
+  if (override === "error" || override === "warning") return override;
+  return defaultSeverity;
+}
+
+// src/detector/index.ts
+import { statSync as statSync2, existsSync as existsSync4, readdirSync as readdirSync3 } from "fs";
+import { resolve as resolve2, join as join3 } from "path";
+
+// src/detector/raw-sql.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename } from "path";
+function detectRawSql(filePath) {
+  const sql = readFileSync2(filePath, "utf-8");
+  const file = {
+    path: filePath,
+    sql,
+    order: 0
+  };
+  return {
+    format: "raw-sql",
+    files: [file],
+    hasDownMigration: false,
+    basePath: filePath
+  };
+}
+function detectRawSqlDirectory(files) {
+  const sqlFiles = files.filter((f) => f.endsWith(".sql")).sort().map((filePath, index) => ({
+    path: filePath,
+    sql: readFileSync2(filePath, "utf-8"),
+    order: index
+  }));
+  const hasDown = sqlFiles.some(
+    (f) => basename(f.path).toLowerCase().includes("down") || basename(f.path).toLowerCase().includes("rollback")
+  );
+  return {
+    format: "raw-sql",
+    files: sqlFiles,
+    hasDownMigration: hasDown,
+    basePath: sqlFiles[0]?.path || ""
+  };
+}
+
+// src/detector/prisma.ts
+import { readFileSync as readFileSync3, existsSync as existsSync2, readdirSync, statSync } from "fs";
+import { join } from "path";
+function detectPrisma(dirPath) {
+  const migrationSqlPath = join(dirPath, "migration.sql");
+  if (existsSync2(migrationSqlPath)) {
+    const sql = readFileSync3(migrationSqlPath, "utf-8");
+    const hasDown2 = existsSync2(join(dirPath, "down.sql"));
+    return {
+      format: "prisma",
+      files: [{ path: migrationSqlPath, sql, order: 0 }],
+      hasDownMigration: hasDown2,
+      basePath: dirPath
+    };
+  }
+  const files = [];
+  const entries = readdirSync(dirPath).filter((entry) => {
+    const entryPath = join(dirPath, entry);
+    return statSync(entryPath).isDirectory();
+  }).sort();
+  let hasDown = false;
+  for (let i = 0; i < entries.length; i++) {
+    const entryDir = join(dirPath, entries[i]);
+    const sqlFile = join(entryDir, "migration.sql");
+    if (existsSync2(sqlFile)) {
+      files.push({
+        path: sqlFile,
+        sql: readFileSync3(sqlFile, "utf-8"),
+        order: i
+      });
+      if (existsSync2(join(entryDir, "down.sql"))) {
+        hasDown = true;
+      }
+    }
+  }
+  return {
+    format: "prisma",
+    files,
+    hasDownMigration: hasDown,
+    basePath: dirPath
+  };
+}
+function isPrismaDirectory(dirPath) {
+  if (existsSync2(join(dirPath, "migration.sql"))) {
+    return true;
+  }
+  try {
+    const entries = readdirSync(dirPath);
+    return entries.some((entry) => {
+      const entryPath = join(dirPath, entry);
+      return statSync(entryPath).isDirectory() && existsSync2(join(entryPath, "migration.sql"));
+    });
+  } catch {
+    return false;
+  }
+}
+
+// src/detector/drizzle.ts
+import { readFileSync as readFileSync4, existsSync as existsSync3, readdirSync as readdirSync2 } from "fs";
+import { join as join2 } from "path";
+function detectDrizzle(dirPath) {
+  const journalPath = join2(dirPath, "meta", "_journal.json");
+  const files = [];
+  if (existsSync3(journalPath)) {
+    const journal = JSON.parse(
+      readFileSync4(journalPath, "utf-8")
+    );
+    for (const entry of journal.entries) {
+      const sqlFile = join2(dirPath, `${entry.tag}.sql`);
+      if (existsSync3(sqlFile)) {
+        files.push({
+          path: sqlFile,
+          sql: readFileSync4(sqlFile, "utf-8"),
+          order: entry.idx
+        });
+      }
+    }
+  } else {
+    const sqlFiles = readdirSync2(dirPath).filter((f) => f.endsWith(".sql")).sort();
+    for (let i = 0; i < sqlFiles.length; i++) {
+      const filePath = join2(dirPath, sqlFiles[i]);
+      files.push({
+        path: filePath,
+        sql: readFileSync4(filePath, "utf-8"),
+        order: i
+      });
+    }
+  }
+  return {
+    format: "drizzle",
+    files,
+    hasDownMigration: false,
+    // Drizzle doesn't natively support down migrations
+    basePath: dirPath
+  };
+}
+function isDrizzleDirectory(dirPath) {
+  return existsSync3(join2(dirPath, "meta", "_journal.json"));
+}
+
+// src/detector/index.ts
+function detectMigration(inputPath) {
+  const fullPath = resolve2(inputPath);
+  if (!existsSync4(fullPath)) {
+    throw new Error(`Path does not exist: ${fullPath}`);
+  }
+  const stat = statSync2(fullPath);
+  if (stat.isFile()) {
+    if (!fullPath.endsWith(".sql")) {
+      throw new Error(
+        `Unsupported file type: ${fullPath}. Expected a .sql file.`
+      );
+    }
+    return detectRawSql(fullPath);
+  }
+  if (stat.isDirectory()) {
+    if (isPrismaDirectory(fullPath)) {
+      return detectPrisma(fullPath);
+    }
+    if (isDrizzleDirectory(fullPath)) {
+      return detectDrizzle(fullPath);
+    }
+    const entries = readdirSync3(fullPath);
+    const sqlFiles = entries.filter((f) => f.endsWith(".sql")).map((f) => join3(fullPath, f));
+    if (sqlFiles.length > 0) {
+      return detectRawSqlDirectory(sqlFiles);
+    }
+    throw new Error(
+      `No migration files found in ${fullPath}. Expected .sql files, a Prisma migration directory, or a Drizzle migration directory.`
+    );
+  }
+  throw new Error(`Unsupported path type: ${fullPath}`);
+}
+
+// src/analyzer/rules/types.ts
+function getStmtType(ast) {
+  if (!ast) return null;
+  const stmt = ast.RawStmt?.stmt || ast.stmt || ast;
+  const keys = Object.keys(stmt);
+  return keys.length > 0 ? keys[0] : null;
+}
+function getStmtNode(ast) {
+  if (!ast) return null;
+  const stmt = ast.RawStmt?.stmt || ast.stmt || ast;
+  const type = getStmtType(ast);
+  return type ? stmt[type] : null;
+}
+function sqlMatches(raw, pattern) {
+  return pattern.test(raw);
+}
+
+// src/analyzer/rules/create-index-not-concurrent.ts
+var createIndexNotConcurrent = {
+  id: "MG001",
+  name: "create-index-not-concurrent",
+  severity: "error",
+  description: "CREATE INDEX without CONCURRENTLY locks the table for writes during index build",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "IndexStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node && !node.concurrent) {
+            isViolation = true;
+          }
+        }
+      } else {
+        const pattern = /CREATE\s+INDEX\b(?!\s+CONCURRENTLY)/i;
+        const uniquePattern = /CREATE\s+UNIQUE\s+INDEX\b(?!\s+CONCURRENTLY)/i;
+        if ((sqlMatches(stmt.raw, pattern) || sqlMatches(stmt.raw, uniquePattern)) && !sqlMatches(stmt.raw, /CREATE\s+(UNIQUE\s+)?INDEX\s+CONCURRENTLY/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG001",
+          ruleName: "create-index-not-concurrent",
+          severity: "error",
+          message: "CREATE INDEX without CONCURRENTLY acquires a SHARE lock on the table, blocking all INSERT, UPDATE, and DELETE operations for the entire duration of the index build. On a table with millions of rows, this can block writes for minutes or hours.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Use CREATE INDEX CONCURRENTLY instead.\nNote: CONCURRENTLY cannot run inside a transaction block, so each index must be created in its own migration or with explicit transaction control."
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/alter-column-type.ts
+var alterColumnType = {
+  id: "MG002",
+  name: "alter-column-type",
+  severity: "error",
+  description: "ALTER COLUMN TYPE causes a full table rewrite with ACCESS EXCLUSIVE lock",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "AlterTableStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node?.cmds) {
+            for (const cmd of node.cmds) {
+              const alterCmd = cmd.AlterTableCmd;
+              if (alterCmd && (alterCmd.subtype === "AT_AlterColumnType" || alterCmd.subtype === 25)) {
+                isViolation = true;
+              }
+            }
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /ALTER\s+TABLE\b.*\bALTER\s+COLUMN\b.*\bTYPE\b/i)) {
+          isViolation = true;
+        }
+        if (sqlMatches(stmt.raw, /ALTER\s+TABLE\b.*\bSET\s+DATA\s+TYPE\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG002",
+          ruleName: "alter-column-type",
+          severity: "error",
+          message: "ALTER COLUMN TYPE triggers a full table rewrite, acquiring an ACCESS EXCLUSIVE lock that blocks ALL operations (including SELECT) for the entire duration. On a table with millions of rows, this can cause minutes of complete downtime.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Use the expand/contract pattern instead:\n1. Add a new column with the desired type\n2. Backfill data from the old column to the new one (in batches)\n3. Update application code to use the new column\n4. Drop the old column in a subsequent migration"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/add-column-not-null-no-default.ts
+var addColumnNotNullNoDefault = {
+  id: "MG003",
+  name: "add-column-not-null-no-default",
+  severity: "error",
+  description: "ADD COLUMN NOT NULL without DEFAULT causes table rewrite or failure on non-empty tables",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "AlterTableStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node?.cmds) {
+            for (const cmd of node.cmds) {
+              const alterCmd = cmd.AlterTableCmd;
+              if (alterCmd && (alterCmd.subtype === "AT_AddColumn" || alterCmd.subtype === 0)) {
+                const colDef = alterCmd.def?.ColumnDef || alterCmd.def;
+                if (colDef) {
+                  const hasNotNull = colDef.constraints?.some(
+                    (c) => c.Constraint?.contype === "CONSTR_NOTNULL" || c.Constraint?.contype === 1
+                  );
+                  const hasDefault = colDef.constraints?.some(
+                    (c) => c.Constraint?.contype === "CONSTR_DEFAULT" || c.Constraint?.contype === 2
+                  );
+                  if (hasNotNull && !hasDefault) {
+                    isViolation = true;
+                  }
+                }
+              }
+            }
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /ADD\s+COLUMN\b.*\bNOT\s+NULL\b/i) && !sqlMatches(stmt.raw, /\bDEFAULT\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG003",
+          ruleName: "add-column-not-null-no-default",
+          severity: "error",
+          message: "Adding a NOT NULL column without a DEFAULT value will fail on any non-empty table (existing rows cannot satisfy the NOT NULL constraint). On PostgreSQL < 11, even with a DEFAULT, this triggers a full table rewrite. On PG 11+, constant DEFAULT values are metadata-only and safe.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Safe approach (works on all PG versions):\n1. ADD COLUMN name type (nullable, no constraint)\n2. UPDATE table SET name = default_value WHERE name IS NULL (backfill in batches)\n3. ALTER COLUMN name SET NOT NULL\n\nOr on PG 11+:\n  ADD COLUMN name type NOT NULL DEFAULT 'value'"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/add-constraint-not-valid.ts
+var addConstraintNotValid = {
+  id: "MG004",
+  name: "add-constraint-not-valid",
+  severity: "warning",
+  description: "ADD CONSTRAINT without NOT VALID causes full table scan under heavy lock",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      const hasAddConstraint = sqlMatches(stmt.raw, /ADD\s+CONSTRAINT\b/i);
+      const hasCheckOrFK = sqlMatches(stmt.raw, /\bCHECK\s*\(/i) || sqlMatches(stmt.raw, /\bFOREIGN\s+KEY\b/i);
+      const hasNotValid = sqlMatches(stmt.raw, /\bNOT\s+VALID\b/i);
+      if (hasAddConstraint && hasCheckOrFK && !hasNotValid) {
+        violations.push({
+          ruleId: "MG004",
+          ruleName: "add-constraint-not-valid",
+          severity: "warning",
+          message: "Adding a CHECK or FOREIGN KEY constraint without NOT VALID causes PostgreSQL to scan and validate every existing row while holding an ACCESS EXCLUSIVE lock. On large tables, this blocks all access for the duration of the scan.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Split into two steps:\n1. ALTER TABLE t ADD CONSTRAINT c CHECK (expr) NOT VALID;\n   (instant, only applies to new/updated rows)\n2. ALTER TABLE t VALIDATE CONSTRAINT c;\n   (validates existing rows with a weaker SHARE UPDATE EXCLUSIVE lock)"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/drop-column.ts
+var dropColumn = {
+  id: "MG005",
+  name: "drop-column",
+  severity: "error",
+  description: "DROP COLUMN is destructive and irreversible \u2014 requires --confirm-destructive",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "AlterTableStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node?.cmds) {
+            for (const cmd of node.cmds) {
+              const alterCmd = cmd.AlterTableCmd;
+              if (alterCmd && (alterCmd.subtype === "AT_DropColumn" || alterCmd.subtype === 12)) {
+                isViolation = true;
+              }
+            }
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /ALTER\s+TABLE\b.*\bDROP\s+COLUMN\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG005",
+          ruleName: "drop-column",
+          severity: "error",
+          message: "\u26A0\uFE0F  DESTRUCTIVE: DROP COLUMN permanently removes the column and all its data. This operation is irreversible. Any application code still referencing this column will break immediately.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Before dropping a column in production:\n1. Remove all application code references to the column first\n2. Deploy the code change\n3. Only then drop the column in a separate migration\n4. Use --confirm-destructive to proceed with this migration"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/drop-table.ts
+var dropTable = {
+  id: "MG006",
+  name: "drop-table",
+  severity: "error",
+  description: "DROP TABLE is destructive and irreversible \u2014 requires --confirm-destructive",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "DropStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node && (node.removeType === "OBJECT_TABLE" || node.removeType === 38)) {
+            isViolation = true;
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /DROP\s+TABLE\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG006",
+          ruleName: "drop-table",
+          severity: "error",
+          message: "\u26A0\uFE0F  DESTRUCTIVE: DROP TABLE permanently deletes the table and ALL its data. This operation is irreversible. All foreign keys, indexes, triggers, and policies associated with this table will also be removed.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "Before dropping a table in production:\n1. Ensure no application code references this table\n2. Consider renaming the table first (e.g., _deprecated_tablename)\n3. Wait a safe period to confirm nothing breaks\n4. Back up the data if it might be needed later\n5. Use --confirm-destructive to proceed"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/rename-column.ts
+var renameColumn = {
+  id: "MG007",
+  name: "rename-column",
+  severity: "warning",
+  description: "RENAME COLUMN is a breaking change for zero-downtime deployments",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "RenameStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node && (node.renameType === "OBJECT_COLUMN" || node.renameType === 3)) {
+            isViolation = true;
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /ALTER\s+TABLE\b.*\bRENAME\s+COLUMN\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG007",
+          ruleName: "rename-column",
+          severity: "warning",
+          message: "Renaming a column is a breaking change for zero-downtime deployments. Any running application code, ORM queries, or reports referencing the old column name will fail immediately after the rename is applied.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "For zero-downtime rename, use the expand/contract pattern:\n1. Add a new column with the desired name\n2. Write to both old and new columns in application code\n3. Backfill existing data to the new column\n4. Switch reads to the new column\n5. Stop writing to the old column\n6. Drop the old column in a subsequent migration"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/rename-table.ts
+var renameTable = {
+  id: "MG008",
+  name: "rename-table",
+  severity: "warning",
+  description: "RENAME TABLE is a breaking change for zero-downtime deployments",
+  check(statements, _context) {
+    const violations = [];
+    for (const stmt of statements) {
+      let isViolation = false;
+      if (stmt.ast) {
+        const type = getStmtType(stmt.ast);
+        if (type === "RenameStmt") {
+          const node = getStmtNode(stmt.ast);
+          if (node && (node.renameType === "OBJECT_TABLE" || node.renameType === 38)) {
+            isViolation = true;
+          }
+        }
+      } else {
+        if (sqlMatches(stmt.raw, /ALTER\s+TABLE\b.*\bRENAME\s+TO\b/i)) {
+          isViolation = true;
+        }
+      }
+      if (isViolation) {
+        violations.push({
+          ruleId: "MG008",
+          ruleName: "rename-table",
+          severity: "warning",
+          message: "Renaming a table is a breaking change for zero-downtime deployments. All application code, views, foreign keys, and queries referencing the old table name will fail immediately after the rename.",
+          line: stmt.line,
+          sql: stmt.raw,
+          suggestion: "For zero-downtime rename:\n1. Create a new table with the desired name\n2. Create a VIEW with the old name pointing to the new table\n3. Migrate application code to use the new table name\n4. Drop the view and old table in a subsequent migration"
+        });
+      }
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/missing-lock-timeout.ts
+var missingLockTimeout = {
+  id: "MG009",
+  name: "missing-lock-timeout",
+  severity: "warning",
+  description: "No lock_timeout or statement_timeout set before risky operations",
+  check(statements, _context) {
+    const violations = [];
+    const hasLockTimeout = statements.some(
+      (s) => sqlMatches(s.raw, /SET\s+(LOCAL\s+)?lock_timeout/i)
+    );
+    const hasStatementTimeout = statements.some(
+      (s) => sqlMatches(s.raw, /SET\s+(LOCAL\s+)?statement_timeout/i)
+    );
+    if (hasLockTimeout || hasStatementTimeout) {
+      return violations;
+    }
+    const riskyPatterns = [
+      /CREATE\s+INDEX\b/i,
+      /ALTER\s+TABLE\b/i,
+      /DROP\s+INDEX\b/i
+    ];
+    const hasRiskyOp = statements.some(
+      (s) => riskyPatterns.some((p) => sqlMatches(s.raw, p))
+    );
+    if (hasRiskyOp) {
+      violations.push({
+        ruleId: "MG009",
+        ruleName: "missing-lock-timeout",
+        severity: "warning",
+        message: "This migration contains DDL operations that acquire locks but does not set a lock_timeout. Without a lock_timeout, if another transaction holds a conflicting lock, your migration will wait indefinitely \u2014 and all subsequent queries will queue behind it, potentially causing a cascading outage (lock queue death spiral).",
+        line: 1,
+        sql: _context.fullSql.substring(0, 200) + "...",
+        suggestion: "Add a lock timeout at the beginning of your migration:\n  SET lock_timeout = '5s';\n\nThis causes the migration to fail fast if it cannot acquire the lock within 5 seconds, rather than waiting indefinitely and blocking other queries. You can retry the migration during a quieter period."
+      });
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/missing-down-migration.ts
+var missingDownMigration = {
+  id: "MG010",
+  name: "missing-down-migration",
+  severity: "warning",
+  description: "No rollback/down migration detected",
+  check(_statements, context) {
+    const violations = [];
+    if (context.format === "drizzle") {
+      return violations;
+    }
+    if (!context.hasDownMigration) {
+      violations.push({
+        ruleId: "MG010",
+        ruleName: "missing-down-migration",
+        severity: "warning",
+        message: "No rollback/down migration was detected. Without a rollback migration, reverting this change in production requires manual intervention. This is especially risky for schema changes that are difficult to reverse (e.g., column type changes).",
+        line: 1,
+        sql: "(no down migration file found)",
+        suggestion: "Create a corresponding rollback migration:\n\u2022 For Prisma: Add a down.sql file in the same migration directory\n\u2022 For raw SQL: Create a corresponding *_down.sql or *_rollback.sql file\n\nThe rollback should reverse the changes made by this migration. For example:\n  Up:   ALTER TABLE users ADD COLUMN status TEXT;\n  Down: ALTER TABLE users DROP COLUMN status;"
+      });
+    }
+    return violations;
+  }
+};
+
+// src/analyzer/rules/index.ts
+var ALL_RULES = [
+  createIndexNotConcurrent,
+  // MG001
+  alterColumnType,
+  // MG002
+  addColumnNotNullNoDefault,
+  // MG003
+  addConstraintNotValid,
+  // MG004
+  dropColumn,
+  // MG005
+  dropTable,
+  // MG006
+  renameColumn,
+  // MG007
+  renameTable,
+  // MG008
+  missingLockTimeout,
+  // MG009
+  missingDownMigration
+  // MG010
+];
+var DESTRUCTIVE_RULE_IDS = /* @__PURE__ */ new Set(["MG005", "MG006"]);
+
+// src/analyzer/parser.ts
+async function parseSql(rawSql) {
+  const statements = [];
+  try {
+    const { parse } = await import("pgsql-parser");
+    const result = await parse(rawSql);
+    const stmtList = Array.isArray(result) ? result : result?.stmts || [];
+    if (stmtList.length > 0) {
+      for (let i = 0; i < stmtList.length; i++) {
+        const stmtObj = stmtList[i];
+        const loc = stmtObj.stmt_location || 0;
+        const len = stmtObj.stmt_len && stmtObj.stmt_len > 0 ? stmtObj.stmt_len : rawSql.length - loc;
+        const raw = rawSql.substring(loc, loc + len).trim();
+        const line = rawSql.substring(0, loc).split("\n").length;
+        statements.push({
+          raw,
+          line,
+          ast: stmtObj
+        });
+      }
+      return statements;
+    }
+  } catch {
+    const rawStatements = splitStatements(rawSql);
+    for (let i = 0; i < rawStatements.length; i++) {
+      const raw = rawStatements[i].trim();
+      if (!raw) continue;
+      statements.push({
+        raw,
+        line: findLineNumber(rawSql, rawStatements[i]),
+        ast: null
+      });
+    }
+    return statements;
+  }
+  const fallbackStatements = splitStatements(rawSql);
+  for (const rawStmt of fallbackStatements) {
+    const raw = rawStmt.trim();
+    if (!raw) continue;
+    statements.push({
+      raw,
+      line: findLineNumber(rawSql, rawStmt),
+      ast: null
+    });
+  }
+  return statements;
+}
+function splitStatements(sql) {
+  const statements = [];
+  let current = "";
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inDollarQuote = false;
+  let dollarTag = "";
+  let inLineComment = false;
+  let inBlockComment = false;
+  for (let i = 0; i < sql.length; i++) {
+    const char = sql[i];
+    const next = sql[i + 1] || "";
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote && !inBlockComment) {
+      if (char === "-" && next === "-") {
+        inLineComment = true;
+        current += char;
+        continue;
+      }
+    }
+    if (inLineComment) {
+      current += char;
+      if (char === "\n") {
+        inLineComment = false;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && !inDollarQuote) {
+      if (char === "/" && next === "*") {
+        inBlockComment = true;
+        current += char;
+        continue;
+      }
+    }
+    if (inBlockComment) {
+      current += char;
+      if (char === "*" && next === "/") {
+        current += next;
+        i++;
+        inBlockComment = false;
+      }
+      continue;
+    }
+    if (!inSingleQuote && !inDoubleQuote && char === "$") {
+      if (inDollarQuote) {
+        const remaining = sql.substring(i);
+        if (remaining.startsWith(dollarTag)) {
+          current += dollarTag;
+          i += dollarTag.length - 1;
+          inDollarQuote = false;
+          continue;
+        }
+      } else {
+        const match = sql.substring(i).match(/^(\$[^$]*\$)/);
+        if (match) {
+          dollarTag = match[1];
+          current += dollarTag;
+          i += dollarTag.length - 1;
+          inDollarQuote = true;
+          continue;
+        }
+      }
+    }
+    if (inDollarQuote) {
+      current += char;
+      continue;
+    }
+    if (char === "'" && !inDoubleQuote) {
+      inSingleQuote = !inSingleQuote;
+      current += char;
+      continue;
+    }
+    if (inSingleQuote) {
+      current += char;
+      continue;
+    }
+    if (char === '"' && !inSingleQuote) {
+      inDoubleQuote = !inDoubleQuote;
+      current += char;
+      continue;
+    }
+    if (inDoubleQuote) {
+      current += char;
+      continue;
+    }
+    if (char === ";") {
+      current += char;
+      if (current.trim()) {
+        statements.push(current);
+      }
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current.trim()) {
+    statements.push(current);
+  }
+  return statements;
+}
+function findLineNumber(fullSql, substring) {
+  const trimmed = substring.trim();
+  const index = fullSql.indexOf(trimmed);
+  if (index === -1) return 1;
+  const before = fullSql.substring(0, index);
+  return before.split("\n").length;
+}
+
+// src/analyzer/index.ts
+async function analyze(migration, config) {
+  const fullSql = migration.files.map((f) => f.sql).join("\n");
+  const statements = await parseSql(fullSql);
+  const context = {
+    hasDownMigration: migration.hasDownMigration,
+    format: migration.format,
+    fullSql
+  };
+  const violations = [];
+  let hasDestructive = false;
+  for (const rule of ALL_RULES) {
+    const effectiveSeverity = getRuleSeverity(rule.id, rule.severity, config);
+    if (effectiveSeverity === null) {
+      continue;
+    }
+    const ruleViolations = rule.check(statements, context);
+    for (const violation of ruleViolations) {
+      violation.severity = effectiveSeverity;
+      violations.push(violation);
+      if (DESTRUCTIVE_RULE_IDS.has(violation.ruleId)) {
+        hasDestructive = true;
+      }
+    }
+  }
+  return {
+    violations,
+    hasDestructive,
+    statements: statements.map((s) => ({ line: s.line, raw: s.raw }))
+  };
+}
+
+// src/shadow/docker-postgres.ts
+import Dockerode from "dockerode";
+import pg from "pg";
+var { Client } = pg;
+var DockerPostgresShadow = class {
+  docker;
+  container = null;
+  connectionConfig = null;
+  externalDbUrl = null;
+  imageName;
+  constructor(imageName = "postgres:16-alpine", externalDbUrl) {
+    this.docker = new Dockerode();
+    this.imageName = imageName;
+    this.externalDbUrl = externalDbUrl || null;
+  }
+  async create() {
+    if (this.externalDbUrl) {
+      const url = new URL(this.externalDbUrl);
+      this.connectionConfig = {
+        host: url.hostname,
+        port: parseInt(url.port || "5432", 10),
+        database: url.pathname.slice(1) || "postgres",
+        user: url.username || "postgres",
+        password: url.password || "postgres"
+      };
+      return this.connectionConfig;
+    }
+    try {
+      await this.docker.getImage(this.imageName).inspect();
+    } catch {
+      console.error(`Pulling ${this.imageName}...`);
+      await new Promise((resolve4, reject) => {
+        this.docker.pull(this.imageName, (err, stream) => {
+          if (err) return reject(err);
+          this.docker.modem.followProgress(stream, (err2) => {
+            if (err2) return reject(err2);
+            resolve4();
+          });
+        });
+      });
+    }
+    const password = "mgcheck_shadow_" + Math.random().toString(36).substring(7);
+    const containerName = `mgcheck-shadow-${Date.now()}-${Math.random().toString(36).substring(7)}`;
+    this.container = await this.docker.createContainer({
+      Image: this.imageName,
+      name: containerName,
+      Env: [
+        `POSTGRES_PASSWORD=${password}`,
+        "POSTGRES_DB=mgcheck_shadow",
+        "POSTGRES_USER=mgcheck"
+      ],
+      HostConfig: {
+        AutoRemove: true,
+        PortBindings: {
+          "5432/tcp": [{ HostPort: "0" }]
+          // Random port
+        }
+      },
+      ExposedPorts: {
+        "5432/tcp": {}
+      }
+    });
+    await this.container.start();
+    const info = await this.container.inspect();
+    const hostPort = info.NetworkSettings.Ports["5432/tcp"]?.[0]?.HostPort;
+    if (!hostPort) {
+      throw new Error("Failed to get assigned port for shadow database container");
+    }
+    this.connectionConfig = {
+      host: "127.0.0.1",
+      port: parseInt(hostPort, 10),
+      database: "mgcheck_shadow",
+      user: "mgcheck",
+      password
+    };
+    await this.waitForReady();
+    return this.connectionConfig;
+  }
+  async seed(sql) {
+    if (!this.connectionConfig) {
+      throw new Error("Shadow database not created yet. Call create() first.");
+    }
+    const client = new Client(this.connectionConfig);
+    try {
+      await client.connect();
+      await client.query(sql);
+    } finally {
+      await client.end();
+    }
+  }
+  async execute(sql) {
+    if (!this.connectionConfig) {
+      throw new Error("Shadow database not created yet. Call create() first.");
+    }
+    const client = new Client(this.connectionConfig);
+    const startTime = Date.now();
+    let statementsExecuted = 0;
+    try {
+      await client.connect();
+      const result = await client.query(sql);
+      statementsExecuted = Array.isArray(result) ? result.length : 1;
+      return {
+        success: true,
+        executionTimeMs: Date.now() - startTime,
+        statementsExecuted
+      };
+    } catch (err) {
+      return {
+        success: false,
+        error: err.message,
+        executionTimeMs: Date.now() - startTime,
+        statementsExecuted
+      };
+    } finally {
+      await client.end();
+    }
+  }
+  async teardown() {
+    if (this.container) {
+      try {
+        await this.container.stop({ t: 2 });
+      } catch {
+      }
+      try {
+        await this.container.remove({ force: true });
+      } catch {
+      }
+      this.container = null;
+    }
+    this.connectionConfig = null;
+  }
+  /**
+   * Wait for Postgres to accept connections with exponential backoff.
+   * Timeout: 30 seconds.
+   */
+  async waitForReady(timeoutMs = 3e4) {
+    if (!this.connectionConfig) throw new Error("No connection config");
+    const startTime = Date.now();
+    let delay = 200;
+    while (Date.now() - startTime < timeoutMs) {
+      const client = new Client(this.connectionConfig);
+      try {
+        await client.connect();
+        await client.query("SELECT 1");
+        await client.end();
+        return;
+      } catch {
+        await client.end().catch(() => {
+        });
+        await new Promise((resolve4) => setTimeout(resolve4, delay));
+        delay = Math.min(delay * 1.5, 2e3);
+      }
+    }
+    throw new Error(
+      `Shadow database failed to become ready within ${timeoutMs / 1e3}s. Ensure Docker is running and the Postgres image is accessible.`
+    );
+  }
+};
+
+// src/shadow/pglite.ts
+var PGliteShadow = class {
+  db = null;
+  async create() {
+    const { PGlite } = await import("@electric-sql/pglite");
+    this.db = new PGlite();
+    return {
+      host: "pglite-in-process",
+      port: 0,
+      database: "pglite",
+      user: "pglite",
+      password: ""
+    };
+  }
+  async seed(sql) {
+    if (!this.db) {
+      throw new Error("PGlite database not created yet. Call create() first.");
+    }
+    await this.db.exec(sql);
+  }
+  async execute(sql) {
+    if (!this.db) {
+      throw new Error("PGlite database not created yet. Call create() first.");
+    }
+    const startTime = Date.now();
+    try {
+      const results = await this.db.exec(sql);
+      const statementsExecuted = Array.isArray(results) ? results.length : 1;
+      return {
+        success: true,
+        executionTimeMs: Date.now() - startTime,
+        statementsExecuted
+      };
+    } catch (err) {
+      const errorMessage = err.message;
+      if (errorMessage.includes("CONCURRENTLY")) {
+        return {
+          success: false,
+          error: errorMessage + "\n\nNote: PGlite does not support CONCURRENTLY operations. Use --provider docker for full Postgres fidelity.",
+          executionTimeMs: Date.now() - startTime,
+          statementsExecuted: 0
+        };
+      }
+      return {
+        success: false,
+        error: errorMessage,
+        executionTimeMs: Date.now() - startTime,
+        statementsExecuted: 0
+      };
+    }
+  }
+  async teardown() {
+    if (this.db) {
+      try {
+        await this.db.close();
+      } catch {
+      }
+      this.db = null;
+    }
+  }
+};
+
+// src/shadow/index.ts
+function createShadowDatabase(config) {
+  if (config.shadowDb.dbUrl) {
+    return new DockerPostgresShadow(config.shadowDb.dockerImage, config.shadowDb.dbUrl);
+  }
+  switch (config.shadowDb.provider) {
+    case "docker":
+      return new DockerPostgresShadow(config.shadowDb.dockerImage);
+    case "pglite":
+      return new PGliteShadow();
+    default:
+      throw new Error(`Unknown shadow DB provider: ${config.shadowDb.provider}`);
+  }
+}
+
+// src/core/engine.ts
+import { readFileSync as readFileSync5, existsSync as existsSync5 } from "fs";
+import { resolve as resolve3 } from "path";
+async function runCheck(inputPath, config, mode = "run", onProgress) {
+  const log = onProgress || (() => {
+  });
+  log("Detecting migration format...");
+  const migration = detectMigration(inputPath);
+  log(`Detected: ${migration.format} (${migration.files.length} file(s))`);
+  log("Running rule analysis...");
+  const analysis = await analyze(migration, config);
+  log(`Parsed ${analysis.statements.length} SQL statement(s):`);
+  for (const s of analysis.statements) {
+    const singleLine = s.raw.replace(/\s+/g, " ").trim();
+    const truncated = singleLine.length > 70 ? singleLine.substring(0, 67) + "..." : singleLine;
+    log(`  \u2022 [Line ${s.line}] ${truncated}`);
+  }
+  log(`Rule analysis completed: ${analysis.violations.length} violation(s) found`);
+  let execution = null;
+  if (mode === "run") {
+    const shadow = createShadowDatabase(config);
+    try {
+      log(`Starting shadow database (${config.shadowDb.provider})...`);
+      await shadow.create();
+      log("Shadow database ready");
+      if (config.shadowDb.seedFile) {
+        const seedPath = resolve3(config.shadowDb.seedFile);
+        if (!existsSync5(seedPath)) {
+          throw new Error(`Seed file not found: ${seedPath}`);
+        }
+        const seedSql = readFileSync5(seedPath, "utf-8");
+        log("Applying seed schema...");
+        await shadow.seed(seedSql);
+        log("Seed schema applied");
+      }
+      const fullSql = migration.files.map((f) => f.sql).join("\n");
+      log(`Executing migration against shadow database (${analysis.statements.length} statement(s))...`);
+      execution = await shadow.execute(fullSql);
+      log(execution.success ? "Migration executed successfully" : `Migration execution failed: ${execution.error}`);
+    } finally {
+      log("Tearing down shadow database...");
+      await shadow.teardown();
+      log("Shadow database cleaned up");
+    }
+  }
+  const hasBlockingViolations = analysis.violations.some((v) => v.severity === "error");
+  const executionFailed = execution !== null && !execution.success;
+  const hasUnconfirmedDestructive = analysis.hasDestructive && !config.confirmDestructive;
+  const passed = !executionFailed && !hasBlockingViolations && !hasUnconfirmedDestructive;
+  const report = {
+    migration,
+    execution,
+    violations: analysis.violations,
+    statements: analysis.statements,
+    passed,
+    hasDestructive: analysis.hasDestructive,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    mode
+  };
+  return report;
+}
+
+export {
+  loadConfig,
+  getRuleSeverity,
+  detectMigration,
+  ALL_RULES,
+  DESTRUCTIVE_RULE_IDS,
+  analyze,
+  createShadowDatabase,
+  runCheck
+};
+//# sourceMappingURL=chunk-7JBFSZBD.js.map