tewip-ai 0.41.0 → 0.42.0

package/README.md

@@ -870,7 +870,7 @@ That last section is the part no SQL linter does: it searches your own code for
 away. "This drops `users.nickname`, and four files still read it" is a different sentence from "dropping a
 column is risky", and it is the one that stops the outage.
 
-It reads **SQL, Django, Rails, Alembic and TypeORM** migrations — which covers Prisma, Drizzle, Flyway
+It reads **SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase** migrations — which covers Prisma, Drizzle, Flyway
 and golang-migrate too, since those all emit plain `.sql`. It judges **only the forward path** (a rollback step
 contains the mirror image of the change, so reading it says a migration that creates a table destroys
 one), and stays quiet when the team already did the safe thing — `atomic = False`, `algorithm:

package/dist/cli/help.js

@@ -157,9 +157,11 @@ Usage:
                                     What will this migration do to a live database? Names the changes
                                     that break the version still running during a deploy, destroy data,
                                     block writes while they run, or cannot be undone - and searches your
-                                    code for what still uses the column it takes away. Reads SQL, Django,
-                                    Rails and Alembic migrations, and says so when it cannot read one.
-                                    No model, no cost.
+                                    code for what still uses the column it takes away. Reads SQL,
+                                    Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and
+                                    Liquibase - so Prisma, Drizzle, Flyway and golang-migrate too,
+                                    since those emit plain SQL - and says so when it cannot read one.
+                                    It judges only the forward path, never the rollback. No cost.
   tewip pick [--diff main...HEAD] [--list] [--out picked.md]
                                     Which tests could notice this change? Narrows a test run using
                                     facts rather than a prediction: a test runs when it imports a

package/dist/engine/a2a/card.js

@@ -51,7 +51,7 @@ export const ANSWERABLE = [
         id: 'migration-safety',
         verb: 'schema',
         name: 'What will this migration do to a live database?',
-        description: 'Names what breaks the version still running during a rolling deploy, destroys data, blocks writes, or cannot be undone - and searches the repository for code that still uses a column being dropped. Reads SQL, Django, Rails, Alembic and TypeORM, which covers Prisma, Drizzle and Flyway.',
+        description: 'Names what breaks the version still running during a rolling deploy, destroys data, blocks writes, or cannot be undone - and searches the repository for code that still uses a column being dropped. Reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase, which covers Prisma, Drizzle and Flyway too.',
         tags: ['database', 'migrations', 'deployment', 'risk'],
         examples: ['Is this migration safe to deploy?', 'Will this drop break the running version?'],
     },

package/dist/engine/schema/dialect-rules-node.js

@@ -0,0 +1,190 @@
+const STR = String.raw `['"]([\w.]+)['"]`;
+/** Alembic. */
+/**
+ * Sequelize. `queryInterface.removeColumn('Users', 'passwordHash')` names the table and the column
+ * in one call, which makes it the simplest of these to read.
+ *
+ * Written against opencollective-api's real migrations, which also show why the forward path
+ * matters more here than anywhere else: a Sequelize migration almost always *adds* in `up` and
+ * *removes* in `down`, so a reader that took the whole file would report every harmless migration
+ * in the ecosystem as dropping a column.
+ */
+const SEQUELIZE = [
+    {
+        find: new RegExp(String.raw `removeColumn\s*\(\s*${STR}\s*,\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `removes ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then remove it in a later migration',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `renameColumn\s*\(\s*${STR}\s*,\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `dropTable\s*\(\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        // Sequelize has no CONCURRENTLY option, so an index on a populated table takes the lock.
+        find: new RegExp(String.raw `addIndex\s*\(\s*${STR}`, 'i'),
+        unless: /concurrently\s*:\s*true/i,
+        risk: 'locks-writes',
+        what: (m) => `builds an index on ${m[1]} while holding a lock that blocks writes to it`,
+        instead: 'build it concurrently with a raw query, or accept the lock if the table is small',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `changeColumn\s*\(\s*${STR}\s*,\s*${STR}`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `changes the type of ${m[1]}.${m[2]}, which can rewrite the whole table`,
+        instead: 'add a new column, backfill it in batches, and switch the readers over',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+];
+/**
+ * Knex. The awkward one: the table is named by `knex.schema.table('articles', ...)` and the
+ * operation happens inside the callback, so the two are matched together across the lines between
+ * them. Matterwiki's real migrations are exactly this shape.
+ */
+const KNEX = [
+    {
+        find: new RegExp(String.raw `\.(?:table|alterTable)\s*\(\s*${STR}[\s\S]{0,400}?\.dropColumn\s*\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `\.(?:table|alterTable)\s*\(\s*${STR}[\s\S]{0,400}?\.renameColumn\s*\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `\.dropTable(?:IfExists)?\s*\(\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `\.(?:table|alterTable)\s*\(\s*${STR}[\s\S]{0,400}?\.notNullable\s*\(`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `makes a column on ${m[1]} NOT NULL, which scans every row under a lock`,
+        instead: 'add a CHECK ... NOT VALID, validate it, then set NOT NULL - or accept the scan if the table is small',
+        table: (m) => m[1],
+    },
+];
+/**
+ * EF Core. Its MigrationBuilder calls use named arguments over several lines and in either order,
+ * so each operation is matched twice - once for `name` before `table`, once for the reverse -
+ * rather than assuming the order Coflnet's real migrations happen to use.
+ */
+const NAMED = (first, second) => String.raw `(?:${first}:\s*${STR}[\s\S]{0,200}?${second}:\s*${STR}|${second}:\s*${STR}[\s\S]{0,200}?${first}:\s*${STR})`;
+/** Whichever order the arguments came in, the two names are in 1,2 or in 4,3. */
+const pair = (m) => (m[1] !== undefined ? [m[1], m[2]] : [m[4], m[3]]);
+const EFCORE = [
+    {
+        find: new RegExp(String.raw `migrationBuilder\.DropColumn\s*\(\s*${NAMED('name', 'table')}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${pair(m)[1]}.${pair(m)[0]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later migration',
+        table: (m) => pair(m)[1],
+        column: (m) => pair(m)[0],
+    },
+    {
+        find: new RegExp(String.raw `migrationBuilder\.DropTable\s*\(\s*name:\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `migrationBuilder\.RenameColumn\s*\(\s*${NAMED('name', 'table')}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${pair(m)[1]}.${pair(m)[0]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => pair(m)[1],
+        column: (m) => pair(m)[0],
+    },
+    {
+        find: new RegExp(String.raw `migrationBuilder\.CreateIndex\s*\(\s*${NAMED('name', 'table')}`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `builds an index on ${pair(m)[1]} while holding a lock that blocks writes to it`,
+        instead: 'build it concurrently with migrationBuilder.Sql, or accept the lock if the table is small',
+        table: (m) => pair(m)[1],
+    },
+    {
+        find: new RegExp(String.raw `migrationBuilder\.AlterColumn<[^>]*>\s*\(\s*${NAMED('name', 'table')}`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `alters ${pair(m)[1]}.${pair(m)[0]}, which can rewrite the whole table`,
+        instead: 'add a new column, backfill it in batches, and switch the readers over',
+        table: (m) => pair(m)[1],
+        column: (m) => pair(m)[0],
+    },
+];
+/**
+ * Liquibase. A changelog is XML or YAML rather than code, and the operation is the element name
+ * with the table on `tableName`. DEFRA's real changelogs are the shape this was written against.
+ */
+const XML_TABLE = String.raw `tableName\s*=\s*["']([\w.]+)["']`;
+const LIQUIBASE = [
+    {
+        find: new RegExp(String.raw `<dropColumn[^>]*${XML_TABLE}[\s\S]{0,300}?<column[^>]*name\s*=\s*["']([\w.]+)["']`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `<dropColumn[^>]*columnName\s*=\s*["']([\w.]+)["'][^>]*${XML_TABLE}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[2]}.${m[1]}`,
+        instead: 'deploy code that no longer selects or writes the column, then drop it in a later changeSet',
+        table: (m) => m[2],
+        column: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `<dropTable[^>]*${XML_TABLE}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop reading the table, deploy that, then drop it once nothing refers to it',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `<renameColumn[^>]*${XML_TABLE}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames a column on ${m[1]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `<addNotNullConstraint[^>]*${XML_TABLE}`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `makes a column on ${m[1]} NOT NULL, which scans every row under a lock`,
+        instead: 'add a CHECK ... NOT VALID, validate it, then set NOT NULL - or accept the scan if the table is small',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `<createIndex[^>]*${XML_TABLE}`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `builds an index on ${m[1]} while holding a lock that blocks writes to it`,
+        instead: 'build it concurrently with a <sql> changeSet, or accept the lock if the table is small',
+        table: (m) => m[1],
+    },
+];
+export { SEQUELIZE, KNEX, EFCORE, LIQUIBASE };

package/dist/engine/schema/dialect-rules.js

@@ -0,0 +1,147 @@
+const STR = String.raw `['"]([\w.]+)['"]`;
+/** Django's operations. `model_name` and `name` are the table and the column. */
+const DJANGO = [
+    {
+        find: new RegExp(String.raw `migrations\.RemoveField\([\s\S]{0,200}?model_name=${STR}[\s\S]{0,200}?name=${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `removes the field ${m[2]} from ${m[1]}`,
+        instead: 'stop reading and writing the field, deploy that, then remove it in a later migration. The version still running during a rolling deploy will select a column that no longer exists',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `migrations\.RenameField\([\s\S]{0,200}?model_name=${STR}[\s\S]{0,200}?old_name=${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new field, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `migrations\.DeleteModel\([\s\S]{0,120}?${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `deletes the model ${m[1]} and its table`,
+        instead: 'stop using it, ship that, confirm nothing reads it, and delete it later',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `migrations\.AddField\([\s\S]{0,400}?null=False(?![\s\S]{0,400}?default=)`, 'i'),
+        risk: 'breaks-old-code',
+        what: () => 'adds a field that cannot be null and has no default',
+        instead: 'add it with null=True or a default. Without one, Django rewrites the table and every insert from the running version fails',
+    },
+    {
+        find: new RegExp(String.raw `migrations\.AlterField\([\s\S]{0,400}?null=False`, 'i'),
+        risk: 'locks-writes',
+        what: () => 'makes an existing field NOT NULL, which reads every row under a lock',
+        instead: 'backfill first, add a validated constraint, then alter - or use SeparateDatabaseAndState with the safe SQL',
+    },
+    {
+        // A data migration. Django wraps a migration in one transaction, so this holds it open for as long as
+        // the work takes - fine for a hundred rows, an outage for a hundred million.
+        find: /migrations\.RunPython\(/,
+        unless: /atomic\s*=\s*False/,
+        risk: 'slow',
+        what: () => 'runs application code against the data inside the migration transaction',
+        instead: 'for a large table, work in batches with atomic = False on the migration and make it resumable. For a small one this is fine - Tewip cannot see how many rows there are',
+    },
+    {
+        find: /AddIndex\(|AddConstraint\(/i,
+        unless: /AddIndexConcurrently|AddConstraintNotValid|atomic\s*=\s*False/,
+        risk: 'locks-writes',
+        what: () => 'adds an index or constraint, which Django builds with a lock unless told otherwise',
+        instead: 'AddIndexConcurrently / AddConstraintNotValid from django.contrib.postgres.operations, with atomic = False on the migration',
+    },
+];
+/** Rails migrations. */
+const RAILS = [
+    {
+        find: new RegExp(String.raw `remove_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `removes ${m[1]}.${m[2]}`,
+        instead: "ignore the column in the model (self.ignored_columns), deploy that, then remove it. Rails caches the column list, so the running version keeps selecting it",
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `rename_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames ${m[1]}.${m[2]}`,
+        instead: 'add the new column, write to both, move the readers, then remove the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `drop_table\s*[\s(]\s*:?(\w+)`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop using it, ship that, then drop it later',
+        table: (m) => m[1],
+    },
+    {
+        find: /add_index\s*[\s(]/i,
+        unless: /algorithm:\s*:concurrently/,
+        risk: 'locks-writes',
+        what: () => 'adds an index without algorithm: :concurrently, so writes to the table block while it builds',
+        instead: 'add_index ..., algorithm: :concurrently, with disable_ddl_transaction! on the migration',
+    },
+    {
+        find: new RegExp(String.raw `change_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `changes the type of ${m[1]}.${m[2]}, which usually rewrites the table`,
+        instead: 'add a new column, backfill in batches, switch the readers, then drop the old one',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `change_column_null\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)\s*,\s*false`, 'i'),
+        risk: 'locks-writes',
+        what: (m) => `makes ${m[1]}.${m[2]} NOT NULL, which reads every row under a lock`,
+        instead: 'add a validated check constraint first, then set the column NOT NULL',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+];
+const ALEMBIC = [
+    {
+        find: new RegExp(String.raw `op\.drop_column\(\s*${STR}\s*,\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `drops ${m[1]}.${m[2]}`,
+        instead: 'stop reading and writing it, deploy that, then drop it in a later revision',
+        table: (m) => m[1],
+        column: (m) => m[2],
+    },
+    {
+        find: new RegExp(String.raw `op\.drop_table\(\s*${STR}`, 'i'),
+        risk: 'destroys-data',
+        what: (m) => `drops the table ${m[1]}`,
+        instead: 'stop using it, ship that, then drop it later',
+        table: (m) => m[1],
+    },
+    {
+        find: new RegExp(String.raw `op\.alter_column\([\s\S]{0,300}?nullable=False`, 'i'),
+        risk: 'locks-writes',
+        what: () => 'makes a column NOT NULL, which reads every row under a lock',
+        instead: 'backfill, add a validated constraint, then alter the column',
+    },
+    {
+        find: /op\.create_index\(/i,
+        unless: /postgresql_concurrently\s*=\s*True/,
+        risk: 'locks-writes',
+        what: () => 'builds an index without postgresql_concurrently, so writes block while it builds',
+        instead: 'op.create_index(..., postgresql_concurrently=True) with a non-transactional revision',
+    },
+    {
+        find: new RegExp(String.raw `op\.rename_table\(\s*${STR}`, 'i'),
+        risk: 'breaks-old-code',
+        what: (m) => `renames the table ${m[1]}`,
+        instead: 'move the readers first, or keep a view with the old name',
+        table: (m) => m[1],
+    },
+];
+// TypeORM has no operations of its own: unlike Django's `RemoveField` or Rails's `remove_column`,
+// a TypeORM migration contains SQL and nothing else, handed to queryRunner.query(). So its list is
+// empty on purpose and every finding comes from reading that SQL, which is the same reader the
+// `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
+// TypeORM migration silently producing no findings at all.
+export { DJANGO, RAILS, ALEMBIC };

package/dist/engine/schema/frameworks.js

@@ -1,3 +1,5 @@
+import { ALEMBIC, DJANGO, RAILS } from './dialect-rules.js';
+import { EFCORE, KNEX, LIQUIBASE, SEQUELIZE } from './dialect-rules-node.js';
 export function dialectOf(file, text) {
     const path = file.split('\\').join('/').toLowerCase();
     if (path.endsWith('.sql'))
@@ -17,158 +19,28 @@ export function dialectOf(file, text) {
     // at all - and on a Node backend that is most of them.
     if (/\bMigrationInterface\b|\bqueryRunner\.query\s*\(/.test(text))
         return 'typeorm';
+    if (/\bqueryInterface\.\w+\s*\(/.test(text))
+        return 'sequelize';
+    if (/\bknex\.schema\b|\bexports\.(?:up|down)\s*=\s*(?:async\s*)?function\s*\(\s*knex\b/.test(text))
+        return 'knex';
+    if (/\bmigrationBuilder\.\w+|\b:\s*Migration\b[\s\S]*\bMigrationBuilder\b/.test(text))
+        return 'efcore';
+    if (/<databaseChangeLog\b|\bdatabaseChangeLog\s*:/.test(text))
+        return 'liquibase';
     if (/(^|\/)(migrations?|db\/migrate)\//.test(path))
         return 'unknown';
     return 'unknown';
 }
-const STR = String.raw `['"]([\w.]+)['"]`;
-/** Django's operations. `model_name` and `name` are the table and the column. */
-const DJANGO = [
-    {
-        find: new RegExp(String.raw `migrations\.RemoveField\([\s\S]{0,200}?model_name=${STR}[\s\S]{0,200}?name=${STR}`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `removes the field ${m[2]} from ${m[1]}`,
-        instead: 'stop reading and writing the field, deploy that, then remove it in a later migration. The version still running during a rolling deploy will select a column that no longer exists',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `migrations\.RenameField\([\s\S]{0,200}?model_name=${STR}[\s\S]{0,200}?old_name=${STR}`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `renames ${m[1]}.${m[2]}`,
-        instead: 'add the new field, write to both, move the readers, then remove the old one',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `migrations\.DeleteModel\([\s\S]{0,120}?${STR}`, 'i'),
-        risk: 'destroys-data',
-        what: (m) => `deletes the model ${m[1]} and its table`,
-        instead: 'stop using it, ship that, confirm nothing reads it, and delete it later',
-        table: (m) => m[1],
-    },
-    {
-        find: new RegExp(String.raw `migrations\.AddField\([\s\S]{0,400}?null=False(?![\s\S]{0,400}?default=)`, 'i'),
-        risk: 'breaks-old-code',
-        what: () => 'adds a field that cannot be null and has no default',
-        instead: 'add it with null=True or a default. Without one, Django rewrites the table and every insert from the running version fails',
-    },
-    {
-        find: new RegExp(String.raw `migrations\.AlterField\([\s\S]{0,400}?null=False`, 'i'),
-        risk: 'locks-writes',
-        what: () => 'makes an existing field NOT NULL, which reads every row under a lock',
-        instead: 'backfill first, add a validated constraint, then alter - or use SeparateDatabaseAndState with the safe SQL',
-    },
-    {
-        // A data migration. Django wraps a migration in one transaction, so this holds it open for as long as
-        // the work takes - fine for a hundred rows, an outage for a hundred million.
-        find: /migrations\.RunPython\(/,
-        unless: /atomic\s*=\s*False/,
-        risk: 'slow',
-        what: () => 'runs application code against the data inside the migration transaction',
-        instead: 'for a large table, work in batches with atomic = False on the migration and make it resumable. For a small one this is fine - Tewip cannot see how many rows there are',
-    },
-    {
-        find: /AddIndex\(|AddConstraint\(/i,
-        unless: /AddIndexConcurrently|AddConstraintNotValid|atomic\s*=\s*False/,
-        risk: 'locks-writes',
-        what: () => 'adds an index or constraint, which Django builds with a lock unless told otherwise',
-        instead: 'AddIndexConcurrently / AddConstraintNotValid from django.contrib.postgres.operations, with atomic = False on the migration',
-    },
-];
-/** Rails migrations. */
-const RAILS = [
-    {
-        find: new RegExp(String.raw `remove_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `removes ${m[1]}.${m[2]}`,
-        instead: "ignore the column in the model (self.ignored_columns), deploy that, then remove it. Rails caches the column list, so the running version keeps selecting it",
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `rename_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `renames ${m[1]}.${m[2]}`,
-        instead: 'add the new column, write to both, move the readers, then remove the old one',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `drop_table\s*[\s(]\s*:?(\w+)`, 'i'),
-        risk: 'destroys-data',
-        what: (m) => `drops the table ${m[1]}`,
-        instead: 'stop using it, ship that, then drop it later',
-        table: (m) => m[1],
-    },
-    {
-        find: /add_index\s*[\s(]/i,
-        unless: /algorithm:\s*:concurrently/,
-        risk: 'locks-writes',
-        what: () => 'adds an index without algorithm: :concurrently, so writes to the table block while it builds',
-        instead: 'add_index ..., algorithm: :concurrently, with disable_ddl_transaction! on the migration',
-    },
-    {
-        find: new RegExp(String.raw `change_column\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)`, 'i'),
-        risk: 'locks-writes',
-        what: (m) => `changes the type of ${m[1]}.${m[2]}, which usually rewrites the table`,
-        instead: 'add a new column, backfill in batches, switch the readers, then drop the old one',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `change_column_null\s*[\s(]\s*:?(\w+)\s*,\s*:?(\w+)\s*,\s*false`, 'i'),
-        risk: 'locks-writes',
-        what: (m) => `makes ${m[1]}.${m[2]} NOT NULL, which reads every row under a lock`,
-        instead: 'add a validated check constraint first, then set the column NOT NULL',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-];
-/** Alembic. */
-const ALEMBIC = [
-    {
-        find: new RegExp(String.raw `op\.drop_column\(\s*${STR}\s*,\s*${STR}`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `drops ${m[1]}.${m[2]}`,
-        instead: 'stop reading and writing it, deploy that, then drop it in a later revision',
-        table: (m) => m[1],
-        column: (m) => m[2],
-    },
-    {
-        find: new RegExp(String.raw `op\.drop_table\(\s*${STR}`, 'i'),
-        risk: 'destroys-data',
-        what: (m) => `drops the table ${m[1]}`,
-        instead: 'stop using it, ship that, then drop it later',
-        table: (m) => m[1],
-    },
-    {
-        find: new RegExp(String.raw `op\.alter_column\([\s\S]{0,300}?nullable=False`, 'i'),
-        risk: 'locks-writes',
-        what: () => 'makes a column NOT NULL, which reads every row under a lock',
-        instead: 'backfill, add a validated constraint, then alter the column',
-    },
-    {
-        find: /op\.create_index\(/i,
-        unless: /postgresql_concurrently\s*=\s*True/,
-        risk: 'locks-writes',
-        what: () => 'builds an index without postgresql_concurrently, so writes block while it builds',
-        instead: 'op.create_index(..., postgresql_concurrently=True) with a non-transactional revision',
-    },
-    {
-        find: new RegExp(String.raw `op\.rename_table\(\s*${STR}`, 'i'),
-        risk: 'breaks-old-code',
-        what: (m) => `renames the table ${m[1]}`,
-        instead: 'move the readers first, or keep a view with the old name',
-        table: (m) => m[1],
-    },
-];
-// TypeORM has no operations of its own: unlike Django's `RemoveField` or Rails's `remove_column`,
-// a TypeORM migration contains SQL and nothing else, handed to queryRunner.query(). So its list is
-// empty on purpose and every finding comes from reading that SQL, which is the same reader the
-// `.sql` dialect uses. The exhaustive Record is what made this a compile error rather than a
-// TypeORM migration silently producing no findings at all.
-const BY_DIALECT = { django: DJANGO, rails: RAILS, alembic: ALEMBIC, typeorm: [] };
+const BY_DIALECT = {
+    django: DJANGO,
+    rails: RAILS,
+    alembic: ALEMBIC,
+    typeorm: [],
+    sequelize: SEQUELIZE,
+    knex: KNEX,
+    efcore: EFCORE,
+    liquibase: LIQUIBASE,
+};
 /** Findings from a framework migration, with the line each one sits on. */
 export function readFramework(dialect, text) {
     const lines = text.split(String.fromCharCode(10));
@@ -230,10 +102,24 @@ export function forwardOnly(dialect, text) {
             (dialect === 'sql' && /^\s*--\s*(?:\+migrate\s+Down|\+goose\s+Down|\/\/@UNDO|Down\b)/i.test(line)) ||
             // TypeORM's rollback is `public async down(queryRunner: QueryRunner)`. Reading it as part of
             // the change would report a migration that adds a column as one that drops it.
-            (dialect === 'typeorm' && /^\s*(?:public\s+)?async\s+down\s*\(/.test(line));
+            (dialect === 'typeorm' && /^\s*(?:public\s+)?async\s+down\s*\(/.test(line)) ||
+            // These three matter more than the rest. A Sequelize or Knex migration almost always *adds*
+            // in up and *removes* in down, and an EF Core Down() is the mirror image of its Up(), so a
+            // reader that took the whole file would report nearly every harmless migration in those
+            // ecosystems as dropping a column. Verified on real migrations from opencollective-api,
+            // Matterwiki and Coflnet, all three of which have their only destructive call in down.
+            (dialect === 'sequelize' && /^\s*down\s*:/.test(line)) ||
+            (dialect === 'knex' && /^\s*(?:exports\.down|module\.exports\.down)\s*=/.test(line)) ||
+            (dialect === 'efcore' && /^\s*protected\s+override\s+void\s+Down\s*\(/.test(line)) ||
+            // Liquibase puts the reverse inside the change itself rather than in a second method.
+            (dialect === 'liquibase' && /^\s*<rollback\b/.test(line));
         if (down) {
             // To the end of the block: the next line at the same indentation or less that starts something new.
-            blankFrom(i, (l, indent) => l.trim() !== '' && indentOf(l) <= indent && !/^\s*(end|\})\s*$/.test(l), indentOf(line));
+            // A lone brace is punctuation, not the start of something new. C# puts the opening `{` of a
+            // method on its own line at the same indent as the signature, so without `{` here the block
+            // ended one line after it began and the whole of EF Core's Down() was read as part of the
+            // change - which reported Coflnet's real migration as dropping three columns it adds.
+            blankFrom(i, (l, indent) => l.trim() !== '' && indentOf(l) <= indent && !/^\s*(end|\}|\{)\s*$/.test(l), indentOf(line));
             continue;
         }
         // Rails's `direction.down { ... }` is usually one line.

package/dist/engine/schema/schema-command.js

@@ -70,7 +70,7 @@ export function readMigration(root, file) {
             file,
             dialect,
             findings: [],
-            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic and TypeORM migrations',
+            unread: 'Tewip does not recognise how this migration is written, so it says nothing about it rather than passing it. It reads SQL, Django, Rails, Alembic, TypeORM, Sequelize, Knex, EF Core and Liquibase migrations',
             irreversible: false,
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tewip-ai",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "mcpName": "io.github.hmamut39/tewip",
   "description": "Tewip finds why each failing test failed - real bug, flaky test, environment, test data or changed selector - for any stack, from the command line, CI, or your editor.",
   "keywords": [