turbine-orm 0.26.0 → 0.27.0

package/README.md

@@ -661,6 +661,12 @@ npx turbine migrate down
 npx turbine migrate status
 ```
 
+**Destructive migrations require explicit confirmation.** If a pending migration (or a DOWN
+section being rolled back) contains data-destroying SQL — `DROP TABLE`, `DROP COLUMN`,
+`TRUNCATE`, `DELETE FROM`, `UPDATE` without `WHERE`, `ALTER COLUMN … TYPE` — Turbine refuses
+to run it and prints an itemized report. Interactively you must type `destroy my data` and
+then `yes`; in CI you must pass `--allow-destructive`. A refused batch applies nothing.
+
 ## Studio
 
 The only Postgres ORM with a Studio your DBA will approve. `turbine studio` launches a local, read-only web UI for exploring your database — no mutations, no writes, and since v0.19 **no raw-SQL surface at all**: every query is composed visually in the ORM and compiled by the same validated query builder your application uses.

package/dist/cjs/cli/destructive.js

@@ -0,0 +1,123 @@
+"use strict";
+/**
+ * Destructive-migration detection.
+ *
+ * `migrate up`/`down` execute user-authored SQL files verbatim, which is the
+ * one place data loss can hide: a `DROP TABLE` or a `DELETE FROM` in a
+ * migration runs with no ceremony. This module scans migration SQL for
+ * statements that can destroy data so the CLI can force an explicit,
+ * interactive confirmation (and the programmatic API can refuse by default).
+ *
+ * Deliberately conservative in BOTH directions:
+ *   - comments and string literals are stripped first, so `-- DROP TABLE foo`
+ *     or `INSERT ... VALUES ('DROP TABLE x')` never false-positive;
+ *   - anything that removes rows, columns, tables, or schemas — or rewrites a
+ *     column's type (a potentially lossy cast) — is flagged. `DROP INDEX`,
+ *     `DROP CONSTRAINT`, and `DROP TRIGGER` are NOT flagged (recreatable
+ *     structures; no row data lost).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESTRUCTIVE_KIND_LABEL = void 0;
+exports.scanDestructiveSql = scanDestructiveSql;
+/** Human explanation per kind, used in CLI output. */
+exports.DESTRUCTIVE_KIND_LABEL = {
+    'drop-table': 'drops a table and ALL its rows',
+    'drop-schema': 'drops an entire schema',
+    'drop-column': 'drops a column and its data in every row',
+    truncate: 'deletes every row',
+    delete: 'deletes rows',
+    'update-without-where': 'rewrites every row (no WHERE clause)',
+    'alter-column-type': 'rewrites a column type (cast may truncate or fail)',
+};
+/** Strip -- line comments, C-style block comments, and quoted literals. */
+function stripCommentsAndStrings(sql) {
+    let out = '';
+    let i = 0;
+    while (i < sql.length) {
+        const two = sql.slice(i, i + 2);
+        if (two === '--') {
+            const nl = sql.indexOf('\n', i);
+            i = nl === -1 ? sql.length : nl; // keep the newline
+        }
+        else if (two === '/*') {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            out += ' ';
+        }
+        else if (sql[i] === "'") {
+            // single-quoted literal ('' escapes a quote)
+            let j = i + 1;
+            while (j < sql.length) {
+                if (sql[j] === "'" && sql[j + 1] === "'")
+                    j += 2;
+                else if (sql[j] === "'")
+                    break;
+                else
+                    j++;
+            }
+            i = j + 1;
+            out += "''";
+        }
+        else if (sql[i] === '$' && /^\$[a-zA-Z_]*\$/.test(sql.slice(i))) {
+            // dollar-quoted literal ($$...$$ / $tag$...$tag$)
+            const tag = sql.slice(i).match(/^\$[a-zA-Z_]*\$/)?.[0] ?? '$$';
+            const end = sql.indexOf(tag, i + tag.length);
+            i = end === -1 ? sql.length : end + tag.length;
+            out += "''";
+        }
+        else {
+            out += sql[i];
+            i++;
+        }
+    }
+    return out;
+}
+/** Unquote a "quoted" identifier for display. */
+const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
+const IDENT = String.raw `("[^"]+"|[a-zA-Z_][\w$]*)(\.("[^"]+"|[a-zA-Z_][\w$]*))?`;
+/**
+ * Scan SQL (one file's worth; may contain many `;`-separated statements) and
+ * return every statement that can destroy data.
+ */
+function scanDestructiveSql(sql) {
+    const found = [];
+    const cleaned = stripCommentsAndStrings(sql);
+    for (const rawStmt of cleaned.split(';')) {
+        const stmt = rawStmt.trim();
+        if (!stmt)
+            continue;
+        const display = stmt.replace(/\s+/g, ' ');
+        let m;
+        if ((m = stmt.match(new RegExp(String.raw `^DROP\s+TABLE\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({
+                statement: display,
+                kind: 'drop-table',
+                target: ident(m[4] ? `${ident(m[2])}.${ident(m[4])}` : m[2]),
+            });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^DROP\s+SCHEMA\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'drop-schema', target: ident(m[2]) });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^TRUNCATE\s+(TABLE\s+)?(ONLY\s+)?${IDENT}`, 'i')))) {
+            found.push({
+                statement: display,
+                kind: 'truncate',
+                target: ident(m[5] ? `${ident(m[3])}.${ident(m[5])}` : m[3]),
+            });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bDROP\s+COLUMN\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'drop-column', target: `${ident(m[3])}.${ident(m[7])}` });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bALTER\s+(COLUMN\s+)?${IDENT}\s+(SET\s+DATA\s+)?TYPE\b`, 'i')))) {
+            found.push({ statement: display, kind: 'alter-column-type', target: `${ident(m[3])}.${ident(m[7])}` });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^DELETE\s+FROM\s+(ONLY\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'delete', target: ident(m[2]) });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^UPDATE\s+(ONLY\s+)?${IDENT}\b`, 'i'))) &&
+            !/\bWHERE\b/i.test(stmt)) {
+            found.push({ statement: display, kind: 'update-without-where', target: ident(m[2]) });
+        }
+    }
+    return found;
+}

package/dist/cjs/cli/index.js

@@ -128,6 +128,9 @@ function parseArgs() {
             case '--fix':
                 result.fix = true;
                 break;
+            case '--allow-destructive':
+                result.allowDestructive = true;
+                break;
             case '--force':
             case '-f':
                 result.force = true;
@@ -784,11 +787,35 @@ async function cmdMigrateUp(args, config) {
         console.log(`  ${(0, ui_js_1.dim)('Proceed only if you are intentionally rewriting migration history.')}`);
         (0, ui_js_1.newline)();
     }
+    if (args.allowDestructive) {
+        (0, ui_js_1.warn)('--allow-destructive is set — data-destroying statements in migrations WILL run.');
+        (0, ui_js_1.newline)();
+    }
     const spinner = new ui_js_1.Spinner('Applying migrations').start();
-    const result = await (0, migrate_js_1.migrateUp)(url, config.migrationsDir, {
-        step: args.step,
-        allowDrift: args.allowDrift,
-    });
+    let result;
+    try {
+        result = await (0, migrate_js_1.migrateUp)(url, config.migrationsDir, {
+            step: args.step,
+            allowDrift: args.allowDrift,
+            allowDestructive: args.allowDestructive,
+        });
+    }
+    catch (err) {
+        if (!isDestructiveRefusal(err))
+            throw err;
+        spinner.stop();
+        if (!(await confirmDestructive(err.message))) {
+            (0, ui_js_1.error)('Aborted — no migrations were applied and no data was touched.');
+            (0, ui_js_1.newline)();
+            process.exit(1);
+        }
+        spinner.start();
+        result = await (0, migrate_js_1.migrateUp)(url, config.migrationsDir, {
+            step: args.step,
+            allowDrift: args.allowDrift,
+            allowDestructive: true,
+        });
+    }
     if (result.applied.length === 0 && result.errors.length === 0) {
         spinner.succeed('All migrations are up to date');
         (0, ui_js_1.newline)();
@@ -811,6 +838,44 @@ async function cmdMigrateUp(args, config) {
     }
     (0, ui_js_1.newline)();
 }
+/** True when the error is migrate up/down's destructive-statement refusal. */
+function isDestructiveRefusal(err) {
+    return err instanceof Error && err.message.includes('DESTRUCTIVE');
+}
+/**
+ * Triple confirmation for destructive migrations:
+ *   1. show the full itemized report (statement kinds + targets),
+ *   2. require typing the literal phrase `destroy my data`,
+ *   3. require a final explicit `yes`.
+ * Non-interactive shells (CI, pipes) can never pass this — they must use the
+ * explicit `--allow-destructive` flag instead. Anything but exact answers aborts.
+ */
+async function confirmDestructive(report) {
+    (0, ui_js_1.newline)();
+    (0, ui_js_1.error)('DESTRUCTIVE MIGRATION DETECTED');
+    (0, ui_js_1.newline)();
+    for (const line of report.split('\n'))
+        console.log(`  ${line.includes('[turbine]') ? line.replace('[turbine] ', '') : line}`);
+    (0, ui_js_1.newline)();
+    if (!process.stdin.isTTY) {
+        console.log(`  ${(0, ui_js_1.dim)('Non-interactive shell: rerun with')} ${(0, ui_js_1.cyan)('--allow-destructive')} ${(0, ui_js_1.dim)('to proceed.')}`);
+        (0, ui_js_1.newline)();
+        return false;
+    }
+    const { createInterface } = await Promise.resolve().then(() => __importStar(require('node:readline/promises')));
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        console.log(`  ${(0, ui_js_1.yellow)('This will permanently destroy data. There is no undo.')}`);
+        const phrase = await rl.question(`  Type ${(0, ui_js_1.bold)('destroy my data')} to continue, anything else to abort: `);
+        if (phrase.trim() !== 'destroy my data')
+            return false;
+        const finalAnswer = await rl.question(`  Final confirmation — apply the destructive statements above? Type ${(0, ui_js_1.bold)('yes')}: `);
+        return finalAnswer.trim() === 'yes';
+    }
+    finally {
+        rl.close();
+    }
+}
 async function cmdMigrateDown(args, config) {
     (0, ui_js_1.banner)();
     const url = requireUrl(config);
@@ -818,9 +883,28 @@ async function cmdMigrateDown(args, config) {
     (0, ui_js_1.label)('Migrations', config.migrationsDir);
     (0, ui_js_1.newline)();
     const spinner = new ui_js_1.Spinner('Rolling back migration(s)').start();
-    const result = await (0, migrate_js_1.migrateDown)(url, config.migrationsDir, {
-        step: args.step ?? 1,
-    });
+    let result;
+    try {
+        result = await (0, migrate_js_1.migrateDown)(url, config.migrationsDir, {
+            step: args.step ?? 1,
+            allowDestructive: args.allowDestructive,
+        });
+    }
+    catch (err) {
+        if (!isDestructiveRefusal(err))
+            throw err;
+        spinner.stop();
+        if (!(await confirmDestructive(err.message))) {
+            (0, ui_js_1.error)('Aborted — nothing was rolled back and no data was touched.');
+            (0, ui_js_1.newline)();
+            process.exit(1);
+        }
+        spinner.start();
+        result = await (0, migrate_js_1.migrateDown)(url, config.migrationsDir, {
+            step: args.step ?? 1,
+            allowDestructive: true,
+        });
+    }
     if (result.rolledBack.length === 0 && result.errors.length === 0) {
         spinner.succeed('No migrations to roll back');
         (0, ui_js_1.newline)();
@@ -1308,6 +1392,7 @@ function showMigrateHelp() {
     console.log(`    ${(0, ui_js_1.cyan)('--step, -n')} ${(0, ui_js_1.dim)('<N>')}    Number of migrations to apply/rollback`);
     console.log(`    ${(0, ui_js_1.cyan)('--dry-run')}         Show SQL without executing`);
     console.log(`    ${(0, ui_js_1.cyan)('--allow-drift')}     Bypass checksum validation ${(0, ui_js_1.dim)('(migrate up only — advanced)')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--allow-destructive')} Run data-destroying migration statements without the interactive confirm`);
     console.log(`    ${(0, ui_js_1.cyan)('--verbose, -v')}     Show detailed output`);
     (0, ui_js_1.newline)();
     console.log(`  ${(0, ui_js_1.bold)('Examples:')}`);

package/dist/cjs/cli/migrate.js

@@ -35,6 +35,7 @@ const pg_1 = __importDefault(require("pg"));
 const index_js_1 = require("../adapters/index.js");
 const dialect_js_1 = require("../dialect.js");
 const errors_js_1 = require("../errors.js");
+const destructive_js_1 = require("./destructive.js");
 // ---------------------------------------------------------------------------
 // Tracking table management
 // ---------------------------------------------------------------------------
@@ -368,6 +369,35 @@ async function migrateUp(connectionString, migrationsDir, options) {
             if (options?.step != null && options.step > 0) {
                 pending = pending.slice(0, options.step);
             }
+            // Data-loss gate: refuse to run pending migrations containing destructive
+            // statements unless the caller has EXPLICITLY opted in. The CLI layers an
+            // interactive typed confirmation on top of this; programmatic callers must
+            // pass `allowDestructive: true`. Safe-by-default is the whole point — a
+            // DROP TABLE should never run just because a file exists.
+            if (!options?.allowDestructive) {
+                const offenders = [];
+                for (const file of pending) {
+                    const { up } = parseMigrationSQL(file.path);
+                    if (!up)
+                        continue;
+                    const hits = (0, destructive_js_1.scanDestructiveSql)(up);
+                    if (hits.length > 0)
+                        offenders.push({ file: file.filename, hits });
+                }
+                if (offenders.length > 0) {
+                    const lines = ['[turbine] Refusing to apply migrations containing DESTRUCTIVE statements:', ''];
+                    for (const o of offenders) {
+                        lines.push(`  ${o.file}`);
+                        for (const h of o.hits) {
+                            lines.push(`    - [${h.kind}] ${h.target} — ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
+                        }
+                    }
+                    lines.push('');
+                    lines.push('Review the statements above. To proceed: run `npx turbine migrate up` interactively');
+                    lines.push('and confirm, pass --allow-destructive, or set allowDestructive: true programmatically.');
+                    throw new errors_js_1.MigrationError(lines.join('\n'));
+                }
+            }
             const results = [];
             const errors = [];
             for (const file of pending) {
@@ -435,6 +465,36 @@ async function migrateDown(connectionString, migrationsDir, options) {
             const fileMap = new Map(allFiles.map((f) => [f.name, f]));
             // Reverse order — rollback most recent first
             const toRollback = applied.reverse().slice(0, options?.step ?? 1);
+            // Same data-loss gate as migrateUp — DOWN sections routinely contain
+            // DROP TABLE (the legitimate reverse of a CREATE), which still destroys
+            // every row written since the migration ran. Explicit opt-in required.
+            if (!options?.allowDestructive) {
+                const offenders = [];
+                for (const migration of toRollback) {
+                    const file = fileMap.get(migration.name);
+                    if (!file)
+                        continue;
+                    const { down } = parseMigrationSQL(file.path);
+                    if (!down)
+                        continue;
+                    const hits = (0, destructive_js_1.scanDestructiveSql)(down);
+                    if (hits.length > 0)
+                        offenders.push({ file: file.filename, hits });
+                }
+                if (offenders.length > 0) {
+                    const lines = ['[turbine] Refusing to roll back migrations whose DOWN sections are DESTRUCTIVE:', ''];
+                    for (const o of offenders) {
+                        lines.push(`  ${o.file}`);
+                        for (const h of o.hits) {
+                            lines.push(`    - [${h.kind}] ${h.target} — ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
+                        }
+                    }
+                    lines.push('');
+                    lines.push('To proceed: run `npx turbine migrate down` interactively and confirm, pass');
+                    lines.push('--allow-destructive, or set allowDestructive: true programmatically.');
+                    throw new errors_js_1.MigrationError(lines.join('\n'));
+                }
+            }
             const results = [];
             const errors = [];
             for (const migration of toRollback) {

package/dist/cli/destructive.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Destructive-migration detection.
+ *
+ * `migrate up`/`down` execute user-authored SQL files verbatim, which is the
+ * one place data loss can hide: a `DROP TABLE` or a `DELETE FROM` in a
+ * migration runs with no ceremony. This module scans migration SQL for
+ * statements that can destroy data so the CLI can force an explicit,
+ * interactive confirmation (and the programmatic API can refuse by default).
+ *
+ * Deliberately conservative in BOTH directions:
+ *   - comments and string literals are stripped first, so `-- DROP TABLE foo`
+ *     or `INSERT ... VALUES ('DROP TABLE x')` never false-positive;
+ *   - anything that removes rows, columns, tables, or schemas — or rewrites a
+ *     column's type (a potentially lossy cast) — is flagged. `DROP INDEX`,
+ *     `DROP CONSTRAINT`, and `DROP TRIGGER` are NOT flagged (recreatable
+ *     structures; no row data lost).
+ */
+export type DestructiveKind = 'drop-table' | 'drop-schema' | 'drop-column' | 'truncate' | 'delete' | 'update-without-where' | 'alter-column-type';
+export interface DestructiveStatement {
+    /** The offending SQL statement (trimmed, possibly long — display truncated) */
+    statement: string;
+    kind: DestructiveKind;
+    /** Best-effort extracted object name (table, schema, or table.column) */
+    target: string;
+}
+/** Human explanation per kind, used in CLI output. */
+export declare const DESTRUCTIVE_KIND_LABEL: Record<DestructiveKind, string>;
+/**
+ * Scan SQL (one file's worth; may contain many `;`-separated statements) and
+ * return every statement that can destroy data.
+ */
+export declare function scanDestructiveSql(sql: string): DestructiveStatement[];

package/dist/cli/destructive.js

@@ -0,0 +1,119 @@
+/**
+ * Destructive-migration detection.
+ *
+ * `migrate up`/`down` execute user-authored SQL files verbatim, which is the
+ * one place data loss can hide: a `DROP TABLE` or a `DELETE FROM` in a
+ * migration runs with no ceremony. This module scans migration SQL for
+ * statements that can destroy data so the CLI can force an explicit,
+ * interactive confirmation (and the programmatic API can refuse by default).
+ *
+ * Deliberately conservative in BOTH directions:
+ *   - comments and string literals are stripped first, so `-- DROP TABLE foo`
+ *     or `INSERT ... VALUES ('DROP TABLE x')` never false-positive;
+ *   - anything that removes rows, columns, tables, or schemas — or rewrites a
+ *     column's type (a potentially lossy cast) — is flagged. `DROP INDEX`,
+ *     `DROP CONSTRAINT`, and `DROP TRIGGER` are NOT flagged (recreatable
+ *     structures; no row data lost).
+ */
+/** Human explanation per kind, used in CLI output. */
+export const DESTRUCTIVE_KIND_LABEL = {
+    'drop-table': 'drops a table and ALL its rows',
+    'drop-schema': 'drops an entire schema',
+    'drop-column': 'drops a column and its data in every row',
+    truncate: 'deletes every row',
+    delete: 'deletes rows',
+    'update-without-where': 'rewrites every row (no WHERE clause)',
+    'alter-column-type': 'rewrites a column type (cast may truncate or fail)',
+};
+/** Strip -- line comments, C-style block comments, and quoted literals. */
+function stripCommentsAndStrings(sql) {
+    let out = '';
+    let i = 0;
+    while (i < sql.length) {
+        const two = sql.slice(i, i + 2);
+        if (two === '--') {
+            const nl = sql.indexOf('\n', i);
+            i = nl === -1 ? sql.length : nl; // keep the newline
+        }
+        else if (two === '/*') {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? sql.length : end + 2;
+            out += ' ';
+        }
+        else if (sql[i] === "'") {
+            // single-quoted literal ('' escapes a quote)
+            let j = i + 1;
+            while (j < sql.length) {
+                if (sql[j] === "'" && sql[j + 1] === "'")
+                    j += 2;
+                else if (sql[j] === "'")
+                    break;
+                else
+                    j++;
+            }
+            i = j + 1;
+            out += "''";
+        }
+        else if (sql[i] === '$' && /^\$[a-zA-Z_]*\$/.test(sql.slice(i))) {
+            // dollar-quoted literal ($$...$$ / $tag$...$tag$)
+            const tag = sql.slice(i).match(/^\$[a-zA-Z_]*\$/)?.[0] ?? '$$';
+            const end = sql.indexOf(tag, i + tag.length);
+            i = end === -1 ? sql.length : end + tag.length;
+            out += "''";
+        }
+        else {
+            out += sql[i];
+            i++;
+        }
+    }
+    return out;
+}
+/** Unquote a "quoted" identifier for display. */
+const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
+const IDENT = String.raw `("[^"]+"|[a-zA-Z_][\w$]*)(\.("[^"]+"|[a-zA-Z_][\w$]*))?`;
+/**
+ * Scan SQL (one file's worth; may contain many `;`-separated statements) and
+ * return every statement that can destroy data.
+ */
+export function scanDestructiveSql(sql) {
+    const found = [];
+    const cleaned = stripCommentsAndStrings(sql);
+    for (const rawStmt of cleaned.split(';')) {
+        const stmt = rawStmt.trim();
+        if (!stmt)
+            continue;
+        const display = stmt.replace(/\s+/g, ' ');
+        let m;
+        if ((m = stmt.match(new RegExp(String.raw `^DROP\s+TABLE\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({
+                statement: display,
+                kind: 'drop-table',
+                target: ident(m[4] ? `${ident(m[2])}.${ident(m[4])}` : m[2]),
+            });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^DROP\s+SCHEMA\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'drop-schema', target: ident(m[2]) });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^TRUNCATE\s+(TABLE\s+)?(ONLY\s+)?${IDENT}`, 'i')))) {
+            found.push({
+                statement: display,
+                kind: 'truncate',
+                target: ident(m[5] ? `${ident(m[3])}.${ident(m[5])}` : m[3]),
+            });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bDROP\s+COLUMN\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'drop-column', target: `${ident(m[3])}.${ident(m[7])}` });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bALTER\s+(COLUMN\s+)?${IDENT}\s+(SET\s+DATA\s+)?TYPE\b`, 'i')))) {
+            found.push({ statement: display, kind: 'alter-column-type', target: `${ident(m[3])}.${ident(m[7])}` });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^DELETE\s+FROM\s+(ONLY\s+)?${IDENT}`, 'i')))) {
+            found.push({ statement: display, kind: 'delete', target: ident(m[2]) });
+        }
+        else if ((m = stmt.match(new RegExp(String.raw `^UPDATE\s+(ONLY\s+)?${IDENT}\b`, 'i'))) &&
+            !/\bWHERE\b/i.test(stmt)) {
+            found.push({ statement: display, kind: 'update-without-where', target: ident(m[2]) });
+        }
+    }
+    return found;
+}

package/dist/cli/index.js

@@ -93,6 +93,9 @@ function parseArgs() {
             case '--fix':
                 result.fix = true;
                 break;
+            case '--allow-destructive':
+                result.allowDestructive = true;
+                break;
             case '--force':
             case '-f':
                 result.force = true;
@@ -749,11 +752,35 @@ async function cmdMigrateUp(args, config) {
         console.log(`  ${dim('Proceed only if you are intentionally rewriting migration history.')}`);
         newline();
     }
+    if (args.allowDestructive) {
+        warn('--allow-destructive is set — data-destroying statements in migrations WILL run.');
+        newline();
+    }
     const spinner = new Spinner('Applying migrations').start();
-    const result = await migrateUp(url, config.migrationsDir, {
-        step: args.step,
-        allowDrift: args.allowDrift,
-    });
+    let result;
+    try {
+        result = await migrateUp(url, config.migrationsDir, {
+            step: args.step,
+            allowDrift: args.allowDrift,
+            allowDestructive: args.allowDestructive,
+        });
+    }
+    catch (err) {
+        if (!isDestructiveRefusal(err))
+            throw err;
+        spinner.stop();
+        if (!(await confirmDestructive(err.message))) {
+            error('Aborted — no migrations were applied and no data was touched.');
+            newline();
+            process.exit(1);
+        }
+        spinner.start();
+        result = await migrateUp(url, config.migrationsDir, {
+            step: args.step,
+            allowDrift: args.allowDrift,
+            allowDestructive: true,
+        });
+    }
     if (result.applied.length === 0 && result.errors.length === 0) {
         spinner.succeed('All migrations are up to date');
         newline();
@@ -776,6 +803,44 @@ async function cmdMigrateUp(args, config) {
     }
     newline();
 }
+/** True when the error is migrate up/down's destructive-statement refusal. */
+function isDestructiveRefusal(err) {
+    return err instanceof Error && err.message.includes('DESTRUCTIVE');
+}
+/**
+ * Triple confirmation for destructive migrations:
+ *   1. show the full itemized report (statement kinds + targets),
+ *   2. require typing the literal phrase `destroy my data`,
+ *   3. require a final explicit `yes`.
+ * Non-interactive shells (CI, pipes) can never pass this — they must use the
+ * explicit `--allow-destructive` flag instead. Anything but exact answers aborts.
+ */
+async function confirmDestructive(report) {
+    newline();
+    error('DESTRUCTIVE MIGRATION DETECTED');
+    newline();
+    for (const line of report.split('\n'))
+        console.log(`  ${line.includes('[turbine]') ? line.replace('[turbine] ', '') : line}`);
+    newline();
+    if (!process.stdin.isTTY) {
+        console.log(`  ${dim('Non-interactive shell: rerun with')} ${cyan('--allow-destructive')} ${dim('to proceed.')}`);
+        newline();
+        return false;
+    }
+    const { createInterface } = await import('node:readline/promises');
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        console.log(`  ${yellow('This will permanently destroy data. There is no undo.')}`);
+        const phrase = await rl.question(`  Type ${bold('destroy my data')} to continue, anything else to abort: `);
+        if (phrase.trim() !== 'destroy my data')
+            return false;
+        const finalAnswer = await rl.question(`  Final confirmation — apply the destructive statements above? Type ${bold('yes')}: `);
+        return finalAnswer.trim() === 'yes';
+    }
+    finally {
+        rl.close();
+    }
+}
 async function cmdMigrateDown(args, config) {
     banner();
     const url = requireUrl(config);
@@ -783,9 +848,28 @@ async function cmdMigrateDown(args, config) {
     label('Migrations', config.migrationsDir);
     newline();
     const spinner = new Spinner('Rolling back migration(s)').start();
-    const result = await migrateDown(url, config.migrationsDir, {
-        step: args.step ?? 1,
-    });
+    let result;
+    try {
+        result = await migrateDown(url, config.migrationsDir, {
+            step: args.step ?? 1,
+            allowDestructive: args.allowDestructive,
+        });
+    }
+    catch (err) {
+        if (!isDestructiveRefusal(err))
+            throw err;
+        spinner.stop();
+        if (!(await confirmDestructive(err.message))) {
+            error('Aborted — nothing was rolled back and no data was touched.');
+            newline();
+            process.exit(1);
+        }
+        spinner.start();
+        result = await migrateDown(url, config.migrationsDir, {
+            step: args.step ?? 1,
+            allowDestructive: true,
+        });
+    }
     if (result.rolledBack.length === 0 && result.errors.length === 0) {
         spinner.succeed('No migrations to roll back');
         newline();
@@ -1273,6 +1357,7 @@ function showMigrateHelp() {
     console.log(`    ${cyan('--step, -n')} ${dim('<N>')}    Number of migrations to apply/rollback`);
     console.log(`    ${cyan('--dry-run')}         Show SQL without executing`);
     console.log(`    ${cyan('--allow-drift')}     Bypass checksum validation ${dim('(migrate up only — advanced)')}`);
+    console.log(`    ${cyan('--allow-destructive')} Run data-destroying migration statements without the interactive confirm`);
     console.log(`    ${cyan('--verbose, -v')}     Show detailed output`);
     newline();
     console.log(`  ${bold('Examples:')}`);

package/dist/cli/migrate.d.ts

@@ -115,6 +115,8 @@ export declare function migrateUp(connectionString: string, migrationsDir: strin
     step?: number;
     allowDrift?: boolean;
     force?: boolean /** @deprecated use allowDrift */;
+    /** Run migrations even when they contain data-destroying statements. Default false. */
+    allowDestructive?: boolean;
     adapter?: DatabaseAdapter;
     dialect?: Dialect;
 }): Promise<{
@@ -134,6 +136,7 @@ export declare function migrateUp(connectionString: string, migrationsDir: strin
  */
 export declare function migrateDown(connectionString: string, migrationsDir: string, options?: {
     step?: number;
+    allowDestructive?: boolean;
     adapter?: DatabaseAdapter;
     dialect?: Dialect;
 }): Promise<{

package/dist/cli/migrate.js

@@ -18,6 +18,7 @@ import pg from 'pg';
 import { postgresql } from '../adapters/index.js';
 import { postgresDialect } from '../dialect.js';
 import { MigrationError } from '../errors.js';
+import { DESTRUCTIVE_KIND_LABEL, scanDestructiveSql } from './destructive.js';
 // ---------------------------------------------------------------------------
 // Tracking table management
 // ---------------------------------------------------------------------------
@@ -351,6 +352,35 @@ export async function migrateUp(connectionString, migrationsDir, options) {
             if (options?.step != null && options.step > 0) {
                 pending = pending.slice(0, options.step);
             }
+            // Data-loss gate: refuse to run pending migrations containing destructive
+            // statements unless the caller has EXPLICITLY opted in. The CLI layers an
+            // interactive typed confirmation on top of this; programmatic callers must
+            // pass `allowDestructive: true`. Safe-by-default is the whole point — a
+            // DROP TABLE should never run just because a file exists.
+            if (!options?.allowDestructive) {
+                const offenders = [];
+                for (const file of pending) {
+                    const { up } = parseMigrationSQL(file.path);
+                    if (!up)
+                        continue;
+                    const hits = scanDestructiveSql(up);
+                    if (hits.length > 0)
+                        offenders.push({ file: file.filename, hits });
+                }
+                if (offenders.length > 0) {
+                    const lines = ['[turbine] Refusing to apply migrations containing DESTRUCTIVE statements:', ''];
+                    for (const o of offenders) {
+                        lines.push(`  ${o.file}`);
+                        for (const h of o.hits) {
+                            lines.push(`    - [${h.kind}] ${h.target} — ${DESTRUCTIVE_KIND_LABEL[h.kind]}`);
+                        }
+                    }
+                    lines.push('');
+                    lines.push('Review the statements above. To proceed: run `npx turbine migrate up` interactively');
+                    lines.push('and confirm, pass --allow-destructive, or set allowDestructive: true programmatically.');
+                    throw new MigrationError(lines.join('\n'));
+                }
+            }
             const results = [];
             const errors = [];
             for (const file of pending) {
@@ -418,6 +448,36 @@ export async function migrateDown(connectionString, migrationsDir, options) {
             const fileMap = new Map(allFiles.map((f) => [f.name, f]));
             // Reverse order — rollback most recent first
             const toRollback = applied.reverse().slice(0, options?.step ?? 1);
+            // Same data-loss gate as migrateUp — DOWN sections routinely contain
+            // DROP TABLE (the legitimate reverse of a CREATE), which still destroys
+            // every row written since the migration ran. Explicit opt-in required.
+            if (!options?.allowDestructive) {
+                const offenders = [];
+                for (const migration of toRollback) {
+                    const file = fileMap.get(migration.name);
+                    if (!file)
+                        continue;
+                    const { down } = parseMigrationSQL(file.path);
+                    if (!down)
+                        continue;
+                    const hits = scanDestructiveSql(down);
+                    if (hits.length > 0)
+                        offenders.push({ file: file.filename, hits });
+                }
+                if (offenders.length > 0) {
+                    const lines = ['[turbine] Refusing to roll back migrations whose DOWN sections are DESTRUCTIVE:', ''];
+                    for (const o of offenders) {
+                        lines.push(`  ${o.file}`);
+                        for (const h of o.hits) {
+                            lines.push(`    - [${h.kind}] ${h.target} — ${DESTRUCTIVE_KIND_LABEL[h.kind]}`);
+                        }
+                    }
+                    lines.push('');
+                    lines.push('To proceed: run `npx turbine migrate down` interactively and confirm, pass');
+                    lines.push('--allow-destructive, or set allowDestructive: true programmatically.');
+                    throw new MigrationError(lines.join('\n'));
+                }
+            }
             const results = [];
             const errors = [];
             for (const migration of toRollback) {

package/dist/cli/ui.d.ts

@@ -30,7 +30,7 @@ export declare const symbols: {
     readonly bullet: "*" | "•";
     readonly arrow: "→" | "->";
     readonly arrowRight: ">" | "▸";
-    readonly info: "ℹ" | "i";
+    readonly info: "i" | "ℹ";
     readonly warning: "⚠" | "!";
     readonly dot: "." | "∙";
     readonly line: "─" | "-";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "turbine-orm",
-  "version": "0.26.0",
+  "version": "0.27.0",
   "description": "Postgres-native TypeScript ORM — runs on Neon, Vercel Postgres, Cloudflare, Supabase. Streaming cursors, typed errors, single-query nested relations. One dependency, no WASM engine",
   "type": "module",
   "exports": {