turbine-orm 0.40.0 → 0.40.1

package/README.md

@@ -602,22 +602,22 @@ Operators for Postgres array columns (`text[]`, `int[]`, etc.).
 npx turbine <command> [options]
 
 Commands:
-  init                  Initialize a Turbine project (creates config, dirs, templates)
-  generate | pull       Introspect database and generate TypeScript types + client
-  push                  Apply schema-builder definitions to database
-  migrate create <name>            Create a new SQL migration file
-  migrate create <name> --auto     Auto-generate from schema diff
-  migrate create <name> --from-diff Like --auto, but flag destructive statements
-  migrate up                       Apply pending migrations
-  migrate deploy               Apply pending migrations without prompts
-  migrate down                 Rollback last migration
-  migrate status               Show applied/pending migrations
-  seed                         Run seed file
-  status                       Show database schema summary
-  doctor                       Check relations for missing FK indexes (--fix emits migration)
-  studio                       Launch local Studio web UI (read-only; --write for writes, --demo for a sample DB)
-  mcp                          Start read-only MCP server over JSON-RPC stdio
-  observe                      Launch local metrics dashboard (requires TURBINE_OBSERVE_URL)
+  init                               Initialize a Turbine project (creates config, dirs, templates)
+  generate | pull                    Introspect database and generate TypeScript types + client
+  push                               Apply schema-builder definitions to database
+  migrate create <name>              Create a new SQL migration file
+  migrate create <name> --auto       Auto-generate from schema diff
+  migrate create <name> --from-diff  Like --auto, but flag destructive statements
+  migrate up                         Apply pending migrations
+  migrate deploy                     Apply pending migrations without prompts
+  migrate down                       Rollback last migration (--step N for last N)
+  migrate status                     Show applied/pending migrations
+  seed                               Run seed file
+  status                             Show database schema summary
+  doctor                             Check relations for missing FK indexes (--fix emits migration)
+  studio                             Launch local Studio web UI (read-only; --write for writes, --demo for a sample DB)
+  mcp                                Start read-only MCP server over JSON-RPC stdio
+  observe                            Launch local metrics dashboard (requires TURBINE_OBSERVE_URL)
 
 Options:
   --url, -u <url>       Postgres connection string
@@ -625,6 +625,10 @@ Options:
   --schema, -s <name>   Postgres schema (default: public)
   --auto                Auto-generate migration from schema diff
   --from-diff           Like --auto, but flag destructive statements (migrate create)
+  --recipe <name>       Scaffold a sanctioned pattern, e.g. backfill (migrate create)
+  --step, -n <N>        Apply/rollback only N migrations (migrate up / down)
+  --allow-drift         Bypass checksum validation (migrate up / deploy)
+  --allow-destructive   Run data-destroying statements without confirmation (up / down / push)
   --dry-run             Show SQL without executing
   --verbose, -v         Detailed output
 ```

package/dist/cjs/cli/index.js

@@ -67,6 +67,7 @@ exports.buildMigrateDeployOptions = buildMigrateDeployOptions;
 exports.getSeedExecutionPlan = getSeedExecutionPlan;
 exports.isLoopbackHost = isLoopbackHost;
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const node_path_1 = require("node:path");
 const node_url_1 = require("node:url");
 const generate_js_1 = require("../generate.js");
@@ -74,6 +75,7 @@ const index_advisor_js_1 = require("../index-advisor.js");
 const introspect_js_1 = require("../introspect.js");
 const schema_sql_js_1 = require("../schema-sql.js");
 const config_js_1 = require("./config.js");
+const destructive_js_1 = require("./destructive.js");
 const loader_js_1 = require("./loader.js");
 const mcp_js_1 = require("./mcp.js");
 const migrate_js_1 = require("./migrate.js");
@@ -1129,12 +1131,13 @@ async function cmdMigrate(args, config) {
         console.log(`    ${(0, ui_js_1.cyan)('status')}                   Show migration status`);
         (0, ui_js_1.newline)();
         console.log(`  ${(0, ui_js_1.bold)('Options:')}`);
-        console.log(`    ${(0, ui_js_1.cyan)('--auto')}             Auto-generate UP/DOWN SQL from schema diff`);
-        console.log(`    ${(0, ui_js_1.cyan)('--from-diff')}        Like --auto, but flags destructive statements in the file`);
+        console.log(`    ${(0, ui_js_1.cyan)('--auto')}             Auto-generate UP/DOWN SQL from schema diff (destructive flagged)`);
+        console.log(`    ${(0, ui_js_1.cyan)('--from-diff')}        Generate from schema diff, destructive statements flagged inline`);
         console.log(`    ${(0, ui_js_1.cyan)('--recipe <name>')}    Scaffold a sanctioned migration pattern`);
         console.log(`    ${(0, ui_js_1.cyan)('--step, -n')}         Number of migrations to apply/rollback`);
         console.log(`    ${(0, ui_js_1.cyan)('--dry-run')}          Show SQL without executing`);
-        console.log(`    ${(0, ui_js_1.cyan)('--allow-drift')}      Bypass checksum validation on ${(0, ui_js_1.cyan)('migrate up')} ${(0, ui_js_1.dim)('(advanced)')}`);
+        console.log(`    ${(0, ui_js_1.cyan)('--allow-destructive')} Run data-destroying statements without prompting`);
+        console.log(`    ${(0, ui_js_1.cyan)('--allow-drift')}      Bypass checksum validation on ${(0, ui_js_1.cyan)('up')} / ${(0, ui_js_1.cyan)('deploy')} ${(0, ui_js_1.dim)('(advanced)')}`);
         (0, ui_js_1.newline)();
         console.log(`  ${(0, ui_js_1.bold)('Recipes')} ${(0, ui_js_1.dim)('(--recipe):')}`);
         for (const [key, recipe] of Object.entries(migrate_js_1.MIGRATION_RECIPES)) {
@@ -1217,9 +1220,13 @@ async function cmdMigrateCreate(args, config) {
         }
         diffSpinner.succeed(`Found ${(0, ui_js_1.bold)(String(diff.statements.length))} change(s)`);
         (0, ui_js_1.newline)();
-        const upSQL = diff.statements.join('\n');
-        const downSQL = diff.reverseStatements.join('\n');
-        const file = (0, migrate_js_1.createMigration)(config.migrationsDir, name, { up: upSQL, down: downSQL });
+        // Route through buildDiffMigrationBody so any destructive statement (a lossy
+        // ALTER COLUMN ... TYPE, or a DROP COLUMN for a column removed from the
+        // schema) is flagged inline in the file, matching --from-diff. A
+        // destructive-only diff therefore produces a real, flagged migration instead
+        // of the old "already in sync" false negative.
+        const body = (0, migrate_js_1.buildDiffMigrationBody)(diff);
+        const file = (0, migrate_js_1.createMigration)(config.migrationsDir, name, { up: body.up, down: body.down });
         const relPath = (0, node_path_1.relative)(process.cwd(), file.path);
         (0, ui_js_1.success)(`Created auto-migration: ${(0, ui_js_1.bold)(file.filename)}`);
         (0, ui_js_1.newline)();
@@ -1247,6 +1254,27 @@ async function cmdMigrateCreate(args, config) {
             }
         }
         (0, ui_js_1.newline)();
+        // Loudly flag any destructive statements written into the file (same as
+        // --from-diff). They stay intact so `migrate up` still refuses them by
+        // default, but the operator must know they are there before running.
+        const destructiveCount = body.destructiveUp.length + body.destructiveDown.length;
+        if (destructiveCount > 0) {
+            (0, ui_js_1.warn)(`This migration contains ${(0, ui_js_1.bold)(String(destructiveCount))} DESTRUCTIVE statement(s), flagged in the file.`);
+            for (const h of body.destructiveUp) {
+                console.log(`    ${(0, ui_js_1.red)(ui_js_1.symbols.warning)} ${(0, ui_js_1.dim)('UP')}   [${h.kind}] ${h.target}`);
+            }
+            for (const h of body.destructiveDown) {
+                console.log(`    ${(0, ui_js_1.red)(ui_js_1.symbols.warning)} ${(0, ui_js_1.dim)('DOWN')} [${h.kind}] ${h.target}`);
+            }
+            (0, ui_js_1.newline)();
+            console.log(`  ${(0, ui_js_1.dim)('`migrate up` refuses destructive statements by default: confirm interactively or pass')} ${(0, ui_js_1.cyan)('--allow-destructive')}${(0, ui_js_1.dim)('.')}`);
+            (0, ui_js_1.newline)();
+        }
+        if (diff.warnings && diff.warnings.length > 0) {
+            for (const w of diff.warnings)
+                (0, ui_js_1.warn)(w);
+            (0, ui_js_1.newline)();
+        }
         console.log(`  ${(0, ui_js_1.dim)('Review the migration, then run:')}`);
         console.log(`  ${(0, ui_js_1.cyan)('npx turbine migrate up')}`);
         (0, ui_js_1.newline)();
@@ -1417,6 +1445,7 @@ async function cmdMigrateUp(args, config) {
             console.log(`    ${(0, ui_js_1.green)(ui_js_1.symbols.check)} ${file.filename}`);
         }
     }
+    warnOutOfOrder(result.outOfOrder);
     if (result.errors.length > 0) {
         spinner.fail('Migration failed');
         for (const { file, error: msg } of result.errors) {
@@ -1428,58 +1457,101 @@ async function cmdMigrateUp(args, config) {
     }
     (0, ui_js_1.newline)();
 }
-function buildMigrateDeployOptions(_args) {
+/** Print a one-line warning for each migration applied out of timestamp order. */
+function warnOutOfOrder(outOfOrder) {
+    if (outOfOrder.length === 0)
+        return;
+    (0, ui_js_1.newline)();
+    for (const o of outOfOrder) {
+        (0, ui_js_1.warn)(`Applied ${(0, ui_js_1.bold)(o.applied)} out of order (older than already-applied ${(0, ui_js_1.bold)(o.newestPrior)}).`);
+    }
+}
+function buildMigrateDeployOptions(args) {
     return {
-        allowDrift: false,
+        allowDrift: args.allowDrift === true,
         allowDestructive: true,
         step: undefined,
     };
 }
+/**
+ * Print the itemized, classified destructive-statement report as a NOTICE.
+ * `deploy` proceeds by design (the gate ran at author time), but it must not run
+ * data-destroying SQL in total silence; the notice ends that zero-ceremony hole.
+ */
+function printDestructiveNotice(offenders) {
+    (0, ui_js_1.warn)('NOTICE: this deploy runs DESTRUCTIVE statement(s):');
+    for (const o of offenders) {
+        console.log(`    ${(0, ui_js_1.red)(ui_js_1.symbols.warning)} ${o.file}`);
+        for (const h of o.hits) {
+            console.log(`      ${(0, ui_js_1.dim)('-')} [${h.kind}] ${h.target} ${(0, ui_js_1.dim)(destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind])}`);
+        }
+    }
+    (0, ui_js_1.newline)();
+}
 async function cmdMigrateDeploy(args, config) {
     (0, ui_js_1.banner)();
     const url = requireUrl(config);
     (0, ui_js_1.label)('Database', (0, ui_js_1.redactUrl)(url));
     (0, ui_js_1.label)('Migrations', config.migrationsDir);
     (0, ui_js_1.newline)();
-    if (args.dryRun) {
-        const spinner = new ui_js_1.Spinner('Checking pending migrations').start();
-        const plan = await (0, migrate_js_1.inspectMigrationDeploy)(url, config.migrationsDir);
-        if (plan.mismatches.length > 0) {
-            spinner.fail('Deploy blocked by migration drift');
-            for (const mismatch of plan.mismatches) {
-                const reason = mismatch.type === 'missing' ? 'deleted from disk' : 'modified on disk';
-                console.log(`    ${(0, ui_js_1.red)(ui_js_1.symbols.cross)} ${mismatch.name}.sql ${(0, ui_js_1.dim)(`(${reason})`)}`);
+    const spinner = new ui_js_1.Spinner('Checking pending migrations').start();
+    const plan = await (0, migrate_js_1.inspectMigrationDeploy)(url, config.migrationsDir);
+    spinner.stop();
+    // Drift handling: honor --allow-drift exactly like `up`. Without it, block;
+    // with it, warn loudly and proceed.
+    if (plan.mismatches.length > 0) {
+        if (!args.allowDrift) {
+            (0, ui_js_1.error)('Deploy blocked by migration drift');
+            (0, ui_js_1.newline)();
+            for (const line of (0, migrate_js_1.formatChecksumMismatchError)(plan.mismatches).split('\n')) {
+                console.log(`  ${line.replace('[turbine] ', '')}`);
             }
             (0, ui_js_1.newline)();
             process.exit(1);
         }
+        (0, ui_js_1.warn)('--allow-drift is set: checksum validation is DISABLED for this deploy.');
+        console.log(`  ${(0, ui_js_1.dim)('Applied migrations may have been modified or deleted on disk.')}`);
+        (0, ui_js_1.newline)();
+    }
+    if (args.dryRun) {
         if (plan.pending.length === 0) {
-            spinner.succeed('No pending migrations');
+            (0, ui_js_1.info)('No pending migrations');
             (0, ui_js_1.newline)();
             return;
         }
-        spinner.succeed(`${(0, ui_js_1.bold)(String(plan.pending.length))} pending migration(s)`);
+        (0, ui_js_1.info)(`${(0, ui_js_1.bold)(String(plan.pending.length))} pending migration(s)`);
         for (const file of plan.pending) {
             console.log(`    ${(0, ui_js_1.yellow)(ui_js_1.symbols.dot)} ${file.filename}`);
         }
+        // Surface destructive statements even in a dry run so CI can see them.
+        const destructive = (0, migrate_js_1.collectUpDestructive)(plan.pending);
+        if (destructive.length > 0) {
+            (0, ui_js_1.newline)();
+            printDestructiveNotice(destructive);
+        }
         (0, ui_js_1.newline)();
         return;
     }
-    const spinner = new ui_js_1.Spinner('Deploying migrations').start();
-    const result = await (0, migrate_js_1.migrateDeploy)(url, config.migrationsDir);
+    // Destructive notice before applying (deploy still proceeds by design).
+    const destructive = (0, migrate_js_1.collectUpDestructive)(plan.pending);
+    if (destructive.length > 0)
+        printDestructiveNotice(destructive);
+    const runSpinner = new ui_js_1.Spinner('Deploying migrations').start();
+    const result = await (0, migrate_js_1.migrateDeploy)(url, config.migrationsDir, { allowDrift: args.allowDrift });
     if (result.applied.length === 0 && result.errors.length === 0) {
-        spinner.succeed('0 applied — all migrations are up to date');
+        runSpinner.succeed('0 applied, all migrations are up to date');
         (0, ui_js_1.newline)();
         return;
     }
     if (result.applied.length > 0) {
-        spinner.succeed(`${(0, ui_js_1.bold)(String(result.applied.length))} applied`);
+        runSpinner.succeed(`${(0, ui_js_1.bold)(String(result.applied.length))} applied`);
         for (const file of result.applied) {
             console.log(`    ${(0, ui_js_1.green)(ui_js_1.symbols.check)} ${file.filename}`);
         }
     }
+    warnOutOfOrder(result.outOfOrder);
     if (result.errors.length > 0) {
-        spinner.fail('Deploy failed');
+        runSpinner.fail('Deploy failed');
         for (const { file, error: msg } of result.errors) {
             console.log(`    ${(0, ui_js_1.red)(ui_js_1.symbols.cross)} ${file.filename}`);
             console.log(`      ${(0, ui_js_1.dim)(msg)}`);
@@ -1596,8 +1668,17 @@ async function cmdMigrateStatus(_args, config) {
     const pendingCount = statuses.filter((s) => !s.applied).length;
     (0, ui_js_1.info)(`${(0, ui_js_1.bold)(String(appliedCount))} applied, ${pendingCount > 0 ? (0, ui_js_1.yellow)((0, ui_js_1.bold)(String(pendingCount))) : (0, ui_js_1.bold)(String(pendingCount))} pending`);
     (0, ui_js_1.newline)();
-    // Check for checksum mismatches
-    const driftCount = statuses.filter((s) => s.checksumValid === false).length;
+    // Applied migrations whose file was deleted from disk (distinct from an
+    // on-disk edit). Counted in "applied" above; surfaced with their own banner.
+    const missingCount = statuses.filter((s) => s.missingFile).length;
+    if (missingCount > 0) {
+        (0, ui_js_1.warn)(`${(0, ui_js_1.bold)(String(missingCount))} applied migration(s) are missing from disk!`);
+        console.log(`  ${(0, ui_js_1.dim)('The history table records them, but their .sql file is gone.')}`);
+        console.log(`  ${(0, ui_js_1.dim)('Restore the file(s) before running')} ${(0, ui_js_1.cyan)('migrate up')} ${(0, ui_js_1.dim)('or')} ${(0, ui_js_1.cyan)('migrate deploy')}${(0, ui_js_1.dim)('.')}`);
+        (0, ui_js_1.newline)();
+    }
+    // Check for checksum mismatches (on-disk edits only; missing files above).
+    const driftCount = statuses.filter((s) => s.checksumValid === false && !s.missingFile).length;
     if (driftCount > 0) {
         (0, ui_js_1.warn)(`${(0, ui_js_1.bold)(String(driftCount))} migration(s) have been modified after application!`);
         console.log(`  ${(0, ui_js_1.dim)('Applied migrations should be immutable. Modifying them can cause drift.')}`);
@@ -1607,7 +1688,10 @@ async function cmdMigrateStatus(_args, config) {
     const headers = ['Status', 'Migration', 'Applied at'];
     const rows = statuses.map((s) => {
         let status;
-        if (s.applied && s.checksumValid === false) {
+        if (s.missingFile) {
+            status = (0, ui_js_1.red)(`${ui_js_1.symbols.warning} Missing file`);
+        }
+        else if (s.applied && s.checksumValid === false) {
             status = (0, ui_js_1.red)(`${ui_js_1.symbols.warning} Drifted`);
         }
         else if (s.applied) {
@@ -1656,21 +1740,40 @@ async function runSeedPlan(plan, config) {
             if (!(0, loader_js_1.canResolveTsx)()) {
                 throw new Error('TypeScript seed files require tsx — install tsx or use seed.js/seed.sql.');
             }
+            // The seed runs in a child process, so we cannot observe its callback
+            // directly. Hand it a sentinel path: `defineSeed`'s runner writes the file
+            // only after a callback executes to completion. If the child exits cleanly
+            // but the sentinel never appears, the seed module loaded without running
+            // anything: a silent no-op we must report as a failure, not success.
+            const sentinelDir = (0, node_fs_1.mkdtempSync)((0, node_path_1.join)((0, node_os_1.tmpdir)(), 'turbine-seed-'));
+            const sentinel = (0, node_path_1.join)(sentinelDir, 'ran');
             const { execFileSync } = await Promise.resolve().then(() => __importStar(require('node:child_process')));
-            execFileSync(plan.command, plan.args, {
-                stdio: 'inherit',
-                env: {
-                    ...process.env,
-                    DATABASE_URL: config.url || process.env.DATABASE_URL,
-                },
-            });
+            try {
+                execFileSync(plan.command, plan.args, {
+                    stdio: 'inherit',
+                    env: {
+                        ...process.env,
+                        DATABASE_URL: config.url || process.env.DATABASE_URL,
+                        TURBINE_SEED_SENTINEL: sentinel,
+                    },
+                });
+                if (!(0, node_fs_1.existsSync)(sentinel)) {
+                    throw new Error('The seed file completed without running a seed callback. ' +
+                        'Make sure it calls defineSeed(async (db) => { ... }) at the top level.');
+                }
+            }
+            finally {
+                (0, node_fs_1.rmSync)(sentinelDir, { recursive: true, force: true });
+            }
             return;
         }
         if (plan.kind === 'js') {
             const mod = await Promise.resolve(`${(0, node_url_1.pathToFileURL)(plan.file).href}`).then(s => __importStar(require(s)));
-            if (typeof mod.default === 'function') {
-                await mod.default();
+            if (typeof mod.default !== 'function') {
+                throw new Error('The seed file has no callable default export. ' +
+                    'Export your seed with `export default defineSeed(async (db) => { ... })`.');
             }
+            await mod.default();
             return;
         }
         const url = requireUrl(config);
@@ -2263,8 +2366,18 @@ function showHelp() {
     (0, ui_js_1.newline)();
     console.log(`  ${(0, ui_js_1.bold)('Migrate options:')}`);
     console.log(`    ${(0, ui_js_1.cyan)('--auto')}               Auto-generate UP/DOWN SQL from schema diff ${(0, ui_js_1.dim)('(create)')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--from-diff')}          Generate from schema diff, destructive statements flagged ${(0, ui_js_1.dim)('(create)')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--recipe')} ${(0, ui_js_1.dim)('<name>')}       Scaffold a named migration recipe, e.g. backfill ${(0, ui_js_1.dim)('(create)')}`);
     console.log(`    ${(0, ui_js_1.cyan)('--step, -n')} ${(0, ui_js_1.dim)('<N>')}       Number of migrations to apply/rollback`);
-    console.log(`    ${(0, ui_js_1.cyan)('--allow-drift')}        Bypass checksum validation on ${(0, ui_js_1.cyan)('migrate up')} ${(0, ui_js_1.dim)('(advanced)')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--allow-destructive')}  Run data-destroying statements without prompting ${(0, ui_js_1.dim)('(up/down/push)')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--allow-drift')}        Bypass checksum validation on ${(0, ui_js_1.cyan)('migrate up')} / ${(0, ui_js_1.cyan)('deploy')} ${(0, ui_js_1.dim)('(advanced)')}`);
+    (0, ui_js_1.newline)();
+    console.log(`  ${(0, ui_js_1.bold)('Init options:')}`);
+    console.log(`    ${(0, ui_js_1.cyan)('--yes, -y')}            Accept every step's default (non-interactive)`);
+    console.log(`    ${(0, ui_js_1.cyan)('--skip-schema')}        Don't scaffold the schema file`);
+    console.log(`    ${(0, ui_js_1.cyan)('--skip-seed')}          Don't scaffold or run the seed file`);
+    console.log(`    ${(0, ui_js_1.cyan)('--skip-push')}          Don't offer to push the schema to the database`);
+    console.log(`    ${(0, ui_js_1.cyan)('--skip-generate')}      Don't offer to generate the typed client`);
     (0, ui_js_1.newline)();
     console.log(`  ${(0, ui_js_1.bold)('Studio / observe options:')}`);
     console.log(`    ${(0, ui_js_1.cyan)('--port')} ${(0, ui_js_1.dim)('<n>')}           HTTP port ${(0, ui_js_1.dim)('(default: 4983 studio, 4984 observe)')}`);

package/dist/cjs/cli/migrate.js

@@ -17,6 +17,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MIGRATION_RECIPES = void 0;
+exports.migrationTimestamp = migrationTimestamp;
+exports.collectUpDestructive = collectUpDestructive;
 exports.parseMigrationFilename = parseMigrationFilename;
 exports.sanitizeName = sanitizeName;
 exports.formatTimestamp = formatTimestamp;
@@ -27,6 +29,7 @@ exports.parseMigrationSQL = parseMigrationSQL;
 exports.buildDiffMigrationBody = buildDiffMigrationBody;
 exports.createMigration = createMigration;
 exports.deriveLockId = deriveLockId;
+exports.formatChecksumMismatchError = formatChecksumMismatchError;
 exports.planMigrationDeploy = planMigrationDeploy;
 exports.inspectMigrationDeploy = inspectMigrationDeploy;
 exports.migrateUp = migrateUp;
@@ -41,6 +44,24 @@ const index_js_1 = require("../adapters/index.js");
 const dialect_js_1 = require("../dialect.js");
 const errors_js_1 = require("../errors.js");
 const destructive_js_1 = require("./destructive.js");
+/** Extract the YYYYMMDDHHMMSS timestamp prefix from a migration name, or null. */
+function migrationTimestamp(name) {
+    const m = name.match(/^(\d{14})(?:_|$)/);
+    return m ? m[1] : null;
+}
+/** Scan a set of migration files' UP sections for data-destroying statements. */
+function collectUpDestructive(files) {
+    const offenders = [];
+    for (const file of files) {
+        const { up } = parseMigrationSQL(file.path);
+        if (!up)
+            continue;
+        const hits = (0, destructive_js_1.scanDestructiveSql)(up);
+        if (hits.length > 0)
+            offenders.push({ file: file.filename, hits });
+    }
+    return offenders;
+}
 // ---------------------------------------------------------------------------
 // Tracking table management
 // ---------------------------------------------------------------------------
@@ -472,7 +493,14 @@ function formatChecksumMismatchError(mismatches) {
     lines.push('');
     lines.push('Fix one of these:');
     lines.push('  1. Restore the file(s) to their original content, OR');
-    lines.push('  2. Roll back the affected migrations with `npx turbine migrate down`, OR');
+    if (modified.length > 0) {
+        // `migrate down` needs the file on disk to read its DOWN section, so it is
+        // only a remedy for MODIFIED files, never for deleted ones.
+        lines.push('  2. Roll back the affected migrations with `npx turbine migrate down` (modified files only), OR');
+    }
+    if (missing.length > 0) {
+        lines.push('     (deleted files cannot be rolled back: restore the file, then run `migrate down` if needed), OR');
+    }
     lines.push('  3. Pass `--allow-drift` to bypass this check (advanced — make sure you know what you are doing).');
     return lines.join('\n');
 }
@@ -581,42 +609,43 @@ async function migrateUp(connectionString, migrationsDir, options) {
             }
             const applied = await getAppliedMigrations(client, dialect);
             const appliedNames = new Set(applied.map((m) => m.name));
+            // Newest already-applied timestamp. Anything applied below this line is
+            // going in out of order (an older migration created/applied after a newer
+            // one). Used to surface a warning; never blocks.
+            const newestPrior = applied
+                .map((m) => ({ ts: migrationTimestamp(m.name), name: m.name }))
+                .filter((m) => m.ts !== null)
+                .sort((a, b) => (a.ts < b.ts ? 1 : a.ts > b.ts ? -1 : 0))[0];
             const allFiles = listMigrationFiles(migrationsDir);
             let pending = allFiles.filter((f) => !appliedNames.has(f.name));
             if (options?.step != null && options.step > 0) {
                 pending = pending.slice(0, options.step);
             }
+            // Destructive statements in the pending batch, computed once. Returned in
+            // the result regardless of the gate so `deploy` can print a notice even
+            // though it proceeds by design.
+            const destructive = collectUpDestructive(pending);
             // Data-loss gate: refuse to run pending migrations containing destructive
             // statements unless the caller has EXPLICITLY opted in. The CLI layers an
             // interactive typed confirmation on top of this; programmatic callers must
             // pass `allowDestructive: true`. Safe-by-default is the whole point — a
             // DROP TABLE should never run just because a file exists.
-            if (!options?.allowDestructive) {
-                const offenders = [];
-                for (const file of pending) {
-                    const { up } = parseMigrationSQL(file.path);
-                    if (!up)
-                        continue;
-                    const hits = (0, destructive_js_1.scanDestructiveSql)(up);
-                    if (hits.length > 0)
-                        offenders.push({ file: file.filename, hits });
-                }
-                if (offenders.length > 0) {
-                    const lines = ['[turbine] Refusing to apply migrations containing DESTRUCTIVE statements:', ''];
-                    for (const o of offenders) {
-                        lines.push(`  ${o.file}`);
-                        for (const h of o.hits) {
-                            lines.push(`    - [${h.kind}] ${h.target} — ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
-                        }
+            if (!options?.allowDestructive && destructive.length > 0) {
+                const lines = ['[turbine] Refusing to apply migrations containing DESTRUCTIVE statements:', ''];
+                for (const o of destructive) {
+                    lines.push(`  ${o.file}`);
+                    for (const h of o.hits) {
+                        lines.push(`    - [${h.kind}] ${h.target}: ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
                     }
-                    lines.push('');
-                    lines.push('Review the statements above. To proceed: run `npx turbine migrate up` interactively');
-                    lines.push('and confirm, pass --allow-destructive, or set allowDestructive: true programmatically.');
-                    throw new errors_js_1.MigrationError(lines.join('\n'));
                 }
+                lines.push('');
+                lines.push('Review the statements above. To proceed: run `npx turbine migrate up` interactively');
+                lines.push('and confirm, pass --allow-destructive, or set allowDestructive: true programmatically.');
+                throw new errors_js_1.MigrationError(lines.join('\n'));
             }
             const results = [];
             const errors = [];
+            const outOfOrder = [];
             for (const file of pending) {
                 const { up } = parseMigrationSQL(file.path);
                 if (!up) {
@@ -631,6 +660,11 @@ async function migrateUp(connectionString, migrationsDir, options) {
                     await client.query(dialect.buildMigrationInsertApplied(quotedTrackingTable(dialect)), [file.name, hash]);
                     await client.query('COMMIT');
                     results.push(file);
+                    // Flag an out-of-order apply: this file's timestamp is older than a
+                    // migration that was already applied before this run started.
+                    if (newestPrior && file.timestamp && file.timestamp < newestPrior.ts) {
+                        outOfOrder.push({ applied: file.filename, newestPrior: `${newestPrior.name}.sql` });
+                    }
                 }
                 catch (err) {
                     await client.query('ROLLBACK');
@@ -640,7 +674,7 @@ async function migrateUp(connectionString, migrationsDir, options) {
                     break;
                 }
             }
-            return { applied: results, errors };
+            return { applied: results, errors, destructive, outOfOrder };
         }
         finally {
             await releaseLock(client, lockId, adapter);
@@ -656,7 +690,9 @@ async function migrateUp(connectionString, migrationsDir, options) {
  */
 async function migrateDeploy(connectionString, migrationsDir, options) {
     return migrateUp(connectionString, migrationsDir, {
-        allowDrift: false,
+        // Honor `--allow-drift` on deploy exactly as `up` does: deploy's own drift
+        // error recommends this flag, so it must actually bypass the checksum block.
+        allowDrift: options?.allowDrift === true,
         allowDestructive: true,
         adapter: options?.adapter,
         dialect: options?.dialect,
@@ -715,7 +751,7 @@ async function migrateDown(connectionString, migrationsDir, options) {
                     for (const o of offenders) {
                         lines.push(`  ${o.file}`);
                         for (const h of o.hits) {
-                            lines.push(`    - [${h.kind}] ${h.target} — ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
+                            lines.push(`    - [${h.kind}] ${h.target}: ${destructive_js_1.DESTRUCTIVE_KIND_LABEL[h.kind]}`);
                         }
                     }
                     lines.push('');
@@ -777,7 +813,8 @@ async function migrateStatus(connectionString, migrationsDir, options) {
         const applied = await getAppliedMigrations(client, dialect);
         const appliedMap = new Map(applied.map((m) => [m.name, m]));
         const allFiles = listMigrationFiles(migrationsDir);
-        return allFiles.map((file) => {
+        const fileNames = new Set(allFiles.map((f) => f.name));
+        const fromFiles = allFiles.map((file) => {
             const record = appliedMap.get(file.name);
             let checksumValid;
             if (record) {
@@ -792,6 +829,25 @@ async function migrateStatus(connectionString, migrationsDir, options) {
                 checksumValid,
             };
         });
+        // Applied migrations whose file was deleted from disk. up/deploy already
+        // catch this as drift; status must not silently drop them from history.
+        const missing = applied
+            .filter((m) => !fileNames.has(m.name))
+            .map((m) => ({
+            file: parseMigrationFilename(`${m.name}.sql`) ?? {
+                filename: `${m.name}.sql`,
+                path: '',
+                name: m.name,
+                timestamp: '',
+            },
+            applied: true,
+            appliedAt: m.applied_at,
+            checksumValid: false,
+            missingFile: true,
+        }));
+        // Keep the overall list in timestamp order so a deleted entry appears where
+        // it belongs in history, not tacked on at the end.
+        return [...fromFiles, ...missing].sort((a, b) => a.file.name < b.file.name ? -1 : a.file.name > b.file.name ? 1 : 0);
     }
     finally {
         await client.end();

package/dist/cjs/schema-sql.js

@@ -839,14 +839,23 @@ async function schemaDiff(schema, connectionString) {
                     }
                 }
             }
-            // Check for columns in DB that are not in schema
+            // Check for columns in DB that are not in schema.
+            // The DROP COLUMN statement stays IN `result.statements` so the destructive
+            // gate (findDestructivePushStatements / scanDestructiveSql, and the migrate
+            // up gate) can see it and refuse by default. Safety is enforced by that
+            // gate, not by hiding the statement: withholding it here previously made
+            // `push` report "already in sync" for a destructive-only diff and print a
+            // false "Altered" for a mixed one, since the 0.36 guard never received it.
+            // No reverse is emitted (a dropped column and its data cannot be recreated
+            // automatically), so diff-generated migrations fall back to the documented
+            // irreversible-DOWN placeholder for this change.
             for (const dbColName of Object.keys(dbCols)) {
                 const hasField = Object.entries(tableDef.columns).some(([fieldName]) => (0, schema_js_1.camelToSnake)(fieldName) === dbColName);
                 if (!hasField) {
                     const sql = `ALTER TABLE ${dialect.quoteIdentifier(tableName)} DROP COLUMN ${dialect.quoteIdentifier(dbColName)};`;
-                    const reverseSql = `-- Cannot auto-reverse DROP COLUMN for "${dbColName}" — add it back manually`;
+                    const reverseSql = `-- Cannot auto-reverse DROP COLUMN for "${dbColName}"; add it back manually`;
                     alterDef.columns.push({ column: dbColName, action: 'drop', sql, reverseSql });
-                    // Don't auto-add drops to statements for safety — user must opt in
+                    result.statements.push(sql);
                 }
             }
             if (alterDef.columns.length > 0) {