turbine-orm 0.48.0 → 0.49.0

package/dist/cjs/query/batched-loader.js

@@ -48,6 +48,7 @@
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.defaultProjectionFields = defaultProjectionFields;
 exports.includeKeysForBatching = includeKeysForBatching;
 exports.stripFields = stripFields;
 exports.neededParentKeyFields = neededParentKeyFields;
@@ -69,6 +70,29 @@ const utils_js_1 = require("./utils.js");
 const MAX_RELATION_KEYS = 32_000;
 /** Nesting cap — parity with the join strategy's depth-10 guard. */
 const MAX_DEPTH = 10;
+/**
+ * The default projection of `meta` expressed in FIELD names: which fields the
+ * default (no `select`/`omit`) projection hides, and which it returns. Today the
+ * only hidden class is PII-tagged columns, and only when `includePii` is off.
+ *
+ * Returns `undefined` for the overwhelmingly common untagged case, so callers
+ * keep the `select: undefined, omit: undefined` fast path and the emitted SQL
+ * stays byte-identical.
+ */
+function defaultProjectionFields(meta, includePii) {
+    if (includePii)
+        return undefined;
+    const hidden = new Set();
+    const visible = [];
+    for (const col of meta.columns) {
+        const field = meta.reverseColumnMap[col.name] ?? col.name;
+        if (col.pii)
+            hidden.add(field);
+        else
+            visible.push(field);
+    }
+    return hidden.size === 0 ? undefined : { hidden, visible };
+}
 /**
  * Adjust a `select`/`omit` pair so that `fields` are guaranteed present in the
  * query result, returning the adjusted projection plus the list of fields that
@@ -78,7 +102,19 @@ const MAX_DEPTH = 10;
  * keys) so a caller's `select: { title: true }` on a relation still stitches even
  * though the FK was not requested — and the FK never appears in the output.
  */
-function includeKeysForBatching(select, omit, fields) {
+function includeKeysForBatching(select, omit, fields, 
+/**
+ * The default projection for this table when it is NOT `select`/`omit`-driven:
+ * `hidden` are fields the default projection leaves out (today: PII-tagged
+ * columns without `includePii`), `visible` is everything it does return.
+ *
+ * Without this, a correlation key that is itself PII-tagged is absent from
+ * every row, the loader sees no keys, and it silently hands back empty
+ * relation arrays. Passing it turns that case into an explicit select that
+ * re-adds only the key, which is then stripped like any other stitch-only
+ * field, so no PII value ever reaches the caller.
+ */
+defaultProjection) {
     const unique = [...new Set(fields)];
     if (select) {
         const next = { ...select };
@@ -102,7 +138,19 @@ function includeKeysForBatching(select, omit, fields) {
         }
         return { select, omit: next, strip };
     }
-    // Neither select nor omit — every column is already present; nothing to strip.
+    // Neither select nor omit. Every column the DEFAULT projection returns is
+    // already present, so normally there is nothing to strip; the exception is a
+    // key the default projection hides (a PII-tagged correlation column), which
+    // has to be asked for explicitly.
+    const hiddenKeys = defaultProjection ? unique.filter((f) => defaultProjection.hidden.has(f)) : [];
+    if (hiddenKeys.length > 0 && defaultProjection) {
+        const explicit = {};
+        for (const f of defaultProjection.visible)
+            explicit[f] = true;
+        for (const f of hiddenKeys)
+            explicit[f] = true;
+        return { select: explicit, omit: undefined, strip: hiddenKeys };
+    }
     return { select, omit, strip: [] };
 }
 /** Delete stitch-only key fields from each row (no-op when `fields` is empty). */
@@ -280,7 +328,7 @@ async function loadToOneOrMany(ctx, parents, rel, relName, options, timeout, dep
     }
     // The follow-up must project the child correlation key even if the caller's
     // select/omit excluded it; strip it back off afterwards so the shape matches join.
-    const proj = includeKeysForBatching(options.select, options.omit, [childKeyField]);
+    const proj = includeKeysForBatching(options.select, options.omit, [childKeyField], defaultProjectionFields(targetMeta, ctx.includePii));
     const child = ctx.makeChild(rel.to);
     const chunks = [];
     for (let i = 0; i < keys.length; i += MAX_RELATION_KEYS)
@@ -382,7 +430,7 @@ async function loadManyToMany(ctx, parents, rel, relName, options, timeout, dept
         }
     }
     // (2) Target rows by PK, honouring the relation's own where/select/omit/orderBy.
-    const proj = includeKeysForBatching(options.select, options.omit, [targetPkField]);
+    const proj = includeKeysForBatching(options.select, options.omit, [targetPkField], defaultProjectionFields(targetMeta, ctx.includePii));
     const child = ctx.makeChild(rel.to);
     const targetVals = [...targetValSet];
     const tChunks = [];
@@ -535,9 +583,25 @@ async function loadOneCount(ctx, parents, rel) {
 // ---------------------------------------------------------------------------
 // Small helpers
 // ---------------------------------------------------------------------------
-/** Merge the batched correlation predicate (`key IN chunk`) into the relation's own where. */
+/**
+ * AND the batched correlation predicate (`key IN chunk`) onto the relation's own
+ * `where`, matching the join strategy, which appends the correlation with
+ * ` AND <extra>` and so never lets one predicate replace the other.
+ *
+ * A flat spread is kept for the overwhelmingly common case where the caller's
+ * `where` does not name the correlation field, so the emitted SQL is unchanged
+ * there. When it DOES name it (e.g. `with: { posts: { where: { userId: 1 } } }`,
+ * or a belongsTo `where` on the child's PK), a bare spread would let the chunk
+ * predicate silently overwrite the caller's filter and return rows the join
+ * strategy excludes; the two are combined with `AND` instead so both apply.
+ */
 function mergeChildWhere(where, keyField, chunk) {
-    return { ...(where ?? {}), [keyField]: { in: chunk } };
+    const correlation = { [keyField]: { in: chunk } };
+    if (!where)
+        return correlation;
+    if (Object.hasOwn(where, keyField))
+        return { AND: [where, correlation] };
+    return { ...where, ...correlation };
 }
 /** Distinct, non-null values of `field` across `rows`. */
 function uniqueKeys(rows, field) {

package/dist/cjs/query/builder.js

@@ -781,7 +781,7 @@ class QueryInterface {
         (0, batched_loader_js_1.rejectNestedPickOrder)(batchedWith);
         const skip = args.skipGlobalFilters;
         const needed = (0, batched_loader_js_1.neededParentKeyFields)(this.tableMeta, batchedWith);
-        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed);
+        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed, (0, batched_loader_js_1.defaultProjectionFields)(this.tableMeta, args.includePii));
         const hasJoin = Object.keys(joinWith).length > 0;
         // Force the residual `with` onto the join plan so the base query never
         // re-enters this auto planning.
@@ -894,7 +894,7 @@ class QueryInterface {
      */
     prepareBatchedBase(args, withClause) {
         const needed = (0, batched_loader_js_1.neededParentKeyFields)(this.tableMeta, withClause);
-        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed);
+        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed, (0, batched_loader_js_1.defaultProjectionFields)(this.tableMeta, args.includePii));
         const baseArgs = {
             ...args,
             with: undefined,
@@ -1200,7 +1200,7 @@ class QueryInterface {
         // Same scope-rule parity as runFindManyBatched: reject before querying.
         (0, batched_loader_js_1.rejectNestedPickOrder)(withClause);
         const needed = (0, batched_loader_js_1.neededParentKeyFields)(this.tableMeta, withClause);
-        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed);
+        const proj = (0, batched_loader_js_1.includeKeysForBatching)(args.select, args.omit, needed, (0, batched_loader_js_1.defaultProjectionFields)(this.tableMeta, args.includePii));
         const baseArgs = { ...args, with: undefined, select: proj.select, omit: proj.omit };
         const deferred = this.buildFindUnique(baseArgs);
         const result = await this.queryWithTimeout(deferred.sql, deferred.params, args.timeout, deferred.preparedName);

package/dist/cjs/query/relations.js

@@ -551,8 +551,18 @@ function buildRelationOrderBy(qi, relName, value, alias, params, ctx, lateralSin
     const parentRef = ctx?.parentRef ?? qi.table;
     const relDef = ownerMeta.relations[relName];
     if (!relDef) {
-        throw new errors_js_1.RelationError(`[turbine] Unknown relation "${relName}" in orderBy on table "${ownerTable}". ` +
-            `Available: ${Object.keys(ownerMeta.relations).join(', ')}`);
+        // A table with no relations at all would otherwise render a dangling
+        // "Available: " and read as a broken message; and the most likely cause of
+        // landing here on such a table is an orderBy VALUE of the wrong shape on a
+        // scalar column, which deserves to be named rather than reported as a
+        // missing relation.
+        const known = Object.keys(ownerMeta.relations);
+        const isColumn = Object.hasOwn(ownerMeta.columnMap, relName) || ownerMeta.allColumns.includes(relName);
+        throw new errors_js_1.RelationError(isColumn
+            ? `[turbine] orderBy on "${ownerTable}.${relName}" got a relation-shaped value, but "${relName}" is a ` +
+                `column. Order a column with 'asc' / 'desc' (or { sort, nulls }); the object form is for relations.`
+            : `[turbine] Unknown relation "${relName}" in orderBy on table "${ownerTable}". ` +
+                (known.length > 0 ? `Available: ${known.join(', ')}` : `"${ownerTable}" has no relations.`));
     }
     // Pick-row ordering (`{ pick, by }`): order by a value from ONE related
     // row: a correlated scalar subquery with its own ORDER BY … LIMIT 1.

package/dist/cjs/query/where.js

@@ -56,6 +56,8 @@ exports.fingerprintAliasWhere = fingerprintAliasWhere;
 exports.resolveColumnRef = resolveColumnRef;
 exports.columnRefSql = columnRefSql;
 exports.buildOperatorClauses = buildOperatorClauses;
+exports.requireFullTextSearch = requireFullTextSearch;
+exports.requireArrayColumns = requireArrayColumns;
 exports.vectorOperator = vectorOperator;
 exports.pushVectorParam = pushVectorParam;
 exports.normalizeRelationFilter = normalizeRelationFilter;
@@ -208,6 +210,9 @@ function collectScalarParams(qi, key, value, params) {
             collectArrayFilterParams(qi, value, params);
             return;
         case 'textsearch':
+            // Same gate the build path applies, so the collect path never diverges
+            // (it throws before any param is pushed).
+            requireFullTextSearch(qi);
             params.push(value.search);
             return;
         case 'operator':
@@ -344,7 +349,8 @@ function collectJsonFilterParams(qi, filter, params, column) {
     }
 }
 /** Collect params from array filter. Mirrors buildArrayFilterClauses. */
-function collectArrayFilterParams(_qi, filter, params) {
+function collectArrayFilterParams(qi, filter, params) {
+    requireArrayColumns(qi);
     if (filter.has !== undefined)
         params.push(filter.has);
     if (filter.hasEvery !== undefined)
@@ -1221,6 +1227,33 @@ function buildOperatorClauses(qi, column, op, params, refCtx) {
     }
     return clauses;
 }
+/**
+ * Gate the full-text `search` filter on {@link Dialect.supportsFullTextSearch}.
+ * The clause it guards is `to_tsvector(...) @@ to_tsquery(...)`, which only
+ * PostgreSQL parses, so every other engine gets a typed
+ * {@link UnsupportedFeatureError} (E017) instead of a raw driver syntax error.
+ * Called from BOTH the build and the param-collect side (mirroring the vector
+ * gate) so the two paths can never diverge.
+ */
+function requireFullTextSearch(qi) {
+    if (qi.dialect.supportsFullTextSearch)
+        return;
+    throw new errors_js_1.UnsupportedFeatureError('the full-text search filter (`search`)', qi.dialect.name, 'Full-text `search` compiles to PostgreSQL to_tsvector/to_tsquery. ' +
+        'Use `contains` (LIKE) on this engine, or run the query on PostgreSQL.');
+}
+/**
+ * Gate the array filter operators (`has` / `hasEvery` / `hasSome` / `isEmpty`)
+ * on {@link Dialect.supportsArrayColumns}. They compile to PostgreSQL array
+ * operators (`= ANY(col)`, `@>`, `&&`, `cardinality(col)`) over a native array
+ * column, which no other supported engine has. Called from BOTH the build and
+ * the param-collect side.
+ */
+function requireArrayColumns(qi) {
+    if (qi.dialect.supportsArrayColumns)
+        return;
+    throw new errors_js_1.UnsupportedFeatureError('the array column filter set (`has` / `hasEvery` / `hasSome` / `isEmpty`)', qi.dialect.name, 'Array filters compile to PostgreSQL array operators over a native array ' +
+        'column; this engine has no array column type.');
+}
 /**
  * Resolve a {@link VectorMetric} to its pgvector distance operator from a
  * fixed allow-list, validating the target column is actually a `vector`
@@ -1438,6 +1471,7 @@ function castJsonNumeric(qi, extract) {
  * Supports: has, hasEvery, hasSome, isEmpty.
  */
 function buildArrayFilterClauses(qi, column, filter, params, pgType) {
+    requireArrayColumns(qi);
     const clauses = [];
     const elementType = getArrayElementType(qi, pgType);
     if (filter.has !== undefined) {
@@ -1503,6 +1537,7 @@ function buildVectorFilterClauses(qi, field, rawColumn, filter, params) {
  * The config name is validated to prevent injection (only alphanumeric + underscore).
  */
 function buildTextSearchClause(qi, column, filter, params) {
+    requireFullTextSearch(qi);
     const config = filter.config ?? 'english';
     if (!(0, filters_js_1.validateTextSearchConfig)(config)) {
         throw new errors_js_1.ValidationError(`[turbine] Invalid text search config "${config}": only alphanumeric characters and underscores are allowed.`);

package/dist/cjs/sqlite.js

@@ -375,6 +375,11 @@ exports.sqliteDialect = {
     supportsReturning: true,
     supportsILike: false,
     supportsVector: false,
+    // FTS5 is a virtual-table feature with its own MATCH syntax, not the
+    // `to_tsvector @@ to_tsquery` shape Turbine's `search` filter emits.
+    supportsFullTextSearch: false,
+    // No array column type (a JSON column is not an array column).
+    supportsArrayColumns: false,
     supportsListenNotify: false,
     supportsRLS: false,
     supportsAdvisoryLock: false,

package/dist/cli/destructive.d.ts

@@ -10,12 +10,18 @@
  * Deliberately conservative in BOTH directions:
  *   - comments and string literals are stripped first, so `-- DROP TABLE foo`
  *     or `INSERT ... VALUES ('DROP TABLE x')` never false-positive;
- *   - anything that removes rows, columns, tables, or schemas — or rewrites a
- *     column's type (a potentially lossy cast) — is flagged. `DROP INDEX`,
+ *   - anything that removes rows, columns, tables, or schemas, or rewrites a
+ *     column's type (a potentially lossy cast), is flagged. `DROP INDEX`,
  *     `DROP CONSTRAINT`, and `DROP TRIGGER` are NOT flagged (recreatable
  *     structures; no row data lost).
+ *
+ * Row removal hides in more than a leading `DELETE`, so the scan also covers:
+ * the optional-`COLUMN` shorthand (`ALTER TABLE t DROP email`), data-modifying
+ * CTEs (`WITH d AS (DELETE ...) SELECT ...`), `MERGE ... THEN DELETE`, dynamic
+ * SQL inside a `DO`/function body, and an `UPDATE` whose only WHERE sits inside
+ * a subquery (which restricts nothing).
  */
-export type DestructiveKind = 'drop-table' | 'drop-schema' | 'drop-column' | 'truncate' | 'delete' | 'update-without-where' | 'alter-column-type';
+export type DestructiveKind = 'drop-table' | 'drop-schema' | 'drop-database' | 'drop-owned' | 'drop-matview' | 'drop-column' | 'truncate' | 'delete' | 'update-without-where' | 'alter-column-type' | 'merge-delete';
 export interface DestructiveStatement {
     /** The offending SQL statement (trimmed, possibly long — display truncated) */
     statement: string;

package/dist/cli/destructive.js

@@ -10,23 +10,40 @@
  * Deliberately conservative in BOTH directions:
  *   - comments and string literals are stripped first, so `-- DROP TABLE foo`
  *     or `INSERT ... VALUES ('DROP TABLE x')` never false-positive;
- *   - anything that removes rows, columns, tables, or schemas — or rewrites a
- *     column's type (a potentially lossy cast) — is flagged. `DROP INDEX`,
+ *   - anything that removes rows, columns, tables, or schemas, or rewrites a
+ *     column's type (a potentially lossy cast), is flagged. `DROP INDEX`,
  *     `DROP CONSTRAINT`, and `DROP TRIGGER` are NOT flagged (recreatable
  *     structures; no row data lost).
+ *
+ * Row removal hides in more than a leading `DELETE`, so the scan also covers:
+ * the optional-`COLUMN` shorthand (`ALTER TABLE t DROP email`), data-modifying
+ * CTEs (`WITH d AS (DELETE ...) SELECT ...`), `MERGE ... THEN DELETE`, dynamic
+ * SQL inside a `DO`/function body, and an `UPDATE` whose only WHERE sits inside
+ * a subquery (which restricts nothing).
  */
 /** Human explanation per kind, used in CLI output. */
 export const DESTRUCTIVE_KIND_LABEL = {
     'drop-table': 'drops a table and ALL its rows',
     'drop-schema': 'drops an entire schema',
+    'drop-database': 'drops an entire database and everything in it',
+    'drop-owned': 'drops every object owned by a role, and their rows',
+    'drop-matview': 'drops a materialized view and its stored rows',
     'drop-column': 'drops a column and its data in every row',
     truncate: 'deletes every row',
     delete: 'deletes rows',
     'update-without-where': 'rewrites every row (no WHERE clause)',
     'alter-column-type': 'rewrites a column type (cast may truncate or fail)',
+    'merge-delete': 'deletes matched rows (MERGE ... THEN DELETE)',
 };
+/**
+ * A dollar-quote tag. Postgres allows digits after the first character
+ * (`$do1$`), so a tag regex that stops at letters reads the body as code and
+ * misses everything inside it. Same shape as the splitter in `migrate.ts`.
+ */
+const DOLLAR_TAG = /^\$([A-Za-z_][A-Za-z_0-9]*)?\$/;
 /** Strip -- line comments, C-style block comments, and quoted literals. */
 function stripCommentsAndStrings(sql) {
+    const blocks = [];
     let out = '';
     let i = 0;
     while (i < sql.length) {
@@ -41,10 +58,17 @@ function stripCommentsAndStrings(sql) {
             out += ' ';
         }
         else if (sql[i] === "'") {
-            // single-quoted literal ('' escapes a quote)
+            // Single-quoted literal. `''` always escapes a quote; inside an E-string
+            // (`E'...'`) a backslash escapes the next character too, so `E'a\'b'` is
+            // ONE literal. Without the E-string case the scan ends the literal at the
+            // backslash-quote and treats the rest of the file as code, which
+            // (worse) then hides every following statement from the guard.
+            const escapes = isEscapeStringPrefix(sql, i);
             let j = i + 1;
             while (j < sql.length) {
-                if (sql[j] === "'" && sql[j + 1] === "'")
+                if (escapes && sql[j] === '\\')
+                    j += 2;
+                else if (sql[j] === "'" && sql[j + 1] === "'")
                     j += 2;
                 else if (sql[j] === "'")
                     break;
@@ -54,10 +78,28 @@ function stripCommentsAndStrings(sql) {
             i = j + 1;
             out += "''";
         }
-        else if (sql[i] === '$' && /^\$[a-zA-Z_]*\$/.test(sql.slice(i))) {
+        else if (sql[i] === '"') {
+            // Quoted identifier. Kept VERBATIM (rules match on identifiers), but it
+            // has to be consumed as one token: an apostrophe inside a quoted name
+            // (`"customer's_orders"`) would otherwise open a string literal and hide
+            // every statement after it from the scan.
+            let j = i + 1;
+            while (j < sql.length) {
+                if (sql[j] === '"' && sql[j + 1] === '"')
+                    j += 2;
+                else if (sql[j] === '"')
+                    break;
+                else
+                    j++;
+            }
+            out += sql.slice(i, Math.min(j + 1, sql.length));
+            i = j + 1;
+        }
+        else if (sql[i] === '$' && DOLLAR_TAG.test(sql.slice(i))) {
             // dollar-quoted literal ($$...$$ / $tag$...$tag$)
-            const tag = sql.slice(i).match(/^\$[a-zA-Z_]*\$/)?.[0] ?? '$$';
+            const tag = sql.slice(i).match(DOLLAR_TAG)?.[0] ?? '$$';
             const end = sql.indexOf(tag, i + tag.length);
+            blocks.push({ at: out.length, body: sql.slice(i + tag.length, end === -1 ? sql.length : end) });
             i = end === -1 ? sql.length : end + tag.length;
             out += "''";
         }
@@ -66,7 +108,23 @@ function stripCommentsAndStrings(sql) {
             i++;
         }
     }
-    return out;
+    return { text: out, blocks };
+}
+/**
+ * True when the quote at `quoteAt` opens an E-string (`E'...'`), where a
+ * backslash escapes the next character. The preceding `E` must not itself be
+ * part of an identifier, so `some_table'` never turns the following literal
+ * into an E-string. Ordinary literals are left alone on purpose: with the
+ * modern `standard_conforming_strings = on` default, `'a\'` IS a complete
+ * string. Mirrors the same-named helper in `migrate.ts`; kept local so this
+ * module stays a pure leaf with no CLI imports of its own.
+ */
+function isEscapeStringPrefix(sql, quoteAt) {
+    const prev = sql[quoteAt - 1];
+    if (prev !== 'E' && prev !== 'e')
+        return false;
+    const before = sql[quoteAt - 2];
+    return before === undefined || !/[A-Za-z0-9_$"]/.test(before);
 }
 /** Unquote a "quoted" identifier for display. */
 const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
@@ -83,15 +141,34 @@ const RULES = [
         regex: new RegExp(String.raw `^DROP\s+SCHEMA\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
         target: (m) => ident(m[2]),
     },
+    {
+        kind: 'drop-matview',
+        regex: new RegExp(String.raw `^DROP\s+MATERIALIZED\s+VIEW\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
+        target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
+    },
+    {
+        kind: 'drop-database',
+        regex: new RegExp(String.raw `^DROP\s+DATABASE\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
+        target: (m) => ident(m[2]),
+    },
+    {
+        // `DROP OWNED BY role` removes every object that role owns, rows included.
+        kind: 'drop-owned',
+        regex: new RegExp(String.raw `^DROP\s+OWNED\s+BY\s+${IDENT}`, 'i'),
+        target: (m) => ident(m[1]),
+    },
     {
         kind: 'truncate',
         regex: new RegExp(String.raw `^TRUNCATE\s+(TABLE\s+)?(ONLY\s+)?${IDENT}`, 'i'),
         target: (m) => (m[5] ? `${ident(m[3])}.${ident(m[5])}` : ident(m[3])),
     },
     {
+        // `COLUMN` is OPTIONAL in Postgres: `ALTER TABLE t DROP email` drops the
+        // column and its data exactly like the spelled-out form. The lookahead
+        // excludes the other `DROP <thing>` sub-actions, none of which lose rows.
         kind: 'drop-column',
-        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bDROP\s+COLUMN\s+(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
-        target: (m) => `${ident(m[3])}.${ident(m[7])}`,
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bDROP\s+(?!CONSTRAINT\b|DEFAULT\b|NOT\b|IDENTITY\b|EXPRESSION\b)(COLUMN\s+)?(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
+        target: (m) => `${ident(m[3])}.${ident(m[8])}`,
     },
     {
         kind: 'alter-column-type',
@@ -101,15 +178,130 @@ const RULES = [
     {
         kind: 'delete',
         regex: new RegExp(String.raw `^DELETE\s+FROM\s+(ONLY\s+)?${IDENT}`, 'i'),
-        target: (m) => ident(m[2]),
+        target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
+    },
+    {
+        // MERGE's DELETE action removes rows from the target table.
+        kind: 'merge-delete',
+        regex: new RegExp(String.raw `^MERGE\s+INTO\s+(ONLY\s+)?${IDENT}\b[\s\S]*?\bTHEN\s+DELETE\b`, 'i'),
+        target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
     },
     {
+        // A WHERE inside a scalar subquery (`SET x = (SELECT ... WHERE ...)`) does
+        // NOT restrict the rows updated, so the guard tests only the TOP level.
         kind: 'update-without-where',
         regex: new RegExp(String.raw `^UPDATE\s+(ONLY\s+)?${IDENT}\b`, 'i'),
-        target: (m) => ident(m[2]),
-        also: (stmt) => !/\bWHERE\b/i.test(stmt),
+        target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
+        also: (stmt) => !hasTopLevelWhere(stmt),
     },
 ];
+/** True when the statement has a `WHERE` outside every parenthesized group. */
+function hasTopLevelWhere(stmt) {
+    const re = /[()]|\bWHERE\b/gi;
+    let depth = 0;
+    let m = re.exec(stmt);
+    while (m !== null) {
+        if (m[0] === '(')
+            depth++;
+        else if (m[0] === ')')
+            depth = Math.max(0, depth - 1);
+        else if (depth === 0)
+            return true;
+        m = re.exec(stmt);
+    }
+    return false;
+}
+/**
+ * A leading CTE list is a prefix, not a statement: `WITH c AS (SELECT 1) DELETE
+ * FROM users` is a plain DELETE that the anchored rules would otherwise skip.
+ * Strip balanced `WITH name AS ( ... )` groups (and their comma-separated
+ * siblings) so the real statement head is what gets matched. The CTE bodies
+ * themselves are handled separately by {@link cteSubstatements}.
+ */
+function stripLeadingCtes(stmt) {
+    if (!/^WITH\b/i.test(stmt))
+        return stmt;
+    let rest = stmt.replace(/^WITH\s+(RECURSIVE\s+)?/i, '');
+    for (;;) {
+        const open = rest.indexOf('(');
+        if (open === -1)
+            return stmt;
+        const close = closingParenIndex(rest, open);
+        rest = rest.slice(close + 1).trimStart();
+        if (rest.startsWith(',')) {
+            rest = rest.slice(1).trimStart();
+            continue;
+        }
+        return rest;
+    }
+}
+/** First matching rule for one candidate fragment, or null. */
+function matchRules(candidate) {
+    for (const rule of RULES) {
+        const m = candidate.match(rule.regex);
+        if (!m)
+            continue;
+        if (rule.also && !rule.also(candidate))
+            continue;
+        return { kind: rule.kind, target: rule.target(m) };
+    }
+    return null;
+}
+/**
+ * Data-modifying CTE bodies: `WITH d AS (DELETE FROM t ...) SELECT ...` runs a
+ * real DELETE even though the statement reads as a SELECT. Each candidate is cut
+ * at the paren that closes its CTE, so the outer query's WHERE cannot mask a
+ * `WITH u AS (UPDATE t SET ...) SELECT ... WHERE ...`.
+ */
+function cteSubstatements(stmt) {
+    if (!/^WITH\b/i.test(stmt))
+        return [];
+    const out = [];
+    const re = /\(\s*(?=(?:DELETE|UPDATE|INSERT|TRUNCATE|DROP|ALTER|MERGE)\b)/gi;
+    let m = re.exec(stmt);
+    while (m !== null) {
+        const start = m.index + m[0].length;
+        out.push(stmt.slice(start, closingParenIndex(stmt, m.index)));
+        m = re.exec(stmt);
+    }
+    return out;
+}
+/** Index of the `)` closing the `(` at `openAt`, or the end of the string. */
+function closingParenIndex(stmt, openAt) {
+    let depth = 0;
+    for (let i = openAt; i < stmt.length; i++) {
+        if (stmt[i] === '(')
+            depth++;
+        else if (stmt[i] === ')') {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return stmt.length;
+}
+/** Statements whose dollar-quoted body is executable SQL rather than data. */
+const PROCEDURAL_STATEMENT = /^(DO\b|CREATE\s+(OR\s+REPLACE\s+)?(FUNCTION|PROCEDURE)\b)/i;
+/**
+ * Candidate fragments inside a procedural body (a `DO $$ ... $$` block or a
+ * function source). The body's own string literals are NOT stripped here: the
+ * whole point is dynamic SQL, whose payload lives in a literal
+ * (`EXECUTE 'DROP TABLE users'`). Rules are anchored, so every keyword-leading
+ * position in the body is offered as its own candidate. This deliberately
+ * over-reports (a body that merely mentions "drop table" in a message string is
+ * flagged) in keeping with the module's false-positives-only asymmetry.
+ */
+function proceduralCandidates(body) {
+    const withoutComments = body.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
+    const out = [];
+    const re = /\b(?:DROP|TRUNCATE|DELETE|ALTER|UPDATE|MERGE)\s/gi;
+    let m = re.exec(withoutComments);
+    while (m !== null) {
+        out.push(withoutComments.slice(m.index));
+        m = re.exec(withoutComments);
+    }
+    return out;
+}
 /**
  * Scan SQL (one file's worth; may contain many `;`-separated statements) and
  * return every statement that can destroy data.
@@ -117,17 +309,40 @@ const RULES = [
 export function scanDestructiveSql(sql) {
     const found = [];
     const cleaned = stripCommentsAndStrings(sql);
-    for (const rawStmt of cleaned.split(';')) {
+    let offset = 0;
+    for (const rawStmt of cleaned.text.split(';')) {
+        const start = offset;
+        const end = offset + rawStmt.length;
+        offset = end + 1; // the ';' consumed by split
         const stmt = rawStmt.trim();
         if (!stmt)
             continue;
-        for (const rule of RULES) {
-            const m = stmt.match(rule.regex);
-            if (!m)
+        // Top level, then data-modifying CTEs, then any procedural body this
+        // statement blanked. First match per statement wins, as before.
+        const display = stmt.replace(/\s+/g, ' ');
+        const candidates = [
+            stripLeadingCtes(stmt),
+            ...cteSubstatements(stmt),
+        ].map((text) => ({
+            text,
+            display,
+        }));
+        // Only a DO block / routine body is procedural SQL. A dollar-quoted literal
+        // used as DATA (`INSERT ... VALUES ($$DELETE FROM x$$)`) stays a literal.
+        const procedural = PROCEDURAL_STATEMENT.test(stmt);
+        for (const block of procedural ? cleaned.blocks : []) {
+            if (block.at < start || block.at >= end)
                 continue;
-            if (rule.also && !rule.also(stmt))
+            for (const text of proceduralCandidates(block.body)) {
+                // The body was blanked in `display`, so name the fragment that matched.
+                candidates.push({ text, display: `${display} [in block: ${text.replace(/\s+/g, ' ').slice(0, 60)}]` });
+            }
+        }
+        for (const candidate of candidates) {
+            const hit = matchRules(candidate.text);
+            if (!hit)
                 continue;
-            found.push({ statement: stmt.replace(/\s+/g, ' '), kind: rule.kind, target: rule.target(m) });
+            found.push({ statement: candidate.display, kind: hit.kind, target: hit.target });
             break;
         }
     }