turbine-orm 0.65.0 → 0.66.0

package/dist/cjs/cli/destructive.js

@@ -19,12 +19,20 @@
  * Row removal hides in more than a leading `DELETE`, so the scan also covers:
  * the optional-`COLUMN` shorthand (`ALTER TABLE t DROP email`), data-modifying
  * CTEs (`WITH d AS (DELETE ...) SELECT ...`), `MERGE ... THEN DELETE`, dynamic
- * SQL inside a `DO`/function body, and an `UPDATE` whose only WHERE sits inside
- * a subquery (which restricts nothing).
+ * SQL inside a `DO`/function body, an `UPDATE` whose only WHERE sits inside a
+ * subquery (which restricts nothing), a `DROP ... CASCADE` of a non-table
+ * object (which takes dependent COLUMNS with it), a detached partition, and an
+ * `EXPLAIN ANALYZE` of any of the above (which really executes it).
+ *
+ * The lexing, "where does a statement end" and "which characters are code",
+ * is NOT done here: it lives in `sql-statements.ts` and is shared with the
+ * migration runner. Two lexers is how this guard came to disagree with the
+ * executor about what a file contained (see that module's header).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DESTRUCTIVE_KIND_LABEL = void 0;
+exports.DYNAMIC_TARGET = exports.DESTRUCTIVE_KIND_LABEL = void 0;
 exports.scanDestructiveSql = scanDestructiveSql;
+const sql_statements_js_1 = require("./sql-statements.js");
 /** Human explanation per kind, used in CLI output. */
 exports.DESTRUCTIVE_KIND_LABEL = {
     'drop-table': 'drops a table and ALL its rows',
@@ -33,106 +41,36 @@ exports.DESTRUCTIVE_KIND_LABEL = {
     'drop-owned': 'drops every object owned by a role, and their rows',
     'drop-matview': 'drops a materialized view and its stored rows',
     'drop-column': 'drops a column and its data in every row',
+    'drop-cascade': 'drops an object AND every dependent object, columns and their data included',
+    'detach-partition': 'detaches a partition, every row in it leaves the table',
     truncate: 'deletes every row',
     delete: 'deletes rows',
     'update-without-where': 'rewrites every row (no WHERE clause)',
     'alter-column-type': 'rewrites a column type (cast may truncate or fail)',
     'merge-delete': 'deletes matched rows (MERGE ... THEN DELETE)',
+    rename: 'renames a table or column, every query and view referencing the old name breaks',
+    'dynamic-destructive': 'runs destructive SQL assembled at run time, what it destroys cannot be known without running it',
 };
+/** Unquote a "quoted" identifier for display. */
+const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
+const IDENT = String.raw `("[^"]+"|[a-zA-Z_][\w$]*)(\.("[^"]+"|[a-zA-Z_][\w$]*))?`;
 /**
- * A dollar-quote tag. Postgres allows digits after the first character
- * (`$do1$`), so a tag regex that stops at letters reads the body as code and
- * misses everything inside it. Same shape as the splitter in `migrate.ts`.
+ * Render one `IDENT` capture triple (name, `.qualifier`, qualifier) as text,
+ * where `base` is the 1-based index of the triple's first group.
  */
-const DOLLAR_TAG = /^\$([A-Za-z_][A-Za-z_0-9]*)?\$/;
-/** Strip -- line comments, C-style block comments, and quoted literals. */
-function stripCommentsAndStrings(sql) {
-    const blocks = [];
-    let out = '';
-    let i = 0;
-    while (i < sql.length) {
-        const two = sql.slice(i, i + 2);
-        if (two === '--') {
-            const nl = sql.indexOf('\n', i);
-            i = nl === -1 ? sql.length : nl; // keep the newline
-        }
-        else if (two === '/*') {
-            const end = sql.indexOf('*/', i + 2);
-            i = end === -1 ? sql.length : end + 2;
-            out += ' ';
-        }
-        else if (sql[i] === "'") {
-            // Single-quoted literal. `''` always escapes a quote; inside an E-string
-            // (`E'...'`) a backslash escapes the next character too, so `E'a\'b'` is
-            // ONE literal. Without the E-string case the scan ends the literal at the
-            // backslash-quote and treats the rest of the file as code, which
-            // (worse) then hides every following statement from the guard.
-            const escapes = isEscapeStringPrefix(sql, i);
-            let j = i + 1;
-            while (j < sql.length) {
-                if (escapes && sql[j] === '\\')
-                    j += 2;
-                else if (sql[j] === "'" && sql[j + 1] === "'")
-                    j += 2;
-                else if (sql[j] === "'")
-                    break;
-                else
-                    j++;
-            }
-            i = j + 1;
-            out += "''";
-        }
-        else if (sql[i] === '"') {
-            // Quoted identifier. Kept VERBATIM (rules match on identifiers), but it
-            // has to be consumed as one token: an apostrophe inside a quoted name
-            // (`"customer's_orders"`) would otherwise open a string literal and hide
-            // every statement after it from the scan.
-            let j = i + 1;
-            while (j < sql.length) {
-                if (sql[j] === '"' && sql[j + 1] === '"')
-                    j += 2;
-                else if (sql[j] === '"')
-                    break;
-                else
-                    j++;
-            }
-            out += sql.slice(i, Math.min(j + 1, sql.length));
-            i = j + 1;
-        }
-        else if (sql[i] === '$' && DOLLAR_TAG.test(sql.slice(i))) {
-            // dollar-quoted literal ($$...$$ / $tag$...$tag$)
-            const tag = sql.slice(i).match(DOLLAR_TAG)?.[0] ?? '$$';
-            const end = sql.indexOf(tag, i + tag.length);
-            blocks.push({ at: out.length, body: sql.slice(i + tag.length, end === -1 ? sql.length : end) });
-            i = end === -1 ? sql.length : end + tag.length;
-            out += "''";
-        }
-        else {
-            out += sql[i];
-            i++;
-        }
-    }
-    return { text: out, blocks };
-}
+const qualified = (m, base) => m[base + 2] ? `${ident(m[base])}.${ident(m[base + 2])}` : ident(m[base]);
 /**
- * True when the quote at `quoteAt` opens an E-string (`E'...'`), where a
- * backslash escapes the next character. The preceding `E` must not itself be
- * part of an identifier, so `some_table'` never turns the following literal
- * into an E-string. Ordinary literals are left alone on purpose: with the
- * modern `standard_conforming_strings = on` default, `'a\'` IS a complete
- * string. Mirrors the same-named helper in `migrate.ts`; kept local so this
- * module stays a pure leaf with no CLI imports of its own.
+ * Filler between an `ALTER TABLE <name>` head and the sub-action keyword that
+ * follows it, for the multi-action forms.
+ *
+ * NOT `[\s\S]*?`: that lets the lazy walk stop INSIDE a quoted identifier,
+ * because a quoted name is kept verbatim in the stripped text. `ALTER TABLE t
+ * ADD COLUMN "drop me" int` was flagged `drop-column` on `t.me`, a pure false
+ * positive on a statement that adds data and removes none. Consuming either a
+ * WHOLE quoted identifier or a single non-quote character means the scan can
+ * never begin a keyword match part-way through a quoted name.
  */
-function isEscapeStringPrefix(sql, quoteAt) {
-    const prev = sql[quoteAt - 1];
-    if (prev !== 'E' && prev !== 'e')
-        return false;
-    const before = sql[quoteAt - 2];
-    return before === undefined || !/[A-Za-z0-9_$"]/.test(before);
-}
-/** Unquote a "quoted" identifier for display. */
-const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
-const IDENT = String.raw `("[^"]+"|[a-zA-Z_][\w$]*)(\.("[^"]+"|[a-zA-Z_][\w$]*))?`;
+const OUTSIDE_QUOTES = '(?:"[^"]*"|[^"])*?';
 /** Ordered rules, first match per statement wins. */
 const RULES = [
     {
@@ -161,6 +99,17 @@ const RULES = [
         regex: new RegExp(String.raw `^DROP\s+OWNED\s+BY\s+${IDENT}`, 'i'),
         target: (m) => ident(m[1]),
     },
+    {
+        // `DROP <object> ... CASCADE` on anything OTHER than a table. Without
+        // CASCADE these are safe: Postgres refuses the drop while a dependency
+        // exists. With it, the dependents go too, and a dependent of a TYPE or a
+        // DOMAIN is typically a COLUMN, so `DROP TYPE order_status CASCADE`
+        // silently removes `orders.status` and every value in it. The presence of
+        // CASCADE is therefore the whole rule, not an extra detail.
+        kind: 'drop-cascade',
+        regex: new RegExp(String.raw `^DROP\s+(TYPE|DOMAIN|EXTENSION|SEQUENCE|FUNCTION|PROCEDURE|ROUTINE|AGGREGATE)\s+(IF\s+EXISTS\s+)?${IDENT}${OUTSIDE_QUOTES}\bCASCADE\b`, 'i'),
+        target: (m) => `${m[1].toUpperCase()} ${qualified(m, 3)}`,
+    },
     {
         kind: 'truncate',
         regex: new RegExp(String.raw `^TRUNCATE\s+(TABLE\s+)?(ONLY\s+)?${IDENT}`, 'i'),
@@ -171,12 +120,19 @@ const RULES = [
         // column and its data exactly like the spelled-out form. The lookahead
         // excludes the other `DROP <thing>` sub-actions, none of which lose rows.
         kind: 'drop-column',
-        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bDROP\s+(?!CONSTRAINT\b|DEFAULT\b|NOT\b|IDENTITY\b|EXPRESSION\b)(COLUMN\s+)?(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}${OUTSIDE_QUOTES}\bDROP\s+(?!CONSTRAINT\b|DEFAULT\b|NOT\b|IDENTITY\b|EXPRESSION\b)(COLUMN\s+)?(IF\s+EXISTS\s+)?${IDENT}`, 'i'),
         target: (m) => `${ident(m[3])}.${ident(m[8])}`,
     },
+    {
+        // A detached partition keeps its rows, but they leave the parent table:
+        // every query against the parent stops seeing them the moment this runs.
+        kind: 'detach-partition',
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}\s+DETACH\s+PARTITION\s+${IDENT}`, 'i'),
+        target: (m) => `${qualified(m, 3)}.${qualified(m, 6)}`,
+    },
     {
         kind: 'alter-column-type',
-        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}[\s\S]*?\bALTER\s+(COLUMN\s+)?${IDENT}\s+(SET\s+DATA\s+)?TYPE\b`, 'i'),
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}${OUTSIDE_QUOTES}\bALTER\s+(COLUMN\s+)?${IDENT}\s+(SET\s+DATA\s+)?TYPE\b`, 'i'),
         target: (m) => `${ident(m[3])}.${ident(m[7])}`,
     },
     {
@@ -187,7 +143,7 @@ const RULES = [
     {
         // MERGE's DELETE action removes rows from the target table.
         kind: 'merge-delete',
-        regex: new RegExp(String.raw `^MERGE\s+INTO\s+(ONLY\s+)?${IDENT}\b[\s\S]*?\bTHEN\s+DELETE\b`, 'i'),
+        regex: new RegExp(String.raw `^MERGE\s+INTO\s+(ONLY\s+)?${IDENT}\b${OUTSIDE_QUOTES}\bTHEN\s+DELETE\b`, 'i'),
         target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
     },
     {
@@ -198,6 +154,25 @@ const RULES = [
         target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
         also: (stmt) => !hasTopLevelWhere(stmt),
     },
+    // Renames come LAST: they destroy no data, so any statement that is BOTH a
+    // rename and a data-loss operation should report the data loss instead.
+    {
+        // `ALTER TABLE t RENAME TO u`. Nothing is lost, but every query, view,
+        // function, and application reference to `t` breaks the moment it lands,
+        // and it is the second half of the sanctioned backfill swap, so an operator
+        // confirming a migration deserves to see it in the inventory.
+        kind: 'rename',
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}\s+RENAME\s+TO\s+${IDENT}`, 'i'),
+        target: (m) => qualified(m, 3),
+    },
+    {
+        // `ALTER TABLE t RENAME [COLUMN] old TO new`. The lookahead keeps the
+        // table-rename form (handled above) and `RENAME CONSTRAINT` (which breaks
+        // nothing a query can name) out of this rule.
+        kind: 'rename',
+        regex: new RegExp(String.raw `^ALTER\s+TABLE\s+(IF\s+EXISTS\s+)?(ONLY\s+)?${IDENT}\s+RENAME\s+(COLUMN\s+)?(?!TO\b|CONSTRAINT\b)${IDENT}\s+TO\s+${IDENT}`, 'i'),
+        target: (m) => `${qualified(m, 3)}.${qualified(m, 7)}`,
+    },
 ];
 /** True when the statement has a `WHERE` outside every parenthesized group. */
 function hasTopLevelWhere(stmt) {
@@ -284,25 +259,79 @@ function closingParenIndex(stmt, openAt) {
     }
     return stmt.length;
 }
+/**
+ * An `EXPLAIN` prefix, either the parenthesized option list or the bare keyword
+ * form. Used to answer one question: does this EXPLAIN actually RUN the
+ * statement it wraps?
+ */
+const EXPLAIN_PREFIX = /^EXPLAIN\s*(?:\(([^)]*)\)|((?:(?:ANALYZE|ANALYSE|VERBOSE)\s+)*))/i;
+/**
+ * `EXPLAIN ANALYZE <DML>` EXECUTES the statement, it does not merely plan it.
+ * `EXPLAIN ANALYZE DELETE FROM t` empties `t`, and the guard used to see a
+ * statement whose head was `EXPLAIN` and match no rule at all. Returned is the
+ * inner statement when the EXPLAIN executes, otherwise the statement unchanged
+ * (a plain `EXPLAIN DELETE ...` only plans, and must NOT be flagged).
+ *
+ * `ANALYZE false` / `ANALYZE off` is treated as executing even though it does
+ * not: this module's asymmetry is that a false positive costs a confirmation
+ * prompt while a false negative costs data, and spelling out boolean option
+ * values here would trade the cheap error for the expensive one.
+ */
+function stripExecutingExplain(stmt) {
+    const m = EXPLAIN_PREFIX.exec(stmt);
+    if (!m)
+        return stmt;
+    const options = m[1] ?? m[2] ?? '';
+    if (!/\bANALY[SZ]E\b/i.test(options))
+        return stmt;
+    return stmt.slice(m[0].length).trimStart();
+}
 /** Statements whose dollar-quoted body is executable SQL rather than data. */
 const PROCEDURAL_STATEMENT = /^(DO\b|CREATE\s+(OR\s+REPLACE\s+)?(FUNCTION|PROCEDURE)\b)/i;
 /**
- * Candidate fragments inside a procedural body (a `DO $$ ... $$` block or a
- * function source). The body's own string literals are NOT stripped here: the
- * whole point is dynamic SQL, whose payload lives in a literal
- * (`EXECUTE 'DROP TABLE users'`). Rules are anchored, so every keyword-leading
- * position in the body is offered as its own candidate. This deliberately
- * over-reports (a body that merely mentions "drop table" in a message string is
- * flagged) in keeping with the module's false-positives-only asymmetry.
+ * Candidate fragments inside a procedural body (a `DO $$ ... $$` block, a
+ * function source, or a PG14+ `BEGIN ATOMIC` body). The body's own string
+ * literals are NOT stripped: the whole point is dynamic SQL, whose payload
+ * lives in a literal (`EXECUTE 'DROP TABLE users'`). Rules are anchored, so
+ * every keyword-leading position in the body is offered as its own candidate.
+ * This deliberately over-reports (a body that merely mentions "drop table" in a
+ * message string is flagged) in keeping with the module's
+ * false-positives-only asymmetry.
+ *
+ * Comments come out via the SHARED tokenizer, never a regex. The pair that used
+ * to do it here, `/\/\*[\s\S]*?\*\//g` and `/--[^\n]*\/g`, was the exact
+ * hand-written lexer the tokenizer was written to delete, still in place one
+ * level down and on the path that exists specifically to catch dynamic SQL.
+ * Neither pattern nests and neither respects string literals, so ONE earlier
+ * literal containing `--` or an unclosed `/*` blanked every destructive
+ * statement after it. Both of these reported an empty inventory and dropped the
+ * table on PostgreSQL 16.14:
+ *
+ *   DO $$ DECLARE s text := 'x --'; BEGIN EXECUTE 'DROP TABLE users'; END $$;
+ *   DO $$ DECLARE s text := 'a /*'; BEGIN EXECUTE 'DROP TABLE users';
+ *          RAISE NOTICE '% b *\/', s; END $$;
+ *
+ * The `--` shape is the worse of the two because it is reachable by ACCIDENT:
+ * any single-line body whose earlier literal holds a `--` (a date range, a
+ * separator, a placeholder) hides everything that follows it.
+ *
+ * Tokenizing also bounds each candidate at its own statement instead of at the
+ * end of the body, so a later `WHERE` can no longer talk the `update-without-
+ * where` rule out of an earlier unrestricted UPDATE.
  */
 function proceduralCandidates(body) {
-    const withoutComments = body.replace(/\/\*[\s\S]*?\*\//g, ' ').replace(/--[^\n]*/g, ' ');
     const out = [];
-    const re = /\b(?:DROP|TRUNCATE|DELETE|ALTER|UPDATE|MERGE)\s/gi;
-    let m = re.exec(withoutComments);
-    while (m !== null) {
-        out.push(withoutComments.slice(m.index));
-        m = re.exec(withoutComments);
+    for (const statement of (0, sql_statements_js_1.tokenizeSql)(body)) {
+        // `code` is the statement with comments gone and everything else verbatim.
+        // Literals have to survive: they are where dynamic SQL keeps its payload,
+        // and `stripped` would have emptied exactly them.
+        const text = statement.code;
+        const re = /\b(?:DROP|TRUNCATE|DELETE|ALTER|UPDATE|MERGE)\s/gi;
+        let m = re.exec(text);
+        while (m !== null) {
+            out.push(text.slice(m.index));
+            m = re.exec(text);
+        }
     }
     return out;
 }
@@ -312,43 +341,122 @@ function proceduralCandidates(body) {
  */
 function scanDestructiveSql(sql) {
     const found = [];
-    const cleaned = stripCommentsAndStrings(sql);
-    let offset = 0;
-    for (const rawStmt of cleaned.text.split(';')) {
-        const start = offset;
-        const end = offset + rawStmt.length;
-        offset = end + 1; // the ';' consumed by split
-        const stmt = rawStmt.trim();
+    for (const statement of (0, sql_statements_js_1.tokenizeSql)(sql)) {
+        if (statement.commentOnly)
+            continue;
+        const stmt = statement.stripped;
         if (!stmt)
             continue;
+        // `EXPLAIN ANALYZE` is a wrapper that RUNS its argument, so the rules are
+        // matched against what it wraps. `display` keeps the EXPLAIN, so the
+        // inventory shows the operator the statement they actually wrote.
+        const body = stripExecutingExplain(stmt);
         // Top level, then data-modifying CTEs, then any procedural body this
         // statement blanked. First match per statement wins, as before.
         const display = stmt.replace(/\s+/g, ' ');
         const candidates = [
-            stripLeadingCtes(stmt),
-            ...cteSubstatements(stmt),
+            stripLeadingCtes(body),
+            ...cteSubstatements(body),
         ].map((text) => ({
             text,
             display,
         }));
         // Only a DO block / routine body is procedural SQL. A dollar-quoted literal
         // used as DATA (`INSERT ... VALUES ($$DELETE FROM x$$)`) stays a literal.
+        // The tokenizer hands back each statement's OWN blocks, so which body
+        // belongs to which statement is no longer an offset calculation that can
+        // disagree with the statement split.
         const procedural = PROCEDURAL_STATEMENT.test(stmt);
-        for (const block of procedural ? cleaned.blocks : []) {
-            if (block.at < start || block.at >= end)
-                continue;
-            for (const text of proceduralCandidates(block.body)) {
+        const proceduralTexts = [];
+        for (const block of procedural ? statement.blocks : []) {
+            for (const text of proceduralCandidates(block)) {
                 // The body was blanked in `display`, so name the fragment that matched.
                 candidates.push({ text, display: `${display} [in block: ${text.replace(/\s+/g, ' ').slice(0, 60)}]` });
+                proceduralTexts.push(text);
             }
         }
+        let matched = false;
         for (const candidate of candidates) {
             const hit = matchRules(candidate.text);
             if (!hit)
                 continue;
             found.push({ statement: candidate.display, kind: hit.kind, target: hit.target });
+            matched = true;
+            break;
+        }
+        if (matched)
+            continue;
+        // Nothing matched a rule. Inside a PROCEDURAL body that is not the end of
+        // the question, because the rules all need a parseable object name and
+        // dynamic SQL does not have one until it runs. All three of these execute a
+        // real `DROP TABLE` on PostgreSQL 16 and reported NOTHING:
+        //
+        //   DO $$ BEGIN EXECUTE format('DROP TABLE %I', 'users'); END $$;
+        //   DO $$ BEGIN EXECUTE 'DROP ' || 'TABLE users'; END $$;
+        //   DO $$ BEGIN EXECUTE 'DROP TABLE ' || quote_ident('users'); END $$;
+        //
+        // A clean inventory for a file that drops a table is the exact failure this
+        // module exists to prevent: the operator confirms what they were shown, and
+        // the unlisted statement runs under that confirmation. So report it with an
+        // explicit unknown target and let them decide.
+        //
+        // Gated on evidence of RUNTIME ASSEMBLY rather than on the verb alone, and
+        // that gate is complete rather than heuristic: a destructive statement whose
+        // object name is written out literally already matches a rule above, so the
+        // only way to be dynamic is to concatenate or format. Without the gate,
+        // `RAISE NOTICE 'DROP the mic'` would prompt, and a guard that fires on
+        // prose teaches operators to confirm without reading, which costs more than
+        // it saves.
+        for (const text of proceduralTexts) {
+            const kind = dynamicDestructiveKind(text);
+            if (!kind)
+                continue;
+            found.push({
+                statement: `${display} [in block: ${text.replace(/\s+/g, ' ').slice(0, 60)}]`,
+                kind,
+                target: exports.DYNAMIC_TARGET,
+            });
             break;
         }
     }
     return found;
 }
+/** Shown in place of an object name that does not exist until the block runs. */
+exports.DYNAMIC_TARGET = '<name assembled at run time>';
+/** `||`, `format(...)`, or a `quote_*` helper: the ways a body builds SQL. */
+const DYNAMIC_ASSEMBLY = /\|\||\bformat\s*\(|\bquote_(?:ident|literal|nullable)\s*\(|%[IsL]/;
+/**
+ * The kind a runtime-assembled procedural fragment should be reported as, or
+ * `null` when it is not dynamic (so a rule already had its chance) or its verb
+ * is not one that destroys data on its own.
+ *
+ * `ALTER` and `UPDATE` are deliberately absent even though
+ * {@link proceduralCandidates} collects them: their destructive forms are
+ * narrow (`ALTER COLUMN ... TYPE`, an `UPDATE` with no `WHERE`) and neither is
+ * decidable from a fragment whose tail is a runtime expression, so including
+ * them would flag every dynamic `UPDATE ... WHERE` in the file.
+ */
+function dynamicDestructiveKind(text) {
+    if (!DYNAMIC_ASSEMBLY.test(text))
+        return null;
+    if (/^DROP\s+TABLE\b/i.test(text))
+        return 'drop-table';
+    if (/^DROP\s+SCHEMA\b/i.test(text))
+        return 'drop-schema';
+    if (/^DROP\s+DATABASE\b/i.test(text))
+        return 'drop-database';
+    if (/^DROP\s+MATERIALIZED\s+VIEW\b/i.test(text))
+        return 'drop-matview';
+    // A bare `DROP` whose object keyword is itself part of the runtime expression
+    // (`'DROP ' || 'TABLE users'`). Deliberately NOT reported as `drop-cascade`:
+    // that label claims dependent objects go too, which would be a factual claim
+    // about the operator's migration that we cannot support. Being alarming is
+    // fine here; being wrong is not.
+    if (/^DROP\b/i.test(text))
+        return 'dynamic-destructive';
+    if (/^TRUNCATE\b/i.test(text))
+        return 'truncate';
+    if (/^DELETE\b/i.test(text))
+        return 'delete';
+    return null;
+}

package/dist/cjs/cli/index.d.ts

@@ -393,10 +393,16 @@ export declare function initEnvNotice(input: {
  * database (unless `--no-db`), and emit (a) a Markdown resolution report and
  * (b) a typed `prisma-map.ts` name map next to the generated client.
  *
- * NOTE: within THIS command `--schema` names the Prisma schema FILE (not the
- * Postgres namespace, which the rest of the CLI's `--schema` means). The
- * Postgres namespace is `public` here; multi-schema (`@@schema`) is unsupported
- * in v1 and listed as a parser note in the report.
+ * NOTE: within THIS command `--schema` names the Prisma schema FILE, or the
+ * DIRECTORY of a multi-file schema (Prisma >= 5.15), not the Postgres namespace
+ * that the rest of the CLI's `--schema` means. The Postgres namespace is
+ * `public` here.
+ *
+ * Multi-schema (`@@schema`) is unsupported: the parser emits a warning naming
+ * the attribute, which lands in the report's "Parser notes" section, and two
+ * models that resolve to the same bare table name are both marked UNRESOLVED
+ * rather than silently collapsed (see flagDuplicateTables in prisma-resolve.ts).
+ * This JSDoc used to claim the note existed before either half was written.
  */
 /** Outcome of {@link resolveMigrateFromPrismaUrl}. */
 export interface MigrateFromPrismaUrl {
@@ -420,6 +426,17 @@ export interface MigrateFromPrismaUrl {
  * pass on every run.
  */
 export declare function resolveMigrateFromPrismaUrl(configUrl: string | undefined, ast: Pick<PrismaSchemaAst, 'datasources'>, env: Record<string, string | undefined>): MigrateFromPrismaUrl;
+/**
+ * Read a Prisma schema from a FILE or from a multi-file schema DIRECTORY
+ * (Prisma >= 5.15, GA). A directory used to reach `readFileSync` unchanged and
+ * die with a raw `EISDIR`, which is a stack trace rather than an answer.
+ *
+ * Prisma treats every `.prisma` file under the directory as one logical schema,
+ * so they are concatenated in sorted order (stable across machines) and parsed
+ * as a single source. Line numbers in any parse error then refer to that
+ * concatenation, so each file is introduced by a comment naming it.
+ */
+export declare function readPrismaSchemaSource(path: string): string;
 export declare function buildMigrateDeployOptions(args: CliArgs): {
     allowDrift: boolean;
     allowDestructive: true;