@amerged/ohmyhost-cli 0.1.29 → 0.1.30

package/README.md

@@ -1,6 +1,6 @@
 # @amerged/ohmyhost-cli
 
-ohmyho.st cli client, version 0.1.29.
+ohmyho.st cli client, version 0.1.30.
 
 ```sh
 npm install --global @amerged/ohmyhost-cli

package/dist/bin.js

@@ -2,7 +2,7 @@
 import { createRequire as __ohmyhostCreateRequire } from "node:module"; const require = __ohmyhostCreateRequire(import.meta.url);
 import {
   runProductionCli
-} from "./chunk-Y4VB4EGQ.js";
+} from "./chunk-PRLVV4ZG.js";
 import "./chunk-7D2RFLWM.js";
 
 // apps/product-cli/dist/bin.js

package/dist/{chunk-Y4VB4EGQ.js → chunk-PRLVV4ZG.js}

@@ -35600,7 +35600,7 @@ function isAdmittedNextVersion(version2) {
   const patch = Number(match[3]);
   if (![major, minor, patch].every(Number.isSafeInteger))
     return false;
-  return major === 15 && minor === 5 && patch >= 26 || major === 16 && minor === 3 && patch >= 6 && patch <= 7;
+  return major === 15 && minor === 5 && patch >= 26 || major === 16 && minor === 3 && patch === 8;
 }
 var TYPESCRIPT_BUILD_STAGE = /^tsc(?:[ \t]+(?:--noEmit|-b|--build))?$/u;
 function isAdmittedFrameworkBuildScript(framework, script) {
@@ -35710,7 +35710,7 @@ function resolveFrameworkConfig(basename2, files) {
 var VERIFIED_VERSIONS = Object.freeze({
   vite: /* @__PURE__ */ new Set(["5.4.21", "8.0.16", "8.2.2"]),
   "tanstack-start": /* @__PURE__ */ new Set(["1.168.26", "1.168.49"]),
-  nextjs: /* @__PURE__ */ new Set(["15.5.26", "16.3.7"])
+  nextjs: /* @__PURE__ */ new Set(["15.5.26", "16.3.8"])
 });
 function classifyFrameworkVersion(framework, version2) {
   const parsed = parseVersionSpec(version2);
@@ -40236,7 +40236,7 @@ function exact3(v, keys) {
 // apps/product-cli/package.json
 var package_default = {
   name: "@ohmyhost/product-cli",
-  version: "0.1.29",
+  version: "0.1.30",
   private: true,
   ohmyhost: {
     deployment: "production",
@@ -46753,11 +46753,7 @@ function classifyFrameworkFamily(dependencies) {
   return vite ? "vite" : "unknown";
 }
 
-// packages/contracts/dist/database-migration-admission.js
-var MAX_MIGRATION_COUNT = 128;
-var MAX_MIGRATION_BYTES = 256 * 1024;
-var MAX_MIGRATION_TOTAL_BYTES = 2 * 1024 * 1024;
-var MIGRATION_PATH = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u;
+// packages/contracts/dist/database-migration-errors.js
 var DatabaseMigrationAdmissionError = class extends Error {
   reason;
   code = "database_migration_not_admitted";
@@ -46767,143 +46763,337 @@ var DatabaseMigrationAdmissionError = class extends Error {
     this.name = "DatabaseMigrationAdmissionError";
   }
 };
-function admitExpandOnlyMigrations(migrations) {
-  if (!Array.isArray(migrations) || migrations.length === 0 || migrations.length > MAX_MIGRATION_COUNT) {
-    throw new DatabaseMigrationAdmissionError("invalid");
-  }
-  let previousPath = "";
-  let totalBytes = 0;
-  let statementCount = 0;
-  const files = migrations.map((migration) => {
-    if (typeof migration !== "object" || migration === null || !MIGRATION_PATH.test(migration.path) || migration.path <= previousPath || !(migration.body instanceof Uint8Array) || migration.body.byteLength === 0 || migration.body.byteLength > MAX_MIGRATION_BYTES) {
-      throw new DatabaseMigrationAdmissionError("invalid");
-    }
-    previousPath = migration.path;
-    totalBytes += migration.body.byteLength;
-    if (totalBytes > MAX_MIGRATION_TOTAL_BYTES || migration.body.includes(0)) {
-      throw new DatabaseMigrationAdmissionError("invalid");
-    }
-    let sql;
-    try {
-      sql = new TextDecoder("utf-8", { fatal: true }).decode(migration.body);
-    } catch {
-      throw new DatabaseMigrationAdmissionError("invalid");
-    }
-    if (sql.length === 0 || sql.includes("\r") || sql.charCodeAt(0) === 65279) {
-      throw new DatabaseMigrationAdmissionError("invalid");
-    }
-    if (/\bohmyhost\b/iu.test(sql))
-      throw new DatabaseMigrationAdmissionError("unsupported");
-    rejectProviderSpecificSql(sql);
-    const statements = splitSqlStatements(sql);
-    if (statements.length === 0)
-      throw new DatabaseMigrationAdmissionError("invalid");
-    for (const statement of statements)
-      admitStatement(statement);
-    statementCount += statements.length;
-    return Object.freeze({ path: migration.path, statementCount: statements.length });
-  });
-  return Object.freeze({ files: Object.freeze(files), statementCount });
-}
-function rejectProviderSpecificSql(sql) {
-  const normalized = sql.toLowerCase();
-  const withoutPortableAuth = normalized.replace(/\bauth\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu, "");
-  if (/\bauth\s*\./u.test(withoutPortableAuth) || /\bstorage\s*\./u.test(normalized) || /\b(?:to|from)\s+(?:anon|authenticated|service_role)\b/u.test(normalized) || /\bcreate\s+policy\b/u.test(normalized) || /\brow\s+level\s+security\b/u.test(normalized) || /\bsupabase\b/u.test(normalized)) {
-    throw new DatabaseMigrationAdmissionError("provider_specific");
-  }
-}
-function splitSqlStatements(sql) {
+
+// packages/contracts/dist/database-migration-lexical.js
+function readMigrationSql(sql) {
   const statements = [];
+  let tokens = [];
   let start = 0;
   let index = 0;
   while (index < sql.length) {
-    const character = sql[index];
+    const character = sql[index] ?? "";
     const next = sql[index + 1];
+    if (/\s/u.test(character)) {
+      index += 1;
+      continue;
+    }
     if (character === "-" && next === "-") {
-      index = skipLineComment(sql, index + 2);
+      const newline = sql.indexOf("\n", index + 2);
+      index = newline < 0 ? sql.length : newline + 1;
       continue;
     }
     if (character === "/" && next === "*") {
       index = skipBlockComment(sql, index + 2);
       continue;
     }
-    if (character === "'") {
-      index = skipQuoted(sql, index + 1, "'");
-      continue;
-    }
-    if (character === '"') {
-      index = skipQuoted(sql, index + 1, '"');
+    if (character === ";") {
+      if (tokens.length > 0) {
+        statements.push(Object.freeze({ sql: sql.slice(start, index + 1).trim(), tokens }));
+      }
+      tokens = [];
+      start = ++index;
       continue;
     }
-    if (character === "$") {
-      const delimiter = dollarDelimiter(sql, index);
-      if (delimiter !== null) {
-        const end = sql.indexOf(delimiter, index + delimiter.length);
-        if (end < 0)
-          throw new DatabaseMigrationAdmissionError("invalid");
-        index = end + delimiter.length;
-        continue;
-      }
+    const tokenStart = index;
+    let kind = "symbol";
+    let value = character;
+    if (/[uU]/u.test(character) && next === "&" && /['"]/u.test(sql[index + 2] ?? "")) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
     }
-    if (character === ";") {
-      const statement = sql.slice(start, index).trim();
-      if (statement.length > 0)
-        statements.push(statement);
-      start = index + 1;
+    if (character === "'" || character === '"' || /[eE]/u.test(character) && next === "'") {
+      const escaped = character !== "'" && character !== '"';
+      const quote = character === '"' ? '"' : "'";
+      const quoteStart = index + (escaped ? 1 : 0);
+      index = skipQuoted(sql, quoteStart + 1, quote, escaped);
+      kind = quote === '"' ? "identifier" : "string";
+      value = sql.slice(quoteStart + 1, index - 1).replace(/""/gu, '"');
+    } else if (character === "$" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.test(sql.slice(index))) {
+      const delimiter = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index))?.[0] ?? "";
+      const end = sql.indexOf(delimiter, index + delimiter.length);
+      if (end < 0)
+        throw new DatabaseMigrationAdmissionError("invalid");
+      index = end + delimiter.length;
+      kind = "string";
+      value = sql.slice(tokenStart, index);
+    } else if (/[\p{L}_]/u.test(character)) {
+      index += 1;
+      while (index < sql.length && /[\p{L}\p{N}_$]/u.test(sql[index] ?? ""))
+        index += 1;
+      kind = "word";
+      value = sql.slice(tokenStart, index).toLowerCase();
+    } else {
+      index += 1;
     }
-    index += 1;
+    tokens.push(Object.freeze({ kind, value, text: sql.slice(tokenStart, index) }));
   }
-  const tail = sql.slice(start).trim();
-  if (tail.length > 0)
-    statements.push(tail);
+  if (tokens.length > 0)
+    statements.push(Object.freeze({ sql: sql.slice(start).trim(), tokens }));
   return Object.freeze(statements);
 }
-function skipLineComment(sql, index) {
-  const newline = sql.indexOf("\n", index);
-  return newline < 0 ? sql.length : newline + 1;
-}
 function skipBlockComment(sql, index) {
   let depth = 1;
   while (index < sql.length) {
     if (sql[index] === "/" && sql[index + 1] === "*") {
       depth += 1;
       index += 2;
-      continue;
-    }
-    if (sql[index] === "*" && sql[index + 1] === "/") {
+    } else if (sql[index] === "*" && sql[index + 1] === "/") {
       depth -= 1;
       index += 2;
       if (depth === 0)
         return index;
-      continue;
+    } else {
+      index += 1;
     }
-    index += 1;
   }
   throw new DatabaseMigrationAdmissionError("invalid");
 }
-function skipQuoted(sql, index, quote) {
+function skipQuoted(sql, index, quote, escaped) {
   while (index < sql.length) {
-    if (sql[index] !== quote) {
+    if (escaped && sql[index] === "\\") {
+      index += 2;
+    } else if (sql[index] === quote) {
+      if (sql[index + 1] === quote) {
+        index += 2;
+      } else {
+        const continuation = quote === "'" ? continuedStringStart(sql, index + 1) : void 0;
+        if (continuation === void 0)
+          return index + 1;
+        index = continuation;
+      }
+    } else {
       index += 1;
-      continue;
     }
-    if (sql[index + 1] === quote) {
+  }
+  throw new DatabaseMigrationAdmissionError("invalid");
+}
+function continuedStringStart(sql, index) {
+  let newline = false;
+  while (index < sql.length) {
+    const character = sql[index] ?? "";
+    if (/[ \t\f\v\n\r]/u.test(character)) {
+      newline ||= character === "\n" || character === "\r";
+      index += 1;
+    } else if (character === "-" && sql[index + 1] === "-") {
       index += 2;
+      while (index < sql.length && sql[index] !== "\n" && sql[index] !== "\r")
+        index += 1;
+    } else {
+      return character === "'" && newline ? index + 1 : void 0;
+    }
+  }
+  return void 0;
+}
+function isSqlKeyword(token, value) {
+  return token?.kind === "word" && token.value === value;
+}
+function rejectMigrationSqlReferences(tokens, allowIdentityHelpers = false) {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token?.kind !== "word" && token?.kind !== "identifier")
       continue;
+    const value = token.value.toLowerCase();
+    if (value === "ohmyhost") {
+      if (allowIdentityHelpers && token.value === "ohmyhost" && tokens[index + 1]?.kind === "symbol" && tokens[index + 1]?.value === "." && ["user_id", "claims"].includes(tokens[index + 2]?.value ?? "") && ["word", "identifier"].includes(tokens[index + 2]?.kind ?? "") && tokens[index + 3]?.kind === "symbol" && tokens[index + 3]?.value === "(" && tokens[index + 4]?.kind === "symbol" && tokens[index + 4]?.value === ")")
+        continue;
+      throw new DatabaseMigrationAdmissionError("unsupported");
     }
-    return index + 1;
+    const portableAuthTable = tokens[index + 2];
+    if (value === "auth" && tokens[index + 1]?.value === "." && !(portableAuthTable?.kind === "identifier" && ["account", "rateLimit", "ratelimit", "session", "user", "verification"].includes(portableAuthTable.value)) || value === "storage" && tokens[index + 1]?.value === "." || value === "supabase" || (value === "to" || value === "from") && ["anon", "authenticated", "service_role"].includes(tokens[index + 1]?.value ?? ""))
+      throw new DatabaseMigrationAdmissionError("provider_specific");
   }
-  throw new DatabaseMigrationAdmissionError("invalid");
 }
-function dollarDelimiter(sql, index) {
-  const match = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index));
-  return match?.[0] ?? null;
+
+// packages/contracts/dist/database-migration-policies.js
+var PolicyReader = class {
+  tokens;
+  position = 0;
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  take(keyword) {
+    if (!isSqlKeyword(this.tokens[this.position], keyword))
+      return false;
+    this.position += 1;
+    return true;
+  }
+  expect(keyword) {
+    if (!this.take(keyword))
+      throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+  identifier() {
+    const token = this.tokens[this.position++];
+    if (token?.kind !== "word" && token?.kind !== "identifier" || token.value.length === 0 || new TextEncoder().encode(token.value).byteLength > 63) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return token.value;
+  }
+  target() {
+    const schema = this.identifier();
+    const separator = this.tokens[this.position++];
+    if (schema !== "public" && schema !== "private" || separator?.kind !== "symbol" || separator.value !== ".") {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return { schema, table: this.identifier() };
+  }
+  expression() {
+    const opening = this.tokens[this.position++];
+    if (opening?.kind !== "symbol" || opening.value !== "(")
+      throw new DatabaseMigrationAdmissionError("invalid");
+    const start = this.position;
+    let depth = 1;
+    while (this.position < this.tokens.length) {
+      const token = this.tokens[this.position++];
+      if (token?.kind !== "symbol")
+        continue;
+      if (token.value === "(")
+        depth += 1;
+      if (token.value === ")")
+        depth -= 1;
+      if (depth === 0) {
+        if (this.position - 1 === start)
+          throw new DatabaseMigrationAdmissionError("invalid");
+        rejectMigrationSqlReferences(this.tokens.slice(start, this.position - 1), true);
+        return;
+      }
+    }
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+  end() {
+    if (this.position !== this.tokens.length)
+      throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+};
+function readMigrationRlsTarget(tokens) {
+  const first = tokens[0]?.value;
+  const policy = tokens[0]?.kind === "word" && isSqlKeyword(tokens[1], "policy") && ["create", "alter", "drop"].includes(first ?? "");
+  const rls = isSqlKeyword(tokens[0], "alter") && isSqlKeyword(tokens[1], "table") && tokens.some((token, index) => isSqlKeyword(token, "row") && isSqlKeyword(tokens[index + 1], "level") && isSqlKeyword(tokens[index + 2], "security"));
+  if (!policy && !rls)
+    return void 0;
+  const reader = new PolicyReader(tokens);
+  reader.position = 2;
+  if (rls) {
+    rejectMigrationSqlReferences(tokens);
+    const target2 = reader.target();
+    const action = reader.take("enable") ? "enable" : reader.take("force") ? "force" : void 0;
+    if (action === void 0)
+      throw new DatabaseMigrationAdmissionError("destructive");
+    reader.expect("row");
+    reader.expect("level");
+    reader.expect("security");
+    reader.end();
+    return Object.freeze({ ...target2, action });
+  }
+  if (first === "drop" && reader.take("if"))
+    reader.expect("exists");
+  const policyName = reader.identifier();
+  reader.expect("on");
+  const target = reader.target();
+  rejectMigrationSqlReferences(tokens.slice(0, reader.position));
+  if (first === "drop") {
+    reader.take("restrict");
+    reader.end();
+    return Object.freeze({ ...target, policy: policyName, action: "drop" });
+  }
+  if (first === "create" && reader.take("as")) {
+    if (!reader.take("permissive"))
+      reader.expect("restrictive");
+  }
+  if (first === "create" && reader.take("for")) {
+    if (!["all", "select", "insert", "update", "delete"].some((command) => reader.take(command))) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+  }
+  if (reader.take("to"))
+    reader.expect("public");
+  let expression = false;
+  if (reader.take("using")) {
+    reader.expression();
+    expression = true;
+  }
+  if (reader.take("with")) {
+    reader.expect("check");
+    reader.expression();
+    expression = true;
+  }
+  reader.end();
+  if (first === "alter" && !expression)
+    throw new DatabaseMigrationAdmissionError("unsupported");
+  return Object.freeze({
+    ...target,
+    policy: policyName,
+    action: first === "create" ? "create" : "alter"
+  });
 }
-function admitStatement(statement) {
-  const normalized = normalizeStatement(statement);
+
+// packages/contracts/dist/database-migration-admission.js
+var MAX_MIGRATION_COUNT = 128;
+var MAX_MIGRATION_BYTES = 256 * 1024;
+var MAX_MIGRATION_TOTAL_BYTES = 2 * 1024 * 1024;
+var MIGRATION_PATH = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u;
+function admitExpandOnlyMigrations(migrations) {
+  if (!Array.isArray(migrations) || migrations.length === 0 || migrations.length > MAX_MIGRATION_COUNT) {
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+  let previousPath = "";
+  let totalBytes = 0;
+  let statementCount = 0;
+  const files = migrations.map((migration) => {
+    if (typeof migration !== "object" || migration === null || !MIGRATION_PATH.test(migration.path) || migration.path <= previousPath || !(migration.body instanceof Uint8Array) || migration.body.byteLength === 0 || migration.body.byteLength > MAX_MIGRATION_BYTES) {
+      throw new DatabaseMigrationAdmissionError("invalid");
+    }
+    previousPath = migration.path;
+    totalBytes += migration.body.byteLength;
+    if (totalBytes > MAX_MIGRATION_TOTAL_BYTES || migration.body.includes(0)) {
+      throw new DatabaseMigrationAdmissionError("invalid");
+    }
+    let sql;
+    try {
+      sql = new TextDecoder("utf-8", { fatal: true }).decode(migration.body);
+    } catch {
+      throw new DatabaseMigrationAdmissionError("invalid");
+    }
+    if (sql.length === 0 || sql.includes("\r") || sql.charCodeAt(0) === 65279) {
+      throw new DatabaseMigrationAdmissionError("invalid");
+    }
+    const statements = parseDatabaseMigrationStatements(sql);
+    statementCount += statements.length;
+    return Object.freeze({ path: migration.path, statementCount: statements.length });
+  });
+  return Object.freeze({ files: Object.freeze(files), statementCount });
+}
+function parseDatabaseMigrationStatements(sql) {
+  if (sql.length === 0 || sql.includes("\0") || sql.includes("\r") || sql.charCodeAt(0) === 65279) {
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+  const statements = readMigrationSql(sql);
+  if (statements.length === 0)
+    throw new DatabaseMigrationAdmissionError("invalid");
+  return Object.freeze(statements.map((statement) => {
+    rejectMigrationSqlReferences(statement.tokens, true);
+    const rlsTarget = readMigrationRlsTarget(statement.tokens);
+    if (rlsTarget !== void 0)
+      return Object.freeze({ sql: statement.sql, rlsTarget });
+    rejectMigrationSqlReferences(statement.tokens);
+    admitStatement(statement.tokens, statement.sql);
+    return Object.freeze({ sql: statement.sql });
+  }));
+}
+function rejectFunctionBodyReferences(sql) {
+  if (/\bohmyhost\b|\brow\s+level\s+security\b|\b(?:create|alter|drop)\s+policy\b|\bu&['"]/iu.test(sql)) {
+    throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+  const normalized = sql.toLowerCase();
+  const withoutPortableAuth = normalized.replace(/(?:\bauth|"auth")\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu, "");
+  if (/(?:\bauth|"auth")\s*\./u.test(withoutPortableAuth) || /(?:\bstorage|"storage")\s*\./u.test(normalized) || /\b(?:to|from)\s+(?:anon|authenticated|service_role)\b/u.test(normalized) || /\bsupabase\b/u.test(normalized)) {
+    throw new DatabaseMigrationAdmissionError("provider_specific");
+  }
+}
+function admitStatement(tokens, sql) {
+  const normalized = tokens.map((token) => token.kind === "string" ? "'literal'" : token.text.toLowerCase()).join(" ").replace(/\s*\.\s*/gu, ".");
   if (normalized === "set check_function_bodies = false")
     return;
   if (/^create\s+function\b/u.test(normalized)) {
+    rejectFunctionBodyReferences(sql);
     if (!/\blanguage\s+(?:sql|plpgsql)\b/u.test(normalized) || /\bsecurity\s+definer\b/u.test(normalized) && !/\bset\s+search_path\s*(?:=\s*|to\s+)/u.test(normalized)) {
       throw new DatabaseMigrationAdmissionError("unsupported");
     }
@@ -46923,9 +47113,6 @@ function admitStatement(statement) {
   }
   throw new DatabaseMigrationAdmissionError("unsupported");
 }
-function normalizeStatement(statement) {
-  return statement.replace(/--[^\n]*(?:\n|$)/gu, " ").replace(/\/\*[\s\S]*?\*\//gu, " ").trim().replace(/\s+/gu, " ").toLowerCase();
-}
 
 // apps/product-cli/dist/repository-init.js
 var MAXIMUM_PACKAGE_BYTES = 1024 * 1024;
@@ -47648,7 +47835,7 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
     const unsupported = compatibility.frameworks.filter((entry) => entry.classification === "unsupported").map((entry) => `${FRAMEWORK_PACKAGE[entry.framework]}@${entry.version || "missing"}`).join(", ");
     blockers.push({
       code: "framework_version_unsupported",
-      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.26+ (15.5.x) or 16.3.6\u201316.3.7, vite 5.4.0\u20138.2.2, @tanstack/react-start 1.168.26\u20131.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`
+      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.26+ (15.5.x) or 16.3.8, vite 5.4.0\u20138.2.2, @tanstack/react-start 1.168.26\u20131.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`
     });
   }
   const scripts = packageJson["scripts"];
@@ -47686,7 +47873,7 @@ function repositoryBlockers(packageJson, framework, nextStandaloneOutput, tanSta
     if (!nextConfigured) {
       blockers.push({
         code: "next_adapter_unconfigured",
-        message: 'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.26+ (15.5.x) or 16.3.6\u201316.3.7, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.'
+        message: 'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.26+ (15.5.x) or 16.3.8, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.'
       });
     }
   }

package/dist/index.js

@@ -99,7 +99,7 @@ import {
   selectWorkspace,
   verifiedUserId,
   workspaceOf
-} from "./chunk-Y4VB4EGQ.js";
+} from "./chunk-PRLVV4ZG.js";
 import {
   CredentialStoreIntegrityError,
   CredentialStoreUnavailableError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amerged/ohmyhost-cli",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "type": "module",
   "engines": {
     "node": ">=22"

package/src/apps/product-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/product-cli",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "private": true,
   "ohmyhost": {
     "deployment": "production",

package/src/apps/product-cli/src/repository-init.ts

@@ -1242,7 +1242,7 @@ function repositoryBlockers(
       .join(", ");
     blockers.push({
       code: "framework_version_unsupported",
-      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.26+ (15.5.x) or 16.3.6–16.3.7, vite 5.4.0–8.2.2, @tanstack/react-start 1.168.26–1.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`,
+      message: `${unsupported} is outside the versions ohmyho.st builds: next 15.5.26+ (15.5.x) or 16.3.8, vite 5.4.0–8.2.2, @tanstack/react-start 1.168.26–1.168.49, as an exact version or a ^ or ~ range whose base version is inside. Pin a version in that range in package.json, update the lockfile, commit and push.`,
     });
   }
   const scripts = packageJson["scripts"];
@@ -1297,7 +1297,7 @@ function repositoryBlockers(
       blockers.push({
         code: "next_adapter_unconfigured",
         message:
-          'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.26+ (15.5.x) or 16.3.6–16.3.7, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.',
+          'Next.js needs scripts.build exactly "next build" or "next build --webpack", react and react-dom at exact versions such as "19.1.0" (no ^ or ~), next within 15.5.26+ (15.5.x) or 16.3.8, and exactly one next.config.js, .mjs or .ts, with at most one open-next.config file. ohmyho.st adds the OpenNext build itself; do not make it the build script.',
       });
     }
   }

package/src/packages/contracts/src/database-migration-admission.ts

@@ -1,23 +1,23 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+import {
+  readMigrationSql,
+  rejectMigrationSqlReferences,
+  type MigrationSqlToken,
+} from "./database-migration-lexical.js";
+import {
+  readMigrationRlsTarget,
+  type DatabaseMigrationRlsTarget,
+} from "./database-migration-policies.js";
+
+export { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+export type { DatabaseMigrationAdmissionReason } from "./database-migration-errors.js";
+export type { DatabaseMigrationRlsTarget } from "./database-migration-policies.js";
+
 const MAX_MIGRATION_COUNT = 128;
 const MAX_MIGRATION_BYTES = 256 * 1024;
 const MAX_MIGRATION_TOTAL_BYTES = 2 * 1024 * 1024;
 const MIGRATION_PATH = /^(?:[A-Za-z0-9][A-Za-z0-9._-]*\/)*\d{14}_[a-z0-9][a-z0-9_-]*\.sql$/u;
 
-export type DatabaseMigrationAdmissionReason =
-  | "destructive"
-  | "invalid"
-  | "provider_specific"
-  | "unsupported";
-
-export class DatabaseMigrationAdmissionError extends Error {
-  public readonly code = "database_migration_not_admitted";
-
-  public constructor(public readonly reason: DatabaseMigrationAdmissionReason) {
-    super("Database migration is not admitted");
-    this.name = "DatabaseMigrationAdmissionError";
-  }
-}
-
 export interface DatabaseMigrationInput {
   readonly path: string;
   readonly body: Uint8Array;
@@ -67,127 +67,76 @@ export function admitExpandOnlyMigrations(
     if (sql.length === 0 || sql.includes("\r") || sql.charCodeAt(0) === 0xfeff) {
       throw new DatabaseMigrationAdmissionError("invalid");
     }
-    if (/\bohmyhost\b/iu.test(sql)) throw new DatabaseMigrationAdmissionError("unsupported");
-    rejectProviderSpecificSql(sql);
-    const statements = splitSqlStatements(sql);
-    if (statements.length === 0) throw new DatabaseMigrationAdmissionError("invalid");
-    for (const statement of statements) admitStatement(statement);
+    const statements = parseDatabaseMigrationStatements(sql);
     statementCount += statements.length;
     return Object.freeze({ path: migration.path, statementCount: statements.length });
   });
   return Object.freeze({ files: Object.freeze(files), statementCount });
 }
 
-function rejectProviderSpecificSql(sql: string): void {
+export interface DatabaseMigrationStatement {
+  readonly sql: string;
+  readonly rlsTarget?: DatabaseMigrationRlsTarget;
+}
+
+export function parseDatabaseMigrationStatements(
+  sql: string,
+): readonly DatabaseMigrationStatement[] {
+  if (
+    sql.length === 0 ||
+    sql.includes("\0") ||
+    sql.includes("\r") ||
+    sql.charCodeAt(0) === 0xfeff
+  ) {
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+  const statements = readMigrationSql(sql);
+  if (statements.length === 0) throw new DatabaseMigrationAdmissionError("invalid");
+  return Object.freeze(
+    statements.map((statement) => {
+      // Provider references are forbidden throughout executable policy SQL, while
+      // the native helper exception is narrowed by the policy reader below.
+      rejectMigrationSqlReferences(statement.tokens, true);
+      const rlsTarget = readMigrationRlsTarget(statement.tokens);
+      if (rlsTarget !== undefined) return Object.freeze({ sql: statement.sql, rlsTarget });
+      rejectMigrationSqlReferences(statement.tokens);
+      admitStatement(statement.tokens, statement.sql);
+      return Object.freeze({ sql: statement.sql });
+    }),
+  );
+}
+
+function rejectFunctionBodyReferences(sql: string): void {
+  if (
+    /\bohmyhost\b|\brow\s+level\s+security\b|\b(?:create|alter|drop)\s+policy\b|\bu&['"]/iu.test(
+      sql,
+    )
+  ) {
+    throw new DatabaseMigrationAdmissionError("unsupported");
+  }
   const normalized = sql.toLowerCase();
   const withoutPortableAuth = normalized.replace(
-    /\bauth\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu,
+    /(?:\bauth|"auth")\s*\.\s*"(?:account|ratelimit|session|user|verification)"/gu,
     "",
   );
   if (
-    /\bauth\s*\./u.test(withoutPortableAuth) ||
-    /\bstorage\s*\./u.test(normalized) ||
+    /(?:\bauth|"auth")\s*\./u.test(withoutPortableAuth) ||
+    /(?:\bstorage|"storage")\s*\./u.test(normalized) ||
     /\b(?:to|from)\s+(?:anon|authenticated|service_role)\b/u.test(normalized) ||
-    /\bcreate\s+policy\b/u.test(normalized) ||
-    /\brow\s+level\s+security\b/u.test(normalized) ||
     /\bsupabase\b/u.test(normalized)
   ) {
     throw new DatabaseMigrationAdmissionError("provider_specific");
   }
 }
 
-function splitSqlStatements(sql: string): readonly string[] {
-  const statements: string[] = [];
-  let start = 0;
-  let index = 0;
-  while (index < sql.length) {
-    const character = sql[index];
-    const next = sql[index + 1];
-    if (character === "-" && next === "-") {
-      index = skipLineComment(sql, index + 2);
-      continue;
-    }
-    if (character === "/" && next === "*") {
-      index = skipBlockComment(sql, index + 2);
-      continue;
-    }
-    if (character === "'") {
-      index = skipQuoted(sql, index + 1, "'");
-      continue;
-    }
-    if (character === '"') {
-      index = skipQuoted(sql, index + 1, '"');
-      continue;
-    }
-    if (character === "$") {
-      const delimiter = dollarDelimiter(sql, index);
-      if (delimiter !== null) {
-        const end = sql.indexOf(delimiter, index + delimiter.length);
-        if (end < 0) throw new DatabaseMigrationAdmissionError("invalid");
-        index = end + delimiter.length;
-        continue;
-      }
-    }
-    if (character === ";") {
-      const statement = sql.slice(start, index).trim();
-      if (statement.length > 0) statements.push(statement);
-      start = index + 1;
-    }
-    index += 1;
-  }
-  const tail = sql.slice(start).trim();
-  if (tail.length > 0) statements.push(tail);
-  return Object.freeze(statements);
-}
-
-function skipLineComment(sql: string, index: number): number {
-  const newline = sql.indexOf("\n", index);
-  return newline < 0 ? sql.length : newline + 1;
-}
-
-function skipBlockComment(sql: string, index: number): number {
-  let depth = 1;
-  while (index < sql.length) {
-    if (sql[index] === "/" && sql[index + 1] === "*") {
-      depth += 1;
-      index += 2;
-      continue;
-    }
-    if (sql[index] === "*" && sql[index + 1] === "/") {
-      depth -= 1;
-      index += 2;
-      if (depth === 0) return index;
-      continue;
-    }
-    index += 1;
-  }
-  throw new DatabaseMigrationAdmissionError("invalid");
-}
-
-function skipQuoted(sql: string, index: number, quote: "'" | '"'): number {
-  while (index < sql.length) {
-    if (sql[index] !== quote) {
-      index += 1;
-      continue;
-    }
-    if (sql[index + 1] === quote) {
-      index += 2;
-      continue;
-    }
-    return index + 1;
-  }
-  throw new DatabaseMigrationAdmissionError("invalid");
-}
-
-function dollarDelimiter(sql: string, index: number): string | null {
-  const match = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index));
-  return match?.[0] ?? null;
-}
-
-function admitStatement(statement: string): void {
-  const normalized = normalizeStatement(statement);
+function admitStatement(tokens: readonly MigrationSqlToken[], sql: string): void {
+  const normalized = tokens
+    .map((token) => (token.kind === "string" ? "'literal'" : token.text.toLowerCase()))
+    .join(" ")
+    .replace(/\s*\.\s*/gu, ".");
   if (normalized === "set check_function_bodies = false") return;
   if (/^create\s+function\b/u.test(normalized)) {
+    rejectFunctionBodyReferences(sql);
     if (
       !/\blanguage\s+(?:sql|plpgsql)\b/u.test(normalized) ||
       (/\bsecurity\s+definer\b/u.test(normalized) &&
@@ -224,12 +173,3 @@ function admitStatement(statement: string): void {
   }
   throw new DatabaseMigrationAdmissionError("unsupported");
 }
-
-function normalizeStatement(statement: string): string {
-  return statement
-    .replace(/--[^\n]*(?:\n|$)/gu, " ")
-    .replace(/\/\*[\s\S]*?\*\//gu, " ")
-    .trim()
-    .replace(/\s+/gu, " ")
-    .toLowerCase();
-}

package/src/packages/contracts/src/database-migration-errors.ts

@@ -0,0 +1,14 @@
+export type DatabaseMigrationAdmissionReason =
+  | "destructive"
+  | "invalid"
+  | "provider_specific"
+  | "unsupported";
+
+export class DatabaseMigrationAdmissionError extends Error {
+  public readonly code = "database_migration_not_admitted";
+
+  public constructor(public readonly reason: DatabaseMigrationAdmissionReason) {
+    super("Database migration is not admitted");
+    this.name = "DatabaseMigrationAdmissionError";
+  }
+}

package/src/packages/contracts/src/database-migration-lexical.ts

@@ -0,0 +1,180 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+
+export interface MigrationSqlToken {
+  readonly kind: "word" | "identifier" | "string" | "symbol";
+  readonly value: string;
+  readonly text: string;
+}
+
+export interface MigrationSqlStatement {
+  readonly sql: string;
+  readonly tokens: readonly MigrationSqlToken[];
+}
+
+/** SQL-aware boundaries only; PostgreSQL remains the expression parser. */
+export function readMigrationSql(sql: string): readonly MigrationSqlStatement[] {
+  const statements: MigrationSqlStatement[] = [];
+  let tokens: MigrationSqlToken[] = [];
+  let start = 0;
+  let index = 0;
+  while (index < sql.length) {
+    const character = sql[index] ?? "";
+    const next = sql[index + 1];
+    if (/\s/u.test(character)) {
+      index += 1;
+      continue;
+    }
+    if (character === "-" && next === "-") {
+      const newline = sql.indexOf("\n", index + 2);
+      index = newline < 0 ? sql.length : newline + 1;
+      continue;
+    }
+    if (character === "/" && next === "*") {
+      index = skipBlockComment(sql, index + 2);
+      continue;
+    }
+    if (character === ";") {
+      if (tokens.length > 0) {
+        statements.push(Object.freeze({ sql: sql.slice(start, index + 1).trim(), tokens }));
+      }
+      tokens = [];
+      start = ++index;
+      continue;
+    }
+    const tokenStart = index;
+    let kind: MigrationSqlToken["kind"] = "symbol";
+    let value = character;
+    if (/[uU]/u.test(character) && next === "&" && /['"]/u.test(sql[index + 2] ?? "")) {
+      // Unicode escapes can conceal reserved schema identifiers.
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    if (character === "'" || character === '"' || (/[eE]/u.test(character) && next === "'")) {
+      const escaped = character !== "'" && character !== '"';
+      const quote = character === '"' ? '"' : "'";
+      const quoteStart = index + (escaped ? 1 : 0);
+      index = skipQuoted(sql, quoteStart + 1, quote, escaped);
+      kind = quote === '"' ? "identifier" : "string";
+      value = sql.slice(quoteStart + 1, index - 1).replace(/""/gu, '"');
+    } else if (character === "$" && /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.test(sql.slice(index))) {
+      const delimiter = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/u.exec(sql.slice(index))?.[0] ?? "";
+      const end = sql.indexOf(delimiter, index + delimiter.length);
+      if (end < 0) throw new DatabaseMigrationAdmissionError("invalid");
+      index = end + delimiter.length;
+      kind = "string";
+      value = sql.slice(tokenStart, index);
+    } else if (/[\p{L}_]/u.test(character)) {
+      index += 1;
+      while (index < sql.length && /[\p{L}\p{N}_$]/u.test(sql[index] ?? "")) index += 1;
+      kind = "word";
+      value = sql.slice(tokenStart, index).toLowerCase();
+    } else {
+      index += 1;
+    }
+    tokens.push(Object.freeze({ kind, value, text: sql.slice(tokenStart, index) }));
+  }
+  if (tokens.length > 0) statements.push(Object.freeze({ sql: sql.slice(start).trim(), tokens }));
+  return Object.freeze(statements);
+}
+
+function skipBlockComment(sql: string, index: number): number {
+  let depth = 1;
+  while (index < sql.length) {
+    if (sql[index] === "/" && sql[index + 1] === "*") {
+      depth += 1;
+      index += 2;
+    } else if (sql[index] === "*" && sql[index + 1] === "/") {
+      depth -= 1;
+      index += 2;
+      if (depth === 0) return index;
+    } else {
+      index += 1;
+    }
+  }
+  throw new DatabaseMigrationAdmissionError("invalid");
+}
+
+function skipQuoted(sql: string, index: number, quote: string, escaped: boolean): number {
+  while (index < sql.length) {
+    if (escaped && sql[index] === "\\") {
+      index += 2;
+    } else if (sql[index] === quote) {
+      if (sql[index + 1] === quote) {
+        index += 2;
+      } else {
+        const continuation = quote === "'" ? continuedStringStart(sql, index + 1) : undefined;
+        if (continuation === undefined) return index + 1;
+        // Keep the initial E-string's escape semantics in every continuation.
+        index = continuation;
+      }
+    } else {
+      index += 1;
+    }
+  }
+  throw new DatabaseMigrationAdmissionError("invalid");
+}
+
+function continuedStringStart(sql: string, index: number): number | undefined {
+  // Match PostgreSQL scan.l quotecontinue with a linear scan: at least one
+  // newline, with line comments as whitespace. Block comments end continuation.
+  let newline = false;
+  while (index < sql.length) {
+    const character = sql[index] ?? "";
+    if (/[ \t\f\v\n\r]/u.test(character)) {
+      newline ||= character === "\n" || character === "\r";
+      index += 1;
+    } else if (character === "-" && sql[index + 1] === "-") {
+      index += 2;
+      while (index < sql.length && sql[index] !== "\n" && sql[index] !== "\r") index += 1;
+    } else {
+      return character === "'" && newline ? index + 1 : undefined;
+    }
+  }
+  return undefined;
+}
+
+export function isSqlKeyword(token: MigrationSqlToken | undefined, value: string): boolean {
+  return token?.kind === "word" && token.value === value;
+}
+
+export function rejectMigrationSqlReferences(
+  tokens: readonly MigrationSqlToken[],
+  allowIdentityHelpers = false,
+): void {
+  for (let index = 0; index < tokens.length; index += 1) {
+    const token = tokens[index];
+    if (token?.kind !== "word" && token?.kind !== "identifier") continue;
+    const value = token.value.toLowerCase();
+    if (value === "ohmyhost") {
+      if (
+        allowIdentityHelpers &&
+        token.value === "ohmyhost" &&
+        tokens[index + 1]?.kind === "symbol" &&
+        tokens[index + 1]?.value === "." &&
+        ["user_id", "claims"].includes(tokens[index + 2]?.value ?? "") &&
+        ["word", "identifier"].includes(tokens[index + 2]?.kind ?? "") &&
+        tokens[index + 3]?.kind === "symbol" &&
+        tokens[index + 3]?.value === "(" &&
+        tokens[index + 4]?.kind === "symbol" &&
+        tokens[index + 4]?.value === ")"
+      )
+        continue;
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    const portableAuthTable = tokens[index + 2];
+    if (
+      (value === "auth" &&
+        tokens[index + 1]?.value === "." &&
+        !(
+          portableAuthTable?.kind === "identifier" &&
+          ["account", "rateLimit", "ratelimit", "session", "user", "verification"].includes(
+            portableAuthTable.value,
+          )
+        )) ||
+      (value === "storage" && tokens[index + 1]?.value === ".") ||
+      value === "supabase" ||
+      ((value === "to" || value === "from") &&
+        ["anon", "authenticated", "service_role"].includes(tokens[index + 1]?.value ?? ""))
+    )
+      throw new DatabaseMigrationAdmissionError("provider_specific");
+  }
+}

package/src/packages/contracts/src/database-migration-policies.ts

@@ -0,0 +1,150 @@
+import { DatabaseMigrationAdmissionError } from "./database-migration-errors.js";
+import {
+  isSqlKeyword,
+  rejectMigrationSqlReferences,
+  type MigrationSqlToken,
+} from "./database-migration-lexical.js";
+
+export interface DatabaseMigrationRlsTarget {
+  readonly schema: "public" | "private";
+  readonly table: string;
+  readonly policy?: string;
+  readonly action: "create" | "alter" | "drop" | "enable" | "force";
+}
+
+class PolicyReader {
+  public position = 0;
+
+  public constructor(private readonly tokens: readonly MigrationSqlToken[]) {}
+
+  public take(keyword: string): boolean {
+    if (!isSqlKeyword(this.tokens[this.position], keyword)) return false;
+    this.position += 1;
+    return true;
+  }
+
+  public expect(keyword: string): void {
+    if (!this.take(keyword)) throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+
+  public identifier(): string {
+    const token = this.tokens[this.position++];
+    if (
+      (token?.kind !== "word" && token?.kind !== "identifier") ||
+      token.value.length === 0 ||
+      new TextEncoder().encode(token.value).byteLength > 63
+    ) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return token.value;
+  }
+
+  public target(): Readonly<{ schema: "public" | "private"; table: string }> {
+    const schema = this.identifier();
+    const separator = this.tokens[this.position++];
+    if (
+      (schema !== "public" && schema !== "private") ||
+      separator?.kind !== "symbol" ||
+      separator.value !== "."
+    ) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+    return { schema, table: this.identifier() };
+  }
+
+  public expression(): void {
+    const opening = this.tokens[this.position++];
+    if (opening?.kind !== "symbol" || opening.value !== "(")
+      throw new DatabaseMigrationAdmissionError("invalid");
+    const start = this.position;
+    let depth = 1;
+    while (this.position < this.tokens.length) {
+      const token = this.tokens[this.position++];
+      if (token?.kind !== "symbol") continue;
+      if (token.value === "(") depth += 1;
+      if (token.value === ")") depth -= 1;
+      if (depth === 0) {
+        if (this.position - 1 === start) throw new DatabaseMigrationAdmissionError("invalid");
+        rejectMigrationSqlReferences(this.tokens.slice(start, this.position - 1), true);
+        return;
+      }
+    }
+    throw new DatabaseMigrationAdmissionError("invalid");
+  }
+
+  public end(): void {
+    if (this.position !== this.tokens.length)
+      throw new DatabaseMigrationAdmissionError("unsupported");
+  }
+}
+
+export function readMigrationRlsTarget(
+  tokens: readonly MigrationSqlToken[],
+): DatabaseMigrationRlsTarget | undefined {
+  const first = tokens[0]?.value;
+  const policy =
+    tokens[0]?.kind === "word" &&
+    isSqlKeyword(tokens[1], "policy") &&
+    ["create", "alter", "drop"].includes(first ?? "");
+  const rls =
+    isSqlKeyword(tokens[0], "alter") &&
+    isSqlKeyword(tokens[1], "table") &&
+    tokens.some(
+      (token, index) =>
+        isSqlKeyword(token, "row") &&
+        isSqlKeyword(tokens[index + 1], "level") &&
+        isSqlKeyword(tokens[index + 2], "security"),
+    );
+  if (!policy && !rls) return undefined;
+  // Header and table identifiers must never use the reserved namespace. Helpers
+  // are admitted separately, only inside balanced policy expressions.
+  const reader = new PolicyReader(tokens);
+  reader.position = 2;
+  if (rls) {
+    rejectMigrationSqlReferences(tokens);
+    const target = reader.target();
+    const action = reader.take("enable") ? "enable" : reader.take("force") ? "force" : undefined;
+    if (action === undefined) throw new DatabaseMigrationAdmissionError("destructive");
+    reader.expect("row");
+    reader.expect("level");
+    reader.expect("security");
+    reader.end();
+    return Object.freeze({ ...target, action });
+  }
+  if (first === "drop" && reader.take("if")) reader.expect("exists");
+  const policyName = reader.identifier();
+  reader.expect("on");
+  const target = reader.target();
+  rejectMigrationSqlReferences(tokens.slice(0, reader.position));
+  if (first === "drop") {
+    reader.take("restrict");
+    reader.end();
+    return Object.freeze({ ...target, policy: policyName, action: "drop" });
+  }
+  if (first === "create" && reader.take("as")) {
+    if (!reader.take("permissive")) reader.expect("restrictive");
+  }
+  if (first === "create" && reader.take("for")) {
+    if (!["all", "select", "insert", "update", "delete"].some((command) => reader.take(command))) {
+      throw new DatabaseMigrationAdmissionError("unsupported");
+    }
+  }
+  if (reader.take("to")) reader.expect("public");
+  let expression = false;
+  if (reader.take("using")) {
+    reader.expression();
+    expression = true;
+  }
+  if (reader.take("with")) {
+    reader.expect("check");
+    reader.expression();
+    expression = true;
+  }
+  reader.end();
+  if (first === "alter" && !expression) throw new DatabaseMigrationAdmissionError("unsupported");
+  return Object.freeze({
+    ...target,
+    policy: policyName,
+    action: first === "create" ? "create" : "alter",
+  });
+}

package/src/packages/contracts/src/framework-admission.ts

@@ -129,7 +129,7 @@ export interface FrameworkVersionAdmission {
 const VERIFIED_VERSIONS: Readonly<Record<AdmittedFramework, ReadonlySet<string>>> = Object.freeze({
   vite: new Set(["5.4.21", "8.0.16", "8.2.2"]),
   "tanstack-start": new Set(["1.168.26", "1.168.49"]),
-  nextjs: new Set(["15.5.26", "16.3.7"]),
+  nextjs: new Set(["15.5.26", "16.3.8"]),
 });
 
 export function classifyFrameworkVersion(

package/src/packages/contracts/src/framework-build-script.mjs

@@ -14,8 +14,7 @@ export function isAdmittedNextVersion(version) {
   const patch = Number(match[3]);
   if (![major, minor, patch].every(Number.isSafeInteger)) return false;
   return (
-    (major === 15 && minor === 5 && patch >= 26) ||
-    (major === 16 && minor === 3 && patch >= 6 && patch <= 7)
+    (major === 15 && minor === 5 && patch >= 26) || (major === 16 && minor === 3 && patch === 8)
   );
 }
 

package/src/packages/sdk-ts/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ohmyhost/sdk-ts",
-  "version": "0.1.29",
+  "version": "0.1.30",
   "private": true,
   "type": "module",
   "exports": {