@devdogsuga/devtools 0.1.51-next.549 → 0.1.51-next.551

package/README.md

@@ -106,17 +106,17 @@ pnpm devtools setup
 
 Anywhere else, the one-off form is `pnpm dlx @devdogsuga/devtools@next setup`.
 
-| Command                                 | What it does                                                                                                                                                               |
-| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `setup [--local \| --hosted]`           | Writes `.env` from `.env.example`; starts the Docker stack (or takes your own hosted project's URL, keys and session-pooler `DB_URL`); `db sync`; the types; then `oauth`. |
-| `db sync [--rebuild] [--yes]`           | Makes your development database match `supabase/schemas/`. Never resets it; `--rebuild` is the explicit reset (local only) and registers sign in again afterwards.         |
-| `db types [--download] [--pack <file>]` | Generates the TypeScript types or Dart models from your database, or downloads the ones CI built for your exact schema hash. `--pack` writes the release asset (CI).       |
-| `db hash`                               | Prints the schema hash that names the generated types.                                                                                                                     |
-| `dev-data [--member <email\|id>]`       | Runs the product's `devData.file` SQL, in one transaction, as the member who last signed in with DevDogs. Refuses the product's production project.                        |
-| `oauth`                                 | "Sign in with DevDogs" on your database (the same wizard as the platform's).                                                                                               |
-| `doctor`                                | Docker, the pinned Supabase CLI, `.env`, the database, whether the types match the schema.                                                                                 |
-| `supabase <args>`                       | The Supabase CLI at the version the product pins.                                                                                                                          |
-| `check env-example`                     | CI: `.env.example` holds public values only (it ships in the app).                                                                                                         |
+| Command                                  | What it does                                                                                                                                                                                                                                                                                                               |
+| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `setup [--local \| --hosted]`            | Writes `.env` from `.env.example`; starts the Docker stack (or takes your own hosted project's URL, keys and session-pooler `DB_URL`); `db sync`; the types; then `oauth`.                                                                                                                                                 |
+| `db sync [--rebuild] [--strict] [--yes]` | Makes your development database match `supabase/schemas/`: recreates what it lost, applies schema changes you pulled, warns about extras (`--strict` fails on them), refuses to alter what is defined differently. Never resets it; `--rebuild` is the explicit reset (local only) and registers sign in again afterwards. |
+| `db types [--download] [--pack <file>]`  | Generates the TypeScript types or Dart models from your database, or downloads the ones CI built for your exact schema hash. `--pack` writes the release asset (CI).                                                                                                                                                       |
+| `db hash`                                | Prints the schema hash that names the generated types.                                                                                                                                                                                                                                                                     |
+| `dev-data [--member <email\|id>]`        | Runs the product's `devData.file` SQL, in one transaction, as the member who last signed in with DevDogs. Refuses the product's production project.                                                                                                                                                                        |
+| `oauth`                                  | "Sign in with DevDogs" on your database (the same wizard as the platform's).                                                                                                                                                                                                                                               |
+| `doctor`                                 | Docker, the pinned Supabase CLI, `.env`, the database, whether the types match the schema.                                                                                                                                                                                                                                 |
+| `supabase <args>`                        | The Supabase CLI at the version the product pins.                                                                                                                                                                                                                                                                          |
+| `check env-example`                      | CI: `.env.example` holds public values only (it ships in the app).                                                                                                                                                                                                                                                         |
 
 How it works, in short:
 

package/dist/{cli-Doy2BzCQ.js → cli-xAkuiAkl.js}

@@ -1,7 +1,7 @@
 import { n as execSync, r as spawnProcess } from "./spawn-BvLQzc_K.js";
 import { n as discoverRepoRoot, r as findRepoRoot } from "./root-RaJ8ECCO.js";
 import { A as findApp, M as listApps, N as resolveAppPath, O as appWorkspaceRoot, P as resolveLayout, _ as dryRunKind, c as supabaseRoot, d as loadEnvLoad, f as loadEnvSession, g as runInGroup, h as reportRan, i as runWithStderr, j as layoutAt, k as devdogsugaRootOrNull, l as getEnvSync, n as reportRuns, o as supabase, p as repoPeerUrl, r as run$1, t as dbPush, u as loadEnv, v as isDryRun, x as wouldRunLine } from "./run-D5iI9zve.js";
-import { A as renderHelp, C as loadProductConfig, D as catalog, M as probeEnvironment, O as helpPath, T as isProductMode, _ as explain, a as recordEnteredTier, b as ProductConfigError, c as nonEmpty, d as sessionLabel, g as errorMessage, h as bail, i as beginInvocation, j as describeEnvironment, k as renderCommandList, l as resolveDbConnection, n as bareGroupStartPath, o as recordResolved, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as sessionIsLocal, v as explainError, w as activeCatalog, x as currentProduct, y as unwrap } from "./menu-CZK0L1Vf.js";
+import { A as renderHelp, C as loadProductConfig, D as catalog, M as probeEnvironment, O as helpPath, T as isProductMode, _ as explain, a as recordEnteredTier, b as ProductConfigError, c as nonEmpty, d as sessionLabel, g as errorMessage, h as bail, i as beginInvocation, j as describeEnvironment, k as renderCommandList, l as resolveDbConnection, n as bareGroupStartPath, o as recordResolved, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as sessionIsLocal, v as explainError, w as activeCatalog, x as currentProduct, y as unwrap } from "./menu-Ctqnvduz.js";
 import { a as isVersionRequest, c as cliName, m as positionals, o as ownPackageDir, p as flagValue, s as ownVersion } from "./failure-log-MSdCgvLc.js";
 import { f as hasYes, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive } from "./telemetry-BDOwjuoC.js";
 import { t as runStackCommand } from "./stack-CzNe6rxl.js";
@@ -7058,7 +7058,7 @@ function commandLine(command, args) {
 function cliLine(cli, args) {
 	return commandLine(cli.command, [...cli.prefix, ...args]);
 }
-function versionOf(output) {
+function versionOf$1(output) {
 	return /\b(\d+\.\d+\.\d+)\b/.exec(output)?.[1] ?? null;
 }
 async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
@@ -7076,7 +7076,7 @@ async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
 	});
 	for (const candidate of candidates) try {
 		const result = await run(candidate.command, ["--version"], { cwd: root });
-		if (result.code === 0 && versionOf(result.stdout) === pin) return candidate;
+		if (result.code === 0 && versionOf$1(result.stdout) === pin) return candidate;
 	} catch {}
 	try {
 		if ((await run("pnpm", ["--version"], { cwd: root })).code === 0) return {
@@ -7303,6 +7303,27 @@ function postgresSession(dbUrl) {
 			const present = new Set(rows.map((r) => r.nspname));
 			return schemas.filter((name) => !present.has(name));
 		},
+		async existingObjects(schemas) {
+			const list = [...schemas];
+			const found = /* @__PURE__ */ new Set();
+			const functions = await sql`
+        select n.nspname as s, p.proname as n from pg_proc p
+        join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = any(${list})`;
+			for (const r of functions) found.add(`function:${r.s}.${r.n}`);
+			const views = await sql`
+        select n.nspname as s, c.relname as n from pg_class c
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and c.relkind in ('v', 'm')`;
+			for (const r of views) found.add(`view:${r.s}.${r.n}`);
+			const triggers = await sql`
+        select n.nspname as s, c.relname as t, g.tgname as n from pg_trigger g
+        join pg_class c on c.oid = g.tgrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and not g.tgisinternal`;
+			for (const r of triggers) found.add(`trigger:${r.s}.${r.t}:${r.n}`);
+			return found;
+		},
 		async exec(text) {
 			await sql.begin(async (tx) => {
 				await tx.unsafe(text);
@@ -7563,6 +7584,319 @@ function typesAssetName(product, hash) {
 	return `${product}-types-${hash}.tgz`;
 }
 //#endregion
+//#region src/product/drift.ts
+/** Splits SQL at top-level semicolons, honoring quotes, dollar quotes and comments. Comments are dropped. */
+function splitStatements(sql) {
+	const out = [];
+	let current = "";
+	let i = 0;
+	const push = () => {
+		const text = current.trim();
+		if (text) out.push(text);
+		current = "";
+	};
+	while (i < sql.length) {
+		const ch = sql[i];
+		const next = sql[i + 1];
+		if (ch === "-" && next === "-") {
+			while (i < sql.length && sql[i] !== "\n") i++;
+			continue;
+		}
+		if (ch === "/" && next === "*") {
+			const end = sql.indexOf("*/", i + 2);
+			i = end === -1 ? sql.length : end + 2;
+			current += " ";
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			let j = i + 1;
+			while (j < sql.length) {
+				if (sql[j] === ch) {
+					if (sql[j + 1] === ch) {
+						j += 2;
+						continue;
+					}
+					break;
+				}
+				j++;
+			}
+			current += sql.slice(i, j + 1);
+			i = j + 1;
+			continue;
+		}
+		if (ch === "$") {
+			const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i))?.[0];
+			if (tag) {
+				const end = sql.indexOf(tag, i + tag.length);
+				const stop = end === -1 ? sql.length : end + tag.length;
+				current += sql.slice(i, stop);
+				i = stop;
+				continue;
+			}
+		}
+		if (ch === ";") {
+			push();
+			i++;
+			continue;
+		}
+		current += ch;
+		i++;
+	}
+	push();
+	return out;
+}
+/** Splits `text` at commas that are not inside parentheses or quotes. */
+function splitTopLevel(text) {
+	const parts = [];
+	let depth = 0;
+	let quote = null;
+	let start = 0;
+	for (let i = 0; i < text.length; i++) {
+		const ch = text[i];
+		if (quote) {
+			if (ch === quote) quote = null;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			parts.push(text.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	parts.push(text.slice(start).trim());
+	return parts.filter(Boolean);
+}
+const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})*`;
+/** `"a"."b"` -> ["a", "b"]; unquoted names fold to lower case like Postgres. */
+function parts(name) {
+	return (name.match(new RegExp(IDENT, "g")) ?? []).map((part) => part.startsWith("\"") ? part.slice(1, -1).replace(/""/g, "\"") : part.toLowerCase());
+}
+function qualified(name) {
+	return parts(name).join(".");
+}
+function shown(name) {
+	return parts(name).map((part) => `"${part}"`).join(".");
+}
+const CREATE_KINDS = {
+	SCHEMA: "schema",
+	TABLE: "table",
+	"FOREIGN TABLE": "table",
+	SEQUENCE: "sequence",
+	TYPE: "type",
+	DOMAIN: "type",
+	VIEW: "view",
+	"MATERIALIZED VIEW": "view",
+	FUNCTION: "function",
+	PROCEDURE: "function"
+};
+const WORD = (word) => new RegExp(`^${word}\\b`, "i");
+/**
+* Classifies the statements of a live diff. `existing` is what the live
+* database has (for `CREATE OR REPLACE`, which reads the same whether the
+* object is missing or merely different).
+*/
+function classifyDiff(sql, existing) {
+	const creates = [];
+	const drops = [];
+	const conflicts = /* @__PURE__ */ new Map();
+	const extras = [];
+	const preamble = [];
+	const privileges = [];
+	let sawRevoke = false;
+	const conflict = (object, why) => {
+		const set = conflicts.get(object) ?? /* @__PURE__ */ new Set();
+		set.add(why);
+		conflicts.set(object, set);
+	};
+	for (const statement of splitStatements(sql)) {
+		const text = statement.replace(/\s+/g, " ");
+		if (WORD("SET").test(text)) {
+			preamble.push(statement);
+			continue;
+		}
+		if (WORD("GRANT").test(text)) {
+			privileges.push({
+				sql: statement,
+				target: null,
+				finding: null
+			});
+			continue;
+		}
+		if (WORD("REVOKE").test(text)) {
+			sawRevoke = true;
+			const on = new RegExp(String.raw`\bON\s+(?:(?:TABLE|SEQUENCE|FUNCTION|SCHEMA|TYPE|DOMAIN)\s+)?(${QNAME})(?:\s*\([^)]*\))?\s+FROM\s+(.+)$`, "i").exec(text);
+			privileges.push({
+				sql: statement,
+				target: on ? qualified(on[1]) : "",
+				finding: {
+					object: on ? `privileges on ${shown(on[1])}` : "privileges",
+					detail: on ? `granted to ${on[2].replace(/"/g, "")} beyond (or instead of) what supabase/schemas grants` : "differ from what supabase/schemas grants"
+				}
+			});
+			continue;
+		}
+		const create = new RegExp(String.raw`^CREATE\s+(OR\s+REPLACE\s+)?(?:UNIQUE\s+)?(?:TEMP(?:ORARY)?\s+)?(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|CONSTRAINT TRIGGER)\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT}(?:\s*\.\s*${IDENT})*)(.*)$`, "is").exec(text);
+		if (create) {
+			const replace = Boolean(create[1]);
+			const kindWord = create[2].toUpperCase().replace(/\s+/g, " ");
+			const name = create[3];
+			const rest = create[4];
+			let key;
+			let label;
+			if (kindWord === "INDEX") {
+				key = `index:${parts(name).at(-1)}`;
+				label = `index ${shown(name)}`;
+			} else if (kindWord === "POLICY" || kindWord === "TRIGGER" || kindWord === "CONSTRAINT TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const table = on ? qualified(on[1]) : "?";
+				const noun = kindWord === "POLICY" ? "policy" : "trigger";
+				key = `${noun}:${table}:${parts(name).at(-1)}`;
+				label = `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`;
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				key = `${kind}:${qualified(name)}`;
+				label = `${kind} ${shown(name)}`;
+			}
+			if (replace && existing.has(key)) conflict(label, "its definition differs from supabase/schemas");
+			else creates.push({
+				key,
+				sql: statement,
+				label
+			});
+			continue;
+		}
+		const drop = new RegExp(String.raw`^DROP\s+(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|EXTENSION)\s+(?:IF\s+EXISTS\s+)?(${QNAME})(.*)$`, "is").exec(text);
+		if (drop) {
+			const kindWord = drop[1].toUpperCase();
+			const name = drop[2];
+			const rest = drop[3];
+			if (kindWord === "INDEX") drops.push({
+				key: `index:${parts(name).at(-1)}`,
+				finding: {
+					object: `index ${shown(name)}`,
+					detail: "not in supabase/schemas"
+				}
+			});
+			else if (kindWord === "POLICY" || kindWord === "TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const noun = kindWord.toLowerCase();
+				drops.push({
+					key: `${noun}:${on ? qualified(on[1]) : "?"}:${parts(name).at(-1)}`,
+					finding: {
+						object: `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				drops.push({
+					key: `${kind}:${qualified(name)}`,
+					finding: {
+						object: `${kind} ${shown(name)}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			}
+			continue;
+		}
+		const alterTable = new RegExp(String.raw`^ALTER\s+(?:FOREIGN\s+)?TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${QNAME})\s+(.*)$`, "is").exec(text);
+		if (alterTable) {
+			const table = alterTable[1];
+			const t = qualified(table);
+			for (const action of splitTopLevel(alterTable[2])) classifyTableAction(table, t, action, {
+				creates,
+				drops,
+				conflict
+			});
+			continue;
+		}
+		const alterType = new RegExp(String.raw`^ALTER\s+TYPE\s+(${QNAME})\s+ADD\s+VALUE\b`, "i").exec(text);
+		if (alterType) {
+			creates.push({
+				key: `enumvalue:${statement}`,
+				sql: statement,
+				label: `a value of type ${shown(alterType[1])}`
+			});
+			continue;
+		}
+		conflict(text.slice(0, 80), "a difference devtools does not know how to classify, so it will not touch it");
+	}
+	const created = new Set(creates.map((c) => c.key));
+	const dropped = new Set(drops.map((d) => d.key));
+	const restoring = creates.filter((c) => !dropped.has(c.key));
+	for (const d of drops) if (created.has(d.key)) conflict(d.finding.object, "it is defined differently from supabase/schemas");
+	else extras.push(d.finding);
+	const newNames = new Set(restoring.map((c) => c.key).filter((key) => !/^(index|policy|trigger|column|constraint|rls)/.test(key)).map((key) => key.slice(key.indexOf(":") + 1)));
+	const tail = [];
+	let grants = 0;
+	for (const p of privileges) if (p.target === null) {
+		tail.push(p.sql);
+		grants++;
+	} else if (newNames.has(p.target)) tail.push(p.sql);
+	else if (p.finding) extras.push(p.finding);
+	const restore = [];
+	const restored = restoring.map((c) => c.label);
+	if (restoring.length > 0 || grants > 0) restore.push(...preamble, ...restoring.map((c) => c.sql), ...tail);
+	if (restoring.length === 0 && grants > 0 && !sawRevoke) restored.push("privileges");
+	return {
+		restore,
+		restored,
+		extras: dedupe(extras),
+		conflicts: [...conflicts].map(([object, why]) => ({
+			object,
+			detail: [...why].join("; ")
+		}))
+	};
+}
+function dedupe(findings) {
+	const seen = /* @__PURE__ */ new Set();
+	return findings.filter((f) => {
+		const key = `${f.object}|${f.detail}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function classifyTableAction(table, t, action, ctx) {
+	const sql = `ALTER TABLE ${table} ${action}`;
+	let m;
+	if (m = new RegExp(String.raw`^ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.creates.push({
+		key: `column:${t}.${parts(m[1])[0]}`,
+		sql,
+		label: `column ${shown(table)}.${shown(m[1])}`
+	});
+	else if (m = new RegExp(String.raw`^ADD\s+CONSTRAINT\s+(${IDENT})`, "i").exec(action)) ctx.creates.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		sql,
+		label: `constraint ${shown(m[1])} on ${shown(table)}`
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `column:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `column ${shown(table)}.${shown(m[1])}`,
+			detail: "not in supabase/schemas"
+		}
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `constraint ${shown(m[1])} on ${shown(table)}`,
+			detail: "not in supabase/schemas"
+		}
+	});
+	else if (m = new RegExp(String.raw`^ALTER\s+COLUMN\s+(${IDENT})\s+(.*)$`, "i").exec(action)) {
+		const what = m[2];
+		const aspect = /^(?:SET\s+DATA\s+)?TYPE\b/i.test(what) ? "type" : /\bDEFAULT\b/i.test(what) ? "default" : /\bNOT\s+NULL\b/i.test(what) ? "nullability" : "definition";
+		ctx.conflict(`column ${shown(table)}.${shown(m[1])}`, `its ${aspect} differs from supabase/schemas`);
+	} else if (/^(?:ENABLE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/i.test(action)) ctx.creates.push({
+		key: `rls:${t}:${action.toUpperCase()}`,
+		sql,
+		label: `row level security on ${shown(table)}`
+	});
+	else ctx.conflict(`table ${shown(table)}`, `a change devtools will not make for you (${action.slice(0, 60)})`);
+}
+//#endregion
 //#region src/product/sync.ts
 /**
 * `db sync`: make the contributor's development database match
@@ -7586,6 +7920,26 @@ function typesAssetName(product, hash) {
 * Without that, the diff would start from an empty database and write the whole
 * schema as one migration, which `db push` rejects as already applied.
 *
+* The record only says what *should* be in the database, so before the diff,
+* sync compares the live database with it (`supabase db diff --from <database>
+* --to migrations --use-pg-delta`, limited to the product's schemas) and sorts
+* every difference (`drift.ts`):
+*
+*   - missing (a dropped table, schema, column, index, policy, function; a
+*     missing migration ledger): recreated. Only CREATE and ADD statements are
+*     ever run, and the ledger is rewritten from the local record.
+*   - extra (a table, column, index or sequence a member added): listed as a
+*     warning and left alone. `--strict` fails on them instead.
+*   - conflicting (a column's type, a function body, ... defined differently
+*     in the database and the schema files): refused. Nothing is altered
+*     silently; the member edits the schema files or runs `--rebuild`.
+*
+* "Matches" is only ever said after that comparison ran. If it cannot run
+* (the database is unreachable, the password is wrong, the diff tool fails)
+* the sync fails and says so. A schema change the member pulled is a
+* different thing: it is the difference between the files and the record, and
+* keeps the declarative path below, including the `--yes` question for drops.
+*
 * It never resets the database. A reset wipes `auth.custom_oauth_providers`,
 * which is where "Sign in with DevDogs" is registered (Q83); `--rebuild` is
 * the explicit escape hatch for a database that has drifted from its record,
@@ -7607,8 +7961,147 @@ function destructiveStatements(sql) {
 function migrationFiles(dir) {
 	return existsSync(dir) ? readdirSync(dir).filter((name) => name.endsWith(".sql")).sort() : [];
 }
+const NOTHING = {
+	restored: [],
+	extras: [],
+	compared: false
+};
+/** `20261011120000` from `20261011120000_devtools_sync.sql`. */
+function versionOf(file) {
+	return file.split("_")[0] ?? file;
+}
+/** The connection string and its password never reach the terminal. */
+function redactor(target) {
+	const secrets = /* @__PURE__ */ new Set([target.dbUrl]);
+	try {
+		const url = new URL(target.dbUrl);
+		for (const value of [url.password, decodeURIComponent(url.password)]) if (value) secrets.add(value);
+	} catch {}
+	return (text) => {
+		let out = text;
+		for (const secret of [...secrets].sort((a, b) => b.length - a.length)) out = out.split(secret).join(secret === target.dbUrl ? "<DB_URL>" : "<password>");
+		return out;
+	};
+}
+function liveDiffArgs(product, target) {
+	return [
+		"db",
+		"diff",
+		"--from",
+		target.kind === "local" ? "local" : target.dbUrl,
+		"--to",
+		"migrations",
+		"--use-pg-delta",
+		"--schema",
+		product.config.supabase.schemas.join(","),
+		"--output-format",
+		"json"
+	];
+}
+/**
+* The SQL that would turn the live database into what the record describes
+* (pg-delta, database to migrations). Never applied as is. A diff that cannot
+* run is an error: there is no fallback to trusting the record.
+*/
+async function liveDiff(product, cli, target, run, log, redact) {
+	const args = [...cli.prefix, ...liveDiffArgs(product, target)];
+	let result = await run(cli.command, args, { cwd: product.root });
+	if (result.code !== 0 && isContainerFailure(result)) {
+		log("The shadow database did not start; trying once more.");
+		result = await run(cli.command, args, { cwd: product.root });
+	}
+	const raw = result.stdout + "\n" + result.stderr;
+	let parsed = null;
+	for (const line of result.stdout.split("\n").reverse()) {
+		const text = line.trim();
+		if (!text.startsWith("{")) continue;
+		try {
+			parsed = JSON.parse(text);
+			break;
+		} catch {}
+	}
+	if (result.code === 0 && parsed && typeof parsed.diff === "string") return parsed.diff;
+	const reason = typeof parsed?.error?.message === "string" ? parsed.error.message : result.stderr.trim() || result.stdout.trim();
+	throw new SyncError(isContainerFailure({
+		stdout: "",
+		stderr: raw
+	}) && !parsed?.error ? "Could not compare the database with supabase/schemas: Docker is needed for the shadow database. Start Docker and try again. Nothing was changed,, and the database was not checked against supabase/schemas." : "Could not compare the database with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(reason));
+}
+/** Lists the headline objects; their constraints, policies and the like are a count. */
+function summarize(labels) {
+	const major = labels.filter((label) => /^(schema|table|function|view|sequence|type|column) /.test(label));
+	if (major.length === 0 || major.length === labels.length) return labels.join(", ");
+	const rest = labels.length - major.length;
+	return `${major.join(", ")} (and ${rest} related ${rest === 1 ? "thing" : "things"}: constraints, policies, indexes)`;
+}
+/** How to clean up a database that has things the schema files do not define. */
+function cleanupHint(target) {
+	return target.kind === "local" ? "To clean up: `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data` to load the sample data again." : "To clean up: reset the project from its dashboard (Database > Settings), then run `devtools db sync` and `devtools dev-data`.";
+}
+function listFindings(findings) {
+	return findings.map((f) => `- ${f.object}: ${f.detail}`).join("\n");
+}
+/**
+* Compares the live database with the record and puts right what is safe.
+* See the header comment for the three kinds of difference.
+*/
+async function reconcileLive(product, cli, target, run, options, log, warn, redact) {
+	const files = migrationFiles(product.paths.migrationsDir);
+	if (!options.open || files.length === 0) return NOTHING;
+	const { schemas } = product.config.supabase;
+	let session;
+	let ledger;
+	let existing;
+	try {
+		session = options.open(target.dbUrl);
+		ledger = await session.appliedMigrations();
+		existing = await session.existingObjects(schemas);
+	} catch (err) {
+		await session?.close().catch(() => void 0);
+		throw new SyncError("Could not connect to the database to compare it with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(err.message));
+	}
+	try {
+		const drift = classifyDiff(await liveDiff(product, cli, target, run, log, redact), existing);
+		if (drift.extras.length > 0 && !options.strict) warn(`Your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. They are left as they are:\n${listFindings(drift.extras)}\n${cleanupHint(target)}`);
+		if (drift.conflicts.length > 0) throw new SyncError(`Your database defines ${drift.conflicts.length} thing${drift.conflicts.length === 1 ? "" : "s"} differently from supabase/schemas. devtools will not change them for you, and nothing was changed.`, `${listFindings(drift.conflicts)}\nIf the database is right, edit supabase/schemas to match it. If the schema files are right, ${target.kind === "local" ? "run `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data`" : "reset the project from its dashboard (Database > Settings), then run `devtools db sync` and `devtools dev-data`"}.`);
+		if (options.strict && drift.extras.length > 0) throw new SyncError(`--strict: your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. Nothing was changed or deleted.`, `${listFindings(drift.extras)}\n${cleanupHint(target)}`);
+		if (drift.restore.length > 0) {
+			if (drift.restored.length > 0) log(`Your database is missing ${summarize(drift.restored)}; creating ${drift.restored.length === 1 ? "it" : "them"} again from supabase/schemas. Nothing that already exists is changed.`);
+			try {
+				await session.exec(drift.restore.join(";\n") + ";");
+			} catch (err) {
+				throw new SyncError("Could not recreate what the database is missing; nothing was changed.", `${redact(err.message)}\n${target.kind === "local" ? "`devtools db sync --rebuild` starts over (it wipes your development database)." : "Reset the project from its dashboard (Database > Settings), then run `devtools db sync`."}`);
+			}
+		}
+		const known = new Set(ledger ?? []);
+		const unlisted = files.map(versionOf).filter((version) => !known.has(version));
+		if (unlisted.length > 0) {
+			if (ledger === null) log("The database has no migration history table; recreating it from the local record.");
+			const repaired = await run(cli.command, [
+				...cli.prefix,
+				"migration",
+				"repair",
+				"--status",
+				"applied",
+				"--db-url",
+				target.dbUrl,
+				...unlisted
+			], { cwd: product.root });
+			if (repaired.code !== 0) throw new SyncError("Could not record the applied migrations in the database's history.", redact(repaired.stderr || repaired.stdout));
+		}
+		return {
+			restored: drift.restored,
+			extras: drift.extras,
+			compared: true
+		};
+	} finally {
+		await session.close().catch(() => void 0);
+	}
+}
 async function dbSync(product, cli, target, run, options) {
 	const log = options.log ?? (() => void 0);
+	const warn = options.warn ?? log;
+	const redact = redactor(target);
 	const { migrationsDir, schemasDir } = product.paths;
 	if (!existsSync(schemasDir)) throw new SyncError(`${product.config.supabase.dir}/schemas does not exist; there is nothing to sync.`);
 	mkdirSync(migrationsDir, { recursive: true });
@@ -7637,6 +8130,7 @@ async function dbSync(product, cli, target, run, options) {
 			"--db-url",
 			"<DB_URL>"
 		])} (this machine has no record of what the project has had applied)`);
+		if (options.open) log(`Would run: ${cliLine(cli, liveDiffArgs(product, target).map((arg) => arg === target.dbUrl ? "<DB_URL>" : arg))} (and recreate anything the database is missing; extras are only listed)`);
 		log(`Would run: ${cliLine(cli, generateArgs.slice(cli.prefix.length))}`);
 		log(target.kind === "local" ? `Would run: ${cliLine(cli, [
 			"migration",
@@ -7652,28 +8146,35 @@ async function dbSync(product, cli, target, run, options) {
 		return {
 			migration: null,
 			applied: false,
-			destructive: []
+			destructive: [],
+			...NOTHING
 		};
 	}
 	if (needsRecord) {
 		const fetched = await run(cli.command, fetchArgs, { cwd: product.root });
-		const restored = migrationFiles(migrationsDir).length;
-		if (fetched.code === 0 && restored > 0) log(`Restored ${restored} applied migration${restored === 1 ? "" : "s"} from the project's history.`);
+		const restoredFiles = migrationFiles(migrationsDir).length;
+		if (fetched.code === 0 && restoredFiles > 0) log(`Restored ${restoredFiles} applied migration${restoredFiles === 1 ? "" : "s"} from the project's history.`);
 	}
+	const live = await reconcileLive(product, cli, target, run, options, log, warn, redact);
+	const restoredSomething = live.restored.length > 0;
 	const before = new Set(migrationFiles(migrationsDir));
 	let generated = await run(cli.command, generateArgs, { cwd: product.root });
 	if (generated.code !== 0 && isContainerFailure(generated)) {
 		log("The shadow database did not start; trying once more.");
 		generated = await run(cli.command, generateArgs, { cwd: product.root });
 	}
-	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", generated.stderr || generated.stdout);
+	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", redact(generated.stderr || generated.stdout));
 	const created = migrationFiles(migrationsDir).filter((f) => !before.has(f));
 	if (created.length === 0) {
-		log("The database already matches supabase/schemas.");
+		if (live.compared && !restoredSomething) {
+			const n = live.extras.length;
+			log(n === 0 ? "The database already matches supabase/schemas." : `The database matches supabase/schemas, with ${n} extra thing${n === 1 ? "" : "s"} listed above that it does not define.`);
+		}
 		return {
 			migration: null,
-			applied: false,
-			destructive: []
+			applied: restoredSomething,
+			destructive: [],
+			...live
 		};
 	}
 	const migration = created[created.length - 1];
@@ -7702,12 +8203,13 @@ async function dbSync(product, cli, target, run, options) {
 	const applied = await run(cli.command, applyArgs, { cwd: product.root });
 	if (applied.code !== 0) {
 		for (const file of created) rmSync(join(migrationsDir, file));
-		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", applied.stderr || applied.stdout);
+		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", redact(applied.stderr || applied.stdout));
 	}
 	return {
 		migration,
 		applied: true,
-		destructive
+		destructive,
+		...live
 	};
 }
 function isContainerFailure(result) {
@@ -7972,7 +8474,10 @@ async function runSync(product, deps, rest) {
 		yes: hasYes(rest),
 		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
 		dryRun,
-		log: (line) => log.info(line)
+		strict: rest.includes("--strict"),
+		log: (line) => log.info(line),
+		warn: (line) => log.warn(line),
+		open: deps.openSql
 	});
 	if (rest.includes("--rebuild") && !dryRun) try {
 		const row = await reRegisterSavedProvider(product.paths.toolingFile, target);
@@ -7997,7 +8502,7 @@ async function regenerateAfterSync(product, cli, target, result, deps) {
 		log.info(`Would regenerate ${product.config.types.out}.`);
 		return;
 	}
-	if (!result.migration && typesAreCurrent(product)) return;
+	if (!result.applied && typesAreCurrent(product)) return;
 	try {
 		await generateTypes(product, cli, target, deps.run, (line) => log.info(line));
 		log.success(`Regenerated ${product.config.types.out}.`);
@@ -8043,7 +8548,7 @@ function createProductHandlers(deps = defaultDeps) {
 		switch (sub) {
 			case "sync": {
 				const { result, cli, target } = await runSync(product, deps, flags);
-				if (result.migration) log.success("Your database now matches supabase/schemas.");
+				if (result.applied) log.success(result.extras.length > 0 ? `Your database now matches supabase/schemas, apart from the ${result.extras.length} extra thing${result.extras.length === 1 ? "" : "s"} listed above.` : "Your database now matches supabase/schemas.");
 				await regenerateAfterSync(product, cli, target, result, deps);
 				return DONE;
 			}
@@ -8273,9 +8778,12 @@ async function runSetup(product, deps, rest) {
 	const result = await dbSync(product, cli, target, deps.run, {
 		yes: hasYes(rest),
 		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
-		log: (line) => log.info(line)
+		log: (line) => log.info(line),
+		warn: (line) => log.warn(line),
+		open: deps.openSql
 	});
-	log.success(result.migration ? "Applied supabase/schemas to your database." : "Your database already matched supabase/schemas.");
+	if (result.applied) log.success("Applied supabase/schemas to your database.");
+	else if (result.compared) log.success("Your database already matched supabase/schemas.");
 	if (target.kind === "local") await waitForRest(target, deps, product);
 	if (rest.includes("--download-types")) try {
 		await downloadTypes(product, {

package/dist/launch.js

@@ -1,6 +1,6 @@
 import { i as markOutsideCheckout, n as discoverRepoRoot, r as findRepoRoot, t as RepoNotFoundError } from "./root-RaJ8ECCO.js";
 import { b as setDryRun, d as loadEnvLoad, f as loadEnvSession, m as formatCommand, v as isDryRun, y as resolveDryRun } from "./run-D5iI9zve.js";
-import { D as catalog, E as setProductMode, N as setEnvironmentRoot, O as helpPath, S as findProductRoot, c as nonEmpty, f as enterSessionEnvironment, g as errorMessage, h as bail, m as setMenuEnvHook, n as bareGroupStartPath, p as realEnvEntryDeps, y as unwrap } from "./menu-CZK0L1Vf.js";
+import { D as catalog, E as setProductMode, N as setEnvironmentRoot, O as helpPath, S as findProductRoot, c as nonEmpty, f as enterSessionEnvironment, g as errorMessage, h as bail, m as setMenuEnvHook, n as bareGroupStartPath, p as realEnvEntryDeps, y as unwrap } from "./menu-Ctqnvduz.js";
 import { a as isVersionRequest, c as cliName, t as installFailureLog } from "./failure-log-MSdCgvLc.js";
 import { c as lastSentryEventId, f as hasYes, h as stripTierFlag, m as stripNoEnvFlag, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive } from "./telemetry-BDOwjuoC.js";
 import { confirm, select } from "@clack/prompts";
@@ -183,7 +183,7 @@ async function startStack() {
 * post-tier-resolution path.
 */
 async function dispatch(argv) {
-	const { main } = await import("./cli-Doy2BzCQ.js");
+	const { main } = await import("./cli-xAkuiAkl.js");
 	try {
 		await main(argv);
 	} catch (err) {

package/dist/{menu-CZK0L1Vf.js → menu-Ctqnvduz.js}

@@ -946,7 +946,7 @@ const productDbCommand = {
 		{
 			name: "sync",
 			title: "Apply the schema to my database",
-			summary: "Diff supabase/schemas against what your database has had applied, and apply the difference.",
+			summary: "Compare your database with supabase/schemas: recreate what it is missing, apply schema changes you pulled, warn about extras, and refuse to alter what is defined differently.",
 			envFree: true,
 			dryRun: "handled",
 			options: [
@@ -955,6 +955,10 @@ const productDbCommand = {
 					flag: "--rebuild",
 					summary: "Reset the local database and start over from the schema, then register sign in again."
 				},
+				{
+					flag: "--strict",
+					summary: "Fail (changing nothing) when the database has things supabase/schemas does not define, instead of warning."
+				},
 				{
 					flag: "--yes",
 					summary: "Allow changes that drop tables or columns."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.51-next.549",
+  "version": "0.1.51-next.551",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for DevDogs repositories (the platform monorepo, DogDays, DogPack): the real tools with the session's tier filled in, `setup`, `db sync`, `db types`, `dev-data`, a menu over them, the checks CI runs, and the `with-env` launcher. Ships built JS; run via `pnpm devtools` in a product repo, `pnpm dlx @devdogsuga/devtools` (or the `devtools` bin once installed) from inside a clone.",
@@ -47,8 +47,8 @@
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
     "@devdogsuga/cli-core": "0.0.0",
-    "@devdogsuga/config": "0.1.4-next.526",
-    "@devdogsuga/sdk": "0.1.0"
+    "@devdogsuga/sdk": "0.1.0",
+    "@devdogsuga/config": "0.1.4-next.526"
   },
   "scripts": {
     "build": "tsdown && node scripts/write-build-info.mjs && node ../../scripts/check-bundle-imports.mjs",