@devdogsuga/devtools 0.1.51-next.549 → 0.1.51-next.552

package/README.md

@@ -106,17 +106,17 @@ pnpm devtools setup
 
 Anywhere else, the one-off form is `pnpm dlx @devdogsuga/devtools@next setup`.
 
-| Command                                 | What it does                                                                                                                                                               |
-| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `setup [--local \| --hosted]`           | Writes `.env` from `.env.example`; starts the Docker stack (or takes your own hosted project's URL, keys and session-pooler `DB_URL`); `db sync`; the types; then `oauth`. |
-| `db sync [--rebuild] [--yes]`           | Makes your development database match `supabase/schemas/`. Never resets it; `--rebuild` is the explicit reset (local only) and registers sign in again afterwards.         |
-| `db types [--download] [--pack <file>]` | Generates the TypeScript types or Dart models from your database, or downloads the ones CI built for your exact schema hash. `--pack` writes the release asset (CI).       |
-| `db hash`                               | Prints the schema hash that names the generated types.                                                                                                                     |
-| `dev-data [--member <email\|id>]`       | Runs the product's `devData.file` SQL, in one transaction, as the member who last signed in with DevDogs. Refuses the product's production project.                        |
-| `oauth`                                 | "Sign in with DevDogs" on your database (the same wizard as the platform's).                                                                                               |
-| `doctor`                                | Docker, the pinned Supabase CLI, `.env`, the database, whether the types match the schema.                                                                                 |
-| `supabase <args>`                       | The Supabase CLI at the version the product pins.                                                                                                                          |
-| `check env-example`                     | CI: `.env.example` holds public values only (it ships in the app).                                                                                                         |
+| Command                                  | What it does                                                                                                                                                                                                                                                                                                               |
+| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `setup [--local \| --hosted]`            | Writes `.env` from `.env.example`; starts the Docker stack (or takes your own hosted project's URL, keys and session-pooler `DB_URL`); `db sync`; the types; then `oauth`.                                                                                                                                                 |
+| `db sync [--rebuild] [--strict] [--yes]` | Makes your development database match `supabase/schemas/`: recreates what it lost, applies schema changes you pulled, warns about extras (`--strict` fails on them), refuses to alter what is defined differently. Never resets it; `--rebuild` is the explicit reset (local only) and registers sign in again afterwards. |
+| `db types [--download] [--pack <file>]`  | Generates the TypeScript types or Dart models from your database, or downloads the ones CI built for your exact schema hash. `--pack` writes the release asset (CI).                                                                                                                                                       |
+| `db hash`                                | Prints the schema hash that names the generated types.                                                                                                                                                                                                                                                                     |
+| `dev-data [--member <email\|id>]`        | Runs the product's `devData.file` SQL, in one transaction, as the member who last signed in with DevDogs. Refuses the product's production project.                                                                                                                                                                        |
+| `oauth`                                  | "Sign in with DevDogs" on your database (the same wizard as the platform's).                                                                                                                                                                                                                                               |
+| `doctor`                                 | Docker, the pinned Supabase CLI, `.env`, the database, whether the types match the schema.                                                                                                                                                                                                                                 |
+| `supabase <args>`                        | The Supabase CLI at the version the product pins.                                                                                                                                                                                                                                                                          |
+| `check env-example`                      | CI: `.env.example` holds public values only (it ships in the app).                                                                                                                                                                                                                                                         |
 
 How it works, in short:
 
@@ -127,7 +127,14 @@ How it works, in short:
   needs `--yes`. It then regenerates the types (and leaves them alone when nothing changed and they are current).
   On a hosted project, a machine with no record (a second laptop, a deleted `supabase/migrations/`) first
   restores it from the project's own history table (`migration fetch --db-url`), so the diff is not taken
-  against an empty database.
+  against an empty database. The record belongs to one database (`.devtools/record.json` notes which, and which
+  files it has applied): another target's record is set aside and that database's own history is fetched, and a
+  migration written but never applied is pending, not applied; it is applied on the next sync, with the `--yes`
+  question for drops.
+- **What a member changed.** A column that looks renamed (missing here, an extra of the same type beside it) is
+  refused, not recreated empty. A difference in privileges on something that exists is applied as a GRANT of what
+  `supabase/schemas` grants and reported; privileges beyond that are not taken away. Functions are named with
+  their argument types, and a missing overload is recreated beside the member's own.
 - **Types are never committed.** `db types` writes them to the path in the config, which is git-ignored.
   The schema hash covers the sorted schema paths, their LF-normalised contents and the generator version (the
   pinned CLI, or supadart); CI uploads a `<product>-types-<hash>.tgz` asset to a rolling `generated-types`

package/dist/{cli-Doy2BzCQ.js → cli-DfHsw0fp.js}

@@ -1,7 +1,7 @@
 import { n as execSync, r as spawnProcess } from "./spawn-BvLQzc_K.js";
 import { n as discoverRepoRoot, r as findRepoRoot } from "./root-RaJ8ECCO.js";
 import { A as findApp, M as listApps, N as resolveAppPath, O as appWorkspaceRoot, P as resolveLayout, _ as dryRunKind, c as supabaseRoot, d as loadEnvLoad, f as loadEnvSession, g as runInGroup, h as reportRan, i as runWithStderr, j as layoutAt, k as devdogsugaRootOrNull, l as getEnvSync, n as reportRuns, o as supabase, p as repoPeerUrl, r as run$1, t as dbPush, u as loadEnv, v as isDryRun, x as wouldRunLine } from "./run-D5iI9zve.js";
-import { A as renderHelp, C as loadProductConfig, D as catalog, M as probeEnvironment, O as helpPath, T as isProductMode, _ as explain, a as recordEnteredTier, b as ProductConfigError, c as nonEmpty, d as sessionLabel, g as errorMessage, h as bail, i as beginInvocation, j as describeEnvironment, k as renderCommandList, l as resolveDbConnection, n as bareGroupStartPath, o as recordResolved, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as sessionIsLocal, v as explainError, w as activeCatalog, x as currentProduct, y as unwrap } from "./menu-CZK0L1Vf.js";
+import { A as renderHelp, C as loadProductConfig, D as catalog, M as probeEnvironment, O as helpPath, T as isProductMode, _ as explain, a as recordEnteredTier, b as ProductConfigError, c as nonEmpty, d as sessionLabel, g as errorMessage, h as bail, i as beginInvocation, j as describeEnvironment, k as renderCommandList, l as resolveDbConnection, n as bareGroupStartPath, o as recordResolved, r as runMenu, s as reproducibleCommand, t as bareGroupStartFlags, u as sessionIsLocal, v as explainError, w as activeCatalog, x as currentProduct, y as unwrap } from "./menu-Ctqnvduz.js";
 import { a as isVersionRequest, c as cliName, m as positionals, o as ownPackageDir, p as flagValue, s as ownVersion } from "./failure-log-MSdCgvLc.js";
 import { f as hasYes, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive } from "./telemetry-BDOwjuoC.js";
 import { t as runStackCommand } from "./stack-CzNe6rxl.js";
@@ -7058,7 +7058,7 @@ function commandLine(command, args) {
 function cliLine(cli, args) {
 	return commandLine(cli.command, [...cli.prefix, ...args]);
 }
-function versionOf(output) {
+function versionOf$1(output) {
 	return /\b(\d+\.\d+\.\d+)\b/.exec(output)?.[1] ?? null;
 }
 async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
@@ -7076,7 +7076,7 @@ async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
 	});
 	for (const candidate of candidates) try {
 		const result = await run(candidate.command, ["--version"], { cwd: root });
-		if (result.code === 0 && versionOf(result.stdout) === pin) return candidate;
+		if (result.code === 0 && versionOf$1(result.stdout) === pin) return candidate;
 	} catch {}
 	try {
 		if ((await run("pnpm", ["--version"], { cwd: root })).code === 0) return {
@@ -7303,6 +7303,43 @@ function postgresSession(dbUrl) {
 			const present = new Set(rows.map((r) => r.nspname));
 			return schemas.filter((name) => !present.has(name));
 		},
+		async existingObjects(schemas) {
+			const list = [...schemas];
+			const found = /* @__PURE__ */ new Set();
+			const functions = await sql`
+        select n.nspname as s, p.proname as n,
+               oidvectortypes(p.proargtypes) as sig
+        from pg_proc p
+        join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = any(${list}) and p.prokind in ('f', 'p')`;
+			for (const r of functions) {
+				found.add(`function:${r.s}.${r.n}`);
+				found.add(`signature:${r.s}.${r.n}(${r.sig})`);
+			}
+			const views = await sql`
+        select n.nspname as s, c.relname as n from pg_class c
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and c.relkind in ('v', 'm')`;
+			for (const r of views) found.add(`view:${r.s}.${r.n}`);
+			const triggers = await sql`
+        select n.nspname as s, c.relname as t, g.tgname as n from pg_trigger g
+        join pg_class c on c.oid = g.tgrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and not g.tgisinternal`;
+			for (const r of triggers) found.add(`trigger:${r.s}.${r.t}:${r.n}`);
+			return found;
+		},
+		async columnTypes(schemas) {
+			const rows = await sql`
+        select n.nspname as s, c.relname as t, a.attname as c,
+               format_type(a.atttypid, a.atttypmod) as type
+        from pg_attribute a
+        join pg_class c on c.oid = a.attrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${[...schemas]}) and c.relkind in ('r', 'p', 'f')
+          and a.attnum > 0 and not a.attisdropped`;
+			return new Map(rows.map((r) => [`${r.s}.${r.t}.${r.c}`, r.type]));
+		},
 		async exec(text) {
 			await sql.begin(async (tx) => {
 				await tx.unsafe(text);
@@ -7563,6 +7600,467 @@ function typesAssetName(product, hash) {
 	return `${product}-types-${hash}.tgz`;
 }
 //#endregion
+//#region src/product/drift.ts
+/** Splits SQL at top-level semicolons, honoring quotes, dollar quotes and comments. Comments are dropped. */
+function splitStatements(sql) {
+	const out = [];
+	let current = "";
+	let i = 0;
+	const push = () => {
+		const text = current.trim();
+		if (text) out.push(text);
+		current = "";
+	};
+	while (i < sql.length) {
+		const ch = sql[i];
+		const next = sql[i + 1];
+		if (ch === "-" && next === "-") {
+			while (i < sql.length && sql[i] !== "\n") i++;
+			continue;
+		}
+		if (ch === "/" && next === "*") {
+			const end = sql.indexOf("*/", i + 2);
+			i = end === -1 ? sql.length : end + 2;
+			current += " ";
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			let j = i + 1;
+			while (j < sql.length) {
+				if (sql[j] === ch) {
+					if (sql[j + 1] === ch) {
+						j += 2;
+						continue;
+					}
+					break;
+				}
+				j++;
+			}
+			current += sql.slice(i, j + 1);
+			i = j + 1;
+			continue;
+		}
+		if (ch === "$") {
+			const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i))?.[0];
+			if (tag) {
+				const end = sql.indexOf(tag, i + tag.length);
+				const stop = end === -1 ? sql.length : end + tag.length;
+				current += sql.slice(i, stop);
+				i = stop;
+				continue;
+			}
+		}
+		if (ch === ";") {
+			push();
+			i++;
+			continue;
+		}
+		current += ch;
+		i++;
+	}
+	push();
+	return out;
+}
+/** Splits `text` at commas that are not inside parentheses or quotes. */
+function splitTopLevel(text) {
+	const parts = [];
+	let depth = 0;
+	let quote = null;
+	let start = 0;
+	for (let i = 0; i < text.length; i++) {
+		const ch = text[i];
+		if (quote) {
+			if (ch === quote) quote = null;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			parts.push(text.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	parts.push(text.slice(start).trim());
+	return parts.filter(Boolean);
+}
+const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})*`;
+/** `"a"."b"` -> ["a", "b"]; unquoted names fold to lower case like Postgres. */
+function parts(name) {
+	return (name.match(new RegExp(IDENT, "g")) ?? []).map((part) => part.startsWith("\"") ? part.slice(1, -1).replace(/""/g, "\"") : part.toLowerCase());
+}
+function qualified(name) {
+	return parts(name).join(".");
+}
+function shown(name) {
+	return parts(name).map((part) => `"${part}"`).join(".");
+}
+const TYPE_ALIASES = {
+	int: "integer",
+	int4: "integer",
+	int8: "bigint",
+	int2: "smallint",
+	bool: "boolean",
+	float8: "double precision",
+	float4: "real",
+	varchar: "character varying",
+	bpchar: "character",
+	timestamptz: "timestamp with time zone",
+	timetz: "time with time zone",
+	decimal: "numeric"
+};
+/** `Int4[ ]`, `pg_catalog.text`, `"text"` -> a comparable spelling. */
+function normalizeType(type) {
+	let t = type.trim().replace(/\s+/g, " ").toLowerCase();
+	const array = /(\s*\[\d*\])+$/.exec(t)?.[0] ?? "";
+	t = t.slice(0, t.length - array.length);
+	t = t.replace(/^pg_catalog\./, "").replace(/"/g, "");
+	t = t.replace(/\s*\(.*\)$/, (m) => m.replace(/\s+/g, ""));
+	const base = /^([a-z0-9_ ]+?)(\(.*\))?$/.exec(t);
+	const head = base?.[1]?.trim() ?? t;
+	const tail = base?.[2] ?? "";
+	return `${TYPE_ALIASES[head] ?? head}${tail}${array.replace(/\s/g, "")}`;
+}
+/** The text inside the first balanced parentheses of `text`, or null. */
+function balanced(text) {
+	const start = text.indexOf("(");
+	if (start === -1) return null;
+	let depth = 0;
+	let quote = null;
+	for (let i = start; i < text.length; i++) {
+		const ch = text[i];
+		if (quote) {
+			if (ch === quote) quote = null;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")" && --depth === 0) return text.slice(start + 1, i);
+	}
+	return null;
+}
+const MULTIWORD_HEADS = /* @__PURE__ */ new Set([
+	"double",
+	"timestamp",
+	"time",
+	"character",
+	"bit",
+	"national",
+	"interval"
+]);
+/**
+* The argument types of a function's parameter list, as the database spells
+* them: `a int, OUT b text, c text DEFAULT 'x'` -> `(integer, text)`.
+*/
+function signatureOf(argList) {
+	const types = [];
+	for (let arg of splitTopLevel(argList)) {
+		if (/^(OUT|TABLE)\b/i.test(arg)) continue;
+		arg = arg.replace(/^(?:IN\s+OUT|INOUT|IN|VARIADIC)\s+/i, "");
+		const dflt = /\s+DEFAULT\s|\s*=\s*/i.exec(arg);
+		if (dflt) arg = arg.slice(0, dflt.index);
+		arg = arg.trim();
+		const named = new RegExp(`^(${IDENT})\\s+(.+)$`, "s").exec(arg);
+		let type = arg;
+		if (named) {
+			const head = named[1].toLowerCase();
+			const second = named[2].split(/[\s(]/)[0].toLowerCase();
+			if (!(MULTIWORD_HEADS.has(head) && (/^(precision|with|without|varying)$/.test(second) || named[2].startsWith("(")))) type = named[2];
+		}
+		types.push(normalizeType(type));
+	}
+	return `(${types.join(", ")})`;
+}
+/** Normalizes the `function:s.n(types)` spelling the database reports. */
+function normalizeKeySignature(types) {
+	return signatureOf(types);
+}
+/** Reads what a GRANT or REVOKE is on. */
+function privilegeOf(text, revoke) {
+	const on = new RegExp(String.raw`\bON\s+(?:(TABLE|SEQUENCE|FUNCTION|PROCEDURE|SCHEMA|TYPE|DOMAIN)\s+)?(${QNAME})(\s*\(.*\))?\s+(?:FROM|TO)\s+(.+)$`, "is").exec(text);
+	const base = {
+		sql: text,
+		revoke,
+		targets: [],
+		base: "",
+		object: null,
+		from: ""
+	};
+	if (!on) return base;
+	const kind = (on[1] ?? "").toUpperCase();
+	const name = on[2];
+	const isFunction = kind === "FUNCTION" || kind === "PROCEDURE";
+	const sig = isFunction ? signatureOf(balanced(on[3] ?? "") ?? "") : "";
+	const object = `${qualified(name)}${sig}`;
+	const columns = isFunction ? [] : [...text.slice(0, on.index).matchAll(/\(([^)]*)\)/g)].flatMap((m) => m[1].split(",").map((c) => parts(c)[0]).filter((c) => Boolean(c)));
+	return {
+		...base,
+		base: object,
+		targets: columns.length > 0 ? columns.map((c) => `${object}.${c}`) : [object],
+		object: `privileges on ${isFunction ? "function " : ""}${shown(name)}${sig}`,
+		from: on[4].replace(/"/g, "")
+	};
+}
+const CREATE_KINDS = {
+	SCHEMA: "schema",
+	TABLE: "table",
+	"FOREIGN TABLE": "table",
+	SEQUENCE: "sequence",
+	TYPE: "type",
+	DOMAIN: "type",
+	VIEW: "view",
+	"MATERIALIZED VIEW": "view",
+	FUNCTION: "function",
+	PROCEDURE: "function"
+};
+const WORD = (word) => new RegExp(`^${word}\\b`, "i");
+/**
+* Classifies the statements of a live diff. `existing` is what the live
+* database has (for `CREATE OR REPLACE`, which reads the same whether the
+* object is missing or merely different).
+*/
+function classifyDiff(sql, existing, columnTypes = /* @__PURE__ */ new Map()) {
+	const signatures = /* @__PURE__ */ new Set();
+	for (const key of existing) {
+		const m = /^signature:(.*?)\((.*)\)$/.exec(key);
+		if (m) signatures.add(`${m[1]}${normalizeKeySignature(m[2])}`);
+	}
+	const creates = [];
+	const drops = [];
+	const conflicts = /* @__PURE__ */ new Map();
+	const extras = [];
+	const preamble = [];
+	const privileges = [];
+	const conflict = (object, why) => {
+		const set = conflicts.get(object) ?? /* @__PURE__ */ new Set();
+		set.add(why);
+		conflicts.set(object, set);
+	};
+	for (const statement of splitStatements(sql)) {
+		const text = statement.replace(/\s+/g, " ");
+		if (WORD("SET").test(text)) {
+			preamble.push(statement);
+			continue;
+		}
+		if (WORD("GRANT").test(text) || WORD("REVOKE").test(text)) {
+			const p = privilegeOf(text, WORD("REVOKE").test(text));
+			privileges.push({
+				...p,
+				sql: statement
+			});
+			continue;
+		}
+		const create = new RegExp(String.raw`^CREATE\s+(OR\s+REPLACE\s+)?(?:UNIQUE\s+)?(?:TEMP(?:ORARY)?\s+)?(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|CONSTRAINT TRIGGER)\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT}(?:\s*\.\s*${IDENT})*)(.*)$`, "is").exec(text);
+		if (create) {
+			const replace = Boolean(create[1]);
+			const kindWord = create[2].toUpperCase().replace(/\s+/g, " ");
+			const name = create[3];
+			const rest = create[4];
+			let key;
+			let label;
+			if (kindWord === "INDEX") {
+				key = `index:${parts(name).at(-1)}`;
+				label = `index ${shown(name)}`;
+			} else if (kindWord === "POLICY" || kindWord === "TRIGGER" || kindWord === "CONSTRAINT TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const table = on ? qualified(on[1]) : "?";
+				const noun = kindWord === "POLICY" ? "policy" : "trigger";
+				key = `${noun}:${table}:${parts(name).at(-1)}`;
+				label = `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`;
+			} else if (kindWord === "FUNCTION" || kindWord === "PROCEDURE") {
+				const sig = signatureOf(balanced(rest) ?? "");
+				key = `function:${qualified(name)}${sig}`;
+				label = `function ${shown(name)}${sig}`;
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				key = `${kind}:${qualified(name)}`;
+				label = `${kind} ${shown(name)}`;
+			}
+			const exists = key.startsWith("function:") ? signatures.has(key.slice(9)) || signatures.size === 0 && existing.has(`function:${qualified(name)}`) : existing.has(key);
+			if (replace && exists) conflict(label, "its definition differs from supabase/schemas");
+			else creates.push({
+				key,
+				sql: statement,
+				label
+			});
+			continue;
+		}
+		const drop = new RegExp(String.raw`^DROP\s+(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|EXTENSION)\s+(?:IF\s+EXISTS\s+)?(${QNAME})(.*)$`, "is").exec(text);
+		if (drop) {
+			const kindWord = drop[1].toUpperCase();
+			const name = drop[2];
+			const rest = drop[3];
+			if (kindWord === "INDEX") drops.push({
+				key: `index:${parts(name).at(-1)}`,
+				finding: {
+					object: `index ${shown(name)}`,
+					detail: "not in supabase/schemas"
+				}
+			});
+			else if (kindWord === "POLICY" || kindWord === "TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const noun = kindWord.toLowerCase();
+				drops.push({
+					key: `${noun}:${on ? qualified(on[1]) : "?"}:${parts(name).at(-1)}`,
+					finding: {
+						object: `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			} else if (kindWord === "FUNCTION" || kindWord === "PROCEDURE") {
+				const sig = signatureOf(balanced(rest) ?? "");
+				drops.push({
+					key: `function:${qualified(name)}${sig}`,
+					finding: {
+						object: `function ${shown(name)}${sig}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				drops.push({
+					key: `${kind}:${qualified(name)}`,
+					finding: {
+						object: `${kind} ${shown(name)}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			}
+			continue;
+		}
+		const alterTable = new RegExp(String.raw`^ALTER\s+(?:FOREIGN\s+)?TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${QNAME})\s+(.*)$`, "is").exec(text);
+		if (alterTable) {
+			const table = alterTable[1];
+			const t = qualified(table);
+			for (const action of splitTopLevel(alterTable[2])) classifyTableAction(table, t, action, {
+				creates,
+				drops,
+				conflict
+			});
+			continue;
+		}
+		const alterType = new RegExp(String.raw`^ALTER\s+TYPE\s+(${QNAME})\s+ADD\s+VALUE\b`, "i").exec(text);
+		if (alterType) {
+			creates.push({
+				key: `enumvalue:${statement}`,
+				sql: statement,
+				label: `a value of type ${shown(alterType[1])}`
+			});
+			continue;
+		}
+		conflict(text.slice(0, 80), "a difference devtools does not know how to classify, so it will not touch it");
+	}
+	const renamedCreates = /* @__PURE__ */ new Set();
+	const renamedDrops = /* @__PURE__ */ new Set();
+	for (const c of creates) {
+		if (!c.column) continue;
+		const from = drops.find((d) => {
+			if (!d.column || renamedDrops.has(d)) return false;
+			if (d.column.table !== c.column.table) return false;
+			const type = columnTypes.get(`${d.column.table}.${d.column.name}`);
+			return type !== void 0 && normalizeType(type) === c.column.type;
+		});
+		if (!from) continue;
+		renamedCreates.add(c);
+		renamedDrops.add(from);
+		conflict(c.label, `supabase/schemas has it, and your database has ${from.finding.object} of the same type (${c.column.type}); that looks like a rename, so devtools will not add an empty column beside it. If you renamed it on purpose, rename it in supabase/schemas too; otherwise rename it back`);
+	}
+	const skipped = new Set([...renamedCreates].map((c) => c.key.slice(7)));
+	const liveCreates = creates.filter((c) => !renamedCreates.has(c));
+	const liveDrops = drops.filter((d) => !renamedDrops.has(d));
+	const created = new Set(liveCreates.map((c) => c.key));
+	const dropped = new Set(liveDrops.map((d) => d.key));
+	const restoring = liveCreates.filter((c) => !dropped.has(c.key));
+	for (const d of liveDrops) if (created.has(d.key)) conflict(d.finding.object, "it is defined differently from supabase/schemas");
+	else extras.push(d.finding);
+	const newNames = new Set(restoring.map((c) => c.key).filter((key) => !/^(index|policy|trigger|constraint|rls)/.test(key)).map((key) => key.slice(key.indexOf(":") + 1)));
+	const tail = [];
+	const regranted = /* @__PURE__ */ new Set();
+	const revokes = [];
+	for (const p of privileges) {
+		if (p.targets.length > 0 && p.targets.every((t) => skipped.has(t))) continue;
+		if (p.targets.length > 0 && (newNames.has(p.base) || p.targets.every((t) => newNames.has(t)))) tail.push(p.sql);
+		else if (!p.revoke) {
+			tail.push(p.sql);
+			regranted.add(p.object ?? "privileges");
+		} else revokes.push(p);
+	}
+	for (const p of revokes) {
+		if (p.object && regranted.has(p.object)) continue;
+		extras.push({
+			object: p.object ?? "privileges",
+			detail: p.object ? `granted to ${p.from} beyond (or instead of) what supabase/schemas grants` : "differ from what supabase/schemas grants"
+		});
+	}
+	const restore = [];
+	const restored = [...restoring.map((c) => c.label), ...regranted];
+	if (restoring.length > 0 || tail.length > 0) restore.push(...preamble, ...restoring.map((c) => c.sql), ...tail);
+	return {
+		restore,
+		restored,
+		extras: dedupe(extras),
+		conflicts: [...conflicts].map(([object, why]) => ({
+			object,
+			detail: [...why].join("; ")
+		}))
+	};
+}
+function dedupe(findings) {
+	const seen = /* @__PURE__ */ new Set();
+	return findings.filter((f) => {
+		const key = `${f.object}|${f.detail}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+function classifyTableAction(table, t, action, ctx) {
+	const sql = `ALTER TABLE ${table} ${action}`;
+	let m;
+	if (m = new RegExp(String.raw`^ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) {
+		const typeText = action.slice(m[0].length).trim().split(/\s+(?:DEFAULT|NOT\s+NULL|NULL|GENERATED|CONSTRAINT|REFERENCES|CHECK|COLLATE|UNIQUE|PRIMARY)\b/i)[0];
+		ctx.creates.push({
+			key: `column:${t}.${parts(m[1])[0]}`,
+			sql,
+			label: `column ${shown(table)}.${shown(m[1])}`,
+			column: {
+				table: t,
+				name: parts(m[1])[0],
+				type: normalizeType(typeText)
+			}
+		});
+	} else if (m = new RegExp(String.raw`^ADD\s+CONSTRAINT\s+(${IDENT})`, "i").exec(action)) ctx.creates.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		sql,
+		label: `constraint ${shown(m[1])} on ${shown(table)}`
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `column:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `column ${shown(table)}.${shown(m[1])}`,
+			detail: "not in supabase/schemas"
+		},
+		column: {
+			table: t,
+			name: parts(m[1])[0]
+		}
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `constraint ${shown(m[1])} on ${shown(table)}`,
+			detail: "not in supabase/schemas"
+		}
+	});
+	else if (m = new RegExp(String.raw`^ALTER\s+COLUMN\s+(${IDENT})\s+(.*)$`, "i").exec(action)) {
+		const what = m[2];
+		const aspect = /^(?:SET\s+DATA\s+)?TYPE\b/i.test(what) ? "type" : /\bDEFAULT\b/i.test(what) ? "default" : /\bNOT\s+NULL\b/i.test(what) ? "nullability" : "definition";
+		ctx.conflict(`column ${shown(table)}.${shown(m[1])}`, `its ${aspect} differs from supabase/schemas`);
+	} else if (/^(?:ENABLE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/i.test(action)) ctx.creates.push({
+		key: `rls:${t}:${action.toUpperCase()}`,
+		sql,
+		label: `row level security on ${shown(table)}`
+	});
+	else ctx.conflict(`table ${shown(table)}`, `a change devtools will not make for you (${action.slice(0, 60)})`);
+}
+//#endregion
 //#region src/product/sync.ts
 /**
 * `db sync`: make the contributor's development database match
@@ -7586,6 +8084,26 @@ function typesAssetName(product, hash) {
 * Without that, the diff would start from an empty database and write the whole
 * schema as one migration, which `db push` rejects as already applied.
 *
+* The record only says what *should* be in the database, so before the diff,
+* sync compares the live database with it (`supabase db diff --from <database>
+* --to migrations --use-pg-delta`, limited to the product's schemas) and sorts
+* every difference (`drift.ts`):
+*
+*   - missing (a dropped table, schema, column, index, policy, function; a
+*     missing migration ledger): recreated. Only CREATE and ADD statements are
+*     ever run, and the ledger is rewritten from the local record.
+*   - extra (a table, column, index or sequence a member added): listed as a
+*     warning and left alone. `--strict` fails on them instead.
+*   - conflicting (a column's type, a function body, ... defined differently
+*     in the database and the schema files): refused. Nothing is altered
+*     silently; the member edits the schema files or runs `--rebuild`.
+*
+* "Matches" is only ever said after that comparison ran. If it cannot run
+* (the database is unreachable, the password is wrong, the diff tool fails)
+* the sync fails and says so. A schema change the member pulled is a
+* different thing: it is the difference between the files and the record, and
+* keeps the declarative path below, including the `--yes` question for drops.
+*
 * It never resets the database. A reset wipes `auth.custom_oauth_providers`,
 * which is where "Sign in with DevDogs" is registered (Q83); `--rebuild` is
 * the explicit escape hatch for a database that has drifted from its record,
@@ -7607,8 +8125,233 @@ function destructiveStatements(sql) {
 function migrationFiles(dir) {
 	return existsSync(dir) ? readdirSync(dir).filter((name) => name.endsWith(".sql")).sort() : [];
 }
+const NOTHING = {
+	restored: [],
+	extras: [],
+	compared: false
+};
+function recordFile(product) {
+	return join(product.root, ".devtools", "record.json");
+}
+function pendingDir(product) {
+	return join(product.root, ".devtools", "pending");
+}
+function readRecord(product) {
+	try {
+		const raw = JSON.parse(readFileSync(recordFile(product), "utf8"));
+		return typeof raw.target === "string" && Array.isArray(raw.applied) ? {
+			target: raw.target,
+			applied: raw.applied.map(String)
+		} : null;
+	} catch {
+		return null;
+	}
+}
+function writeRecord(product, target, files) {
+	mkdirSync(dirname(recordFile(product)), { recursive: true });
+	const record = {
+		target: targetKey(target),
+		applied: files.map(versionOf)
+	};
+	writeFileSync(recordFile(product), JSON.stringify(record, null, 2) + "\n");
+}
+/** `local`, or `hosted:<project ref>` (never the password). */
+function targetKey(target) {
+	if (target.kind === "local") return "local";
+	try {
+		const url = new URL(target.dbUrl);
+		const user = decodeURIComponent(url.username);
+		return `hosted:${(user.includes(".") ? user.split(".").slice(1).join(".") : "") || url.hostname}`;
+	} catch {
+		return "hosted";
+	}
+}
+/** The migrations the target has applied (null: no history table); throws if it cannot be reached. */
+async function probe(open, target, redact) {
+	let session;
+	try {
+		session = open(target.dbUrl);
+		return await session.appliedMigrations();
+	} catch (err) {
+		throw new SyncError("Could not connect to the database to compare it with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(err.message));
+	} finally {
+		await session?.close().catch(() => void 0);
+	}
+}
+/** Puts back migrations a sync that was killed had set aside. */
+function restorePending(product) {
+	const dir = pendingDir(product);
+	if (!existsSync(dir)) return;
+	mkdirSync(product.paths.migrationsDir, { recursive: true });
+	for (const file of readdirSync(dir)) {
+		const back = join(product.paths.migrationsDir, file);
+		if (existsSync(back)) rmSync(join(dir, file));
+		else renameSync(join(dir, file), back);
+	}
+}
+/** `20261011120000` from `20261011120000_devtools_sync.sql`. */
+function versionOf(file) {
+	return file.split("_")[0] ?? file;
+}
+/** The connection string and its password never reach the terminal. */
+function redactor(target) {
+	const secrets = /* @__PURE__ */ new Set([target.dbUrl]);
+	try {
+		const url = new URL(target.dbUrl);
+		for (const value of [url.password, decodeURIComponent(url.password)]) if (value) secrets.add(value);
+	} catch {}
+	return (text) => {
+		let out = text;
+		for (const secret of [...secrets].sort((a, b) => b.length - a.length)) out = out.split(secret).join(secret === target.dbUrl ? "<DB_URL>" : "<password>");
+		return out;
+	};
+}
+function liveDiffArgs(product, target) {
+	return [
+		"db",
+		"diff",
+		"--from",
+		target.kind === "local" ? "local" : target.dbUrl,
+		"--to",
+		"migrations",
+		"--use-pg-delta",
+		"--schema",
+		product.config.supabase.schemas.join(","),
+		"--output-format",
+		"json"
+	];
+}
+/**
+* The SQL that would turn the live database into what the record describes
+* (pg-delta, database to migrations). Never applied as is. A diff that cannot
+* run is an error: there is no fallback to trusting the record.
+*/
+async function liveDiff(product, cli, target, run, log, redact) {
+	const args = [...cli.prefix, ...liveDiffArgs(product, target)];
+	let result = await run(cli.command, args, { cwd: product.root });
+	if (result.code !== 0 && isContainerFailure(result)) {
+		log("The shadow database did not start; trying once more.");
+		result = await run(cli.command, args, { cwd: product.root });
+	}
+	const raw = result.stdout + "\n" + result.stderr;
+	let parsed = null;
+	for (const line of result.stdout.split("\n").reverse()) {
+		const text = line.trim();
+		if (!text.startsWith("{")) continue;
+		try {
+			parsed = JSON.parse(text);
+			break;
+		} catch {}
+	}
+	if (result.code === 0 && parsed && typeof parsed.diff === "string") return parsed.diff;
+	const reason = typeof parsed?.error?.message === "string" ? parsed.error.message : result.stderr.trim() || result.stdout.trim();
+	throw new SyncError(isContainerFailure({
+		stdout: "",
+		stderr: raw
+	}) && !parsed?.error ? "Could not compare the database with supabase/schemas: Docker is needed for the shadow database. Start Docker and try again. Nothing was changed,, and the database was not checked against supabase/schemas." : "Could not compare the database with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(reason));
+}
+/** Lists the headline objects; their constraints, policies and the like are a count. */
+function summarize(labels) {
+	const major = labels.filter((label) => /^(schema|table|function|view|sequence|type|column) /.test(label));
+	if (major.length === 0 || major.length === labels.length) return labels.join(", ");
+	const rest = labels.length - major.length;
+	return `${major.join(", ")} (and ${rest} related ${rest === 1 ? "thing" : "things"}: constraints, policies, indexes)`;
+}
+/** How to clean up a database that has things the schema files do not define. */
+function cleanupHint(target) {
+	return target.kind === "local" ? "To clean up: `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data` to load the sample data again." : "To clean up: reset the project from its dashboard (Database > Settings), then run `devtools db sync` and `devtools dev-data`.";
+}
+function listFindings(findings) {
+	return findings.map((f) => `- ${f.object}: ${f.detail}`).join("\n");
+}
+/**
+* Compares the live database with the record and puts right what is safe.
+* See the header comment for the three kinds of difference.
+*/
+async function reconcileLive(product, cli, target, run, options, log, warn, redact) {
+	const files = migrationFiles(product.paths.migrationsDir);
+	if (!options.open || files.length === 0) return {
+		...NOTHING,
+		pending: []
+	};
+	const { schemas } = product.config.supabase;
+	let session;
+	let ledger;
+	let existing;
+	let columnTypes;
+	try {
+		session = options.open(target.dbUrl);
+		ledger = await session.appliedMigrations();
+		existing = await session.existingObjects(schemas);
+		columnTypes = await session.columnTypes(schemas);
+	} catch (err) {
+		await session?.close().catch(() => void 0);
+		throw new SyncError("Could not connect to the database to compare it with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(err.message));
+	}
+	const record = readRecord(product);
+	const noted = record?.target === targetKey(target) ? record.applied : null;
+	const known = /* @__PURE__ */ new Set([...ledger ?? [], ...noted ?? []]);
+	const everythingApplied = ledger === null && noted === null;
+	const isApplied = (file) => everythingApplied || known.has(versionOf(file));
+	const appliedFiles = files.filter(isApplied);
+	const pending = files.filter((file) => !isApplied(file));
+	if (appliedFiles.length === 0) {
+		await session.close().catch(() => void 0);
+		return {
+			...NOTHING,
+			pending
+		};
+	}
+	const aside = pendingDir(product);
+	if (pending.length > 0) mkdirSync(aside, { recursive: true });
+	for (const file of pending) renameSync(join(product.paths.migrationsDir, file), join(aside, file));
+	try {
+		const drift = classifyDiff(await liveDiff(product, cli, target, run, log, redact), existing, columnTypes);
+		if (drift.extras.length > 0 && !options.strict) warn(`Your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. They are left as they are:\n${listFindings(drift.extras)}\n${cleanupHint(target)}`);
+		if (drift.conflicts.length > 0) throw new SyncError(`Your database defines ${drift.conflicts.length} thing${drift.conflicts.length === 1 ? "" : "s"} differently from supabase/schemas. devtools will not change them for you, and nothing was changed.`, `${listFindings(drift.conflicts)}\nIf the database is right, edit supabase/schemas to match it. If the schema files are right, ${target.kind === "local" ? "run `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data`" : "reset the project from its dashboard (Database > Settings), then run `devtools db sync` and `devtools dev-data`"}.`);
+		if (options.strict && drift.extras.length > 0) throw new SyncError(`--strict: your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. Nothing was changed or deleted.`, `${listFindings(drift.extras)}\n${cleanupHint(target)}`);
+		if (drift.restore.length > 0) {
+			if (drift.restored.length > 0) log(`Your database is missing ${summarize(drift.restored)}; creating ${drift.restored.length === 1 ? "it" : "them"} again from supabase/schemas. Nothing that already exists is changed.${drift.restored.some((label) => label.startsWith("privileges on")) ? " For the privileges, what supabase/schemas grants was granted again; privileges beyond that were not taken away." : ""}`);
+			try {
+				await session.exec(drift.restore.join(";\n") + ";");
+			} catch (err) {
+				throw new SyncError("Could not recreate what the database is missing; nothing was changed.", `${redact(err.message)}\n${target.kind === "local" ? "`devtools db sync --rebuild` starts over (it wipes your development database)." : "Reset the project from its dashboard (Database > Settings), then run `devtools db sync`."}`);
+			}
+		}
+		const listed = new Set(ledger ?? []);
+		const unlisted = appliedFiles.map(versionOf).filter((version) => !listed.has(version));
+		if (unlisted.length > 0) {
+			if (ledger === null) log("The database has no migration history table; recreating it from the local record.");
+			const repaired = await run(cli.command, [
+				...cli.prefix,
+				"migration",
+				"repair",
+				"--status",
+				"applied",
+				"--db-url",
+				target.dbUrl,
+				...unlisted
+			], { cwd: product.root });
+			if (repaired.code !== 0) throw new SyncError("Could not record the applied migrations in the database's history.", redact(repaired.stderr || repaired.stdout));
+		}
+		return {
+			restored: drift.restored,
+			extras: drift.extras,
+			compared: true,
+			pending
+		};
+	} finally {
+		for (const file of pending) {
+			const from = join(aside, file);
+			if (existsSync(from)) renameSync(from, join(product.paths.migrationsDir, file));
+		}
+		await session.close().catch(() => void 0);
+	}
+}
 async function dbSync(product, cli, target, run, options) {
 	const log = options.log ?? (() => void 0);
+	const warn = options.warn ?? log;
+	const redact = redactor(target);
 	const { migrationsDir, schemasDir } = product.paths;
 	if (!existsSync(schemasDir)) throw new SyncError(`${product.config.supabase.dir}/schemas does not exist; there is nothing to sync.`);
 	mkdirSync(migrationsDir, { recursive: true });
@@ -7626,17 +8369,24 @@ async function dbSync(product, cli, target, run, options) {
 		...cli.prefix,
 		"migration",
 		"fetch",
-		"--db-url",
-		target.dbUrl
+		...target.kind === "local" ? ["--local"] : ["--db-url", target.dbUrl]
 	];
-	const needsRecord = target.kind === "hosted" && migrationFiles(migrationsDir).length === 0;
+	const key = targetKey(target);
+	const owner = readRecord(product)?.target;
+	const foreign = owner !== void 0 && owner !== key && migrationFiles(migrationsDir).length > 0;
+	let needsRecord = migrationFiles(migrationsDir).length === 0 && (target.kind === "hosted" || owner !== void 0 && owner !== key) || foreign;
 	if (options.dryRun) {
-		if (needsRecord) log(`Would run: ${cliLine(cli, [
+		if (needsRecord) log(`Would run: ${cliLine(cli, target.kind === "local" ? [
+			"migration",
+			"fetch",
+			"--local"
+		] : [
 			"migration",
 			"fetch",
 			"--db-url",
 			"<DB_URL>"
-		])} (this machine has no record of what the project has had applied)`);
+		])} (this machine has no record of what ${target.kind === "local" ? "the local stack" : "the project"} has had applied)`);
+		if (options.open) log(`Would run: ${cliLine(cli, liveDiffArgs(product, target).map((arg) => arg === target.dbUrl ? "<DB_URL>" : arg))} (and recreate anything the database is missing; extras are only listed)`);
 		log(`Would run: ${cliLine(cli, generateArgs.slice(cli.prefix.length))}`);
 		log(target.kind === "local" ? `Would run: ${cliLine(cli, [
 			"migration",
@@ -7652,32 +8402,51 @@ async function dbSync(product, cli, target, run, options) {
 		return {
 			migration: null,
 			applied: false,
-			destructive: []
+			destructive: [],
+			...NOTHING
 		};
 	}
+	restorePending(product);
+	if (!needsRecord && target.kind === "local" && options.open && migrationFiles(migrationsDir).length === 0) needsRecord = (await probe(options.open, target, redact) ?? []).length > 0;
+	if (foreign) {
+		log(`supabase/migrations holds the record of another database (${owner}); this sync is for ${key}, so that record is set aside and this database's own history is used.`);
+		forgetMigrations(product);
+	}
 	if (needsRecord) {
 		const fetched = await run(cli.command, fetchArgs, { cwd: product.root });
-		const restored = migrationFiles(migrationsDir).length;
-		if (fetched.code === 0 && restored > 0) log(`Restored ${restored} applied migration${restored === 1 ? "" : "s"} from the project's history.`);
+		if (fetched.code !== 0 && options.open) await probe(options.open, target, redact);
+		const restoredFiles = migrationFiles(migrationsDir).length;
+		if (fetched.code === 0 && restoredFiles > 0) {
+			log(`Restored ${restoredFiles} applied migration${restoredFiles === 1 ? "" : "s"} from ${target.kind === "local" ? "the local stack's" : "the project's"} history.`);
+			writeRecord(product, target, migrationFiles(migrationsDir));
+		}
 	}
+	const { pending, ...live } = await reconcileLive(product, cli, target, run, options, log, warn, redact);
+	const restoredSomething = live.restored.length > 0;
 	const before = new Set(migrationFiles(migrationsDir));
 	let generated = await run(cli.command, generateArgs, { cwd: product.root });
 	if (generated.code !== 0 && isContainerFailure(generated)) {
 		log("The shadow database did not start; trying once more.");
 		generated = await run(cli.command, generateArgs, { cwd: product.root });
 	}
-	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", generated.stderr || generated.stdout);
+	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", redact(generated.stderr || generated.stdout));
 	const created = migrationFiles(migrationsDir).filter((f) => !before.has(f));
-	if (created.length === 0) {
-		log("The database already matches supabase/schemas.");
+	const toApply = [...pending, ...created].sort();
+	if (toApply.length === 0) {
+		if (live.compared && !restoredSomething) {
+			const n = live.extras.length;
+			log(n === 0 ? "The database already matches supabase/schemas." : `The database matches supabase/schemas, with ${n} extra thing${n === 1 ? "" : "s"} listed above that it does not define.`);
+		}
+		writeRecord(product, target, migrationFiles(migrationsDir));
 		return {
 			migration: null,
-			applied: false,
-			destructive: []
+			applied: restoredSomething,
+			destructive: [],
+			...live
 		};
 	}
-	const migration = created[created.length - 1];
-	const sql = readFileSync(join(migrationsDir, migration), "utf8");
+	const migration = toApply[toApply.length - 1];
+	const sql = toApply.map((file) => readFileSync(join(migrationsDir, file), "utf8")).join("\n");
 	const destructive = destructiveStatements(sql);
 	if (destructive.length > 0 && !options.yes) {
 		if (!(options.confirmDestructive ? await options.confirmDestructive(sql, destructive) : false)) {
@@ -7685,7 +8454,7 @@ async function dbSync(product, cli, target, run, options) {
 			throw new SyncError(`The change drops data in your development database (${destructive.length} statement${destructive.length === 1 ? "" : "s"}). Re-run with --yes to allow it.`, destructive.join(";\n"));
 		}
 	}
-	log(`Applying ${migration}`);
+	log(`Applying ${toApply.join(", ")}`);
 	const applyArgs = target.kind === "local" ? [
 		...cli.prefix,
 		"migration",
@@ -7702,12 +8471,14 @@ async function dbSync(product, cli, target, run, options) {
 	const applied = await run(cli.command, applyArgs, { cwd: product.root });
 	if (applied.code !== 0) {
 		for (const file of created) rmSync(join(migrationsDir, file));
-		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", applied.stderr || applied.stdout);
+		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", redact(applied.stderr || applied.stdout));
 	}
+	writeRecord(product, target, migrationFiles(migrationsDir));
 	return {
 		migration,
 		applied: true,
-		destructive
+		destructive,
+		...live
 	};
 }
 function isContainerFailure(result) {
@@ -7717,6 +8488,11 @@ function isContainerFailure(result) {
 function forgetMigrations(product) {
 	const files = migrationFiles(product.paths.migrationsDir);
 	for (const file of files) rmSync(join(product.paths.migrationsDir, file));
+	rmSync(recordFile(product), { force: true });
+	rmSync(pendingDir(product), {
+		recursive: true,
+		force: true
+	});
 	return files;
 }
 //#endregion
@@ -7972,7 +8748,10 @@ async function runSync(product, deps, rest) {
 		yes: hasYes(rest),
 		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
 		dryRun,
-		log: (line) => log.info(line)
+		strict: rest.includes("--strict"),
+		log: (line) => log.info(line),
+		warn: (line) => log.warn(line),
+		open: deps.openSql
 	});
 	if (rest.includes("--rebuild") && !dryRun) try {
 		const row = await reRegisterSavedProvider(product.paths.toolingFile, target);
@@ -7997,7 +8776,7 @@ async function regenerateAfterSync(product, cli, target, result, deps) {
 		log.info(`Would regenerate ${product.config.types.out}.`);
 		return;
 	}
-	if (!result.migration && typesAreCurrent(product)) return;
+	if (!result.applied && typesAreCurrent(product)) return;
 	try {
 		await generateTypes(product, cli, target, deps.run, (line) => log.info(line));
 		log.success(`Regenerated ${product.config.types.out}.`);
@@ -8043,7 +8822,7 @@ function createProductHandlers(deps = defaultDeps) {
 		switch (sub) {
 			case "sync": {
 				const { result, cli, target } = await runSync(product, deps, flags);
-				if (result.migration) log.success("Your database now matches supabase/schemas.");
+				if (result.applied) log.success(result.extras.length > 0 ? `Your database now matches supabase/schemas, apart from the ${result.extras.length} extra thing${result.extras.length === 1 ? "" : "s"} listed above.` : "Your database now matches supabase/schemas.");
 				await regenerateAfterSync(product, cli, target, result, deps);
 				return DONE;
 			}
@@ -8273,9 +9052,12 @@ async function runSetup(product, deps, rest) {
 	const result = await dbSync(product, cli, target, deps.run, {
 		yes: hasYes(rest),
 		confirmDestructive: deps.interactive() ? confirmDestructive : void 0,
-		log: (line) => log.info(line)
+		log: (line) => log.info(line),
+		warn: (line) => log.warn(line),
+		open: deps.openSql
 	});
-	log.success(result.migration ? "Applied supabase/schemas to your database." : "Your database already matched supabase/schemas.");
+	if (result.applied) log.success("Applied supabase/schemas to your database.");
+	else if (result.compared) log.success("Your database already matched supabase/schemas.");
 	if (target.kind === "local") await waitForRest(target, deps, product);
 	if (rest.includes("--download-types")) try {
 		await downloadTypes(product, {

package/dist/launch.js

@@ -1,6 +1,6 @@
 import { i as markOutsideCheckout, n as discoverRepoRoot, r as findRepoRoot, t as RepoNotFoundError } from "./root-RaJ8ECCO.js";
 import { b as setDryRun, d as loadEnvLoad, f as loadEnvSession, m as formatCommand, v as isDryRun, y as resolveDryRun } from "./run-D5iI9zve.js";
-import { D as catalog, E as setProductMode, N as setEnvironmentRoot, O as helpPath, S as findProductRoot, c as nonEmpty, f as enterSessionEnvironment, g as errorMessage, h as bail, m as setMenuEnvHook, n as bareGroupStartPath, p as realEnvEntryDeps, y as unwrap } from "./menu-CZK0L1Vf.js";
+import { D as catalog, E as setProductMode, N as setEnvironmentRoot, O as helpPath, S as findProductRoot, c as nonEmpty, f as enterSessionEnvironment, g as errorMessage, h as bail, m as setMenuEnvHook, n as bareGroupStartPath, p as realEnvEntryDeps, y as unwrap } from "./menu-Ctqnvduz.js";
 import { a as isVersionRequest, c as cliName, t as installFailureLog } from "./failure-log-MSdCgvLc.js";
 import { c as lastSentryEventId, f as hasYes, h as stripTierFlag, m as stripNoEnvFlag, n as captureDevtoolsError, o as initDevtoolsTelemetry, p as isNonInteractive } from "./telemetry-BDOwjuoC.js";
 import { confirm, select } from "@clack/prompts";
@@ -183,7 +183,7 @@ async function startStack() {
 * post-tier-resolution path.
 */
 async function dispatch(argv) {
-	const { main } = await import("./cli-Doy2BzCQ.js");
+	const { main } = await import("./cli-DfHsw0fp.js");
 	try {
 		await main(argv);
 	} catch (err) {

package/dist/{menu-CZK0L1Vf.js → menu-Ctqnvduz.js}

@@ -946,7 +946,7 @@ const productDbCommand = {
 		{
 			name: "sync",
 			title: "Apply the schema to my database",
-			summary: "Diff supabase/schemas against what your database has had applied, and apply the difference.",
+			summary: "Compare your database with supabase/schemas: recreate what it is missing, apply schema changes you pulled, warn about extras, and refuse to alter what is defined differently.",
 			envFree: true,
 			dryRun: "handled",
 			options: [
@@ -955,6 +955,10 @@ const productDbCommand = {
 					flag: "--rebuild",
 					summary: "Reset the local database and start over from the schema, then register sign in again."
 				},
+				{
+					flag: "--strict",
+					summary: "Fail (changing nothing) when the database has things supabase/schemas does not define, instead of warning."
+				},
 				{
 					flag: "--yes",
 					summary: "Allow changes that drop tables or columns."

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@devdogsuga/devtools",
-  "version": "0.1.51-next.549",
+  "version": "0.1.51-next.552",
   "private": false,
   "type": "module",
   "description": "Contributor CLI for DevDogs repositories (the platform monorepo, DogDays, DogPack): the real tools with the session's tier filled in, `setup`, `db sync`, `db types`, `dev-data`, a menu over them, the checks CI runs, and the `with-env` launcher. Ships built JS; run via `pnpm devtools` in a product repo, `pnpm dlx @devdogsuga/devtools` (or the `devtools` bin once installed) from inside a clone.",
@@ -46,8 +46,8 @@
     "eslint": "^9.39.5",
     "tsdown": "^0.23.0",
     "vitest": "^4.1.11",
-    "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/config": "0.1.4-next.526",
+    "@devdogsuga/cli-core": "0.0.0",
     "@devdogsuga/sdk": "0.1.0"
   },
   "scripts": {