@devdogsuga/devtools 0.1.51-next.551 → 0.1.51-next.553

package/dist/{cli-xAkuiAkl.js → cli-CzHls8xA.js}

@@ -7002,899 +7002,1256 @@ const OAUTH = {
 	"callbackPath": "/auth/v1/callback"
 };
 //#endregion
-//#region src/product/exec.ts
-const spawnRunner = (command, args, options) => new Promise((resolve, reject) => {
-	const child = spawnProcess(command, args, {
-		cwd: options.cwd,
-		env: {
-			...process.env,
-			...options.env
-		},
-		stdio: options.inherit ? "inherit" : [
-			"ignore",
-			"pipe",
-			"pipe"
-		]
-	});
-	let stdout = "";
-	let stderr = "";
-	child.stdout?.on("data", (chunk) => {
-		stdout += chunk.toString("utf8");
-	});
-	child.stderr?.on("data", (chunk) => {
-		stderr += chunk.toString("utf8");
-	});
-	child.on("error", reject);
-	child.on("close", (code) => {
-		resolve({
-			code: code ?? 1,
-			stdout,
-			stderr
-		});
-	});
-});
-/** `command arg arg`, quoted only where a shell would need it. For messages. */
-function commandLine(command, args) {
-	return [command, ...args].map((part) => /^[\w@%+=:,./-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+//#region src/product/drift.ts
+/** Splits SQL at top-level semicolons, honoring quotes, dollar quotes and comments. Comments are dropped. */
+function splitStatements(sql) {
+	const out = [];
+	let current = "";
+	let i = 0;
+	const push = () => {
+		const text = current.trim();
+		if (text) out.push(text);
+		current = "";
+	};
+	while (i < sql.length) {
+		const ch = sql[i];
+		const next = sql[i + 1];
+		if (ch === "-" && next === "-") {
+			while (i < sql.length && sql[i] !== "\n") i++;
+			continue;
+		}
+		if (ch === "/" && next === "*") {
+			const end = sql.indexOf("*/", i + 2);
+			i = end === -1 ? sql.length : end + 2;
+			current += " ";
+			continue;
+		}
+		if (ch === "'" || ch === "\"") {
+			let j = i + 1;
+			while (j < sql.length) {
+				if (sql[j] === ch) {
+					if (sql[j + 1] === ch) {
+						j += 2;
+						continue;
+					}
+					break;
+				}
+				j++;
+			}
+			current += sql.slice(i, j + 1);
+			i = j + 1;
+			continue;
+		}
+		if (ch === "$") {
+			const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i))?.[0];
+			if (tag) {
+				const end = sql.indexOf(tag, i + tag.length);
+				const stop = end === -1 ? sql.length : end + tag.length;
+				current += sql.slice(i, stop);
+				i = stop;
+				continue;
+			}
+		}
+		if (ch === ";") {
+			push();
+			i++;
+			continue;
+		}
+		current += ch;
+		i++;
+	}
+	push();
+	return out;
 }
-//#endregion
-//#region src/product/supabase-cli.ts
-/**
-* Finding the Supabase CLI a product is pinned to.
-*
-* A product repo may have no `package.json` (DogPack has none), so the CLI
-* cannot be assumed to be a dependency. In order:
-*
-*   1. `node_modules/.bin/supabase` in the repo, when its version is the pin;
-*   2. a `supabase` on PATH whose version is the pin;
-*   3. `pnpm dlx supabase@<pin>`, which downloads and caches the right one.
-*      Members are expected to have pnpm (both product repos pin it);
-*   4. `npx --yes supabase@<pin>`, only when pnpm is not on PATH.
-*
-* The pin is also part of the generated-types hash, so a contributor on a
-* different CLI would generate different types than CI; matching it is not
-* cosmetic.
-*/
-function cliLine(cli, args) {
-	return commandLine(cli.command, [...cli.prefix, ...args]);
+/** Splits `text` at commas that are not inside parentheses or quotes. */
+function splitTopLevel(text) {
+	const parts = [];
+	let depth = 0;
+	let quote = null;
+	let start = 0;
+	for (let i = 0; i < text.length; i++) {
+		const ch = text[i];
+		if (quote) {
+			if (ch === quote) quote = null;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (ch === "," && depth === 0) {
+			parts.push(text.slice(start, i).trim());
+			start = i + 1;
+		}
+	}
+	parts.push(text.slice(start).trim());
+	return parts.filter(Boolean);
 }
-function versionOf$1(output) {
-	return /\b(\d+\.\d+\.\d+)\b/.exec(output)?.[1] ?? null;
+const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const QNAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})*`;
+/** `"a"."b"` -> ["a", "b"]; unquoted names fold to lower case like Postgres. */
+function parts(name) {
+	return (name.match(new RegExp(IDENT, "g")) ?? []).map((part) => part.startsWith("\"") ? part.slice(1, -1).replace(/""/g, "\"") : part.toLowerCase());
 }
-async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
-	const candidates = [];
-	const local = join(root, "node_modules", ".bin", "supabase");
-	if (fileExists(local)) candidates.push({
-		command: local,
-		prefix: [],
-		source: "repo"
-	});
-	candidates.push({
-		command: "supabase",
-		prefix: [],
-		source: "path"
-	});
-	for (const candidate of candidates) try {
-		const result = await run(candidate.command, ["--version"], { cwd: root });
-		if (result.code === 0 && versionOf$1(result.stdout) === pin) return candidate;
-	} catch {}
-	try {
-		if ((await run("pnpm", ["--version"], { cwd: root })).code === 0) return {
-			command: "pnpm",
-			prefix: ["dlx", `supabase@${pin}`],
-			source: "pnpm"
-		};
-	} catch {}
-	return {
-		command: "npx",
-		prefix: ["--yes", `supabase@${pin}`],
-		source: "npx"
-	};
+function qualified(name) {
+	return parts(name).join(".");
 }
-//#endregion
-//#region src/product/target.ts
-const TOOLING_KEYS = {
-	/** `local` or `hosted`: what `setup` last chose. Wins over everything else. */
-	target: "DEVTOOLS_TARGET",
-	dbUrl: "DB_URL",
-	secretKey: "SECRET_KEY",
-	accessToken: "SUPABASE_ACCESS_TOKEN"
-};
-var TargetError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "TargetError";
-	}
+function shown(name) {
+	return parts(name).map((part) => `"${part}"`).join(".");
+}
+const TYPE_ALIASES = {
+	int: "integer",
+	int4: "integer",
+	int8: "bigint",
+	int2: "smallint",
+	bool: "boolean",
+	float8: "double precision",
+	float4: "real",
+	varchar: "character varying",
+	bpchar: "character",
+	timestamptz: "timestamp with time zone",
+	timetz: "time with time zone",
+	decimal: "numeric"
 };
-/** The project ref or vanity name in a Supabase URL or pooler URL, if it has one. */
-function projectNameOf(url) {
-	try {
-		const { hostname, username } = new URL(url);
-		const fromHost = /^([a-z0-9-]+)\.supabase\.co$/.exec(hostname)?.[1];
-		if (fromHost) return fromHost;
-		const fromUser = /^postgres\.([a-z0-9]+)$/.exec(username)?.[1];
-		if (fromUser) return fromUser;
-		return /^db\.([a-z0-9]+)\.supabase\.co$/.exec(hostname)?.[1] ?? null;
-	} catch {
-		return null;
+/** `Int4[ ]`, `pg_catalog.text`, `"text"` -> a comparable spelling. */
+function normalizeType(type) {
+	let t = type.trim().replace(/\s+/g, " ").toLowerCase();
+	const array = /(\s*\[\d*\])+$/.exec(t)?.[0] ?? "";
+	t = t.slice(0, t.length - array.length);
+	t = t.replace(/^pg_catalog\./, "").replace(/"/g, "");
+	t = t.replace(/\s*\(.*\)$/, (m) => m.replace(/\s+/g, ""));
+	const base = /^([a-z0-9_ ]+?)(\(.*\))?$/.exec(t);
+	const head = base?.[1]?.trim() ?? t;
+	const tail = base?.[2] ?? "";
+	return `${TYPE_ALIASES[head] ?? head}${tail}${array.replace(/\s/g, "")}`;
+}
+/** The text inside the first balanced parentheses of `text`, or null. */
+function balanced(text) {
+	const start = text.indexOf("(");
+	if (start === -1) return null;
+	let depth = 0;
+	let quote = null;
+	for (let i = start; i < text.length; i++) {
+		const ch = text[i];
+		if (quote) {
+			if (ch === quote) quote = null;
+		} else if (ch === "'" || ch === "\"") quote = ch;
+		else if (ch === "(") depth++;
+		else if (ch === ")" && --depth === 0) return text.slice(start + 1, i);
 	}
+	return null;
 }
-/** Refuses a URL that names one of the product's production projects. */
-function assertNotProduction(product, ...urls) {
-	const production = new Set(product.config.production.projects);
-	for (const url of urls) {
-		const name = projectNameOf(url);
-		if (name !== null && production.has(name)) throw new TargetError(`${url} is ${product.config.name}'s production project (${name}). devtools only acts on your own development project or the local Docker stack.`);
+const MULTIWORD_HEADS = /* @__PURE__ */ new Set([
+	"double",
+	"timestamp",
+	"time",
+	"character",
+	"bit",
+	"national",
+	"interval"
+]);
+/**
+* The argument types of a function's parameter list, as the database spells
+* them: `a int, OUT b text, c text DEFAULT 'x'` -> `(integer, text)`.
+*/
+function signatureOf(argList) {
+	const types = [];
+	for (let arg of splitTopLevel(argList)) {
+		if (/^(OUT|TABLE)\b/i.test(arg)) continue;
+		arg = arg.replace(/^(?:IN\s+OUT|INOUT|IN|VARIADIC)\s+/i, "");
+		const dflt = /\s+DEFAULT\s|\s*=\s*/i.exec(arg);
+		if (dflt) arg = arg.slice(0, dflt.index);
+		arg = arg.trim();
+		const named = new RegExp(`^(${IDENT})\\s+(.+)$`, "s").exec(arg);
+		let type = arg;
+		if (named) {
+			const head = named[1].toLowerCase();
+			const second = named[2].split(/[\s(]/)[0].toLowerCase();
+			if (!(MULTIWORD_HEADS.has(head) && (/^(precision|with|without|varying)$/.test(second) || named[2].startsWith("(")))) type = named[2];
+		}
+		types.push(normalizeType(type));
+	}
+	return `(${types.join(", ")})`;
+}
+/** Normalizes the `function:s.n(types)` spelling the database reports. */
+function normalizeKeySignature(types) {
+	return signatureOf(types);
+}
+const ALL_PRIVILEGES = {
+	TABLE: [
+		"SELECT",
+		"INSERT",
+		"UPDATE",
+		"DELETE",
+		"TRUNCATE",
+		"REFERENCES",
+		"TRIGGER"
+	],
+	COLUMN: [
+		"SELECT",
+		"INSERT",
+		"UPDATE",
+		"REFERENCES"
+	],
+	SEQUENCE: [
+		"USAGE",
+		"SELECT",
+		"UPDATE"
+	],
+	FUNCTION: ["EXECUTE"],
+	PROCEDURE: ["EXECUTE"],
+	SCHEMA: ["USAGE", "CREATE"],
+	TYPE: ["USAGE"],
+	DOMAIN: ["USAGE"]
+};
+/** Reads what a GRANT or REVOKE is on. */
+function privilegeOf(text, revoke) {
+	const on = new RegExp(String.raw`\bON\s+(?:(TABLE|SEQUENCE|FUNCTION|PROCEDURE|SCHEMA|TYPE|DOMAIN)\s+)?(${QNAME})(\s*\(.*\))?\s+(?:FROM|TO)\s+(.+)$`, "is").exec(text);
+	const base = {
+		sql: text,
+		revoke,
+		targets: [],
+		base: "",
+		object: null,
+		from: "",
+		kind: "TABLE",
+		units: [],
+		grantees: [],
+		onText: "",
+		option: ""
+	};
+	if (!on) return base;
+	const kind = (on[1] ?? "").toUpperCase();
+	const name = on[2];
+	const isFunction = kind === "FUNCTION" || kind === "PROCEDURE";
+	const sig = isFunction ? signatureOf(balanced(on[3] ?? "") ?? "") : "";
+	const object = `${qualified(name)}${sig}`;
+	const head = text.slice(0, on.index).replace(/^(?:GRANT|REVOKE)\s+(?:GRANT\s+OPTION\s+FOR\s+)?/i, "");
+	const units = [];
+	for (const entry of splitTopLevel(head)) {
+		const word = entry.replace(/\(.*\)/s, "").trim().toUpperCase().replace(/^ALL\s+PRIVILEGES$/, "ALL");
+		const cols = /\(([^)]*)\)/.exec(entry)?.[1];
+		if (cols && !isFunction) for (const c of cols.split(",")) {
+			const column = parts(c)[0];
+			if (column) units.push({
+				priv: word,
+				column
+			});
+		}
+		else if (word) units.push({ priv: word });
 	}
-}
-/** Reads `supabase status -o env` for the running local stack. */
-async function localTarget(product, cli, run) {
-	const args = [
-		...cli.prefix,
-		"status",
-		"-o",
-		"env"
-	];
-	const result = await run(cli.command, args, { cwd: product.root });
-	if (result.code !== 0) throw new TargetError(`The local Supabase stack is not running (${cliLine(cli, ["status"])} failed). Start it with \`devtools supabase start\`, or run \`devtools setup\`.`);
-	const env = parse(result.stdout);
-	const apiUrl = env["API_URL"];
-	const dbUrl = env["DB_URL"];
-	const publishableKey = env["PUBLISHABLE_KEY"] ?? env["ANON_KEY"];
-	const secretKey = env["SERVICE_ROLE_KEY"] ?? env["SECRET_KEY"];
-	if (!apiUrl || !dbUrl || !publishableKey || !secretKey) throw new TargetError("`supabase status -o env` did not report the API URL, DB URL and keys. Is the stack fully started?");
+	const columns = units.flatMap((u) => u.column ? [u.column] : []);
+	const tail = on[4];
+	const option = /\bWITH\s+GRANT\s+OPTION\b/i.test(tail) ? " WITH GRANT OPTION" : "";
+	const who = tail.replace(/\s+WITH\s+GRANT\s+OPTION\b/i, "").replace(/\s+(?:CASCADE|RESTRICT)\s*$/i, "").replace(/\s+GRANTED\s+BY\s+.+$/i, "");
 	return {
-		kind: "local",
-		apiUrl,
-		dbUrl,
-		publishableKey,
-		secretKey
+		...base,
+		base: object,
+		targets: columns.length > 0 ? columns.map((c) => `${object}.${c}`) : [object],
+		object: `privileges on ${isFunction ? "function " : ""}${shown(name)}${sig}`,
+		from: tail.replace(/"/g, ""),
+		kind: kind || "TABLE",
+		units,
+		grantees: splitTopLevel(who).map((raw) => {
+			const name = raw.replace(/^GROUP\s+/i, "").trim();
+			return {
+				raw: name,
+				name: /^public$/i.test(name) ? "public" : parts(name)[0] ?? name
+			};
+		}),
+		onText: `ON ${kind ? kind + " " : ""}${name}${on[3] ?? ""}`,
+		option
 	};
 }
-/** The contributor's own hosted project, from `.env` and `.env.tooling`. */
-function hostedTarget(product) {
-	const pub = readEnvFile(product.paths.envFile);
-	const tooling = readEnvFile(product.paths.toolingFile);
-	const { keys } = product.config.env;
-	const apiUrl = pub[keys.url];
-	const publishableKey = pub[keys.publishableKey];
-	const dbUrl = tooling[TOOLING_KEYS.dbUrl];
-	const secretKey = tooling[TOOLING_KEYS.secretKey];
-	const missing = [
-		[
-			keys.url,
-			apiUrl,
-			product.config.env.file
-		],
-		[
-			keys.publishableKey,
-			publishableKey,
-			product.config.env.file
-		],
-		[
-			TOOLING_KEYS.dbUrl,
-			dbUrl,
-			product.config.env.tooling
-		],
-		[
-			TOOLING_KEYS.secretKey,
-			secretKey,
-			product.config.env.tooling
-		]
-	].filter(([, value]) => !value);
-	if (missing.length > 0 || !apiUrl || !publishableKey || !dbUrl || !secretKey) throw new TargetError(`A hosted project needs ${missing.map(([key, , file]) => `${String(key)} (in ${String(file)})`).join(", ")}. Run \`devtools setup --hosted\`.`);
-	assertNotProduction(product, apiUrl, dbUrl);
+const CREATE_KINDS = {
+	SCHEMA: "schema",
+	TABLE: "table",
+	"FOREIGN TABLE": "table",
+	SEQUENCE: "sequence",
+	TYPE: "type",
+	DOMAIN: "type",
+	VIEW: "view",
+	"MATERIALIZED VIEW": "view",
+	FUNCTION: "function",
+	PROCEDURE: "function"
+};
+const WORD = (word) => new RegExp(`^${word}\\b`, "i");
+/**
+* Classifies the statements of a live diff. `existing` is what the live
+* database has (for `CREATE OR REPLACE`, which reads the same whether the
+* object is missing or merely different).
+*/
+function classifyDiff(sql, existing, columnTypes = /* @__PURE__ */ new Map(), livePrivileges) {
+	const signatures = /* @__PURE__ */ new Set();
+	for (const key of existing) {
+		const m = /^signature:(.*?)\((.*)\)$/.exec(key);
+		if (m) signatures.add(`${m[1]}${normalizeKeySignature(m[2])}`);
+	}
+	const creates = [];
+	const drops = [];
+	const conflicts = /* @__PURE__ */ new Map();
+	const conflicted = /* @__PURE__ */ new Set();
+	const extras = [];
+	const preamble = [];
+	const privileges = [];
+	const conflict = (object, why) => {
+		const set = conflicts.get(object) ?? /* @__PURE__ */ new Set();
+		set.add(why);
+		conflicts.set(object, set);
+	};
+	for (const statement of splitStatements(sql)) {
+		const text = statement.replace(/\s+/g, " ");
+		if (WORD("SET").test(text)) {
+			preamble.push(statement);
+			continue;
+		}
+		if (WORD("GRANT").test(text) || WORD("REVOKE").test(text)) {
+			const p = privilegeOf(text, WORD("REVOKE").test(text));
+			privileges.push({
+				...p,
+				sql: statement
+			});
+			continue;
+		}
+		const create = new RegExp(String.raw`^CREATE\s+(OR\s+REPLACE\s+)?(?:UNIQUE\s+)?(?:TEMP(?:ORARY)?\s+)?(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|CONSTRAINT TRIGGER)\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT}(?:\s*\.\s*${IDENT})*)(.*)$`, "is").exec(text);
+		if (create) {
+			const replace = Boolean(create[1]);
+			const kindWord = create[2].toUpperCase().replace(/\s+/g, " ");
+			const name = create[3];
+			const rest = create[4];
+			let key;
+			let label;
+			if (kindWord === "INDEX") {
+				key = `index:${parts(name).at(-1)}`;
+				label = `index ${shown(name)}`;
+			} else if (kindWord === "POLICY" || kindWord === "TRIGGER" || kindWord === "CONSTRAINT TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const table = on ? qualified(on[1]) : "?";
+				const noun = kindWord === "POLICY" ? "policy" : "trigger";
+				key = `${noun}:${table}:${parts(name).at(-1)}`;
+				label = `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`;
+			} else if (kindWord === "FUNCTION" || kindWord === "PROCEDURE") {
+				const sig = signatureOf(balanced(rest) ?? "");
+				key = `function:${qualified(name)}${sig}`;
+				label = `function ${shown(name)}${sig}`;
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				key = `${kind}:${qualified(name)}`;
+				label = `${kind} ${shown(name)}`;
+			}
+			const exists = key.startsWith("function:") ? signatures.has(key.slice(9)) || signatures.size === 0 && existing.has(`function:${qualified(name)}`) : existing.has(key);
+			if (replace && exists) {
+				conflicted.add(key);
+				conflict(label, "its definition differs from supabase/schemas");
+			} else creates.push({
+				key,
+				sql: statement,
+				label
+			});
+			continue;
+		}
+		const drop = new RegExp(String.raw`^DROP\s+(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|EXTENSION)\s+(?:IF\s+EXISTS\s+)?(${QNAME})(.*)$`, "is").exec(text);
+		if (drop) {
+			const kindWord = drop[1].toUpperCase();
+			const name = drop[2];
+			const rest = drop[3];
+			if (kindWord === "INDEX") drops.push({
+				key: `index:${parts(name).at(-1)}`,
+				finding: {
+					object: `index ${shown(name)}`,
+					detail: "not in supabase/schemas"
+				}
+			});
+			else if (kindWord === "POLICY" || kindWord === "TRIGGER") {
+				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
+				const noun = kindWord.toLowerCase();
+				drops.push({
+					key: `${noun}:${on ? qualified(on[1]) : "?"}:${parts(name).at(-1)}`,
+					finding: {
+						object: `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			} else if (kindWord === "FUNCTION" || kindWord === "PROCEDURE") {
+				const sig = signatureOf(balanced(rest) ?? "");
+				drops.push({
+					key: `function:${qualified(name)}${sig}`,
+					finding: {
+						object: `function ${shown(name)}${sig}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			} else {
+				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
+				drops.push({
+					key: `${kind}:${qualified(name)}`,
+					finding: {
+						object: `${kind} ${shown(name)}`,
+						detail: "not in supabase/schemas"
+					}
+				});
+			}
+			continue;
+		}
+		const alterTable = new RegExp(String.raw`^ALTER\s+(?:FOREIGN\s+)?TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${QNAME})\s+(.*)$`, "is").exec(text);
+		if (alterTable) {
+			const table = alterTable[1];
+			const t = qualified(table);
+			for (const action of splitTopLevel(alterTable[2])) classifyTableAction(table, t, action, {
+				creates,
+				drops,
+				conflict
+			});
+			continue;
+		}
+		const alterType = new RegExp(String.raw`^ALTER\s+TYPE\s+(${QNAME})\s+ADD\s+VALUE\b`, "i").exec(text);
+		if (alterType) {
+			creates.push({
+				key: `enumvalue:${statement}`,
+				sql: statement,
+				label: `a value of type ${shown(alterType[1])}`
+			});
+			continue;
+		}
+		conflict(text.slice(0, 80), "a difference devtools does not know how to classify, so it will not touch it");
+	}
+	const renamedCreates = /* @__PURE__ */ new Set();
+	const renamedDrops = /* @__PURE__ */ new Set();
+	for (const c of creates) {
+		if (!c.column) continue;
+		const from = drops.find((d) => {
+			if (!d.column || renamedDrops.has(d)) return false;
+			if (d.column.table !== c.column.table) return false;
+			const type = columnTypes.get(`${d.column.table}.${d.column.name}`);
+			return type !== void 0 && normalizeType(type) === c.column.type;
+		});
+		if (!from) continue;
+		renamedCreates.add(c);
+		renamedDrops.add(from);
+		conflict(c.label, `supabase/schemas has it, and your database has ${from.finding.object} of the same type (${c.column.type}); that looks like a rename, so devtools will not add an empty column beside it. If you renamed it on purpose, rename it in supabase/schemas too; otherwise rename it back`);
+	}
+	const skipped = new Set([...renamedCreates].map((c) => c.key.slice(7)));
+	const liveCreates = creates.filter((c) => !renamedCreates.has(c));
+	const liveDrops = drops.filter((d) => !renamedDrops.has(d));
+	const created = new Set(liveCreates.map((c) => c.key));
+	const dropped = new Set(liveDrops.map((d) => d.key));
+	const restoring = liveCreates.filter((c) => !dropped.has(c.key));
+	for (const d of liveDrops) {
+		if (conflicted.has(d.key)) continue;
+		if (created.has(d.key)) conflict(d.finding.object, "it is defined differently from supabase/schemas");
+		else extras.push(d.finding);
+	}
+	const newNames = new Set(restoring.map((c) => c.key).filter((key) => !/^(index|policy|trigger|constraint|rls)/.test(key)).map((key) => key.slice(key.indexOf(":") + 1)));
+	const tail = [];
+	const regranted = /* @__PURE__ */ new Set();
+	const grants = /* @__PURE__ */ new Map();
+	const revokes = /* @__PURE__ */ new Map();
+	const grantOf = (target, grantee) => {
+		const key = `${target}|${grantee}`;
+		const set = grants.get(key) ?? /* @__PURE__ */ new Set();
+		grants.set(key, set);
+		return set;
+	};
+	const expand = (p, u) => u.priv === "ALL" ? ALL_PRIVILEGES[u.column ? "COLUMN" : p.kind] ?? [] : [u.priv];
+	const granting = [];
+	for (const p of privileges) {
+		if (p.targets.length > 0 && p.targets.every((t) => skipped.has(t))) continue;
+		if (p.targets.length > 0 && (newNames.has(p.base) || p.targets.every((t) => newNames.has(t)))) {
+			tail.push(p.sql);
+			continue;
+		}
+		if (!p.object || p.grantees.length === 0 || p.units.length === 0) {
+			if (!p.revoke) {
+				tail.push(p.sql);
+				regranted.add(p.object ?? "privileges");
+			} else extras.push({
+				object: p.object ?? "privileges",
+				detail: "differ from what supabase/schemas grants"
+			});
+			continue;
+		}
+		for (const grantee of p.grantees) {
+			for (const u of p.units) {
+				const target = u.column ? `${p.base}.${u.column}` : p.base;
+				if (p.revoke) {
+					const key = `${target}|${grantee.name}`;
+					const entry = revokes.get(key) ?? {
+						p,
+						grantee: grantee.name,
+						target,
+						privs: /* @__PURE__ */ new Set()
+					};
+					for (const priv of u.priv === "ALL" ? ["ALL"] : [u.priv]) entry.privs.add(priv);
+					revokes.set(key, entry);
+				} else for (const priv of expand(p, u)) grantOf(target, grantee.name).add(priv);
+			}
+			if (!p.revoke) granting.push({
+				p,
+				grantee
+			});
+		}
+	}
+	const liveOf = (target, grantee) => livePrivileges ? livePrivileges.get(target)?.get(grantee) ?? /* @__PURE__ */ new Set() : null;
+	const written = /* @__PURE__ */ new Set();
+	for (const { p, grantee } of granting) {
+		const byPriv = [];
+		const byColumn = [];
+		for (const u of p.units) {
+			const live = liveOf(u.column ? `${p.base}.${u.column}` : p.base, grantee.name);
+			for (const priv of expand(p, u)) {
+				if (live?.has(priv)) continue;
+				if (u.column) byColumn.push(`${priv} ("${u.column}")`);
+				else byPriv.push(u.priv === "ALL" ? priv : u.priv);
+			}
+		}
+		const missing = [...new Set(byPriv)];
+		const statements = [...missing.length > 0 ? [`GRANT ${missing.join(", ")} ${p.onText} TO ${grantee.raw}${p.option}`] : [], ...[...new Set(byColumn)].map((c) => `GRANT ${c} ${p.onText} TO ${grantee.raw}${p.option}`)];
+		for (const statement of statements) {
+			if (written.has(statement)) continue;
+			written.add(statement);
+			tail.push(statement);
+			regranted.add(p.object);
+		}
+	}
+	for (const { p, grantee, target, privs } of revokes.values()) {
+		const granted = grants.get(`${target}|${grantee}`) ?? /* @__PURE__ */ new Set();
+		const live = liveOf(target, grantee);
+		if (live === null) {
+			if (granted.size > 0) continue;
+			extras.push({
+				object: p.object,
+				detail: `granted to ${grantee} beyond (or instead of) what supabase/schemas grants`
+			});
+			continue;
+		}
+		const beyond = (privs.has("ALL") ? [...live] : [...privs]).filter((priv) => live.has(priv) && !granted.has(priv));
+		if (beyond.length === 0) continue;
+		const column = target === p.base ? "" : ` (column "${target.slice(p.base.length + 1)}")`;
+		extras.push({
+			object: p.object,
+			detail: `${beyond.sort().join(", ")}${column} granted to ${grantee} beyond what supabase/schemas grants`
+		});
+	}
+	const restore = [];
+	const restored = [...restoring.map((c) => c.label), ...regranted];
+	if (restoring.length > 0 || tail.length > 0) restore.push(...preamble, ...restoring.map((c) => c.sql), ...tail);
 	return {
-		kind: "hosted",
-		apiUrl,
-		dbUrl,
-		publishableKey,
-		secretKey
+		restore,
+		restored,
+		extras: dedupe(extras),
+		conflicts: [...conflicts].map(([object, why]) => ({
+			object,
+			detail: [...why].join("; ")
+		}))
 	};
 }
-/**
-* `--local` or `--hosted` if given; else what `setup` recorded in
-* `.env.tooling`; else hosted when that file carries a `DB_URL` (the
-* contributor chose their own project) and the local stack when it does not.
-*/
-function chooseKind(product, preference) {
-	if (preference) return preference;
-	const tooling = readEnvFile(product.paths.toolingFile);
-	const recorded = tooling[TOOLING_KEYS.target];
-	if (recorded === "local" || recorded === "hosted") return recorded;
-	return tooling[TOOLING_KEYS.dbUrl] ? "hosted" : "local";
+function dedupe(findings) {
+	const seen = /* @__PURE__ */ new Set();
+	return findings.filter((f) => {
+		const key = `${f.object}|${f.detail}`;
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
 }
-async function resolveTarget(product, cli, run, preference) {
-	return chooseKind(product, preference) === "hosted" ? hostedTarget(product) : localTarget(product, cli, run);
+function classifyTableAction(table, t, action, ctx) {
+	const sql = `ALTER TABLE ${table} ${action}`;
+	let m;
+	if (m = new RegExp(String.raw`^ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) {
+		const typeText = action.slice(m[0].length).trim().split(/\s+(?:DEFAULT|NOT\s+NULL|NULL|GENERATED|CONSTRAINT|REFERENCES|CHECK|COLLATE|UNIQUE|PRIMARY)\b/i)[0];
+		ctx.creates.push({
+			key: `column:${t}.${parts(m[1])[0]}`,
+			sql,
+			label: `column ${shown(table)}.${shown(m[1])}`,
+			column: {
+				table: t,
+				name: parts(m[1])[0],
+				type: normalizeType(typeText)
+			}
+		});
+	} else if (m = new RegExp(String.raw`^ADD\s+CONSTRAINT\s+(${IDENT})`, "i").exec(action)) ctx.creates.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		sql,
+		label: `constraint ${shown(m[1])} on ${shown(table)}`
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `column:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `column ${shown(table)}.${shown(m[1])}`,
+			detail: "not in supabase/schemas"
+		},
+		column: {
+			table: t,
+			name: parts(m[1])[0]
+		}
+	});
+	else if (m = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
+		key: `constraint:${t}.${parts(m[1])[0]}`,
+		finding: {
+			object: `constraint ${shown(m[1])} on ${shown(table)}`,
+			detail: "not in supabase/schemas"
+		}
+	});
+	else if (m = new RegExp(String.raw`^ALTER\s+COLUMN\s+(${IDENT})\s+(.*)$`, "i").exec(action)) {
+		const what = m[2];
+		const aspect = /^(?:SET\s+DATA\s+)?TYPE\b/i.test(what) ? "type" : /\bDEFAULT\b/i.test(what) ? "default" : /\bNOT\s+NULL\b/i.test(what) ? "nullability" : "definition";
+		ctx.conflict(`column ${shown(table)}.${shown(m[1])}`, `its ${aspect} differs from supabase/schemas`);
+	} else if (/^(?:ENABLE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/i.test(action)) ctx.creates.push({
+		key: `rls:${t}:${action.toUpperCase()}`,
+		sql,
+		label: `row level security on ${shown(table)}`
+	});
+	else ctx.conflict(`table ${shown(table)}`, `a change devtools will not make for you (${action.slice(0, 60)})`);
 }
 //#endregion
-//#region src/product/dev-data.ts
+//#region src/product/exec.ts
+const spawnRunner = (command, args, options) => new Promise((resolve, reject) => {
+	const child = spawnProcess(command, args, {
+		cwd: options.cwd,
+		env: {
+			...process.env,
+			...options.env
+		},
+		stdio: options.inherit ? "inherit" : [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	let stdout = "";
+	let stderr = "";
+	child.stdout?.on("data", (chunk) => {
+		stdout += chunk.toString("utf8");
+	});
+	child.stderr?.on("data", (chunk) => {
+		stderr += chunk.toString("utf8");
+	});
+	child.on("error", reject);
+	child.on("close", (code) => {
+		resolve({
+			code: code ?? 1,
+			stdout,
+			stderr
+		});
+	});
+});
+/** `command arg arg`, quoted only where a shell would need it. For messages. */
+function commandLine(command, args) {
+	return [command, ...args].map((part) => /^[\w@%+=:,./-]+$/.test(part) ? part : JSON.stringify(part)).join(" ");
+}
+//#endregion
+//#region src/product/supabase-cli.ts
 /**
-* `dev-data`: fill a development database with believable rows (DogPack's fake
-* hosts, and open, full and past sessions for the member's own courses).
-*
-* The product supplies the SQL (`devData.file`); devtools supplies who to
-* run it for. The file reads the signed-in member from a session setting:
-*
-* ```sql
-* select current_setting('devtools.member_id')::uuid;
-* ```
+* Finding the Supabase CLI a product is pinned to.
 *
-* `devtools.member_id` is the Supabase `auth.users` id of the member, found as
-* the most recent sign-in through "Sign in with DevDogs" unless `--member`
-* names someone. Nothing is seeded until someone has signed in, which is why
-* this is a command run afterwards and not part of `setup`.
+* A product repo may have no `package.json` (DogPack has none), so the CLI
+* cannot be assumed to be a dependency. In order:
 *
-* It refuses any database that is not the local stack or the contributor's own
-* project, and the SQL runs in one transaction.
-*/
-var DevDataError = class extends Error {
-	/** A failure the contributor or the product's SQL caused, not a devtools bug: never sent to Sentry. */
-	expected = true;
-	constructor(message) {
-		super(message);
-		this.name = "DevDataError";
-	}
-};
-/**
-* Whether `err` is the product's own SQL being wrong: a Postgres error whose
-* SQLSTATE class is a cardinality violation (21), data exception (22),
-* integrity constraint violation (23) or syntax error or access rule
-* violation (42). Everything else is not the file's fault and reports as a
-* normal failure: a refused or dropped connection (class 08 and
-* `ECONNREFUSED`), an operator shutdown (57, `admin_shutdown`), a server out
-* of resources (53), a transaction that was rolled back (40), and so on.
-*/
-function isSqlFileError(err) {
-	const code = err?.code;
-	return typeof code === "string" && /^(21|22|23|42)[0-9A-Z]{3}$/.test(code);
-}
-/**
-* The line of `text` a Postgres error points at, from the error's 1-based
-* character `position`, or null when it carries none.
-*/
-function errorLine(err, text) {
-	const raw = err?.position;
-	const position = typeof raw === "string" ? Number(raw) : raw;
-	if (typeof position !== "number" || !Number.isInteger(position)) return null;
-	if (position < 1 || position > text.length + 1) return null;
-	return text.slice(0, position - 1).split("\n").length;
-}
-function postgresSession(dbUrl) {
-	const sql = postgres(dbUrl, {
-		max: 1,
-		onnotice: () => void 0
-	});
-	return {
-		async members(provider) {
-			return (await sql`
-        select u.id, u.email, u.last_sign_in_at
-        from auth.users u
-        join auth.identities i on i.user_id = u.id
-        where i.provider = ${provider}
-        order by u.last_sign_in_at desc nulls last
-        limit 5`).map((r) => ({
-				id: r.id,
-				email: r.email,
-				lastSignInAt: r.last_sign_in_at?.toISOString() ?? null
-			}));
-		},
-		async memberByRef(ref) {
-			const row = (await sql`
-        select id, email, last_sign_in_at from auth.users
-        where id::text = ${ref} or lower(email) = lower(${ref})
-        limit 1`)[0];
-			return row ? {
-				id: row.id,
-				email: row.email,
-				lastSignInAt: row.last_sign_in_at?.toISOString() ?? null
-			} : null;
-		},
-		async appliedMigrations() {
-			const [table] = await sql`
-        select to_regclass('supabase_migrations.schema_migrations')::text as present`;
-			if (!table?.present) return null;
-			return (await sql`
-        select version from supabase_migrations.schema_migrations`).map((r) => r.version);
-		},
-		async missingSchemas(schemas) {
-			const rows = await sql`
-        select nspname from pg_namespace where nspname = any(${[...schemas]})`;
-			const present = new Set(rows.map((r) => r.nspname));
-			return schemas.filter((name) => !present.has(name));
-		},
-		async existingObjects(schemas) {
-			const list = [...schemas];
-			const found = /* @__PURE__ */ new Set();
-			const functions = await sql`
-        select n.nspname as s, p.proname as n from pg_proc p
-        join pg_namespace n on n.oid = p.pronamespace
-        where n.nspname = any(${list})`;
-			for (const r of functions) found.add(`function:${r.s}.${r.n}`);
-			const views = await sql`
-        select n.nspname as s, c.relname as n from pg_class c
-        join pg_namespace n on n.oid = c.relnamespace
-        where n.nspname = any(${list}) and c.relkind in ('v', 'm')`;
-			for (const r of views) found.add(`view:${r.s}.${r.n}`);
-			const triggers = await sql`
-        select n.nspname as s, c.relname as t, g.tgname as n from pg_trigger g
-        join pg_class c on c.oid = g.tgrelid
-        join pg_namespace n on n.oid = c.relnamespace
-        where n.nspname = any(${list}) and not g.tgisinternal`;
-			for (const r of triggers) found.add(`trigger:${r.s}.${r.t}:${r.n}`);
-			return found;
-		},
-		async exec(text) {
-			await sql.begin(async (tx) => {
-				await tx.unsafe(text);
-			});
-		},
-		async runAs(memberId, text) {
-			await sql.begin(async (tx) => {
-				await tx`select set_config('devtools.member_id', ${memberId}, true)`;
-				await tx.unsafe(text);
-			});
-		},
-		close: () => sql.end({ timeout: 5 })
-	};
+*   1. `node_modules/.bin/supabase` in the repo, when its version is the pin;
+*   2. a `supabase` on PATH whose version is the pin;
+*   3. `pnpm dlx supabase@<pin>`, which downloads and caches the right one.
+*      Members are expected to have pnpm (both product repos pin it);
+*   4. `npx --yes supabase@<pin>`, only when pnpm is not on PATH.
+*
+* The pin is also part of the generated-types hash, so a contributor on a
+* different CLI would generate different types than CI; matching it is not
+* cosmetic.
+*/
+function cliLine(cli, args) {
+	return commandLine(cli.command, [...cli.prefix, ...args]);
 }
-async function runDevData(product, target, open, options) {
-	const log = options.log ?? (() => void 0);
-	const { devData } = product.config;
-	if (!devData) throw new DevDataError(`${product.config.name} has no dev data: add "devData": { "file": "supabase/dev-data.sql" } to devtools.config.json.`);
-	try {
-		assertNotProduction(product, target.apiUrl, target.dbUrl);
-	} catch (err) {
-		if (err instanceof TargetError) throw new DevDataError(err.message);
-		throw err;
-	}
-	const file = join(product.root, devData.file);
-	const text = readFileSync(file, "utf8");
-	const session = open(target.dbUrl);
-	try {
-		const missing = await session.missingSchemas(product.config.supabase.schemas);
-		if (missing.length > 0) throw new DevDataError(`This database does not have ${product.config.name}'s ${missing.length === 1 ? "schema" : "schemas"} yet (missing: ${missing.join(", ")}). Run \`devtools setup\` first, or \`devtools db sync\` if you have already set up.`);
-		return await seed(session, devData.file, text, options, log);
-	} finally {
-		await session.close();
-	}
+function versionOf$1(output) {
+	return /\b(\d+\.\d+\.\d+)\b/.exec(output)?.[1] ?? null;
 }
-async function seed(session, file, text, options, log) {
-	const member = options.member ? await session.memberByRef(options.member) : (await session.members(options.provider))[0] ?? null;
-	if (!member) throw new DevDataError(options.member ? `No user matches ${options.member} in this database.` : `Nobody has signed in with DevDogs on this database yet. Start the app, sign in, then run this again (or name someone with --member).`);
-	log(`Seeding as ${member.email ?? member.id} (${member.id})`);
-	if (options.dryRun) {
-		log(`Would run ${file} (${text.split("\n").length} lines) in one transaction.`);
-		return null;
-	}
+async function resolveSupabaseCli(root, pin, run, fileExists = existsSync) {
+	const candidates = [];
+	const local = join(root, "node_modules", ".bin", "supabase");
+	if (fileExists(local)) candidates.push({
+		command: local,
+		prefix: [],
+		source: "repo"
+	});
+	candidates.push({
+		command: "supabase",
+		prefix: [],
+		source: "path"
+	});
+	for (const candidate of candidates) try {
+		const result = await run(candidate.command, ["--version"], { cwd: root });
+		if (result.code === 0 && versionOf$1(result.stdout) === pin) return candidate;
+	} catch {}
 	try {
-		await session.runAs(member.id, text);
-	} catch (err) {
-		if (!isSqlFileError(err)) throw err;
-		const line = errorLine(err, text);
-		throw new DevDataError(`${file}${line === null ? "" : `:${line}`}: ${err.message}. This is a problem in the product's dev-data SQL, not in devtools; nothing was seeded (the file runs in one transaction).`);
-	}
+		if ((await run("pnpm", ["--version"], { cwd: root })).code === 0) return {
+			command: "pnpm",
+			prefix: ["dlx", `supabase@${pin}`],
+			source: "pnpm"
+		};
+	} catch {}
 	return {
-		member,
-		file
+		command: "npx",
+		prefix: ["--yes", `supabase@${pin}`],
+		source: "npx"
 	};
 }
 //#endregion
-//#region src/product/management.ts
-/**
-* The two hosted-project auth settings "Sign in with DevDogs" needs and a
-* contributor would otherwise click through the dashboard for:
-*
-*   * `custom_oauth_enabled`: off by default, and GoTrue's custom-provider
-*     endpoint answers 404 "Custom OAuth providers are disabled" until it is
-*     on, so registering `custom:devdogsuga` fails without it;
-*   * `uri_allow_list`: the app's return addresses, which the local stack
-*     reads from `supabase/config.toml` instead.
-*
-* Both are the Management API's `PATCH /v1/projects/{ref}/config/auth`, with a
-* personal access token (`SUPABASE_ACCESS_TOKEN`, from the dashboard's Access
-* Tokens page). Without a token `setup` prints the two dashboard steps.
-*/
-const API = "https://api.supabase.com";
-var ManagementError = class extends Error {
-	status;
-	constructor(message, status) {
+//#region src/product/target.ts
+const TOOLING_KEYS = {
+	/** `local` or `hosted`: what `setup` last chose. Wins over everything else. */
+	target: "DEVTOOLS_TARGET",
+	dbUrl: "DB_URL",
+	secretKey: "SECRET_KEY",
+	accessToken: "SUPABASE_ACCESS_TOKEN"
+};
+var TargetError = class extends Error {
+	constructor(message) {
 		super(message);
-		this.status = status;
-		this.name = "ManagementError";
+		this.name = "TargetError";
 	}
 };
-/** The project ref in `https://<ref>.supabase.co`, or null for a custom domain or local URL. */
-function projectRefOf(apiUrl) {
+/** The project ref or vanity name in a Supabase URL or pooler URL, if it has one. */
+function projectNameOf(url) {
 	try {
-		return /^([a-z0-9]{20})\.supabase\.co$/.exec(new URL(apiUrl).hostname)?.[1] ?? null;
+		const { hostname, username } = new URL(url);
+		const fromHost = /^([a-z0-9-]+)\.supabase\.co$/.exec(hostname)?.[1];
+		if (fromHost) return fromHost;
+		const fromUser = /^postgres\.([a-z0-9]+)$/.exec(username)?.[1];
+		if (fromUser) return fromUser;
+		return /^db\.([a-z0-9]+)\.supabase\.co$/.exec(hostname)?.[1] ?? null;
 	} catch {
 		return null;
 	}
 }
-/** The allow list with `wanted` added, keeping what was there; comma-separated as GoTrue stores it. */
-function mergeAllowList(current, wanted) {
-	const entries = (current ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
-	for (const uri of wanted) if (!entries.includes(uri)) entries.push(uri);
-	return entries.join(",");
-}
-async function ensureHostedAuthSettings(input) {
-	const doFetch = input.fetch ?? fetch;
-	const headers = {
-		authorization: `Bearer ${input.token}`,
-		"content-type": "application/json"
-	};
-	const url = `${API}/v1/projects/${input.projectRef}/config/auth`;
-	const current = await doFetch(url, { headers });
-	if (!current.ok) throw new ManagementError(current.status === 401 || current.status === 403 ? "The Supabase access token was refused. Create one at https://supabase.com/dashboard/account/tokens." : `Reading the project's auth settings failed (${current.status}).`, current.status);
-	const settings = await current.json();
-	const patch = {};
-	const changed = [];
-	if (settings.custom_oauth_enabled !== true) {
-		patch["custom_oauth_enabled"] = true;
-		changed.push("custom_oauth_enabled");
-	}
-	const allow = mergeAllowList(settings.uri_allow_list, input.redirectUris);
-	if (allow !== (settings.uri_allow_list ?? "")) {
-		patch["uri_allow_list"] = allow;
-		changed.push("uri_allow_list");
+/** Refuses a URL that names one of the product's production projects. */
+function assertNotProduction(product, ...urls) {
+	const production = new Set(product.config.production.projects);
+	for (const url of urls) {
+		const name = projectNameOf(url);
+		if (name !== null && production.has(name)) throw new TargetError(`${url} is ${product.config.name}'s production project (${name}). devtools only acts on your own development project or the local Docker stack.`);
 	}
-	if (changed.length === 0) return { changed };
-	const response = await doFetch(url, {
-		method: "PATCH",
-		headers,
-		body: JSON.stringify(patch)
-	});
-	if (!response.ok) throw new ManagementError(`Updating the project's auth settings failed (${response.status}).`, response.status);
-	return { changed };
 }
-//#endregion
-//#region src/product/oauth.ts
-/**
-* "Sign in with DevDogs" for a product's development database, without
-* prompts: the non-interactive halves of `devtools oauth`.
-*
-* The wizard (`../oauth/wizard.ts`) is the front door and is what `setup`
-* runs for a person. These two exist for the cases that have no person:
-*
-*   * a fresh-machine or CI run that already holds an OAuth client's id and
-*     secret (`DEVDOGS_OAUTH_CLIENT_ID` / `DEVDOGS_OAUTH_CLIENT_SECRET`);
-*   * `db sync --rebuild`, which resets the local database and with it
-*     `auth.custom_oauth_providers`, so the provider is registered again from
-*     the credentials the wizard saved to the product's `.env.tooling`.
-*/
-var OAuthRegistrationError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "OAuthRegistrationError";
-	}
-};
-function credentialsFromEnv(env) {
-	const clientId = env["DEVDOGS_OAUTH_CLIENT_ID"];
-	const clientSecret = env["DEVDOGS_OAUTH_CLIENT_SECRET"];
-	if (!clientId || !clientSecret) return null;
+/** Reads `supabase status -o env` for the running local stack. */
+async function localTarget(product, cli, run) {
+	const args = [
+		...cli.prefix,
+		"status",
+		"-o",
+		"env"
+	];
+	const result = await run(cli.command, args, { cwd: product.root });
+	if (result.code !== 0) throw new TargetError(`The local Supabase stack is not running (${cliLine(cli, ["status"])} failed). Start it with \`devtools supabase start\`, or run \`devtools setup\`.`);
+	const env = parse(result.stdout);
+	const apiUrl = env["API_URL"];
+	const dbUrl = env["DB_URL"];
+	const publishableKey = env["PUBLISHABLE_KEY"] ?? env["ANON_KEY"];
+	const secretKey = env["SERVICE_ROLE_KEY"] ?? env["SECRET_KEY"];
+	if (!apiUrl || !dbUrl || !publishableKey || !secretKey) throw new TargetError("`supabase status -o env` did not report the API URL, DB URL and keys. Is the stack fully started?");
 	return {
-		clientId,
-		clientSecret,
-		baseUrl: env["DEVDOGS_OAUTH_BASE_URL"]
+		kind: "local",
+		apiUrl,
+		dbUrl,
+		publishableKey,
+		secretKey
 	};
 }
-/** Registers `custom:devdogsuga` on the target with these credentials. */
-async function registerProvider(credentialsFile, target, credentials) {
-	const { issuer } = await fetchIssuerFromAny(credentials.baseUrl ? [credentials.baseUrl] : DEFAULT_API_URLS);
-	const row = await upsertDevDogsProvider({
-		apiUrl: target.apiUrl,
-		serviceRoleKey: target.secretKey
-	}, {
-		identifier: OAUTH.providerId,
-		name: PROVIDER_NAME,
-		clientId: credentials.clientId,
-		clientSecret: credentials.clientSecret,
-		issuer
-	});
-	upsertEnvFile(credentialsFile, {
-		[ENV_KEYS.clientId]: credentials.clientId,
-		[ENV_KEYS.clientSecret]: credentials.clientSecret
-	});
-	return row;
+/** The contributor's own hosted project, from `.env` and `.env.tooling`. */
+function hostedTarget(product) {
+	const pub = readEnvFile(product.paths.envFile);
+	const tooling = readEnvFile(product.paths.toolingFile);
+	const { keys } = product.config.env;
+	const apiUrl = pub[keys.url];
+	const publishableKey = pub[keys.publishableKey];
+	const dbUrl = tooling[TOOLING_KEYS.dbUrl];
+	const secretKey = tooling[TOOLING_KEYS.secretKey];
+	const missing = [
+		[
+			keys.url,
+			apiUrl,
+			product.config.env.file
+		],
+		[
+			keys.publishableKey,
+			publishableKey,
+			product.config.env.file
+		],
+		[
+			TOOLING_KEYS.dbUrl,
+			dbUrl,
+			product.config.env.tooling
+		],
+		[
+			TOOLING_KEYS.secretKey,
+			secretKey,
+			product.config.env.tooling
+		]
+	].filter(([, value]) => !value);
+	if (missing.length > 0 || !apiUrl || !publishableKey || !dbUrl || !secretKey) throw new TargetError(`A hosted project needs ${missing.map(([key, , file]) => `${String(key)} (in ${String(file)})`).join(", ")}. Run \`devtools setup --hosted\`.`);
+	assertNotProduction(product, apiUrl, dbUrl);
+	return {
+		kind: "hosted",
+		apiUrl,
+		dbUrl,
+		publishableKey,
+		secretKey
+	};
 }
-/** Registers the provider again from what the wizard saved to `.env.tooling`. */
-async function reRegisterSavedProvider(credentialsFile, target) {
-	const saved = readEnvFile(credentialsFile);
-	const clientId = saved[ENV_KEYS.clientId];
-	const clientSecret = saved[ENV_KEYS.clientSecret];
-	if (!clientId || !clientSecret) throw new OAuthRegistrationError(`No saved OAuth client in ${basename(credentialsFile)}, so "Sign in with DevDogs" cannot be registered again automatically. Run \`devtools oauth\`.`);
-	return registerProvider(credentialsFile, target, {
-		clientId,
-		clientSecret,
-		baseUrl: saved[ENV_KEYS.baseUrl]
-	});
+/**
+* `--local` or `--hosted` if given; else what `setup` recorded in
+* `.env.tooling`; else hosted when that file carries a `DB_URL` (the
+* contributor chose their own project) and the local stack when it does not.
+*/
+function chooseKind(product, preference) {
+	if (preference) return preference;
+	const tooling = readEnvFile(product.paths.toolingFile);
+	const recorded = tooling[TOOLING_KEYS.target];
+	if (recorded === "local" || recorded === "hosted") return recorded;
+	return tooling[TOOLING_KEYS.dbUrl] ? "hosted" : "local";
+}
+async function resolveTarget(product, cli, run, preference) {
+	return chooseKind(product, preference) === "hosted" ? hostedTarget(product) : localTarget(product, cli, run);
 }
 //#endregion
-//#region src/product/schema-hash.ts
+//#region src/product/dev-data.ts
 /**
-* The schema hash that names a set of generated types.
+* `dev-data`: fill a development database with believable rows (DogPack's fake
+* hosts, and open, full and past sessions for the member's own courses).
 *
-* Generated types are never committed (Q82). CI builds them once per schema
-* change and uploads them to a rolling `generated-types` release; a
-* contributor who cannot (or would rather not) generate them downloads the
-* asset whose name carries the hash of the schema they have checked out. Two
-* checkouts with the same hash have the same types, so the hash must change
-* exactly when the generated output could.
+* The product supplies the SQL (`devData.file`); devtools supplies who to
+* run it for. The file reads the signed-in member from a session setting:
 *
-* It covers:
-*   * every file under `supabase/schemas`, by sorted path (POSIX separators,
-*     relative to the schemas directory) and LF-normalised contents, so a
-*     Windows checkout with CRLF hashes like a Linux one;
-*   * the generator and its version (the pinned Supabase CLI for TypeScript,
-*     supadart for Dart), since a new generator rewrites the output.
+* ```sql
+* select current_setting('devtools.member_id')::uuid;
+* ```
+*
+* `devtools.member_id` is the Supabase `auth.users` id of the member, found as
+* the most recent sign-in through "Sign in with DevDogs" unless `--member`
+* names someone. Nothing is seeded until someone has signed in, which is why
+* this is a command run afterwards and not part of `setup`.
+*
+* It refuses any database that is not the local stack or the contributor's own
+* project, and the SQL runs in one transaction.
 */
-function listFiles(dir) {
-	if (!existsSync(dir)) return [];
-	const found = [];
-	for (const entry of readdirSync(dir, { withFileTypes: true })) {
-		const path = join(dir, entry.name);
-		if (entry.isDirectory()) found.push(...listFiles(path));
-		else found.push(path);
-	}
-	return found;
-}
-/** The files a hash covers, as POSIX paths relative to the schemas directory, sorted. */
-function schemaFiles(schemasDir) {
-	return listFiles(schemasDir).map((path) => relative(schemasDir, path).split(sep).join("/")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
-}
-function normalise(contents) {
-	return Buffer.from(contents.toString("utf8").replace(/\r\n/g, "\n"), "utf8");
-}
-function hashSchemas(schemasDir, generator) {
-	const hash = createHash("sha256");
-	for (const path of schemaFiles(schemasDir)) {
-		hash.update(`file:${path}\0`);
-		hash.update(normalise(readFileSync(join(schemasDir, ...path.split("/")))));
-		hash.update("\0");
+var DevDataError = class extends Error {
+	/** A failure the contributor or the product's SQL caused, not a devtools bug: never sent to Sentry. */
+	expected = true;
+	constructor(message) {
+		super(message);
+		this.name = "DevDataError";
 	}
-	hash.update(`generator:${generator}`);
-	return hash.digest("hex");
-}
+};
 /**
-* The generator and version string a product's types come from. For supadart
-* it is the version `pubspec.lock` resolved, else the constraint in
-* `pubspec.yaml`, so a Dart SDK bump that changes the models changes the hash.
+* Whether `err` is the product's own SQL being wrong: a Postgres error whose
+* SQLSTATE class is a cardinality violation (21), data exception (22),
+* integrity constraint violation (23) or syntax error or access rule
+* violation (42). Everything else is not the file's fault and reports as a
+* normal failure: a refused or dropped connection (class 08 and
+* `ECONNREFUSED`), an operator shutdown (57, `admin_shutdown`), a server out
+* of resources (53), a transaction that was rolled back (40), and so on.
 */
-function generatorFor(product) {
-	const { types, supabase } = product.config;
-	if (types.kind === "typescript") return `supabase@${supabase.version}`;
-	const lock = join(product.root, "pubspec.lock");
-	if (existsSync(lock)) {
-		const match = /^ {2}supadart:\n(?:.*\n)*? {4}version: "([^"]+)"/m.exec(readFileSync(lock, "utf8"));
-		if (match?.[1]) return `supadart@${match[1]}`;
-	}
-	const pubspec = join(product.root, "pubspec.yaml");
-	if (existsSync(pubspec)) {
-		const match = /^\s+supadart:\s*([^\s#]+)/m.exec(readFileSync(pubspec, "utf8"));
-		if (match?.[1]) return `supadart@${match[1]}`;
-	}
-	return "supadart@unknown";
-}
-function schemaHashFor(product) {
-	return hashSchemas(product.paths.schemasDir, generatorFor(product));
+function isSqlFileError(err) {
+	const code = err?.code;
+	return typeof code === "string" && /^(21|22|23|42)[0-9A-Z]{3}$/.test(code);
 }
-/** The release asset CI uploads for a hash, and `db types --download` looks for. */
-function typesAssetName(product, hash) {
-	return `${product}-types-${hash}.tgz`;
+/**
+* The line of `text` a Postgres error points at, from the error's 1-based
+* character `position`, or null when it carries none.
+*/
+function errorLine(err, text) {
+	const raw = err?.position;
+	const position = typeof raw === "string" ? Number(raw) : raw;
+	if (typeof position !== "number" || !Number.isInteger(position)) return null;
+	if (position < 1 || position > text.length + 1) return null;
+	return text.slice(0, position - 1).split("\n").length;
 }
-//#endregion
-//#region src/product/drift.ts
-/** Splits SQL at top-level semicolons, honoring quotes, dollar quotes and comments. Comments are dropped. */
-function splitStatements(sql) {
-	const out = [];
-	let current = "";
-	let i = 0;
-	const push = () => {
-		const text = current.trim();
-		if (text) out.push(text);
-		current = "";
-	};
-	while (i < sql.length) {
-		const ch = sql[i];
-		const next = sql[i + 1];
-		if (ch === "-" && next === "-") {
-			while (i < sql.length && sql[i] !== "\n") i++;
-			continue;
-		}
-		if (ch === "/" && next === "*") {
-			const end = sql.indexOf("*/", i + 2);
-			i = end === -1 ? sql.length : end + 2;
-			current += " ";
-			continue;
-		}
-		if (ch === "'" || ch === "\"") {
-			let j = i + 1;
-			while (j < sql.length) {
-				if (sql[j] === ch) {
-					if (sql[j + 1] === ch) {
-						j += 2;
-						continue;
-					}
-					break;
-				}
-				j++;
-			}
-			current += sql.slice(i, j + 1);
-			i = j + 1;
-			continue;
-		}
-		if (ch === "$") {
-			const tag = /^\$[A-Za-z_]*\$/.exec(sql.slice(i))?.[0];
-			if (tag) {
-				const end = sql.indexOf(tag, i + tag.length);
-				const stop = end === -1 ? sql.length : end + tag.length;
-				current += sql.slice(i, stop);
-				i = stop;
-				continue;
+function postgresSession(dbUrl) {
+	const sql = postgres(dbUrl, {
+		max: 1,
+		onnotice: () => void 0
+	});
+	return {
+		async members(provider) {
+			return (await sql`
+        select u.id, u.email, u.last_sign_in_at
+        from auth.users u
+        join auth.identities i on i.user_id = u.id
+        where i.provider = ${provider}
+        order by u.last_sign_in_at desc nulls last
+        limit 5`).map((r) => ({
+				id: r.id,
+				email: r.email,
+				lastSignInAt: r.last_sign_in_at?.toISOString() ?? null
+			}));
+		},
+		async memberByRef(ref) {
+			const row = (await sql`
+        select id, email, last_sign_in_at from auth.users
+        where id::text = ${ref} or lower(email) = lower(${ref})
+        limit 1`)[0];
+			return row ? {
+				id: row.id,
+				email: row.email,
+				lastSignInAt: row.last_sign_in_at?.toISOString() ?? null
+			} : null;
+		},
+		async appliedMigrations() {
+			const [table] = await sql`
+        select to_regclass('supabase_migrations.schema_migrations')::text as present`;
+			if (!table?.present) return null;
+			return (await sql`
+        select version from supabase_migrations.schema_migrations`).map((r) => r.version);
+		},
+		async missingSchemas(schemas) {
+			const rows = await sql`
+        select nspname from pg_namespace where nspname = any(${[...schemas]})`;
+			const present = new Set(rows.map((r) => r.nspname));
+			return schemas.filter((name) => !present.has(name));
+		},
+		async existingObjects(schemas) {
+			const list = [...schemas];
+			const found = /* @__PURE__ */ new Set();
+			const functions = await sql`
+        select n.nspname as s, p.proname as n,
+               oidvectortypes(p.proargtypes) as sig
+        from pg_proc p
+        join pg_namespace n on n.oid = p.pronamespace
+        where n.nspname = any(${list}) and p.prokind in ('f', 'p')`;
+			for (const r of functions) {
+				found.add(`function:${r.s}.${r.n}`);
+				found.add(`signature:${r.s}.${r.n}(${r.sig})`);
 			}
-		}
-		if (ch === ";") {
-			push();
-			i++;
-			continue;
-		}
-		current += ch;
-		i++;
-	}
-	push();
-	return out;
+			const views = await sql`
+        select n.nspname as s, c.relname as n from pg_class c
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and c.relkind in ('v', 'm')`;
+			for (const r of views) found.add(`view:${r.s}.${r.n}`);
+			const triggers = await sql`
+        select n.nspname as s, c.relname as t, g.tgname as n from pg_trigger g
+        join pg_class c on c.oid = g.tgrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${list}) and not g.tgisinternal`;
+			for (const r of triggers) found.add(`trigger:${r.s}.${r.t}:${r.n}`);
+			return found;
+		},
+		async columnTypes(schemas) {
+			const rows = await sql`
+        select n.nspname as s, c.relname as t, a.attname as c,
+               format_type(a.atttypid, a.atttypmod) as type
+        from pg_attribute a
+        join pg_class c on c.oid = a.attrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        where n.nspname = any(${[...schemas]}) and c.relkind in ('r', 'p', 'f')
+          and a.attnum > 0 and not a.attisdropped`;
+			return new Map(rows.map((r) => [`${r.s}.${r.t}.${r.c}`, r.type]));
+		},
+		async privileges(schemas) {
+			const list = [...schemas];
+			const out = /* @__PURE__ */ new Map();
+			const add = (key, role, priv) => {
+				const roles = out.get(key) ?? /* @__PURE__ */ new Map();
+				out.set(key, roles);
+				const name = role ?? "public";
+				const set = roles.get(name) ?? /* @__PURE__ */ new Set();
+				roles.set(name, set);
+				set.add(priv);
+			};
+			const relations = await sql`
+        select n.nspname || '.' || c.relname as key, r.rolname as role,
+               a.privilege_type as priv
+        from pg_class c
+        join pg_namespace n on n.oid = c.relnamespace
+        cross join lateral aclexplode(coalesce(c.relacl, acldefault(
+          case when c.relkind = 'S' then 's'::"char" else 'r'::"char" end,
+          c.relowner))) a
+        left join pg_roles r on r.oid = a.grantee
+        where n.nspname = any(${list})
+          and c.relkind in ('r', 'p', 'v', 'm', 'f', 'S')`;
+			for (const r of relations) add(r.key, r.role, r.priv);
+			const columns = await sql`
+        select n.nspname || '.' || c.relname || '.' || t.attname as key,
+               r.rolname as role, a.privilege_type as priv
+        from pg_attribute t
+        join pg_class c on c.oid = t.attrelid
+        join pg_namespace n on n.oid = c.relnamespace
+        cross join lateral aclexplode(t.attacl) a
+        left join pg_roles r on r.oid = a.grantee
+        where n.nspname = any(${list}) and t.attacl is not null
+          and t.attnum > 0 and not t.attisdropped`;
+			for (const r of columns) add(r.key, r.role, r.priv);
+			const functions = await sql`
+        select n.nspname || '.' || p.proname as key, r.rolname as role,
+               a.privilege_type as priv,
+               pg_get_function_identity_arguments(p.oid) as args
+        from pg_proc p
+        join pg_namespace n on n.oid = p.pronamespace
+        cross join lateral aclexplode(coalesce(p.proacl,
+          acldefault('f'::"char", p.proowner))) a
+        left join pg_roles r on r.oid = a.grantee
+        where n.nspname = any(${list}) and p.prokind in ('f', 'p')`;
+			for (const r of functions) add(`${r.key}${signatureOf(r.args)}`, r.role, r.priv);
+			const schemaRows = await sql`
+        select n.nspname as key, r.rolname as role, a.privilege_type as priv
+        from pg_namespace n
+        cross join lateral aclexplode(coalesce(n.nspacl,
+          acldefault('n'::"char", n.nspowner))) a
+        left join pg_roles r on r.oid = a.grantee
+        where n.nspname = any(${list})`;
+			for (const r of schemaRows) add(r.key, r.role, r.priv);
+			return out;
+		},
+		async exec(text) {
+			await sql.begin(async (tx) => {
+				await tx.unsafe(text);
+			});
+		},
+		async runAs(memberId, text) {
+			await sql.begin(async (tx) => {
+				await tx`select set_config('devtools.member_id', ${memberId}, true)`;
+				await tx.unsafe(text);
+			});
+		},
+		close: () => sql.end({ timeout: 5 })
+	};
 }
-/** Splits `text` at commas that are not inside parentheses or quotes. */
-function splitTopLevel(text) {
-	const parts = [];
-	let depth = 0;
-	let quote = null;
-	let start = 0;
-	for (let i = 0; i < text.length; i++) {
-		const ch = text[i];
-		if (quote) {
-			if (ch === quote) quote = null;
-		} else if (ch === "'" || ch === "\"") quote = ch;
-		else if (ch === "(") depth++;
-		else if (ch === ")") depth--;
-		else if (ch === "," && depth === 0) {
-			parts.push(text.slice(start, i).trim());
-			start = i + 1;
-		}
+async function runDevData(product, target, open, options) {
+	const log = options.log ?? (() => void 0);
+	const { devData } = product.config;
+	if (!devData) throw new DevDataError(`${product.config.name} has no dev data: add "devData": { "file": "supabase/dev-data.sql" } to devtools.config.json.`);
+	try {
+		assertNotProduction(product, target.apiUrl, target.dbUrl);
+	} catch (err) {
+		if (err instanceof TargetError) throw new DevDataError(err.message);
+		throw err;
+	}
+	const file = join(product.root, devData.file);
+	const text = readFileSync(file, "utf8");
+	const session = open(target.dbUrl);
+	try {
+		const missing = await session.missingSchemas(product.config.supabase.schemas);
+		if (missing.length > 0) throw new DevDataError(`This database does not have ${product.config.name}'s ${missing.length === 1 ? "schema" : "schemas"} yet (missing: ${missing.join(", ")}). Run \`devtools setup\` first, or \`devtools db sync\` if you have already set up.`);
+		return await seed(session, devData.file, text, options, log);
+	} finally {
+		await session.close();
 	}
-	parts.push(text.slice(start).trim());
-	return parts.filter(Boolean);
-}
-const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
-const QNAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})*`;
-/** `"a"."b"` -> ["a", "b"]; unquoted names fold to lower case like Postgres. */
-function parts(name) {
-	return (name.match(new RegExp(IDENT, "g")) ?? []).map((part) => part.startsWith("\"") ? part.slice(1, -1).replace(/""/g, "\"") : part.toLowerCase());
-}
-function qualified(name) {
-	return parts(name).join(".");
 }
-function shown(name) {
-	return parts(name).map((part) => `"${part}"`).join(".");
+async function seed(session, file, text, options, log) {
+	const member = options.member ? await session.memberByRef(options.member) : (await session.members(options.provider))[0] ?? null;
+	if (!member) throw new DevDataError(options.member ? `No user matches ${options.member} in this database.` : `Nobody has signed in with DevDogs on this database yet. Start the app, sign in, then run this again (or name someone with --member).`);
+	log(`Seeding as ${member.email ?? member.id} (${member.id})`);
+	if (options.dryRun) {
+		log(`Would run ${file} (${text.split("\n").length} lines) in one transaction.`);
+		return null;
+	}
+	try {
+		await session.runAs(member.id, text);
+	} catch (err) {
+		if (!isSqlFileError(err)) throw err;
+		const line = errorLine(err, text);
+		throw new DevDataError(`${file}${line === null ? "" : `:${line}`}: ${err.message}. This is a problem in the product's dev-data SQL, not in devtools; nothing was seeded (the file runs in one transaction).`);
+	}
+	return {
+		member,
+		file
+	};
 }
-const CREATE_KINDS = {
-	SCHEMA: "schema",
-	TABLE: "table",
-	"FOREIGN TABLE": "table",
-	SEQUENCE: "sequence",
-	TYPE: "type",
-	DOMAIN: "type",
-	VIEW: "view",
-	"MATERIALIZED VIEW": "view",
-	FUNCTION: "function",
-	PROCEDURE: "function"
-};
-const WORD = (word) => new RegExp(`^${word}\\b`, "i");
+//#endregion
+//#region src/product/management.ts
 /**
-* Classifies the statements of a live diff. `existing` is what the live
-* database has (for `CREATE OR REPLACE`, which reads the same whether the
-* object is missing or merely different).
+* The two hosted-project auth settings "Sign in with DevDogs" needs and a
+* contributor would otherwise click through the dashboard for:
+*
+*   * `custom_oauth_enabled`: off by default, and GoTrue's custom-provider
+*     endpoint answers 404 "Custom OAuth providers are disabled" until it is
+*     on, so registering `custom:devdogsuga` fails without it;
+*   * `uri_allow_list`: the app's return addresses, which the local stack
+*     reads from `supabase/config.toml` instead.
+*
+* Both are the Management API's `PATCH /v1/projects/{ref}/config/auth`, with a
+* personal access token (`SUPABASE_ACCESS_TOKEN`, from the dashboard's Access
+* Tokens page). Without a token `setup` prints the two dashboard steps.
 */
-function classifyDiff(sql, existing) {
-	const creates = [];
-	const drops = [];
-	const conflicts = /* @__PURE__ */ new Map();
-	const extras = [];
-	const preamble = [];
-	const privileges = [];
-	let sawRevoke = false;
-	const conflict = (object, why) => {
-		const set = conflicts.get(object) ?? /* @__PURE__ */ new Set();
-		set.add(why);
-		conflicts.set(object, set);
-	};
-	for (const statement of splitStatements(sql)) {
-		const text = statement.replace(/\s+/g, " ");
-		if (WORD("SET").test(text)) {
-			preamble.push(statement);
-			continue;
-		}
-		if (WORD("GRANT").test(text)) {
-			privileges.push({
-				sql: statement,
-				target: null,
-				finding: null
-			});
-			continue;
-		}
-		if (WORD("REVOKE").test(text)) {
-			sawRevoke = true;
-			const on = new RegExp(String.raw`\bON\s+(?:(?:TABLE|SEQUENCE|FUNCTION|SCHEMA|TYPE|DOMAIN)\s+)?(${QNAME})(?:\s*\([^)]*\))?\s+FROM\s+(.+)$`, "i").exec(text);
-			privileges.push({
-				sql: statement,
-				target: on ? qualified(on[1]) : "",
-				finding: {
-					object: on ? `privileges on ${shown(on[1])}` : "privileges",
-					detail: on ? `granted to ${on[2].replace(/"/g, "")} beyond (or instead of) what supabase/schemas grants` : "differ from what supabase/schemas grants"
-				}
-			});
-			continue;
-		}
-		const create = new RegExp(String.raw`^CREATE\s+(OR\s+REPLACE\s+)?(?:UNIQUE\s+)?(?:TEMP(?:ORARY)?\s+)?(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|CONSTRAINT TRIGGER)\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT}(?:\s*\.\s*${IDENT})*)(.*)$`, "is").exec(text);
-		if (create) {
-			const replace = Boolean(create[1]);
-			const kindWord = create[2].toUpperCase().replace(/\s+/g, " ");
-			const name = create[3];
-			const rest = create[4];
-			let key;
-			let label;
-			if (kindWord === "INDEX") {
-				key = `index:${parts(name).at(-1)}`;
-				label = `index ${shown(name)}`;
-			} else if (kindWord === "POLICY" || kindWord === "TRIGGER" || kindWord === "CONSTRAINT TRIGGER") {
-				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
-				const table = on ? qualified(on[1]) : "?";
-				const noun = kindWord === "POLICY" ? "policy" : "trigger";
-				key = `${noun}:${table}:${parts(name).at(-1)}`;
-				label = `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`;
-			} else {
-				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
-				key = `${kind}:${qualified(name)}`;
-				label = `${kind} ${shown(name)}`;
-			}
-			if (replace && existing.has(key)) conflict(label, "its definition differs from supabase/schemas");
-			else creates.push({
-				key,
-				sql: statement,
-				label
-			});
-			continue;
-		}
-		const drop = new RegExp(String.raw`^DROP\s+(SCHEMA|TABLE|FOREIGN TABLE|SEQUENCE|TYPE|DOMAIN|VIEW|MATERIALIZED VIEW|FUNCTION|PROCEDURE|INDEX|POLICY|TRIGGER|EXTENSION)\s+(?:IF\s+EXISTS\s+)?(${QNAME})(.*)$`, "is").exec(text);
-		if (drop) {
-			const kindWord = drop[1].toUpperCase();
-			const name = drop[2];
-			const rest = drop[3];
-			if (kindWord === "INDEX") drops.push({
-				key: `index:${parts(name).at(-1)}`,
-				finding: {
-					object: `index ${shown(name)}`,
-					detail: "not in supabase/schemas"
-				}
-			});
-			else if (kindWord === "POLICY" || kindWord === "TRIGGER") {
-				const on = new RegExp(String.raw`\bON\s+(${QNAME})`, "i").exec(rest);
-				const noun = kindWord.toLowerCase();
-				drops.push({
-					key: `${noun}:${on ? qualified(on[1]) : "?"}:${parts(name).at(-1)}`,
-					finding: {
-						object: `${noun} ${shown(name)} on ${on ? shown(on[1]) : "?"}`,
-						detail: "not in supabase/schemas"
-					}
-				});
-			} else {
-				const kind = CREATE_KINDS[kindWord] ?? kindWord.toLowerCase();
-				drops.push({
-					key: `${kind}:${qualified(name)}`,
-					finding: {
-						object: `${kind} ${shown(name)}`,
-						detail: "not in supabase/schemas"
-					}
-				});
-			}
-			continue;
-		}
-		const alterTable = new RegExp(String.raw`^ALTER\s+(?:FOREIGN\s+)?TABLE\s+(?:IF\s+EXISTS\s+)?(?:ONLY\s+)?(${QNAME})\s+(.*)$`, "is").exec(text);
-		if (alterTable) {
-			const table = alterTable[1];
-			const t = qualified(table);
-			for (const action of splitTopLevel(alterTable[2])) classifyTableAction(table, t, action, {
-				creates,
-				drops,
-				conflict
-			});
-			continue;
-		}
-		const alterType = new RegExp(String.raw`^ALTER\s+TYPE\s+(${QNAME})\s+ADD\s+VALUE\b`, "i").exec(text);
-		if (alterType) {
-			creates.push({
-				key: `enumvalue:${statement}`,
-				sql: statement,
-				label: `a value of type ${shown(alterType[1])}`
-			});
-			continue;
-		}
-		conflict(text.slice(0, 80), "a difference devtools does not know how to classify, so it will not touch it");
+const API = "https://api.supabase.com";
+var ManagementError = class extends Error {
+	status;
+	constructor(message, status) {
+		super(message);
+		this.status = status;
+		this.name = "ManagementError";
+	}
+};
+/** The project ref in `https://<ref>.supabase.co`, or null for a custom domain or local URL. */
+function projectRefOf(apiUrl) {
+	try {
+		return /^([a-z0-9]{20})\.supabase\.co$/.exec(new URL(apiUrl).hostname)?.[1] ?? null;
+	} catch {
+		return null;
+	}
+}
+/** The allow list with `wanted` added, keeping what was there; comma-separated as GoTrue stores it. */
+function mergeAllowList(current, wanted) {
+	const entries = (current ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+	for (const uri of wanted) if (!entries.includes(uri)) entries.push(uri);
+	return entries.join(",");
+}
+async function ensureHostedAuthSettings(input) {
+	const doFetch = input.fetch ?? fetch;
+	const headers = {
+		authorization: `Bearer ${input.token}`,
+		"content-type": "application/json"
+	};
+	const url = `${API}/v1/projects/${input.projectRef}/config/auth`;
+	const current = await doFetch(url, { headers });
+	if (!current.ok) throw new ManagementError(current.status === 401 || current.status === 403 ? "The Supabase access token was refused. Create one at https://supabase.com/dashboard/account/tokens." : `Reading the project's auth settings failed (${current.status}).`, current.status);
+	const settings = await current.json();
+	const patch = {};
+	const changed = [];
+	if (settings.custom_oauth_enabled !== true) {
+		patch["custom_oauth_enabled"] = true;
+		changed.push("custom_oauth_enabled");
 	}
-	const created = new Set(creates.map((c) => c.key));
-	const dropped = new Set(drops.map((d) => d.key));
-	const restoring = creates.filter((c) => !dropped.has(c.key));
-	for (const d of drops) if (created.has(d.key)) conflict(d.finding.object, "it is defined differently from supabase/schemas");
-	else extras.push(d.finding);
-	const newNames = new Set(restoring.map((c) => c.key).filter((key) => !/^(index|policy|trigger|column|constraint|rls)/.test(key)).map((key) => key.slice(key.indexOf(":") + 1)));
-	const tail = [];
-	let grants = 0;
-	for (const p of privileges) if (p.target === null) {
-		tail.push(p.sql);
-		grants++;
-	} else if (newNames.has(p.target)) tail.push(p.sql);
-	else if (p.finding) extras.push(p.finding);
-	const restore = [];
-	const restored = restoring.map((c) => c.label);
-	if (restoring.length > 0 || grants > 0) restore.push(...preamble, ...restoring.map((c) => c.sql), ...tail);
-	if (restoring.length === 0 && grants > 0 && !sawRevoke) restored.push("privileges");
+	const allow = mergeAllowList(settings.uri_allow_list, input.redirectUris);
+	if (allow !== (settings.uri_allow_list ?? "")) {
+		patch["uri_allow_list"] = allow;
+		changed.push("uri_allow_list");
+	}
+	if (changed.length === 0) return { changed };
+	const response = await doFetch(url, {
+		method: "PATCH",
+		headers,
+		body: JSON.stringify(patch)
+	});
+	if (!response.ok) throw new ManagementError(`Updating the project's auth settings failed (${response.status}).`, response.status);
+	return { changed };
+}
+//#endregion
+//#region src/product/oauth.ts
+/**
+* "Sign in with DevDogs" for a product's development database, without
+* prompts: the non-interactive halves of `devtools oauth`.
+*
+* The wizard (`../oauth/wizard.ts`) is the front door and is what `setup`
+* runs for a person. These two exist for the cases that have no person:
+*
+*   * a fresh-machine or CI run that already holds an OAuth client's id and
+*     secret (`DEVDOGS_OAUTH_CLIENT_ID` / `DEVDOGS_OAUTH_CLIENT_SECRET`);
+*   * `db sync --rebuild`, which resets the local database and with it
+*     `auth.custom_oauth_providers`, so the provider is registered again from
+*     the credentials the wizard saved to the product's `.env.tooling`.
+*/
+var OAuthRegistrationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "OAuthRegistrationError";
+	}
+};
+function credentialsFromEnv(env) {
+	const clientId = env["DEVDOGS_OAUTH_CLIENT_ID"];
+	const clientSecret = env["DEVDOGS_OAUTH_CLIENT_SECRET"];
+	if (!clientId || !clientSecret) return null;
 	return {
-		restore,
-		restored,
-		extras: dedupe(extras),
-		conflicts: [...conflicts].map(([object, why]) => ({
-			object,
-			detail: [...why].join("; ")
-		}))
+		clientId,
+		clientSecret,
+		baseUrl: env["DEVDOGS_OAUTH_BASE_URL"]
 	};
 }
-function dedupe(findings) {
-	const seen = /* @__PURE__ */ new Set();
-	return findings.filter((f) => {
-		const key = `${f.object}|${f.detail}`;
-		if (seen.has(key)) return false;
-		seen.add(key);
-		return true;
-	});
-}
-function classifyTableAction(table, t, action, ctx) {
-	const sql = `ALTER TABLE ${table} ${action}`;
-	let m;
-	if (m = new RegExp(String.raw`^ADD\s+COLUMN\s+(?:IF\s+NOT\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.creates.push({
-		key: `column:${t}.${parts(m[1])[0]}`,
-		sql,
-		label: `column ${shown(table)}.${shown(m[1])}`
-	});
-	else if (m = new RegExp(String.raw`^ADD\s+CONSTRAINT\s+(${IDENT})`, "i").exec(action)) ctx.creates.push({
-		key: `constraint:${t}.${parts(m[1])[0]}`,
-		sql,
-		label: `constraint ${shown(m[1])} on ${shown(table)}`
-	});
-	else if (m = new RegExp(String.raw`^DROP\s+COLUMN\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
-		key: `column:${t}.${parts(m[1])[0]}`,
-		finding: {
-			object: `column ${shown(table)}.${shown(m[1])}`,
-			detail: "not in supabase/schemas"
-		}
+/** Registers `custom:devdogsuga` on the target with these credentials. */
+async function registerProvider(credentialsFile, target, credentials) {
+	const { issuer } = await fetchIssuerFromAny(credentials.baseUrl ? [credentials.baseUrl] : DEFAULT_API_URLS);
+	const row = await upsertDevDogsProvider({
+		apiUrl: target.apiUrl,
+		serviceRoleKey: target.secretKey
+	}, {
+		identifier: OAUTH.providerId,
+		name: PROVIDER_NAME,
+		clientId: credentials.clientId,
+		clientSecret: credentials.clientSecret,
+		issuer
 	});
-	else if (m = new RegExp(String.raw`^DROP\s+CONSTRAINT\s+(?:IF\s+EXISTS\s+)?(${IDENT})`, "i").exec(action)) ctx.drops.push({
-		key: `constraint:${t}.${parts(m[1])[0]}`,
-		finding: {
-			object: `constraint ${shown(m[1])} on ${shown(table)}`,
-			detail: "not in supabase/schemas"
-		}
+	upsertEnvFile(credentialsFile, {
+		[ENV_KEYS.clientId]: credentials.clientId,
+		[ENV_KEYS.clientSecret]: credentials.clientSecret
 	});
-	else if (m = new RegExp(String.raw`^ALTER\s+COLUMN\s+(${IDENT})\s+(.*)$`, "i").exec(action)) {
-		const what = m[2];
-		const aspect = /^(?:SET\s+DATA\s+)?TYPE\b/i.test(what) ? "type" : /\bDEFAULT\b/i.test(what) ? "default" : /\bNOT\s+NULL\b/i.test(what) ? "nullability" : "definition";
-		ctx.conflict(`column ${shown(table)}.${shown(m[1])}`, `its ${aspect} differs from supabase/schemas`);
-	} else if (/^(?:ENABLE|FORCE)\s+ROW\s+LEVEL\s+SECURITY\b/i.test(action)) ctx.creates.push({
-		key: `rls:${t}:${action.toUpperCase()}`,
-		sql,
-		label: `row level security on ${shown(table)}`
+	return row;
+}
+/** Registers the provider again from what the wizard saved to `.env.tooling`. */
+async function reRegisterSavedProvider(credentialsFile, target) {
+	const saved = readEnvFile(credentialsFile);
+	const clientId = saved[ENV_KEYS.clientId];
+	const clientSecret = saved[ENV_KEYS.clientSecret];
+	if (!clientId || !clientSecret) throw new OAuthRegistrationError(`No saved OAuth client in ${basename(credentialsFile)}, so "Sign in with DevDogs" cannot be registered again automatically. Run \`devtools oauth\`.`);
+	return registerProvider(credentialsFile, target, {
+		clientId,
+		clientSecret,
+		baseUrl: saved[ENV_KEYS.baseUrl]
 	});
-	else ctx.conflict(`table ${shown(table)}`, `a change devtools will not make for you (${action.slice(0, 60)})`);
+}
+//#endregion
+//#region src/product/schema-hash.ts
+/**
+* The schema hash that names a set of generated types.
+*
+* Generated types are never committed (Q82). CI builds them once per schema
+* change and uploads them to a rolling `generated-types` release; a
+* contributor who cannot (or would rather not) generate them downloads the
+* asset whose name carries the hash of the schema they have checked out. Two
+* checkouts with the same hash have the same types, so the hash must change
+* exactly when the generated output could.
+*
+* It covers:
+*   * every file under `supabase/schemas`, by sorted path (POSIX separators,
+*     relative to the schemas directory) and LF-normalised contents, so a
+*     Windows checkout with CRLF hashes like a Linux one;
+*   * the generator and its version (the pinned Supabase CLI for TypeScript,
+*     supadart for Dart), since a new generator rewrites the output.
+*/
+function listFiles(dir) {
+	if (!existsSync(dir)) return [];
+	const found = [];
+	for (const entry of readdirSync(dir, { withFileTypes: true })) {
+		const path = join(dir, entry.name);
+		if (entry.isDirectory()) found.push(...listFiles(path));
+		else found.push(path);
+	}
+	return found;
+}
+/** The files a hash covers, as POSIX paths relative to the schemas directory, sorted. */
+function schemaFiles(schemasDir) {
+	return listFiles(schemasDir).map((path) => relative(schemasDir, path).split(sep).join("/")).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+}
+function normalise(contents) {
+	return Buffer.from(contents.toString("utf8").replace(/\r\n/g, "\n"), "utf8");
+}
+function hashSchemas(schemasDir, generator) {
+	const hash = createHash("sha256");
+	for (const path of schemaFiles(schemasDir)) {
+		hash.update(`file:${path}\0`);
+		hash.update(normalise(readFileSync(join(schemasDir, ...path.split("/")))));
+		hash.update("\0");
+	}
+	hash.update(`generator:${generator}`);
+	return hash.digest("hex");
+}
+/**
+* The generator and version string a product's types come from. For supadart
+* it is the version `pubspec.lock` resolved, else the constraint in
+* `pubspec.yaml`, so a Dart SDK bump that changes the models changes the hash.
+*/
+function generatorFor(product) {
+	const { types, supabase } = product.config;
+	if (types.kind === "typescript") return `supabase@${supabase.version}`;
+	const lock = join(product.root, "pubspec.lock");
+	if (existsSync(lock)) {
+		const match = /^ {2}supadart:\n(?:.*\n)*? {4}version: "([^"]+)"/m.exec(readFileSync(lock, "utf8"));
+		if (match?.[1]) return `supadart@${match[1]}`;
+	}
+	const pubspec = join(product.root, "pubspec.yaml");
+	if (existsSync(pubspec)) {
+		const match = /^\s+supadart:\s*([^\s#]+)/m.exec(readFileSync(pubspec, "utf8"));
+		if (match?.[1]) return `supadart@${match[1]}`;
+	}
+	return "supadart@unknown";
+}
+function schemaHashFor(product) {
+	return hashSchemas(product.paths.schemasDir, generatorFor(product));
+}
+/** The release asset CI uploads for a hash, and `db types --download` looks for. */
+function typesAssetName(product, hash) {
+	return `${product}-types-${hash}.tgz`;
 }
 //#endregion
 //#region src/product/sync.ts
@@ -7966,6 +8323,65 @@ const NOTHING = {
 	extras: [],
 	compared: false
 };
+function recordFile(product) {
+	return join(product.root, ".devtools", "record.json");
+}
+function pendingDir(product) {
+	return join(product.root, ".devtools", "pending");
+}
+function readRecord(product) {
+	try {
+		const raw = JSON.parse(readFileSync(recordFile(product), "utf8"));
+		return typeof raw.target === "string" && Array.isArray(raw.applied) ? {
+			target: raw.target,
+			applied: raw.applied.map(String)
+		} : null;
+	} catch {
+		return null;
+	}
+}
+function writeRecord(product, target, files) {
+	mkdirSync(dirname(recordFile(product)), { recursive: true });
+	const record = {
+		target: targetKey(target),
+		applied: files.map(versionOf)
+	};
+	writeFileSync(recordFile(product), JSON.stringify(record, null, 2) + "\n");
+}
+/** `local`, or `hosted:<project ref>` (never the password). */
+function targetKey(target) {
+	if (target.kind === "local") return "local";
+	try {
+		const url = new URL(target.dbUrl);
+		const user = decodeURIComponent(url.username);
+		return `hosted:${(user.includes(".") ? user.split(".").slice(1).join(".") : "") || url.hostname}`;
+	} catch {
+		return "hosted";
+	}
+}
+/** The migrations the target has applied (null: no history table); throws if it cannot be reached. */
+async function probe(open, target, redact) {
+	let session;
+	try {
+		session = open(target.dbUrl);
+		return await session.appliedMigrations();
+	} catch (err) {
+		throw new SyncError("Could not connect to the database to compare it with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(err.message));
+	} finally {
+		await session?.close().catch(() => void 0);
+	}
+}
+/** Puts back migrations a sync that was killed had set aside. */
+function restorePending(product) {
+	const dir = pendingDir(product);
+	if (!existsSync(dir)) return;
+	mkdirSync(product.paths.migrationsDir, { recursive: true });
+	for (const file of readdirSync(dir)) {
+		const back = join(product.paths.migrationsDir, file);
+		if (existsSync(back)) rmSync(join(dir, file));
+		else renameSync(join(dir, file), back);
+	}
+}
 /** `20261011120000` from `20261011120000_devtools_sync.sql`. */
 function versionOf(file) {
 	return file.split("_")[0] ?? file;
@@ -8047,34 +8463,65 @@ function listFindings(findings) {
 */
 async function reconcileLive(product, cli, target, run, options, log, warn, redact) {
 	const files = migrationFiles(product.paths.migrationsDir);
-	if (!options.open || files.length === 0) return NOTHING;
+	if (!options.open || files.length === 0) return {
+		...NOTHING,
+		pending: []
+	};
 	const { schemas } = product.config.supabase;
 	let session;
 	let ledger;
 	let existing;
+	let columnTypes;
+	let privileges;
 	try {
 		session = options.open(target.dbUrl);
 		ledger = await session.appliedMigrations();
 		existing = await session.existingObjects(schemas);
+		columnTypes = await session.columnTypes(schemas);
+		privileges = await session.privileges(schemas);
 	} catch (err) {
 		await session?.close().catch(() => void 0);
 		throw new SyncError("Could not connect to the database to compare it with supabase/schemas, so nothing was changed, and the database was not checked against supabase/schemas. Fix the connection (is the database running, is the password right?) and run `devtools db sync` again.", redact(err.message));
 	}
+	const record = readRecord(product);
+	const noted = record?.target === targetKey(target) ? record.applied : null;
+	const known = /* @__PURE__ */ new Set([...ledger ?? [], ...noted ?? []]);
+	const everythingApplied = ledger === null && noted === null;
+	const isApplied = (file) => everythingApplied || known.has(versionOf(file));
+	if (everythingApplied) {
+		const drops = files.filter((file) => destructiveStatements(readFileSync(join(product.paths.migrationsDir, file), "utf8")).length > 0);
+		if (drops.length > 0) {
+			await session.close().catch(() => void 0);
+			throw new SyncError(`devtools cannot tell whether ${drops.length === 1 ? "this migration" : "these migrations"} ran in your database: it has no migration history table and this folder has no record of what was applied. ${drops.length === 1 ? "It drops" : "They drop"} something, so devtools will not guess and nothing was changed or marked applied.`, `${drops.join("\n")}\n${target.kind === "local" ? "Run `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data`; or delete supabase/migrations and run `devtools db sync` again." : "Delete supabase/migrations and run `devtools db sync` again, or reset the project from its dashboard (Database > Settings)."}`);
+		}
+	}
+	const appliedFiles = files.filter(isApplied);
+	const pending = files.filter((file) => !isApplied(file));
+	if (appliedFiles.length === 0) {
+		await session.close().catch(() => void 0);
+		return {
+			...NOTHING,
+			pending
+		};
+	}
+	const aside = pendingDir(product);
+	if (pending.length > 0) mkdirSync(aside, { recursive: true });
+	for (const file of pending) renameSync(join(product.paths.migrationsDir, file), join(aside, file));
 	try {
-		const drift = classifyDiff(await liveDiff(product, cli, target, run, log, redact), existing);
+		const drift = classifyDiff(await liveDiff(product, cli, target, run, log, redact), existing, columnTypes, privileges);
 		if (drift.extras.length > 0 && !options.strict) warn(`Your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. They are left as they are:\n${listFindings(drift.extras)}\n${cleanupHint(target)}`);
 		if (drift.conflicts.length > 0) throw new SyncError(`Your database defines ${drift.conflicts.length} thing${drift.conflicts.length === 1 ? "" : "s"} differently from supabase/schemas. devtools will not change them for you, and nothing was changed.`, `${listFindings(drift.conflicts)}\nIf the database is right, edit supabase/schemas to match it. If the schema files are right, ${target.kind === "local" ? "run `devtools db sync --rebuild` (it wipes your development database), then `devtools dev-data`" : "reset the project from its dashboard (Database > Settings), then run `devtools db sync` and `devtools dev-data`"}.`);
 		if (options.strict && drift.extras.length > 0) throw new SyncError(`--strict: your database has ${drift.extras.length} thing${drift.extras.length === 1 ? "" : "s"} that supabase/schemas does not define. Nothing was changed or deleted.`, `${listFindings(drift.extras)}\n${cleanupHint(target)}`);
 		if (drift.restore.length > 0) {
-			if (drift.restored.length > 0) log(`Your database is missing ${summarize(drift.restored)}; creating ${drift.restored.length === 1 ? "it" : "them"} again from supabase/schemas. Nothing that already exists is changed.`);
+			if (drift.restored.length > 0) log(`Your database is missing ${summarize(drift.restored)}; creating ${drift.restored.length === 1 ? "it" : "them"} again from supabase/schemas. Nothing that already exists is changed.${drift.restored.some((label) => label.startsWith("privileges on")) ? " For the privileges, what supabase/schemas grants was granted again; privileges beyond that were not taken away." : ""}`);
 			try {
 				await session.exec(drift.restore.join(";\n") + ";");
 			} catch (err) {
 				throw new SyncError("Could not recreate what the database is missing; nothing was changed.", `${redact(err.message)}\n${target.kind === "local" ? "`devtools db sync --rebuild` starts over (it wipes your development database)." : "Reset the project from its dashboard (Database > Settings), then run `devtools db sync`."}`);
 			}
 		}
-		const known = new Set(ledger ?? []);
-		const unlisted = files.map(versionOf).filter((version) => !known.has(version));
+		const listed = new Set(ledger ?? []);
+		const unlisted = appliedFiles.map(versionOf).filter((version) => !listed.has(version));
 		if (unlisted.length > 0) {
 			if (ledger === null) log("The database has no migration history table; recreating it from the local record.");
 			const repaired = await run(cli.command, [
@@ -8092,9 +8539,14 @@ async function reconcileLive(product, cli, target, run, options, log, warn, reda
 		return {
 			restored: drift.restored,
 			extras: drift.extras,
-			compared: true
+			compared: true,
+			pending
 		};
 	} finally {
+		for (const file of pending) {
+			const from = join(aside, file);
+			if (existsSync(from)) renameSync(from, join(product.paths.migrationsDir, file));
+		}
 		await session.close().catch(() => void 0);
 	}
 }
@@ -8104,6 +8556,7 @@ async function dbSync(product, cli, target, run, options) {
 	const redact = redactor(target);
 	const { migrationsDir, schemasDir } = product.paths;
 	if (!existsSync(schemasDir)) throw new SyncError(`${product.config.supabase.dir}/schemas does not exist; there is nothing to sync.`);
+	const ledger0 = !options.dryRun && options.open ? await probe(options.open, target, redact) : void 0;
 	mkdirSync(migrationsDir, { recursive: true });
 	const generateArgs = [
 		...cli.prefix,
@@ -8119,17 +8572,23 @@ async function dbSync(product, cli, target, run, options) {
 		...cli.prefix,
 		"migration",
 		"fetch",
-		"--db-url",
-		target.dbUrl
+		...target.kind === "local" ? ["--local"] : ["--db-url", target.dbUrl]
 	];
-	const needsRecord = target.kind === "hosted" && migrationFiles(migrationsDir).length === 0;
+	const key = targetKey(target);
+	const owner = readRecord(product)?.target;
+	const foreign = owner !== void 0 && owner !== key && migrationFiles(migrationsDir).length > 0;
+	let needsRecord = migrationFiles(migrationsDir).length === 0 && (target.kind === "hosted" || owner !== void 0 && owner !== key) || foreign;
 	if (options.dryRun) {
-		if (needsRecord) log(`Would run: ${cliLine(cli, [
+		if (needsRecord) log(`Would run: ${cliLine(cli, target.kind === "local" ? [
+			"migration",
+			"fetch",
+			"--local"
+		] : [
 			"migration",
 			"fetch",
 			"--db-url",
 			"<DB_URL>"
-		])} (this machine has no record of what the project has had applied)`);
+		])} (this machine has no record of what ${target.kind === "local" ? "the local stack" : "the project"} has had applied)`);
 		if (options.open) log(`Would run: ${cliLine(cli, liveDiffArgs(product, target).map((arg) => arg === target.dbUrl ? "<DB_URL>" : arg))} (and recreate anything the database is missing; extras are only listed)`);
 		log(`Would run: ${cliLine(cli, generateArgs.slice(cli.prefix.length))}`);
 		log(target.kind === "local" ? `Would run: ${cliLine(cli, [
@@ -8150,12 +8609,32 @@ async function dbSync(product, cli, target, run, options) {
 			...NOTHING
 		};
 	}
+	restorePending(product);
+	if (!needsRecord && target.kind === "local" && ledger0 !== void 0 && migrationFiles(migrationsDir).length === 0) needsRecord = (ledger0 ?? []).length > 0;
+	let unknownFiles = false;
+	if (!foreign && owner === void 0 && ledger0 !== void 0 && migrationFiles(migrationsDir).length > 0) {
+		const listed = new Set(ledger0 ?? []);
+		unknownFiles = ledger0 === null ? target.kind === "hosted" : !migrationFiles(migrationsDir).some((file) => listed.has(versionOf(file)));
+		if (unknownFiles) {
+			log(`supabase/migrations has migrations that ${key === "local" ? "the local stack" : "this project"} has not applied and no record of whose they are (they were probably written for another database); they are set aside and this database's own history is used.`);
+			forgetMigrations(product);
+			needsRecord = true;
+		}
+	}
+	if (foreign) {
+		log(`supabase/migrations holds the record of another database (${owner}); this sync is for ${key}, so that record is set aside and this database's own history is used.`);
+		forgetMigrations(product);
+	}
 	if (needsRecord) {
 		const fetched = await run(cli.command, fetchArgs, { cwd: product.root });
+		if (fetched.code !== 0 && (ledger0 ?? []).length > 0) throw new SyncError("Could not restore this database's migration history from the database itself, so nothing was changed.", redact(fetched.stderr || fetched.stdout));
 		const restoredFiles = migrationFiles(migrationsDir).length;
-		if (fetched.code === 0 && restoredFiles > 0) log(`Restored ${restoredFiles} applied migration${restoredFiles === 1 ? "" : "s"} from the project's history.`);
+		if (fetched.code === 0 && restoredFiles > 0) {
+			log(`Restored ${restoredFiles} applied migration${restoredFiles === 1 ? "" : "s"} from ${target.kind === "local" ? "the local stack's" : "the project's"} history.`);
+			writeRecord(product, target, migrationFiles(migrationsDir));
+		}
 	}
-	const live = await reconcileLive(product, cli, target, run, options, log, warn, redact);
+	const { pending, ...live } = await reconcileLive(product, cli, target, run, options, log, warn, redact);
 	const restoredSomething = live.restored.length > 0;
 	const before = new Set(migrationFiles(migrationsDir));
 	let generated = await run(cli.command, generateArgs, { cwd: product.root });
@@ -8165,11 +8644,13 @@ async function dbSync(product, cli, target, run, options) {
 	}
 	if (generated.code !== 0) throw new SyncError(isContainerFailure(generated) ? "Could not diff the schema: Docker is needed for the shadow database. Start Docker and try again." : "Could not diff the schema against what this database has had applied.", redact(generated.stderr || generated.stdout));
 	const created = migrationFiles(migrationsDir).filter((f) => !before.has(f));
-	if (created.length === 0) {
+	const toApply = [...pending, ...created].sort();
+	if (toApply.length === 0) {
 		if (live.compared && !restoredSomething) {
 			const n = live.extras.length;
 			log(n === 0 ? "The database already matches supabase/schemas." : `The database matches supabase/schemas, with ${n} extra thing${n === 1 ? "" : "s"} listed above that it does not define.`);
 		}
+		writeRecord(product, target, migrationFiles(migrationsDir));
 		return {
 			migration: null,
 			applied: restoredSomething,
@@ -8177,8 +8658,8 @@ async function dbSync(product, cli, target, run, options) {
 			...live
 		};
 	}
-	const migration = created[created.length - 1];
-	const sql = readFileSync(join(migrationsDir, migration), "utf8");
+	const migration = toApply[toApply.length - 1];
+	const sql = toApply.map((file) => readFileSync(join(migrationsDir, file), "utf8")).join("\n");
 	const destructive = destructiveStatements(sql);
 	if (destructive.length > 0 && !options.yes) {
 		if (!(options.confirmDestructive ? await options.confirmDestructive(sql, destructive) : false)) {
@@ -8186,7 +8667,7 @@ async function dbSync(product, cli, target, run, options) {
 			throw new SyncError(`The change drops data in your development database (${destructive.length} statement${destructive.length === 1 ? "" : "s"}). Re-run with --yes to allow it.`, destructive.join(";\n"));
 		}
 	}
-	log(`Applying ${migration}`);
+	log(`Applying ${toApply.join(", ")}`);
 	const applyArgs = target.kind === "local" ? [
 		...cli.prefix,
 		"migration",
@@ -8203,8 +8684,10 @@ async function dbSync(product, cli, target, run, options) {
 	const applied = await run(cli.command, applyArgs, { cwd: product.root });
 	if (applied.code !== 0) {
 		for (const file of created) rmSync(join(migrationsDir, file));
-		throw new SyncError("The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", redact(applied.stderr || applied.stdout));
+		const why = redact(applied.stderr || applied.stdout);
+		throw new SyncError(/migration versions not found|history does not match/i.test(why) ? "The change did not apply: the database's migration history and supabase/migrations disagree. The error below is the database's own." : "The change did not apply. Your schema files may not be valid SQL, or the database has drifted from what devtools recorded (`devtools db sync --rebuild` starts over).", why);
 	}
+	writeRecord(product, target, migrationFiles(migrationsDir));
 	return {
 		migration,
 		applied: true,
@@ -8219,6 +8702,11 @@ function isContainerFailure(result) {
 function forgetMigrations(product) {
 	const files = migrationFiles(product.paths.migrationsDir);
 	for (const file of files) rmSync(join(product.paths.migrationsDir, file));
+	rmSync(recordFile(product), { force: true });
+	rmSync(pendingDir(product), {
+		recursive: true,
+		force: true
+	});
 	return files;
 }
 //#endregion