@syntopica/db-quality 0.1.0 → 0.2.1

package/dist/cli.js

@@ -71,7 +71,7 @@ var dataSourceType = (url) => {
 };
 
 // src/config/isDisabled.ts
-var isDisabled = (code, disabled) => disabled.includes(code);
+var isDisabled = (code, disabled) => disabled.some((entry) => entry.code === code);
 
 // src/model/fingerprintFinding.ts
 import { createHash } from "crypto";
@@ -166,7 +166,7 @@ var runSoda = (runner, root, soda, disabled) => {
 var ADVISOR_SEVERITY = {
   ERROR: "error",
   WARN: "warn",
-  INFO: "info"
+  INFO: "warn"
 };
 
 // src/adapters/supabase/parseAdvisorReport.ts
@@ -268,7 +268,7 @@ var parseIndexStats = (stdout2, disabled) => {
   ).map((row) => {
     const partial = {
       code: "BDB601",
-      severity: "info",
+      severity: "warn",
       path: "supabase",
       line: 0,
       message: `index has never been scanned (${row.size})`,
@@ -368,13 +368,16 @@ var reportCommandError = (error, stderr2) => {
   return configuration ? ExitCode.CONFIGURATION : ExitCode.INFRASTRUCTURE;
 };
 
+// src/config/CONFIG_FILENAME.ts
+var CONFIG_FILENAME = "codeality-db.json";
+
+// src/config/legacyConfigNotice.ts
+var legacyConfigNotice = (config) => config.schemaVersion === 1 ? `${CONFIG_FILENAME} is schemaVersion 1; "codeality-db init --apply" upgrades it to 2 and asks a reason for every disabled rule` : void 0;
+
 // src/config/readConfig.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { join as join3 } from "path";
 
-// src/config/CONFIG_FILENAME.ts
-var CONFIG_FILENAME = "codeality-db.json";
-
 // src/config/expectConfig.ts
 var expectConfig = (condition, message) => {
   if (!condition) throw new ConfigError(message);
@@ -408,7 +411,9 @@ var CONFIG_KEYS = /* @__PURE__ */ new Set([
   "prisma",
   "drizzle",
   "sqlite",
+  "postgrest",
   "audit",
+  "perf",
   "disable"
 ]);
 
@@ -422,9 +427,103 @@ var configSection = (raw, name) => {
   return value;
 };
 
+// src/config/LEGACY_DISABLE_REASON.ts
+var LEGACY_DISABLE_REASON = "carried over from schemaVersion 1; write the real reason";
+
+// src/config/disableEntryFrom.ts
+var disableEntryFrom = (raw, schemaVersion) => {
+  if (typeof raw === "string") {
+    if (schemaVersion === 1) return { code: raw, reason: LEGACY_DISABLE_REASON };
+    throw new ConfigError(
+      `disable entries must be { "code": "${raw}", "reason": "why" } under schemaVersion 2`
+    );
+  }
+  if (typeof raw !== "object" || raw === null)
+    throw new ConfigError("disable entries must be objects");
+  const { code, reason } = raw;
+  if (typeof code !== "string")
+    throw new ConfigError("disable code must be a string");
+  if (typeof reason !== "string" || reason.trim() === "")
+    throw new ConfigError(`disable reason must not be empty (${code})`);
+  return { code, reason };
+};
+
+// src/config/disableEntriesFrom.ts
+var disableEntriesFrom = (raw, schemaVersion) => {
+  if (raw === void 0) return [];
+  if (!Array.isArray(raw)) throw new ConfigError("disable must be a list");
+  return raw.map((entry) => disableEntryFrom(entry, schemaVersion));
+};
+
+// src/config/isPositiveInteger.ts
+var isPositiveInteger = (value) => typeof value === "number" && Number.isInteger(value) && value > 0;
+
 // src/config/isStringList.ts
 var isStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
 
+// src/config/PERF_DEFAULTS.ts
+var PERF_DEFAULTS = {
+  inGate: false,
+  slowMs: 100,
+  regressionPercent: 20,
+  minCalls: 20,
+  seqScanRows: 1e4,
+  benchDir: "db-quality/bench",
+  benchRuns: 5,
+  benchTimeoutMs: 6e4,
+  roles: ["authenticator", "service_role", "postgres"],
+  ignore: []
+};
+
+// src/config/ROLE_NAME_PATTERN.ts
+var ROLE_NAME_PATTERN = /^[a-z_][a-z0-9_]*$/;
+
+// src/config/perfSectionFrom.ts
+var perfSectionFrom = (raw) => {
+  const merged = { ...PERF_DEFAULTS, ...raw };
+  for (const key of [
+    "slowMs",
+    "regressionPercent",
+    "minCalls",
+    "seqScanRows",
+    "benchRuns",
+    "benchTimeoutMs"
+  ])
+    expectConfig(
+      typeof merged[key] === "number",
+      `perf.${key} must be a number`
+    );
+  for (const key of ["minCalls", "benchRuns", "benchTimeoutMs"])
+    expectConfig(
+      isPositiveInteger(merged[key]),
+      `perf.${key} must be a positive integer`
+    );
+  expectConfig(
+    typeof merged["inGate"] === "boolean",
+    "perf.inGate must be a boolean"
+  );
+  expectConfig(
+    typeof merged["benchDir"] === "string",
+    "perf.benchDir must be a string"
+  );
+  expectConfig(
+    isStringList(merged["roles"]),
+    "perf.roles must be a list of strings"
+  );
+  expectConfig(
+    isStringList(merged["ignore"]),
+    "perf.ignore must be a list of strings"
+  );
+  const roles = merged["roles"];
+  expectConfig(roles.length > 0, "perf.roles must name at least one role");
+  const bad = roles.find((role) => !ROLE_NAME_PATTERN.test(role));
+  if (bad !== void 0)
+    throw new ConfigError(
+      `perf.roles entries must match ${ROLE_NAME_PATTERN.source}: "${bad}"`
+    );
+  return merged;
+};
+
 // src/config/drizzleSectionFrom.ts
 var drizzleSectionFrom = (drizzle) => {
   const roots = drizzle["roots"];
@@ -437,6 +536,16 @@ var drizzleSectionFrom = (drizzle) => {
   return { roots, objectNames };
 };
 
+// src/config/postgrestSectionFrom.ts
+var postgrestSectionFrom = (raw) => {
+  const roots = raw["roots"];
+  if (!isStringList(roots))
+    throw new ConfigError("postgrest.roots must be a list of strings");
+  if (roots.length === 0)
+    throw new ConfigError("postgrest.roots must name at least one directory");
+  return { roots };
+};
+
 // src/config/stackSectionsFrom.ts
 var stackSectionsFrom = (raw) => {
   const stacks = {};
@@ -463,6 +572,8 @@ var stackSectionsFrom = (raw) => {
       throw new ConfigError("sqlite.files must be a list of strings");
     stacks.sqlite = { files };
   }
+  const postgrest = configSection(raw, "postgrest");
+  if (postgrest) stacks.postgrest = postgrestSectionFrom(postgrest);
   return stacks;
 };
 
@@ -475,16 +586,15 @@ var configFromDocument = (document) => {
   for (const key of Object.keys(raw)) {
     if (!CONFIG_KEYS.has(key)) throw new ConfigError(`unknown key "${key}"`);
   }
-  if (raw["schemaVersion"] !== 1)
-    throw new ConfigError("schemaVersion must be 1");
-  const disable = raw["disable"] ?? [];
-  if (!isStringList(disable))
-    throw new ConfigError("disable must be a list of strings");
+  const schemaVersion = raw["schemaVersion"];
+  if (schemaVersion !== 1 && schemaVersion !== 2)
+    throw new ConfigError("schemaVersion must be 1 or 2");
   return {
-    schemaVersion: 1,
+    schemaVersion,
     ...stackSectionsFrom(raw),
     audit: auditSectionFrom(configSection(raw, "audit")),
-    disable
+    perf: perfSectionFrom(configSection(raw, "perf")),
+    disable: disableEntriesFrom(raw["disable"], schemaVersion)
   };
 };
 
@@ -516,12 +626,15 @@ var auditCommand = (argv2, io) => {
       "db-url": { type: "string" }
     });
     const config = readConfig(io.root);
+    const notice = legacyConfigNotice(config);
+    if (notice) io.stderr(`${notice}
+`);
     const target = resolveAuditTarget(io.root, {
       linked: values["linked"] === true,
       "db-url": values["db-url"]
     });
-    for (const notice of auditPlan(config, target).skipped)
-      io.stderr(`${notice}
+    for (const notice2 of auditPlan(config, target).skipped)
+      io.stderr(`${notice2}
 `);
     const findings = runAudit({
       root: io.root,
@@ -540,8 +653,8 @@ var auditCommand = (argv2, io) => {
 };
 
 // src/commands/baselineCommand.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { join as join9 } from "path";
 
 // src/baseline/BASELINE_FILENAME.ts
 var BASELINE_FILENAME = ".codeality-db-baseline.json";
@@ -913,6 +1026,471 @@ var runSquawk = (runner, root, set, disabled) => {
   return parseSquawkReport(result.stdout, set, disabled);
 };
 
+// src/postgrest/runPostgrestRules.ts
+import { readFileSync as readFileSync4 } from "fs";
+import { join as join7 } from "path";
+
+// src/postgrest/ITERATION_METHODS.ts
+var ITERATION_METHODS = /* @__PURE__ */ new Set([
+  "map",
+  "forEach",
+  "reduce",
+  "filter",
+  "flatMap"
+]);
+
+// src/postgrest/isIterationCallback.ts
+var isIterationCallback = (compiler, node) => (compiler.isArrowFunction(node) || compiler.isFunctionExpression(node)) && compiler.isCallExpression(node.parent) && compiler.isPropertyAccessExpression(node.parent.expression) && ITERATION_METHODS.has(node.parent.expression.name.text);
+
+// src/postgrest/isInsideLoop.ts
+var isInsideLoop = (compiler, node) => {
+  let current = node.parent;
+  while (!compiler.isSourceFile(current)) {
+    if (compiler.isIterationStatement(current, false)) return true;
+    if (isIterationCallback(compiler, current)) return true;
+    if (compiler.isFunctionLike(current)) return false;
+    current = current.parent;
+  }
+  return false;
+};
+
+// src/postgrest/isStorageReceiver.ts
+var isStorageReceiver = (compiler, expression) => compiler.isPropertyAccessExpression(expression) && expression.name.text === "storage";
+
+// src/postgrest/isStringLiteralArgument.ts
+var isStringLiteralArgument = (compiler, node) => node !== void 0 && (compiler.isStringLiteral(node) || compiler.isNoSubstitutionTemplateLiteral(node));
+
+// src/postgrest/literalArgument.ts
+var literalArgument = (compiler, node) => {
+  if (compiler.isStringLiteral(node) || compiler.isNoSubstitutionTemplateLiteral(node))
+    return node.text;
+  if (!compiler.isObjectLiteralExpression(node)) return "?";
+  const pairs = node.properties.map((property) => {
+    if (!compiler.isPropertyAssignment(property)) return "?";
+    const key = compiler.isIdentifier(property.name) || compiler.isStringLiteral(property.name) ? property.name.text : "?";
+    const value = property.initializer;
+    const text = compiler.isStringLiteral(value) || compiler.isNumericLiteral(value) ? value.text : value.kind === compiler.SyntaxKind.TrueKeyword ? "true" : value.kind === compiler.SyntaxKind.FalseKeyword ? "false" : "?";
+    return `${key}:${text}`;
+  });
+  return `{${pairs.join(",")}}`;
+};
+
+// src/postgrest/chainFromCall.ts
+var chainFromCall = (compiler, outer, file, path) => {
+  const calls = [];
+  let current = outer;
+  while (compiler.isCallExpression(current) && compiler.isPropertyAccessExpression(current.expression)) {
+    calls.unshift({
+      name: current.expression.name.text,
+      args: current.arguments.map((node) => literalArgument(compiler, node)),
+      node: current
+    });
+    current = current.expression.expression;
+  }
+  const rootIndex = calls.findIndex(
+    (call) => (call.name === "from" || call.name === "rpc") && isStringLiteralArgument(compiler, call.node.arguments[0])
+  );
+  const root = calls[rootIndex];
+  if (!root) return void 0;
+  if (rootIndex === 0 && isStorageReceiver(compiler, current)) return void 0;
+  const rest = calls.slice(rootIndex + 1).map(({ name, args }) => ({ name, args }));
+  return {
+    path,
+    line: file.getLineAndCharacterOfPosition(root.node.getStart(file)).line + 1,
+    root: root.name,
+    target: root.args[0] ?? "",
+    calls: rest,
+    inLoop: isInsideLoop(compiler, outer),
+    text: outer.getText(file).replaceAll(/\s+/g, " ")
+  };
+};
+
+// src/postgrest/isInnerCall.ts
+var isInnerCall = (compiler, node) => compiler.isPropertyAccessExpression(node.parent) && compiler.isCallExpression(node.parent.parent) && node.parent.parent.expression === node.parent;
+
+// src/postgrest/collectPostgrestChains.ts
+var collectPostgrestChains = (compiler, path, source) => {
+  const file = compiler.createSourceFile(
+    path,
+    source,
+    compiler.ScriptTarget.Latest,
+    true,
+    path.endsWith(".tsx") ? compiler.ScriptKind.TSX : compiler.ScriptKind.TS
+  );
+  const chains = [];
+  const visit = (node) => {
+    if (compiler.isCallExpression(node) && !isInnerCall(compiler, node)) {
+      const chain = chainFromCall(compiler, node, file, path);
+      if (chain) chains.push(chain);
+    }
+    compiler.forEachChild(node, visit);
+  };
+  visit(file);
+  return chains;
+};
+
+// src/postgrest/loadTypeScript.ts
+import { createRequire } from "module";
+var loadTypeScript = (bases) => {
+  for (const base of bases) {
+    try {
+      return createRequire(base)("typescript");
+    } catch (error) {
+      if (error.code !== "MODULE_NOT_FOUND")
+        throw error;
+    }
+  }
+  throw new ToolMissingError(
+    "typescript",
+    "install typescript in the project to run the PostgREST rules"
+  );
+};
+
+// src/postgrest/chainSelectCall.ts
+var chainSelectCall = (chain) => {
+  const first = chain.calls[0];
+  return chain.root === "from" && first?.name === "select" ? first : void 0;
+};
+
+// src/postgrest/makePostgrestFinding.ts
+var makePostgrestFinding = (rule, chain, subject, message) => {
+  const partial = {
+    code: rule.code,
+    severity: rule.severity,
+    path: chain.path,
+    line: chain.line,
+    message,
+    subject
+  };
+  return { ...partial, fingerprint: fingerprintFinding(partial, chain.text) };
+};
+
+// src/postgrest/exactCountUnbounded.ts
+var exactCountUnbounded = {
+  code: "BDB805",
+  name: "exact-count-unbounded",
+  severity: "warn",
+  run: (chain) => {
+    const options = chainSelectCall(chain)?.args[1] ?? "";
+    if (!options.includes("count:exact") || options.includes("head:true"))
+      return void 0;
+    if (chain.calls.some((call) => call.name === "limit" || call.name === "range"))
+      return void 0;
+    return makePostgrestFinding(
+      exactCountUnbounded,
+      chain,
+      chain.target,
+      "count: exact with no limit or range counts and returns the whole table; use head: true for the count alone or bound the rows"
+    );
+  }
+};
+
+// src/postgrest/FILTER_METHODS.ts
+var FILTER_METHODS = /* @__PURE__ */ new Set([
+  "eq",
+  "neq",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "like",
+  "ilike",
+  "is",
+  "in",
+  "contains",
+  "containedBy",
+  "overlaps",
+  "textSearch"
+]);
+
+// src/postgrest/filterWithoutIndex.ts
+var filterWithoutIndex = {
+  code: "BDB803",
+  name: "filter-without-index",
+  severity: "warn",
+  run: (chain, context) => {
+    if (chain.root !== "from") return void 0;
+    const knowledge = context.knowledge.get(`public.${chain.target}`);
+    if (!knowledge) return void 0;
+    const filter = chain.calls.find(
+      (call) => FILTER_METHODS.has(call.name) && call.args[0] !== void 0 && call.args[0] !== "?" && !call.args[0].includes(".") && !knowledge.indexed.has(call.args[0].toLowerCase())
+    );
+    if (!filter) return void 0;
+    const column = filter.args[0] ?? "";
+    return makePostgrestFinding(
+      filterWithoutIndex,
+      chain,
+      `${chain.target}.${column}`,
+      `${filter.name}('${column}') filters a column no migration indexes: a sequential scan on every call`
+    );
+  }
+};
+
+// src/postgrest/queryInLoop.ts
+var queryInLoop = {
+  code: "BDB804",
+  name: "query-in-loop",
+  severity: "warn",
+  run: (chain) => chain.inLoop ? makePostgrestFinding(
+    queryInLoop,
+    chain,
+    chain.target,
+    "query runs once per iteration: fetch the set with .in() or a join, or move the query out of the loop"
+  ) : void 0
+};
+
+// src/postgrest/starSelect.ts
+var starSelect = {
+  code: "BDB801",
+  name: "select-star",
+  severity: "warn",
+  run: (chain) => {
+    const select = chainSelectCall(chain);
+    if (!select) return void 0;
+    const list = select.args[0];
+    if (list !== void 0 && list !== "?" && !list.includes("*"))
+      return void 0;
+    if (list === "?") return void 0;
+    return makePostgrestFinding(
+      starSelect,
+      chain,
+      chain.target,
+      "select fetches every column: name the columns the caller reads, so a new wide column never travels for free"
+    );
+  }
+};
+
+// src/postgrest/BOUNDING_METHODS.ts
+var BOUNDING_METHODS = /* @__PURE__ */ new Set([
+  "limit",
+  "range",
+  "single",
+  "maybeSingle",
+  "csv"
+]);
+
+// src/postgrest/isBounded.ts
+var isBounded = (chain, context) => {
+  if (chain.calls.some((call) => BOUNDING_METHODS.has(call.name))) return true;
+  if (chainSelectCall(chain)?.args[1]?.includes("head:true")) return true;
+  const unique = context.knowledge.get(`public.${chain.target}`)?.unique;
+  return chain.calls.some(
+    (call) => call.name === "eq" && call.args[0] !== void 0 && unique?.has(call.args[0].toLowerCase()) === true
+  );
+};
+
+// src/postgrest/unboundedList.ts
+var unboundedList = {
+  code: "BDB802",
+  name: "unbounded-list",
+  severity: "warn",
+  run: (chain, context) => {
+    if (!chainSelectCall(chain) || !context.knowledge.has(`public.${chain.target}`))
+      return void 0;
+    if (isBounded(chain, context)) return void 0;
+    return makePostgrestFinding(
+      unboundedList,
+      chain,
+      chain.target,
+      "read has no limit, range, single or unique-key equality: it returns the whole table as it grows"
+    );
+  }
+};
+
+// src/postgrest/POSTGREST_RULES.ts
+var POSTGREST_RULES = [
+  starSelect,
+  unboundedList,
+  filterWithoutIndex,
+  queryInLoop,
+  exactCountUnbounded
+];
+
+// src/postgrest/sourceFilesUnder.ts
+import { readdirSync } from "fs";
+import { join as join6, relative as relative2 } from "path";
+
+// src/config/isDirectory.ts
+import { existsSync as existsSync5, statSync } from "fs";
+var isDirectory = (path) => existsSync5(path) && statSync(path).isDirectory();
+
+// src/postgrest/SKIPPED_SOURCE_DIRS.ts
+var SKIPPED_SOURCE_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  ".next",
+  "coverage",
+  "__tests__",
+  "__mocks__"
+]);
+
+// src/postgrest/sourceFilesUnder.ts
+var sourceFilesUnder = (root, roots) => {
+  for (const base of roots) {
+    if (!isDirectory(join6(root, base)))
+      throw new ConfigError(`postgrest.roots: "${base}" is not a directory`);
+  }
+  const files = [];
+  const walk = (dir) => {
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+      if (entry.isDirectory()) {
+        if (!SKIPPED_SOURCE_DIRS.has(entry.name) && !entry.name.startsWith("."))
+          walk(join6(dir, entry.name));
+        continue;
+      }
+      const name = entry.name;
+      if (!/\.tsx?$/.test(name) || name.endsWith(".d.ts") || /\.(?:test|spec)\.tsx?$/.test(name))
+        continue;
+      files.push(relative2(root, join6(dir, name)));
+    }
+  };
+  for (const base of roots) walk(join6(root, base));
+  return files.sort();
+};
+
+// src/postgrest/runPostgrestRules.ts
+var runPostgrestRules = (root, roots, knowledge, disabled) => {
+  const rules = POSTGREST_RULES.filter(
+    (rule) => !isDisabled(rule.code, disabled)
+  );
+  const context = { knowledge };
+  const compiler = loadTypeScript([join7(root, "package.json"), import.meta.url]);
+  return sourceFilesUnder(root, roots).flatMap(
+    (path) => collectPostgrestChains(
+      compiler,
+      path,
+      readFileSync4(join7(root, path), "utf8")
+    )
+  ).flatMap((chain) => rules.map((rule) => rule.run(chain, context))).filter((finding) => finding !== void 0).sort(compareFindings);
+};
+
+// src/sql/qualifiedName.ts
+var qualifiedName = (raw) => {
+  const parts = raw.trim().split(".").map((part) => part.replaceAll('"', "").toLowerCase());
+  return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
+};
+
+// src/rules/matchedTables.ts
+var matchedTables = (set, pattern) => {
+  const tables = /* @__PURE__ */ new Map();
+  for (const file of set)
+    for (const statement of file.statements) {
+      const match = pattern.exec(normalizeSqlText(statement.text));
+      if (!match?.[1]) continue;
+      const name = qualifiedName(match[1]);
+      if (!tables.has(name)) tables.set(name, { file, statement });
+    }
+  return tables;
+};
+
+// src/rules/createdTables.ts
+var createdTables = (set) => new Map(
+  [
+    ...matchedTables(
+      set,
+      /^create (?:unlogged |temp(?:orary)? )?table (?:if not exists )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/
+    )
+  ].filter(([name]) => name.startsWith("public."))
+);
+
+// src/rules/ALTER_KEY_PATTERN.ts
+var ALTER_KEY_PATTERN = /^alter table (?:if exists )?(?:only )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?) add (?:constraint \S+ )?(primary key|unique)\s*\(([^)]*)\)/;
+
+// src/rules/leadingColumn.ts
+var leadingColumn = (list) => {
+  const first = list.split(",")[0]?.trim() ?? "";
+  const match = /^(?:"([^"]+)"|([a-z_][\w$]*))(?:\s+(?:asc|desc|nulls|[a-z_]+_ops)\b.*)?$/i.exec(
+    first
+  );
+  if (!match) return void 0;
+  return (match[1] ?? match[2] ?? "").toLowerCase();
+};
+
+// src/rules/recordAlterKey.ts
+var recordAlterKey = (text, entry) => {
+  const match = ALTER_KEY_PATTERN.exec(text);
+  if (!match?.[1] || match[3] === void 0) return false;
+  const column = leadingColumn(match[3]);
+  if (column === void 0) return true;
+  const table = entry(qualifiedName(match[1]));
+  table.indexed.add(column);
+  table.unique.add(column);
+  return true;
+};
+
+// src/rules/CREATE_INDEX_PATTERN.ts
+var CREATE_INDEX_PATTERN = /^create (unique )?index (?:concurrently )?(?:if not exists )?(?:\S+ )?on (?:only )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)(?: using \w+)?\s*\(([^)]*)\)/;
+
+// src/rules/recordCreateIndex.ts
+var recordCreateIndex = (text, entry) => {
+  const match = CREATE_INDEX_PATTERN.exec(text);
+  if (!match?.[2] || match[3] === void 0) return false;
+  const column = leadingColumn(match[3]);
+  if (column === void 0) return true;
+  const table = entry(qualifiedName(match[2]));
+  table.indexed.add(column);
+  if (match[1]) table.unique.add(column);
+  return true;
+};
+
+// src/rules/CREATE_TABLE_PATTERN.ts
+var CREATE_TABLE_PATTERN = /^create (?:unlogged |temp(?:orary)? )?table (?:if not exists )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)\s*\(([\s\S]*)\)/;
+
+// src/rules/inlineKeyColumns.ts
+var inlineKeyColumns = (body) => {
+  const columns = [];
+  for (const part of body.split(/,(?![^(]*\))/)) {
+    const item = part.trim();
+    const constraint = /^(?:constraint\s+\S+\s+)?(?:primary key|unique)\s*\(([^)]*)\)/i.exec(
+      item
+    );
+    if (constraint?.[1]) {
+      const head = constraint[1].split(",")[0]?.trim().replaceAll('"', "").toLowerCase();
+      if (head) columns.push(head);
+      continue;
+    }
+    const column = /^(?:"([^"]+)"|([a-z_][\w$]*))\s[^,]*\b(?:primary key|unique)\b/i.exec(
+      item
+    );
+    if (column) columns.push((column[1] ?? column[2] ?? "").toLowerCase());
+  }
+  return columns;
+};
+
+// src/rules/recordCreateTable.ts
+var recordCreateTable = (text, entry) => {
+  const match = CREATE_TABLE_PATTERN.exec(text);
+  if (!match?.[1] || match[2] === void 0) return false;
+  const table = entry(qualifiedName(match[1]));
+  for (const column of inlineKeyColumns(match[2])) {
+    table.indexed.add(column);
+    table.unique.add(column);
+  }
+  return true;
+};
+
+// src/rules/indexedColumns.ts
+var indexedColumns = (set) => {
+  const knowledge = /* @__PURE__ */ new Map();
+  const entry = (table) => {
+    const existing = knowledge.get(table);
+    if (existing) return existing;
+    const fresh = { indexed: /* @__PURE__ */ new Set(), unique: /* @__PURE__ */ new Set() };
+    knowledge.set(table, fresh);
+    return fresh;
+  };
+  for (const table of createdTables(set).keys()) entry(table);
+  for (const file of set)
+    for (const statement of file.statements) {
+      const text = normalizeSqlText(statement.text);
+      if (recordCreateTable(text, entry)) continue;
+      if (recordCreateIndex(text, entry)) continue;
+      recordAlterKey(text, entry);
+    }
+  return knowledge;
+};
+
 // src/rules/makeSqlFinding.ts
 var makeSqlFinding = (rule, { file, statement }, subject, message) => {
   const partial = {
@@ -929,12 +1507,6 @@ var makeSqlFinding = (rule, { file, statement }, subject, message) => {
   };
 };
 
-// src/sql/qualifiedName.ts
-var qualifiedName = (raw) => {
-  const parts = raw.trim().split(".").map((part) => part.replaceAll('"', "").toLowerCase());
-  return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
-};
-
 // src/rules/policyTable.ts
 var policyTable = (statement) => {
   const match = /^create policy .+? on ((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/.exec(
@@ -1020,19 +1592,6 @@ var policyTables = (set) => {
   return tables;
 };
 
-// src/rules/matchedTables.ts
-var matchedTables = (set, pattern) => {
-  const tables = /* @__PURE__ */ new Map();
-  for (const file of set)
-    for (const statement of file.statements) {
-      const match = pattern.exec(normalizeSqlText(statement.text));
-      if (!match?.[1]) continue;
-      const name = qualifiedName(match[1]);
-      if (!tables.has(name)) tables.set(name, { file, statement });
-    }
-  return tables;
-};
-
 // src/rules/rlsEnabledTables.ts
 var rlsEnabledTables = (set) => matchedTables(
   set,
@@ -1043,7 +1602,7 @@ var rlsEnabledTables = (set) => matchedTables(
 var rlsEnabledNoPolicy = {
   code: "BDB002",
   name: "rls-enabled-no-policy",
-  severity: "info",
+  severity: "warn",
   run: (set) => {
     const withPolicy = policyTables(set);
     return [...rlsEnabledTables(set)].filter(([table]) => !withPolicy.has(table)).map(
@@ -1057,16 +1616,6 @@ var rlsEnabledNoPolicy = {
   }
 };
 
-// src/rules/createdTables.ts
-var createdTables = (set) => new Map(
-  [
-    ...matchedTables(
-      set,
-      /^create (?:unlogged |temp(?:orary)? )?table (?:if not exists )?((?:"[^"]+"|[\w$]+)(?:\.(?:"[^"]+"|[\w$]+))?)/
-    )
-  ].filter(([name]) => name.startsWith("public."))
-);
-
 // src/rules/tableWithoutRls.ts
 var tableWithoutRls = {
   code: "BDB003",
@@ -1098,8 +1647,8 @@ var SQL_RULES = [
 var runSqlRules = (set, disabled) => SQL_RULES.filter((rule) => !isDisabled(rule.code, disabled)).flatMap((rule) => rule.run(set)).sort(compareFindings);
 
 // src/sql/readMigrationSet.ts
-import { readdirSync, readFileSync as readFileSync4 } from "fs";
-import { join as join6 } from "path";
+import { readdirSync as readdirSync2, readFileSync as readFileSync5 } from "fs";
+import { join as join8 } from "path";
 
 // src/sql/quotedSpanEnd.ts
 var quotedSpanEnd = (sql, index) => {
@@ -1168,18 +1717,18 @@ var splitSqlStatements = (sql) => {
 };
 
 // src/sql/readMigrationSet.ts
-var readMigrationSet = (root, migrationsDir) => readdirSync(join6(root, migrationsDir)).filter((name) => name.endsWith(".sql")).sort().map((name) => ({
+var readMigrationSet = (root, migrationsDir) => readdirSync2(join8(root, migrationsDir)).filter((name) => name.endsWith(".sql")).sort().map((name) => ({
   path: `${migrationsDir.replaceAll("\\", "/")}/${name}`,
   statements: splitSqlStatements(
-    readFileSync4(join6(root, migrationsDir, name), "utf8")
+    readFileSync5(join8(root, migrationsDir, name), "utf8")
   )
 }));
 
 // src/check/runCheck.ts
 var runCheck = ({ root, config, runner }) => {
   const findings = [];
+  const set = config.supabase ? readMigrationSet(root, config.supabase.migrations) : [];
   if (config.supabase) {
-    const set = readMigrationSet(root, config.supabase.migrations);
     findings.push(
       ...runSqlRules(set, config.disable),
       ...runSquawk(runner, root, set, config.disable)
@@ -1199,12 +1748,22 @@ var runCheck = ({ root, config, runner }) => {
       ...runSqliteChecks(runner, root, config.sqlite.files, config.disable)
     );
   }
+  if (config.postgrest) {
+    findings.push(
+      ...runPostgrestRules(
+        root,
+        config.postgrest.roots,
+        indexedColumns(set),
+        config.disable
+      )
+    );
+  }
   return findings.sort(compareFindings);
 };
 
 // src/packageVersion.ts
-import { createRequire } from "module";
-var PACKAGE_VERSION = createRequire(import.meta.url)("../package.json").version;
+import { createRequire as createRequire2 } from "module";
+var PACKAGE_VERSION = createRequire2(import.meta.url)("../package.json").version;
 
 // src/commands/baselineCommand.ts
 var baselineCommand = (argv2, io) => {
@@ -1213,14 +1772,18 @@ var baselineCommand = (argv2, io) => {
       "check-stale": { type: "boolean" }
     });
     const action = baselineActionFrom(positionals);
-    if (action === "create" && existsSync5(join7(io.root, BASELINE_FILENAME))) {
+    if (action === "create" && existsSync6(join9(io.root, BASELINE_FILENAME))) {
       throw new ConfigError(
         `${BASELINE_FILENAME} exists; use "baseline update" to rewrite it`
       );
     }
+    const config = readConfig(io.root);
+    const notice = legacyConfigNotice(config);
+    if (notice) io.stderr(`${notice}
+`);
     const findings = runCheck({
       root: io.root,
-      config: readConfig(io.root),
+      config,
       runner: io.runner
     });
     if (action !== "check") {
@@ -1250,9 +1813,13 @@ var baselineCommand = (argv2, io) => {
 var checkCommand = (argv2, io) => {
   try {
     const { values } = parseCommandArgs(argv2, { json: { type: "boolean" } });
+    const config = readConfig(io.root);
+    const notice = legacyConfigNotice(config);
+    if (notice) io.stderr(`${notice}
+`);
     const findings = runCheck({
       root: io.root,
-      config: readConfig(io.root),
+      config,
       runner: io.runner
     });
     io.stdout(
@@ -1275,62 +1842,790 @@ var gateExitCode = (results) => {
 };
 
 // src/gate/gateStages.ts
-import { existsSync as existsSync6 } from "fs";
-import { join as join8 } from "path";
-var gateStages = (context) => {
-  const hasBaseline = existsSync6(join8(context.root, BASELINE_FILENAME));
-  const linked = existsSync6(join8(context.root, "supabase/.temp/project-ref"));
-  return [
-    hasBaseline ? {
-      name: "baseline-check",
-      run: () => classifyFindings(runCheck(context), readBaseline(context.root)).new
-    } : { name: "check", run: () => runCheck(context) },
-    {
-      name: "audit",
-      run: () => context.config.audit.inGate && linked ? runAudit({ ...context, target: { linked: true } }) : "not-applicable"
-    }
-  ];
-};
+import { existsSync as existsSync11 } from "fs";
+import { join as join15 } from "path";
 
-// src/gate/renderGateReport.ts
-var renderGateReport = (results) => results.flatMap((result) => [
-  `${result.status.padStart(22)}  ${result.name.padEnd(14)}${result.durationSeconds.toFixed(2).padStart(8)}s`,
-  ...result.status === "passed" || result.status === "skipped-not-applicable" || !result.detail ? [] : result.detail.split("\n").map((line) => `  ${line}`)
-]).join("\n");
+// src/gate/perfStage.ts
+import { existsSync as existsSync10 } from "fs";
+import { join as join14 } from "path";
 
-// src/gate/runStage.ts
-import { performance } from "perf_hooks";
-var runStage = (stage) => {
-  const started = performance.now();
-  const done = (status, detail) => ({
-    name: stage.name,
-    status,
-    durationSeconds: (performance.now() - started) / 1e3,
-    detail
-  });
-  try {
-    const outcome = stage.run();
-    if (outcome === "not-applicable") return done("skipped-not-applicable", "");
-    return outcome.length === 0 ? done("passed", "") : done("findings", renderFindings(outcome));
-  } catch (error) {
-    return done(
-      "failed-to-run",
-      error instanceof Error ? error.message : String(error)
+// src/bench/BENCH_RECORD_FILENAME.ts
+var BENCH_RECORD_FILENAME = ".codeality-db-bench.json";
+
+// src/bench/readBenchRecord.ts
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { join as join10 } from "path";
+var readBenchRecord = (root) => {
+  const path = join10(root, BENCH_RECORD_FILENAME);
+  if (!existsSync7(path)) return void 0;
+  const document = JSON.parse(
+    readFileSync6(path, "utf8")
+  );
+  if (document.schemaVersion !== 1)
+    throw new ConfigError(
+      `${BENCH_RECORD_FILENAME} is not a version 1 bench record`
     );
-  }
+  return {
+    schemaVersion: 1,
+    toolVersion: document.toolVersion ?? "",
+    takenAt: document.takenAt ?? "",
+    host: document.host ?? "",
+    entries: document.entries ?? {}
+  };
 };
 
-// src/gate/runGate.ts
-var runGate = (stages) => stages.map(runStage);
-
-// src/commands/gateCommand.ts
+// src/bench/benchFinding.ts
+var benchFinding = (input, code, subject, message) => {
+  const partial = {
+    code,
+    severity: code === "BDB913" ? "warn" : "error",
+    path: `${input.benchDir}/${input.file}`,
+    line: 1,
+    message,
+    subject
+  };
+  return { ...partial, fingerprint: fingerprintFinding(partial, input.file) };
+};
+
+// src/bench/ESTIMATE_RATIO_LIMIT.ts
+var ESTIMATE_RATIO_LIMIT = 100;
+
+// src/perf/REGRESSION_FLOOR_MS.ts
+var REGRESSION_FLOOR_MS = 5;
+
+// src/bench/benchFindings.ts
+var benchFindings = (input, recorded, current, judgement) => {
+  const { perf, disabled } = judgement;
+  const findings = [];
+  const add = (code, subject, message) => {
+    findings.push(benchFinding(input, code, subject, message));
+  };
+  const slower = recorded && current.medianMs >= recorded.medianMs * (1 + perf.regressionPercent / 100) && current.medianMs - recorded.medianMs >= REGRESSION_FLOOR_MS;
+  if (slower)
+    add(
+      "BDB911",
+      input.file,
+      `median ${recorded.medianMs.toFixed(2)} ms -> ${current.medianMs.toFixed(2)} ms (+${String(Math.round((current.medianMs / recorded.medianMs - 1) * 100))}%) over ${String(current.runs)} runs`
+    );
+  const newScans = recorded ? current.seqScans.filter(
+    (scan) => !recorded.seqScans.some((r) => r.relation === scan.relation) && (scan.rows >= perf.seqScanRows || recorded.indexScans.includes(scan.relation))
+  ) : [];
+  for (const scan of newScans)
+    add(
+      "BDB912",
+      scan.relation,
+      `sequential scan over ${scan.rows.toLocaleString("en-US")} rows of "${scan.relation}" where the record had ${recorded?.indexScans.includes(scan.relation) ? "an index scan" : "none"}`
+    );
+  if (current.worstEstimateRatio >= ESTIMATE_RATIO_LIMIT)
+    add(
+      "BDB913",
+      input.file,
+      `planner estimate off by ${String(Math.round(current.worstEstimateRatio))}x: run ANALYZE or raise the statistics target`
+    );
+  return findings.filter((f) => !isDisabled(f.code, disabled));
+};
+
+// src/bench/readBenchQueries.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { join as join11 } from "path";
+
+// src/bench/RUNS_HEADER.ts
+var RUNS_HEADER = /^--\s*runs:\s*(\S+)/;
+
+// src/bench/readBenchQueries.ts
+var readBenchQueries = (root, benchDir, defaultRuns) => {
+  const dir = join11(root, benchDir);
+  if (!isDirectory(dir)) throw new ConfigError(`${benchDir} is not a directory`);
+  return readdirSync3(dir).filter((name) => name.endsWith(".sql")).sort().map((name) => {
+    const raw = readFileSync7(join11(dir, name), "utf8");
+    const match = RUNS_HEADER.exec(raw);
+    const runs = match?.[1] ? Number(match[1]) : defaultRuns;
+    if (!isPositiveInteger(runs))
+      throw new ConfigError(`${name}: -- runs: must be a positive integer`);
+    const statements = splitSqlStatements(raw);
+    const sql = statements[0]?.text;
+    if (sql === void 0) throw new ConfigError(`${name} holds no statement`);
+    if (statements.length > 1)
+      throw new ConfigError(
+        `${name} holds more than one statement; a bench file is one statement`
+      );
+    return { file: name, sql, runs };
+  });
+};
+
+// src/bench/median.ts
+var median = (values) => {
+  const sorted = [...values].sort((a, b) => a - b);
+  const mid = Math.floor(sorted.length / 2);
+  if (sorted.length % 2 === 1) return sorted[mid] ?? 0;
+  return ((sorted[mid - 1] ?? 0) + (sorted[mid] ?? 0)) / 2;
+};
+
+// src/bench/ESTIMATE_MIN_ROWS.ts
+var ESTIMATE_MIN_ROWS = 1e3;
+
+// src/bench/walkPlan.ts
+var walkPlan = (node, visit) => {
+  visit(node);
+  for (const child of node.Plans ?? []) walkPlan(child, visit);
+};
+
+// src/bench/summarizeExplain.ts
+var summarizeExplain = (explainJson) => {
+  const scanKinds = ["Index Scan", "Index Only Scan", "Bitmap Heap Scan"];
+  const parsed = JSON.parse(explainJson);
+  const first = Array.isArray(parsed) ? parsed[0] : void 0;
+  if (typeof first !== "object" || first === null || !("Plan" in first) || !("Execution Time" in first))
+    throw new Error("psql output is not an EXPLAIN document");
+  const document = first;
+  const seqScans = [];
+  const indexScans = [];
+  let worstEstimateRatio = 0;
+  walkPlan(document.Plan, (node) => {
+    const relation = node["Relation Name"];
+    if (node["Node Type"] === "Seq Scan" && relation)
+      seqScans.push({
+        relation,
+        rows: (node["Actual Rows"] + (node["Rows Removed by Filter"] ?? 0)) * node["Actual Loops"]
+      });
+    if (relation && scanKinds.includes(node["Node Type"]))
+      indexScans.push(relation);
+    const plan = node["Plan Rows"];
+    const actual = node["Actual Rows"];
+    if (plan > 0 && actual > 0 && Math.max(plan, actual) >= ESTIMATE_MIN_ROWS) {
+      const ratio = Math.max(
+        (plan + 1) / (actual + 1),
+        (actual + 1) / (plan + 1)
+      );
+      if (ratio > worstEstimateRatio) worstEstimateRatio = ratio;
+    }
+  });
+  return {
+    executionMs: document["Execution Time"],
+    seqScans,
+    indexScans,
+    worstEstimateRatio
+  };
+};
+
+// src/bench/runBenchQuery.ts
+var runBenchQuery = (session, query) => {
+  const times = [];
+  let last;
+  try {
+    session.explain(query.sql);
+    for (let run = 0; run < query.runs; run += 1) {
+      last = summarizeExplain(session.explain(query.sql));
+      times.push(last.executionMs);
+    }
+  } catch (error) {
+    throw new Error(`${query.file}: ${error.message}`, {
+      cause: error
+    });
+  }
+  if (!last) throw new Error(`${query.file}: zero runs`);
+  return {
+    medianMs: median(times),
+    minMs: Math.min(...times),
+    runs: query.runs,
+    seqScans: last.seqScans,
+    indexScans: last.indexScans,
+    worstEstimateRatio: last.worstEstimateRatio
+  };
+};
+
+// src/bench/runBench.ts
+var runBench = (session, root, recorded, judgement) => {
+  const { perf } = judgement;
+  const queries = readBenchQueries(root, perf.benchDir, perf.benchRuns);
+  const entries = {};
+  const findings = [];
+  const improvements = [];
+  for (const query of queries) {
+    const entry = runBenchQuery(session, query);
+    entries[query.file] = entry;
+    const recordedEntry = recorded?.entries[query.file];
+    findings.push(
+      ...benchFindings(
+        { file: query.file, benchDir: perf.benchDir },
+        recordedEntry,
+        entry,
+        judgement
+      )
+    );
+    if (recordedEntry && entry.medianMs <= recordedEntry.medianMs * (1 - perf.regressionPercent / 100))
+      improvements.push({
+        subject: query.file,
+        previousMs: recordedEntry.medianMs,
+        currentMs: entry.medianMs,
+        calls: entry.runs,
+        savedMs: recordedEntry.medianMs - entry.medianMs
+      });
+  }
+  return { entries, findings, improvements };
+};
+
+// src/postgres/dollarTag.ts
+import { randomBytes } from "crypto";
+var dollarTag = (text, next = () => randomBytes(8).toString("hex")) => {
+  for (; ; ) {
+    const tag = `dbq_${next()}`;
+    if (!text.includes(`$${tag}$`)) return tag;
+  }
+};
+
+// src/postgres/PLAN_SETTING.ts
+var PLAN_SETTING = "dbq.plan";
+
+// src/postgres/ROLLBACK_SQLSTATE.ts
+var ROLLBACK_SQLSTATE = "DBQRB";
+
+// src/postgres/explainDoBlock.ts
+var explainDoBlock = (sql) => {
+  const quote = dollarTag(sql);
+  const body = dollarTag(`${sql}$${quote}$`);
+  return `do $${body}$ declare c refcursor; p text; begin begin open c for execute 'explain (analyze, buffers, format json) ' || $${quote}$${sql}$${quote}$; fetch c into p; close c; raise exception using errcode = '${ROLLBACK_SQLSTATE}'; exception when sqlstate '${ROLLBACK_SQLSTATE}' then null; end; if p is null then raise exception 'the statement produced no plan'; end if; perform set_config('${PLAN_SETTING}', p, false); end $${body}$`;
+};
+
+// src/postgres/psqlArguments.ts
+var psqlArguments = (url, timeoutMs, statements) => [
+  url,
+  "-X",
+  "-q",
+  "-A",
+  "-t",
+  "-v",
+  "ON_ERROR_STOP=1",
+  "-c",
+  "set default_transaction_read_only = on",
+  "-c",
+  `set statement_timeout = ${String(timeoutMs)}`,
+  ...statements.flatMap((statement) => ["-c", statement])
+];
+
+// src/postgres/redactConnectionSecrets.ts
+var redactConnectionSecrets = (text) => text.replace(/(\w+:\/\/[^:/\s@]+:)[^@\s]+@/g, "$1***@");
+
+// src/postgres/psqlSession.ts
+var psqlSession = (runner, root, target, timeoutMs) => {
+  const run = (statements) => {
+    const result = runner(
+      "psql",
+      psqlArguments(target.url, timeoutMs, statements),
+      {
+        cwd: root,
+        systemPathOnly: true,
+        env: {
+          ...target.password === void 0 ? {} : { PGPASSWORD: target.password },
+          PGCONNECT_TIMEOUT: "10"
+        }
+      }
+    );
+    if (result.missing)
+      throw new ToolMissingError("psql", "install the PostgreSQL client");
+    if (result.status !== 0)
+      throw new Error(
+        `psql failed: ${redactConnectionSecrets(result.stderr.trim())}`
+      );
+    return result.stdout;
+  };
+  return {
+    rows: (sql) => {
+      const out = run([
+        `select coalesce(json_agg(t), '[]'::json) from (${sql}) t`
+      ]).trim();
+      return out === "" ? [] : JSON.parse(out);
+    },
+    explain: (sql) => run([
+      explainDoBlock(sql),
+      `select current_setting('${PLAN_SETTING}')`
+    ]).trim()
+  };
+};
+
+// src/gate/perfBenchFindings.ts
+var perfBenchFindings = ({ root, config, runner }, target) => {
+  const session = psqlSession(runner, root, target, config.perf.benchTimeoutMs);
+  return runBench(session, root, readBenchRecord(root), {
+    perf: config.perf,
+    disabled: config.disable
+  }).findings;
+};
+
+// src/perf/statementSubject.ts
+var statementSubject = (window) => `${window.role}: ${window.text.slice(0, 80)}`;
+
+// src/perf/improvementsIn.ts
+var improvementsIn = (windows, perf) => windows.reduce((improvements, window) => {
+  if (window.previousMeanMs === null || window.calls < perf.minCalls || window.meanMs > window.previousMeanMs * (1 - perf.regressionPercent / 100))
+    return improvements;
+  return [
+    ...improvements,
+    {
+      subject: statementSubject(window),
+      previousMs: window.previousMeanMs,
+      currentMs: window.meanMs,
+      calls: window.calls,
+      savedMs: (window.previousMeanMs - window.meanMs) * window.calls
+    }
+  ];
+}, []);
+
+// src/perf/isRegression.ts
+var isRegression = (window, perf) => window.previousMeanMs !== null && window.meanMs >= REGRESSION_FLOOR_MS && window.meanMs >= window.previousMeanMs * (1 + perf.regressionPercent / 100) && window.meanMs - window.previousMeanMs >= REGRESSION_FLOOR_MS;
+
+// src/perf/perfFinding.ts
+var perfFinding = (code, subject, context, message) => {
+  const partial = {
+    code,
+    severity: code === "BDB901" ? "error" : "warn",
+    path: "postgres",
+    line: 0,
+    message,
+    subject
+  };
+  return { ...partial, fingerprint: fingerprintFinding(partial, context) };
+};
+
+// src/perf/statementContext.ts
+var statementContext = (window) => `${window.role}|${window.queryId}`;
+
+// src/perf/statementRegressionFinding.ts
+var statementRegressionFinding = (window, perf) => {
+  if (!isRegression(window, perf) || window.previousMeanMs === null) return null;
+  const percent = Math.round((window.meanMs / window.previousMeanMs - 1) * 100);
+  const sign = percent >= 0 ? "+" : "";
+  return perfFinding(
+    "BDB901",
+    statementSubject(window),
+    statementContext(window),
+    `mean ${window.previousMeanMs.toFixed(2)} ms -> ${window.meanMs.toFixed(2)} ms (${sign}${String(percent)}%) over ${window.calls.toLocaleString("en-US")} calls`
+  );
+};
+
+// src/perf/statementSlowFinding.ts
+var statementSlowFinding = (window, perf) => {
+  if (window.meanMs < perf.slowMs) return null;
+  return perfFinding(
+    "BDB902",
+    statementSubject(window),
+    statementContext(window),
+    `mean ${window.meanMs.toFixed(2)} ms over ${window.calls.toLocaleString("en-US")} calls, threshold ${perf.slowMs.toLocaleString("en-US")} ms`
+  );
+};
+
+// src/perf/statementSpillFinding.ts
+var statementSpillFinding = (window) => {
+  if (window.tempBlksWritten <= 0) return null;
+  return perfFinding(
+    "BDB904",
+    statementSubject(window),
+    statementContext(window),
+    `wrote ${window.tempBlksWritten.toLocaleString("en-US")} temp blocks over ${window.calls.toLocaleString("en-US")} calls: a sort or hash spilled to disk`
+  );
+};
+
+// src/perf/statementFindings.ts
+var statementFindings = (windows, perf, disabled) => windows.filter((window) => window.calls >= perf.minCalls).flatMap((window) => [
+  statementRegressionFinding(window, perf),
+  statementSlowFinding(window, perf),
+  statementSpillFinding(window)
+]).filter((finding) => finding !== null).filter((finding) => !isDisabled(finding.code, disabled));
+
+// src/perf/tableFindings.ts
+var tableFindings = (windows, perf, disabled) => windows.filter(
+  (window) => window.liveRows >= perf.seqScanRows && window.seqScan > window.idxScan
+).map(
+  (window) => perfFinding(
+    "BDB903",
+    window.name,
+    window.name,
+    `${window.seqScan.toLocaleString("en-US")} sequential scans against ${window.idxScan.toLocaleString("en-US")} index scans on ${window.liveRows.toLocaleString("en-US")} live rows`
+  )
+).filter((finding) => !isDisabled(finding.code, disabled));
+
+// src/perf/windowStatements.ts
+var windowStatements = (previous, current) => {
+  const reset = current.statsReset !== previous.statsReset;
+  return current.statements.map((statement) => {
+    const match = previous.statements.find(
+      (candidate) => candidate.role === statement.role && candidate.queryId === statement.queryId
+    );
+    const fell = match !== void 0 && (statement.calls < match.calls || statement.totalMs < match.totalMs || statement.tempBlksWritten < match.tempBlksWritten);
+    if (reset || match === void 0 || fell) {
+      const { calls: calls2, totalMs: totalMs2, tempBlksWritten } = statement;
+      return {
+        role: statement.role,
+        queryId: statement.queryId,
+        text: statement.text,
+        calls: calls2,
+        totalMs: totalMs2,
+        tempBlksWritten,
+        meanMs: calls2 === 0 ? 0 : totalMs2 / calls2,
+        previousMeanMs: null
+      };
+    }
+    const calls = statement.calls - match.calls;
+    const totalMs = statement.totalMs - match.totalMs;
+    return {
+      role: statement.role,
+      queryId: statement.queryId,
+      text: statement.text,
+      calls,
+      totalMs,
+      tempBlksWritten: statement.tempBlksWritten - match.tempBlksWritten,
+      meanMs: calls === 0 ? 0 : totalMs / calls,
+      previousMeanMs: match.calls === 0 ? null : match.totalMs / match.calls
+    };
+  });
+};
+
+// src/perf/windowTables.ts
+var windowTables = (previous, current) => {
+  const reset = current.statsReset !== previous.statsReset;
+  return current.tables.map((table) => {
+    const match = previous.tables.find(
+      (candidate) => candidate.name === table.name
+    );
+    const fell = match !== void 0 && (table.seqScan < match.seqScan || table.idxScan < match.idxScan);
+    if (reset || match === void 0 || fell) {
+      return {
+        name: table.name,
+        liveRows: table.liveRows,
+        seqScan: table.seqScan,
+        idxScan: table.idxScan
+      };
+    }
+    return {
+      name: table.name,
+      liveRows: table.liveRows,
+      seqScan: table.seqScan - match.seqScan,
+      idxScan: table.idxScan - match.idxScan
+    };
+  });
+};
+
+// src/perf/diffSnapshots.ts
+var diffSnapshots = (previous, current, perf, disabled) => {
+  const statementWindows = windowStatements(previous, current);
+  const eligible = statementWindows.filter(
+    (window) => window.calls >= perf.minCalls
+  );
+  const improvements = improvementsIn(statementWindows, perf);
+  const findings = [
+    ...statementFindings(statementWindows, perf, disabled),
+    ...tableFindings(windowTables(previous, current), perf, disabled)
+  ].sort(compareFindings);
+  return {
+    from: previous.takenAt,
+    to: current.takenAt,
+    improvements,
+    findings,
+    savedMs: improvements.reduce(
+      (sum, improvement) => sum + improvement.savedMs,
+      0
+    ),
+    lostMs: eligible.filter((window) => isRegression(window, perf)).reduce(
+      (sum, window) => sum + (window.previousMeanMs === null ? 0 : (window.meanMs - window.previousMeanMs) * window.calls),
+      0
+    )
+  };
+};
+
+// src/perf/QUERY_TIMEOUT_MS.ts
+var QUERY_TIMEOUT_MS = 3e4;
+
+// src/perf/readPerfSnapshot.ts
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join12 } from "path";
+
+// src/perf/PERF_SNAPSHOT_FILENAME.ts
+var PERF_SNAPSHOT_FILENAME = ".codeality-db-perf.json";
+
+// src/perf/readPerfSnapshot.ts
+var readPerfSnapshot = (root) => {
+  const path = join12(root, PERF_SNAPSHOT_FILENAME);
+  if (!existsSync8(path)) {
+    throw new ConfigError(
+      `${PERF_SNAPSHOT_FILENAME} not found; run "codeality-db perf snapshot"`
+    );
+  }
+  const document = JSON.parse(
+    readFileSync8(path, "utf8")
+  );
+  if (document.schemaVersion !== 1) {
+    throw new ConfigError(
+      `${PERF_SNAPSHOT_FILENAME} is not a version 1 snapshot`
+    );
+  }
+  return {
+    schemaVersion: 1,
+    toolVersion: document.toolVersion ?? "",
+    takenAt: document.takenAt ?? "",
+    host: document.host ?? "",
+    statsReset: document.statsReset ?? null,
+    statements: document.statements ?? [],
+    tables: document.tables ?? []
+  };
+};
+
+// src/perf/PLATFORM_NOISE.ts
+var PLATFORM_NOISE = [
+  /^select pg_sleep\(/i,
+  /pg_timezone_names/i,
+  /pg_stat_statements/i,
+  /^WITH -- Recursively get the base types of domains/,
+  /^SELECT wal->>/,
+  /^COPY /i,
+  /^select coalesce\(json_agg\(t\)/i
+];
+
+// src/perf/isPlatformNoise.ts
+var isPlatformNoise = (text, ignore) => PLATFORM_NOISE.some((pattern) => pattern.test(text)) || ignore.some((fragment) => text.includes(fragment));
+
+// src/perf/statementStatsSql.ts
+var statementStatsSql = (roles) => `select r.rolname as role, s.queryid::text as query_id,
+    left(regexp_replace(s.query, '\\s+', ' ', 'g'), 200) as text,
+    s.calls::bigint as calls, s.total_exec_time as total_ms, s.rows::bigint as rows,
+    s.shared_blks_read::bigint as shared_blks_read, s.temp_blks_written::bigint as temp_blks_written
+  from pg_stat_statements s join pg_roles r on r.oid = s.userid
+  where s.toplevel and r.rolname in (${roles.map((role) => `'${role}'`).join(", ")})
+    and s.query ~* '^\\s*(select|with|insert|update|delete|merge|values|table)\\y'
+    and s.query !~* '^\\s*explain'
+    and s.dbid = (select oid from pg_database where datname = current_database())`;
+
+// src/perf/readStatementStats.ts
+var readStatementStats = (session, perf) => {
+  const rows = session.rows(statementStatsSql(perf.roles));
+  return rows.map((row) => ({
+    role: String(row["role"]),
+    queryId: String(row["query_id"]),
+    text: String(row["text"]),
+    calls: Number(row["calls"]),
+    totalMs: Number(row["total_ms"]),
+    rows: Number(row["rows"]),
+    sharedBlksRead: Number(row["shared_blks_read"]),
+    tempBlksWritten: Number(row["temp_blks_written"])
+  })).filter((statement) => !isPlatformNoise(statement.text, perf.ignore)).sort(
+    (a, b) => perf.roles.indexOf(a.role) - perf.roles.indexOf(b.role) || a.queryId.localeCompare(b.queryId)
+  );
+};
+
+// src/perf/STATS_RESET_SQL.ts
+var STATS_RESET_SQL = "select stats_reset::text as stats_reset from pg_stat_statements_info()";
+
+// src/perf/readStatsReset.ts
+var readStatsReset = (session) => {
+  const rows = session.rows(STATS_RESET_SQL);
+  const value = rows[0]?.["stats_reset"];
+  return typeof value === "string" ? value : null;
+};
+
+// src/perf/TABLE_STATS_SQL.ts
+var TABLE_STATS_SQL = `select schemaname || '.' || relname as name, n_live_tup::bigint as live_rows,
+    seq_scan::bigint as seq_scan, coalesce(idx_scan, 0)::bigint as idx_scan, pg_total_relation_size(relid)::bigint as bytes
+  from pg_stat_user_tables where schemaname = 'public'`;
+
+// src/perf/readTableStats.ts
+var readTableStats = (session) => {
+  const rows = session.rows(TABLE_STATS_SQL);
+  return rows.map((row) => ({
+    name: String(row["name"]),
+    liveRows: Number(row["live_rows"]),
+    seqScan: Number(row["seq_scan"]),
+    idxScan: Number(row["idx_scan"]),
+    bytes: Number(row["bytes"])
+  })).sort((a, b) => a.name.localeCompare(b.name));
+};
+
+// src/perf/takePerfSnapshot.ts
+var takePerfSnapshot = (session, perf, host, takenAt) => {
+  const statements = readStatementStats(session, perf);
+  const tables = readTableStats(session);
+  const statsReset = readStatsReset(session);
+  return {
+    schemaVersion: 1,
+    toolVersion: PACKAGE_VERSION,
+    takenAt,
+    host,
+    statsReset,
+    statements,
+    tables
+  };
+};
+
+// src/gate/perfDiffFindings.ts
+var perfDiffFindings = ({ root, config, runner }, target) => {
+  const session = psqlSession(runner, root, target, QUERY_TIMEOUT_MS);
+  const current = takePerfSnapshot(
+    session,
+    config.perf,
+    target.host,
+    (/* @__PURE__ */ new Date()).toISOString()
+  );
+  return diffSnapshots(
+    readPerfSnapshot(root),
+    current,
+    config.perf,
+    config.disable
+  ).findings;
+};
+
+// src/postgres/resolvePostgresTarget.ts
+import { existsSync as existsSync9, readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
+import { env } from "process";
+
+// src/postgres/DB_PASSWORD_ENV.ts
+var DB_PASSWORD_ENV = "SUPABASE_DB_PASSWORD";
+
+// src/postgres/POOLER_URL_FILE.ts
+var POOLER_URL_FILE = "supabase/.temp/pooler-url";
+
+// src/postgres/parsedUrl.ts
+var parsedUrl = (raw, source) => {
+  try {
+    return new URL(raw);
+  } catch {
+    throw new ConfigError(`${source} is not a valid url`);
+  }
+};
+
+// src/postgres/refuseTransactionPooler.ts
+var refuseTransactionPooler = (url, source) => {
+  if (url.port !== "6543" && url.searchParams.get("pgbouncer") !== "true")
+    return;
+  throw new ConfigError(
+    `${source} points at a transaction pooler (port 6543 or pgbouncer=true), where the read-only setting does not hold; use the session pooler (port 5432) or a direct connection`
+  );
+};
+
+// src/postgres/takeUrlPassword.ts
+var takeUrlPassword = (url, source) => {
+  const query = url.searchParams.get("password") ?? void 0;
+  url.searchParams.delete("password");
+  const encoded = url.password;
+  url.password = "";
+  if (!encoded) return query;
+  try {
+    return decodeURIComponent(encoded);
+  } catch {
+    throw new ConfigError(`${source} password is not valid percent-encoding`);
+  }
+};
+
+// src/postgres/targetFromUrl.ts
+var targetFromUrl = (raw, source, fallbackPassword) => {
+  const url = parsedUrl(raw, source);
+  refuseTransactionPooler(url, source);
+  const password = takeUrlPassword(url, source) ?? fallbackPassword;
+  return {
+    url: url.toString(),
+    host: url.hostname,
+    ...password === void 0 ? {} : { password }
+  };
+};
+
+// src/postgres/resolvePostgresTarget.ts
+var resolvePostgresTarget = (root, flags) => {
+  const explicit = flags["db-url"];
+  if (explicit !== void 0) return targetFromUrl(explicit, "--db-url");
+  const poolerPath = join13(root, POOLER_URL_FILE);
+  const password = env[DB_PASSWORD_ENV];
+  if (!existsSync9(poolerPath) || password === void 0 || password === "")
+    return void 0;
+  return targetFromUrl(
+    readFileSync9(poolerPath, "utf8").trim(),
+    POOLER_URL_FILE,
+    password
+  );
+};
+
+// src/gate/perfStage.ts
+var perfStage = (context) => ({
+  name: "perf",
+  run: () => {
+    if (!context.config.perf.inGate) return "not-applicable";
+    const target = resolvePostgresTarget(context.root, {});
+    if (!target)
+      return {
+        skipped: "no linked project with SUPABASE_DB_PASSWORD"
+      };
+    const hasSnapshot = existsSync10(join14(context.root, PERF_SNAPSHOT_FILENAME));
+    const hasRecord = existsSync10(join14(context.root, BENCH_RECORD_FILENAME));
+    if (!hasSnapshot && !hasRecord)
+      return {
+        skipped: 'no perf snapshot and no bench record; run "perf snapshot" or "perf bench --record"'
+      };
+    return [
+      ...hasSnapshot ? perfDiffFindings(context, target) : [],
+      ...hasRecord ? perfBenchFindings(context, target) : []
+    ];
+  }
+});
+
+// src/gate/gateStages.ts
+var gateStages = (context) => {
+  const hasBaseline = existsSync11(join15(context.root, BASELINE_FILENAME));
+  const linked = existsSync11(join15(context.root, "supabase/.temp/project-ref"));
+  return [
+    hasBaseline ? {
+      name: "baseline-check",
+      run: () => classifyFindings(runCheck(context), readBaseline(context.root)).new
+    } : { name: "check", run: () => runCheck(context) },
+    {
+      name: "audit",
+      run: () => context.config.audit.inGate && linked ? runAudit({ ...context, target: { linked: true } }) : "not-applicable"
+    },
+    perfStage(context)
+  ];
+};
+
+// src/gate/renderGateReport.ts
+var renderGateReport = (results) => results.flatMap((result) => [
+  `${result.status.padStart(22)}  ${result.name.padEnd(14)}${result.durationSeconds.toFixed(2).padStart(8)}s`,
+  ...result.status === "passed" || !result.detail ? [] : result.detail.split("\n").map((line) => `  ${line}`)
+]).join("\n");
+
+// src/gate/runStage.ts
+import { performance } from "perf_hooks";
+var runStage = (stage) => {
+  const started = performance.now();
+  const done = (status, detail) => ({
+    name: stage.name,
+    status,
+    durationSeconds: (performance.now() - started) / 1e3,
+    detail
+  });
+  try {
+    const outcome = stage.run();
+    if (outcome === "not-applicable") return done("skipped-not-applicable", "");
+    if (!Array.isArray(outcome))
+      return done("skipped-not-applicable", outcome.skipped);
+    return outcome.length === 0 ? done("passed", "") : done("findings", renderFindings(outcome));
+  } catch (error) {
+    return done(
+      "failed-to-run",
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+};
+
+// src/gate/runGate.ts
+var runGate = (stages) => stages.map(runStage);
+
+// src/commands/gateCommand.ts
 var gateCommand = (argv2, io) => {
   try {
     const { values } = parseCommandArgs(argv2, { json: { type: "boolean" } });
+    const config = readConfig(io.root);
+    const notice = legacyConfigNotice(config);
+    if (notice) io.stderr(`${notice}
+`);
     const results = runGate(
       gateStages({
         root: io.root,
-        config: readConfig(io.root),
+        config,
         runner: io.runner
       })
     );
@@ -1343,39 +2638,122 @@ var gateCommand = (argv2, io) => {
   }
 };
 
+// src/init/adoptionPhase.ts
+import { existsSync as existsSync12 } from "fs";
+import { join as join16 } from "path";
+var adoptionPhase = (root, config) => {
+  if (config.schemaVersion !== 2) return 0;
+  const hasSnapshot = existsSync12(join16(root, PERF_SNAPSHOT_FILENAME));
+  const hasBench = existsSync12(join16(root, BENCH_RECORD_FILENAME));
+  if (config.perf.inGate && (hasSnapshot || hasBench)) return 4;
+  if (hasBench) return 3;
+  if (hasSnapshot) return 2;
+  return 1;
+};
+
+// src/init/baselineStep.ts
+import { existsSync as existsSync13 } from "fs";
+import { join as join17 } from "path";
+var baselineStep = (context) => {
+  const findings = runCheck(context);
+  if (findings.length === 0) return "covered";
+  if (!existsSync13(join17(context.root, BASELINE_FILENAME))) return "create";
+  const classified = classifyFindings(findings, readBaseline(context.root));
+  return classified.new.length > 0 ? "update" : "covered";
+};
+
+// src/init/adoptionStanding.ts
+var adoptionStanding = (context) => {
+  const phase = adoptionPhase(context.root, context.config);
+  if (phase === 0) return { phase };
+  let step;
+  try {
+    step = baselineStep(context);
+  } catch (error) {
+    return { phase: 1, next: `make check run: ${error.message}` };
+  }
+  return step === "covered" ? { phase } : { phase: 1, next: `codeality-db baseline ${step}` };
+};
+
 // src/init/applyInit.ts
 import { mkdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { dirname, join as join9 } from "path";
+import { dirname, join as join18 } from "path";
 var applyInit = (root, plan) => {
   for (const file of plan) {
     const writes = file.disposition === "create" || file.disposition === "merge";
     if (!writes || file.content === void 0) continue;
-    mkdirSync(dirname(join9(root, file.path)), { recursive: true });
-    writeFileSync3(join9(root, file.path), file.content);
+    mkdirSync(dirname(join18(root, file.path)), { recursive: true });
+    writeFileSync3(join18(root, file.path), file.content);
   }
 };
 
+// src/init/planBenchReadme.ts
+import { existsSync as existsSync14 } from "fs";
+import { join as join19 } from "path";
+
+// src/init/BENCH_README.ts
+var BENCH_README = `# Bench queries
+
+Each \`.sql\` file in this directory holds one statement to benchmark. Write
+literal values inline; the session that runs them has no way to bind
+parameters.
+
+An optional first line \`-- runs: N\` overrides how many times the statement
+runs before the median is recorded, in place of \`perf.benchRuns\` in
+codeality-db.json.
+
+A file holding more than one statement is refused. The statement runs
+inside a read-only transaction it cannot leave, and whatever it did is
+rolled back, so a statement that writes is refused or undone instead of
+touching the database.
+
+Run \`codeality-db perf bench --record\` once to write the reference numbers
+to ${BENCH_RECORD_FILENAME}. Run \`codeality-db perf bench\` afterwards to
+compare a new run against that reference.
+`;
+
+// src/init/planBenchReadme.ts
+var planBenchReadme = (root) => {
+  const benchDir = (() => {
+    try {
+      return readConfig(root).perf.benchDir;
+    } catch {
+      return PERF_DEFAULTS.benchDir;
+    }
+  })();
+  const relative4 = `${benchDir}/README.md`;
+  if (existsSync14(join19(root, relative4))) {
+    return { path: relative4, disposition: "unchanged", detail: "present" };
+  }
+  return {
+    path: relative4,
+    disposition: "create",
+    detail: "explains the bench convention",
+    content: BENCH_README
+  };
+};
+
 // src/init/planConfigFile.ts
-import { existsSync as existsSync9, readFileSync as readFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync17, readFileSync as readFileSync11 } from "fs";
+import { join as join23 } from "path";
 
 // src/config/detectStacks.ts
-import { existsSync as existsSync8 } from "fs";
-import { join as join11 } from "path";
+import { existsSync as existsSync16 } from "fs";
+import { join as join22 } from "path";
 
 // src/config/findSqliteFiles.ts
-import { readdirSync as readdirSync2 } from "fs";
-import { join as join10, relative as relative2 } from "path";
+import { readdirSync as readdirSync4 } from "fs";
+import { join as join20, relative as relative3 } from "path";
 var findSqliteFiles = (root) => {
   const skipped = /* @__PURE__ */ new Set(["node_modules", "dist", "coverage"]);
   const found = [];
   const walk = (directory, depth) => {
-    for (const entry of readdirSync2(directory, { withFileTypes: true })) {
+    for (const entry of readdirSync4(directory, { withFileTypes: true })) {
       if (skipped.has(entry.name) || entry.name.startsWith(".")) continue;
-      const path = join10(directory, entry.name);
+      const path = join20(directory, entry.name);
       if (entry.isDirectory() && depth < 2) walk(path, depth + 1);
       else if (entry.isFile() && /\.(?:db|sqlite|sqlite3)$/.test(entry.name)) {
-        found.push(relative2(root, path).replaceAll("\\", "/"));
+        found.push(relative3(root, path).replaceAll("\\", "/"));
       }
     }
   };
@@ -1383,49 +2761,102 @@ var findSqliteFiles = (root) => {
   return found.sort();
 };
 
-// src/config/isDirectory.ts
-import { existsSync as existsSync7, statSync } from "fs";
-var isDirectory = (path) => existsSync7(path) && statSync(path).isDirectory();
+// src/config/hasPostgrestSources.ts
+var hasPostgrestSources = (root, name) => sourceFilesUnder(root, [name]).length > 0;
+
+// src/config/hasSupabaseJsDependency.ts
+import { existsSync as existsSync15, readFileSync as readFileSync10 } from "fs";
+import { join as join21 } from "path";
+var hasSupabaseJsDependency = (root) => {
+  const manifestPath = join21(root, "package.json");
+  if (!existsSync15(manifestPath)) return false;
+  const manifest = JSON.parse(
+    readFileSync10(manifestPath, "utf8")
+  );
+  const dependencies = { ...manifest.dependencies, ...manifest.devDependencies };
+  return "@supabase/supabase-js" in dependencies;
+};
 
 // src/config/detectStacks.ts
 var detectStacks = (root) => {
   const sqliteFiles = findSqliteFiles(root);
   const hasDrizzle = ["ts", "js", "mjs"].some(
-    (ext) => existsSync8(join11(root, `drizzle.config.${ext}`))
+    (ext) => existsSync16(join22(root, `drizzle.config.${ext}`))
   );
   const drizzleRoots = ["src", "server", "app", "lib", "db"].filter(
-    (name) => isDirectory(join11(root, name))
+    (name) => isDirectory(join22(root, name))
+  );
+  const postgrestRoots = ["src", "app", "supabase/functions"].filter(
+    (name) => isDirectory(join22(root, name)) && hasPostgrestSources(root, name)
   );
   return {
-    ...isDirectory(join11(root, "supabase/migrations")) ? { supabase: { migrations: "supabase/migrations" } } : {},
-    ...existsSync8(join11(root, "prisma/schema.prisma")) ? { prisma: { schema: "prisma/schema.prisma" } } : {},
+    ...isDirectory(join22(root, "supabase/migrations")) ? { supabase: { migrations: "supabase/migrations" } } : {},
+    ...existsSync16(join22(root, "prisma/schema.prisma")) ? { prisma: { schema: "prisma/schema.prisma" } } : {},
     ...hasDrizzle ? { drizzle: { roots: drizzleRoots, objectNames: ["db", "tx"] } } : {},
-    ...sqliteFiles.length > 0 ? { sqlite: { files: sqliteFiles } } : {}
+    ...sqliteFiles.length > 0 ? { sqlite: { files: sqliteFiles } } : {},
+    ...hasSupabaseJsDependency(root) && postgrestRoots.length > 0 ? { postgrest: { roots: postgrestRoots } } : {}
+  };
+};
+
+// src/init/PERF_INIT_SECTION.ts
+var PERF_INIT_SECTION = { ...PERF_DEFAULTS, inGate: false };
+
+// src/init/upgradedConfigDocument.ts
+var upgradedConfigDocument = (raw, detected) => {
+  const disable = raw["disable"];
+  return {
+    ...raw,
+    schemaVersion: 2,
+    ...Array.isArray(disable) ? {
+      disable: disable.map(
+        (entry) => typeof entry === "string" ? { code: entry, reason: LEGACY_DISABLE_REASON } : entry
+      )
+    } : {},
+    ...raw["postgrest"] === void 0 && detected.postgrest !== void 0 ? { postgrest: detected.postgrest } : {},
+    ...raw["perf"] === void 0 ? { perf: PERF_INIT_SECTION } : {}
   };
 };
 
 // src/init/planConfigFile.ts
 var planConfigFile = (root, force) => {
-  const content = `${JSON.stringify({ schemaVersion: 1, ...detectStacks(root) }, null, 2)}
+  const path = join23(root, CONFIG_FILENAME);
+  const freshContent = `${JSON.stringify(
+    { schemaVersion: 2, ...detectStacks(root), perf: PERF_INIT_SECTION },
+    null,
+    2
+  )}
 `;
-  const path = join12(root, CONFIG_FILENAME);
-  if (!existsSync9(path)) {
+  if (!existsSync17(path)) {
     return {
       path: CONFIG_FILENAME,
       disposition: "create",
       detail: "from the detected stacks",
-      content
+      content: freshContent
     };
   }
   try {
-    configFromDocument(JSON.parse(readFileSync5(path, "utf8")));
+    const raw = JSON.parse(readFileSync11(path, "utf8"));
+    const config = configFromDocument(raw);
+    if (config.schemaVersion === 1) {
+      return {
+        path: CONFIG_FILENAME,
+        disposition: "merge",
+        detail: "upgraded to schemaVersion 2",
+        content: `${JSON.stringify(
+          upgradedConfigDocument(raw, detectStacks(root)),
+          null,
+          2
+        )}
+`
+      };
+    }
     return { path: CONFIG_FILENAME, disposition: "unchanged", detail: "valid" };
   } catch (error) {
     return force ? {
       path: CONFIG_FILENAME,
       disposition: "merge",
       detail: "replaced (--force)",
-      content
+      content: freshContent
     } : {
       path: CONFIG_FILENAME,
       disposition: "conflict",
@@ -1435,23 +2866,23 @@ var planConfigFile = (root, force) => {
 };
 
 // src/init/planPackageScript.ts
-import { existsSync as existsSync10, readFileSync as readFileSync6 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync18, readFileSync as readFileSync12 } from "fs";
+import { join as join24 } from "path";
 
 // src/init/PACKAGE_MANIFEST.ts
 var PACKAGE_MANIFEST = "package.json";
 
 // src/init/planPackageScript.ts
 var planPackageScript = (root, force) => {
-  const path = join13(root, PACKAGE_MANIFEST);
-  if (!existsSync10(path)) {
+  const path = join24(root, PACKAGE_MANIFEST);
+  if (!existsSync18(path)) {
     return {
       path: PACKAGE_MANIFEST,
       disposition: "unchanged",
       detail: "no package.json"
     };
   }
-  const manifest = JSON.parse(readFileSync6(path, "utf8"));
+  const manifest = JSON.parse(readFileSync12(path, "utf8"));
   const current = manifest.scripts?.["db:gate"];
   if (current === "codeality-db gate") {
     return {
@@ -1479,26 +2910,47 @@ var planPackageScript = (root, force) => {
 };
 
 // src/init/planWorkflow.ts
-import { existsSync as existsSync11, readFileSync as readFileSync7 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync19, readFileSync as readFileSync13 } from "fs";
+import { join as join25 } from "path";
+
+// src/init/sha256Of.ts
+import { createHash as createHash2 } from "crypto";
+var sha256Of = (content) => createHash2("sha256").update(content).digest("hex");
+
+// src/init/SHIPPED_WORKFLOW_HASHES.ts
+var SHIPPED_WORKFLOW_HASHES = {
+  "4845c1f1cd3c179701d4a143cb34400c8a6225b73e6e86418408e8f3ae1581c0": "0.1.0"
+};
+
+// src/init/planWorkflow.ts
 var planWorkflow = (root, force) => {
-  const relative3 = ".github/workflows/db-quality.yml";
-  const content = readFileSync7(assetPath("db-quality.yml"), "utf8");
-  const path = join14(root, relative3);
-  if (!existsSync11(path)) {
+  const relative4 = ".github/workflows/db-quality.yml";
+  const content = readFileSync13(assetPath("db-quality.yml"), "utf8");
+  const path = join25(root, relative4);
+  if (!existsSync19(path)) {
     const detail = "runs codeality-db gate on push and pull request";
-    return { path: relative3, disposition: "create", detail, content };
+    return { path: relative4, disposition: "create", detail, content };
   }
-  if (readFileSync7(path, "utf8") === content) {
-    return { path: relative3, disposition: "unchanged", detail: "identical" };
+  const existing = readFileSync13(path, "utf8");
+  if (existing === content) {
+    return { path: relative4, disposition: "unchanged", detail: "identical" };
+  }
+  const shippedVersion = SHIPPED_WORKFLOW_HASHES[sha256Of(existing)];
+  if (shippedVersion !== void 0) {
+    return {
+      path: relative4,
+      disposition: "merge",
+      detail: `upgraded from the ${shippedVersion} workflow`,
+      content
+    };
   }
   return force ? {
-    path: relative3,
+    path: relative4,
     disposition: "merge",
     detail: "replaced (--force)",
     content
   } : {
-    path: relative3,
+    path: relative4,
     disposition: "conflict",
     detail: "differs from the shipped workflow"
   };
@@ -1508,9 +2960,51 @@ var planWorkflow = (root, force) => {
 var planInit = (root, force) => [
   planConfigFile(root, force),
   planPackageScript(root, force),
-  planWorkflow(root, force)
+  planWorkflow(root, force),
+  planBenchReadme(root)
+];
+
+// src/init/ADOPTION_LADDER.ts
+var ADOPTION_LADDER = [
+  { phase: 0, does: "no configuration", next: "codeality-db init --apply" },
+  {
+    phase: 1,
+    does: "strict check and PostgREST rules, baseline covers what exists",
+    next: "codeality-db perf snapshot"
+  },
+  {
+    phase: 2,
+    does: "perf snapshot recorded",
+    next: "codeality-db perf bench --record"
+  },
+  {
+    phase: 3,
+    does: "bench reference recorded",
+    next: "set perf.inGate to true in codeality-db.json"
+  },
+  {
+    phase: 4,
+    does: "the gate measures performance",
+    next: "nothing: the gate measures"
+  }
 ];
 
+// src/init/renderAdoptionPhase.ts
+var renderAdoptionPhase = ({
+  phase,
+  next
+}) => {
+  const rungs = ADOPTION_LADDER.map(
+    (rung) => `${rung.phase === phase ? "*" : " "} ${String(rung.phase)}  ${rung.does}`
+  );
+  const current = ADOPTION_LADDER.find((rung) => rung.phase === phase);
+  return [
+    `adoption phase ${String(phase)} of 4`,
+    ...rungs,
+    `next: ${next ?? current?.next ?? ""}`
+  ].join("\n");
+};
+
 // src/init/renderInitPlan.ts
 var renderInitPlan = (plan) => plan.map(
   (file) => `${file.disposition.padEnd(9)}  ${file.path}  ${file.detail}`
@@ -1528,15 +3022,258 @@ var initCommand = (argv2, io) => {
     const plan = planInit(io.root, force);
     io.stdout(`${renderInitPlan(plan)}
 `);
+    let exitCode = ExitCode.OK;
     if (values["check"] === true) {
-      return plan.every((file) => file.disposition === "unchanged") ? ExitCode.OK : ExitCode.FINDINGS;
-    }
-    if (values["apply"] !== true && !force) return ExitCode.OK;
-    if (plan.some((file) => file.disposition === "conflict")) {
-      throw new ConfigError("conflicts remain; resolve them or pass --force");
+      exitCode = plan.every((file) => file.disposition === "unchanged") ? ExitCode.OK : ExitCode.FINDINGS;
+    } else if (values["apply"] === true || force) {
+      if (plan.some((file) => file.disposition === "conflict")) {
+        throw new ConfigError("conflicts remain; resolve them or pass --force");
+      }
+      applyInit(io.root, plan);
     }
-    applyInit(io.root, plan);
+    const config = (() => {
+      try {
+        return readConfig(io.root);
+      } catch {
+        return void 0;
+      }
+    })();
+    const standing = config ? adoptionStanding({ root: io.root, config, runner: io.runner }) : { phase: 0 };
+    io.stdout(`${renderAdoptionPhase(standing)}
+`);
+    return exitCode;
+  } catch (error) {
+    return reportCommandError(error, io.stderr);
+  }
+};
+
+// src/bench/renderBench.ts
+var renderBench = (result, recorded) => {
+  const entries = Object.entries(result.entries);
+  const width = Math.max(0, ...entries.map(([file]) => file.length)) + 2;
+  const runs = new Set(entries.map(([, entry]) => entry.runs));
+  const perFile = runs.size > 1;
+  const lines = entries.map(([file, entry]) => {
+    const recordedEntry = recorded?.entries[file];
+    const record = recordedEntry ? `(record ${recordedEntry.medianMs.toFixed(2)} ms)` : "(no record)";
+    const count = perFile ? `   ${String(entry.runs)} runs` : "";
+    return `  ${file.padEnd(width)}${entry.medianMs.toFixed(2)} ms   ${record}${count}`;
+  });
+  const improvementLines = result.improvements.length === 0 ? [] : [
+    "improvements",
+    ...result.improvements.map((improvement) => {
+      const percent = Math.round(
+        (improvement.currentMs / improvement.previousMs - 1) * 100
+      );
+      return `  ${String(percent)}%   ${improvement.previousMs.toFixed(2)} ms -> ${improvement.currentMs.toFixed(2)} ms  ${improvement.subject}`;
+    })
+  ];
+  return [
+    perFile ? "bench (runs per file)" : `bench (${String([...runs][0] ?? 0)} runs each)`,
+    ...lines,
+    ...improvementLines,
+    renderFindings(result.findings)
+  ].join("\n");
+};
+
+// src/bench/renderBenchJson.ts
+var renderBenchJson = (result, recorded) => JSON.stringify(
+  {
+    schemaVersion: 1,
+    entries: result.entries,
+    recorded: recorded?.entries ?? null,
+    improvements: result.improvements,
+    findings: result.findings
+  },
+  null,
+  2
+);
+
+// src/bench/writeBenchRecord.ts
+import { renameSync as renameSync2, writeFileSync as writeFileSync4 } from "fs";
+import { join as join26 } from "path";
+var writeBenchRecord = (root, record) => {
+  const path = join26(root, BENCH_RECORD_FILENAME);
+  writeFileSync4(`${path}.tmp`, `${JSON.stringify(record, null, 2)}
+`);
+  renameSync2(`${path}.tmp`, path);
+};
+
+// src/commands/perfBenchAction.ts
+var perfBenchAction = ({
+  io,
+  config,
+  target,
+  session,
+  json,
+  record
+}) => {
+  const recorded = record ? void 0 : readBenchRecord(io.root);
+  const result = runBench(session, io.root, recorded, {
+    perf: config.perf,
+    disabled: config.disable
+  });
+  if (record) {
+    writeBenchRecord(io.root, {
+      schemaVersion: 1,
+      toolVersion: PACKAGE_VERSION,
+      takenAt: (/* @__PURE__ */ new Date()).toISOString(),
+      host: target.host,
+      entries: result.entries
+    });
+    io.stdout(
+      `recorded ${String(Object.keys(result.entries).length)} bench queries in ${BENCH_RECORD_FILENAME}
+`
+    );
     return ExitCode.OK;
+  }
+  io.stdout(
+    `${json ? renderBenchJson(result, recorded) : renderBench(result, recorded)}
+`
+  );
+  return result.findings.length > 0 ? ExitCode.FINDINGS : ExitCode.OK;
+};
+
+// src/perf/renderImprovements.ts
+var renderImprovements = (improvements) => improvements.length === 0 ? [] : [
+  "improvements",
+  ...improvements.map((improvement) => {
+    const percent = Math.round(
+      (improvement.currentMs / improvement.previousMs - 1) * 100
+    );
+    return `  ${String(percent)}%   ${improvement.previousMs.toFixed(2)} ms -> ${improvement.currentMs.toFixed(2)} ms  x${improvement.calls.toLocaleString("en-US")}  ${improvement.subject}`;
+  })
+];
+
+// src/perf/renderPerfDiff.ts
+var renderPerfDiff = (diff) => [
+  `perf diff: ${diff.from} -> ${diff.to}`,
+  ...renderImprovements(diff.improvements),
+  ...diff.improvements.length > 0 || diff.lostMs > 0 ? [
+    `saved ${diff.savedMs.toLocaleString("en-US")} ms against the previous means; regressions cost ${diff.lostMs.toLocaleString("en-US")} ms`
+  ] : [],
+  ...diff.findings.map(
+    (finding) => `${finding.path}:${String(finding.line)}: ${finding.code} ${finding.message} (${finding.subject})`
+  ),
+  `${diff.findings.length.toLocaleString("en-US")} findings`
+].join("\n");
+
+// src/perf/renderPerfDiffJson.ts
+var renderPerfDiffJson = (diff) => JSON.stringify(
+  {
+    schemaVersion: 1,
+    from: diff.from,
+    to: diff.to,
+    savedMs: diff.savedMs,
+    lostMs: diff.lostMs,
+    improvements: diff.improvements,
+    findings: diff.findings
+  },
+  null,
+  2
+);
+
+// src/commands/perfDiffAction.ts
+var perfDiffAction = ({
+  io,
+  config,
+  target,
+  session,
+  json
+}) => {
+  const previous = readPerfSnapshot(io.root);
+  const current = takePerfSnapshot(
+    session,
+    config.perf,
+    target.host,
+    (/* @__PURE__ */ new Date()).toISOString()
+  );
+  const diff = diffSnapshots(previous, current, config.perf, config.disable);
+  io.stdout(`${json ? renderPerfDiffJson(diff) : renderPerfDiff(diff)}
+`);
+  return diff.findings.length > 0 ? ExitCode.FINDINGS : ExitCode.OK;
+};
+
+// src/perf/writePerfSnapshot.ts
+import { renameSync as renameSync3, writeFileSync as writeFileSync5 } from "fs";
+import { join as join27 } from "path";
+var writePerfSnapshot = (root, snapshot) => {
+  const path = join27(root, PERF_SNAPSHOT_FILENAME);
+  writeFileSync5(`${path}.tmp`, `${JSON.stringify(snapshot, null, 2)}
+`);
+  renameSync3(`${path}.tmp`, path);
+};
+
+// src/commands/perfSnapshotAction.ts
+var perfSnapshotAction = ({
+  io,
+  config,
+  target,
+  session
+}) => {
+  const snapshot = takePerfSnapshot(
+    session,
+    config.perf,
+    target.host,
+    (/* @__PURE__ */ new Date()).toISOString()
+  );
+  writePerfSnapshot(io.root, snapshot);
+  io.stdout(
+    `recorded ${String(snapshot.statements.length)} statements and ${String(snapshot.tables.length)} tables from ${target.host} in ${PERF_SNAPSHOT_FILENAME}
+`
+  );
+  return ExitCode.OK;
+};
+
+// src/perf/PERF_USAGE.ts
+var PERF_USAGE = "usage: codeality-db perf snapshot|diff|bench [--db-url <url>] [--json] [--record]";
+
+// src/perf/perfActionFrom.ts
+var perfActionFrom = (positionals) => {
+  const action = positionals[0];
+  if (action === "snapshot" || action === "diff" || action === "bench")
+    return action;
+  throw new ConfigError(PERF_USAGE);
+};
+
+// src/postgres/requirePostgresTarget.ts
+var requirePostgresTarget = (root, flags) => {
+  const target = resolvePostgresTarget(root, flags);
+  if (target) return target;
+  throw new ConfigError(
+    `perf needs --db-url, or a linked project with ${DB_PASSWORD_ENV} set (the same variable the Supabase CLI reads)`
+  );
+};
+
+// src/commands/perfCommand.ts
+var perfCommand = (argv2, io) => {
+  try {
+    const { values, positionals } = parseCommandArgs(argv2, {
+      json: { type: "boolean" },
+      record: { type: "boolean" },
+      "db-url": { type: "string" }
+    });
+    const action = perfActionFrom(positionals);
+    const config = readConfig(io.root);
+    const notice = legacyConfigNotice(config);
+    if (notice) io.stderr(`${notice}
+`);
+    const target = requirePostgresTarget(io.root, {
+      "db-url": values["db-url"]
+    });
+    const timeout = action === "bench" ? config.perf.benchTimeoutMs : QUERY_TIMEOUT_MS;
+    const session = psqlSession(io.runner, io.root, target, timeout);
+    const actionIo = {
+      io,
+      config,
+      target,
+      session,
+      json: values["json"] === true,
+      record: values["record"] === true
+    };
+    if (action === "snapshot") return perfSnapshotAction(actionIo);
+    if (action === "diff") return perfDiffAction(actionIo);
+    return perfBenchAction(actionIo);
   } catch (error) {
     return reportCommandError(error, io.stderr);
   }
@@ -1548,7 +3285,8 @@ var COMMANDS = {
   check: checkCommand,
   audit: auditCommand,
   gate: gateCommand,
-  baseline: baselineCommand
+  baseline: baselineCommand,
+  perf: perfCommand
 };
 
 // src/cli/USAGE.ts
@@ -1559,6 +3297,7 @@ var USAGE = `usage: codeality-db [--project <dir>] <command> [options]
   audit     --linked|--db-url <url> [--json]   findings from the live database
   gate      [--json]                           check (or baseline check) and the linked audit, one exit code
   baseline  create|update|check [--check-stale]   record, refresh or enforce the debt the project carries
+  perf      snapshot|diff|bench [--db-url <url>] [--json] [--record]   record, compare and benchmark the live database
 
 exit codes: 0 passed, 1 findings, 2 invalid usage or configuration, 3 required tool missing or unusable
 `;
@@ -1591,7 +3330,7 @@ var runCli = (argv2, io) => {
 
 // src/tools/spawnRunner.ts
 import { spawnSync } from "child_process";
-import { delimiter, join as join15 } from "path";
+import { delimiter, join as join28 } from "path";
 import { env as processEnv } from "process";
 
 // src/tools/packageBinPath.ts
@@ -1600,8 +3339,8 @@ var packageBinPath = () => fileURLToPath2(new URL("../node_modules/.bin", import
 
 // src/tools/spawnRunner.ts
 var spawnRunner = (command, args, options) => {
-  const path = [
-    join15(options.cwd, "node_modules/.bin"),
+  const path = options.systemPathOnly ? processEnv["PATH"] ?? "" : [
+    join28(options.cwd, "node_modules/.bin"),
     packageBinPath(),
     processEnv["PATH"] ?? ""
   ].join(delimiter);