better-supabase 0.10.0 → 0.12.0

package/dist/cli/{env-2v9JrxSr.js → env-Dh5K5t2U.js}

@@ -1,22 +1,24 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { r as readIfExists, t as display } from "./io-BiPX-_J1.js";
-import { n as readStackStatus, t as parseStackStatus } from "./stack-status-LeEoCtV1.js";
+import { n as readStackStatus, t as parseStackStatus } from "./stack-status-_NUgd-g5.js";
 import { n as applyPlan, o as insideRoot, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { r as publicPrefix, t as detectProject } from "./detect-BeLVeNpA.js";
+import { r as publicPrefix, t as detectProject } from "./detect-DQsVeBHg.js";
+import { n as prefixFromFlag, r as stackEnvValues } from "./stack-env-_uWWNHWq.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 //#region src/cli/commands/env.ts
 const ARGS = {
-	out: {
+	write: {
 		type: "string",
+		alias: "out",
 		description: "Env file to write, or - to print the variables. Defaults to env.output, then .env.local",
 		valueHint: "file"
 	},
 	prefix: {
 		type: "string",
-		description: "Prefix for browser variables. Defaults to env.prefix, then one detected from your framework; \"none\" for no prefix",
+		description: "Browser variable prefix: next, vite, expo, nuxt, astro, sveltekit, a literal prefix, or \"none\". Defaults to env.prefix, then one detected from your framework",
 		valueHint: "prefix"
 	},
 	"status-file": {
@@ -40,12 +42,22 @@ async function readStatus(config, args, env, signal) {
 	if (!result.ok) throw new CliError("supabase_cli_failed", `supabase status failed (${result.code}). Is the local stack running (supabase start)?`, { suggestion: "supabase start" });
 	return result.status;
 }
-const text = (status, ...keys) => {
-	for (const key of keys) {
-		const value = status[key];
-		if (typeof value === "string" && value.length > 0) return value;
-	}
-};
+/** The browser prefix: `--prefix`, then `env.prefix`, then the framework's. */
+async function browserPrefix(config, flag) {
+	const prefix = flag ?? config.env.prefix;
+	return prefix === void 0 ? publicPrefix(await detectProject(config.root)) : prefixFromFlag(prefix);
+}
+/** The running stack's variables, as `env` writes them and `run` sets them. */
+async function readStackEnv(config, args, env, signal) {
+	const status = await readStatus(config, args, env, signal);
+	const prefix = await browserPrefix(config, args.prefix);
+	const values = stackEnvValues(status, prefix);
+	if (!values) throw new CliError("supabase_cli_failed", "supabase status has no API_URL or publishable key. Is the stack running?", { suggestion: "supabase start" });
+	return {
+		status,
+		values
+	};
+}
 /** Replaces `KEY=` lines in place and appends the rest under a header. */
 function mergeEnv(current, values) {
 	const pending = new Map(Object.entries(values));
@@ -65,32 +77,20 @@ function mergeEnv(current, values) {
 }
 async function runEnv(config, args, env, signal) {
 	const status = await readStatus(config, args, env, signal);
-	const project = await detectProject(config.root);
-	const prefixFlag = args.prefix ?? config.env.prefix;
-	const prefix = prefixFlag === void 0 ? publicPrefix(project) : prefixFlag === "none" ? "" : prefixFlag;
-	const url = text(status, "API_URL");
-	const publishableKey = text(status, "PUBLISHABLE_KEY", "ANON_KEY");
-	const secretKey = text(status, "SECRET_KEY", "SERVICE_ROLE_KEY");
-	if (!url || !publishableKey) return {
+	const prefix = await browserPrefix(config, args.prefix);
+	const values = stackEnvValues(status, prefix);
+	if (!values) return {
 		code: 1,
 		error: "supabase status has no API_URL or publishable key. Is the stack running?"
 	};
-	const values = {
-		[`${prefix}SUPABASE_URL`]: url,
-		[`${prefix}SUPABASE_PUBLISHABLE_KEY`]: publishableKey
-	};
-	if (secretKey) values["SUPABASE_SECRET_KEY"] = secretKey;
-	const dbUrl = text(status, "DB_URL");
-	if (dbUrl) values["SUPABASE_DB_URL"] = dbUrl;
-	const jwtSecret = text(status, "JWT_SECRET");
-	if (jwtSecret) values["SUPABASE_JWT_SECRET"] = jwtSecret;
-	if (args.out === "-") return {
+	const write = args.write;
+	if (write === "-") return {
 		code: 0,
 		output: Object.entries(values).map(([key, value]) => `${key}=${value}`).join("\n"),
 		data: { values }
 	};
-	const out = args.out ?? config.env.output;
-	const path = insideRoot(config.root, out, args.out ? "--out" : "env.output");
+	const out = write ?? config.env.output;
+	const path = insideRoot(config.root, out, write ? "--write" : "env.output");
 	const current = await readIfExists(path) ?? "";
 	const file = display(config.root, out);
 	const plan = {
@@ -110,7 +110,8 @@ async function runEnv(config, args, env, signal) {
 		keys: Object.keys(values)
 	} });
 	const warnings = [];
-	if (!text(status, "PUBLISHABLE_KEY")) warnings.push("This Supabase CLI prints only legacy JWT keys. Upgrade it to get sb_publishable_/sb_secret_ keys.");
+	const publishable = status["PUBLISHABLE_KEY"];
+	if (typeof publishable !== "string" || publishable.length === 0) warnings.push("This Supabase CLI prints only legacy JWT keys. Upgrade it to get sb_publishable_/sb_secret_ keys.");
 	const gitignore = resolve(config.root, ".gitignore");
 	if (!(existsSync(gitignore) && (await readFile(gitignore, "utf-8")).split("\n").some((line) => [
 		out,
@@ -139,4 +140,4 @@ const envCommand = defineCliCommand({
 	run: (args, { config, env, signal }) => runEnv(config, args, env, signal)
 });
 //#endregion
-export { mergeEnv as n, runEnv as r, envCommand as t };
+export { runEnv as a, readStackEnv as i, envCommand as n, mergeEnv as r, browserPrefix as t };

package/dist/cli/{gen-BhquLu7l.js → gen-D3sC5jDn.js}

@@ -1,17 +1,17 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { a as parseNames, i as failedResult, n as CliError } from "./errors-Caiz_0so.js";
-import { a as catalogFingerprint } from "./cache-CPBYJAkb.js";
-import { n as runGen } from "./run-DliGNdjI.js";
+import { a as catalogFingerprint } from "./cache-DQwgb3rg.js";
+import { n as runGen } from "./run-BhJKAanr.js";
 import { r as isGenTask, t as GEN_TASKS } from "./names-D6LrQnOv.js";
-import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
-import { i as sourceFlags, n as SOURCE_ARGS, r as sourceArgs } from "./source-args-BNhagtpw.js";
-import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-DikbSOE0.js";
-import { r as runEnv } from "./env-2v9JrxSr.js";
-import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-BewE6r6J.js";
-import { t as runScaffoldApi } from "./scaffold-6bv24GSP.js";
-import { t as runSeed } from "./seed-CIJaL1Ao.js";
-import { t as runSql } from "./sql-BBkchli4.js";
+import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
+import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BGkle6WM.js";
+import { a as runEnv } from "./env-Dh5K5t2U.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-DZeIP9ta.js";
+import { t as runScaffoldApi } from "./scaffold-DoURlDEI.js";
+import { t as runSeed } from "./seed-CIdg6s7m.js";
+import { t as runSql } from "./sql-DLOvvnBV.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/commands/gen-pipeline.ts

package/dist/cli/index.d.ts

@@ -227,6 +227,8 @@ interface CliEnv {
   readonly BETTER_SUPABASE_ENV?: string | undefined;
   /** Agent mode when `--agent` is not passed: auto, yes or no. `run()` reads it before parsing. */
   readonly BETTER_SUPABASE_AGENT?: string | undefined;
+  /** The named local stack `db query` and `seed` use when `--stack` is not passed. */
+  readonly BSB_STACK?: string | undefined;
   /** Every variable of the run, for the processes the CLI starts. */
   readonly [PROCESS_ENV]?: Readonly<Record<string, string | undefined>>;
 }
@@ -686,6 +688,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.10.0";
+export declare const VERSION = "0.12.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,12 +1,12 @@
-import { a as list, r as defineCliCommand } from "./command-D_HI1mp1.js";
-import { i as run, n as createCli, r as help, t as commandNames } from "./run-BLJj7SuM.js";
-import { t as VERSION } from "./version-D1wM9DNb.js";
+import { a as list, r as defineCliCommand } from "./command-dfdVhU_2.js";
+import { i as run, n as createCli, r as help, t as commandNames } from "./run-DRZ10srj.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-Caiz_0so.js";
-import { t as toCatalog } from "./catalog-Di15TkM2.js";
-import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-j0zZ6NE_.js";
-import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-DliGNdjI.js";
-import { s as loadConfig } from "./config-Bi_UBxXl.js";
-import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { t as toCatalog } from "./catalog-Cm6BtquM.js";
+import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-56LAG_Px.js";
+import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-BhJKAanr.js";
+import { s as loadConfig } from "./config-yZ55rsKZ.js";
+import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests
@@ -177,7 +177,8 @@ function fromCatalog(catalog) {
 				policies: table.policies,
 				triggers: table.triggers,
 				grants: table.grants,
-				...table.columnGrants ? { columnGrants: table.columnGrants } : {}
+				...table.columnGrants ? { columnGrants: table.columnGrants } : {},
+				...table.partitionOf ? { partitionOf: table.partitionOf } : {}
 			})),
 			buckets: catalog.buckets,
 			realtime: catalog.realtime,

package/dist/cli/{init-BwLTO6XG.js → init-DNomoycJ.js}

@@ -1,19 +1,19 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-BNBPI4Eu.js";
-import { a as findConfig, s as loadConfig } from "./config-Bi_UBxXl.js";
+import { a as findConfig, s as loadConfig } from "./config-yZ55rsKZ.js";
 import { n as applyPlan, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-CUS0AiBh.js";
-import { n as installCommand, t as detectProject } from "./detect-BeLVeNpA.js";
-import { s as enablePgDelta } from "./write-Dp1XlAVM.js";
-import { n as latestMigrationVersion } from "./migration-safety-LaGVPPuD.js";
-import { a as CONVENTION_COMPLETIONS, c as hasConventionFlags, i as CONVENTION_ARGS, l as promptConventions, n as AUTHZ_NOTE, o as conventionFlags, r as createUrlParam, s as defaultConventions, t as writeDesign, u as withConventions } from "./design-edit-B-WsnhUF.js";
-import { t as syncModules } from "./sync-CJ-ft-tl.js";
+import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-TT72pQk6.js";
+import { n as installCommand, t as detectProject } from "./detect-DQsVeBHg.js";
+import { s as enablePgDelta } from "./write-VZljwoTB.js";
+import { n as latestMigrationVersion } from "./migration-safety-DjVpz2D6.js";
+import { a as CONVENTION_ARGS, c as defaultConventions, d as withConventions, i as createUrlParam, l as hasConventionFlags, n as readPresetInput, o as CONVENTION_COMPLETIONS, r as AUTHZ_NOTE, s as conventionFlags, t as writeDesign, u as promptConventions } from "./design-edit-0U9iCTiS.js";
+import { t as syncModules } from "./sync-DBvknfOK.js";
 import { existsSync } from "node:fs";
 import { join, posix, resolve } from "node:path";
 import { glob, readFile } from "node:fs/promises";
-import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, designOf, encodePreset, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, presetOf, resolvePreset } from "better-supabase/preset";
+import { PRESETS, PRESET_NAMES, conventionConfig, designConfig, encodePreset, glueCommand, integrationsForFramework, isPresetName, presetBlocksSource, presetGlue, resolvePreset } from "better-supabase/preset";
 import { resolveConfig } from "better-supabase/config";
 //#region src/cli/project/workspace.ts
 const unquote = (value) => value.replace(/\s+#.*$/, "").trim().replace(/^(["'])(.*)\1$/, "$2");
@@ -120,8 +120,8 @@ const INIT_ARGS = {
 	},
 	preset: {
 		type: "string",
-		description: "A named preset, a code from /create or its URL: the config starts from it, and init writes its modules and lib/blocks.ts",
-		valueHint: "name|code|url"
+		description: "A named preset, a code from /create, its URL or a downloaded design file: the config starts from it, and init writes its modules and lib/blocks.ts",
+		valueHint: "name|code|url|file"
 	},
 	lite: {
 		type: "boolean",
@@ -175,7 +175,7 @@ async function initTarget(cwd, pkg, prompts) {
 	return dir === void 0 ? CANCELLED : { dir };
 }
 /** The preset `--preset` names, or the one the person picks; `null` for none. */
-async function chosenPreset(args, flags, prompts) {
+async function chosenPreset(args, flags, prompts, root) {
 	let value = args.preset;
 	if (value === void 0 && prompts && !hasConventionFlags(flags) && args.integration === void 0) {
 		const picked = await prompts.select("Preset", [{
@@ -191,15 +191,9 @@ async function chosenPreset(args, flags, prompts) {
 		if (picked !== "none") value = picked;
 	}
 	if (value === void 0) return null;
-	let preset;
-	let design;
-	try {
-		preset = presetOf(value);
-		design = isPresetName(value) ? void 0 : await designOf(value);
-	} catch (error) {
-		throw new CliError("usage", error instanceof Error ? error.message : String(error));
-	}
-	preset = withConventions(preset, flags);
+	const input = await readPresetInput(value, root);
+	const design = input.design;
+	const preset = withConventions(input.preset, flags);
 	const resolved = resolvePreset(preset);
 	if (resolved.conflicts.length > 0) throw new CliError("usage", `The preset can't install: ${resolved.conflicts.map((conflict) => `${conflict.block ?? conflict.field ?? ""} (${conflict.reason})`).join("; ")}.`);
 	if (design !== void 0) try {
@@ -233,7 +227,7 @@ function withDesign(files, design) {
 }
 async function runInit(config, args, prompts, now = () => /* @__PURE__ */ new Date()) {
 	const flags = conventionFlags(args);
-	const chosen = await chosenPreset(args, flags, prompts);
+	const chosen = await chosenPreset(args, flags, prompts, config.root);
 	if (chosen !== null && "code" in chosen) return chosen;
 	let conventions = chosen?.resolved.preset;
 	conventions ??= prompts && !hasConventionFlags(flags) ? await promptConventions(prompts) : defaultConventions(flags);

package/dist/cli/{introspect-B-gXAIqs.js → introspect-kYX06Q2g.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { c as serializeGenerator, s as restrictSchemas } from "./typegen--TfvOPLh.js";
-import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 import { n as applyPlan, o as insideRoot, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-BNhagtpw.js";
+import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
 //#region src/cli/commands/introspect.ts
 const ARGS = {
 	out: {

package/dist/cli/{keys-hwtdwdkT.js → keys-B8dIJwwi.js}

@@ -1,6 +1,6 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { t as display } from "./io-BiPX-_J1.js";
-import { m as supabaseDir } from "./supabase-toml-DjLgBYEo.js";
+import { m as supabaseDir } from "./supabase-toml-BC5sNVKU.js";
 import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/cli/{live-BFfYoE0_.js → live-CkV3d3yp.js}

@@ -1,6 +1,6 @@
 import { r as errorText } from "./errors-Caiz_0so.js";
-import "./snapshot-Dvcx0BSl.js";
-import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-CNcvDOLt.js";
+import "./snapshot-BBKFojqM.js";
+import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-DKLuA1Tp.js";
 //#region src/cli/doctor/reserved-roles.ts
 /**
 * supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,

package/dist/cli/{mcp-Bdm2oGmL.js → mcp-DrxB2Wuw.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
-import { a as envelope, i as run } from "./run-BLJj7SuM.js";
-import { t as VERSION } from "./version-D1wM9DNb.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
+import { a as envelope, i as run } from "./run-DRZ10srj.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { n as consentToken } from "./agent-CCrTYK3W.js";
-import { A as string$1, E as record, M as unknown, O as safeParse, S as optional, a as array, b as object, d as is, o as boolean, t as PROCESS_ENV } from "./env-Cf5OTqbK.js";
+import { A as string$1, E as record, M as unknown, O as safeParse, S as optional, a as array, b as object, d as is, o as boolean, t as PROCESS_ENV } from "./env-C8R7Nf0a.js";
 import { createInterface } from "node:readline";
 import { answerLine } from "better-supabase/mcp";
 //#region src/cli/mcp/server.ts

package/dist/cli/{metadata-DikbSOE0.js → metadata-BGkle6WM.js}

@@ -1,8 +1,8 @@
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { i as readStdin } from "./io-BiPX-_J1.js";
 import { a as parseMetadataDocument, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
-import { i as metaPaths } from "./emit-j0zZ6NE_.js";
-import { b as render, i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-DliGNdjI.js";
+import { i as metaPaths } from "./emit-56LAG_Px.js";
+import { b as render, i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-BhJKAanr.js";
 import { basename, join, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
 import { jsonSchema, standardSchema, valibot, zod } from "better-supabase/config";

package/dist/cli/{migration-safety-LaGVPPuD.js → migration-safety-DjVpz2D6.js}

@@ -1,4 +1,4 @@
-import { c as splitStatements } from "./shared-CNcvDOLt.js";
+import { c as splitStatements } from "./shared-DKLuA1Tp.js";
 import { join } from "node:path";
 import { readdir } from "node:fs/promises";
 //#region src/cli/doctor/migration-safety.ts

package/dist/cli/{module-migration-CLkZ8jpw.js → module-migration-CPhuiY8C.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
+import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-BC5sNVKU.js";
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
-import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-DjLgBYEo.js";
 import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
 import { existsSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";

package/dist/cli/{moved-B7UFO_OM.js → moved-BMQu1YNY.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
-import { s as positionalIndex } from "./parse-CwV5a6dA.js";
+import { s as positionalIndex } from "./parse-QzDvMpXH.js";
 //#region src/cli/core/moved.ts
 /** Commands renamed in 0.9, longest prefix first. */
 const MOVED_COMMANDS = [

package/dist/cli/{parse-CwV5a6dA.js → parse-QzDvMpXH.js}

@@ -1,5 +1,5 @@
 import { r as __toESM } from "./rolldown-runtime-kJ_i4yPo.js";
-import { t as GLOBAL_ARGS } from "./command-D_HI1mp1.js";
+import { t as GLOBAL_ARGS } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 //#region src/cli/core/parse.ts
 /** Global options that take a value, so a command name is never the token after them. */

package/dist/cli/{preset-DQ1DxMtI.js → preset-CfIs24cc.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { PRESET_FIELDS, decodePreset, encodePreset, isPresetCode, listNames, presetConfig, presetOf, resolvePreset } from "better-supabase/preset";
 //#region src/cli/commands/preset.ts

package/dist/cli/run-Bck-p0MI.js

@@ -0,0 +1,63 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
+import { n as CliError } from "./errors-Caiz_0so.js";
+import { t as PROCESS_ENV } from "./env-C8R7Nf0a.js";
+import { r as spawnInherited } from "./stack-status-_NUgd-g5.js";
+import { i as staleVariables } from "./stack-env-_uWWNHWq.js";
+import { i as readStackEnv } from "./env-Dh5K5t2U.js";
+//#region src/cli/commands/run.ts
+const ARGS = {
+	prefix: {
+		type: "string",
+		description: "Browser variable prefix: next, vite, expo, nuxt, astro, sveltekit, a literal prefix, or \"none\". Defaults to env.prefix, then one detected from your framework",
+		valueHint: "prefix"
+	},
+	"status-file": {
+		type: "string",
+		description: "Read `supabase status -o json` output from a file",
+		valueHint: "file"
+	}
+};
+/**
+* Runs a command with the stack's variables set. They override the shell,
+* and frameworks never override a variable that is already set, so they win
+* over `.env.local` too.
+*/
+async function runWithStackEnv(config, args, { cwd, env, log, signal, spawn = spawnInherited }) {
+	const [command, ...rest] = args._ ?? [];
+	if (command === void 0) throw new CliError("usage", "Name the command to run after --, e.g. better-supabase run -- next dev.", { suggestion: "better-supabase run -- next dev" });
+	const { values } = await readStackEnv(config, args, env, signal);
+	const shell = env[PROCESS_ENV] ?? {};
+	const stale = staleVariables(shell, values);
+	for (const variable of stale) log.warn(`${variable.message} run uses the stack's value.`);
+	return {
+		code: await spawn(command, rest, {
+			cwd,
+			env: {
+				...shell,
+				...values
+			}
+		}),
+		data: {
+			command: [command, ...rest],
+			keys: Object.keys(values),
+			warnings: stale.map(({ message }) => message),
+			stale: stale.map(({ variable, shell: from, stack }) => ({
+				variable,
+				shell: from,
+				stack
+			}))
+		}
+	};
+}
+const runCommand = defineCliCommand({
+	meta: commandMeta("run"),
+	args: ARGS,
+	run: (args, { config, cwd, env, log, signal }) => runWithStackEnv(config, args, {
+		cwd,
+		env,
+		log,
+		signal
+	})
+});
+//#endregion
+export { runCommand };

package/dist/cli/{run-DliGNdjI.js → run-BhJKAanr.js}

@@ -1,13 +1,13 @@
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, n as importPath, t as display } from "./io-BiPX-_J1.js";
-import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-CPBYJAkb.js";
+import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-DQwgb3rg.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { d as typegenVersion, f as typegenVersionNotice, i as oxfmtInstalled, l as stabilizeMetadata, r as generateDatabaseTypes } from "./typegen--TfvOPLh.js";
-import { a as buildModel, i as metaPaths, l as prop, n as emitMeta, o as generatorModel, r as emitModule, t as GENERATED_HEADER, u as q } from "./emit-j0zZ6NE_.js";
-import { C as accessRequirements, D as providerLabel, E as moduleKeyProblems, O as unsafeKey, S as accessProviderMode, T as entitlementsMode, c as writeLatestMigration, l as writesMigrations, n as READ_SETS_SUFFIX, r as latestMigration, s as sameModuleMigration, v as migrationsDir, w as entitlementRequirements, x as compiledReadSets } from "./module-migration-CLkZ8jpw.js";
-import { t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { a as buildModel, i as metaPaths, l as prop, n as emitMeta, o as generatorModel, r as emitModule, t as GENERATED_HEADER, u as q } from "./emit-56LAG_Px.js";
+import { C as accessRequirements, D as providerLabel, E as moduleKeyProblems, O as unsafeKey, S as accessProviderMode, T as entitlementsMode, c as writeLatestMigration, l as writesMigrations, n as READ_SETS_SUFFIX, r as latestMigration, s as sameModuleMigration, v as migrationsDir, w as entitlementRequirements, x as compiledReadSets } from "./module-migration-CPhuiY8C.js";
+import { t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 import { a as hasConflicts, c as fileDiff, i as changedFiles, n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
-import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-CNcvDOLt.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-DKLuA1Tp.js";
 import { existsSync } from "node:fs";
 import { basename, dirname, isAbsolute, posix, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
@@ -594,7 +594,28 @@ const TIMEOUT_ROLES = [
 	"authenticated",
 	"authenticator"
 ];
+/** Partitions of an RLS table that have RLS off: queried by name, they skip the parent's policies. */
+function partitionsWithoutRls(context) {
+	const tables = catalogOf(context).tables;
+	const byName = new Map(tables.map((table) => [qualified(table), table]));
+	return tables.flatMap((table) => {
+		if (table.partitionOf === void 0 || table.rls || !context.config.schemas.includes(table.schema)) return [];
+		if (!byName.get(table.partitionOf)?.rls) return [];
+		return [{
+			message: `${qualified(table)} is a partition of ${table.partitionOf}, which has RLS on, but RLS is off on the partition. A query that names the partition skips the parent's policies, and Data API roles with a grant on it read every row. Run \`alter table ${qualified(table)} enable row level security;\`, and add the same enable to the code that creates new partitions.`,
+			target: qualified(table),
+			object: tableObject(table)
+		}];
+	});
+}
 const RLS_RULES = [
+	{
+		code: "BS343",
+		severity: "error",
+		title: "Partition without row level security",
+		description: "A table in `schemas` is a partition of a table with RLS on, but has RLS off itself. Policies belong to the parent, so a query that names the partition (`select * from events_default`) never applies them. This includes the default partition. Enable RLS on every partition when you create it; the partition functions of the SQL modules (`ensure_partitions`, ADR 0038) already do.",
+		check: partitionsWithoutRls
+	},
 	{
 		code: "BS205",
 		severity: "warning",