better-supabase 0.12.0 → 0.13.0

package/dist/cli/db-CQCLx7cx.js

@@ -0,0 +1,78 @@
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+//#region src/cli/db.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const loadPg = () => import("pg");
+/** Opens a `pg` connection. `pg` is an optional peer, loaded on demand. */
+async function connect(url, load = loadPg, options = {}) {
+	let pg;
+	try {
+		const mod = await load();
+		pg = mod.default ?? mod;
+	} catch {
+		throw new CliError("dependency_missing", "better-supabase needs the \"pg\" package to read your database. Install it: pnpm add -D pg", { suggestion: "pnpm add -D pg" });
+	}
+	options.signal?.throwIfAborted();
+	const settings = {
+		connectionString: url,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		...options.statementTimeout === void 0 ? {} : { statement_timeout: options.statementTimeout }
+	};
+	const pool = options.pool === void 0 || pg.Pool === void 0 ? void 0 : new pg.Pool({
+		...settings,
+		max: options.pool
+	});
+	const client = pool ?? new pg.Client(settings);
+	const pooled = pool !== void 0;
+	client.on?.("error", () => void 0);
+	let ended;
+	const close = () => ended ??= client.end();
+	const onAbort = () => void close().catch(() => void 0);
+	try {
+		if (pool) (await pool.connect()).release();
+		else await client.connect();
+	} catch (cause) {
+		await close().catch(() => void 0);
+		const message = errorText(cause);
+		const hint = localStackDown(url, message) ? " Is the local stack running (supabase start)?" : "";
+		throw new CliError("database_unreachable", `Could not connect to ${redact(url)}: ${message}.${hint}`, {
+			cause,
+			...hint ? { suggestion: "supabase start" } : {}
+		});
+	}
+	options.signal?.addEventListener("abort", onAbort, { once: true });
+	return {
+		client,
+		...pooled ? { pooled } : {},
+		close: () => {
+			options.signal?.removeEventListener("abort", onAbort);
+			return close();
+		},
+		describe: redact(url)
+	};
+}
+const LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"::1"
+]);
+const UNREACHABLE = /ECONNREFUSED|ECONNRESET|Connection terminated|socket closed|connection closed/i;
+/**
+* Whether a failure looks like a local stack that isn't running: a loopback
+* host that refused or dropped the connection. A remote host, a bad password or
+* a TLS error has another cause, so `supabase start` would mislead.
+*/
+function localStackDown(url, message) {
+	let host;
+	try {
+		host = new URL(url).hostname;
+	} catch {
+		return false;
+	}
+	return LOOPBACK.has(host) && UNREACHABLE.test(message);
+}
+function redact(url) {
+	return url.replace(/\/\/([^:@/]+):([^@/]+)@/, "//$1:***@");
+}
+//#endregion
+export { connect as t };

package/dist/cli/db-D8iId4R8.js

@@ -0,0 +1,473 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-33pu13LT.js";
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
+import { t as display } from "./io-DH1kcmmP.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-2qlSTi2o.js";
+import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
+import { r as supabaseCli, t as runProcess } from "./exec--Q1ZEWUW.js";
+import { t as connect } from "./db-CQCLx7cx.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-Dy3j1-H-.js";
+import { basename, dirname, join, resolve } from "node:path";
+import { mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+//#region src/cli/in-stack-diff.ts
+/**
+* Schemas the platform owns. The declarative files may add policies to their
+* tables (`storage.objects`), so those policies are dropped and replayed, but
+* the schemas themselves are kept.
+*/
+const PLATFORM_SCHEMAS = /* @__PURE__ */ new Set([
+	"_analytics",
+	"_realtime",
+	"auth",
+	"cron",
+	"extensions",
+	"graphql",
+	"graphql_public",
+	"information_schema",
+	"net",
+	"pgbouncer",
+	"pgmq",
+	"pgsodium",
+	"pgsodium_masks",
+	"pgtle",
+	"realtime",
+	"repack",
+	"storage",
+	"supabase_functions",
+	"supabase_migrations",
+	"tiger",
+	"tiger_data",
+	"topology",
+	"vault"
+]);
+/** The local stack's superuser; pg-delta skips objects it owns. */
+const ADMIN_ROLE = "supabase_admin";
+/** Why the Supabase CLI could not start its shadow database. */
+const SHADOW_FAILURE = /could not create shared memory segment|No space left on device|shmget|shadow database/i;
+function isShadowFailure(output) {
+	return SHADOW_FAILURE.test(output);
+}
+/**
+* The same database as `supabase_admin`, which may create databases and read
+* every schema.
+*/
+function adminUrl(url) {
+	const parsed = new URL(url);
+	parsed.username = ADMIN_ROLE;
+	return parsed.toString();
+}
+function withDatabase(url, database) {
+	const parsed = new URL(url);
+	parsed.pathname = `/${database}`;
+	return parsed.toString();
+}
+/** The migration versions (`<digits>_name.sql`) the stack has not applied. */
+function pendingMigrations(files, applied) {
+	return files.filter((file) => {
+		const version = /^(\d+)_/.exec(basename(file))?.[1];
+		return version !== void 0 && !applied.has(version);
+	});
+}
+/** The SQL from `supabase db diff --output-format json`, or its text output. */
+function diffSql(stdout) {
+	const start = stdout.indexOf("{");
+	if (start !== -1) try {
+		const parsed = JSON.parse(stdout.slice(start));
+		if (typeof parsed === "object" && parsed !== null && "diff" in parsed && typeof parsed.diff === "string") return parsed.diff;
+	} catch {}
+	return stdout;
+}
+/** The postmaster's `bin` directory, from `ps` lines and its data directory. */
+function postgresBin(psOutput, dataDirectory) {
+	for (const line of psOutput.split("\n")) {
+		const command = line.trim().replace(/^\d+\s+/, "");
+		const executable = command.split(/\s+/)[0];
+		if (executable !== void 0 && basename(executable).includes("postgres") && command.includes(` -D ${dataDirectory}`)) return dirname(executable);
+	}
+}
+const MIGRATION_HEADER = `-- Generated by better-supabase db diff from the running stack with pg-delta.
+-- The SQL compares two databases, so review it before you apply it: check
+-- the order of the statements and drop the ones you didn't mean to change.
+`;
+/** UTC `YYYYMMDDHHMMSS`, the Supabase CLI's migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
+}
+async function queryRows(client, sql) {
+	return (await client.query(sql)).rows;
+}
+async function findPostgresBin(options, client) {
+	const fromEnv = options.env.BSB_PG_BIN;
+	if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+	const [row] = await queryRows(client, "show data_directory");
+	const ps = await (options.run ?? runProcess)("ps", ["-axo", "pid=,command="], options.root, options.env);
+	return row === void 0 ? void 0 : postgresBin(ps.stdout, row.data_directory);
+}
+const tool = (bin, name) => bin === void 0 ? name : join(bin, name);
+async function dropManagedObjects(client, replayedPlatformSchemas) {
+	const schemas = await queryRows(client, String.raw`select nspname from pg_namespace where nspname not like 'pg\_%' and nspname not in (select n.nspname from pg_namespace n join pg_depend d on d.objid = n.oid and d.deptype = 'e')`);
+	for (const { nspname } of schemas) {
+		if (PLATFORM_SCHEMAS.has(nspname)) continue;
+		if (nspname === "public") await client.query(EMPTY_PUBLIC);
+		else await client.query(`drop schema ${quoteIdent(nspname)} cascade`);
+	}
+	for (const schema of replayedPlatformSchemas) {
+		const policies = await client.query("select tablename, policyname from pg_policies where schemaname = $1", [schema]);
+		for (const policy of policies.rows) await client.query(`drop policy ${quoteIdent(policy.policyname)} on ${quoteIdent(schema)}.${quoteIdent(policy.tablename)}`);
+	}
+}
+const quoteIdent = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/**
+* Empties `public` without dropping it, so its default privileges stay. Objects
+* an extension owns stay too.
+*/
+const EMPTY_PUBLIC = `do $$
+declare r record;
+begin
+  for r in select format('drop %s if exists public.%I cascade',
+      case c.relkind when 'v' then 'view' when 'm' then 'materialized view' when 'S' then 'sequence' when 'f' then 'foreign table' else 'table' end,
+      c.relname) as s
+    from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'public' and c.relkind in ('v', 'm', 'r', 'p', 'f', 'S')
+      and not exists (select 1 from pg_depend d where d.objid = c.oid and d.deptype = 'e')
+    order by case c.relkind when 'v' then 0 when 'm' then 0 when 'S' then 2 else 1 end
+  loop execute r.s; end loop;
+  for r in select format('drop routine if exists %s cascade', p.oid::regprocedure) as s
+    from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'public'
+      and not exists (select 1 from pg_depend d where d.objid = p.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+  for r in select format('drop type if exists public.%I cascade', t.typname) as s
+    from pg_type t join pg_namespace n on n.oid = t.typnamespace
+    where n.nspname = 'public' and t.typtype in ('e', 'd', 'c')
+      and (t.typtype <> 'c' or (select relkind from pg_class where oid = t.typrelid) = 'c')
+      and not exists (select 1 from pg_depend d where d.objid = t.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+end $$`;
+/**
+* Applies each file in its own transaction and retries the ones that failed
+* until a round applies nothing, so files that depend on a later file still
+* apply. Returns the files that never applied, with the last error.
+*/
+async function applyInRounds(client, root, files) {
+	let pending = await Promise.all(files.map(async (file) => ({
+		file,
+		sql: await readFile(join(root, file), "utf-8")
+	})));
+	let error;
+	while (pending.length > 0) {
+		const failed = [];
+		for (const script of pending) try {
+			await client.query("begin");
+			await client.query(script.sql);
+			await client.query("commit");
+		} catch (cause) {
+			await client.query("rollback");
+			failed.push(script);
+			error = `${script.file}: ${errorText(cause)}`;
+		}
+		if (failed.length === pending.length) return {
+			failed: failed.map((script) => script.file),
+			...error === void 0 ? {} : { error }
+		};
+		pending = failed;
+	}
+	return { failed: [] };
+}
+/**
+* Diffs the declarative schema against the running stack without a shadow
+* database: copies the stack's database into a temporary one in the same
+* Postgres, replaces the objects the files manage with the files, and lets the
+* CLI's pg-delta diff the stack against the copy. The temporary database is
+* always dropped.
+*/
+async function inStackDiff(options) {
+	const open = options.open ?? connect;
+	const run = options.run ?? runProcess;
+	const supabase = options.supabase ?? supabaseCli;
+	const log = options.log ?? (() => {});
+	const admin = adminUrl(options.url);
+	const temp = `bsb_diff_${Date.now().toString(36)}`;
+	const tempUrl = withDatabase(admin, temp);
+	const main = await open(admin);
+	const scratch = await mkdtemp(join(tmpdir(), "bsb-diff-"));
+	let created = false;
+	try {
+		const applied = new Set((await queryRows(main.client, "select version from supabase_migrations.schema_migrations").catch(() => [])).map((row) => row.version));
+		const behind = pendingMigrations(options.migrations, applied);
+		if (behind.length > 0) throw new CliError("check_failed", `The stack has not applied ${String(behind.length)} migration(s) (${behind.slice(0, 3).join(", ")}${behind.length > 3 ? ", ..." : ""}), so the diff would repeat them. Run supabase migration up, then diff again.`, { suggestion: "supabase migration up" });
+		const bin = await findPostgresBin(options, main.client);
+		const dump = join(scratch, "schema.sql");
+		log("Copying the stack's schema into a temporary database");
+		const dumped = await run(tool(bin, "pg_dump"), [
+			"--schema-only",
+			"--file",
+			dump,
+			admin
+		], options.root, options.env);
+		if (dumped.code !== 0) throw new CliError(dumped.code === 127 ? "dependency_missing" : "failed", dumped.code === 127 ? "db diff --in-stack needs pg_dump and psql from the stack's Postgres. Set BSB_PG_BIN to their directory." : `pg_dump failed: ${dumped.stderr.trim()}`);
+		await main.client.query(`create database ${quoteIdent(temp)} owner postgres`);
+		created = true;
+		if ((await run(tool(bin, "psql"), [
+			"-X",
+			"-q",
+			"-v",
+			"ON_ERROR_STOP=0",
+			"-d",
+			tempUrl,
+			"-f",
+			dump
+		], options.root, options.env)).code === 127) throw new CliError("dependency_missing", "db diff --in-stack needs psql from the stack's Postgres. Set BSB_PG_BIN to its directory.");
+		const copy = await open(tempUrl);
+		try {
+			await copy.client.query("set check_function_bodies = off");
+			const topLevel = new Set(options.files.map((file) => file.slice(options.schemasDir.length + 1).split("/")[0] ?? ""));
+			await dropManagedObjects(copy.client, new Set([...topLevel].filter((schema) => PLATFORM_SCHEMAS.has(schema))));
+			await copy.client.query("set role postgres");
+			log(`Applying ${String(options.files.length)} schema file(s)`);
+			const result = await applyInRounds(copy.client, options.root, options.files);
+			if (result.failed.length > 0) throw new CliError("failed", `${String(result.failed.length)} schema file(s) did not apply. ${result.error ?? ""}`.trim());
+		} finally {
+			await copy.close();
+		}
+		log("Diffing the stack against the schema files with pg-delta");
+		const diff = await supabase([
+			"db",
+			"diff",
+			"--use-pg-delta",
+			"--from",
+			"local",
+			"--to",
+			`${tempUrl}${tempUrl.includes("?") ? "&" : "?"}sslmode=disable`,
+			"--output-format",
+			"json"
+		], options.root, options.env);
+		if (diff.code !== 0) throw new CliError("supabase_cli_failed", `supabase db diff failed: ${(diff.stderr || diff.stdout).trim()}`);
+		return diffSql(diff.stdout).trim();
+	} finally {
+		if (created) await main.client.query(`drop database if exists ${quoteIdent(temp)} with (force)`).catch(() => void 0);
+		await main.close();
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** The migration files under `supabase/migrations`, relative to the root. */
+async function migrationFiles(root, supabaseDir) {
+	const dir = join(supabaseDir, "migrations");
+	return (await readdir(join(root, dir)).catch(() => [])).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(dir, name));
+}
+//#endregion
+//#region src/cli/commands/db.ts
+const ARGS = {
+	file: {
+		type: "positional",
+		required: true,
+		variadic: true,
+		description: "SQL files, run in the order given"
+	},
+	"single-transaction": {
+		type: "boolean",
+		description: "Wrap every file in one transaction, so a failure keeps none"
+	}
+};
+/** Runs each file as one multi-statement script and reports the files it ran. */
+async function runDbQuery(config, args, env, open = connect, dbUrl, requireConsent = () => {}) {
+	const files = [...args._];
+	if (files.length === 0) throw new CliError("usage", "Pass at least one SQL file.", { flag: "file" });
+	const scripts = [];
+	for (const file of files) {
+		const path = resolve(config.root, file);
+		try {
+			scripts.push({
+				name: display(config.root, path),
+				sql: await readFile(path, "utf-8")
+			});
+		} catch (cause) {
+			throw new CliError("invalid_input", `Could not read ${file}: ${errorText(cause)}.`);
+		}
+	}
+	const url = await databaseUrl(config, env, dbUrl, args.stack ?? env.BSB_STACK);
+	if (!isLocalDatabaseUrl(url)) requireConsent({
+		effect: "database-write",
+		detail: `db query runs ${String(files.length)} file(s) against ${databaseHost(url)}`
+	});
+	const single = args["single-transaction"] === true;
+	const { client, close } = await open(url);
+	const ran = [];
+	try {
+		if (single) await client.query("begin");
+		for (const script of scripts) try {
+			await client.query(script.sql);
+			ran.push(script.name);
+		} catch (cause) {
+			if (single) await client.query("rollback");
+			return {
+				code: 1,
+				errorCode: "failed",
+				error: `${script.name}: ${errorText(cause)}${single ? " (nothing was kept)" : ""}`,
+				data: {
+					ran,
+					failed: script.name
+				}
+			};
+		}
+		if (single) await client.query("commit");
+	} finally {
+		await close();
+	}
+	return {
+		code: 0,
+		output: ran.map((name) => `Ran ${name}`).join("\n"),
+		data: {
+			ran,
+			singleTransaction: single
+		}
+	};
+}
+const dbQueryCommand = defineCliCommand({
+	meta: commandMeta("db query"),
+	args: {
+		...ARGS,
+		...DB_URL_STDIN_ARG,
+		...STACK_ARG
+	},
+	run: async (args, { config, env, io, log, requireConsent }) => {
+		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+		return log.progress("Running the SQL files", () => runDbQuery(config, args, env, connect, dbUrl, requireConsent));
+	}
+});
+const DIFF_ARGS = {
+	file: {
+		type: "string",
+		alias: "f",
+		description: "Save the diff as supabase/migrations/<timestamp>_<name>.sql instead of printing it",
+		valueHint: "name"
+	},
+	"in-stack": {
+		type: "boolean",
+		description: "Diff inside the running stack with pg-delta, without the Supabase CLI's shadow database"
+	}
+};
+const DEFAULT_DIFF_DEPS = {
+	supabase: (args, root, env) => supabaseCli(args, root, env),
+	inStackDiff,
+	now: () => /* @__PURE__ */ new Date(),
+	log: () => {}
+};
+/**
+* The Supabase CLI's diff for the workflow. pg-delta's `declarative sync`
+* always writes a migration, so printing a diff under pg-delta runs in the
+* stack.
+*/
+function cliDiffCommand(workflow, name) {
+	switch (workflow) {
+		case "pg-delta": return name === void 0 ? void 0 : [
+			"db",
+			"schema",
+			"declarative",
+			"sync",
+			"--no-apply",
+			"-f",
+			name
+		];
+		case "migra": return name === void 0 ? ["db", "diff"] : [
+			"db",
+			"diff",
+			"-f",
+			name
+		];
+		default: return workflow;
+	}
+}
+/**
+* Turns the declarative schema into a migration with the Supabase CLI's command
+* for the project's workflow. When the CLI can't start its shadow database (no
+* shared memory segment left), or with `--in-stack`, it diffs inside the
+* running stack instead.
+*/
+async function runDbDiff(config, args, env, deps = DEFAULT_DIFF_DEPS) {
+	const name = args.file;
+	if (name !== void 0 && !/^[\w-]+$/u.test(name)) throw new CliError("invalid_value", `--file "${name}" must be letters, digits, dashes or underscores.`, { flag: "--file" });
+	const toml = await readSupabaseToml(config.root);
+	const workflow = sqlWorkflow(config, toml);
+	if (workflow === "migrations") throw new CliError("usage", "db diff turns declarative schema files into a migration, and this project writes migrations directly (sql.workflow = migrations).");
+	let fellBack = false;
+	const command = cliDiffCommand(workflow, name);
+	if (args["in-stack"] !== true && command !== void 0) {
+		const result = await deps.supabase(command, config.root, env);
+		if (result.code === 0) return {
+			code: 0,
+			output: result.stdout.trim() || "No schema changes.",
+			data: {
+				engine: "supabase",
+				command: ["supabase", ...command]
+			}
+		};
+		const output = `${result.stderr}\n${result.stdout}`;
+		if (!isShadowFailure(output)) return {
+			code: 1,
+			errorCode: "supabase_cli_failed",
+			error: `supabase ${command.join(" ")} failed: ${output.trim()}`,
+			data: {
+				engine: "supabase",
+				command: ["supabase", ...command]
+			}
+		};
+		fellBack = true;
+		deps.log("The Supabase CLI could not start its shadow database (no shared memory segment left), so db diff diffs inside the running stack. better-supabase stack prune frees segments.");
+	}
+	const url = await databaseUrl(config, env, void 0, args.stack ?? env.BSB_STACK);
+	if (!isLocalDatabaseUrl(url)) throw new CliError("usage", `db diff --in-stack works on a local stack, and the database is ${databaseHost(url)}.`);
+	const dir = toml?.dir ?? "supabase";
+	const sql = await deps.inStackDiff({
+		url,
+		root: config.root,
+		env,
+		files: (await schemaPaths(config.root, toml, workflow)).files,
+		schemasDir: declarativeSchemasDir(toml, workflow),
+		migrations: await migrationFiles(config.root, dir),
+		log: deps.log
+	});
+	const data = {
+		engine: "in-stack",
+		fellBack,
+		changes: sql !== ""
+	};
+	if (sql === "") return {
+		code: 0,
+		output: "No schema changes.",
+		data
+	};
+	if (name === void 0) return {
+		code: 0,
+		output: sql,
+		data
+	};
+	const path = join(config.root, dir, "migrations", `${migrationVersion(deps.now())}_${name}.sql`);
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${MIGRATION_HEADER}\n${sql}\n`);
+	return {
+		code: 0,
+		output: `Wrote ${display(config.root, path)}. Review it before you apply it.`,
+		data: {
+			...data,
+			file: display(config.root, path)
+		}
+	};
+}
+const dbDiffCommand = defineCliCommand({
+	meta: commandMeta("db diff"),
+	args: {
+		...DIFF_ARGS,
+		...STACK_ARG
+	},
+	run: (args, { config, env, log }) => log.progress("Diffing the schema files", () => runDbDiff(config, args, env, {
+		...DEFAULT_DIFF_DEPS,
+		log: log.info
+	}))
+});
+//#endregion
+export { dbDiffCommand, dbQueryCommand };