better-supabase 0.13.0 → 0.14.0

package/dist/cli/config-CjgXMZW2.js

@@ -0,0 +1,1522 @@
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { i as readStdin, t as display } from "./io-DH1kcmmP.js";
+import { _ as parse$1, d as readSupabaseToml, g as tomlNumber, s as findUp } from "./supabase-toml-CncmQbO0.js";
+import { c as resolve$1, i as extname$1, n as basename$1, o as join$1, r as dirname$1, s as normalize$1, t as resolveModulePath } from "./dist-DuiMMRbJ.js";
+import { A as strictObject, C as optional, D as record, E as rawCheck, M as union, N as unknown, O as regex, S as objectWithRest, T as pipe, _ as minLength, a as array, b as number, c as exactOptional, f as lazy, g as maxValue, h as maxLength, j as string, k as safeParse, l as getDotPath, m as literal, o as boolean, p as length, s as custom, u as integer, v as minValue, w as picklist, y as nullable } from "./env-DMgjB_4y.js";
+import { n as INTEGRATIONS, t as GEN_TASKS } from "./names-D6LrQnOv.js";
+import { t as importFresh } from "./fresh-import-DzgsGHkX.js";
+import { n as readStackStatus } from "./stack-status-B_Ipd_-z.js";
+import * as nodeUtil from "node:util";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { readFile, rm } from "node:fs/promises";
+import { pathToFileURL } from "node:url";
+import { APP_COLUMN_ACCESS, APP_COLUMN_FORMATS, APP_COLUMN_TYPES, APP_ON_DELETE_ACTIONS, APP_ROLLUP_AGGREGATES, APP_TABLE_EVENT_KINDS, SKILLS_AGENTS, providerApiProblem, resolveConfig } from "better-supabase/config";
+import { SCOPE_ID_TYPES, scopeProblems } from "better-supabase/sql";
+import { homedir } from "node:os";
+//#region ../../node_modules/.pnpm/rc9@3.1.0/node_modules/rc9/dist/_chunks/libs/flat.mjs
+function isBuffer(obj) {
+	return obj && obj.constructor && typeof obj.constructor.isBuffer === "function" && obj.constructor.isBuffer(obj);
+}
+function keyIdentity(key) {
+	return key;
+}
+function flatten(target, opts) {
+	opts = opts || {};
+	const delimiter = opts.delimiter || ".";
+	const maxDepth = opts.maxDepth;
+	const transformKey = opts.transformKey || keyIdentity;
+	const output = {};
+	function step(object, prev, currentDepth) {
+		currentDepth = currentDepth || 1;
+		Object.keys(object).forEach(function(key) {
+			const value = object[key];
+			const isarray = opts.safe && Array.isArray(value);
+			const type = Object.prototype.toString.call(value);
+			const isbuffer = isBuffer(value);
+			const isobject = type === "[object Object]" || type === "[object Array]";
+			const newKey = prev ? prev + delimiter + transformKey(key) : transformKey(key);
+			if (!isarray && !isbuffer && isobject && Object.keys(value).length && (!opts.maxDepth || currentDepth < maxDepth)) return step(value, newKey, currentDepth + 1);
+			output[newKey] = value;
+		});
+	}
+	step(target);
+	return output;
+}
+function unflatten(target, opts) {
+	opts = opts || {};
+	const delimiter = opts.delimiter || ".";
+	const overwrite = opts.overwrite || false;
+	const transformKey = opts.transformKey || keyIdentity;
+	const result = {};
+	if (isBuffer(target) || Object.prototype.toString.call(target) !== "[object Object]") return target;
+	function getkey(key) {
+		const parsedKey = Number(key);
+		return isNaN(parsedKey) || key.indexOf(".") !== -1 || opts.object ? key : parsedKey;
+	}
+	function addKeys(keyPrefix, recipient, target) {
+		return Object.keys(target).reduce(function(result, key) {
+			result[keyPrefix + delimiter + key] = target[key];
+			return result;
+		}, recipient);
+	}
+	function isEmpty(val) {
+		const type = Object.prototype.toString.call(val);
+		const isArray = type === "[object Array]";
+		const isObject = type === "[object Object]";
+		if (!val) return true;
+		else if (isArray) return !val.length;
+		else if (isObject) return !Object.keys(val).length;
+	}
+	target = Object.keys(target).reduce(function(result, key) {
+		const type = Object.prototype.toString.call(target[key]);
+		if (!(type === "[object Object]" || type === "[object Array]") || isEmpty(target[key])) {
+			result[key] = target[key];
+			return result;
+		} else return addKeys(key, result, flatten(target[key], opts));
+	}, {});
+	Object.keys(target).forEach(function(key) {
+		const split = key.split(delimiter).map(transformKey);
+		let key1 = getkey(split.shift());
+		let key2 = getkey(split[0]);
+		let recipient = result;
+		while (key2 !== void 0) {
+			if (key1 === "__proto__") return;
+			const type = Object.prototype.toString.call(recipient[key1]);
+			const isobject = type === "[object Object]" || type === "[object Array]";
+			if (!overwrite && !isobject && typeof recipient[key1] !== "undefined") return;
+			if (overwrite && !isobject || !overwrite && recipient[key1] == null) recipient[key1] = typeof key2 === "number" && !opts.object ? [] : {};
+			recipient = recipient[key1];
+			if (split.length > 0) {
+				key1 = getkey(split.shift());
+				key2 = getkey(split[0]);
+			}
+		}
+		recipient[key1] = unflatten(target[key], opts);
+	});
+	return result;
+}
+//#endregion
+//#region ../../node_modules/.pnpm/destr@2.0.5/node_modules/destr/dist/index.mjs
+const suspectProtoRx = /"(?:_|\\u0{2}5[Ff]){2}(?:p|\\u0{2}70)(?:r|\\u0{2}72)(?:o|\\u0{2}6[Ff])(?:t|\\u0{2}74)(?:o|\\u0{2}6[Ff])(?:_|\\u0{2}5[Ff]){2}"\s*:/;
+const suspectConstructorRx = /"(?:c|\\u0063)(?:o|\\u006[Ff])(?:n|\\u006[Ee])(?:s|\\u0073)(?:t|\\u0074)(?:r|\\u0072)(?:u|\\u0075)(?:c|\\u0063)(?:t|\\u0074)(?:o|\\u006[Ff])(?:r|\\u0072)"\s*:/;
+const JsonSigRx = /^\s*["[{]|^\s*-?\d{1,16}(\.\d{1,17})?([Ee][+-]?\d+)?\s*$/;
+function jsonParseTransform(key, value) {
+	if (key === "__proto__" || key === "constructor" && value && typeof value === "object" && "prototype" in value) {
+		warnKeyDropped(key);
+		return;
+	}
+	return value;
+}
+function warnKeyDropped(key) {
+	console.warn(`[destr] Dropping "${key}" key to prevent prototype pollution.`);
+}
+function destr(value, options = {}) {
+	if (typeof value !== "string") return value;
+	if (value[0] === "\"" && value[value.length - 1] === "\"" && value.indexOf("\\") === -1) return value.slice(1, -1);
+	const _value = value.trim();
+	if (_value.length <= 9) switch (_value.toLowerCase()) {
+		case "true": return true;
+		case "false": return false;
+		case "undefined": return;
+		case "null": return null;
+		case "nan": return NaN;
+		case "infinity": return Number.POSITIVE_INFINITY;
+		case "-infinity": return Number.NEGATIVE_INFINITY;
+	}
+	if (!JsonSigRx.test(value)) {
+		if (options.strict) throw new SyntaxError("[destr] Invalid JSON");
+		return value;
+	}
+	try {
+		if (suspectProtoRx.test(value) || suspectConstructorRx.test(value)) {
+			if (options.strict) throw new Error("[destr] Possible prototype pollution");
+			return JSON.parse(value, jsonParseTransform);
+		}
+		return JSON.parse(value);
+	} catch (error) {
+		if (options.strict) throw error;
+		return value;
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/defu@6.1.7/node_modules/defu/dist/defu.mjs
+function isPlainObject$1(value) {
+	if (value === null || typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== null && prototype !== Object.prototype && Object.getPrototypeOf(prototype) !== null) return false;
+	if (Symbol.iterator in value) return false;
+	if (Symbol.toStringTag in value) return Object.prototype.toString.call(value) === "[object Module]";
+	return true;
+}
+function _defu(baseObject, defaults, namespace = ".", merger) {
+	if (!isPlainObject$1(defaults)) return _defu(baseObject, {}, namespace, merger);
+	const object = { ...defaults };
+	for (const key of Object.keys(baseObject)) {
+		if (key === "__proto__" || key === "constructor") continue;
+		const value = baseObject[key];
+		if (value === null || value === void 0) continue;
+		if (merger && merger(object, key, value, namespace)) continue;
+		if (Array.isArray(value) && Array.isArray(object[key])) object[key] = [...value, ...object[key]];
+		else if (isPlainObject$1(value) && isPlainObject$1(object[key])) object[key] = _defu(value, object[key], (namespace ? `${namespace}.` : "") + key.toString(), merger);
+		else object[key] = value;
+	}
+	return object;
+}
+function createDefu(merger) {
+	return (...arguments_) => arguments_.reduce((p, c) => _defu(p, c, "", merger), {});
+}
+const defu = createDefu();
+//#endregion
+//#region ../../node_modules/.pnpm/rc9@3.1.0/node_modules/rc9/dist/index.mjs
+const RE_KEY_VAL = /^\s*([^\s=]+)\s*=\s*(.*)?\s*$/;
+const RE_LINES = /\n|\r|\r\n/;
+const defaults = {
+	name: ".conf",
+	dir: process.cwd(),
+	flat: false
+};
+function withDefaults(options) {
+	if (typeof options === "string") options = { name: options };
+	return {
+		...defaults,
+		...options
+	};
+}
+function parse(contents, options = {}) {
+	const config = {};
+	const lines = contents.split(RE_LINES);
+	for (const line of lines) {
+		const match = line.match(RE_KEY_VAL);
+		if (!match) continue;
+		const key = match[1];
+		if (!key || key === "__proto__" || key === "constructor") continue;
+		const value = destr((match[2] || "").trim());
+		if (key.endsWith("[]")) {
+			const nkey = key.slice(0, Math.max(0, key.length - 2));
+			config[nkey] = (config[nkey] || []).concat(value);
+			continue;
+		}
+		config[key] = value;
+	}
+	return options.flat ? config : unflatten(config, { overwrite: true });
+}
+function parseFile(path, options) {
+	if (!existsSync(path)) return {};
+	return parse(readFileSync(path, "utf8"), options);
+}
+function read(options) {
+	options = withDefaults(options);
+	return parseFile(resolve(options.dir, options.name), options);
+}
+function userConfigDir() {
+	return process.env.XDG_CONFIG_HOME || resolve(homedir(), ".config");
+}
+function readUserConfig(options) {
+	options = withDefaults(options);
+	options.dir = userConfigDir();
+	return read(options);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/c12@4.0.0-rc.2_dotenv@17.4.2_giget@3.3.1_jiti@2.7.0_magicast@0.5.5/node_modules/c12/dist/index.mjs
+async function setupDotenv(options) {
+	const targetEnvironment = options.env ?? process.env;
+	const environment = await loadDotenv({
+		cwd: options.cwd,
+		fileName: options.fileName ?? ".env",
+		env: targetEnvironment,
+		interpolate: options.interpolate ?? true,
+		expandFileReferences: options.expandFileReferences ?? false,
+		parse: options.parse
+	});
+	const dotenvVars = getDotEnvVars(targetEnvironment);
+	for (const key in environment) {
+		if (key.startsWith("_")) continue;
+		if (targetEnvironment[key] === void 0 || dotenvVars.has(key)) targetEnvironment[key] = environment[key];
+	}
+	return environment;
+}
+async function loadDotenv(options) {
+	const environment = Object.create(null);
+	const cwd = resolve$1(options.cwd || ".");
+	const _fileName = options.fileName || ".env";
+	const dotenvFiles = typeof _fileName === "string" ? [_fileName] : _fileName;
+	const dotenvVars = getDotEnvVars(options.env || {});
+	Object.assign(environment, options.env);
+	for (const file of dotenvFiles) {
+		const dotenvFile = resolve$1(cwd, file);
+		if (!statSync(dotenvFile, { throwIfNoEntry: false })?.isFile()) continue;
+		const parsed = await readEnvFile(dotenvFile, options.parse);
+		for (const key in parsed) {
+			if (key in environment && !dotenvVars.has(key)) continue;
+			environment[key] = parsed[key];
+			dotenvVars.add(key);
+		}
+	}
+	if (options.expandFileReferences) {
+		for (const key in environment) if (key.endsWith("_FILE")) {
+			const targetKey = key.slice(0, -5);
+			if (environment[targetKey] === void 0) {
+				const filePath = environment[key];
+				if (filePath && statSync(filePath, { throwIfNoEntry: false })?.isFile()) {
+					environment[targetKey] = readFileSync(filePath, "utf8").trim();
+					dotenvVars.add(targetKey);
+				}
+			}
+		}
+	}
+	if (options.interpolate) interpolate(environment);
+	return environment;
+}
+let _parseEnv = nodeUtil.parseEnv;
+async function readEnvFile(path, parse) {
+	const src = readFileSync(path, "utf8");
+	if (parse) return parse(src);
+	if (!_parseEnv) try {
+		const dotenv = await import("dotenv");
+		_parseEnv = (src) => dotenv.parse(src);
+	} catch {
+		throw new Error("Failed to parse .env file: `node:util.parseEnv` is not available and `dotenv` package is not installed. Please upgrade your runtime, install `dotenv` as a dependency or provide a custom `parse` option.");
+	}
+	return _parseEnv(src);
+}
+function interpolate(target, source = {}, parse = (v) => v) {
+	function getValue(key) {
+		return source[key] === void 0 ? target[key] : source[key];
+	}
+	function interpolate(value, parents = []) {
+		if (typeof value !== "string") return value;
+		let result = "";
+		let index = 0;
+		while (index < value.length) {
+			const char = value[index];
+			if (char === "\\" && value[index + 1] === "$") {
+				result += "$";
+				index += 2;
+				continue;
+			}
+			const ref = char === "$" ? parseRef(value, index) : void 0;
+			if (!ref) {
+				result += char;
+				index++;
+				continue;
+			}
+			if (parents.includes(ref.key)) {
+				if (ref.defaultValue !== void 0) {
+					result += interpolate(ref.defaultValue, parents);
+					index = ref.end;
+					continue;
+				}
+				console.warn(`Please avoid recursive environment variables ( loop: ${parents.join(" > ")} > ${ref.key} )`);
+				return "";
+			}
+			let resolved = interpolate(getValue(ref.key), [...parents, ref.key]);
+			if (ref.defaultValue !== void 0 && (resolved === void 0 || ref.operator === ":-" && resolved === "")) resolved = interpolate(ref.defaultValue, parents);
+			result += resolved === void 0 ? value.slice(index, ref.end) : resolved;
+			index = ref.end;
+		}
+		return parse(result);
+	}
+	for (const key in target) target[key] = interpolate(getValue(key));
+}
+const REF_NAME_RE = /\w+/y;
+const BRACED_REF_NAME_RE = /[\w:]+/y;
+function parseRef(input, start) {
+	let index = start + 1;
+	const braced = input[index] === "{";
+	if (braced) index++;
+	const nameRe = braced ? BRACED_REF_NAME_RE : REF_NAME_RE;
+	nameRe.lastIndex = index;
+	const name = nameRe.exec(input);
+	if (!name) return;
+	let key = name[0];
+	index = nameRe.lastIndex;
+	if (!braced) return {
+		key,
+		end: index
+	};
+	if (input[index] === "}") return {
+		key,
+		end: index + 1
+	};
+	if (input[index] === "-") {
+		let operator = "-";
+		if (key.endsWith(":")) {
+			key = key.slice(0, -1);
+			operator = ":-";
+		}
+		const defaultValue = key ? readDefault(input, index + 1) : void 0;
+		if (!defaultValue) return;
+		return {
+			key,
+			operator,
+			defaultValue: defaultValue.value,
+			end: defaultValue.end
+		};
+	}
+	return {
+		key,
+		end: index
+	};
+}
+function readDefault(input, start) {
+	let value = "";
+	let depth = 1;
+	for (let index = start; index < input.length; index++) {
+		const char = input[index];
+		if (char === "\\" && index + 1 < input.length) {
+			const next = input[index + 1];
+			value += next === "{" || next === "}" ? next : char + next;
+			index++;
+			continue;
+		}
+		if (char === "$" && input[index + 1] === "{") {
+			depth++;
+			value += "${";
+			index++;
+			continue;
+		}
+		if (char === "{") depth++;
+		if (char === "}") {
+			depth--;
+			if (depth === 0) return {
+				value,
+				end: index + 1
+			};
+		}
+		value += char;
+	}
+}
+function getDotEnvVars(targetEnvironment) {
+	const globalRegistry = globalThis.__c12_dotenv_vars__ ||= /* @__PURE__ */ new Map();
+	if (!globalRegistry.has(targetEnvironment)) globalRegistry.set(targetEnvironment, /* @__PURE__ */ new Set());
+	return globalRegistry.get(targetEnvironment);
+}
+const _normalize = (p) => p?.replace(/\\/g, "/");
+let importCounter = 0;
+const ASYNC_LOADERS = {
+	".json": () => JSON.parse,
+	".yaml": () => import("./yaml-CYCbJ6et.js").then((r) => r.parseYAML),
+	".yml": () => import("./yaml-CYCbJ6et.js").then((r) => r.parseYAML),
+	".jsonc": () => import("./jsonc-C8M0EhHB.js").then((r) => (source) => r.parseJSONC(source, { allowTrailingComma: true })),
+	".json5": () => import("./json5-ChRycquj.js").then((r) => r.parseJSON5),
+	".toml": () => import("./toml-DB-MNnFs.js").then((r) => r.parseTOML)
+};
+const SUPPORTED_EXTENSIONS = Object.freeze([
+	".js",
+	".ts",
+	".mjs",
+	".cjs",
+	".mts",
+	".cts",
+	".json",
+	".jsonc",
+	".json5",
+	".yaml",
+	".yml",
+	".toml"
+]);
+async function loadConfig$1(options) {
+	options.cwd = resolve$1(process.cwd(), options.cwd || ".");
+	options.name = options.name || "config";
+	options.envName = options.envName ?? process.env.NODE_ENV;
+	options.configFile = options.configFile ?? (options.name === "config" ? "config" : `${options.name}.config`);
+	options.rcFile = options.rcFile ?? `.${options.name}rc`;
+	if (options.extend !== false) options.extend = {
+		extendKey: "extends",
+		...options.extend
+	};
+	const _merger = options.merger || defu;
+	const r = {
+		config: {},
+		cwd: options.cwd,
+		configFile: resolve$1(options.cwd, options.configFile),
+		layers: [],
+		_configFile: void 0
+	};
+	const rawConfigs = {
+		overrides: options.overrides,
+		main: void 0,
+		rc: void 0,
+		packageJson: void 0,
+		defaultConfig: options.defaultConfig
+	};
+	if (options.dotenv) await setupDotenv({
+		cwd: options.cwd,
+		...options.dotenv === true ? {} : options.dotenv
+	});
+	const _mainConfig = await resolveConfig$1(".", options);
+	if (_mainConfig.configFile) {
+		rawConfigs.main = _mainConfig.config;
+		r.configFile = _mainConfig.configFile;
+		r._configFile = _mainConfig._configFile;
+	}
+	if (_mainConfig.meta) r.meta = _mainConfig.meta;
+	if (options.rcFile) {
+		const rcSources = [];
+		rcSources.push(read({
+			name: options.rcFile,
+			dir: options.cwd
+		}));
+		if (options.globalRc) {
+			const { findWorkspaceDir } = await import("./dist-DSwzLVAG.js");
+			const workspaceDir = await findWorkspaceDir(options.cwd).catch(() => {});
+			if (workspaceDir) rcSources.push(read({
+				name: options.rcFile,
+				dir: workspaceDir
+			}));
+			rcSources.push(readUserConfig({ name: options.rcFile }));
+			rcSources.push(read({
+				name: options.rcFile,
+				dir: homedir()
+			}));
+		}
+		rawConfigs.rc = _merger({}, ...rcSources);
+	}
+	if (options.packageJson) {
+		const keys = (Array.isArray(options.packageJson) ? options.packageJson : [typeof options.packageJson === "string" ? options.packageJson : options.name]).filter((t) => t && typeof t === "string");
+		const { readPackageJSON } = await import("./dist-DSwzLVAG.js");
+		const pkgJsonFile = await readPackageJSON(options.cwd).catch(() => {});
+		rawConfigs.packageJson = _merger({}, ...keys.map((key) => pkgJsonFile?.[key]));
+	}
+	const configs = {};
+	for (const key in rawConfigs) {
+		const value = rawConfigs[key];
+		configs[key] = await (typeof value === "function" ? value({
+			configs,
+			rawConfigs
+		}) : value);
+	}
+	if (Array.isArray(configs.main)) r.config = configs.main;
+	else {
+		r.config = _merger(configs.overrides, configs.main, configs.rc, configs.packageJson, configs.defaultConfig);
+		if (options.extend) {
+			await extendConfig(r.config, options);
+			r.layers = r.config._layers;
+			delete r.config._layers;
+			r.config = _merger(r.config, ...r.layers.map((e) => e.config));
+		}
+	}
+	r.layers = [...[
+		configs.overrides && {
+			config: configs.overrides,
+			configFile: void 0,
+			cwd: void 0
+		},
+		{
+			config: configs.main,
+			configFile: options.configFile,
+			cwd: options.cwd
+		},
+		configs.rc && {
+			config: configs.rc,
+			configFile: options.rcFile
+		},
+		configs.packageJson && {
+			config: configs.packageJson,
+			configFile: "package.json"
+		}
+	].filter((l) => l && l.config), ...r.layers];
+	if (options.defaults) r.config = _merger(r.config, options.defaults);
+	if (options.omit$Keys) {
+		for (const key in r.config) if (key.startsWith("$")) delete r.config[key];
+	}
+	if (options.configFileRequired && !r._configFile) throw new Error(`Required config (${r.configFile}) cannot be resolved.`);
+	if (options.schema != null) r.config = await validateConfig(r.config, options.schema);
+	return r;
+}
+async function extendConfig(config, options) {
+	config._layers = config._layers || [];
+	if (!options.extend) return;
+	let keys = options.extend.extendKey;
+	if (typeof keys === "string") keys = [keys];
+	const extendSources = [];
+	for (const key of keys) {
+		extendSources.push(...(Array.isArray(config[key]) ? config[key] : [config[key]]).filter(Boolean));
+		delete config[key];
+	}
+	for (let extendSource of extendSources) {
+		const originalExtendSource = extendSource;
+		let sourceOptions = {};
+		if (extendSource.source) {
+			sourceOptions = extendSource.options || {};
+			extendSource = extendSource.source;
+		}
+		if (Array.isArray(extendSource)) {
+			sourceOptions = extendSource[1] || {};
+			extendSource = extendSource[0];
+		}
+		if (typeof extendSource !== "string") {
+			console.warn(`Cannot extend config from \`${JSON.stringify(originalExtendSource)}\` in ${options.cwd}`);
+			continue;
+		}
+		const _config = await resolveConfig$1(extendSource, options, sourceOptions);
+		if (!_config.config) {
+			console.warn(`Cannot extend config from \`${extendSource}\` in ${options.cwd}`);
+			continue;
+		}
+		await extendConfig(_config.config, {
+			...options,
+			cwd: _config.cwd
+		});
+		config._layers.push(_config);
+		if (_config.config._layers) {
+			config._layers.push(..._config.config._layers);
+			delete _config.config._layers;
+		}
+	}
+}
+const GIGET_PREFIXES = [
+	"gh:",
+	"github:",
+	"gitlab:",
+	"bitbucket:",
+	"https://",
+	"http://"
+];
+const NPM_PACKAGE_RE = /^(@[\da-z~-][\d._a-z~-]*\/)?[\da-z~-][\d._a-z~-]*($|\/.*)/;
+async function resolveConfig$1(source, options, sourceOptions = {}) {
+	if (options.resolve) {
+		const res = await options.resolve(source, options);
+		if (res) return res;
+	}
+	const _merger = options.merger || defu;
+	const customProviderKeys = Object.keys(sourceOptions.giget?.providers || {}).map((key) => `${key}:`);
+	const gigetPrefixes = customProviderKeys.length > 0 ? [.../* @__PURE__ */ new Set([...customProviderKeys, ...GIGET_PREFIXES])] : GIGET_PREFIXES;
+	if (options.giget !== false && gigetPrefixes.some((prefix) => source.startsWith(prefix))) {
+		const { downloadTemplate } = await import("giget").catch((error) => {
+			throw new Error(`Extending config from \`${source}\` requires \`giget\` peer dependency to be installed.\n\nInstall it with: \`npx nypm i giget\``, { cause: error });
+		});
+		const { digest } = await import("./ohash-BjQY1cBb.js").then((n) => n.dist_exports);
+		const cloneName = source.replace(/\W+/g, "_").split("_").splice(0, 3).join("_") + "_" + digest(source).slice(0, 10).replace(/[-_]/g, "");
+		let cloneDir;
+		const localNodeModules = resolve$1(options.cwd, "node_modules");
+		const parentDir = dirname$1(options.cwd);
+		if (basename$1(parentDir) === ".c12") cloneDir = join$1(parentDir, cloneName);
+		else if (existsSync(localNodeModules)) cloneDir = join$1(localNodeModules, ".c12", cloneName);
+		else cloneDir = process.env.XDG_CACHE_HOME ? resolve$1(process.env.XDG_CACHE_HOME, "c12", cloneName) : resolve$1(homedir(), ".cache/c12", cloneName);
+		const install = sourceOptions.install ? defu(sourceOptions.install === true ? {} : sourceOptions.install, { ignoreWorkspace: true }) : false;
+		if (existsSync(cloneDir) && !install) await rm(cloneDir, { recursive: true });
+		source = (await downloadTemplate(source, {
+			dir: cloneDir,
+			install,
+			force: Boolean(install),
+			auth: sourceOptions.auth,
+			...options.giget,
+			...sourceOptions.giget
+		})).dir;
+	}
+	if (NPM_PACKAGE_RE.test(source)) source = tryResolve(source, options) || source;
+	const ext = extname$1(source);
+	const isDir = _isDirectory(resolve$1(options.cwd, source)) ?? (!ext || ext === basename$1(source));
+	const cwd = resolve$1(options.cwd, isDir ? source : dirname$1(source));
+	if (isDir) source = options.configFile;
+	const res = {
+		config: void 0,
+		configFile: void 0,
+		cwd,
+		source,
+		sourceOptions
+	};
+	res.configFile = tryResolve(resolve$1(cwd, source), options) || tryResolve(resolve$1(cwd, ".config", source.replace(/\.config$/, "")), options) || tryResolve(resolve$1(cwd, ".config", source), options) || source;
+	if (!existsSync(res.configFile)) return res;
+	res._configFile = res.configFile;
+	const configFileExt = extname$1(res.configFile) || "";
+	if (configFileExt in ASYNC_LOADERS) res.config = (await ASYNC_LOADERS[configFileExt]())(await readFile(res.configFile, "utf8"));
+	else {
+		const _resolveModule = options.resolveModule || ((mod) => mod.default || mod);
+		if (options.import) res.config = _resolveModule(await options.import(res.configFile));
+		else {
+			const _configURL = pathToFileURL(res.configFile);
+			_configURL.search = `_${++importCounter}`;
+			res.config = await import(_configURL.href).then(_resolveModule, async (error) => {
+				const { createJiti } = await import("jiti").catch(() => {
+					throw new Error(`Failed to load config file \`${res.configFile}\`: ${error?.message}.  Hint install \`jiti\` for compatibility.`, { cause: error });
+				});
+				const jiti = createJiti(join$1(options.cwd || ".", options.configFile || "/"), {
+					interopDefault: true,
+					moduleCache: false,
+					extensions: [...SUPPORTED_EXTENSIONS],
+					...options.jitiOptions
+				});
+				options.import = (id) => jiti.import(id);
+				return _resolveModule(await options.import(res.configFile));
+			});
+		}
+	}
+	if (typeof res.config === "function") res.config = await res.config(options.context);
+	if (res.config && typeof res.config === "object" && !Array.isArray(res.config) && !Object.isExtensible(res.config)) res.config = { ...res.config };
+	const envConfigs = (Array.isArray(options.envName) ? options.envName : [options.envName]).filter(Boolean).reverse().flatMap((envName) => [res.config.$env?.[envName], res.config["$" + envName]]).filter((c) => c && Object.keys(c).length > 0);
+	if (envConfigs.length > 0) res.config = (options.envMerger || _merger)({}, ...envConfigs, res.config);
+	res.meta = defu(res.sourceOptions.meta, res.config.$meta);
+	delete res.config.$meta;
+	if (res.sourceOptions.overrides) res.config = _merger(res.sourceOptions.overrides, res.config);
+	res.configFile = _normalize(res.configFile);
+	res.source = _normalize(res.source);
+	return res;
+}
+async function validateConfig(config, schema) {
+	if (typeof schema?.["~standard"]?.validate !== "function") throw new TypeError("Invalid `schema` option: expected a Standard Schema (https://standardschema.dev).");
+	const result = await schema["~standard"].validate(config);
+	if (result.issues) {
+		const messages = result.issues.map((issue) => {
+			const path = issue.path?.map((p) => String(typeof p === "object" ? p.key : p)).join(".");
+			return `  - ${path ? `${path}: ` : ""}${issue.message}`;
+		});
+		throw new Error(`Config validation failed (${schema["~standard"].vendor}):\n${messages.join("\n")}`, { cause: result.issues });
+	}
+	return result.value;
+}
+function tryResolve(id, options) {
+	const res = resolveModulePath(id, {
+		try: true,
+		from: pathToFileURL(join$1(options.cwd || ".", options.configFile || "/")),
+		suffixes: ["", "/index"],
+		extensions: SUPPORTED_EXTENSIONS,
+		cache: false
+	});
+	return res ? normalize$1(res) : void 0;
+}
+function _isDirectory(path) {
+	try {
+		return statSync(path).isDirectory();
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/cli/config-schema.ts
+const strings = array(string());
+const stringRecord = record(string(), string());
+const privilege = pipe(string(), regex(/^(?:select|insert|update|delete|(?:select|insert|update)\s*\(\s*(?:[a-z_][a-z0-9_$]*(?:\s*,\s*[a-z_][a-z0-9_$]*)*|\*(?:\s*,\s*-\s*[a-z_][a-z0-9_$]*)*)\s*\))$/, "Use select, insert, update or delete, name columns such as \"update(title, body)\", or exclude them from every column with \"select(*, -secret)\""));
+const privileges = array(privilege);
+const triggerValue = union([string(), strictObject({
+	from: string(),
+	via: lazy(() => triggerValue),
+	select: string(),
+	key: exactOptional(string())
+})]);
+const triggerValues = record(string(), triggerValue);
+const pluginFlag = union([boolean(), record(string(), unknown())]);
+const isGenerator = (value) => typeof value === "object" && value !== null && "name" in value && typeof value.name === "string" && "generate" in value && typeof value.generate === "function";
+const generator = custom(isGenerator, "must be a generator: { name, generate(input) }");
+/**
+* The top level of `better-supabase.config.*`. It rejects unknown keys and
+* checks the leaves a typo or an old value breaks; nested objects the library
+* reads loosely stay loose.
+*/
+const entityName = pipe(string(), regex(/^[a-z][a-z0-9_]{0,40}$/, "an entity name is lowercase letters, digits and underscores"));
+const blockEntries = {
+	mode: optional(picklist([
+		"managed",
+		"adopt",
+		"custom"
+	])),
+	schema: optional(string()),
+	tables: optional(record(string(), nullable(string()))),
+	columns: optional(record(string(), record(string(), nullable(string())))),
+	idType: optional(string()),
+	scope: optional(picklist([
+		"tenant",
+		"user",
+		"none"
+	])),
+	functions: optional(stringRecord),
+	permissions: optional(stringRecord),
+	entities: optional(union([entityName, record(string(), union([entityName, strictObject({
+		name: optional(entityName),
+		plural: optional(entityName),
+		url: optional(string()),
+		subject: optional(literal(false))
+	})]))])),
+	options: optional(record(string(), unknown())),
+	hooks: optional(strictObject({
+		schema: optional(string()),
+		functions: optional(stringRecord)
+	})),
+	events: optional(boolean()),
+	audit: optional(boolean()),
+	api: optional(union([
+		string(),
+		literal(false),
+		strictObject({
+			schema: string(),
+			functions: optional(strings)
+		})
+	]))
+};
+const disabledRow = strictObject({
+	table: string(),
+	id: string(),
+	disabledAt: optional(string()),
+	status: optional(string()),
+	active: optional(strings)
+});
+const accessBlock = strictObject({
+	...blockEntries,
+	model: optional(picklist([
+		"roles",
+		"catalog",
+		"provider",
+		"custom"
+	])),
+	roles: optional(record(string(), strings)),
+	functions: optional(strictObject({
+		can: optional(string()),
+		tenantIdsWith: optional(string()),
+		isPlatform: optional(string()),
+		canUser: optional(string()),
+		canAssign: optional(string()),
+		canAssignFor: optional(string()),
+		permissionClaims: optional(string())
+	})),
+	platformClaim: optional(string()),
+	scopes: optional(record(string(), strings)),
+	disabled: optional(strictObject({
+		tenant: optional(union([string(), disabledRow])),
+		user: optional(union([string(), disabledRow])),
+		userKey: optional(string())
+	})),
+	activeTenant: optional(union([picklist(["claim", "resolver"]), strictObject({
+		profileColumn: string(),
+		key: optional(string())
+	})]))
+});
+/**
+* `blocks`: a list of names, or each block's config. The schema checks the keys
+* every block shares; `resolveConfig` checks the tables, columns, functions,
+* actions, hooks and entities each module declares.
+*/
+const blocksSchema = lazy((input) => Array.isArray(input) ? strings : objectWithRest({ access: optional(accessBlock) }, strictObject(blockEntries)));
+const scopeName = pipe(string(), regex(/^[a-z][a-z0-9_]*$/, "Use lower case letters, digits and _"));
+const membershipScope = union([strictObject({ column: string() }), strictObject({ value: string() })]);
+const authorization = strictObject({
+	apiVersion: literal(1),
+	name: string(),
+	scopes: array(strictObject({
+		name: scopeName,
+		idType: optional(picklist(SCOPE_ID_TYPES)),
+		parent: optional(string())
+	})),
+	tenantScope: scopeName,
+	functions: strictObject({
+		idsWith: string(),
+		isPlatform: string(),
+		idsWithFor: optional(string()),
+		isPlatformFor: optional(string()),
+		memberIds: optional(string()),
+		memberIdsFor: optional(string()),
+		teamIdsOf: optional(string()),
+		canAssign: optional(string()),
+		canAssignFor: optional(string()),
+		permissionsFor: optional(string()),
+		canApprove: optional(string()),
+		isApprover: optional(string()),
+		holdersOf: optional(string()),
+		actorMayWrite: optional(string()),
+		permitted: optional(string()),
+		portalSubjects: optional(string()),
+		portalParties: optional(string())
+	}),
+	requires: optional(array(strictObject({
+		function: string(),
+		args: optional(string()),
+		role: string()
+	}))),
+	permissions: optional(array(strictObject({
+		key: string(),
+		sqlComplete: optional(boolean()),
+		scopes: optional(strings)
+	}))),
+	operations: optional(record(string(), strictObject({
+		permission: pipe(string(), minLength(1)),
+		meta: optional(strictObject({
+			risk: optional(picklist([
+				"low",
+				"medium",
+				"high"
+			])),
+			effects: optional(array(picklist([
+				"read",
+				"write",
+				"delete",
+				"external"
+			]))),
+			title: optional(string())
+		}))
+	}))),
+	memberships: optional(array(strictObject({
+		table: string(),
+		userColumn: string(),
+		scope: membershipScope,
+		idColumn: string()
+	}))),
+	suspension: optional(strictObject({
+		user: optional(disabledRow),
+		tenant: optional(disabledRow)
+	})),
+	roleSources: optional(array(strictObject({
+		table: string(),
+		role: strictObject({
+			column: string(),
+			through: strictObject({
+				table: string(),
+				id: string(),
+				column: string()
+			})
+		})
+	}))),
+	decidingColumns: optional(array(pipe(string(), regex(/^[A-Za-z_][\w$]*\.[A-Za-z_][\w$]*\.[A-Za-z_][\w$]*$/, "Use schema.table.column")))),
+	tokenHook: optional(strictObject({
+		function: string(),
+		tenantClaim: optional(string()),
+		ownedClaims: pipe(strings, minLength(1, "List at least one claim")),
+		registeredClaims: optional(array(strictObject({
+			name: string(),
+			function: string()
+		}))),
+		budget: optional(strictObject({
+			claims: strings,
+			bytes: pipe(number(), integer("Use a whole number of bytes"), minValue(1, "Use at least 1 byte")),
+			truncatedClaim: optional(string())
+		})),
+		markers: optional(strictObject({
+			hook: optional(string()),
+			grants: optional(string())
+		})),
+		grantsCommand: optional(string())
+	})),
+	delegation: optional(strictObject({ scopes: optional(record(string(), strings)) })),
+	approvals: optional(strictObject({ distinctApprover: optional(boolean()) })),
+	problems: optional(strings)
+});
+const checkedAuthorization = pipe(authorization, rawCheck(({ dataset, addIssue }) => {
+	if (!dataset.typed) return;
+	for (const problem of scopeProblems(dataset.value)) addIssue({ message: problem });
+}));
+const jsonSchema$1 = record(string(), unknown());
+const onDelete = optional(picklist(APP_ON_DELETE_ACTIONS));
+const positiveInteger = pipe(number(), integer(), minValue(1));
+const bucket = strictObject({
+	id: optional(string()),
+	public: optional(boolean()),
+	path: union([string(), pipe(strings, minLength(1))]),
+	policy: optional(union([picklist([
+		"tenant",
+		"owner",
+		"public",
+		"none"
+	]), strictObject({
+		access: strictObject({
+			read: string(),
+			list: optional(string()),
+			write: string(),
+			delete: optional(string())
+		}),
+		scope: optional(string()),
+		segment: optional(positiveInteger),
+		sql: optional(union([literal("provider"), strictObject({
+			idsWith: string(),
+			isPlatform: string()
+		})]))
+	})])),
+	fileSizeLimit: optional(string()),
+	allowedMimeTypes: optional(strings),
+	versioning: optional(boolean()),
+	lifecycle: optional(strictObject({ rules: pipe(array(strictObject({
+		id: optional(string()),
+		status: optional(picklist(["Enabled", "Disabled"])),
+		noncurrentVersionExpiration: strictObject({
+			noncurrentDays: positiveInteger,
+			newerNoncurrentVersions: optional(pipe(number(), integer(), minValue(1), maxValue(100)))
+		})
+	})), minLength(1), maxLength(1e3)) }))
+});
+const appTables = record(string(), strictObject({
+	columns: optional(record(string(), strictObject({
+		type: picklist(APP_COLUMN_TYPES),
+		nullable: optional(boolean()),
+		default: optional(string()),
+		unique: optional(boolean()),
+		references: optional(union([strictObject({
+			table: string(),
+			onDelete
+		}), strictObject({
+			block: string(),
+			table: string(),
+			onDelete
+		})])),
+		format: optional(picklist(APP_COLUMN_FORMATS)),
+		options: optional(array(string())),
+		min: optional(number()),
+		max: optional(number()),
+		comment: optional(string()),
+		identity: optional(boolean()),
+		access: optional(picklist(APP_COLUMN_ACCESS)),
+		encrypted: optional(boolean())
+	}))),
+	scope: optional(picklist([
+		"inherit",
+		"user",
+		"none"
+	])),
+	timestamps: optional(boolean()),
+	id: optional(picklist(["uuid", "bigint"])),
+	unique: optional(array(array(string()))),
+	indexes: optional(array(array(string()))),
+	comment: optional(string()),
+	auditReads: optional(boolean()),
+	subject: optional(strictObject({
+		type: string(),
+		title: optional(string()),
+		url: optional(string()),
+		search: optional(strictObject({
+			title: optional(string()),
+			body: optional(array(string()))
+		})),
+		permissions: optional(record(string(), string())),
+		rank: optional(union([literal(true), strictObject({ group: optional(string()) })])),
+		softDelete: optional(boolean()),
+		versions: optional(union([literal(true), strictObject({
+			columns: optional(strings),
+			auto: optional(boolean())
+		})]))
+	})),
+	rollups: optional(record(string(), strictObject({
+		table: string(),
+		via: string(),
+		aggregate: picklist(APP_ROLLUP_AGGREGATES),
+		column: optional(string()),
+		where: optional(strictObject({
+			column: string(),
+			equals: string()
+		}))
+	}))),
+	lookups: optional(record(string(), strictObject({
+		via: string(),
+		column: string()
+	}))),
+	events: optional(union([literal(true), strictObject({
+		on: optional(array(picklist(APP_TABLE_EVENT_KINDS))),
+		include: optional(strings)
+	})]))
+}));
+const ENTRIES = {
+	source: optional(strictObject({
+		dbUrl: optional(string()),
+		projectRef: optional(string()),
+		accessToken: optional(string()),
+		snapshot: optional(string()),
+		lite: optional(boolean())
+	})),
+	schemas: optional(strings),
+	casing: optional(picklist(["snake", "camel"])),
+	tables: optional(record(string(), strictObject({
+		casing: optional(picklist(["snake", "camel"])),
+		exclude: optional(boolean()),
+		serviceRole: optional(boolean()),
+		relations: optional(stringRecord),
+		insertOptional: optional(strings)
+	}))),
+	output: optional(string()),
+	postgrestVersion: optional(string()),
+	generateFeatures: optional(boolean()),
+	json: optional(record(string(), union([strictObject({
+		import: string(),
+		schema: optional(jsonSchema$1)
+	}), strictObject({
+		type: string(),
+		schema: optional(jsonSchema$1)
+	})], "Use { import } or { type }, with an optional schema"))),
+	codecs: optional(strictObject({
+		timestamptz: optional(picklist([
+			"string",
+			"instant",
+			"utc"
+		])),
+		int8: optional(picklist([
+			"number",
+			"string",
+			"bigint"
+		])),
+		numeric: optional(picklist(["number", "string"]))
+	})),
+	relations: optional(strictObject({ nullableUnderRls: optional(boolean()) })),
+	sensitive: optional(strings),
+	storagePaths: optional(stringRecord),
+	functions: optional(record(string(), strictObject({ notNull: optional(union([literal(true), strings])) }))),
+	expose: optional(record(string(), union([
+		privileges,
+		strictObject({
+			anon: optional(privileges),
+			authenticated: optional(privileges),
+			serviceRole: optional(privileges)
+		}),
+		strictObject({
+			execute: array(picklist(["anon", "authenticated"])),
+			serviceRole: optional(boolean())
+		})
+	]))),
+	readSets: optional(strings),
+	generators: optional(array(generator)),
+	plugins: optional(strictObject({
+		timestamps: optional(pluginFlag),
+		softDelete: optional(pluginFlag),
+		tenant: optional(pluginFlag),
+		actor: optional(pluginFlag)
+	})),
+	claims: optional(strictObject({
+		tenant: optional(string()),
+		scope: optional(string()),
+		features: optional(string()),
+		memberships: optional(string())
+	})),
+	buckets: optional(record(string(), bucket)),
+	topics: optional(stringRecord),
+	realtime: optional(strictObject({
+		tables: optional(strings),
+		global: optional(strings),
+		users: optional(stringRecord),
+		policies: optional(strictObject({
+			from: strings,
+			output: string()
+		})),
+		triggers: optional(array(strictObject({
+			topic: string(),
+			table: string(),
+			values: optional(triggerValues),
+			events: optional(array(picklist([
+				"insert",
+				"update",
+				"delete"
+			]))),
+			event: optional(union([string(), strictObject({
+				insert: optional(string()),
+				update: optional(string()),
+				delete: optional(string())
+			})])),
+			payload: optional(union([picklist(["keys", "row"]), record(string(), union([triggerValue, strictObject({ sql: string() })]))])),
+			topics: optional(array(strictObject({
+				topic: string(),
+				values: optional(triggerValues)
+			}))),
+			functionSchema: optional(string()),
+			when: optional(strictObject({ changed: pipe(array(string()), minLength(1)) }))
+		})))
+	})),
+	entitlements: optional(strictObject({
+		customer: optional(string()),
+		key: optional(string()),
+		memberships: optional(picklist(["tenant", "provider"])),
+		source: optional(union([picklist(["stripe-sync", "custom"]), strictObject({ plans: strictObject({
+			subscriptions: strictObject({
+				table: string(),
+				tenant: string(),
+				plan: string(),
+				status: optional(string()),
+				activeStatuses: optional(strings)
+			}),
+			features: strictObject({
+				table: string(),
+				plan: string(),
+				feature: string(),
+				included: optional(string()),
+				value: optional(string())
+			})
+		}) })])),
+		claim: optional(union([literal(false), strictObject({
+			maxTenants: optional(number()),
+			keys: optional(stringRecord)
+		})]))
+	})),
+	authorization: optional(checkedAuthorization),
+	vectorSearch: optional(record(string(), union([string(), strictObject({
+		column: string(),
+		distance: optional(picklist([
+			"cosine",
+			"l2",
+			"inner_product"
+		])),
+		type: optional(picklist(["vector", "halfvec"])),
+		key: optional(string()),
+		hybrid: optional(strictObject({
+			tsvector: string(),
+			config: optional(string()),
+			k: optional(number())
+		})),
+		boost: optional(string()),
+		prefilter: optional(strings),
+		predicate: optional(string()),
+		boostMode: optional(picklist(["multiply", "add"])),
+		order: optional(string())
+	})]))),
+	subjects: optional(record(pipe(string(), regex(/^[a-z][a-z0-9_]{0,62}$/, "a subject type is lowercase letters, digits and underscores")), strictObject({
+		table: string(),
+		id: optional(string()),
+		idType: optional(string()),
+		tenant: optional(union([string(), literal(false)])),
+		title: optional(string()),
+		url: optional(string()),
+		permissions: optional(record(string(), string())),
+		scope: optional(string()),
+		cascade: optional(boolean()),
+		deletedAt: optional(string()),
+		search: optional(strictObject({
+			title: optional(string()),
+			body: optional(strings)
+		})),
+		rank: optional(strictObject({
+			column: string(),
+			group: optional(string())
+		})),
+		versions: optional(strictObject({
+			columns: strings,
+			auto: boolean()
+		}))
+	}))),
+	appTables: optional(appTables),
+	blocks: optional(blocksSchema),
+	sql: optional(strictObject({
+		workflow: optional(picklist([
+			"pg-delta",
+			"migra",
+			"migrations"
+		])),
+		dir: optional(string()),
+		prefix: optional(string()),
+		testsDir: optional(string()),
+		schema: optional(string()),
+		api: optional(string()),
+		scope: optional(picklist([
+			"tenant",
+			"user",
+			"none"
+		]))
+	})),
+	seed: optional(strictObject({
+		entry: optional(string()),
+		output: optional(string()),
+		perTenant: optional(string())
+	})),
+	openapi: optional(strictObject({
+		entry: optional(string()),
+		output: optional(string())
+	})),
+	specs: optional(strictObject({
+		entry: optional(string()),
+		outputs: optional(array(strictObject({
+			format: pipe(string(), minLength(1)),
+			version: optional(string()),
+			output: optional(string()),
+			overlays: optional(strings),
+			serialize: optional(picklist(["json", "yaml"])),
+			ui: optional(picklist([
+				"scalar",
+				"swagger",
+				"redoc",
+				"elements",
+				"rapidoc"
+			]))
+		}))),
+		failOn: optional(picklist([
+			"error",
+			"warning",
+			"never"
+		])),
+		manifest: optional(string())
+	})),
+	doctor: optional(strictObject({
+		ignore: optional(strings),
+		only: optional(strings),
+		strict: optional(boolean()),
+		format: optional(picklist([
+			"text",
+			"sarif",
+			"github"
+		])),
+		output: optional(string()),
+		sources: optional(strings),
+		policyHelperLimit: optional(number()),
+		claimsLimit: optional(number()),
+		migrationSafety: optional(strictObject({ since: optional(string()) }))
+	})),
+	gen: optional(strictObject({
+		tasks: optional(array(picklist(GEN_TASKS))),
+		watchInterval: optional(pipe(number(), minValue(1, "must be a positive number of ms")))
+	})),
+	env: optional(strictObject({
+		output: optional(string()),
+		prefix: optional(string())
+	})),
+	scaffold: optional(strictObject({ api: optional(strictObject({
+		framework: optional(picklist(["hono", "next"])),
+		tables: optional(strings),
+		name: optional(string()),
+		basePath: optional(string())
+	})) })),
+	integrations: optional(array(picklist(INTEGRATIONS))),
+	skills: optional(strictObject({ agents: optional(array(picklist(SKILLS_AGENTS))) })),
+	keys: optional(strictObject({ output: optional(string()) }))
+};
+const EnvironmentSchema = strictObject(ENTRIES);
+strictObject({
+	version: optional(pipe(number(), integer(), minValue(0))),
+	appTables: optional(appTables),
+	extraColumns: optional(record(string(), stringRecord)),
+	positions: optional(record(string(), pipe(array(number()), length(2))))
+});
+const ConfigSchema = strictObject({
+	$schema: optional(string()),
+	preset: optional(pipe(string(), minLength(1))),
+	...ENTRIES,
+	$env: optional(record(string(), EnvironmentSchema)),
+	$development: optional(EnvironmentSchema),
+	$production: optional(EnvironmentSchema),
+	$test: optional(EnvironmentSchema),
+	$ci: optional(EnvironmentSchema)
+});
+const hasSqlKey = (value, key) => typeof value === "object" && value !== null && "sql" in value && typeof value.sql === "object" && value.sql !== null && key in value.sql;
+/** `sql` keys that moved, with where they went. */
+const MOVED_SQL_KEYS = [["modules", "moved to the top-level `blocks` key in 0.9; run `better-supabase codemod 0.9`"], ["naming", "`sql.naming.tenant` moved to `blocks.tenant.entities.organization`"]];
+/**
+* Moved `sql` keys in the config or one of its environment blocks, each as
+* `path: message`.
+*/
+function movedKeyIssues(value) {
+	if (typeof value !== "object" || value === null) return [];
+	const blocks = [["", value]];
+	const entries = Object.entries(value);
+	for (const [key, block] of entries) if (key === "$env" && typeof block === "object" && block !== null) {
+		const named = Object.entries(block);
+		blocks.push(...named.map(([name, env]) => [`$env.${name}.`, env]));
+	} else if (key.startsWith("$")) blocks.push([`${key}.`, block]);
+	return blocks.flatMap(([prefix, block]) => MOVED_SQL_KEYS.filter(([key]) => hasSqlKey(block, key)).map(([key, message]) => `${prefix}sql.${key}: ${message}`));
+}
+/** Each issue as `path: message`, the path in config keys. */
+function configIssues(value) {
+	const moved = movedKeyIssues(value);
+	if (moved.length > 0) return moved;
+	if (typeof value === "object" && value !== null && "authorization" in value) {
+		const provider = value.authorization;
+		const problem = typeof provider === "object" && provider !== null ? providerApiProblem(provider) : void 0;
+		if (problem !== void 0) {
+			const { authorization: _, ...rest } = value;
+			return [`authorization.apiVersion: ${problem}`, ...configIssues(rest)];
+		}
+	}
+	const result = safeParse(ConfigSchema, value);
+	if (result.success) return [];
+	return result.issues.map((issue) => {
+		const path = getDotPath(issue);
+		return path ? `${path}: ${issue.message}` : issue.message;
+	});
+}
+strictObject(blockEntries);
+//#endregion
+//#region src/cli/core/credentials.ts
+/** The first source that has a value, in order. */
+function first(sources) {
+	for (const [from, value] of sources) if (value !== void 0 && value !== "") return {
+		value,
+		from
+	};
+}
+/**
+* The Supabase access token: `source.accessToken`, then
+* `$SUPABASE_ACCESS_TOKEN`.
+*/
+function accessToken(config, env) {
+	return first([["source.accessToken", config.source.accessToken], ["$SUPABASE_ACCESS_TOKEN", env.SUPABASE_ACCESS_TOKEN]]);
+}
+/**
+* A connection string given by the user: `--db-url-stdin`, `source.dbUrl`,
+* `$DATABASE_URL`, then `$SUPABASE_DB_URL`.
+*/
+function databaseUrlCredential(config, env, fromStdin) {
+	return first([
+		["--db-url-stdin", fromStdin],
+		["source.dbUrl", config.source.dbUrl],
+		["$DATABASE_URL", env.DATABASE_URL],
+		["$SUPABASE_DB_URL", env.SUPABASE_DB_URL]
+	]);
+}
+//#endregion
+//#region src/cli/config.ts
+const CONFIG_FILES = [
+	"better-supabase.config.ts",
+	"better-supabase.config.mts",
+	"better-supabase.config.js",
+	"better-supabase.config.mjs",
+	"better-supabase.config.json"
+];
+function configIn(dir) {
+	for (const name of CONFIG_FILES) {
+		const path = join(dir, name);
+		if (existsSync(path)) return path;
+	}
+}
+function findConfig(cwd, explicit) {
+	if (explicit) return resolve(cwd, explicit);
+	return configIn(cwd);
+}
+/**
+* `--config`, else the first `better-supabase.config.*` at or above `cwd`,
+* within the same `.git` boundary as the Supabase project search.
+*/
+function discoverConfig(cwd, explicit) {
+	if (explicit) return resolve(cwd, explicit);
+	const dir = findUp(cwd, (candidate) => configIn(candidate) !== void 0);
+	return dir === void 0 ? void 0 : configIn(dir);
+}
+/** The named export, then `default`, of a project module. */
+async function importExport(path, name) {
+	if (!existsSync(path)) throw new CliError("not_found", `Module not found: ${path}`);
+	const loaded = await importFresh(path);
+	return loaded[name] ?? loaded["default"];
+}
+function isConfig(value) {
+	return configIssues(value).length === 0;
+}
+const isPlainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* Objects merge key by key; arrays and every other value replace what `base`
+* had.
+*/
+function mergeConfig(base, override) {
+	const merged = { ...base };
+	for (const [key, value] of Object.entries(override)) {
+		if (value === void 0) continue;
+		const current = merged[key];
+		merged[key] = isPlainObject(current) && isPlainObject(value) ? mergeConfig(current, value) : value;
+	}
+	return merged;
+}
+/**
+* The config with the `environment` blocks merged in: `$env.<name>`, then the
+* `$development`, `$production`, `$test` or `$ci` shorthand. Every `$` key is
+* dropped from the result.
+*/
+function applyEnvironment(config, environment) {
+	const { $schema: _schema, $env, $development, $production, $test, $ci, ...base } = config;
+	if (environment === void 0) return base;
+	const shorthand = (/* @__PURE__ */ new Map([
+		["development", $development],
+		["production", $production],
+		["test", $test],
+		["ci", $ci]
+	])).get(environment);
+	let merged = { ...base };
+	for (const block of [$env?.[environment], shorthand]) if (block) merged = mergeConfig(merged, block);
+	if (!isConfig(merged)) throw new CliError("config_invalid", `The ${environment} environment makes the config invalid:\n${configIssues(merged).map((issue) => `  ${issue}`).join("\n")}`);
+	return merged;
+}
+function defaultConfig(cwd, explicit, environment, path = discoverConfig(cwd, explicit)) {
+	const resolved = resolveConfig({}, !path || explicit ? cwd : dirname(path));
+	return environment === void 0 ? resolved : {
+		...resolved,
+		environment
+	};
+}
+/**
+* Loads `better-supabase.config.*` with c12 and checks it against the config
+* schema. c12 imports `.ts` natively (Node 24 strips the types), so no loader
+* is needed; rc files, `package.json`, env overrides and `extends` are off so
+* the one file is the whole config. `environment` merges its blocks in
+* (`applyEnvironment`); c12's own `envName` is off because it concatenates
+* arrays. A discovered file sets the project root to its own directory;
+* `--config` keeps `cwd` as the root. `path` is the file `discoverConfig`
+* found, for callers that already looked it up.
+*/
+async function loadConfig(cwd, explicit, environment, path = discoverConfig(cwd, explicit)) {
+	const withEnvironment = (resolved) => environment === void 0 ? resolved : {
+		...resolved,
+		environment
+	};
+	if (!path) return withEnvironment(resolveConfig({}, cwd));
+	if (!existsSync(path)) throw new CliError("config_not_found", `Config file not found: ${path}`);
+	const { config } = await loadConfig$1({
+		cwd,
+		configFile: path,
+		rcFile: false,
+		globalRc: false,
+		packageJson: false,
+		dotenv: false,
+		envName: false,
+		extend: false,
+		giget: false
+	});
+	if (!isConfig(config)) {
+		const issues = configIssues(config);
+		throw new CliError("config_invalid", `${display(cwd, path)} is not a valid config:\n${issues.map((issue) => `  ${issue}`).join("\n")}`, { issues });
+	}
+	return withEnvironment(resolveConfig(applyEnvironment(config, environment), explicit ? cwd : dirname(path)));
+}
+/** `[db] port` or `[api] port` from `supabase/config.toml`. */
+async function readSupabasePort(root, section) {
+	const toml = await readSupabaseToml(root);
+	return toml ? tomlNumber(toml.document, [section, "port"]) : void 0;
+}
+/** The connection string piped in for `--db-url-stdin`, when it was passed. */
+async function stdinDatabaseUrl(enabled, io) {
+	if (enabled !== true) return;
+	const url = (await readStdin(io, "--db-url-stdin")).trim();
+	if (!url) throw new CliError("missing_value", "--db-url-stdin read nothing from stdin. Pipe the connection string: printf %s \"$URL\" | better-supabase <command> --db-url-stdin", { flag: "--db-url-stdin" });
+	return url;
+}
+/**
+* Connection string: stdin, config, `$DATABASE_URL`, `$SUPABASE_DB_URL`, then
+* the local stack: the `[db] port` in `config.toml`, else the running stack's
+* `DB_URL`. With neither it fails with `not_found` rather than guess a port.
+*/
+async function databaseUrl(config, env, fromStdin, stack = env.BSB_STACK) {
+	const given = databaseUrlCredential(config, env, fromStdin);
+	if (given) return given.value;
+	if (stack !== void 0 && stack !== "") return namedStackUrl(config.root, stack, env);
+	let resolved = localUrls.get(config);
+	if (!resolved) {
+		resolved = localDatabaseUrl(config.root, env);
+		localUrls.set(config, resolved);
+	}
+	return resolved;
+}
+/**
+* The database of `supabase/stacks/<name>/config.toml`, a stack kept for one
+* purpose such as tests or a demo.
+*/
+async function namedStackUrl(root, name, env) {
+	if (!/^[a-z0-9][a-z0-9_-]*$/u.test(name)) throw new CliError("invalid_value", `--stack "${name}" must be lowercase letters, digits, dashes or underscores.`, { flag: "--stack" });
+	const toml = await readSupabaseToml(root);
+	const file = toml ? join(dirname(resolve(root, toml.path)), "stacks", name, "config.toml") : void 0;
+	const db = file !== void 0 && existsSync(file) ? parse$1(await readFile(file, "utf-8"))["db"] : void 0;
+	const port = typeof db === "object" && db !== null && "port" in db && typeof db.port === "number" ? db.port : void 0;
+	if (port !== void 0) return `postgresql://postgres:postgres@127.0.0.1:${port}/postgres`;
+	return statusDatabaseUrl(root, env, name, `supabase/stacks/${name}/config.toml sets no [db] port`);
+}
+/** One lookup per loaded config, so a run asks `supabase status` at most once. */
+const localUrls = /* @__PURE__ */ new WeakMap();
+async function localDatabaseUrl(root, env) {
+	const port = await readSupabasePort(root, "db");
+	if (port !== void 0) return `postgresql://postgres:postgres@127.0.0.1:${port}/postgres`;
+	return statusDatabaseUrl(root, env, void 0, await readSupabaseToml(root) ? "supabase/config.toml sets no [db] port" : "there is no supabase/config.toml");
+}
+/** The running stack's `DB_URL`, or `not_found` naming both places it looked. */
+async function statusDatabaseUrl(root, env, stack, noPort) {
+	let failure;
+	try {
+		const status = await readStackStatus(root, env, stack === void 0 ? {} : { stack });
+		const url = status.ok ? status.status["DB_URL"] : void 0;
+		if (typeof url === "string" && url.length > 0) return url;
+		failure = status.ok ? "printed no DB_URL" : `failed (exit ${String(status.code)})`;
+	} catch (error) {
+		if (error instanceof CliError && error.code === "supabase_cli_missing") failure = "could not run";
+		else if (error instanceof CliError) failure = `failed: ${error.message}`;
+		else throw error;
+	}
+	const command = stack === void 0 ? "supabase status" : `supabase status --stack ${stack}`;
+	throw new CliError("not_found", `No database to connect to: ${noPort}, and \`${command}\` ${failure}. Start the stack, set [db] port, or pass $DATABASE_URL or --db-url-stdin.`, {
+		suggestion: stack === void 0 ? "supabase start" : `supabase start --stack ${stack}`,
+		...stack === void 0 ? {} : { flag: "--stack" }
+	});
+}
+//#endregion
+export { findConfig as a, readSupabasePort as c, discoverConfig as i, stdinDatabaseUrl as l, databaseUrl as n, importExport as o, defaultConfig as r, loadConfig as s, applyEnvironment as t, accessToken as u };