better-supabase 0.13.0 → 0.15.0

package/dist/cli/migration-safety-D7PhzFxm.js

@@ -0,0 +1,928 @@
+import { f as INTEGRATIONS } from "./config-9t5ec_N7.js";
+import { c as splitStatements } from "./shared-LZroULBe.js";
+import { dirname, join, posix } from "node:path";
+import { readdir } from "node:fs/promises";
+import { INTEGRATION_INFO, groupEntries } from "better-supabase/config";
+import { PRESET_CATALOG, PROVIDER_COMMENT } from "better-supabase/preset";
+//#region src/cli/templates.ts
+const join$1 = (...parts) => posix.normalize(posix.join(...parts));
+const libDir = (context) => join$1(context.srcDir, "lib");
+/** `lib/supabase/`: the shared definition, `server.ts` and `client.ts`. */
+const supabaseDir = (context) => join$1(libDir(context), "supabase");
+/** `lib/supabase/index.ts`, imported as `lib/supabase` on both sides. */
+const libEntry = (context) => join$1(supabaseDir(context), "index.ts");
+/**
+* Import path of `lib/supabase/index.ts`: the folder, unless the project keeps
+* `.ts` extensions.
+*/
+function importLib(context, from) {
+	const path = importFrom(context, from, libEntry(context));
+	return context.tsExtensions ? path : path.replace(/^(\.\.?\/.+)\/index$/, "$1");
+}
+/**
+* Relative import from one project file to another, following the project's
+* extension style.
+*/
+function importFrom(context, from, to, keepTs = context.tsExtensions) {
+	let path = posix.relative(posix.dirname(from), to);
+	if (!path.startsWith(".")) path = `./${path}`;
+	return keepTs ? path : path.replace(/\.tsx?$/, "");
+}
+function publicEnv(context) {
+	const read = (prefix, access) => access === "vite" ? {
+		url: `import.meta.env.${prefix}SUPABASE_URL`,
+		key: `import.meta.env.${prefix}SUPABASE_PUBLISHABLE_KEY`
+	} : {
+		url: `process.env.${prefix}SUPABASE_URL!`,
+		key: `process.env.${prefix}SUPABASE_PUBLISHABLE_KEY!`
+	};
+	if (context.frameworks.includes("next")) return read("NEXT_PUBLIC_", "process");
+	if (context.frameworks.includes("expo")) return read("EXPO_PUBLIC_", "process");
+	if (context.frameworks.includes("vite")) return read("VITE_", "vite");
+	return read("", "process");
+}
+const denoJson = (context) => `${JSON.stringify({ imports: {
+	"better-supabase": `npm:better-supabase@^${context.version}`,
+	"better-supabase/": `npm:/better-supabase@^${context.version}/`,
+	"@supabase/supabase-js": "npm:@supabase/supabase-js@^2",
+	zod: "npm:zod@^4"
+} }, null, 2)}\n`;
+const SHARED = "supabase/functions/_shared/supabase.ts";
+function shared(context) {
+	return {
+		path: SHARED,
+		contents: `import { defineSupabase } from 'better-supabase';
+
+import { schema } from '${importFrom(context, SHARED, context.generated, true)}';
+
+export const betterSupabase = defineSupabase(schema);
+`
+	};
+}
+/** `supabase/functions/<name>/server.ts`: the function's `bsb`. */
+function functionServer(name, contents) {
+	return {
+		path: `supabase/functions/${name}/server.ts`,
+		contents: contents("../_shared/supabase.ts")
+	};
+}
+/**
+* Edge Functions import `_shared/supabase.ts`, so they don't need the app
+* definition.
+*/
+const needsLib = (names) => names.length === 0 || names.some((name) => name !== "edge" && name !== "mcp");
+const quote = (text) => `'${text.replaceAll("\\", "\\\\").replaceAll("'", "\\'")}'`;
+/** A JSON value as a one-line TypeScript literal with single quotes. */
+function literal(value) {
+	if (Array.isArray(value)) return `[${value.map(literal).join(", ")}]`;
+	if (typeof value === "object" && value !== null) {
+		const entries = Object.entries(value).map(([name, each]) => `${/^[a-z_$][a-z0-9_$]*$/i.test(name) ? name : quote(name)}: ${literal(each)}`);
+		return entries.length === 0 ? "{}" : `{ ${entries.join(", ")} }`;
+	}
+	return typeof value === "string" ? quote(value) : JSON.stringify(value);
+}
+/**
+* The files `init` writes: the config and, unless `lib` is false, the
+* isomorphic definition.
+*/
+function baseFiles(context, casing, lib = true, integrations = [], workflow = "pg-delta", preset, keys = {}) {
+	const sql = {
+		...workflow === "pg-delta" ? {} : { workflow },
+		...keys.sql
+	};
+	const grouped = groupEntries({
+		...Object.keys(sql).length === 0 ? {} : { sql },
+		...keys.blocks === void 0 ? {} : { blocks: keys.blocks }
+	});
+	const config = {
+		path: "better-supabase.config.ts",
+		contents: `import { defineConfig } from 'better-supabase/config';
+
+export default defineConfig({${preset === void 0 ? "" : `\n  // Expands into blocks and conventions; \`better-supabase config --preset\` shows what it holds.\n  preset: ${literal(preset)},`}
+  gen: { casing: '${casing}', output: '${context.generated}'${keys.contentMapper === true ? ", contentMapper: true" : ""} },${grouped["database"] === void 0 ? "" : `\n  database: ${literal(grouped["database"])},`}${integrations.length > 0 ? `\n  adapters: [${integrations.map((name) => `'${name}'`).join(", ")}],` : ""}${keys.provider === true ? `\n${PROVIDER_COMMENT.join("\n")}` : ""}${grouped["blocks"] === void 0 ? "" : `\n  blocks: ${literal(grouped["blocks"])},`}
+  // \`better-supabase gen\` runs every task this file sets up: types, then
+  // sql, spec and seed when they are configured. Pin the list with
+  // \`tasks: ['types', 'sql', 'spec']\` in \`gen\`.
+  ${keys.migrationSince === void 0 ? "// tooling: { env: { output: '.env.local' }, doctor: { format: 'sarif' } }," : `// Doctor checks the migrations after this one for statements that lock tables.\n  tooling: { doctor: { migrationSafety: { since: ${quote(keys.migrationSince)} } } },`}
+});
+`
+	};
+	if (!lib) return [config];
+	const path = libEntry(context);
+	const generated = importFrom(context, path, context.generated);
+	const expo = context.frameworks.includes("expo");
+	return [config, {
+		path,
+		contents: `import { defineSupabase } from 'better-supabase';
+${expo ? "import { Temporal } from 'temporal-polyfill';\n" : ""}
+import { schema } from '${generated}';
+
+export type { Functions, Models } from '${generated}';
+
+export const betterSupabase = defineSupabase(schema${expo ? ", { temporal: Temporal }" : ""});
+`
+	}];
+}
+const TEMPLATES = {
+	client: {
+		packages: ["@supabase/ssr"],
+		files: (context) => {
+			const path = join$1(supabaseDir(context), "client.ts");
+			const env = publicEnv(context);
+			const blocks = context.blocks === true ? importFrom(context, path, join$1(posix.dirname(context.generated), "blocks.generated.ts")) : void 0;
+			return [{
+				path,
+				contents: `import { createClient } from 'better-supabase/client';
+
+import { betterSupabase } from '${importLib(context, path)}';${blocks === void 0 ? "" : `\n\nimport { blockConfig } from '${blocks}';`}
+
+export const bsb = createClient(betterSupabase, {${blocks === void 0 ? "" : "\n  blocks: blockConfig,"}
+  env: {
+    url: ${env.url},
+    publishableKey: ${env.key},
+  },
+});
+`
+			}];
+		}
+	},
+	next: {
+		packages: [
+			"@supabase/ssr",
+			"@supabase/server",
+			"server-only"
+		],
+		files: (context) => {
+			const server = join$1(supabaseDir(context), "server.ts");
+			const proxy = join$1(context.srcDir, "proxy.ts");
+			return [{
+				path: server,
+				contents: `import 'server-only';
+
+import { createNext } from 'better-supabase/next';
+
+import { betterSupabase } from '${importLib(context, server)}';
+
+export const bsb = createNext(betterSupabase);
+`
+			}, {
+				path: proxy,
+				contents: `import type { NextRequest } from 'next/server';
+
+import { bsb } from '${importFrom(context, proxy, server)}';
+
+export const proxy = (request: NextRequest) => bsb.proxy(request);
+
+export const config = {
+  matcher: ['/((?!_next/static|_next/image|favicon.ico|.*\\\\.(?:svg|png|jpg|webp)$).*)'],
+};
+`
+			}];
+		},
+		next: ["Read the session in Server Components with `const { db } = await bsb.context()`."]
+	},
+	react: {
+		packages: ["@tanstack/react-query"],
+		files: (context) => {
+			const client = join$1(supabaseDir(context), "client.ts");
+			const providers = context.frameworks.includes("next") ? join$1(context.srcDir, "app", "providers.tsx") : join$1(context.srcDir, "providers.tsx");
+			const hooks = join$1(libDir(context), "hooks.ts");
+			return [{
+				path: providers,
+				contents: `${context.frameworks.includes("next") ? "'use client';\n\n" : ""}import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { BetterSupabaseProvider } from 'better-supabase/react';
+import { type ReactNode, useState } from 'react';
+
+import { bsb } from '${importFrom(context, providers, client)}';
+
+export function Providers({ children }: { children: ReactNode }) {
+  const [queryClient] = useState(() => new QueryClient());
+  return (
+    <QueryClientProvider client={queryClient}>
+      <BetterSupabaseProvider client={bsb} queryClient={queryClient}>
+        {children}
+      </BetterSupabaseProvider>
+    </QueryClientProvider>
+  );
+}
+`
+			}, {
+				path: hooks,
+				contents: `import { createHooks } from 'better-supabase/react';
+
+import type { bsb } from '${importFrom(context, hooks, client)}';
+
+export const { useDb, useQueries, useAuth, useSupabase } = createHooks<typeof bsb>();
+`
+			}];
+		},
+		next: ["Wrap your app in <Providers>."]
+	},
+	hono: {
+		packages: ["hono", "@supabase/server"],
+		files: (context) => {
+			const path = join$1(context.srcDir, "server.ts");
+			return [{
+				path,
+				contents: `import { Hono } from 'hono';
+import { type HonoEnv, createHono } from 'better-supabase/hono';
+
+import { betterSupabase, type Functions, type Models } from '${importLib(context, path)}';
+
+export const bsb = createHono(betterSupabase);
+
+const app = new Hono<HonoEnv<Models, Functions, unknown>>()
+  .onError(bsb.onError)
+  .use('/api/*', bsb.middleware())
+  .get('/api/me', (c) => c.json({ kind: c.var.auth.kind }));
+
+export default app;
+`
+			}];
+		}
+	},
+	orpc: {
+		packages: ["@orpc/server", "@supabase/server"],
+		files: (context) => {
+			const path = join$1(context.srcDir, "router.ts");
+			return [{
+				path,
+				contents: `import { os } from '@orpc/server';
+import { createOrpc, type OrpcRequestContext } from 'better-supabase/orpc';
+
+import { betterSupabase } from '${importLib(context, path)}';
+
+export const bsb = createOrpc(betterSupabase);
+
+const base = os.$context<OrpcRequestContext>();
+const authed = base.use(bsb.middleware());
+
+export const router = {
+  me: authed.handler(({ context }) => ({ kind: context.auth.kind })),
+};
+`
+			}];
+		}
+	},
+	edge: {
+		packages: [],
+		files: (context) => [
+			shared(context),
+			functionServer("api", (shared) => `import { createEdge } from 'better-supabase/edge';
+
+import { betterSupabase } from '${shared}';
+
+export const bsb = createEdge(betterSupabase, { cors: true });
+`),
+			{
+				path: "supabase/functions/api/index.ts",
+				contents: `import { bsb } from './server.ts';
+
+Deno.serve(bsb.handler((_request, { auth }) => ({ kind: auth.kind })));
+`
+			},
+			{
+				path: "supabase/functions/api/deno.json",
+				contents: denoJson(context)
+			}
+		],
+		next: ["Serve it locally with `supabase functions serve api`."]
+	},
+	expo: {
+		packages: [
+			"expo-server",
+			"expo-secure-store",
+			"@supabase/supabase-js",
+			"temporal-polyfill"
+		],
+		files: (context) => {
+			const server = join$1(supabaseDir(context), "expo.ts");
+			const native = join$1(supabaseDir(context), "client.native.ts");
+			const middleware = join$1(context.srcDir, "app", "+middleware.ts");
+			const env = publicEnv(context);
+			return [
+				{
+					path: server,
+					contents: `import { createExpo } from 'better-supabase/expo';
+
+import { betterSupabase } from '${importLib(context, server)}';
+
+export const bsb = createExpo(betterSupabase);
+`
+				},
+				{
+					path: native,
+					contents: `import { createClient as createSupabaseClient } from '@supabase/supabase-js';
+import { autoRefreshOnForeground, createNativeClient, secureStorage } from 'better-supabase/client/native';
+import * as SecureStore from 'expo-secure-store';
+import { AppState } from 'react-native';
+
+import { betterSupabase } from '${importLib(context, native)}';
+
+const supabase = createSupabaseClient(${env.url}, ${env.key}, {
+  auth: {
+    storage: secureStorage(SecureStore),
+    autoRefreshToken: true,
+    persistSession: true,
+    detectSessionInUrl: false,
+  },
+});
+
+autoRefreshOnForeground(supabase, AppState);
+
+export const bsb = createNativeClient(betterSupabase, supabase);
+`
+				},
+				{
+					path: middleware,
+					contents: `import { bsb } from '${importFrom(context, middleware, server)}';
+
+export default bsb.middleware();
+`
+				}
+			];
+		},
+		next: ["Load data as the caller with `export const loader = bsb.loader((ctx) => ctx.db.customers.list())`.", "Metro picks `client.native.ts` on iOS and Android and `client.ts` (cookie sessions) on the web."]
+	},
+	mcp: {
+		packages: [],
+		files: (context) => [
+			shared(context),
+			functionServer("mcp", (shared) => `import { createMcp } from 'better-supabase/mcp';
+
+import { betterSupabase } from '${shared}';
+
+export const bsb = createMcp(betterSupabase, {
+  name: 'app',
+  version: '0.1.0',
+  resources: {},
+});
+`),
+			{
+				path: "supabase/functions/mcp/index.ts",
+				contents: `import { bsb } from './server.ts';
+
+Deno.serve(bsb.fetch);
+`
+			},
+			{
+				path: "supabase/functions/mcp/deno.json",
+				contents: denoJson(context)
+			}
+		],
+		next: ["List tables under `resources` to expose them as tools, e.g. `customers: true`.", "Add `[functions.mcp] verify_jwt = false` and `[auth.oauth_server] enabled = true` to `supabase/config.toml`, so MCP clients get the sign-in challenge."]
+	}
+};
+/** The integration and what it requires, dependencies first, without duplicates. */
+function resolveIntegrations(names) {
+	const ordered = [];
+	const visit = (name) => {
+		if (ordered.includes(name)) return;
+		for (const dependency of INTEGRATION_INFO[name].requires) visit(dependency);
+		ordered.push(name);
+	};
+	for (const name of names) visit(name);
+	return ordered;
+}
+function isIntegration(name) {
+	return INTEGRATIONS.includes(name);
+}
+/** Integrations `init` adds for the frameworks it finds. */
+function suggestedIntegrations(frameworks) {
+	const names = [];
+	for (const framework of frameworks) switch (framework) {
+		case "next":
+			names.push("next");
+			break;
+		case "hono":
+			names.push("hono");
+			break;
+		case "orpc":
+			names.push("orpc");
+			break;
+		case "vite":
+			names.push("client");
+			break;
+		case "expo":
+			names.push("expo");
+			break;
+		case "tanstack-query":
+			names.push("react");
+			break;
+		default: throw new TypeError(`Unknown framework ${String(framework)}`);
+	}
+	return resolveIntegrations(names);
+}
+//#endregion
+//#region src/cli/wiring.ts
+/** The config's instances, by the key `blocks.generated.ts` gives them. */
+function configInstances(config) {
+	return Object.entries(config.instances).map(([name, instance]) => ({
+		name,
+		block: instance.block
+	}));
+}
+/** The manifest that installs `block`, a block or one of its SQL modules. */
+function manifestOf(block, catalog = PRESET_CATALOG) {
+	return catalog.manifests.find((manifest) => manifest.name === block) ?? catalog.manifests.find((manifest) => manifest.sql.includes(block));
+}
+/** The env keys, providers, workers, actions and timers `instances` need. */
+function wiringFor(instances, catalog = PRESET_CATALOG) {
+	const env = /* @__PURE__ */ new Map();
+	const providers = [];
+	const workers = /* @__PURE__ */ new Map();
+	const actions = /* @__PURE__ */ new Map();
+	const schedules = /* @__PURE__ */ new Map();
+	for (const instance of instances) {
+		const manifest = manifestOf(instance.block, catalog);
+		if (manifest === void 0) continue;
+		for (const entry of manifest.env ?? []) {
+			const seen = env.get(entry.key);
+			if (seen === void 0) env.set(entry.key, {
+				entry,
+				blocks: [manifest.name]
+			});
+			else {
+				if (!seen.blocks.includes(manifest.name)) seen.blocks.push(manifest.name);
+				if (entry.required !== false && seen.entry.required === false) seen.entry = entry;
+			}
+		}
+		for (const provider of manifest.providers ?? []) providers.push({
+			instance: instance.name,
+			block: manifest.name,
+			provider
+		});
+		for (const worker of manifest.workers ?? []) if (!workers.has(worker.name)) workers.set(worker.name, {
+			...worker,
+			block: manifest.name
+		});
+		for (const action of manifest.actions ?? []) if (!actions.has(action.kind)) actions.set(action.kind, {
+			...action,
+			block: manifest.name
+		});
+		for (const schedule of manifest.schedules ?? []) schedules.set(`${manifest.name}.${schedule.name}`, {
+			...schedule,
+			block: manifest.name
+		});
+	}
+	return {
+		env: [...env.values()].map(({ entry, blocks }) => ({
+			...entry,
+			blocks
+		})),
+		providers,
+		workers: [...workers.values()],
+		actions: [...actions.values()],
+		schedules: [...schedules.values()]
+	};
+}
+const ENV_HEADER = "# better-supabase blocks";
+/**
+* `current` with the keys of `env` it lacks appended, each under its
+* description, or `current` itself when every key is there.
+*/
+function envExampleText(current, env) {
+	const text = current ?? "";
+	const has = (key) => new RegExp(`^\\s*(?:export\\s+)?${key}\\s*=`, "m").test(text);
+	const missing = env.filter((entry) => !has(entry.key));
+	if (missing.length === 0) return text;
+	const lines = missing.flatMap((entry) => [`# ${entry.description}${entry.required === false ? " Optional." : ""} (${entry.blocks.join(", ")})`, `${entry.key}=`]);
+	return `${text.length === 0 ? "" : text.endsWith("\n") ? `${text}\n` : `${text}\n\n`}${text.includes(ENV_HEADER) ? "" : `${ENV_HEADER}\n`}${lines.join("\n")}\n`;
+}
+/** `providers.ts`, next to `blocks.generated.ts`. */
+function providersPath(context) {
+	return join(dirname(context.generated), "providers.ts");
+}
+const PROVIDERS_END = "} satisfies Partial<typeof blocks>;";
+const propertyKey = (name) => /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+const accessor = (name) => /^[A-Za-z_$][\w$]*$/.test(name) ? `blocks.${name}` : `blocks[${JSON.stringify(name)}]`;
+/**
+* The commented stub for one provider. It stays a comment so the app picks the
+* implementation; doctor's BS505 fails while a required one is unwired.
+*/
+function providerStub(entry) {
+	const { provider } = entry;
+	return [
+		`  // ${entry.instance}${provider.required ? " (required)" : ""}: ${provider.description}`,
+		`  // \`${provider.option}\` takes an implementation of ${provider.type} from "${provider.from}".`,
+		`  // ${propertyKey(entry.instance)}: ${accessor(entry.instance)}.with({ ${provider.option}: ${provider.example} }),`
+	];
+}
+const stubbed = (text, entry) => text.includes(`${propertyKey(entry.instance)}: ${accessor(entry.instance)}.with({ ${entry.provider.option}:`);
+/** A new `providers.ts` with a stub for each of `providers`. */
+function providersSource(context, providers) {
+	return [
+		`import { blocks } from "${importFrom(context, providersPath(context), join(dirname(context.generated), "blocks.generated.ts"))}";`,
+		"",
+		"/**",
+		" * The providers the installed blocks take. Spread them over the generated",
+		" * blocks: `defineBlocks(blockConfig, { ...blocks, ...providers })`.",
+		" * `better-supabase add` appends a commented stub for each block that takes",
+		" * one, and doctor (BS505) fails while a required one is still a comment.",
+		" */",
+		"export const providers = {",
+		...providers.flatMap(providerStub),
+		PROVIDERS_END,
+		""
+	].join("\n");
+}
+/** `current` with stubs for the providers it doesn't mention yet. */
+function addProviderStubs(current, providers) {
+	const missing = providers.filter((entry) => !stubbed(current, entry));
+	if (missing.length === 0) return {
+		ok: true,
+		text: current
+	};
+	const end = current.lastIndexOf(PROVIDERS_END);
+	if (end === -1) return {
+		ok: false,
+		reason: `it has no \`${PROVIDERS_END}\``
+	};
+	return {
+		ok: true,
+		text: `${current.slice(0, end)}${missing.flatMap(providerStub).join("\n")}\n${current.slice(end)}`
+	};
+}
+/**
+* The files the wiring writes: `.env.example` with the missing keys, and
+* `providers.ts` with the missing stubs. `read` returns a file's contents
+* relative to the project root, or `undefined`.
+*/
+async function wiringFiles(context, plan, read) {
+	const files = [];
+	const notes = [];
+	if (plan.env.length > 0) {
+		const current = await read(".env.example");
+		const text = envExampleText(current, plan.env);
+		if (text !== (current ?? "")) files.push({
+			path: ".env.example",
+			contents: text,
+			policy: current === void 0 ? "generated" : "edit"
+		});
+	}
+	if (plan.providers.length > 0) {
+		const path = providersPath(context);
+		const current = await read(path);
+		if (current === void 0) files.push({
+			path,
+			contents: providersSource(context, plan.providers),
+			policy: "generated"
+		});
+		else {
+			const edit = addProviderStubs(current, plan.providers);
+			if (!edit.ok) notes.push(`Add the provider stubs to ${path} by hand (${edit.reason}):`, ...plan.providers.flatMap(providerStub));
+			else if (edit.text !== current) files.push({
+				path,
+				contents: edit.text,
+				policy: "edit"
+			});
+		}
+	}
+	return {
+		files,
+		notes
+	};
+}
+/** The numbered steps left after the wiring is written. */
+function wiringChecklist(context, plan, glue) {
+	const steps = [];
+	const required = plan.env.filter((entry) => entry.required !== false);
+	if (required.length > 0) steps.push(`Set ${required.map((entry) => entry.key).join(", ")} in .env.local and in every deployed environment (.env.example lists them).`);
+	if (glue !== void 0) steps.push(`Install the routes: ${glue}`);
+	for (const worker of plan.workers) steps.push(worker.path === void 0 ? `Run the ${worker.name} worker (${worker.block}): ${worker.description}` : `Call ${worker.path} ${worker.schedule === void 0 ? "from a cron" : `on the cron \`${worker.schedule}\``} with \`Authorization: Bearer $CRON_SECRET\` (${worker.block}: ${worker.description})`);
+	if (plan.schedules.length > 0) steps.push(`Schedule the block timers (${plan.schedules.map((entry) => `${entry.block} ${entry.runs} at \`${entry.cron}\``).join(", ")}): call \`jobs.ensureSchedules(blockSchedules(blocks), { prefix: BLOCK_SCHEDULE_PREFIX })\` once and drain the \`block_ticks\` queue with \`blockTickHandler\`.`);
+	if (plan.actions.length > 0) steps.push(`Register the actions in the rules consumer's \`createActionRegistry\`: ${plan.actions.map((entry) => `${entry.kind} (${entry.block})`).join(", ")}.`);
+	const providers = plan.providers.filter((entry) => entry.provider.required);
+	if (providers.length > 0) steps.push(`Fill in the provider for ${providers.map((entry) => entry.instance).join(", ")} in ${providersPath(context)}, and spread \`...providers\` into \`defineBlocks\`.`);
+	return steps.map((step, index) => `  ${index + 1}. ${step}`);
+}
+//#endregion
+//#region src/cli/doctor/migration-safety.ts
+const NAME = String.raw`(?:"[^"]+"|[\w$]+)`;
+const TABLE = String.raw`(${NAME}(?:\s*\.\s*${NAME})?)`;
+const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global\s+|local\s+)?(?:temporary|temp|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${TABLE}`, "iu");
+const ALTER_TABLE = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${TABLE}`, "iu");
+const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${NAME}\s+)?on\s+(?:only\s+)?${TABLE}`, "iu");
+const ADD_CONSTRAINT = /\badd\s+(?:constraint\s+(?:"[^"]+"|[\w$]+)\s+)?(foreign\s+key|check)\b/iu;
+const NOT_VALID = /\bnot\s+valid\b/iu;
+const ALTER_TYPE = /\balter\s+(?:column\s+)?(?:"[^"]+"|[\w$]+)\s+(?:set\s+data\s+)?type\b/iu;
+const SET_NOT_NULL = /\bset\s+not\s+null\b/iu;
+const VALIDATE = /\bvalidate\s+constraint\b/iu;
+const ADD_COLUMN_DEFAULT = /\badd\s+(?:column\s+)?(?:if\s+not\s+exists\s+)?(?:"[^"]+"|[\w$]+)\s[^,]*?\bdefault\s+([^,]+)/giu;
+/**
+* Each `add [column]` clause of an `alter table`, up to the next comma: the
+* column name, then its type and constraints. Table constraints are left out.
+*/
+const ADD_COLUMN = /\badd\s+(?:column\s+)?(?:if\s+not\s+exists\s+)?(?!(?:constraint|primary|unique|foreign|check|exclude)\b)("[^"]+"|[\w$]+)\s([^,]*)/giu;
+const INLINE_CONSTRAINT = /\b(references|check)\b/iu;
+const NOT_NULL = /\bnot\s+null\b/iu;
+const DEFAULT_OR_GENERATED = /\b(?:default|generated)\b/iu;
+const VALIDATE_ONE = String.raw`validate\s+constraint\s+${NAME}`;
+/**
+* A statement that only validates constraints, under a share update exclusive
+* lock.
+*/
+const ONLY_VALIDATES = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${TABLE}\s+${VALIDATE_ONE}(?:\s*,\s*${VALIDATE_ONE})*\s*$`, "iu");
+const VOLATILE = /\b(?:gen_random_uuid|uuid_generate_v[14]|clock_timestamp|timeofday|random|nextval|statement_timestamp)\s*\(/iu;
+const LOCK_TIMEOUT = /^set\s+(?:local\s+)?lock_timeout\b/iu;
+const EXCLUSIVE = /^(?:drop\s+table|truncate|vacuum\s+full|reindex\b(?!.*\bconcurrently\b)|lock\s+table|cluster\b)/iu;
+const DROP = /^drop\s+table\b|\bdrop\s+(?:column\s+)?(?!constraint\b|default\b|not\b|identity\b|expression\b)(?:if\s+exists\s+)?(?:"[^"]+"|[\w$]+)/iu;
+const RENAME = /\brename\s+(?!constraint\b)(?:column\s+)?(?:(?:"[^"]+"|[\w$]+)\s+)?to\b/iu;
+/**
+* `name` without quotes and with `public.` for an unqualified name,
+* lower-cased.
+*/
+function tableKey(name) {
+	const parts = name.split(".").map((part) => part.trim().replaceAll("\"", "").toLowerCase());
+	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
+}
+/** The version a migration file name or a `since` value starts with. */
+function migrationVersion(name) {
+	const base = name.slice(name.lastIndexOf("/") + 1);
+	return base.replace(/\.sql$/u, "").split("_")[0] ?? base;
+}
+/**
+* The newest migration under `<root>/<supabaseDir>/migrations`, which `init`
+* and `adopt` write to `doctor.migrationSafety.since` so the migrations that
+* already ran aren't checked offline.
+*/
+async function latestMigrationVersion(root, supabaseDir = "supabase") {
+	return (await readdir(join(root, supabaseDir, "migrations")).catch(() => [])).filter((name) => name.endsWith(".sql")).map(migrationVersion).toSorted().at(-1);
+}
+const statementsCache = /* @__PURE__ */ new WeakMap();
+function parse(file) {
+	let parsed = statementsCache.get(file);
+	if (parsed === void 0) {
+		const statements = splitStatements(file.text);
+		parsed = {
+			file,
+			statements,
+			created: new Set(statements.flatMap((statement) => {
+				const match = CREATE_TABLE.exec(statement.text);
+				return match?.[1] === void 0 ? [] : [tableKey(match[1])];
+			}))
+		};
+		statementsCache.set(file, parsed);
+	}
+	return parsed;
+}
+const pending = /* @__PURE__ */ new WeakMap();
+/**
+* The migrations to check: with a database, the ones it hasn't applied;
+* offline, the ones after `doctor.migrationSafety.since`, or the newest one
+* without it.
+*/
+function unappliedMigrations(context) {
+	let files = pending.get(context);
+	if (files === void 0) {
+		files = findUnapplied(context);
+		pending.set(context, files);
+	}
+	return files;
+}
+async function findUnapplied(context) {
+	const dir = `${context.configToml?.dir ?? "supabase"}/migrations/`;
+	const migrations = (context.sqlFiles ?? []).filter((file) => file.path.startsWith(dir)).toSorted((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	const db = context.database;
+	if (db !== void 0 && !("skipped" in db)) try {
+		const rows = await db.query("select version from supabase_migrations.schema_migrations");
+		const applied = new Set(rows.map((row) => row.version));
+		return migrations.filter((file) => !applied.has(migrationVersion(file.path)));
+	} catch {}
+	const since = context.config.doctor.migrationSafety?.since;
+	if (since === void 0) return migrations.slice(-1);
+	const after = migrationVersion(since);
+	return migrations.filter((file) => migrationVersion(file.path) > after);
+}
+/** A rule that runs `check` on each statement of the unapplied migrations. */
+function perStatement(check) {
+	return async (context) => (await unappliedMigrations(context)).flatMap((file) => {
+		const parsed = parse(file);
+		return parsed.statements.flatMap((statement) => {
+			const message = check(parsed, statement);
+			return message === void 0 ? [] : [{
+				message: `${file.path}:${String(statement.line)}: ${message}`,
+				target: `${file.path}:${String(statement.line)}`,
+				location: {
+					file: file.path,
+					line: statement.line
+				}
+			}];
+		});
+	});
+}
+/**
+* The table an `alter table` statement changes, unless the same file created
+* it.
+*/
+function alteredTable(parsed, statement) {
+	const match = ALTER_TABLE.exec(statement.text);
+	const table = match?.[1] === void 0 ? void 0 : tableKey(match[1]);
+	return table === void 0 || parsed.created.has(table) ? void 0 : table;
+}
+const indexWithoutConcurrently = (parsed, statement) => {
+	const match = CREATE_INDEX.exec(statement.text);
+	if (match === null || match[1] !== void 0 || match[2] === void 0) return;
+	const table = tableKey(match[2]);
+	return parsed.created.has(table) ? void 0 : `creates an index on ${table} without concurrently, which blocks writes to it until the index is built.`;
+};
+const constraintWithoutNotValid = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	if (table === void 0) return;
+	for (const match of statement.text.matchAll(ADD_COLUMN)) {
+		const inline = INLINE_CONSTRAINT.exec(match[2] ?? "")?.[1]?.toLowerCase();
+		if (inline !== void 0) {
+			const kind = inline === "references" ? "foreign key" : "check";
+			return `adds column ${match[1] ?? ""} to ${table} with an inline ${kind}, which can't be not valid, so Postgres checks every row while it holds the lock. Add the column, then add the ${kind} with not valid.`;
+		}
+	}
+	const kind = ADD_CONSTRAINT.exec(statement.text)?.[1];
+	if (kind === void 0 || NOT_VALID.test(statement.text)) return;
+	return `adds a ${kind.toLowerCase().replace(/\s+/u, " ")} to ${table} without not valid, which scans every row while it holds a lock.`;
+};
+const rewriteOrScan = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	if (table === void 0) return;
+	if (ALTER_TYPE.test(statement.text)) return `changes a column type of ${table}, which can rewrite the table under an access exclusive lock.`;
+	for (const match of statement.text.matchAll(ADD_COLUMN)) {
+		const clause = match[2] ?? "";
+		if (NOT_NULL.test(clause) && !DEFAULT_OR_GENERATED.test(clause)) return `adds column ${match[1] ?? ""} to ${table} as not null without a default, which fails once the table has rows. Add it nullable, fill it with \`better-supabase db backfill\`, then add a not valid check and validate it.`;
+	}
+	const validated = parsed.statements.some((each) => each.line < statement.line && VALIDATE.test(each.text) && alteredTable(parsed, each) === table);
+	return SET_NOT_NULL.test(statement.text) && !validated ? `sets not null on a column of ${table}, which scans every row under an access exclusive lock.` : void 0;
+};
+const volatileDefault = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	if (table === void 0) return;
+	for (const match of statement.text.matchAll(ADD_COLUMN_DEFAULT)) if (VOLATILE.test(match[1] ?? "")) return `adds a column to ${table} with a volatile default (${(match[1] ?? "").trim()}), which rewrites every row.`;
+};
+/** Whether `statement` takes an access exclusive lock on a table others use. */
+function takesExclusiveLock(parsed, statement) {
+	if (EXCLUSIVE.test(statement.text)) return true;
+	if (ONLY_VALIDATES.test(statement.text)) return false;
+	const match = CREATE_INDEX.exec(statement.text);
+	if (match?.[2] !== void 0 && match[1] === void 0) return !parsed.created.has(tableKey(match[2]));
+	return alteredTable(parsed, statement) !== void 0;
+}
+async function missingLockTimeout(context) {
+	return (await unappliedMigrations(context)).flatMap((file) => {
+		const parsed = parse(file);
+		const first = parsed.statements.find((statement) => takesExclusiveLock(parsed, statement));
+		if (first === void 0) return [];
+		return parsed.statements.some((statement) => statement.line <= first.line && LOCK_TIMEOUT.test(statement.text)) ? [] : [{
+			message: `${file.path} locks tables it didn't create (line ${String(first.line)}) without setting lock_timeout, so a long query ahead of it queues every read and write behind the migration.`,
+			target: file.path,
+			location: {
+				file: file.path,
+				line: first.line
+			}
+		}];
+	});
+}
+const dropOrRename = (parsed, statement) => {
+	const isDropTable = /^drop\s+table\b/iu.test(statement.text);
+	const table = alteredTable(parsed, statement);
+	if (isDropTable) return "drops a table; app code that still reads it fails once this runs.";
+	if (table === void 0) return;
+	if (RENAME.test(statement.text)) return `renames ${table} or one of its columns; app code that uses the old name fails once this runs.`;
+	return DROP.test(statement.text) ? `drops a column of ${table}; app code that still reads it fails once this runs.` : void 0;
+};
+const LIBRARY_FUNCTION = String.raw`(?:"better_supabase"|better_supabase)\s*\.\s*("[^"]+"|[\w$]+)\s*\(`;
+const DROP_FUNCTION = /^drop\s+(?:function|procedure)\s+(?:if\s+exists\s+)?/iu;
+const CREATE_FUNCTION = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?(?:function|procedure)\s+${LIBRARY_FUNCTION}`, "iu");
+/** The text between the parenthesis at `open` and its match, or undefined. */
+function parenthesized(text, open) {
+	let depth = 0;
+	let quote;
+	for (let index = open; index < text.length; index += 1) {
+		const char = text.charAt(index);
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+		} else if (char === "'" || char === "\"") quote = char;
+		else if (char === "(") depth += 1;
+		else if (char === ")") {
+			depth -= 1;
+			if (depth === 0) return text.slice(open + 1, index);
+		}
+	}
+}
+/**
+* How many input arguments a function argument list has: the top-level commas,
+* without `out` arguments, which are not part of the signature.
+*/
+function inputArity(args) {
+	const parts = [];
+	let depth = 0;
+	let quote;
+	let start = 0;
+	for (let index = 0; index < args.length; index += 1) {
+		const char = args.charAt(index);
+		if (quote !== void 0) {
+			if (char === quote) quote = void 0;
+		} else if (char === "'" || char === "\"") quote = char;
+		else if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (char === "," && depth === 0) {
+			parts.push(args.slice(start, index));
+			start = index + 1;
+		}
+	}
+	parts.push(args.slice(start));
+	return parts.filter((part) => {
+		const trimmed = part.trim();
+		return trimmed !== "" && !/^out\s/iu.test(trimmed);
+	}).length;
+}
+const functionName = (name) => name.replaceAll("\"", "").toLowerCase();
+/**
+* Each `better_supabase` function a `drop function` statement names, with its
+* arity.
+*/
+function droppedFunctions(text) {
+	const head = DROP_FUNCTION.exec(text);
+	if (head === null) return [];
+	const pattern = new RegExp(LIBRARY_FUNCTION, "giu");
+	const dropped = [];
+	for (const match of text.slice(head[0].length).matchAll(pattern)) {
+		const args = parenthesized(text, head[0].length + match.index + match[0].length - 1);
+		if (match[1] !== void 0 && args !== void 0) dropped.push({
+			name: functionName(match[1]),
+			arity: inputArity(args)
+		});
+	}
+	return dropped;
+}
+const createdSignatures = /* @__PURE__ */ new WeakMap();
+/** `name/arity` for every `better_supabase` function the file creates. */
+function createdFunctions(parsed) {
+	let created = createdSignatures.get(parsed);
+	if (created === void 0) {
+		created = new Set(parsed.statements.flatMap((statement) => {
+			const match = CREATE_FUNCTION.exec(statement.text);
+			if (match?.[1] === void 0) return [];
+			const args = parenthesized(statement.text, match[0].length - 1);
+			return args === void 0 ? [] : [`${functionName(match[1])}/${String(inputArity(args))}`];
+		}));
+		createdSignatures.set(parsed, created);
+	}
+	return created;
+}
+const droppedLibraryFunction = (parsed, statement) => {
+	const created = createdFunctions(parsed);
+	const changed = droppedFunctions(statement.text).filter((each) => !created.has(`${each.name}/${String(each.arity)}`));
+	if (changed.length === 0) return;
+	return `drops ${changed.map((each) => `better_supabase.${each.name}`).join(", ")} without creating it again with the same arguments. A call with positional arguments, or a grant on the old signature, fails once this runs.`;
+};
+const MIGRATION_SAFETY_RULES = [
+	{
+		code: "BS229",
+		severity: "warning",
+		title: "Index created without concurrently",
+		description: "A migration creates an index on an existing table without `concurrently`. The build holds a lock that blocks inserts, updates and deletes on the table until it finishes. Use `create index concurrently`, in a migration file of its own: the statement can't run inside a transaction block.",
+		check: perStatement(indexWithoutConcurrently)
+	},
+	{
+		code: "BS230",
+		severity: "warning",
+		title: "Constraint added without not valid",
+		description: "A migration adds a foreign key or check to an existing table without `not valid`, so Postgres checks every row while it holds the lock. That includes a `references` or `check` written inline in `add column`, which can't be `not valid`. Add the column first, then the constraint with `not valid`, then run `alter table ... validate constraint` in a later statement, which takes a lighter lock (`doctor --fix` does it for a check, BS236).",
+		check: perStatement(constraintWithoutNotValid)
+	},
+	{
+		code: "BS231",
+		severity: "warning",
+		title: "Column type change or set not null",
+		description: "A migration changes a column type or sets `not null` on an existing table, or adds a `not null` column without a default. A type change can rewrite the table, and `set not null` scans every row, both under an access exclusive lock; the new column fails once the table has rows. Add the column nullable and fill it with `better-supabase db backfill`. For `not null`, add `check (column is not null) not valid`, validate it, then set not null. For a type, add a new column and backfill it.",
+		check: perStatement(rewriteOrScan)
+	},
+	{
+		code: "BS232",
+		severity: "warning",
+		title: "Column added with a volatile default",
+		description: "A migration adds a column with a volatile default, such as `gen_random_uuid()` or `clock_timestamp()`, to an existing table. Postgres writes the value into every row under an access exclusive lock. Add the column without a default, backfill it in batches, then set the default.",
+		check: perStatement(volatileDefault)
+	},
+	{
+		code: "BS233",
+		severity: "warning",
+		title: "Migration without lock_timeout",
+		description: "A migration takes an access exclusive lock on an existing table without `set lock_timeout`. While it waits behind a long query, every read and write of the table queues behind it. Start the file with `set lock_timeout = '5s';` and retry the migration when it times out. A statement that only runs `validate constraint` takes a lighter lock and doesn't count.",
+		check: missingLockTimeout
+	},
+	{
+		code: "BS234",
+		severity: "info",
+		title: "Migration drops or renames",
+		description: `A migration drops or renames a table or column. App code deployed before it still uses the old name and fails once it runs. Expand and contract: add the new shape, deploy app code that uses it, then remove the old one in a later migration.`,
+		check: perStatement(dropOrRename)
+	},
+	{
+		code: "BS235",
+		severity: "warning",
+		title: "Migration drops a better-supabase function",
+		description: "A migration drops a `better_supabase` function and doesn't create it again with the same number of arguments. A schema diff does this when a better-supabase release changes a function's signature, such as `audit()` in 0.12. Calls with positional arguments and grants on the old signature fail once it runs. Read the upgrade notes for the release (/docs/migration), then update your calls and grants in the same migration.",
+		check: perStatement(droppedLibraryFunction)
+	}
+];
+//#endregion
+export { wiringFiles as a, baseFiles as c, libEntry as d, needsLib as f, wiringChecklist as i, importFrom as l, suggestedIntegrations as m, latestMigrationVersion as n, wiringFor as o, resolveIntegrations as p, configInstances as r, TEMPLATES as s, MIGRATION_SAFETY_RULES as t, isIntegration as u };