better-supabase 0.14.0 → 0.15.0

package/dist/cli/gen-MtijJQ9r.js

@@ -0,0 +1,387 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { i as plain } from "./style-Bm2X5JrN.js";
+import { a as parseNames, i as failedResult, n as CliError } from "./errors-BTe6A15O.js";
+import { u as catalogFingerprint } from "./cache-CXgR_Ahi.js";
+import { a as serializeSnapshot, g as serializeGenerator, h as restrictSchemas, o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-C8MVPyO8.js";
+import { f as dataMigration } from "./module-migration-aPCckev6.js";
+import { d as GEN_TASKS, p as isGenTask } from "./config-9t5ec_N7.js";
+import { c as insideRoot, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
+import { n as runGen } from "./run-CvYVAztY.js";
+import { t as syncModules } from "./sync-btj01bcM.js";
+import { t as addModules } from "./add-DCI5JKjA.js";
+import { n as listModules, t as printModule } from "./print-BeWO7OJY.js";
+import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-DVx9Zgbj.js";
+import { a as runEnv } from "./env-BBl5L8Bf.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-DGVNMSSB.js";
+import { t as runSeed } from "./seed-Cz8PcXeT.js";
+import { t as upgrade } from "./upgrade-B596d4t8.js";
+import { existsSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/commands/sql.ts
+const SYSTEM_DEPS = { now: () => /* @__PURE__ */ new Date() };
+/**
+* Runs one SQL engine step: `args._` is the step name, then its arguments. The
+* commands reach these through `add`, `upgrade`, `blocks` and `gen`.
+*/
+async function runSql(config, args, paint = plain, deps = SYSTEM_DEPS) {
+	const [action, ...names] = args._ ?? [];
+	switch (action) {
+		case "list": return listModules(config, args);
+		case "add": return addModules(config, args, names, deps);
+		case "sync": return syncModules(config, args, paint, deps.now);
+		case "upgrade": return upgrade(config, args, paint, deps.now);
+		case "data": return dataMigration(config, args, deps.now);
+		case "print": return printModule(config, args, names);
+		case void 0: throw new CliError("usage", "Name a subcommand.");
+		default: throw new CliError("usage", `Unknown sql subcommand "${action}".`);
+	}
+}
+//#endregion
+//#region src/cli/commands/gen-pipeline.ts
+/** Tasks run in this order whatever order the config lists them in. */
+const ORDER = new Map(GEN_TASKS.map((task, index) => [task, index]));
+/** Checks `--only` names. Returns an error message for an unknown one. */
+function parseTasks(names) {
+	return parseNames(names, isGenTask, "gen task", GEN_TASKS);
+}
+/**
+* The tasks `gen` runs, in pipeline order: `--only`, then `gen.tasks`, then
+* every task the config sets up.
+*/
+function selectTasks(config, requested) {
+	const named = requested ?? config.gen.tasks;
+	if (named === void 0) return configuredTasks(config);
+	return [...new Set(named)].toSorted((a, b) => (ORDER.get(a) ?? 0) - (ORDER.get(b) ?? 0));
+}
+/** Every task the config sets up. `env` runs only when a task list names it. */
+function configuredTasks(config) {
+	const exists = (path) => existsSync(resolve(config.root, path));
+	const configured = {
+		types: () => true,
+		sql: () => config.blockNames.length > 0 || config.realtime.policies !== void 0,
+		spec: () => exists(config.specs.entry),
+		seed: () => exists(config.seed.entry),
+		env: () => false
+	};
+	return GEN_TASKS.filter((task) => configured[task]());
+}
+/**
+* Files the steps after `types` read, so `gen --watch` reruns them when one
+* changes.
+*/
+function stepInputs(config, tasks) {
+	const at = (path) => resolve(config.root, path);
+	const inputs = {
+		types: () => [],
+		sql: () => [],
+		spec: () => [at(config.specs.entry), ...config.specs.outputs.flatMap((output) => (output.overlays ?? []).map(at))],
+		seed: () => [at(config.seed.entry)],
+		env: () => []
+	};
+	return tasks.flatMap((task) => inputs[task]());
+}
+const STEPS = {
+	sql: ({ config, check, dryRun, paint }) => runSql(config, {
+		_: ["sync"],
+		check,
+		"dry-run": dryRun
+	}, paint),
+	spec: ({ config, check, dryRun }) => runSpec(specOptionsFromConfig(config, check ? "check" : "emit", dryRun === true ? { dryRun } : {})),
+	seed: ({ config, check, dryRun, env }) => runSeed(config, {
+		check,
+		"dry-run": dryRun
+	}, env),
+	env: async ({ config, check, dryRun, env }) => check ? {
+		code: 0,
+		output: "Skipped: env writes local keys, so --check leaves it out."
+	} : runEnv(config, { "dry-run": dryRun }, env)
+};
+/**
+* Runs the steps after `types`, in order. A write run stops at the first
+* failure, since later steps read what earlier ones wrote; `--check` runs every
+* step so it reports everything that is out of date.
+*/
+async function runSteps(tasks, options, previous = []) {
+	const results = [...previous];
+	for (const task of tasks) {
+		if (task === "types") continue;
+		if (!options.check && results.some(({ result }) => result.code !== 0)) break;
+		const result = await STEPS[task](options).catch(failedResult);
+		results.push({
+			task,
+			result
+		});
+	}
+	return results;
+}
+const indent = (text) => text.split("\n").map((line) => line === "" ? line : `  ${line}`).join("\n");
+/**
+* One result for the run. A single task returns its own result unchanged;
+* several tasks get a section each, the first failing exit code and every
+* error.
+*/
+function combineResults(results) {
+	const [only] = results;
+	if (results.length === 1 && only) return only.result;
+	const output = results.flatMap(({ task, result }) => result.output ? [`[${task}]\n${indent(result.output)}`] : [`[${task}] done`]).join("\n");
+	const errors = results.flatMap(({ task, result }) => result.error ? [`[${task}] ${result.error}`] : []);
+	return {
+		code: results.find(({ result }) => result.code !== 0)?.result.code ?? 0,
+		output,
+		...errors.length > 0 ? { error: errors.join("\n") } : {},
+		data: { tasks: Object.fromEntries(results.map(({ task, result }) => [task, {
+			code: result.code,
+			...result.data === void 0 ? {} : { data: result.data }
+		}])) }
+	};
+}
+//#endregion
+//#region src/cli/commands/save-snapshot.ts
+/** The flags `gen --save-snapshot` reads. */
+const SAVE_SNAPSHOT_ARGS = {
+	"save-snapshot": {
+		type: "boolean",
+		description: "Read the database and save the schema as a snapshot file instead of generating"
+	},
+	out: {
+		type: "string",
+		description: "With --save-snapshot: defaults to database.source.snapshot, supabase/snapshot.json, or supabase/generator-metadata.json",
+		valueHint: "file"
+	},
+	kind: {
+		type: "string",
+		description: "With --save-snapshot: snapshot (the default) or generator-metadata (postgrest-typegen's input)",
+		valueHint: "snapshot|generator-metadata"
+	}
+};
+/**
+* Reads the database and writes its schema as a snapshot, or as the
+* GeneratorMetadata document postgrest-typegen reads. `--snapshot` converts a
+* saved file instead.
+*/
+async function saveSnapshot(args, { config, env, io, log, paint, signal }) {
+	const format = args.kind ?? "snapshot";
+	if (format !== "snapshot" && format !== "generator-metadata") throw new CliError("usage", "--kind must be \"snapshot\" or \"generator-metadata\"");
+	const source = await sourceArgs(args, io);
+	const snapshot = await log.progress("Reading the schema", () => loadSnapshot(config, env, {
+		...source,
+		live: true,
+		...signal ? { signal } : {}
+	}));
+	const out = args.out ?? (format === "snapshot" ? config.source.snapshot ?? "supabase/snapshot.json" : "supabase/generator-metadata.json");
+	const contents = format === "snapshot" ? serializeSnapshot(snapshot) : `${await serializeGenerator(restrictSchemas(snapshot.generator, config.schemas))}\n`;
+	const tables = snapshot.extras.tables.length;
+	const plan = {
+		root: config.root,
+		regenerate: "better-supabase gen --save-snapshot",
+		files: [{
+			path: insideRoot(config.root, out, "--out"),
+			contents,
+			note: `${tables} tables`
+		}]
+	};
+	return planResult(plan, await applyPlan(plan, args, paint), { data: { tables } });
+}
+//#endregion
+//#region src/cli/commands/gen.ts
+const ARGS = {
+	metadata: {
+		type: "string",
+		description: "Read a GeneratorMetadata document (- for stdin) and print one file on stdout",
+		valueHint: "path|-"
+	},
+	emit: {
+		type: "string",
+		description: `With --metadata, the file to print: ${EMITS.join(", ")}. Defaults to schema`,
+		valueHint: "file"
+	},
+	"out-dir": {
+		type: "string",
+		description: "With --metadata, write every generated file into this directory instead of printing one",
+		valueHint: "dir"
+	},
+	only: {
+		type: "string",
+		description: `Tasks to run: ${GEN_TASKS.join(", ")}. Defaults to gen.tasks, or every task the config sets up`,
+		valueHint: "list"
+	},
+	check: {
+		type: "boolean",
+		description: "Fail when a generated file is out of date"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Print what would change and write nothing"
+	},
+	force: {
+		type: "boolean",
+		description: "Overwrite a file at a generated path that the CLI did not write"
+	},
+	watch: {
+		type: "boolean",
+		description: "Run again whenever the schema, the config file or a task's input changes"
+	},
+	interval: {
+		type: "string",
+		description: "Milliseconds between checks in --watch. Defaults to gen.watchInterval, then 2000",
+		valueHint: "ms"
+	},
+	...SAVE_SNAPSHOT_ARGS,
+	...SOURCE_ARGS
+};
+/**
+* Reads the schema when it may have changed. Returns the new change marker (the
+* catalog fingerprint, or the snapshot itself when the source has none) and the
+* snapshot, or no snapshot when the fingerprint still matches `last`.
+*/
+async function poll(options, db, last) {
+	const fingerprint = db ? await catalogFingerprint(db.queryable).catch(() => void 0) : void 0;
+	if (fingerprint !== void 0 && fingerprint === last) return { marker: last };
+	const snapshot = await loadSnapshot(options.config, options.env, options, void 0, db ? () => Promise.resolve(db) : void 0);
+	const marker = fingerprint ?? JSON.stringify(snapshot);
+	return marker === last ? { marker } : {
+		marker,
+		snapshot
+	};
+}
+/**
+* Runs `tasks`: `types` through `runGen`, then the steps after it. Without
+* `types` in the list, `snapshot` is unused.
+*/
+async function runTasks(tasks, options) {
+	const types = tasks.includes("types") ? [{
+		task: "types",
+		result: await runGen(options).catch(failedResult)
+	}] : [];
+	return combineResults(await runSteps(tasks, {
+		config: options.config,
+		env: options.env,
+		check: options.check,
+		dryRun: options.dryRun === true,
+		paint: options.paint ?? plain
+	}, types));
+}
+/**
+* Runs the tasks again whenever the schema, the config file or a task's input
+* (the spec entry and its overlays, the seed entry) changes. A database source
+* keeps one connection open and polls the catalog fingerprint, so an unchanged
+* schema costs one small query per interval; a source without a fingerprint is
+* introspected each time and compared. The schema is read only when `types`
+* runs. A changed config file is loaded again and forces a run; a changed input
+* reruns the steps after `types`. A failed run is retried every interval until
+* it succeeds.
+*/
+async function watch(initial, requested, interval, context) {
+	let options = initial;
+	let last = "";
+	let inputs = "";
+	let db;
+	const closeDb = async () => {
+		await db?.close().catch(() => void 0);
+		db = void 0;
+	};
+	const tick = async () => {
+		const tasks = selectTasks(options.config, requested);
+		const current = await stampFiles(stepInputs(options.config, tasks));
+		let polled;
+		if (tasks.includes("types")) try {
+			db ??= snapshotFile(options.config, options) === void 0 ? await openSource(options.config, options.env, options) : void 0;
+			polled = await poll(options, db, last);
+		} catch (cause) {
+			await closeDb();
+			throw cause;
+		}
+		const run = polled?.snapshot ? tasks : current === inputs ? void 0 : tasks.filter((task) => task !== "types");
+		if (!run || run.length === 0) return;
+		const result = await runTasks(run, {
+			...options,
+			...polled?.snapshot ? { snapshot: polled.snapshot } : {}
+		});
+		if (result.code === 0) {
+			last = polled?.marker ?? last;
+			inputs = current;
+		}
+		return result;
+	};
+	try {
+		return await watchLoop({
+			interval,
+			context,
+			reload: async (config) => {
+				options = {
+					...options,
+					config
+				};
+				last = "";
+				inputs = "";
+				await closeDb();
+			},
+			tick
+		});
+	} finally {
+		await closeDb();
+	}
+}
+const genCommand = defineCliCommand({
+	meta: commandMeta("gen"),
+	args: ARGS,
+	lists: ["only"],
+	completions: { only: () => GEN_TASKS },
+	run: async (args, context) => {
+		if (args["save-snapshot"] === true) {
+			const generating = [
+				["--metadata", args.metadata],
+				["--emit", args.emit],
+				["--out-dir", args["out-dir"]],
+				["--only", args.only],
+				["--watch", args.watch],
+				["--force", args.force]
+			].find(([, value]) => value !== void 0 && value !== false);
+			if (generating !== void 0) throw new CliError("usage", `--save-snapshot writes a snapshot and generates nothing, so it takes no ${String(generating[0])}.`);
+			return saveSnapshot(args, context);
+		}
+		if ((args.out ?? args.kind) !== void 0) throw new CliError("usage", `--${args.out === void 0 ? "kind" : "out"} works with --save-snapshot.`);
+		checkMetadataFlags({
+			...args.metadata === void 0 ? {} : { metadata: args.metadata },
+			...args.emit === void 0 ? {} : { emit: args.emit },
+			...args["out-dir"] === void 0 ? {} : { out: args["out-dir"] },
+			check: args.check === true,
+			json: context.json,
+			conflicting: [...args.watch === true ? ["--watch"] : [], ...sourceFlags(args)]
+		});
+		if (args.metadata !== void 0) return runMetadataGen({
+			config: context.config,
+			env: context.env,
+			cwd: context.cwd,
+			io: context.io,
+			log: context.log,
+			metadata: args.metadata,
+			check: args.check === true,
+			paint: context.paint,
+			...args.emit === void 0 ? {} : { emit: args.emit },
+			...args["out-dir"] === void 0 ? {} : { out: args["out-dir"] }
+		});
+		const requested = args.only === void 0 ? void 0 : parseTasks(list(args.only));
+		if (typeof requested === "string") throw new CliError("usage", requested);
+		const tasks = selectTasks(context.config, requested);
+		if (tasks.length === 0) throw new CliError("usage", "--only names no task.");
+		const options = {
+			config: context.config,
+			...context.configFile ? { configFile: context.configFile } : {},
+			env: context.env,
+			check: args.check === true,
+			dryRun: args["dry-run"] === true,
+			force: args.force === true,
+			paint: context.paint,
+			...await sourceArgs(args, context.io),
+			...context.signal ? { signal: context.signal } : {},
+			cache: true
+		};
+		const interval = parseInterval(args.interval, context.config.gen.watchInterval);
+		if (typeof interval === "string") throw new CliError("usage", interval);
+		return args.watch === true ? watch(options, requested, interval, context) : context.log.progress("Generating from the schema", () => runTasks(tasks, options));
+	}
+});
+//#endregion
+export { genCommand };

package/dist/cli/in-stack-diff-DQTW53Vf.js

@@ -0,0 +1,257 @@
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+import { r as supabaseCli, t as runProcess } from "./exec--Q1ZEWUW.js";
+import { t as connect } from "./db-CQCLx7cx.js";
+import { basename, dirname, join } from "node:path";
+import { mkdtemp, readFile, readdir, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+//#region src/cli/in-stack-diff.ts
+/**
+* Schemas the platform owns. The declarative files may add policies to their
+* tables (`storage.objects`), so those policies are dropped and replayed, but
+* the schemas themselves are kept.
+*/
+const PLATFORM_SCHEMAS = /* @__PURE__ */ new Set([
+	"_analytics",
+	"_realtime",
+	"auth",
+	"cron",
+	"extensions",
+	"graphql",
+	"graphql_public",
+	"information_schema",
+	"net",
+	"pgbouncer",
+	"pgmq",
+	"pgsodium",
+	"pgsodium_masks",
+	"pgtle",
+	"realtime",
+	"repack",
+	"storage",
+	"supabase_functions",
+	"supabase_migrations",
+	"tiger",
+	"tiger_data",
+	"topology",
+	"vault"
+]);
+/** The local stack's superuser; pg-delta skips objects it owns. */
+const ADMIN_ROLE = "supabase_admin";
+/** Why the Supabase CLI could not start its shadow database. */
+const SHADOW_FAILURE = /could not create shared memory segment|No space left on device|shmget|shadow database/i;
+function isShadowFailure(output) {
+	return SHADOW_FAILURE.test(output);
+}
+/**
+* The same database as `supabase_admin`, which may create databases and read
+* every schema.
+*/
+function adminUrl(url) {
+	const parsed = new URL(url);
+	parsed.username = ADMIN_ROLE;
+	return parsed.toString();
+}
+function withDatabase(url, database) {
+	const parsed = new URL(url);
+	parsed.pathname = `/${database}`;
+	return parsed.toString();
+}
+/** The migration versions (`<digits>_name.sql`) the stack has not applied. */
+function pendingMigrations(files, applied) {
+	return files.filter((file) => {
+		const version = /^(\d+)_/.exec(basename(file))?.[1];
+		return version !== void 0 && !applied.has(version);
+	});
+}
+/** The SQL from `supabase db diff --output-format json`, or its text output. */
+function diffSql(stdout) {
+	const start = stdout.indexOf("{");
+	if (start !== -1) try {
+		const parsed = JSON.parse(stdout.slice(start));
+		if (typeof parsed === "object" && parsed !== null && "diff" in parsed && typeof parsed.diff === "string") return parsed.diff;
+	} catch {}
+	return stdout;
+}
+/** The postmaster's `bin` directory, from `ps` lines and its data directory. */
+function postgresBin(psOutput, dataDirectory) {
+	for (const line of psOutput.split("\n")) {
+		const command = line.trim().replace(/^\d+\s+/, "");
+		const executable = command.split(/\s+/)[0];
+		if (executable !== void 0 && basename(executable).includes("postgres") && command.includes(` -D ${dataDirectory}`)) return dirname(executable);
+	}
+}
+const MIGRATION_HEADER = `-- Generated by better-supabase db diff from the running stack with pg-delta.
+-- The SQL compares two databases, so review it before you apply it: check
+-- the order of the statements and drop the ones you didn't mean to change.
+`;
+/** UTC `YYYYMMDDHHMMSS`, the Supabase CLI's migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
+}
+async function queryRows(client, sql) {
+	return (await client.query(sql)).rows;
+}
+async function findPostgresBin(options, client) {
+	const fromEnv = options.env.BSB_PG_BIN;
+	if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+	const [row] = await queryRows(client, "show data_directory");
+	const ps = await (options.run ?? runProcess)("ps", ["-axo", "pid=,command="], options.root, options.env);
+	return row === void 0 ? void 0 : postgresBin(ps.stdout, row.data_directory);
+}
+const tool = (bin, name) => bin === void 0 ? name : join(bin, name);
+async function dropManagedObjects(client, replayedPlatformSchemas) {
+	const schemas = await queryRows(client, String.raw`select nspname from pg_namespace where nspname not like 'pg\_%' and nspname not in (select n.nspname from pg_namespace n join pg_depend d on d.objid = n.oid and d.deptype = 'e')`);
+	for (const { nspname } of schemas) {
+		if (PLATFORM_SCHEMAS.has(nspname)) continue;
+		if (nspname === "public") await client.query(EMPTY_PUBLIC);
+		else await client.query(`drop schema ${quoteIdent(nspname)} cascade`);
+	}
+	for (const schema of replayedPlatformSchemas) {
+		const policies = await client.query("select tablename, policyname from pg_policies where schemaname = $1", [schema]);
+		for (const policy of policies.rows) await client.query(`drop policy ${quoteIdent(policy.policyname)} on ${quoteIdent(schema)}.${quoteIdent(policy.tablename)}`);
+	}
+}
+const quoteIdent = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+/**
+* Empties `public` without dropping it, so its default privileges stay. Objects
+* an extension owns stay too.
+*/
+const EMPTY_PUBLIC = `do $$
+declare r record;
+begin
+  for r in select format('drop %s if exists public.%I cascade',
+      case c.relkind when 'v' then 'view' when 'm' then 'materialized view' when 'S' then 'sequence' when 'f' then 'foreign table' else 'table' end,
+      c.relname) as s
+    from pg_class c join pg_namespace n on n.oid = c.relnamespace
+    where n.nspname = 'public' and c.relkind in ('v', 'm', 'r', 'p', 'f', 'S')
+      and not exists (select 1 from pg_depend d where d.objid = c.oid and d.deptype = 'e')
+    order by case c.relkind when 'v' then 0 when 'm' then 0 when 'S' then 2 else 1 end
+  loop execute r.s; end loop;
+  for r in select format('drop routine if exists %s cascade', p.oid::regprocedure) as s
+    from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+    where n.nspname = 'public'
+      and not exists (select 1 from pg_depend d where d.objid = p.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+  for r in select format('drop type if exists public.%I cascade', t.typname) as s
+    from pg_type t join pg_namespace n on n.oid = t.typnamespace
+    where n.nspname = 'public' and t.typtype in ('e', 'd', 'c')
+      and (t.typtype <> 'c' or (select relkind from pg_class where oid = t.typrelid) = 'c')
+      and not exists (select 1 from pg_depend d where d.objid = t.oid and d.deptype = 'e')
+  loop execute r.s; end loop;
+end $$`;
+/**
+* Applies each file in its own transaction and retries the ones that failed
+* until a round applies nothing, so files that depend on a later file still
+* apply. Returns the files that never applied, with the last error.
+*/
+async function applyInRounds(client, root, files) {
+	let pending = await Promise.all(files.map(async (file) => ({
+		file,
+		sql: await readFile(join(root, file), "utf-8")
+	})));
+	let error;
+	while (pending.length > 0) {
+		const failed = [];
+		for (const script of pending) try {
+			await client.query("begin");
+			await client.query(script.sql);
+			await client.query("commit");
+		} catch (cause) {
+			await client.query("rollback");
+			failed.push(script);
+			error = `${script.file}: ${errorText(cause)}`;
+		}
+		if (failed.length === pending.length) return {
+			failed: failed.map((script) => script.file),
+			...error === void 0 ? {} : { error }
+		};
+		pending = failed;
+	}
+	return { failed: [] };
+}
+/**
+* Diffs the declarative schema against the running stack without a shadow
+* database: copies the stack's database into a temporary one in the same
+* Postgres, replaces the objects the files manage with the files, and lets the
+* CLI's pg-delta diff the stack against the copy. The temporary database is
+* always dropped.
+*/
+async function inStackDiff(options) {
+	const open = options.open ?? connect;
+	const run = options.run ?? runProcess;
+	const supabase = options.supabase ?? supabaseCli;
+	const log = options.log ?? (() => {});
+	const admin = adminUrl(options.url);
+	const temp = `bsb_diff_${Date.now().toString(36)}`;
+	const tempUrl = withDatabase(admin, temp);
+	const main = await open(admin);
+	const scratch = await mkdtemp(join(tmpdir(), "bsb-diff-"));
+	let created = false;
+	try {
+		const applied = new Set((await queryRows(main.client, "select version from supabase_migrations.schema_migrations").catch(() => [])).map((row) => row.version));
+		const behind = pendingMigrations(options.migrations, applied);
+		if (behind.length > 0) throw new CliError("check_failed", `The stack has not applied ${String(behind.length)} migration(s) (${behind.slice(0, 3).join(", ")}${behind.length > 3 ? ", ..." : ""}), so the diff would repeat them. Run supabase migration up, then diff again.`, { suggestion: "supabase migration up" });
+		const bin = await findPostgresBin(options, main.client);
+		const dump = join(scratch, "schema.sql");
+		log("Copying the stack's schema into a temporary database");
+		const dumped = await run(tool(bin, "pg_dump"), [
+			"--schema-only",
+			"--file",
+			dump,
+			admin
+		], options.root, options.env);
+		if (dumped.code !== 0) throw new CliError(dumped.code === 127 ? "dependency_missing" : "failed", dumped.code === 127 ? "db diff --in-stack needs pg_dump and psql from the stack's Postgres. Set BSB_PG_BIN to their directory." : `pg_dump failed: ${dumped.stderr.trim()}`);
+		await main.client.query(`create database ${quoteIdent(temp)} owner postgres`);
+		created = true;
+		if ((await run(tool(bin, "psql"), [
+			"-X",
+			"-q",
+			"-v",
+			"ON_ERROR_STOP=0",
+			"-d",
+			tempUrl,
+			"-f",
+			dump
+		], options.root, options.env)).code === 127) throw new CliError("dependency_missing", "db diff --in-stack needs psql from the stack's Postgres. Set BSB_PG_BIN to its directory.");
+		const copy = await open(tempUrl);
+		try {
+			await copy.client.query("set check_function_bodies = off");
+			const topLevel = new Set(options.files.map((file) => file.slice(options.schemasDir.length + 1).split("/")[0] ?? ""));
+			await dropManagedObjects(copy.client, new Set([...topLevel].filter((schema) => PLATFORM_SCHEMAS.has(schema))));
+			await copy.client.query("set role postgres");
+			log(`Applying ${String(options.files.length)} schema file(s)`);
+			const result = await applyInRounds(copy.client, options.root, options.files);
+			if (result.failed.length > 0) throw new CliError("failed", `${String(result.failed.length)} schema file(s) did not apply. ${result.error ?? ""}`.trim());
+		} finally {
+			await copy.close();
+		}
+		log("Diffing the stack against the schema files with pg-delta");
+		const diff = await supabase([
+			"db",
+			"diff",
+			"--use-pg-delta",
+			"--from",
+			"local",
+			"--to",
+			`${tempUrl}${tempUrl.includes("?") ? "&" : "?"}sslmode=disable`,
+			"--output-format",
+			"json"
+		], options.root, options.env);
+		if (diff.code !== 0) throw new CliError("supabase_cli_failed", `supabase db diff failed: ${(diff.stderr || diff.stdout).trim()}`);
+		return diffSql(diff.stdout).trim();
+	} finally {
+		if (created) await main.client.query(`drop database if exists ${quoteIdent(temp)} with (force)`).catch(() => void 0);
+		await main.close();
+		await rm(scratch, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/** The migration files under `supabase/migrations`, relative to the root. */
+async function migrationFiles(root, supabaseDir) {
+	const dir = join(supabaseDir, "migrations");
+	return (await readdir(join(root, dir)).catch(() => [])).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(dir, name));
+}
+//#endregion
+export { migrationFiles as a, isShadowFailure as i, PLATFORM_SCHEMAS as n, migrationVersion as o, inStackDiff as r, MIGRATION_HEADER as t };