better-supabase 0.5.0 → 0.6.0

package/dist/cli/{keys-ByKHnvP9.js → keys-BGCnnb-s.js}

@@ -1,5 +1,6 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { t as display } from "./io-k41_z-jT.js";
+import { t as display } from "./io-DI1mTdSA.js";
+import { f as supabaseDir } from "./supabase-toml-B-bIukQF.js";
 import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { chmod, mkdir, readFile, writeFile } from "node:fs/promises";
@@ -39,7 +40,8 @@ async function createSigningKey() {
 	};
 }
 async function runKeys(config, args) {
-	const out = args.out ?? "supabase/signing_keys.json";
+	const dir = supabaseDir(config.root);
+	const out = args.out ?? `${dir}/signing_keys.json`;
 	const path = resolve(config.root, out);
 	const rotate = args.rotate === true;
 	const exists = existsSync(path);
@@ -57,12 +59,12 @@ async function runKeys(config, args) {
 	await writeFile(path, `${JSON.stringify([key, ...previous], null, 2)}\n`, { mode: 384 });
 	await chmod(path, 384);
 	const lines = [`Wrote ${display(config.root, out)} with key ${key.kid}${previous.length > 0 ? ` (${previous.length} older key${previous.length === 1 ? "" : "s"} kept for verification)` : ""}.`];
-	const toml = resolve(config.root, "supabase/config.toml");
+	const toml = resolve(config.root, dir, "config.toml");
 	if (!(existsSync(toml) && /^\s*signing_keys_path\s*=/m.test(await readFile(toml, "utf8")))) {
-		const relativeToSupabase = out.startsWith("supabase/") ? `./${out.slice(9)}` : out;
-		lines.push("", "Add it to supabase/config.toml and restart the stack:", "  [auth]", `  signing_keys_path = "${relativeToSupabase}"`);
+		const relativeToSupabase = out.startsWith(`${dir}/`) ? `./${out.slice(dir.length + 1)}` : out;
+		lines.push("", `Add it to ${dir}/config.toml and restart the stack:`, "  [auth]", `  signing_keys_path = "${relativeToSupabase}"`);
 	}
-	const gitignored = [resolve(config.root, ".gitignore"), resolve(config.root, "supabase/.gitignore")];
+	const gitignored = [resolve(config.root, ".gitignore"), resolve(config.root, dir, ".gitignore")];
 	let ignored = false;
 	for (const file of gitignored) if (existsSync(file) && (await readFile(file, "utf8")).includes("signing_keys")) ignored = true;
 	if (!ignored) lines.push("", `Warning: add ${out} to .gitignore; it holds a private key.`);

package/dist/cli/{ohash-D7bG_EOb.js → ohash-BjQY1cBb.js}

@@ -1,5 +1,5 @@
 import { createHash } from "node:crypto";
-//#region ../../node_modules/.pnpm/c12@4.0.0-rc.2_dotenv@17.4.2_jiti@2.7.0_magicast@0.5.5/node_modules/c12/dist/_chunks/libs/ohash.mjs
+//#region ../../node_modules/.pnpm/c12@4.0.0-rc.2_dotenv@17.4.2_giget@3.3.1_jiti@2.7.0_magicast@0.5.5/node_modules/c12/dist/_chunks/libs/ohash.mjs
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
 	let target = {};

package/dist/cli/{openapi-Cp5Fyta-.js → openapi-BlRJ18s3.js}

@@ -1,6 +1,6 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { r as importExport } from "./config-CPVpXP5I.js";
+import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
+import { i as importExport } from "./config-NiPxAmUF.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";

package/dist/cli/{project-B_GeXyHh.js → project-DZRaBaY7.js}

@@ -1,3 +1,4 @@
+import { a as findSupabaseRoot } from "./supabase-toml-B-bIukQF.js";
 import { join } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
@@ -46,16 +47,20 @@ async function detectProject(root) {
 		dependencies,
 		srcDir: existsSync(join(root, "src")) ? "src" : ".",
 		tsExtensions: options["allowImportingTsExtensions"] === true || options["rewriteRelativeImportExtensions"] === true,
-		hasSupabase: existsSync(join(root, "supabase", "config.toml"))
+		hasSupabase: findSupabaseRoot(root) !== void 0
 	};
 }
-function installCommand(manager, packages, dev = false) {
+function installCommand(manager, packages, dev = false, target) {
 	const list = packages.join(" ");
 	switch (manager) {
-		case "pnpm": return `pnpm add ${dev ? "-D " : ""}${list}`;
-		case "bun": return `bun add ${dev ? "-d " : ""}${list}`;
-		case "yarn": return `yarn add ${dev ? "-D " : ""}${list}`;
-		case "npm": return `npm install ${dev ? "-D " : ""}${list}`;
+		case "pnpm": return `pnpm ${target ? `--filter ${target.name ?? `./${target.dir}`} ` : ""}add ${dev ? "-D " : ""}${list}`;
+		case "bun": return `bun add ${dev ? "-d " : ""}${list}${target ? ` --cwd ${target.dir}` : ""}`;
+		case "yarn": {
+			const command = `add ${dev ? "-D " : ""}${list}`;
+			if (!target) return `yarn ${command}`;
+			return target.name ? `yarn workspace ${target.name} ${command}` : `cd ${target.dir} && yarn ${command}`;
+		}
+		case "npm": return `npm install ${dev ? "-D " : ""}${list}${target ? ` -w ${target.dir}` : ""}`;
 		default: return manager;
 	}
 }

package/dist/cli/read-sets-CETOSFx4.js

@@ -0,0 +1,223 @@
+import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
+import { resolve } from "node:path";
+import { MODULE_ID_TYPES, compileReadSets, moduleIdType, scopeProblems, templateFunctions } from "better-supabase/sql";
+import { isReadSet } from "better-supabase";
+//#region src/cli/authorization.ts
+/** How findings name the provider. */
+const providerLabel = (provider) => `the authorization provider (${provider.name})`;
+/**
+* The provider's tenant scope and its id type. A scope missing from
+* `scopes`, or without an id type this release renders, is invalid rather
+* than a guess.
+*/
+function tenantScope(provider, subject) {
+	const scope = provider.tenantScope;
+	const entry = provider.scopes.find((candidate) => candidate.name === scope);
+	const label = providerLabel(provider);
+	const problems = scopeProblems(provider);
+	if (problems.length > 0) return {
+		kind: "invalid",
+		problem: `The scopes of ${label} are inconsistent: ${problems.join("; ")}.`
+	};
+	if (!entry) return {
+		kind: "invalid",
+		problem: `authorization.tenantScope is "${scope}", but ${label} has the scopes ${provider.scopes.map((candidate) => candidate.name).join(", ") || "none"}.`
+	};
+	if (entry.idType === void 0) return {
+		kind: "invalid",
+		problem: `${label} gives scope "${scope}" no idType, so ${subject} can't tell its id type.`
+	};
+	const idType = moduleIdType(entry.idType);
+	if (idType === void 0) return {
+		kind: "invalid",
+		problem: `${label} gives scope "${scope}" the type ${entry.idType}, but ${subject} renders only ${MODULE_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
+	};
+	return {
+		kind: "ok",
+		scope,
+		idType
+	};
+}
+/** The provider's membership tables that can hold rows of `scope`. */
+const scopeMemberships = (provider, scope) => (provider.memberships ?? []).filter((source) => !("value" in source.scope) || source.scope.value === scope);
+/**
+* Provider mode when `entitlements.memberships` resolves to `"provider"`
+* (the default with `authorization`). The provider needs `memberIds` and
+* `memberIdsFor`, so the module never falls back to `tenant` on its own.
+*/
+function entitlementsMode(config) {
+	if (config.entitlements.memberships === "tenant") return { kind: "tenant" };
+	const provider = config.authorization;
+	if (!provider) return {
+		kind: "invalid",
+		problem: "entitlements.memberships is \"provider\", but the config has no authorization. Set authorization, or set entitlements.memberships to \"tenant\"."
+	};
+	const chosen = tenantScope(provider, "the entitlements module");
+	if (chosen.kind === "invalid") return chosen;
+	const { memberIds, memberIdsFor } = provider.functions;
+	if (memberIds === void 0 || memberIdsFor === void 0) return {
+		kind: "invalid",
+		problem: `${providerLabel(provider)} has no authorization.functions.${memberIds === void 0 ? "memberIds" : "memberIdsFor"}, which the entitlements module calls. Use a provider that sets both, or set entitlements.memberships to "tenant" to keep the tenant module's memberships.`
+	};
+	return {
+		kind: "provider",
+		provider: {
+			name: provider.name,
+			scope: chosen.scope,
+			idType: chosen.idType,
+			memberIds,
+			memberIdsFor,
+			memberships: scopeMemberships(provider, chosen.scope)
+		}
+	};
+}
+/**
+* The `provider` access model's functions, from `authorization`. `off` when
+* another model is chosen; without a provider the model is invalid, never a
+* default.
+*/
+function accessProviderMode(config) {
+	const access = config.sql.modules.access;
+	if (access?.model !== "provider") return { kind: "off" };
+	const provider = config.authorization;
+	if (!provider) return {
+		kind: "invalid",
+		problem: "sql.modules.access.model is \"provider\", but the config has no authorization. Set authorization, or choose another sql.modules.access.model."
+	};
+	const chosen = tenantScope(provider, "the provider access model");
+	if (chosen.kind === "invalid") return chosen;
+	const idType = access.idType === void 0 ? void 0 : moduleIdType(access.idType);
+	if (idType !== void 0 && idType !== chosen.idType) return {
+		kind: "invalid",
+		problem: `sql.modules.access.idType is "${access.idType}", but ${providerLabel(provider)} gives scope "${chosen.scope}" the type ${chosen.idType}. Set sql.modules.access.idType to "${chosen.idType}", or remove it.`
+	};
+	const { user, tenant } = provider.suspension ?? {};
+	return {
+		kind: "provider",
+		access: {
+			name: provider.name,
+			scope: chosen.scope,
+			idType: chosen.idType,
+			functions: provider.functions,
+			...user || tenant ? { suspension: {
+				...user ? { user } : {},
+				...tenant ? { tenant } : {}
+			} } : {},
+			...provider.roleSources && provider.roleSources.length > 0 ? { roleSources: provider.roleSources } : {},
+			...provider.approvals?.distinctApprover === true ? { approvals: { distinctApprover: true } } : {}
+		}
+	};
+}
+/**
+* `complete` when the provider marks the key `sqlComplete: true`. A key
+* without the flag is unknown, and so is every key when the provider lists
+* no permissions.
+*/
+function keyStatus(provider, key) {
+	if (!provider.permissions) return "unknown";
+	const entry = provider.permissions.find((permission) => permission.key === key);
+	if (!entry) return "missing";
+	if (entry.sqlComplete === void 0) return "unknown";
+	return entry.sqlComplete ? "complete" : "incomplete";
+}
+const INCOMPLETE_FIX = "Use the provider's own policies for it, or a permission its SQL functions answer for completely.";
+const UNKNOWN_FIX = "Have the provider set sqlComplete on every entry of authorization.permissions.";
+/**
+* Why the provider's SQL functions can't be trusted with `key`, or
+* `undefined` when it is marked `sqlComplete: true`. Unknown and missing
+* keys count as unsafe.
+*/
+function unsafeKey(provider, key) {
+	const status = keyStatus(provider, key);
+	switch (status) {
+		case "complete": return;
+		case "incomplete": return {
+			status,
+			reason: `has conditions ${providerLabel(provider)}'s SQL functions don't check (sqlComplete: false)`,
+			fix: INCOMPLETE_FIX
+		};
+		case "unknown": return {
+			status,
+			reason: provider.permissions ? "has no sqlComplete flag in authorization.permissions, so whether the SQL functions answer for it completely is unknown" : "can't be checked: authorization.permissions is not set, so whether the SQL functions answer for it completely is unknown",
+			fix: UNKNOWN_FIX
+		};
+		case "missing": return {
+			status,
+			reason: "is not in authorization.permissions",
+			fix: UNKNOWN_FIX
+		};
+		default: return status;
+	}
+}
+/**
+* Checks the keys the SQL modules pass to the provider's functions against
+* `authorization.permissions`, with the statuses bucket policies use: only
+* `sqlComplete: true` passes.
+*/
+function moduleKeyProblems(provider, keys) {
+	if (keys.length === 0) return [];
+	if (!provider.permissions) return [{
+		target: "authorization.permissions",
+		message: `The provider access model passes ${keys.length} module permission keys to ${providerLabel(provider)}'s SQL functions, but authorization.permissions is not set, so whether they answer for them completely is unknown. Use a provider that lists its permissions.`
+	}];
+	return keys.flatMap((entry) => {
+		const problem = unsafeKey(provider, entry.key);
+		if (!problem) return [];
+		const fn = entry.scope === "platform" ? "authorization.functions.isPlatform" : "authorization.functions.idsWith";
+		const setting = `sql.modules.${entry.module}.permissions.${entry.action}`;
+		const fix = problem.status === "incomplete" ? `The provider's SQL functions check role and scope, not the key's other conditions, so the module would grant it everywhere in the scope. Set ${setting} to a permission marked sqlComplete: true.` : `${problem.fix} If the provider doesn't define it, set ${setting} to a key it lists.`;
+		return [{
+			target: setting,
+			message: `The ${entry.module} module checks "${entry.key}" (${entry.action}) with ${fn}, but it ${problem.reason}. ${fix}`
+		}];
+	});
+}
+const requirementsOf = (functions, scope, templates) => templates.flatMap(([template, role]) => {
+	const sql = functions[template];
+	return sql === void 0 ? [] : templateFunctions(sql, scope).map((fn) => ({
+		function: fn,
+		template,
+		role
+	}));
+});
+/** The functions the `provider` access model calls, as `authenticated`. */
+const accessRequirements = (access) => requirementsOf(access.functions, access.scope, [["idsWith", "authenticated"], ["isPlatform", "authenticated"]]);
+/**
+* The functions the `entitlements` module calls for the tenant scope:
+* `memberIds` from `has_entitlement` as `authenticated`, and `memberIdsFor`
+* from `feature_claims`, which the access token hook runs as
+* `supabase_auth_admin`.
+*/
+const entitlementRequirements = (provider) => [...templateFunctions(provider.memberIds, provider.scope).map((fn) => ({
+	kind: "member",
+	function: fn,
+	template: "memberIds",
+	caller: "has_entitlement",
+	role: "authenticated"
+})), ...templateFunctions(provider.memberIdsFor, provider.scope).map((fn) => ({
+	kind: "member-for",
+	function: fn,
+	template: "memberIdsFor",
+	caller: "feature_claims",
+	role: "supabase_auth_admin"
+}))];
+//#endregion
+//#region src/cli/read-sets.ts
+/** Every read set exported by the modules in `config.readSets`. */
+async function loadReadSets(config) {
+	const sets = [];
+	for (const entry of config.readSets) {
+		const loaded = await importFresh(resolve(config.root, entry));
+		const found = Object.values(loaded).filter(isReadSet);
+		if (found.length === 0) throw new Error(`${entry} exports no read set (defineReadSet)`);
+		for (const set of found) if (!sets.includes(set)) sets.push(set);
+	}
+	return sets;
+}
+/** The compiled functions for `config.readSets`; empty when none are configured. */
+async function compiledReadSets(config) {
+	if (config.readSets.length === 0) return [];
+	return compileReadSets(await loadReadSets(config));
+}
+//#endregion
+export { entitlementsMode as a, unsafeKey as c, entitlementRequirements as i, accessProviderMode as n, moduleKeyProblems as o, accessRequirements as r, providerLabel as s, compiledReadSets as t };

package/dist/cli/{run-BKR2W_79.js → run-DNWxHynX.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { t as VERSION } from "./version-hr88OZG0.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -11,7 +11,7 @@ const ARRAY_FLAGS = /* @__PURE__ */ new Set([
 	"only",
 	"ignore",
 	"agent",
-	"kit",
+	"block",
 	"with",
 	"explain"
 ]);
@@ -134,51 +134,55 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-Saf5-R9T.js").then((m) => m.initCommand),
+		load: () => import("./init-BIIwclPg.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-Saf5-R9T.js").then((m) => m.addCommand),
+		load: () => import("./init-BIIwclPg.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
-		load: () => import("./env-jIFUADLY.js").then((m) => m.envCommand),
+		load: () => import("./env-qXgyMV6r.js").then((m) => m.envCommand),
 		description: "Writes the local stack's URL and keys from `supabase status` to an env file, keeping its other lines"
 	}],
 	["keys", {
-		load: () => import("./keys-ByKHnvP9.js").then((m) => m.keysCommand),
+		load: () => import("./keys-BGCnnb-s.js").then((m) => m.keysCommand),
 		description: "Creates an ES256 signing key for the local stack, so local tokens verify through JWKS like hosted ones"
 	}],
 	["skills", {
-		load: () => import("./skills-LJJIhLFR.js").then((m) => m.skillsCommand),
+		load: () => import("./skills-QQs4q68J.js").then((m) => m.skillsCommand),
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-BJc9vdyu.js").then((m) => m.genCommand),
+		load: () => import("./gen-DAH8FM2W.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect--H7oGmcd.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect-DNUTuNvb.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
-		load: () => import("./openapi-Cp5Fyta-.js").then((m) => m.openapiCommand),
+		load: () => import("./openapi-BlRJ18s3.js").then((m) => m.openapiCommand),
 		description: "Writes the document your createOpenApi() module exports, so CI can check it for drift"
 	}],
 	["seed", {
-		load: () => import("./seed-CUlqWh-8.js").then((m) => m.seedCommand),
+		load: () => import("./seed-DQzqT7LP.js").then((m) => m.seedCommand),
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-L7Z8mYTx.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-B4JOm_ox.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {
-		load: () => import("./sql-DzPbfngx.js").then((m) => m.sqlCommand),
-		description: "Lists, adds, syncs, upgrades and prints SQL kit modules"
+		load: () => import("./sql-D0GUtUPp.js").then((m) => m.sqlCommand),
+		description: "Lists, adds, syncs, upgrades and prints SQL modules"
+	}],
+	["config", {
+		load: () => import("./config-DU7EJImt.js").then((m) => m.configCommand),
+		description: "Prints the resolved config: the file it came from and every option with its default"
 	}],
 	["codemod", {
-		load: () => import("./codemod-DqV7612m.js").then((m) => m.codemodCommand),
+		load: () => import("./codemod-Bl_tQpHn.js").then((m) => m.codemodCommand),
 		description: "Rewrites imports and calls for renamed better-supabase APIs"
 	}]
 ]);
@@ -193,7 +197,7 @@ const ROOT = defineCommand({
 	meta: {
 		name: "better-supabase",
 		version: VERSION,
-		description: "Typed Supabase: codegen, doctor, the SQL kit and project setup"
+		description: "Typed Supabase: codegen, doctor, the SQL modules and project setup"
 	},
 	args: GLOBAL_ARGS,
 	subCommands: () => Object.fromEntries([...COMMANDS].map(([name, entry]) => [name, "command" in entry ? entry.command : defineCommand({ meta: {
@@ -310,21 +314,27 @@ async function run(argv, options = {}) {
 	let context;
 	let command;
 	try {
-		const [loaded, { loadConfig }, { parseEnv }] = await Promise.all([
+		const [loaded, { discoverConfig, loadConfig }, { parseEnv }] = await Promise.all([
 			load(),
-			import("./config-dtoekM0v.js"),
-			import("./env-DmKv_G4A.js")
+			import("./config-B9HkL8nF.js"),
+			import("./env-CJLbUVPB.js")
 		]);
 		command = loaded;
 		const globals = parseArgs$2(rest, GLOBAL_ARGS);
 		const cwd = resolve(options.cwd ?? ".", globals.cwd ?? ".");
 		const env = parseEnv(options.env ?? {});
+		const reloadConfig = () => loadConfig(cwd, globals.config).catch((cause) => {
+			throw cause instanceof CliError ? cause : new CliError("config_invalid", toCliError(cause).message, { cause });
+		});
+		const config = await reloadConfig();
+		const configFile = discoverConfig(cwd, globals.config);
+		const interactive = globals.json !== true && globals.yes !== true && env.CI === void 0;
 		context = {
 			cwd,
-			config: await loadConfig(cwd, globals.config).catch((cause) => {
-				throw cause instanceof CliError ? cause : new CliError("config_invalid", toCliError(cause).message, { cause });
-			}),
-			io: globals.json !== true && globals.yes !== true && env.CI === void 0 ? io : withoutPrompts(io),
+			config,
+			...configFile ? { configFile } : {},
+			reloadConfig,
+			io: interactive ? io : withoutPrompts(io),
 			env,
 			json: globals.json === true,
 			signal: options.signal

package/dist/cli/{seed-CUlqWh-8.js → seed-DQzqT7LP.js}

@@ -1,6 +1,7 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { r as importExport, s as stdinDatabaseUrl, t as databaseUrl } from "./config-CPVpXP5I.js";
+import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
+import { i as importExport, s as stdinDatabaseUrl, t as databaseUrl } from "./config-NiPxAmUF.js";
+import { f as supabaseDir } from "./supabase-toml-B-bIukQF.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
 import { resolve } from "node:path";
@@ -45,7 +46,7 @@ async function runSeed(config, args, env, open = connect, dbUrl) {
 	const contents = `${HEADER} from ${display(config.root, entry)}. Do not edit.\n\n${statements.join("\n\n")}\n`;
 	const path = resolve(config.root, out);
 	const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
-	if (args.check === true) return current === contents ? {
+	if (args.check === true) return sameText(current, contents) ? {
 		code: 0,
 		output: `${display(config.root, out)} is up to date.`
 	} : {
@@ -71,12 +72,13 @@ async function runSeed(config, args, env, open = connect, dbUrl) {
 		}
 		lines.push("Inserted the fixtures (existing rows were kept).");
 	}
-	const toml = resolve(config.root, "supabase/config.toml");
-	const seedPath = out.startsWith("supabase/") ? `./${out.slice(9)}` : out;
+	const dir = supabaseDir(config.root);
+	const toml = resolve(config.root, dir, "config.toml");
+	const seedPath = out.startsWith(`${dir}/`) ? `./${out.slice(dir.length + 1)}` : out;
 	if (existsSync(toml)) {
 		const text = await readFile(toml, "utf8");
 		const folder = seedPath.replace(/[^/]+$/, "");
-		if (!text.includes(seedPath) && !text.includes(`${folder}*`)) lines.push("", "Add it to supabase/config.toml so `supabase db reset` runs it:", "  [db.seed]", `  sql_paths = ["./seed.sql", "${seedPath}"]`);
+		if (!text.includes(seedPath) && !text.includes(`${folder}*`)) lines.push("", `Add it to ${dir}/config.toml so \`supabase db reset\` runs it:`, "  [db.seed]", `  sql_paths = ["./seed.sql", "${seedPath}"]`);
 	}
 	return {
 		code: 0,

package/dist/cli/{skills-LJJIhLFR.js → skills-QQs4q68J.js}

@@ -1,5 +1,5 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
-import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
+import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { dirname, join, resolve } from "node:path";
 import { existsSync } from "node:fs";
@@ -107,7 +107,8 @@ async function runSkills(config, args, env) {
 		const path = resolve(base, relativePath);
 		const shown = global ? `~/${relativePath}` : display(config.root, relativePath);
 		if (check) {
-			if ((existsSync(path) ? await readFile(path, "utf8") : void 0) !== file.contents) stale.push(shown);
+			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
+			if (!sameText(current, file.contents)) stale.push(shown);
 			continue;
 		}
 		lines.push(`${await writeIfChanged(path, file.contents) ? "Wrote" : "Unchanged"} ${shown}`);