better-supabase 0.5.0 → 0.6.0

package/dist/cli/sql-D0GUtUPp.js

@@ -0,0 +1,536 @@
+import { r as defineCliCommand } from "./command-CK14fP91.js";
+import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
+import { i as plain, r as painter } from "./style-C0NFdJRL.js";
+import { a as entitlementsMode, n as accessProviderMode, o as moduleKeyProblems, s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
+import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
+import { c as migrationCommand, d as schemaPaths, n as declarativeSchemasDir, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { t as fileDiff } from "./diff-SjkO5rNr.js";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, readdir, rm } from "node:fs/promises";
+import { SQL_MODULES, adoptedColumnProblems, auditRegistrations, contractSignature, customContracts, declaredTables, extensionSchema, moduleBody, moduleFilePaths, moduleFileVersion, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, policyGrants, renderModules, resolveModules, sameModuleFile, upgradePlan } from "better-supabase/sql";
+//#region src/cli/topic-policies.ts
+const isTopic = (value) => typeof value === "object" && value !== null && "template" in value && typeof value.template === "string" && "sql" in value && typeof value.sql === "function" && "triggerSql" in value;
+const literalParts = (template) => template.replaceAll(/\{[^}]+\}/g, "{}");
+const owns = (owned, template) => owned.endsWith("*") ? template.startsWith(owned.slice(0, -1)) : literalParts(owned) === literalParts(template);
+const receivesOnly = (sql) => !sql.includes(" for insert ") && !sql.includes("'presence'");
+/** The file `realtime.policies` writes, or `undefined` when it isn't set. */
+async function topicPolicyFile(config, owned = []) {
+	const policies = config.realtime.policies;
+	if (policies === void 0) return void 0;
+	const topics = [];
+	for (const entry of policies.from) {
+		const loaded = await importFresh(resolve(config.root, entry));
+		const found = Object.values(loaded).filter(isTopic);
+		if (found.length === 0) throw new Error(`${entry} exports no topic (defineTopic)`);
+		for (const topic of found) if (!topics.includes(topic)) topics.push(topic);
+	}
+	topics.sort((a, b) => a.template < b.template ? -1 : a.template > b.template ? 1 : 0);
+	const functions = config.authorization?.functions;
+	const sqlOf = (topic) => topic.sql(functions === void 0 ? void 0 : { functions });
+	const skipped = [];
+	const written = topics.filter((topic) => {
+		const owner = owned.find((entry) => owns(entry.topic, topic.template));
+		if (owner === void 0 || !receivesOnly(sqlOf(topic))) return true;
+		skipped.push(`-- Skipped topic ${topic.template}: the ${owner.module} module writes its receive policy.`);
+		return false;
+	});
+	const header = [
+		"-- better-supabase: realtime topic policies",
+		`-- Written by \`better-supabase sql sync\` from ${policies.from.join(", ")}; edit the topics, not this file.`,
+		...skipped
+	].join("\n");
+	return {
+		path: policies.output,
+		contents: `${header}\n\n${written.map(sqlOf).join("\n")}`
+	};
+}
+//#endregion
+//#region src/cli/commands/sql.ts
+const SQL_ARGS = {
+	action: {
+		type: "positional",
+		required: false,
+		description: "list (modules and whether they are installed), add <module...>, sync, upgrade, data (a migration with the rows a schema diff skips) or print <module>"
+	},
+	check: {
+		type: "boolean",
+		description: "With sync: fail when a file is stale. With upgrade: fail when a module is behind"
+	},
+	"tests-dir": {
+		type: "string",
+		description: "Where the pgtap module goes. Defaults to sql.testsDir",
+		valueHint: "dir"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Show what would be written"
+	},
+	force: {
+		type: "boolean",
+		description: "Write tenant even though the authorization provider's hook owns the memberships claim"
+	}
+};
+const USAGE = "Run `better-supabase sql --help` for the actions.";
+/** Modules that fill the `memberships` claim, which a provider's hook may own. */
+const MEMBERSHIP_CLAIM_MODULES = /* @__PURE__ */ new Set(["tenant"]);
+/** Whether the provider's access token hook writes the `memberships` claim itself. */
+const providerOwnsMemberships = (config) => config.authorization?.tokenHook?.ownedClaims.includes("memberships") ?? false;
+/**
+* The provider's memberships for the `entitlements` module. When `names`
+* resolve to that module, an invalid mode (no provider, a scope it lacks,
+* an unknown id type) throws instead of falling back to the tenant module.
+* Without `names` (`sql list`) it only describes the modules, so it doesn't.
+*/
+function entitlementsProviderFor(config, names) {
+	const mode = entitlementsMode(config);
+	switch (mode.kind) {
+		case "tenant": return;
+		case "provider": return mode.provider;
+		case "invalid":
+			if (names === void 0 || !resolveModules(names, {}).some((module) => module.name === "entitlements")) return void 0;
+			throw new TypeError(mode.problem);
+		default: return mode;
+	}
+}
+/**
+* The provider for the `access` module's `provider` model. When `names`
+* resolve to `access`, an invalid mode throws, and so does a module
+* permission key the provider doesn't mark `sqlComplete: true`. `sql list`
+* (no `names`) doesn't render, so it doesn't throw.
+*/
+function accessProviderFor(config, names) {
+	const mode = accessProviderMode(config);
+	const renders = names !== void 0 && resolveModules(names, {}).some((module) => module.name === "access");
+	switch (mode.kind) {
+		case "off": return;
+		case "provider": {
+			if (!renders || !config.authorization) return mode.access;
+			const problems = moduleKeyProblems(config.authorization, modulePermissionKeys(config.sql.modules, names));
+			if (problems.length > 0) throw new TypeError(problems.map((problem) => problem.message).join("\n"));
+			return mode.access;
+		}
+		case "invalid":
+			if (!renders) return void 0;
+			throw new TypeError(mode.problem);
+		default: return mode;
+	}
+}
+/** The provider's permission keys, for `api-keys` scopes. */
+const permissionKeysFor = (config) => config.authorization?.permissions?.map((permission) => permission.key);
+async function layout(config, args, names) {
+	return {
+		...moduleLayout(config, args["tests-dir"], [], entitlementsProviderFor(config, names), accessProviderFor(config, names), permissionKeysFor(config)),
+		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root))
+	};
+}
+/** The declarative schema files, then the migrations oldest first. */
+async function schemaTexts(config) {
+	const toml = await readSupabaseToml(config.root);
+	const migrations = resolve(config.root, migrationsDir(config));
+	const paths = [...(await schemaPaths(config.root, toml)).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
+	return Promise.all(paths.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+async function declarativeTexts(config) {
+	const { files } = await schemaPaths(config.root, await readSupabaseToml(config.root));
+	if (files.length === 0) return schemaTexts(config);
+	return Promise.all(files.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+/**
+* The `better_supabase.audit(...)` calls in the declarative schemas, then
+* the migrations oldest first, so a later call or `unaudit` wins.
+*/
+async function auditedTables(config) {
+	return auditRegistrations(await schemaTexts(config));
+}
+/**
+* The layout, with `config.readSets` compiled when `names` includes
+* `read-sets` and the audited tables when it includes `audit`.
+*/
+async function layoutFor(config, args, names) {
+	const entitlementsProvider = entitlementsProviderFor(config, names);
+	const resolved = new Set(resolveModules(names, { ...entitlementsProvider ? { entitlementsProvider } : {} }).map((module) => module.name));
+	const adopted = adoptedColumnProblems(config.sql.modules, await declarativeTexts(config), config.schemas);
+	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
+	return {
+		...moduleLayout(config, args["tests-dir"], resolved.has("read-sets") ? await compiledReadSets(config) : [], entitlementsProvider, accessProviderFor(config, names), permissionKeysFor(config)),
+		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root)),
+		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
+		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
+		...resolved.has("grants") && config.sql.modules["grants"]?.options?.["fromPolicies"] === true ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
+		...resolved.has("sessions") && config.sql.modules["sessions"]?.options?.["policies"] === true ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {}
+	};
+}
+function vectorSchemaOf(sources) {
+	const schema = extensionSchema(sources, "vector");
+	return schema === void 0 ? {} : { vectorSchema: schema };
+}
+const MODULE_TEST_MARKER = /^-- @bs-module-test ([a-z0-9-]+)$/m;
+/**
+* Test files a SQL module wrote for an earlier layout (a table that is no
+* longer audited), for the modules in `names`.
+*/
+async function staleModuleTests(config, names, sqlLayout, files) {
+	const dir = (sqlLayout.testsDir ?? "supabase/tests").replace(/\/$/, "");
+	const entries = await readdir(resolve(config.root, dir)).catch(() => []);
+	const current = new Set(files.map((file) => file.path));
+	const modules = new Set(resolveModules(names, sqlLayout).map((module) => module.name));
+	const stale = [];
+	for (const name of entries.toSorted()) {
+		const path = `${dir}/${name}`;
+		if (!name.endsWith(".test.sql") || current.has(path)) continue;
+		const text = await readFile(resolve(config.root, path), "utf8");
+		const module = MODULE_TEST_MARKER.exec(text)?.[1];
+		if (module !== void 0 && modules.has(module)) stale.push(path);
+	}
+	return stale;
+}
+/**
+* The migrations folder next to the `config.toml` found walking up from
+* `sql.dir`, relative to the root; `supabase/migrations` without one. The
+* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
+* project (a shared stack in a monorepo) finds that stack's folder.
+*/
+function migrationsDir(config) {
+	const root = resolve(config.root);
+	let dir = resolve(root, config.sql.dir);
+	let stop = root;
+	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
+	for (;;) {
+		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
+		if (dir === stop || dirname(dir) === dir) break;
+		dir = dirname(dir);
+	}
+	return "supabase/migrations";
+}
+/** `YYYYMMDDHHMMSS` in UTC, the Supabase CLI's migration prefix. */
+const migrationStamp = (now) => now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
+/**
+* A stamp for `now`, or one second after the newest migration when that one
+* has the same stamp or a later one: the Supabase CLI keys migrations by
+* stamp, and the data has to run after the schema.
+*/
+function stampAfter(migrations, now) {
+	const newest = migrations.map((name) => /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(?!\d)/.exec(name)).filter((match) => match !== null).map((match) => Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]), Number(match[4]), Number(match[5]), Number(match[6]))).reduce((max, time) => Math.max(max, time), Number.NEGATIVE_INFINITY);
+	const at = Math.floor(now.getTime() / 1e3) * 1e3;
+	return migrationStamp(new Date(Math.max(at, newest + 1e3)));
+}
+async function write(config, args, names, sqlLayout, only) {
+	const lines = [];
+	const dryRun = args["dry-run"] === true;
+	let data = false;
+	const files = renderModules(names, sqlLayout).filter((file) => only === void 0 || only.includes(file.module));
+	for (const path of await staleModuleTests(config, only ?? names, sqlLayout, files)) {
+		const shown = display(config.root, path);
+		if (dryRun) {
+			lines.push(`Would remove ${shown}`);
+			continue;
+		}
+		await rm(resolve(config.root, path));
+		lines.push(`Removed ${shown}`);
+	}
+	for (const file of files) {
+		const path = resolve(config.root, file.path);
+		const shown = display(config.root, file.path);
+		if (dryRun) {
+			lines.push(`Would write ${shown} (${file.module})`);
+			continue;
+		}
+		const wrote = await writeIfChanged(path, file.contents);
+		if (wrote && file.kind === "data") data = true;
+		lines.push(`${wrote ? "Wrote" : "Unchanged"} ${shown} (${file.module})`);
+	}
+	lines.push(...await writeExtensionsMigration(config, files, dryRun));
+	if (data) lines.push("", DATA_NEXT);
+	return lines;
+}
+const EXTENSIONS_SUFFIX = "_better_supabase_extensions.sql";
+const MIGRATION_EXTENSION = /^\s*create\s+extension\s+(?:if\s+not\s+exists\s+)?"?([a-z_][a-z0-9_]*)"?/gim;
+async function unmigratedExtensions(config, files) {
+	const dir = migrationsDir(config);
+	const existing = await readdir(resolve(config.root, dir)).catch(() => []);
+	const created = /* @__PURE__ */ new Set();
+	for (const name of existing) {
+		if (!name.endsWith(".sql") || name.endsWith(DATA_SUFFIX)) continue;
+		const text = await readFile(resolve(config.root, dir, name), "utf8");
+		for (const match of text.matchAll(MIGRATION_EXTENSION)) created.add(match[1].toLowerCase());
+	}
+	return {
+		dir,
+		existing,
+		missing: moduleSchemaExtensions(files).filter((extension) => !created.has(extension.name))
+	};
+}
+async function writeExtensionsMigration(config, files, dryRun) {
+	const { dir, existing, missing } = await unmigratedExtensions(config, files);
+	if (missing.length === 0) return [];
+	const path = `${dir}/${stampAfter(existing, /* @__PURE__ */ new Date(Date.now() - 1e3))}${EXTENSIONS_SUFFIX}`;
+	if (dryRun) return [`Would write ${path}`];
+	await writeIfChanged(resolve(config.root, path), `-- better-supabase sql: the extensions of ${missing.map((extension) => extension.name).join(", ")}, created before the schema migration that needs them.\n\n${missing.map((extension) => extension.statement).join("\n")}\n`);
+	return [`Wrote ${path}`, "It creates the extensions the module schemas need, so create the schema migration after it."];
+}
+const DATA_NEXT = "The better-supabase-data files hold rows and settings a schema diff skips: after the schema migration, run `better-supabase sql data`.";
+const DATA_SUFFIX = "_better_supabase_module_data.sql";
+/**
+* Writes the data files of `sql.modules` into one migration, meant to run after
+* the schema migration that creates their tables. Every statement is
+* idempotent, so the migration carries all of them, not only the changes.
+*/
+async function dataMigration(config, args) {
+	if (config.sql.moduleNames.length === 0) return {
+		code: 0,
+		output: "sql.modules is empty; nothing to write."
+	};
+	const rendered = renderModules(config.sql.moduleNames, await layoutFor(config, args, config.sql.moduleNames));
+	const { missing } = await unmigratedExtensions(config, rendered);
+	if (missing.length > 0) return {
+		code: 1,
+		error: [`No migration before the data migration creates ${missing.map((extension) => extension.name).join(", ")}, and the schema migration needs ${missing.length === 1 ? "it" : "them"} while it applies.`, "Run `better-supabase sql sync` to write the extensions migration, then create the schema migration again after it."].join("\n")
+	};
+	const files = rendered.filter((file) => file.kind === "data");
+	const contents = `-- better-supabase sql data: the rows and settings of ${files.map((file) => file.module).join(", ")}, which a schema diff skips.\n\n${files.map((file) => file.contents.trim()).join("\n\n")}\n`;
+	const dir = migrationsDir(config);
+	const existing = await readdir(resolve(config.root, dir)).catch(() => []);
+	const latest = existing.toSorted().findLast((name) => name.endsWith(DATA_SUFFIX));
+	if (latest !== void 0 && await readFile(resolve(config.root, dir, latest), "utf8") === contents) return {
+		code: 0,
+		output: `${dir}/${latest} already has these rows; nothing to write.`
+	};
+	const path = `${dir}/${stampAfter(existing, /* @__PURE__ */ new Date())}${DATA_SUFFIX}`;
+	if (args["dry-run"] === true) return {
+		code: 0,
+		output: `Would write ${path}`
+	};
+	await writeIfChanged(resolve(config.root, path), contents);
+	return {
+		code: 0,
+		output: `Wrote ${path}`
+	};
+}
+/** A note when migra's `schema_paths` is set and misses module files, which `supabase db diff` would then skip. */
+async function unlistedModuleFiles(config, names, sqlLayout) {
+	const toml = await readSupabaseToml(config.root);
+	const order = await schemaPaths(config.root, toml);
+	if (!order.configured) return [];
+	const supabase = `${toml?.dir ?? "supabase"}/`;
+	const unlisted = new Set(order.unlisted);
+	const listed = new Set(order.files.filter((path) => !unlisted.has(path)));
+	const dir = `${config.sql.dir.replace(/\/$/, "")}/`;
+	const missing = renderModules(names, sqlLayout).filter((file) => file.kind !== "data").map((file) => file.path).filter((path) => path.startsWith(dir) && !listed.has(path));
+	if (missing.length === 0) return [];
+	return [
+		"",
+		`${toml?.path ?? "supabase/config.toml"} sets [db.migrations] schema_paths, and no entry matches these files, so \`supabase db diff\` skips them.`,
+		"Add them before the schemas that call their functions:",
+		...missing.map((path) => `  "./${path.startsWith(supabase) ? path.slice(supabase.length) : path}",`),
+		"Or switch to pg-delta, which orders the files by dependency: add [experimental.pgdelta] with enabled = true and remove schema_paths (doctor BS316)."
+	];
+}
+/**
+* Rewrites the module files of modules behind the current version, and writes
+* their upgrade steps (renames, backfills) as a migration that runs before
+* the one the schema diff creates.
+*/
+async function upgrade(config, args, paint) {
+	if (config.sql.moduleNames.length === 0) return {
+		code: 0,
+		output: "sql.modules is empty; nothing to upgrade."
+	};
+	const sqlLayout = await layoutFor(config, args, config.sql.moduleNames);
+	const files = renderModules(config.sql.moduleNames, sqlLayout);
+	const installed = [];
+	const stale = [];
+	const diffs = [];
+	for (const file of files) {
+		if (file.kind === "data") continue;
+		if (file.kind === "test" && SQL_MODULES[file.module]?.target !== "test") continue;
+		const current = await readFile(resolve(config.root, file.path), "utf8").catch(() => void 0);
+		if (current === void 0) continue;
+		installed.push({
+			module: file.module,
+			version: moduleFileVersion(current)?.version ?? 1
+		});
+		if (!sameModuleFile(current, file.contents)) {
+			stale.push(file);
+			diffs.push(fileDiff(display(config.root, file.path), current, file.contents, paint));
+		}
+	}
+	const plan = upgradePlan(installed, sqlLayout);
+	const behind = plan.map((entry) => `${entry.module} is at version ${String(entry.from)}; the current version is ${String(entry.to)}`);
+	if (args.check === true) {
+		if (plan.length === 0 && stale.length === 0) return {
+			code: 0,
+			output: "SQL modules are at their current versions."
+		};
+		return {
+			code: 1,
+			output: diffs.join("\n\n"),
+			error: [
+				...behind,
+				...stale.length > 0 ? [`Out of date: ${stale.map((file) => display(config.root, file.path)).join(", ")}.`] : [],
+				"Run `better-supabase sql upgrade`."
+			].join("\n")
+		};
+	}
+	if (plan.length === 0 && stale.length === 0) return {
+		code: 0,
+		output: "SQL modules are at their current versions."
+	};
+	const lines = [];
+	const steps = plan.flatMap((entry) => entry.steps.filter((step) => step.sql !== "").map((step) => `-- ${entry.module}: version ${String(step.from)} to ${String(step.from + 1)}. ${step.description}\n${step.sql}`));
+	const dryRun = args["dry-run"] === true;
+	if (steps.length > 0) {
+		const path = `${migrationsDir(config)}/${migrationStamp(/* @__PURE__ */ new Date())}_better_supabase_block_upgrade.sql`;
+		const contents = `-- better-supabase sql upgrade: steps that run before the schema diff.\n\n${steps.join("\n\n")}\n`;
+		if (dryRun) lines.push(`Would write ${path}`);
+		else {
+			await writeIfChanged(resolve(config.root, path), contents);
+			lines.push(`Wrote ${path}`);
+		}
+	}
+	for (const entry of plan) lines.push(`${entry.module}: version ${String(entry.from)} to ${String(entry.to)}`, ...entry.steps.map((step) => `  ${step.description}`));
+	lines.push(...await write(config, args, config.sql.moduleNames, sqlLayout), "", `Then create a migration: ${migrationCommand(await readSupabaseToml(config.root), "better_supabase_module")}`);
+	return {
+		code: 0,
+		output: lines.join("\n")
+	};
+}
+async function runSql(config, args, paint = plain) {
+	const [action, ...names] = args._;
+	switch (action) {
+		case "list": {
+			const sqlLayout = await layout(config, args);
+			const files = moduleFilePaths(Object.keys(SQL_MODULES), sqlLayout);
+			return {
+				code: 0,
+				output: `${Object.values(SQL_MODULES).map((module) => {
+					const path = files.get(module.name);
+					const installed = path !== void 0 && existsSync(resolve(config.root, path));
+					const tracked = config.sql.moduleNames.includes(module.name);
+					const mark = path === void 0 ? "◇" : installed ? tracked ? "●" : "○" : " ";
+					const requires = sqlLayout.entitlementsProvider && module.providerRequires ? module.providerRequires : module.requires;
+					const needs = requires.length > 0 ? ` (needs ${requires.join(", ")})` : "";
+					const integrates = module.integrates ?? [];
+					const works = integrates.includes("*") ? " (works with every installed module)" : integrates.length > 0 ? ` (works with ${integrates.join(", ")})` : "";
+					return `${mark} ${module.name.padEnd(15)} ${module.description}${needs}${works}`;
+				}).join("\n")}\n\n● installed and in sql.modules   ○ installed, not in sql.modules   ◇ custom mode (the app implements it)`
+			};
+		}
+		case "add": {
+			if (names.length === 0) return {
+				code: 2,
+				error: `Name at least one module.\n${USAGE}`
+			};
+			const unknown = names.filter((name) => !(name in SQL_MODULES));
+			if (unknown.length > 0) return {
+				code: 2,
+				error: `Unknown module ${unknown.join(", ")}. Available: ${Object.keys(SQL_MODULES).join(", ")}`
+			};
+			const owner = config.authorization && providerOwnsMemberships(config) ? providerLabel(config.authorization) : void 0;
+			const hookModules = names.filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name));
+			if (owner && hookModules.length > 0 && args.force !== true) return {
+				code: 1,
+				error: [
+					`The access token hook of ${owner} writes the memberships claim.`,
+					`${hookModules.join(" and ")} would add a second source for it. Use the provider's hook instead,`,
+					"or pass --force to write the modules anyway."
+				].join("\n")
+			};
+			const listed = [...config.sql.moduleNames, ...names.filter((name) => !config.sql.moduleNames.includes(name))];
+			const sqlLayout = await layoutFor(config, args, listed);
+			const lines = await write(config, args, listed, sqlLayout, resolveModules(names, sqlLayout).map((module) => module.name));
+			const pulledIn = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => MEMBERSHIP_CLAIM_MODULES.has(name) && !names.includes(name));
+			if (owner && pulledIn.length > 0) lines.push("", `${pulledIn.join(" and ")} came along as a dependency: its memberships table backs has_organization_role() and has_entitlement().`, `The hook of ${owner} still writes the memberships claim, so don't call better_supabase.membership_claims from a hook.`, "Make better_supabase.memberships one of the provider's membership sources if both should agree.");
+			const untracked = resolveModules(names, sqlLayout).map((module) => module.name).filter((name) => !config.sql.moduleNames.includes(name));
+			if (untracked.length > 0) lines.push("", `Add them to your config so \`sql sync --check\` keeps them current:`, `  sql: { modules: [${[...config.sql.moduleNames, ...untracked].map((name) => `'${name}'`).join(", ")}] }`);
+			if (args["dry-run"] !== true) lines.push(...await unlistedModuleFiles(config, names, sqlLayout));
+			lines.push("", `Then create a migration: ${migrationCommand(await readSupabaseToml(config.root), "better_supabase_module")}`);
+			return {
+				code: 0,
+				output: lines.join("\n")
+			};
+		}
+		case "sync": {
+			const topics = await topicPolicyFile(config, config.sql.moduleNames.length === 0 ? [] : moduleTopics(config.sql.moduleNames, await layoutFor(config, args, config.sql.moduleNames)));
+			if (config.sql.moduleNames.length === 0 && topics === void 0) return {
+				code: 0,
+				output: "sql.modules is empty; nothing to sync."
+			};
+			if (args.check !== true) {
+				const lines = config.sql.moduleNames.length === 0 ? [] : await write(config, args, config.sql.moduleNames, await layoutFor(config, args, config.sql.moduleNames));
+				if (topics !== void 0) {
+					const shown = display(config.root, topics.path);
+					if (args["dry-run"] === true) lines.push(`Would write ${shown} (topics)`);
+					else {
+						const wrote = await writeIfChanged(resolve(config.root, topics.path), topics.contents);
+						lines.push(`${wrote ? "Wrote" : "Unchanged"} ${shown} (topics)`);
+					}
+				}
+				return {
+					code: 0,
+					output: lines.join("\n")
+				};
+			}
+			const sqlLayout = await layoutFor(config, args, config.sql.moduleNames);
+			const files = [...renderModules(config.sql.moduleNames, sqlLayout), ...topics === void 0 ? [] : [{
+				...topics,
+				topics: true
+			}]];
+			const stale = (await staleModuleTests(config, config.sql.moduleNames, sqlLayout, renderModules(config.sql.moduleNames, sqlLayout))).map((path) => display(config.root, path));
+			const diffs = stale.map((path) => `${path} is no longer written; \`sql sync\` removes it.`);
+			for (const file of files) {
+				const current = await readFile(resolve(config.root, file.path), "utf8").catch(() => void 0);
+				if (file.topics ? !sameText(current, file.contents) : !sameModuleFile(current, file.contents)) {
+					const shown = display(config.root, file.path);
+					stale.push(shown);
+					diffs.push(fileDiff(shown, current, file.contents, paint));
+				}
+			}
+			return stale.length === 0 ? {
+				code: 0,
+				output: "SQL module files are up to date."
+			} : {
+				code: 1,
+				output: diffs.join("\n\n"),
+				error: `Out of date: ${stale.join(", ")}. Run \`better-supabase sql sync\`.`
+			};
+		}
+		case "upgrade": return upgrade(config, args, paint);
+		case "data": return dataMigration(config, args);
+		case "print": {
+			const [name] = names;
+			const module = name ? SQL_MODULES[name] : void 0;
+			if (!module) return {
+				code: 2,
+				error: `Name one module: ${Object.keys(SQL_MODULES).join(", ")}`
+			};
+			const body = moduleBody(module.name, await layout(config, args, [module.name]));
+			if (body === void 0) return {
+				code: 0,
+				output: `-- sql.modules.${module.name} is in custom mode: the app writes these functions.\n${customContracts([module.name], await layout(config, args, [module.name])).flatMap((contract) => contract.functions.map((fn) => `-- ${contract.schema}.${fn.name}(${contractSignature(fn, contract.idType)}) returns ${fn.returns.replaceAll("{id}", contract.idType)}`)).join("\n")}`
+			};
+			return {
+				code: 0,
+				output: body
+			};
+		}
+		case void 0: return {
+			code: 2,
+			error: `Name an action.\n${USAGE}`
+		};
+		default: return {
+			code: 2,
+			error: `Unknown sql action "${action}".\n${USAGE}`
+		};
+	}
+}
+const sqlCommand = defineCliCommand({
+	meta: {
+		name: "sql",
+		description: "Lists, adds, syncs, upgrades and prints SQL modules, and writes their data migration"
+	},
+	args: SQL_ARGS,
+	run: (args, { config, io }) => runSql(config, args, painter(io.color))
+});
+//#endregion
+export { sqlCommand };