better-supabase 0.7.0 → 0.8.0

package/dist/cli/{doctor-CVdnLahA.js → doctor-VcDtuusV.js}

@@ -1,105 +1,28 @@
-import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
-import { n as CliError } from "./errors-4v4DTtda.js";
-import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
-import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-Bp4fyubI.js";
-import { s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
-import { s as stdinDatabaseUrl } from "./config-NiPxAmUF.js";
-import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { a as list, r as defineCliCommand } from "./command-DV-StG1x.js";
+import { n as CliError, r as errorText } from "./errors-CqTLXe2M.js";
+import { a as writeIfChanged, i as sameText, t as display } from "./io-CFzJVJ68.js";
+import { i as plain, r as painter } from "./style-CB3vxgh0.js";
+import { t as VERSION } from "./version-B4k0aUxS.js";
+import { t as CACHE_DIR } from "./cache-CIfA-jBV.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-AIf4MREI.js";
-import { n as withSpinner } from "./prompts-BNcNfAve.js";
-import { t as connect } from "./db-DOBPt660.js";
+import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen-Demi5-VQ.js";
+import { s as configFor } from "./emit-BHHfwUoT.js";
+import { _ as tableObject, a as METADATA_GAPS_TEXT, c as accessModule, d as exposed, f as exposedSchemas, g as qualified, h as policyObject, l as entitlementsModule, m as permissionCatalogKeys, p as lineOf, s as AUTHORIZATION_RULES, u as catalogOf, y as renderFiles } from "./run-DuN1MX-7.js";
+import { s as providerLabel, t as compiledReadSets } from "./read-sets-DjJrm8Wj.js";
+import { c as stdinDatabaseUrl } from "./config-M-WzL9O2.js";
+import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { t as connect } from "./db-BkcfOlyB.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-Bstk6ulj.js";
 import { n as moduleLayoutFor } from "./sql-layout-D6cphHT3.js";
+import { n as readMetadataSnapshot } from "./metadata-DSRKCaf-.js";
+import { n as withSpinner } from "./prompts-DZJB1nTw.js";
 import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
 import { SQL_MODULES, contractSignature, customContracts, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, moduleVersion, renderModules, sameModuleFile, sharedRolesProblems } from "better-supabase/sql";
-import { createHash } from "node:crypto";
 import { defineBucket, parseSize } from "better-supabase/storage";
-//#region src/cli/doctor/advisors.ts
-/**
-* splinter (https://github.com/supabase/splinter), the linter behind the
-* dashboard's Security and Performance Advisors. It has no license, so it is
-* downloaded at this commit and checked against the hash instead of bundled.
-*/
-const SPLINTER_COMMIT = "e74a9e36cb12258cb67d1464bc1cb196e9cd8446";
-const SPLINTER_SHA256 = "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349";
-const SPLINTER_URL = `https://raw.githubusercontent.com/supabase/splinter/${SPLINTER_COMMIT}/splinter.sql`;
-function isLint(value) {
-	const lint = value;
-	return typeof lint === "object" && lint !== null && typeof lint.name === "string" && typeof lint.level === "string" && Array.isArray(lint.categories);
-}
-/** The hosted project's advisors (`GET /v1/projects/{ref}/advisors/{category}`). */
-function managementAdvisors(options) {
-	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
-	const doFetch = options.fetch ?? fetch;
-	return {
-		describe: `project ${options.projectRef} advisors (Management API)`,
-		async lints(category) {
-			const url = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/advisors/${category}`;
-			const response = await doFetch(url, { headers: { authorization: `Bearer ${options.accessToken}` } });
-			const text = await response.text();
-			if (!response.ok) throw new Error(`Management API ${category} advisors failed (${response.status}): ${text.slice(0, 300)}`);
-			const body = JSON.parse(text);
-			if (!Array.isArray(body.lints)) throw new TypeError(`Management API ${category} advisors returned no "lints".`);
-			return body.lints.filter(isLint);
-		}
-	};
-}
-/** The `[api] schemas` list of a `config.toml`, when it names any. */
-function apiSchemas(document) {
-	const value = document ? tomlGet(document, ["api", "schemas"]) : void 0;
-	if (!Array.isArray(value)) return [];
-	return value.filter((schema) => typeof schema === "string" && schema.trim() !== "");
-}
-const literal$1 = (value) => `'${value.replaceAll("'", "''")}'`;
-/** The read-only transaction splinter runs in, with `pgrst.db_schemas` set first. */
-function splinterScript(sql, schemas = []) {
-	return `begin read only;\n${schemas.length > 0 ? `set local pgrst.db_schemas = ${literal$1(schemas.join(","))};\n` : ""}${sql}\n;\nrollback;`;
-}
-const sha256 = (text) => createHash("sha256").update(text).digest("hex");
-/** Downloads (once) and verifies the pinned `splinter.sql`. */
-async function splinterSql(options) {
-	const file = resolve(options.cacheDir, `splinter-${SPLINTER_COMMIT}.sql`);
-	if (existsSync(file)) {
-		const cached = await readFile(file, "utf8");
-		if (sha256(cached) === SPLINTER_SHA256) return cached;
-	}
-	const response = await (options.fetch ?? fetch)(SPLINTER_URL);
-	if (!response.ok) throw new Error(`Downloading splinter.sql failed (${response.status}) from ${SPLINTER_URL}`);
-	const text = await response.text();
-	if (sha256(text) !== SPLINTER_SHA256) throw new Error(`splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
-	await mkdir(dirname(file), { recursive: true });
-	await writeFile(file, text);
-	return text;
-}
-/** `pg` returns one result per statement for a multi-statement query. */
-function lintRows(result) {
-	const results = Array.isArray(result) ? result : [result];
-	return results.find((entry) => entry.fields?.some((field) => field.name === "cache_key"))?.rows ?? results.at(-1)?.rows ?? [];
-}
-/**
-* Runs splinter against a database (local stack, `$DATABASE_URL` or `--db-url-stdin`) in a
-* read-only transaction that is rolled back.
-*/
-function splinterAdvisors(queryable, describe, options) {
-	let all;
-	const run = async () => {
-		const sql = await splinterSql(options);
-		return lintRows(await queryable.query(splinterScript(sql, options.schemas))).filter(isLint);
-	};
-	return {
-		describe: `${describe} (splinter ${SPLINTER_COMMIT.slice(0, 7)})`,
-		async lints(category) {
-			all ??= run();
-			const wanted = category.toUpperCase();
-			return (await all).filter((lint) => lint.categories.includes(wanted));
-		}
-	};
-}
-//#endregion
 //#region src/cli/doctor/advisor-rules.ts
 /** One request per advisor category, shared by the advisor rules and the rules that defer to them. */
 const fetched = /* @__PURE__ */ new WeakMap();
@@ -163,7 +86,7 @@ function advisorRule(code, category, title, description) {
 			try {
 				return (await lintsOf(advisors, category)).map(lintFinding);
 			} catch (cause) {
-				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${cause instanceof Error ? cause.message : String(cause)}` }];
+				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${errorText(cause)}` }];
 			}
 		}
 	};
@@ -247,6 +170,18 @@ const COOKIE_RULES = [{
 	check: encodingDrift
 }];
 //#endregion
+//#region src/cli/doctor/dependencies.ts
+const DEPENDENCY_RULES = [{
+	code: "BS601",
+	severity: "warning",
+	title: "Peer outside its range",
+	description: "An optional peer of better-supabase is installed at a version outside the range better-supabase declares. With strict peer checks the install fails, and the subpath that needs the peer can break at runtime.",
+	check: (context) => (context.peers ?? []).flatMap((peer) => peer.installed !== void 0 && satisfies(peer.installed, peer.range) === false ? [{
+		message: `${peer.name}@${peer.installed} is installed, but better-supabase needs ${peer.range}. Install a version in that range, or remove ${peer.name} if nothing imports it.`,
+		target: peer.name
+	}] : [])
+}];
+//#endregion
 //#region src/cli/doctor/live.ts
 /** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
 const SLOW_MEAN_MS = 50;
@@ -255,8 +190,7 @@ const SLOW_CALLS = 1e3;
 const EXPLAIN_LIMIT = 1e3;
 const escape$2 = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 const ident$1 = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
-const literal = (text) => `'${text.replaceAll("'", "''")}'`;
-const errorText = (cause) => cause instanceof Error ? cause.message : String(cause);
+const literal$1 = (text) => `'${text.replaceAll("'", "''")}'`;
 const oneLine = (query, max = 160) => {
 	const flat = query.replaceAll(/\s+/g, " ").trim();
 	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
@@ -328,7 +262,7 @@ async function explainTable(db, table, claims) {
 			tracked = false;
 			await db.query("rollback to savepoint bs_track");
 		}
-		await db.query(`select set_config('request.jwt.claims', ${literal(JSON.stringify(claims))}, true)`);
+		await db.query(`select set_config('request.jwt.claims', ${literal$1(JSON.stringify(claims))}, true)`);
 		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
 		await db.query(`set local role ${ident$1(role)}`);
 		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident$1(table.schema)}.${ident$1(table.name)} limit ${EXPLAIN_LIMIT}`);
@@ -433,7 +367,7 @@ const LIVE_RULES = [
 			const db = live(context);
 			if (!db || "skipped" in db || !db.session) return [{
 				severity: "warning",
-				message: `--explain needs a direct database connection (local stack, $DATABASE_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
+				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
 			}];
 			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
 			const findings = [];
@@ -679,12 +613,12 @@ async function withHookEvent(db, userId, run) {
           'amr', jsonb_build_array(jsonb_build_object(
             'method', 'password', 'timestamp', extract(epoch from now())::int8
           )),
-          'iss', ${literal(DOCTOR_ISSUER)},
+          'iss', ${literal$1(DOCTOR_ISSUER)},
           'iat', extract(epoch from now())::int8,
           'exp', extract(epoch from now())::int8 + 3600
         )
       )::text, true) as event
-      from auth.users u where u.id = ${literal(userId)}::uuid`);
+      from auth.users u where u.id = ${literal$1(userId)}::uuid`);
 		if (!user?.event) return void 0;
 		const [role] = await db.query(`select case when exists(select 1 from pg_roles where rolname = 'supabase_auth_admin')
         then pg_has_role('supabase_auth_admin', 'member') else false end as member`);
@@ -705,8 +639,8 @@ async function hookClaims(db, fn, userId) {
 	});
 }
 async function hookClaimsSize(db, fn, userId, budget) {
-	const budgetSql = budget && budget.claims.length > 0 ? budget.claims.map((claim) => `coalesce(octet_length((c -> ${literal(claim)})::text), 0)`).join(" + ") : "0";
-	const truncatedSql = budget?.truncatedClaim ? `c ->> ${literal(budget.truncatedClaim)} = 'true'` : "false";
+	const budgetSql = budget && budget.claims.length > 0 ? budget.claims.map((claim) => `coalesce(octet_length((c -> ${literal$1(claim)})::text), 0)`).join(" + ") : "0";
+	const truncatedSql = budget?.truncatedClaim ? `c ->> ${literal$1(budget.truncatedClaim)} = 'true'` : "false";
 	return withHookEvent(db, userId, async () => {
 		const [row] = await db.query(`select octet_length(c::text) as bytes,
         octet_length((c -> 'memberships')::text) as memberships,
@@ -799,7 +733,7 @@ const HOOK_RULES = [
 					if (!db || "skipped" in db || !db.session) {
 						findings.push({
 							severity: "info",
-							message: `Measuring the hook's claims needs a direct database connection (local stack, $DATABASE_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
+							message: `Measuring the hook's claims needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
 							target: `${signatureOf(fn)}:claims`
 						});
 						continue;
@@ -937,6 +871,68 @@ const HOOK_RULES = [
 	}
 ];
 //#endregion
+//#region src/cli/doctor/lite.ts
+const RPC_CALL = /(?:\.|\$)rpc\s*\(|\brpcTransport\s*\(/;
+const MISSING_FEATURES = [{
+	feature: "Realtime",
+	pattern: /from\s+["']better-supabase\/realtime["']|\.channel\s*\(|\.removeChannel\s*\(/
+}, {
+	feature: "Edge Functions",
+	pattern: /\.functions\.invoke\s*\(|\bfunctions\(\)\.invoke\s*\(/
+}];
+/** The `[db] driver` of a Supabase Lite project, or `undefined` for any other project. */
+function liteDriver(context) {
+	try {
+		return liteDriverOf(context.configToml);
+	} catch {
+		return;
+	}
+}
+function rpcOnSqlite(context) {
+	const driver = liteDriver(context);
+	if (driver === void 0 || !isSqliteLiteDriver(driver)) return [];
+	return context.sources.flatMap((file) => {
+		const line = lineOf(file.text, RPC_CALL);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} calls a Postgres function, but Supabase Lite's ${driver} driver has no rpc(), so the call returns an unsupported error. Switch [db] driver to "pglite" or "postgres" in supabase/config.toml, or replace the function with table queries.`,
+			target: `${file.path}:rpc`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	});
+}
+function missingLiteFeature(context) {
+	if (liteDriver(context) === void 0) return [];
+	return context.sources.flatMap((file) => MISSING_FEATURES.flatMap(({ feature, pattern }) => {
+		const line = lineOf(file.text, pattern);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} uses ${feature}, which Supabase Lite does not implement on any driver. Run the full Supabase stack for this feature, or move the project off Lite with \`supabase lite upgrade\`.`,
+			target: `${file.path}:${feature}`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	}));
+}
+const LITE_RULES = [{
+	code: "BS328",
+	severity: "warning",
+	title: "rpc() on a Supabase Lite SQLite driver",
+	description: "`[db] driver` in `config.toml` is `sqlite-postgres` or `sqlite`, which have no `rpc()`, but the app calls a Postgres function. Those calls return an `unsupported` error.",
+	check: rpcOnSqlite
+}, {
+	code: "BS329",
+	severity: "warning",
+	title: "Feature Supabase Lite does not implement",
+	description: "`config.toml` sets `[db] driver`, so the project runs on Supabase Lite, but the app uses Realtime or Edge Functions, which Lite does not implement.",
+	check: missingLiteFeature
+}];
+//#endregion
 //#region src/cli/doctor/metadata.ts
 /**
 * Rules that read what a `GeneratorMetadata` document leaves out (policies,
@@ -1114,7 +1110,7 @@ async function missingContracts(context) {
 			name: check.name
 		}
 	}));
-	const names = checks.map((check) => `(${literal(check.schema)}, ${literal(check.name)})`).join(", ");
+	const names = checks.map((check) => `(${literal$1(check.schema)}, ${literal$1(check.name)})`).join(", ");
 	let rows;
 	try {
 		rows = await live.query(`select n.nspname as schema, p.proname as name,
@@ -2623,7 +2619,7 @@ const RULES = [
 			code: "BS106",
 			severity: "error",
 			title: "Table not granted to the Data API",
-			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with no permissive policy under `sql.modules.grants.options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
+			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with RLS on and no permissive policy under `sql.modules.grants.options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
 			check: (context) => {
 				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
 				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
@@ -2826,7 +2822,7 @@ const RULES = [
 				const stale = [];
 				for (const file of await renderFiles(context.config, context.snapshot)) {
 					const current = await readFile(resolve(context.config.root, file.path), "utf8").catch(() => void 0);
-					if (current !== file.contents) stale.push({
+					if (!sameText(current, file.contents)) stale.push({
 						message: `${file.path} is ${current === void 0 ? "missing" : "out of date"}. Run \`better-supabase gen\`.`,
 						target: file.path,
 						...current === void 0 ? {} : { location: {
@@ -2965,7 +2961,7 @@ const RULES = [
 			title: "Local stack signs tokens with a shared secret",
 			description: "Hosted projects sign with asymmetric keys. Using the same locally means local tokens verify through JWKS just like production.",
 			check: (context) => {
-				if (!context.configToml || authSetting(context, "signing_keys_path")) return [];
+				if (!context.configToml || authSetting(context, "signing_keys_path") || tomlGet(context.configToml.document, ["db", "driver"]) !== void 0) return [];
 				const location = tomlLocation(context, "signing_keys_path");
 				return [{
 					message: "No [auth] signing_keys_path. Run `better-supabase keys` to sign local tokens with ES256.",
@@ -3033,7 +3029,9 @@ const RULES = [
 	...AUTHORIZATION_RULES,
 	...LIVE_RULES,
 	...MODULE_RULES,
-	...PGDELTA_RULES
+	...PGDELTA_RULES,
+	...LITE_RULES,
+	...DEPENDENCY_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {
@@ -3167,75 +3165,7 @@ function formatReport(findings, options) {
 	}
 }
 //#endregion
-//#region src/cli/commands/doctor.ts
-const ARGS = {
-	format: {
-		type: "string",
-		description: "text (default), sarif (code scanning) or github (workflow annotations); --json for the JSON report",
-		valueHint: "format"
-	},
-	out: {
-		type: "string",
-		description: "Write the report to a file",
-		valueHint: "file"
-	},
-	only: {
-		type: "string",
-		description: "Run only these checks, e.g. --only BS100,BS304",
-		valueHint: "codes"
-	},
-	ignore: {
-		type: "string",
-		description: "Skip checks; also doctor.ignore in the config",
-		valueHint: "codes"
-	},
-	strict: {
-		type: "boolean",
-		description: "Fail on warnings; also doctor.strict"
-	},
-	snapshot: {
-		type: "string",
-		description: "Check a saved snapshot instead of the database",
-		valueHint: "file"
-	},
-	metadata: {
-		type: "string",
-		description: "Check a GeneratorMetadata document (- for stdin); checks it lacks data for are skipped",
-		valueHint: "path|-"
-	},
-	"db-url-stdin": {
-		type: "boolean",
-		description: "Read the connection string from stdin instead of $DATABASE_URL or the config"
-	},
-	"project-ref": {
-		type: "string",
-		description: "Read a hosted project through the Management API",
-		valueHint: "ref"
-	},
-	stats: {
-		type: "boolean",
-		description: "Report slow frequent statements from pg_stat_statements (BS209)"
-	},
-	explain: {
-		type: "string",
-		description: "EXPLAIN ANALYZE these tables under RLS, rolled back (BS212)",
-		valueHint: "tables"
-	},
-	as: {
-		type: "string",
-		description: "Plan as this authenticated user, and measure the claims the custom access token hook returns for them (BS405)",
-		valueHint: "uuid"
-	},
-	claims: {
-		type: "string",
-		description: "Plan with these JWT claims ({\"role\":\"authenticated\",...})",
-		valueHint: "json"
-	},
-	"fix-grants": {
-		type: "boolean",
-		description: "Print the grant and revoke SQL BS404 asks for, to add to your schema or migration"
-	}
-};
+//#region src/cli/doctor/inputs.ts
 const ENV_FILES = [
 	".env",
 	".env.local",
@@ -3276,44 +3206,90 @@ async function sourceFiles(config) {
 	});
 	return files.sort((a, b) => byCodePoint(a.path, b.path));
 }
-const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
-/** Where a table, function or policy is declared: declarative schemas first, then the newest migration. */
-function locate(files, object) {
-	const name = `"?${escape(object.name)}"?`;
-	const qualifiedName = `(?:"?${escape(object.schema)}"?\\.)?${name}`;
-	if (object.kind === "policy" && object.table !== void 0) {
-		const onTable = new RegExp(`create\\s+policy\\s+${name}\\s+on\\s+(?:only\\s+)?(?:"?${escape(object.schema)}"?\\.)?"?${escape(object.table)}"?(?:\\s|;|$)`, "i");
-		for (const file of files) {
-			const match = onTable.exec(file.text);
-			if (match) return {
-				file: file.path,
-				line: file.text.slice(0, match.index).split("\n").length
-			};
+//#endregion
+//#region src/cli/doctor/advisors.ts
+/**
+* splinter (https://github.com/supabase/splinter), the linter behind the
+* dashboard's Security and Performance Advisors. It has no license, so it is
+* downloaded at this commit and checked against the hash instead of bundled.
+*/
+const SPLINTER_COMMIT = "e74a9e36cb12258cb67d1464bc1cb196e9cd8446";
+const SPLINTER_SHA256 = "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349";
+const SPLINTER_URL = `https://raw.githubusercontent.com/supabase/splinter/${SPLINTER_COMMIT}/splinter.sql`;
+function isLint(value) {
+	const lint = value;
+	return typeof lint === "object" && lint !== null && typeof lint.name === "string" && typeof lint.level === "string" && Array.isArray(lint.categories);
+}
+/** The hosted project's advisors (`GET /v1/projects/{ref}/advisors/{category}`). */
+function managementAdvisors(options) {
+	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
+	const doFetch = options.fetch ?? fetch;
+	return {
+		describe: `project ${options.projectRef} advisors (Management API)`,
+		async lints(category) {
+			const url = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/advisors/${category}`;
+			const response = await doFetch(url, { headers: { authorization: `Bearer ${options.accessToken}` } });
+			const text = await response.text();
+			if (!response.ok) throw new Error(`Management API ${category} advisors failed (${response.status}): ${text.slice(0, 300)}`);
+			const body = JSON.parse(text);
+			if (!Array.isArray(body.lints)) throw new TypeError(`Management API ${category} advisors returned no "lints".`);
+			return body.lints.filter(isLint);
 		}
-		return;
-	}
-	const pattern = object.kind === "table" ? new RegExp(`create\\s+(?:unlogged\\s+)?table\\s+(?:if\\s+not\\s+exists\\s+)?${qualifiedName}(?:\\s|\\(|$)`, "i") : object.kind === "function" ? new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${qualifiedName}\\s*\\(`, "i") : new RegExp(`create\\s+policy\\s+${name}`, "i");
-	for (const file of files) {
-		const line = lineOf(file.text, pattern);
-		if (line) return {
-			file: file.path,
-			line
-		};
-	}
+	};
 }
-const FLAG_FORMATS = DOCTOR_FORMATS.filter((format) => format !== "json");
-/** `--json` picks the JSON report; `--format` picks between the others. */
-function reportFormat(args) {
-	if (args.format === "json") throw new CliError("usage", "--format json is now the global --json flag");
-	if (args.json === true) {
-		if (args.format !== void 0) throw new CliError("usage", "Pass --json or --format, not both");
-		return "json";
+/** The `[api] schemas` list of a `config.toml`, when it names any. */
+function apiSchemas(document) {
+	const value = document ? tomlGet(document, ["api", "schemas"]) : void 0;
+	if (!Array.isArray(value)) return [];
+	return value.filter((schema) => typeof schema === "string" && schema.trim() !== "");
+}
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/** The read-only transaction splinter runs in, with `pgrst.db_schemas` set first. */
+function splinterScript(sql, schemas = []) {
+	return `begin read only;\n${schemas.length > 0 ? `set local pgrst.db_schemas = ${literal(schemas.join(","))};\n` : ""}${sql}\n;\nrollback;`;
+}
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** Downloads (once) and verifies the pinned `splinter.sql`. */
+async function splinterSql(options) {
+	const file = resolve(options.cacheDir, `splinter-${SPLINTER_COMMIT}.sql`);
+	if (existsSync(file)) {
+		const cached = await readFile(file, "utf8");
+		if (sha256(cached) === SPLINTER_SHA256) return cached;
 	}
-	if (args.format === void 0) return "text";
-	const format = FLAG_FORMATS.find((candidate) => candidate === args.format);
-	if (!format) throw new CliError("usage", `--format must be one of ${FLAG_FORMATS.join(", ")}`);
-	return format;
+	const response = await (options.fetch ?? fetch)(SPLINTER_URL);
+	if (!response.ok) throw new Error(`Downloading splinter.sql failed (${response.status}) from ${SPLINTER_URL}`);
+	const text = await response.text();
+	if (sha256(text) !== SPLINTER_SHA256) throw new Error(`splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
+	await mkdir(dirname(file), { recursive: true });
+	await writeFile(file, text);
+	return text;
+}
+/** `pg` returns one result per statement for a multi-statement query. */
+function lintRows(result) {
+	const results = Array.isArray(result) ? result : [result];
+	return results.find((entry) => entry.fields?.some((field) => field.name === "cache_key"))?.rows ?? results.at(-1)?.rows ?? [];
+}
+/**
+* Runs splinter against a database (local stack, `$DATABASE_URL` or `--db-url-stdin`) in a
+* read-only transaction that is rolled back.
+*/
+function splinterAdvisors(queryable, describe, options) {
+	let all;
+	const run = async () => {
+		const sql = await splinterSql(options);
+		return lintRows(await queryable.query(splinterScript(sql, options.schemas))).filter(isLint);
+	};
+	return {
+		describe: `${describe} (splinter ${SPLINTER_COMMIT.slice(0, 7)})`,
+		async lints(category) {
+			all ??= run();
+			const wanted = category.toUpperCase();
+			return (await all).filter((lint) => lint.categories.includes(wanted));
+		}
+	};
 }
+//#endregion
+//#region src/cli/doctor/live-source.ts
 /** Checks that read the database itself rather than the snapshot. */
 const LIVE_CODES = /* @__PURE__ */ new Set([
 	"BS100",
@@ -3331,7 +3307,7 @@ function openLive(config, env, source, pg) {
 	const none = { close: () => Promise.resolve() };
 	const file = snapshotFile(config, source);
 	if (file) {
-		const skipped = `reading the saved snapshot ${file}; set $DATABASE_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+		const skipped = `reading the saved snapshot ${file}; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
 		return {
 			...none,
 			advisors: { skipped },
@@ -3375,6 +3351,48 @@ function openLive(config, env, source, pg) {
 		close
 	};
 }
+//#endregion
+//#region src/cli/doctor/locate.ts
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Where a table, function or policy is declared: declarative schemas first, then the newest migration. */
+function locate(files, object) {
+	const name = `"?${escape(object.name)}"?`;
+	const qualifiedName = `(?:"?${escape(object.schema)}"?\\.)?${name}`;
+	if (object.kind === "policy" && object.table !== void 0) {
+		const onTable = new RegExp(`create\\s+policy\\s+${name}\\s+on\\s+(?:only\\s+)?(?:"?${escape(object.schema)}"?\\.)?"?${escape(object.table)}"?(?:\\s|;|$)`, "i");
+		for (const file of files) {
+			const match = onTable.exec(file.text);
+			if (match) return {
+				file: file.path,
+				line: file.text.slice(0, match.index).split("\n").length
+			};
+		}
+		return;
+	}
+	const pattern = object.kind === "table" ? new RegExp(`create\\s+(?:unlogged\\s+)?table\\s+(?:if\\s+not\\s+exists\\s+)?${qualifiedName}(?:\\s|\\(|$)`, "i") : object.kind === "function" ? new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${qualifiedName}\\s*\\(`, "i") : new RegExp(`create\\s+policy\\s+${name}`, "i");
+	for (const file of files) {
+		const line = lineOf(file.text, pattern);
+		if (line) return {
+			file: file.path,
+			line
+		};
+	}
+}
+//#endregion
+//#region src/cli/doctor/options.ts
+const FLAG_FORMATS = DOCTOR_FORMATS.filter((format) => format !== "json");
+/** `--json` picks the JSON report; `--format`, then `doctor.format`, picks between the others. */
+function reportFormat(args, configured) {
+	if (args.format === "json") throw new CliError("usage", "--format json is now the global --json flag");
+	if (args.json === true) {
+		if (args.format !== void 0) throw new CliError("usage", "Pass --json or --format, not both");
+		return "json";
+	}
+	if (args.format === void 0) return configured;
+	const format = FLAG_FORMATS.find((candidate) => candidate === args.format);
+	if (!format) throw new CliError("usage", `--format must be one of ${FLAG_FORMATS.join(", ")}`);
+	return format;
+}
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /** `--as <uuid>` or `--claims <json>` as `request.jwt.claims`. */
 function explainClaims(args) {
@@ -3397,12 +3415,82 @@ function explainClaims(args) {
 			...parsed
 		};
 	} catch (cause) {
-		return { error: `--claims is not valid JSON: ${cause instanceof Error ? cause.message : String(cause)}` };
+		return { error: `--claims is not valid JSON: ${errorText(cause)}` };
 	}
 }
+//#endregion
+//#region src/cli/commands/doctor.ts
+const ARGS = {
+	format: {
+		type: "string",
+		description: "text, sarif (code scanning) or github (workflow annotations); also doctor.format, default text. --json for the JSON report",
+		valueHint: "format"
+	},
+	out: {
+		type: "string",
+		description: "Write the report to a file; also doctor.output",
+		valueHint: "file"
+	},
+	only: {
+		type: "string",
+		description: "Run only these checks, e.g. --only BS100,BS304; also doctor.only",
+		valueHint: "codes"
+	},
+	ignore: {
+		type: "string",
+		description: "Skip checks; also doctor.ignore in the config",
+		valueHint: "codes"
+	},
+	strict: {
+		type: "boolean",
+		description: "Fail on warnings; also doctor.strict"
+	},
+	snapshot: {
+		type: "string",
+		description: "Check a saved snapshot instead of the database",
+		valueHint: "file"
+	},
+	metadata: {
+		type: "string",
+		description: "Check a GeneratorMetadata document (- for stdin); checks it lacks data for are skipped",
+		valueHint: "path|-"
+	},
+	"db-url-stdin": {
+		type: "boolean",
+		description: "Read the connection string from stdin instead of the config, $DATABASE_URL or $SUPABASE_DB_URL"
+	},
+	"project-ref": {
+		type: "string",
+		description: "Read a hosted project through the Management API",
+		valueHint: "ref"
+	},
+	stats: {
+		type: "boolean",
+		description: "Report slow frequent statements from pg_stat_statements (BS209)"
+	},
+	explain: {
+		type: "string",
+		description: "EXPLAIN ANALYZE these tables under RLS, rolled back (BS212)",
+		valueHint: "tables"
+	},
+	as: {
+		type: "string",
+		description: "Plan as this authenticated user, and measure the claims the custom access token hook returns for them (BS405)",
+		valueHint: "uuid"
+	},
+	claims: {
+		type: "string",
+		description: "Plan with these JWT claims ({\"role\":\"authenticated\",...})",
+		valueHint: "json"
+	},
+	"fix-grants": {
+		type: "boolean",
+		description: "Print the grant and revoke SQL BS404 asks for, to add to your schema or migration"
+	}
+};
 async function runDoctor(config, args, env, options = {}) {
-	const format = reportFormat(args);
-	const only = list(args.only);
+	const format = reportFormat(args, config.doctor.format);
+	const only = args.only === void 0 ? [...config.doctor.only] : list(args.only);
 	const ignore = /* @__PURE__ */ new Set([...config.doctor.ignore, ...list(args.ignore)]);
 	const unknown = [...only, ...ignore].filter((code) => !RULE_CODES.includes(code));
 	if (unknown.length > 0) return {
@@ -3445,17 +3533,23 @@ async function runDoctor(config, args, env, options = {}) {
 		...options.advisors === void 0 ? {} : { advisors: options.advisors },
 		...options.database === void 0 ? {} : { database: options.database }
 	};
-	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets] = await Promise.all([
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers] = await Promise.all([
 		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
 		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
 		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml)]),
 		readText(config.root, ".gitignore"),
 		sourceFiles(config),
-		compiledReadSets(config).catch((cause) => ({ skipped: cause instanceof Error ? cause.message : String(cause) }))
+		compiledReadSets(config).catch((cause) => ({ skipped: errorText(cause) })),
+		options.peers ?? peerVersions(config.root).catch(() => [])
 	]).catch(async (cause) => {
 		await opened.close();
 		throw cause;
 	});
+	const replay = opened.open ? (await opened.open()).replay : void 0;
+	const live = replay ? {
+		advisors: options.advisors ?? { skipped: replay },
+		database: options.database ?? { skipped: replay }
+	} : opened;
 	const context = {
 		config,
 		snapshot,
@@ -3465,8 +3559,9 @@ async function runDoctor(config, args, env, options = {}) {
 		gitignore: gitignore?.text ?? "",
 		sources,
 		readSets,
-		...opened.advisors ? { advisors: opened.advisors } : {},
-		...opened.database ? { database: opened.database } : {},
+		peers,
+		...live.advisors ? { advisors: live.advisors } : {},
+		...live.database ? { database: live.database } : {},
 		...stats ? { stats } : {},
 		...hookUser ? { hookUser } : {},
 		...explainTables.length > 0 ? { explain: {
@@ -3495,7 +3590,7 @@ async function runDoctor(config, args, env, options = {}) {
 			location
 		} : finding;
 	});
-	const out = args.out;
+	const out = args.out ?? (format === config.doctor.format ? config.doctor.output : void 0);
 	const fromRepo = format === "sarif" || format === "github";
 	const repoRoot = findRepoRoot(config.root);
 	const repoPath = (file) => display(repoRoot, resolve(config.root, file));
@@ -3571,7 +3666,7 @@ const doctorCommand = defineCliCommand({
 				};
 				throw cause;
 			}
-			const skipped = `reading a GeneratorMetadata document; set $DATABASE_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+			const skipped = `reading a GeneratorMetadata document; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
 			return runDoctor(config, args, env, {
 				snapshot,
 				advisors: { skipped },