better-supabase 0.7.1 → 0.8.0

package/dist/cli/bin.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { i as run } from "./run-BqDPh9UH.js";
-import { t as colorEnabled } from "./style-C0NFdJRL.js";
+import { i as run } from "./run-DA6_lg3w.js";
+import { t as colorEnabled } from "./style-CB3vxgh0.js";
 import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts
-const clack = () => import("./prompts-BTYQGunc.js").then((module) => module.clackPrompter);
+const clack = () => import("./prompts-BdeVmVpg.js").then((module) => module.createClackPrompter(process.stderr));
 const prompts = {
 	select: async (message, choices, initial) => (await clack()).select(message, choices, initial),
 	multiselect: async (message, choices, initial) => (await clack()).multiselect(message, choices, initial),
@@ -39,7 +39,7 @@ const result = await run(process.argv.slice(2), {
 			process.stderr.write(chunk);
 		},
 		stdin: () => text(process.stdin),
-		color: colorEnabled(),
+		color: colorEnabled(process.stdout),
 		...process.stdin.isTTY && process.stdout.isTTY ? { prompts } : {}
 	}
 });

package/dist/cli/cache-CIfA-jBV.js

@@ -0,0 +1,483 @@
+import { t as VERSION } from "./version-B4k0aUxS.js";
+import { t as TYPEGEN_VERSION } from "./typegen-version-DeFbtzYI.js";
+import { dirname, resolve } from "node:path";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+//#region src/cli/introspect/extras.ts
+/**
+* Catalog details `@supabase/postgrest-typegen` leaves out: named unique and
+* CHECK constraints, foreign key actions, ordered primary keys, indexes,
+* policies, triggers, grants, buckets and the realtime publication.
+*
+* The SQL takes no bind parameters because the Management API endpoint only
+* accepts a query string; schema names are inlined as escaped literals.
+*/
+const literalArray = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
+/** Row estimate from which a table counts as large in the snapshot. */
+const LARGE_TABLE_ROWS = 1e4;
+const RELATIONS = (schemas) => `
+select c.oid::int8 as id, n.nspname as schema, c.relname as name,
+  c.reltuples >= ${LARGE_TABLE_ROWS} as large
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
+order by 2, 3`;
+const CONSTRAINTS = (schemas) => `
+select con.conrelid::int8 as table_id, con.conname as name, con.contype as type,
+  array(select a.attname from unnest(con.conkey) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum order by k.ord)::text[] as columns,
+  con.confdeltype as on_delete, con.confupdtype as on_update,
+  pg_get_constraintdef(con.oid) as definition
+from pg_constraint con
+join pg_class c on c.oid = con.conrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and con.contype in ('p', 'u', 'f', 'c')
+order by 1, 2`;
+const INDEXES = (schemas) => `
+select ix.indrelid::int8 as table_id, i.relname as name,
+  ix.indisunique as unique, ix.indisprimary as primary,
+  (ix.indpred is not null or 0 = any(ix.indkey::int2[])) as partial,
+  am.amname as method, pg_get_expr(ix.indpred, ix.indrelid) as predicate,
+  array(select a.attname from unnest((ix.indkey::int2[])[0:ix.indnkeyatts - 1]) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = ix.indrelid and a.attnum = k.attnum order by k.ord)::text[] as columns
+from pg_index ix
+join pg_class i on i.oid = ix.indexrelid
+join pg_am am on am.oid = i.relam
+join pg_class c on c.oid = ix.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and ix.indisvalid
+order by 1, 2`;
+const POLICIES = (schemas) => `
+select c.oid::int8 as table_id, p.policyname as name,
+  (p.permissive = 'PERMISSIVE') as permissive, p.roles::text[] as roles, lower(p.cmd) as command,
+  p.qual as using_expr, p.with_check as check_expr,
+  array(
+    select distinct fn.nspname || '.' || pr.proname
+    from pg_policy pol
+    join pg_depend d on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+      and d.refclassid = 'pg_proc'::regclass
+    join pg_proc pr on pr.oid = d.refobjid
+    join pg_namespace fn on fn.oid = pr.pronamespace
+    where pol.polrelid = c.oid and pol.polname = p.policyname
+    order by 1
+  )::text[] as functions
+from pg_policies p
+join pg_namespace n on n.nspname = p.schemaname
+join pg_class c on c.relnamespace = n.oid and c.relname = p.tablename
+where p.schemaname = any(${schemas})
+order by 1, 2`;
+const FUNCTIONS = (schemas) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(
+    select r from unnest(array['anon', 'authenticated']) r
+    where has_function_privilege(r, p.oid, 'EXECUTE')
+  ) as execute
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where p.oid in (
+    select d.refobjid
+    from pg_depend d
+    join pg_policy pol on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+    join pg_class c on c.oid = pol.polrelid
+    join pg_namespace cn on cn.oid = c.relnamespace
+    where d.refclassid = 'pg_proc'::regclass and cn.nspname = any(${schemas})
+  )
+  or (n.nspname = any(${schemas}) and ((p.prosecdef
+    and p.prorettype not in ('trigger'::regtype, 'event_trigger'::regtype)) or exists (
+    select 1 from unnest(p.proconfig) setting where setting not like 'search_path=%'
+  )))
+order by 1, 2, 3`;
+/** Roles the hook checks care about: the one Auth calls it as, and the API roles. */
+const HOOK_ROLES = literalArray([
+	"supabase_auth_admin",
+	"authenticated",
+	"anon"
+]);
+const HOOKS = (names) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_function_privilege(r.oid, p.oid, 'execute')
+    order by 1) as execute,
+  exists(select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where a.grantee = 0 and a.privilege_type = 'EXECUTE') as public_execute,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_schema_privilege(r.oid, n.oid, 'usage')
+    order by 1) as schema_usage,
+  p.prosrc as source
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where n.nspname || '.' || p.proname = any(${names})
+order by 1, 2, 3`;
+const TRIGGERS = (schemas) => `
+select t.tgrelid::int8 as table_id, t.tgname as name,
+  pn.nspname || '.' || p.proname as function,
+  case when t.tgtype & 2 = 2 then 'before' when t.tgtype & 64 = 64 then 'instead of' else 'after' end as timing,
+  array_remove(array[
+    case when t.tgtype & 4 = 4 then 'insert' end,
+    case when t.tgtype & 16 = 16 then 'update' end,
+    case when t.tgtype & 8 = 8 then 'delete' end,
+    case when t.tgtype & 32 = 32 then 'truncate' end
+  ], null)::text[] as events,
+  case when t.tgtype & 1 = 1 then 'row' else 'statement' end as level
+from pg_trigger t
+join pg_class c on c.oid = t.tgrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_proc p on p.oid = t.tgfoid
+join pg_namespace pn on pn.oid = p.pronamespace
+where not t.tgisinternal and n.nspname = any(${schemas})
+order by 1, 2`;
+const GRANTS = (schemas) => `
+select c.oid::int8 as table_id, coalesce(r.rolname, 'PUBLIC') as role,
+  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+cross join lateral aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl
+left join pg_roles r on r.oid = acl.grantee
+where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
+  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated', 'service_role'))
+  and acl.privilege_type <> 'MAINTAIN'
+group by 1, 2
+order by 1, 2`;
+const COLUMN_GRANTS = (schemas) => `
+select c.oid::int8 as table_id, a.attname as column, coalesce(r.rolname, 'PUBLIC') as role,
+  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped and a.attacl is not null
+cross join lateral aclexplode(a.attacl) acl
+left join pg_roles r on r.oid = acl.grantee
+where n.nspname = any(${schemas})
+  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated'))
+  and acl.privilege_type in ('INSERT', 'UPDATE')
+group by 1, 2, 3
+order by 1, 2, 3`;
+const BUCKETS = `
+select id, public, file_size_limit, allowed_mime_types,
+  to_jsonb(b) ? 'versioning_status' as has_versioning,
+  to_jsonb(b) -> 'versioning_status' as versioning_status,
+  to_jsonb(b) ? 'lifecycle_configuration' as has_lifecycle,
+  to_jsonb(b) -> 'lifecycle_configuration' as lifecycle_configuration
+from storage.buckets b
+order by id`;
+const REALTIME = `
+select schemaname || '.' || tablename as name
+from pg_publication_tables
+where pubname = 'supabase_realtime'
+order by 1`;
+const ROLE_SETTINGS = `
+select r.rolname as role, s.setconfig as config
+from pg_catalog.pg_db_role_setting s
+join pg_catalog.pg_roles r on r.oid = s.setrole
+where r.rolname in ('authenticator', 'anon', 'authenticated')
+  and s.setdatabase in (0, (select oid from pg_catalog.pg_database where datname = current_database()))
+order by s.setdatabase`;
+const HAS_TABLE = (qualified) => `select to_regclass('${qualified}') is not null as present`;
+const ACTIONS = {
+	a: "no action",
+	r: "restrict",
+	c: "cascade",
+	n: "set null",
+	d: "set default"
+};
+const VOLATILITY = {
+	i: "immutable",
+	s: "stable",
+	v: "volatile"
+};
+/** `['statement_timeout=5s']` as `{ statement_timeout: '5s' }`. */
+function settingsOf(config) {
+	const settings = {};
+	for (const entry of config ?? []) {
+		const at = entry.indexOf("=");
+		if (at > 0) settings[entry.slice(0, at)] = entry.slice(at + 1);
+	}
+	return settings;
+}
+const functionOf = (row) => ({
+	schema: row.schema,
+	name: row.name,
+	signature: row.signature,
+	language: row.language,
+	volatility: VOLATILITY[row.volatility],
+	securityDefiner: row.security_definer,
+	settings: settingsOf(row.config)
+});
+/** The functions behind Auth hooks, in any schema, with their ACLs. */
+async function readHooks(db, targets) {
+	if (targets.length === 0) return [];
+	const found = await rows(db, HOOKS(literalArray(targets.map((t) => `${t.schema}.${t.name}`))));
+	return targets.map((target) => ({
+		hook: target.hook,
+		schema: target.schema,
+		name: target.name,
+		functions: found.filter((row) => row.schema === target.schema && row.name === target.name).map((row) => ({
+			...functionOf(row),
+			execute: row.execute,
+			publicExecute: row.public_execute,
+			schemaUsage: row.schema_usage,
+			...row.source === null ? {} : { source: row.source }
+		}))
+	}));
+}
+async function rows(db, sql) {
+	return (await db.query(sql)).rows;
+}
+/** Rows from a table owned by another Supabase service, if it exists. */
+async function serviceRows(db, qualified, sql) {
+	const [probe] = await rows(db, HAS_TABLE(qualified));
+	return probe?.present ? rows(db, sql) : [];
+}
+function groupById(list) {
+	const map = /* @__PURE__ */ new Map();
+	for (const row of list) {
+		const id = Number(row.table_id);
+		const entry = map.get(id);
+		if (entry) entry.push(row);
+		else map.set(id, [row]);
+	}
+	return map;
+}
+/** Reads the extras for `schemas`, with the catalog queries in flight together. */
+async function readExtras(db, schemas, hooks = []) {
+	const list = literalArray(schemas);
+	const [relations, constraintRows, indexRows, policyRows, triggerRows, grantRows, columnGrantRows, buckets, realtime, functions, roleRows, hookRows] = await Promise.all([
+		rows(db, RELATIONS(list)),
+		rows(db, CONSTRAINTS(list)),
+		rows(db, INDEXES(list)),
+		rows(db, POLICIES(list)),
+		rows(db, TRIGGERS(list)),
+		rows(db, GRANTS(list)),
+		rows(db, COLUMN_GRANTS(list)),
+		serviceRows(db, "storage.buckets", BUCKETS),
+		rows(db, REALTIME),
+		rows(db, FUNCTIONS(list)),
+		rows(db, ROLE_SETTINGS),
+		hooks.length > 0 ? readHooks(db, hooks) : void 0
+	]);
+	const constraints = groupById(constraintRows);
+	const indexes = groupById(indexRows);
+	const policies = groupById(policyRows);
+	const triggers = groupById(triggerRows);
+	const grants = groupById(grantRows);
+	const columnGrants = groupById(columnGrantRows);
+	const roleSettings = {};
+	for (const row of roleRows) Object.assign(roleSettings[row.role] ??= {}, settingsOf(row.config));
+	return {
+		tables: relations.map((relation) => {
+			const id = Number(relation.id);
+			const own = constraints.get(id) ?? [];
+			const ownIndexes = indexes.get(id) ?? [];
+			const uniques = own.filter((con) => con.type === "u").map((con) => ({
+				name: con.name,
+				columns: con.columns
+			}));
+			const constraintNames = new Set(own.map((con) => con.name));
+			for (const index of ownIndexes) if (index.unique && !index.primary && !index.partial && !constraintNames.has(index.name)) uniques.push({
+				name: index.name,
+				columns: index.columns
+			});
+			return {
+				id,
+				schema: relation.schema,
+				name: relation.name,
+				primaryKey: own.find((con) => con.type === "p")?.columns ?? [],
+				uniques,
+				foreignKeys: own.filter((con) => con.type === "f").map((con) => ({
+					name: con.name,
+					onDelete: ACTIONS[con.on_delete] ?? "no action",
+					onUpdate: ACTIONS[con.on_update] ?? "no action"
+				})),
+				checks: own.filter((con) => con.type === "c").map((con) => ({
+					name: con.name,
+					definition: con.definition
+				})),
+				indexes: ownIndexes.map((index) => ({
+					name: index.name,
+					columns: index.columns,
+					unique: index.unique,
+					primary: index.primary,
+					partial: index.partial,
+					method: index.method,
+					predicate: index.predicate
+				})),
+				policies: (policies.get(id) ?? []).map((policy) => ({
+					name: policy.name,
+					command: policy.command,
+					roles: policy.roles,
+					permissive: policy.permissive,
+					using: policy.using_expr,
+					check: policy.check_expr,
+					functions: policy.functions ?? []
+				})),
+				triggers: (triggers.get(id) ?? []).map((trigger) => ({
+					name: trigger.name,
+					timing: trigger.timing,
+					events: trigger.events,
+					level: trigger.level,
+					function: trigger.function
+				})),
+				grants: (grants.get(id) ?? []).map((grant) => ({
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				columnGrants: (columnGrants.get(id) ?? []).map((grant) => ({
+					column: grant.column,
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				...relation.large ? { large: true } : {}
+			};
+		}),
+		buckets: buckets.map((row) => ({
+			id: row.id,
+			public: row.public,
+			fileSizeLimit: row.file_size_limit === null ? null : Number(row.file_size_limit),
+			allowedMimeTypes: row.allowed_mime_types,
+			...row.has_versioning ? { versioning: row.versioning_status } : {},
+			...row.has_lifecycle ? { lifecycle: row.lifecycle_configuration } : {}
+		})),
+		realtime: realtime.map((row) => row.name),
+		roleSettings,
+		functions: functions.map((row) => ({
+			...functionOf(row),
+			execute: row.execute
+		})),
+		...hookRows ? { hooks: hookRows } : {}
+	};
+}
+//#endregion
+//#region src/cli/introspect/fingerprint.ts
+/**
+* Catalogs whose rows only change with DDL, grants, comments or settings,
+* with the column that ties a row to a relation or namespace, if any.
+*/
+const CATALOGS = [
+	["pg_namespace", "oid"],
+	["pg_attribute", "attrelid"],
+	["pg_attrdef", "adrelid"],
+	["pg_constraint", "conrelid"],
+	["pg_index", "indrelid"],
+	["pg_inherits"],
+	["pg_rewrite"],
+	["pg_policy"],
+	["pg_trigger", "tgrelid"],
+	["pg_proc"],
+	["pg_type", "typnamespace"],
+	["pg_enum"],
+	["pg_description"],
+	["pg_db_role_setting"],
+	["pg_publication"],
+	["pg_publication_rel"],
+	["pg_extension"]
+];
+const TEMP_NAMESPACES = String.raw`(select oid from pg_catalog.pg_namespace where nspname like 'pg\_temp\_%' or nspname like 'pg\_toast\_temp\_%')`;
+const TEMP_RELATIONS = `(select oid from pg_catalog.pg_class where relnamespace in ${TEMP_NAMESPACES})`;
+const catalogRows = ([name, column]) => {
+	if (column === void 0) return `pg_catalog.${name}`;
+	return `(select * from pg_catalog.${name} where ${column} not in ${column === "oid" || column === "typnamespace" ? TEMP_NAMESPACES : TEMP_RELATIONS})`;
+};
+const digest = (from) => `(select md5(coalesce(string_agg(x::text, ',' order by x::text), '')) from ${from} x)`;
+/**
+* One cheap query whose result changes whenever introspection could. pg_class
+* leaves out the planner statistics that VACUUM and ANALYZE rewrite, except
+* the row-count threshold the snapshot records. pg_depend is limited to the
+* policies' rows, which name the tables and functions each policy uses.
+* pg_auth_members decides which privileges a role inherits, so the execute
+* lists change with it. Bucket rows are data, so they are hashed when
+* `storage.buckets` exists.
+*/
+const FINGERPRINT_SQL = `select md5(concat_ws('|',
+  ${digest(`(select oid, relname, relnamespace, relkind, relacl, reloptions, relrowsecurity, relforcerowsecurity, relreplident, relispartition, reltuples >= ${LARGE_TABLE_ROWS} as large from pg_catalog.pg_class where relnamespace not in ${TEMP_NAMESPACES})`)},
+  ${CATALOGS.map((entry) => digest(catalogRows(entry))).join(",\n  ")},
+  ${digest(`(select objid, refclassid, refobjid, refobjsubid, deptype from pg_catalog.pg_depend where classid = 'pg_catalog.pg_policy'::regclass)`)},
+  (select md5(coalesce(string_agg(rolname, ',' order by rolname), '')) from pg_catalog.pg_roles),
+  ${digest("pg_catalog.pg_auth_members")},
+  case when to_regclass('storage.buckets') is not null
+    then md5(query_to_xml('select id, public, file_size_limit, allowed_mime_types, to_jsonb(b) -> ''versioning_status'' as versioning, to_jsonb(b) -> ''lifecycle_configuration'' as lifecycle from storage.buckets b order by id', false, false, '')::text)
+  end
+)) as fingerprint`;
+/** A hash of the catalog; equal values mean introspection would return the same snapshot. */
+async function catalogFingerprint(db) {
+	const [row] = (await db.query(FINGERPRINT_SQL)).rows;
+	const value = row && typeof row === "object" && "fingerprint" in row ? row.fingerprint : void 0;
+	if (typeof value !== "string") throw new TypeError("The catalog fingerprint query returned no row.");
+	return value;
+}
+//#endregion
+//#region src/cli/introspect/cache.ts
+/** Shared with the splinter download cache. */
+const CACHE_DIR = "node_modules/.cache/better-supabase";
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+function isEntry(value) {
+	return typeof value === "object" && value !== null && "key" in value && typeof value.key === "string" && "snapshot" in value && typeof value.snapshot === "object";
+}
+/**
+* Calls `read`, or returns the snapshot cached under `root` when the catalog
+* fingerprint, the `inputs` (schemas and hooks), the CLI version and the
+* typegen version all match. One file per source keeps the cache from growing. A source that
+* cannot report a fingerprint is read every time.
+*/
+async function cachedIntrospect(root, source, inputs, read) {
+	const fingerprint = await catalogFingerprint(source.queryable).catch(() => void 0);
+	if (fingerprint === void 0) return read();
+	const key = sha256(JSON.stringify([
+		VERSION,
+		TYPEGEN_VERSION,
+		source.describe,
+		inputs,
+		fingerprint
+	]));
+	const file = resolve(root, CACHE_DIR, `snapshot-${sha256(source.describe).slice(0, 16)}.json`);
+	const cached = await readFile(file, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (isEntry(cached) && cached.key === key) return cached.snapshot;
+	const snapshot = await read();
+	await writeAtomic(file, JSON.stringify({
+		key,
+		snapshot
+	})).catch(() => void 0);
+	return snapshot;
+}
+/**
+* Calls `produce`, or returns the `database.types.ts` cached under `root`
+* for the same `inputs`, CLI version and typegen version. Typegen and oxfmt
+* are most of a `gen` run on a large schema, and their output only depends
+* on the inputs.
+*/
+async function cachedDatabaseTypes(root, inputs, produce) {
+	const key = sha256(JSON.stringify([
+		VERSION,
+		TYPEGEN_VERSION,
+		inputs
+	]));
+	const file = resolve(root, CACHE_DIR, "database-types.json");
+	const cached = await readFile(file, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (typeof cached === "object" && cached !== null && "key" in cached && cached.key === key && "contents" in cached && typeof cached.contents === "string") return cached.contents;
+	const contents = await produce();
+	await writeAtomic(file, JSON.stringify({
+		key,
+		contents
+	})).catch(() => void 0);
+	return contents;
+}
+/** Writes through a temporary file, so a concurrent reader never sees half a file. */
+async function writeAtomic(file, contents) {
+	await mkdir(dirname(file), { recursive: true });
+	const temporary = `${file}.${process.pid}-${crypto.randomUUID()}.tmp`;
+	try {
+		await writeFile(temporary, contents);
+		await rename(temporary, file);
+	} catch (cause) {
+		await rm(temporary, { force: true });
+		throw cause;
+	}
+}
+//#endregion
+export { catalogFingerprint as a, writeAtomic as i, cachedDatabaseTypes as n, readExtras as o, cachedIntrospect as r, CACHE_DIR as t };

package/dist/cli/{codemod-Bl_tQpHn.js → codemod-JVlTQQG2.js}

@@ -1,7 +1,7 @@
-import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { i as writeIfChanged } from "./io-DI1mTdSA.js";
-import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as fileDiff } from "./diff-SjkO5rNr.js";
+import { r as defineCliCommand } from "./command-DV-StG1x.js";
+import { a as writeIfChanged } from "./io-CFzJVJ68.js";
+import { i as plain, r as painter } from "./style-CB3vxgh0.js";
+import { t as fileDiff } from "./diff-D1jGdb3Y.js";
 import { extname, join, relative, resolve } from "node:path";
 import { readFile, readdir, stat } from "node:fs/promises";
 import { BLOCK_EVENT_RENAMES } from "better-supabase/events";

package/dist/cli/{command-CK14fP91.js → command-DV-StG1x.js}

@@ -427,6 +427,11 @@ const GLOBAL_ARGS = {
 		description: "Config file, relative to --cwd",
 		valueHint: "file"
 	},
+	env: {
+		type: "string",
+		description: "Config environment to apply ($env.<name> or $<name>). Defaults to $BETTER_SUPABASE_ENV, then ci when $CI is set",
+		valueHint: "name"
+	},
 	json: {
 		type: "boolean",
 		description: "Print one JSON document on stdout; errors as Problem Details"

package/dist/cli/{config-DU7EJImt.js → config-C2Pz2_4A.js}

@@ -1,5 +1,5 @@
-import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { t as display } from "./io-DI1mTdSA.js";
+import { r as defineCliCommand } from "./command-DV-StG1x.js";
+import { t as display } from "./io-CFzJVJ68.js";
 //#region src/cli/commands/config.ts
 /** A connection string with its password replaced, so the printed config is safe to share. */
 function redactUrl(url) {
@@ -29,17 +29,20 @@ function printableConfig(config) {
 const configCommand = defineCliCommand({
 	meta: {
 		name: "config",
-		description: "Prints the resolved config: the file it came from and every option with its default"
+		description: "Prints the resolved config: the file it came from, the active environment and every option with its default"
 	},
 	args: {},
 	run: (_args, context) => {
 		const config = printableConfig(context.config);
 		const file = context.configFile ? display(context.cwd, context.configFile) : null;
+		const environment = context.config.environment ?? null;
+		const header = file ? `# ${file}` : "# no config file, defaults only";
 		return Promise.resolve({
 			code: 0,
-			output: `${file ? `# ${file}` : "# no config file, defaults only"}\n${JSON.stringify(config, null, 2)}`,
+			output: `${header}${environment ? ` (environment: ${environment})` : ""}\n${JSON.stringify(config, null, 2)}`,
 			data: {
 				file,
+				environment,
 				config
 			}
 		});

package/dist/cli/config-DpbF8ML3.js

@@ -0,0 +1,2 @@
+import { a as importExport, c as stdinDatabaseUrl, i as findConfig, n as databaseUrl, o as loadConfig, r as discoverConfig, s as readSupabasePort, t as applyEnvironment } from "./config-M-WzL9O2.js";
+export { applyEnvironment, databaseUrl, discoverConfig, findConfig, importExport, loadConfig, readSupabasePort, stdinDatabaseUrl };