better-supabase 0.9.0 → 0.10.0

package/dist/cli/{doctor-SGw36h1D.js → doctor-wACp5w6N.js}

@@ -1,22 +1,25 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
-import { t as VERSION } from "./version-DNRW4DAP.js";
+import { t as VERSION } from "./version-D1wM9DNb.js";
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, t as display } from "./io-BiPX-_J1.js";
-import { t as CACHE_DIR } from "./cache-Cx6qlRDR.js";
+import { t as CACHE_DIR } from "./cache-CPBYJAkb.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
-import { c as configFor, s as notNullTag } from "./emit-ZAYeh4Yn.js";
-import { A as renderFiles, C as policyObject, D as advisorRule, E as workflowOf, O as splinterTables, S as permissionCatalogKeys, T as tableObject, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as exposedSchemas, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as catalogOf, w as qualified, x as lineOf, y as exposed } from "./run-DaHfUUO9.js";
-import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-YFFdWC5X.js";
-import { l as stdinDatabaseUrl } from "./config-CLHpTk9Y.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { c as configFor, s as notNullTag } from "./emit-j0zZ6NE_.js";
+import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-DliGNdjI.js";
+import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-CLkZ8jpw.js";
+import { l as stdinDatabaseUrl } from "./config-Bi_UBxXl.js";
 import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-DjLgBYEo.js";
 import { t as connect } from "./db-DT1bGB02.js";
-import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
 import { n as applyPlan, o as insideRoot, r as changeLines } from "./files-DDvAwTko.js";
-import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { i as sourceFlags, n as SOURCE_ARGS } from "./source-args-0I9zylYy.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-CxBZo4KM.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-CNcvDOLt.js";
+import { t as MIGRATION_SAFETY_RULES } from "./migration-safety-LaGVPPuD.js";
+import { i as sourceFlags, n as SOURCE_ARGS } from "./source-args-BNhagtpw.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-BFfYoE0_.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-DikbSOE0.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -98,6 +101,29 @@ const ADOPTION_RULES = [
 			});
 		}
 	},
+	{
+		code: "BS342",
+		severity: "error",
+		title: "Adopted enum column the module writes as text",
+		description: "A module in adopt mode writes a text parameter or computed text value into a column the snapshot declares as an enum; string literals are fine. Postgres has no implicit cast from text to an enum, so the module's functions fail when they run. Columns the module casts to their declared type, such as the tags `kind` and the number-sequences `entity`, may be enums.",
+		check: (context) => {
+			const { tables } = catalogOf(context);
+			return adoptedTables(context.config.blocks).flatMap((adopted) => {
+				const table = tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+				if (table === void 0) return [];
+				return adopted.textColumns.flatMap((logical) => {
+					const name = adopted.columns[logical];
+					const column = table.columns.find((entry) => entry.name === name);
+					if (column?.isEnum !== true || column.isArray) return [];
+					const target = `${qualified(table)}.${column.name}`;
+					return [{
+						message: `blocks.${adopted.module} is in adopt mode and writes text into ${target} (${adopted.logical}.${logical}), which is the enum ${column.typeSchema}.${column.udt}. Postgres does not cast text to an enum, so the module's functions fail. Change the column to text with a check constraint on its values.`,
+						target
+					}];
+				});
+			});
+		}
+	},
 	{
 		code: "BS341",
 		severity: "warning",
@@ -246,331 +272,6 @@ const FLAG_RULES = [{
 	check: expiredFlags
 }];
 //#endregion
-//#region src/cli/doctor/reserved-roles.ts
-/**
-* supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
-* drop or change the memberships of these.
-*/
-const RESERVED_ROLES = /* @__PURE__ */ new Set([
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_functions_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"dashboard_user",
-	"pgbouncer"
-]);
-/** Reserved roles whose settings (`alter role ... set`) supautils allows changing. */
-const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
-	"authenticator",
-	"authenticated",
-	"anon",
-	"service_role"
-]);
-/**
-* Roles that Supabase's own services log in as. Their statements (PostgREST's
-* schema cache query, Auth and Storage migrations) aren't the app's.
-*/
-const PLATFORM_ROLES = /* @__PURE__ */ new Set([...RESERVED_ROLES, "authenticator"]);
-/** Comments and string literals blanked, newlines kept so offsets map to lines. */
-const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
-const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
-/** Why a statement changes a reserved role, or undefined when it doesn't. */
-function reservedRoleChange(statement) {
-	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
-	if (alter) {
-		const role = roleNames(alter[2])[0];
-		const verb = alter[1].toLowerCase();
-		const next = alter[3].toLowerCase();
-		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
-		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
-		return;
-	}
-	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
-	if (!membership) return;
-	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
-	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
-}
-/** Where a statement ends, including statements inside `do` blocks and function bodies. */
-const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
-/** Statements in schema files and migrations that supautils rejects on Supabase. */
-function reservedRoles(context) {
-	return (context.sqlFiles ?? []).flatMap((file) => {
-		const code = sqlCode(file.text);
-		const findings = [];
-		let start = 0;
-		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
-			const until = end?.index ?? code.length;
-			const statement = code.slice(start, until);
-			const reason = reservedRoleChange(statement);
-			if (reason !== void 0) {
-				const at = start + statement.search(/\S/);
-				const line = code.slice(0, at).split("\n").length;
-				findings.push({
-					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
-					target: `${file.path}:${String(line)}`,
-					location: {
-						file: file.path,
-						line
-					}
-				});
-			}
-			start = until + (end?.[0].length ?? 0);
-		}
-		return findings;
-	});
-}
-//#endregion
-//#region src/cli/doctor/live.ts
-/** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
-const SLOW_MEAN_MS = 50;
-const SLOW_CALLS = 1e3;
-/** Rows `--explain` reads, like a `findMany()` under Supabase's default `max_rows`. */
-const EXPLAIN_LIMIT = 1e3;
-const escape$1 = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
-const ident$1 = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
-const literal$1 = (text) => `'${text.replaceAll("'", "''")}'`;
-const oneLine = (query, max = 160) => {
-	const flat = query.replaceAll(/\s+/g, " ").trim();
-	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
-};
-const plural$1 = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
-const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-/** The schema `pg_stat_statements` lives in, when the extension is installed. */
-async function statementsView(db) {
-	const [row] = await db.query(`select n.nspname as schema from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'`);
-	return row ? `${ident$1(row.schema)}.pg_stat_statements` : void 0;
-}
-/** The first exposed table a statement names, to locate it in the SQL files. */
-function tableIn(query, tables) {
-	return tables.find((table) => {
-		const schema = escape$1(table.schema);
-		const name = escape$1(table.name);
-		return new RegExp(`(?:"${schema}"|\\b${schema})\\.(?:"${name}"|${name}\\b)`).test(query);
-	});
-}
-const live = (context) => context.database;
-/**
-* Function calls and self time so far in this transaction. The view can
-* still hold unflushed counts from earlier transactions, so callers diff two
-* readings.
-*/
-async function functionTimes(db) {
-	const rows = await db.query(`select schemaname || '.' || funcname as name, calls, self_time from pg_stat_xact_user_functions`);
-	return new Map(rows.map((row) => [row.name, {
-		calls: Number(row.calls),
-		selfTime: Number(row.self_time)
-	}]));
-}
-/** Node types, timings and loops of an `EXPLAIN (ANALYZE, FORMAT JSON)` plan; never rows. */
-function summarizePlan(output) {
-	const nodes = [];
-	const perRowSubPlans = [];
-	let initPlans = 0;
-	const walk = (node) => {
-		const loops = node["Actual Loops"] ?? 1;
-		const ms = (node["Actual Total Time"] ?? 0).toFixed(2);
-		const on = node["Relation Name"] ? ` on ${node["Relation Name"]}` : "";
-		const sub = node["Subplan Name"] ? `${node["Subplan Name"]}: ` : "";
-		nodes.push(`${sub}${node["Node Type"]}${on} ${ms} ms ×${loops}`);
-		if (node["Parent Relationship"] === "InitPlan") initPlans += 1;
-		if (node["Parent Relationship"] === "SubPlan" && loops > 1) perRowSubPlans.push(`${sub}${node["Node Type"]}${on} ×${loops}`);
-		for (const child of node.Plans ?? []) walk(child);
-	};
-	walk(output.Plan);
-	return {
-		nodes,
-		initPlans,
-		perRowSubPlans,
-		executionMs: output["Execution Time"] ?? 0
-	};
-}
-const ROLE = /^[a-z_][a-z0-9_]*$/;
-async function explainTable(db, table, claims) {
-	const role = typeof claims["role"] === "string" ? claims["role"] : "anon";
-	if (!ROLE.test(role)) throw new Error(`Invalid role "${role}" in the claims`);
-	await db.query("begin");
-	try {
-		await db.query(`set local statement_timeout = '30s'`);
-		let tracked = true;
-		await db.query("savepoint bs_track");
-		try {
-			await db.query(`set local track_functions = 'all'`);
-			await db.query("release savepoint bs_track");
-		} catch {
-			tracked = false;
-			await db.query("rollback to savepoint bs_track");
-		}
-		await db.query(`select set_config('request.jwt.claims', ${literal$1(JSON.stringify(claims))}, true)`);
-		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
-		await db.query(`set local role ${ident$1(role)}`);
-		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident$1(table.schema)}.${ident$1(table.name)} limit ${EXPLAIN_LIMIT}`);
-		const raw = row?.["QUERY PLAN"];
-		const plan = typeof raw === "string" ? JSON.parse(raw) : raw;
-		if (!plan?.[0]) throw new Error("EXPLAIN returned no plan");
-		const functions = tracked ? [...await functionTimes(db)].map(([name, after]) => {
-			const start = before.get(name);
-			return {
-				name,
-				calls: after.calls - (start?.calls ?? 0),
-				selfTime: after.selfTime - (start?.selfTime ?? 0)
-			};
-		}).filter((fn) => fn.calls > 0).sort((a, b) => b.selfTime - a.selfTime) : void 0;
-		return {
-			summary: summarizePlan(plan[0]),
-			functions
-		};
-	} finally {
-		await db.query("rollback");
-	}
-}
-function resolveTable(context, name) {
-	return name.includes(".") ? catalogOf(context).tables.find((table) => qualified(table) === name) : exposed(context).find((table) => table.name === name);
-}
-const LIVE_RULES = [
-	{
-		code: "BS208",
-		severity: "warning",
-		title: "Queries spill to temporary files",
-		description: "Sorts and hashes that exceed `work_mem` write temporary files, which is slow. Reads `pg_stat_database` and, when installed, the top statements from `pg_stat_statements`. When every statement that spilled ran as a Supabase service role (PostgREST's schema cache query as `authenticator`, Auth or Storage) or came from better-supabase's own catalog reads (`introspect`, `gen`, `doctor`), there is no finding.",
-		async check(context) {
-			const db = live(context);
-			if (!db || "skipped" in db) return [];
-			try {
-				const [stats] = await db.query(`select temp_files, temp_bytes, current_setting('work_mem') as work_mem from pg_stat_database where datname = current_database()`);
-				const files = Number(stats?.temp_files ?? 0);
-				if (files === 0) return [];
-				let top = "";
-				const view = await statementsView(db);
-				if (view) {
-					const spilled = await db.query(`select s.query, s.temp_blks_written, r.rolname as role from ${view} s left join pg_roles r on r.oid = s.userid where s.temp_blks_written > 0 order by s.temp_blks_written desc limit 50`).catch(() => []);
-					const statements = spilled.filter((statement) => !statement.query.startsWith("/* better-supabase */") && (statement.role === null || !PLATFORM_ROLES.has(statement.role))).slice(0, 5);
-					if (spilled.length > 0 && statements.length === 0) return [];
-					if (statements.length > 0) top = ` Top statements by temporary blocks written: ${statements.map((statement) => `${oneLine(statement.query, 100)} (${statement.temp_blks_written} blocks)`).join("; ")}.`;
-				}
-				return [{
-					message: `${files} temporary files (${megabytes(Number(stats?.temp_bytes ?? 0))}) since the statistics were reset; work_mem is ${stats?.work_mem}. Add indexes so large sorts go away, or raise work_mem for the role that runs them.${top}`,
-					target: "pg_stat_database:temp_files"
-				}];
-			} catch (cause) {
-				return [{
-					severity: "info",
-					message: `Could not read pg_stat_database (${db.describe}): ${errorText(cause)}`
-				}];
-			}
-		}
-	},
-	{
-		code: "BS209",
-		severity: "warning",
-		title: "Slow frequent statements",
-		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
-		async check(context) {
-			if (!context.stats) return [];
-			const db = live(context);
-			if (!db) return [];
-			if ("skipped" in db) return [{
-				severity: "info",
-				message: `Skipped --stats: ${db.skipped}`
-			}];
-			try {
-				const view = await statementsView(db);
-				if (!view) return [{
-					severity: "info",
-					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
-				}];
-				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
-				const tables = exposed(context);
-				return statements.map((statement) => {
-					const table = tableIn(statement.query, tables);
-					return {
-						message: `${Number(statement.mean_exec_time).toFixed(1)} ms mean over ${statement.calls} calls: ${oneLine(statement.query)}`,
-						target: `pg_stat_statements:${statement.queryid}`,
-						...table ? { object: tableObject(table) } : {}
-					};
-				});
-			} catch (cause) {
-				return [{
-					severity: "info",
-					message: `Could not read pg_stat_statements (${db.describe}): ${errorText(cause)}`
-				}];
-			}
-		}
-	},
-	{
-		code: "BS225",
-		severity: "info",
-		title: "pg_stat_statements is not installed",
-		description: "`pg_stat_statements` records the time and calls of each statement, which `--stats` (BS209), BS208 and the Supabase query performance report read. Without it there is no record of which queries are slow. Needs a database; saved snapshots skip it.",
-		async check(context) {
-			const db = live(context);
-			if (!db || "skipped" in db) return [];
-			if (context.stats && context.codes?.includes("BS209")) return [];
-			try {
-				if (await statementsView(db)) return [];
-			} catch {
-				return [];
-			}
-			return [{
-				message: `pg_stat_statements is not installed on the ${db.describe}, so nothing records which statements are slow. Run \`create extension if not exists pg_stat_statements with schema extensions;\` in a migration.`,
-				target: "extension:pg_stat_statements"
-			}];
-		}
-	},
-	{
-		code: "BS212",
-		severity: "info",
-		title: "RLS plan for a table",
-		description: `\`--explain <tables>\` runs \`EXPLAIN (ANALYZE, BUFFERS)\` on \`select * from <table> limit ${EXPLAIN_LIMIT}\` as the given claims, in a transaction that is rolled back. It reports node types, timings and loops, never rows, and warns when a policy SubPlan runs once per row.`,
-		async check(context) {
-			const request = context.explain;
-			if (!request) return [];
-			const db = live(context);
-			if (!db || "skipped" in db || !db.session) return [{
-				severity: "warning",
-				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
-			}];
-			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
-			const findings = [];
-			for (const name of request.tables) {
-				const table = resolveTable(context, name);
-				if (!table) {
-					findings.push({
-						severity: "warning",
-						message: `--explain: no table "${name}" in the exposed schemas; qualify tables in other schemas, like better_supabase.memberships.`
-					});
-					continue;
-				}
-				try {
-					const { summary, functions } = await explainTable(db, table, request.claims);
-					const helpers = functions ? functions.length > 0 ? ` Function time: ${functions.map((fn) => {
-						const self = fn.selfTime;
-						const share = summary.executionMs > 0 ? Math.round(self / summary.executionMs * 100) : 0;
-						return `${fn.name} ${self.toFixed(2)} ms over ${plural$1(fn.calls, "call")} (${share}%)`;
-					}).join(", ")}.` : " No tracked function ran; inlined SQL functions are part of the plan." : " Function times need `track_functions`, which this role may not set; showing the plan only.";
-					const perRow = summary.perRowSubPlans.length > 0 ? ` Per-row SubPlans: ${summary.perRowSubPlans.join(", ")}; wrap the policy's function calls in \`(select ...)\` so they run once as an InitPlan.` : "";
-					findings.push({
-						...summary.perRowSubPlans.length > 0 ? { severity: "warning" } : {},
-						message: `${qualified(table)} as ${who}: ${summary.executionMs.toFixed(2)} ms, ${plural$1(summary.initPlans, "InitPlan")}. Plan: ${summary.nodes.join(" > ")}.${perRow}${helpers}`,
-						target: `${qualified(table)}:explain`,
-						object: tableObject(table)
-					});
-				} catch (cause) {
-					findings.push({
-						severity: "warning",
-						message: `--explain ${qualified(table)} failed: ${errorText(cause)}`,
-						target: `${qualified(table)}:explain`
-					});
-				}
-			}
-			return findings;
-		}
-	}
-];
-//#endregion
 //#region src/cli/doctor/hooks.ts
 /** Claims past this size make every request carry a large cookie and header. */
 const HOOK_CLAIMS_LIMIT = 2048;
@@ -2239,7 +1940,7 @@ const POLICY_RULES = [
 						const dot = name.indexOf(".");
 						const schema = name.slice(0, dot);
 						if (schema === "auth" || volatility.get(name) === "immutable") return false;
-						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$2(schema)}"?\\.)?"?${escape$2(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
+						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$1(schema)}"?\\.)?"?${escape$1(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
 					});
 					if (bare.length === 0) return [];
 					return [{
@@ -2295,7 +1996,7 @@ const APP_COLUMN_FORMAT = {
 */
 const skipsNullKeys = (predicate, columns) => {
 	if (!predicate) return false;
-	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$2(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
+	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$1(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
 };
 /** Whether the first `columns.length` columns of an index are exactly `columns`, in any order, and it holds every row that references something. */
 const covers = (index, columns) => (!index.partial || skipsNullKeys(index.predicate, columns)) && index.columns.length >= columns.length && index.columns.slice(0, columns.length).every((column) => columns.includes(column));
@@ -2386,7 +2087,7 @@ const SCHEMA_DESIGN_RULES = [
 			if (table.kind !== "table") return [];
 			const column = table.columns.find((entry) => SOFT_DELETE.test(entry.name) && entry.nullable);
 			if (!column) return [];
-			const isNull = new RegExp(`"?${escape$2(column.name)}"?\\s+IS\\s+NULL`, "i");
+			const isNull = new RegExp(`"?${escape$1(column.name)}"?\\s+IS\\s+NULL`, "i");
 			if (table.indexes.some((index) => index.partial && (index.predicate === void 0 || index.predicate !== null && isNull.test(index.predicate)))) return [];
 			return [{
 				message: `${qualified(table)} soft-deletes with ${column.name}, but no index has \`where ${column.name} is null\`. Index the live rows you list, for example \`create index on ${qualified(table)} (created_at desc) where ${column.name} is null;\`.`,
@@ -2411,7 +2112,7 @@ const SCHEMA_DESIGN_RULES = [
 				return table.columns.filter((column) => {
 					if (!column.isArray && column.udt !== "jsonb") return false;
 					if (table.indexes.some((index) => index.columns[0] === column.name && (index.method === void 0 || index.method === "gin"))) return false;
-					const used = new RegExp(`"?${escape$2(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$2(column.name)}\\b`);
+					const used = new RegExp(`"?${escape$1(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$1(column.name)}\\b`);
 					return filtered.has(column.name) || used.test(own) || functions.includes(table.name) && used.test(functions);
 				}).map((column) => ({
 					message: `${qualified(table)}.${column.name} is filtered by containment but has no GIN index, so each query scans the table. Run \`create index on ${qualified(table)} using gin (${column.name}${column.udt === "jsonb" ? " jsonb_path_ops" : ""});\`${column.udt === "jsonb" ? " (`jsonb_path_ops` supports `@>` only; drop it for `?`)" : ""}.`,
@@ -2732,7 +2433,7 @@ const RULES = [
 				return exposed(context).flatMap((table) => {
 					const options = configFor(context.config.tables, table.schema, table.name);
 					if (options?.exclude) return [];
-					const granted = (role) => new Set(table.grants.filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
+					const granted = (role) => new Set([...table.grants, ...table.columnGrants ?? []].filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
 					if (options?.serviceRole) {
 						const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && grant.privileges.length > 0);
 						return ["anon", "authenticated"].flatMap((role) => {
@@ -3147,7 +2848,8 @@ const RULES = [
 	...WORKFLOW_BUILDER_RULES,
 	...FLAG_RULES,
 	...REALTIME_RULES,
-	...ADOPTION_RULES
+	...ADOPTION_RULES,
+	...MIGRATION_SAFETY_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {

package/dist/cli/{emit-ZAYeh4Yn.js → emit-j0zZ6NE_.js}

@@ -1,6 +1,7 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { s as restrictSchemas, u as tsTypeOf } from "./typegen--TfvOPLh.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
 import { t as toCatalog } from "./catalog-Di15TkM2.js";
 import { resolveProviderSql } from "better-supabase/sql";
 import { DEFAULT_CLAIMS, tenantClaimPaths } from "better-supabase/config";
@@ -401,6 +402,20 @@ const TEXT_UDTS = /* @__PURE__ */ new Set([
 	"bpchar"
 ]);
 /** `config.storagePaths` resolved to bucket ids, with a check that every key is used. */
+function numberedColumnsOf(config) {
+	const columns = /* @__PURE__ */ new Map();
+	const block = config.blocks["number-sequences"];
+	if (!config.blockNames.includes("number-sequences") || block?.mode === "custom" || !isRecord(block?.options?.["entities"])) return columns;
+	for (const entry of Object.values(block.options["entities"])) {
+		if (!isRecord(entry) || typeof entry["table"] !== "string" || typeof entry["column"] !== "string") continue;
+		const key = entry["table"].includes(".") ? entry["table"] : `public.${entry["table"]}`;
+		const set = columns.get(key) ?? /* @__PURE__ */ new Set();
+		set.add(entry["column"]);
+		if (typeof entry["sequenceColumn"] === "string") set.add(entry["sequenceColumn"]);
+		columns.set(key, set);
+	}
+	return columns;
+}
 function storagePathsOf(config) {
 	const bucketId = (name) => {
 		const bucket = config.buckets[name];
@@ -474,6 +489,7 @@ function prepareCatalog(snapshot, config) {
 function draftTables(ctx) {
 	const { config, included, enumsByName, tsType, jsonTypeFor, optionsOf } = ctx;
 	const storagePaths = storagePathsOf(config);
+	const numbered = numberedColumnsOf(config);
 	const tables = included.map((table) => {
 		const casing = optionsOf(table)?.casing ?? config.casing;
 		const checks = /* @__PURE__ */ new Map();
@@ -485,6 +501,7 @@ function draftTables(ctx) {
 		}
 		const beforeInsert = table.triggers.some((trigger) => trigger.timing === "before" && trigger.level === "row" && trigger.events.includes("insert"));
 		const insertOptional = new Set(optionsOf(table)?.insertOptional);
+		const numberedColumns = numbered.get(`${table.schema}.${table.name}`);
 		for (const name of insertOptional) if (!table.columns.some((column) => column.name === name)) throw new TypeError(`tables.${table.name}.insertOptional: "${name}" is not a column of ${table.schema}.${table.name}`);
 		const columns = table.columns.map((column) => {
 			const values = (column.isEnum ? enumsByName.get(`${column.typeSchema}.${column.udt}`) : void 0) ?? checks.get(column.name);
@@ -497,10 +514,11 @@ function draftTables(ctx) {
 			const readonly = column.generated || column.identity === "always";
 			const narrowed = column.nullable && checkedNotNull.has(column.name);
 			const nullable = column.nullable && !narrowed;
-			const filled = column.hasDefault || insertOptional.has(column.name) || narrowed && beforeInsert;
+			const filled = column.hasDefault || insertOptional.has(column.name) || (numberedColumns?.has(column.name) ?? false) || narrowed && beforeInsert;
 			const insertable = !readonly && table.insertable && (table.kind !== "view" || column.updatable);
 			const updatable = !readonly && table.updatable && column.updatable;
 			return {
+				...table.schema === "public" && config.appTables[table.name]?.columns?.[column.name]?.access === "server" ? { selectable: false } : {},
 				app: applyCasing(column.name, casing),
 				db: column.name,
 				snapshot: column,
@@ -622,6 +640,7 @@ function toTableModels(ctx, tables, relations) {
 			if (column.snapshot.identity) meta.identity = column.snapshot.identity;
 			if (!column.readonly && !column.insertable) meta.insertable = false;
 			if (!column.readonly && !column.updatable) meta.updatable = false;
+			if (column.selectable === false) meta.selectable = false;
 			if (column.snapshot.isArray) meta.array = true;
 			if (column.json) meta.json = true;
 			if (column.values) meta.enum = column.values;
@@ -822,7 +841,7 @@ function realtimeMeta(names, users, tables) {
 //#region src/cli/gen/emit.ts
 const GENERATED_HEADER = "// @generated by better-supabase gen. Do not edit; run `better-supabase gen` instead.";
 function rowEntries(columns, name) {
-	return columns.map((column) => `${prop(column[name])}: ${nullable(column.tsType, column.nullable)};`);
+	return columns.map((column) => `${prop(column[name])}${column.selectable === false ? "?" : ""}: ${nullable(column.tsType, column.nullable)};`);
 }
 function insertEntries(columns, name) {
 	return columns.map((column) => {

package/dist/cli/{env-CVXvJoLP.js → env-2v9JrxSr.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { r as readIfExists, t as display } from "./io-BiPX-_J1.js";
-import { n as readStackStatus, t as parseStackStatus } from "./stack-status-CRanl-CN.js";
+import { n as readStackStatus, t as parseStackStatus } from "./stack-status-LeEoCtV1.js";
 import { n as applyPlan, o as insideRoot, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { r as publicPrefix, t as detectProject } from "./detect-DYDUBLU4.js";
+import { r as publicPrefix, t as detectProject } from "./detect-BeLVeNpA.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";