better-supabase 0.9.0 → 0.10.0

package/dist/cli/{env-DMw_MBe5.js → env-Cf5OTqbK.js}

@@ -297,6 +297,7 @@ function url(message$1) {
 		}
 	};
 }
+const ABORT_EARLY_CONFIG = { abortEarly: true };
 /**
 * Returns the fallback value of the schema.
 *
@@ -323,6 +324,19 @@ function getFallback(schema, dataset, config$1) {
 function getDefault(schema, dataset, config$1) {
 	return typeof schema.default === "function" ? schema.default(dataset, config$1) : schema.default;
 }
+/**
+* Checks if the input matches the schema. By using a type predicate, this
+* function can be used as a type guard.
+*
+* @param schema The schema to be used.
+* @param input The input to be tested.
+*
+* @returns Whether the input matches the schema.
+*/
+/* @__NO_SIDE_EFFECTS__ */
+function is(schema, input) {
+	return !schema["~run"]({ value: input }, ABORT_EARLY_CONFIG).issues;
+}
 /* @__NO_SIDE_EFFECTS__ */
 function array(item, message$1) {
 	return _standardSchema({
@@ -401,6 +415,21 @@ function custom(check$1, message$1) {
 		}
 	});
 }
+/* @__NO_SIDE_EFFECTS__ */
+function exactOptional(wrapped, default_) {
+	return _standardSchema({
+		kind: "schema",
+		type: "exact_optional",
+		reference: exactOptional,
+		expects: wrapped.expects,
+		async: false,
+		wrapped,
+		default: default_,
+		"~run"(dataset, config$1) {
+			return this.wrapped["~run"](dataset, config$1);
+		}
+	});
+}
 /**
 * Creates a lazy schema.
 *
@@ -478,6 +507,68 @@ function number(message$1) {
 	});
 }
 /* @__NO_SIDE_EFFECTS__ */
+function object(entries$1, message$1) {
+	return _standardSchema({
+		kind: "schema",
+		type: "object",
+		reference: object,
+		expects: "Object",
+		async: false,
+		entries: entries$1,
+		message: message$1,
+		"~run"(dataset, config$1) {
+			const input = dataset.value;
+			if (input && typeof input === "object") {
+				dataset.typed = true;
+				dataset.value = {};
+				for (const key in this.entries) {
+					const valueSchema = this.entries[key];
+					if (key in input || (valueSchema.type === "exact_optional" || valueSchema.type === "optional" || valueSchema.type === "nullish") && valueSchema.default !== void 0) {
+						const value$1 = key in input ? input[key] : /* @__PURE__ */ getDefault(valueSchema);
+						const valueDataset = valueSchema["~run"]({ value: value$1 }, config$1);
+						if (valueDataset.issues) {
+							const pathItem = {
+								type: "object",
+								origin: "value",
+								input,
+								key,
+								value: value$1
+							};
+							for (const issue of valueDataset.issues) {
+								if (issue.path) issue.path.unshift(pathItem);
+								else issue.path = [pathItem];
+								dataset.issues?.push(issue);
+							}
+							if (!dataset.issues) dataset.issues = valueDataset.issues;
+							if (config$1.abortEarly) {
+								dataset.typed = false;
+								break;
+							}
+						}
+						if (!valueDataset.typed) dataset.typed = false;
+						dataset.value[key] = valueDataset.value;
+					} else if (valueSchema.fallback !== void 0) dataset.value[key] = /* @__PURE__ */ getFallback(valueSchema);
+					else if (valueSchema.type !== "exact_optional" && valueSchema.type !== "optional" && valueSchema.type !== "nullish") {
+						_addIssue(this, "key", dataset, config$1, {
+							input: void 0,
+							expected: `"${key}"`,
+							path: [{
+								type: "object",
+								origin: "key",
+								input,
+								key,
+								value: input[key]
+							}]
+						});
+						if (config$1.abortEarly) break;
+					}
+				}
+			} else _addIssue(this, "type", dataset, config$1);
+			return dataset;
+		}
+	});
+}
+/* @__NO_SIDE_EFFECTS__ */
 function objectWithRest(entries$1, rest, message$1) {
 	return _standardSchema({
 		kind: "schema",
@@ -993,4 +1084,4 @@ function parseEnv(env) {
 	};
 }
 //#endregion
-export { record as C, string as D, strictObject as E, union as O, rawCheck as S, safeParse as T, number as _, array as a, picklist as b, getDotPath as c, literal as d, maxLength as f, nullable as g, minValue as h, parseEnv as i, unknown as k, integer as l, minLength as m, configEnvironment as n, boolean as o, maxValue as p, isCi as r, custom as s, PROCESS_ENV as t, lazy as u, objectWithRest as v, regex as w, pipe as x, optional as y };
+export { string as A, picklist as C, regex as D, record as E, unknown as M, safeParse as O, optional as S, rawCheck as T, minValue as _, array as a, object as b, exactOptional as c, is as d, lazy as f, minLength as g, maxValue as h, parseEnv as i, union as j, strictObject as k, getDotPath as l, maxLength as m, configEnvironment as n, boolean as o, literal as p, isCi as r, custom as s, PROCESS_ENV as t, integer as u, nullable as v, pipe as w, objectWithRest as x, number as y };

package/dist/cli/{env-DJ4ZaJpe.js → env-Ch99nTQw.js}

@@ -1 +1 @@
-export { t as PROCESS_ENV, n as configEnvironment, r as isCi, i as parseEnv } from "./env-DMw_MBe5.js";
+export { t as PROCESS_ENV, n as configEnvironment, r as isCi, i as parseEnv } from "./env-Cf5OTqbK.js";

package/dist/cli/env-DkBe35Rv.js

@@ -0,0 +1 @@
+export { t as envCommand } from "./env-2v9JrxSr.js";

package/dist/cli/{gen-B344S1Oy.js → gen-BhquLu7l.js}

@@ -1,17 +1,17 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { a as parseNames, i as failedResult, n as CliError } from "./errors-Caiz_0so.js";
-import { a as catalogFingerprint } from "./cache-Cx6qlRDR.js";
-import { n as runGen } from "./run-DaHfUUO9.js";
+import { a as catalogFingerprint } from "./cache-CPBYJAkb.js";
+import { n as runGen } from "./run-DliGNdjI.js";
 import { r as isGenTask, t as GEN_TASKS } from "./names-D6LrQnOv.js";
-import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
-import { i as sourceFlags, n as SOURCE_ARGS, r as sourceArgs } from "./source-args-0I9zylYy.js";
-import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-CxBZo4KM.js";
-import { r as runEnv } from "./env-CVXvJoLP.js";
-import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-CaaSOYZS.js";
-import { t as runScaffoldApi } from "./scaffold-CFdDq36-.js";
-import { t as runSeed } from "./seed-DldDdXWO.js";
-import { t as runSql } from "./sql-DDLWwzh9.js";
+import { o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { i as sourceFlags, n as SOURCE_ARGS, r as sourceArgs } from "./source-args-BNhagtpw.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-DikbSOE0.js";
+import { r as runEnv } from "./env-2v9JrxSr.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-BewE6r6J.js";
+import { t as runScaffoldApi } from "./scaffold-6bv24GSP.js";
+import { t as runSeed } from "./seed-CIJaL1Ao.js";
+import { t as runSql } from "./sql-BBkchli4.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/commands/gen-pipeline.ts

package/dist/cli/index.d.ts

@@ -424,10 +424,10 @@ export declare function renderFiles(config: ResolvedConfig, snapshot: Snapshot,
 //#region src/cli/gen/blocks.d.ts
 /**
  * `blocks.generated.ts`: each installed block's schema, API schema and the
- * options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`.
- * `undefined` when the config installs no blocks.
+ * options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`,
+ * and the app table events. `undefined` when the config installs no blocks.
  */
-export declare function emitBlockConfig(config: Pick<ResolvedConfig, "blocks" | "blockNames" | "output" | "sql">, options?: {
+export declare function emitBlockConfig(config: Pick<ResolvedConfig, "appTables" | "blocks" | "blockNames" | "output" | "sql">, options?: {
   readonly runtimeImport?: string;
 }): GeneratedFile | undefined;
 //#endregion
@@ -591,6 +591,8 @@ interface ColumnModel {
   readonly storage: string | undefined;
   readonly insertable: boolean;
   readonly updatable: boolean;
+  /** `false` for an app table column with `access: "server"`. */
+  readonly selectable?: false;
 }
 interface RelationModel {
   readonly name: string;
@@ -684,6 +686,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.9.0";
+export declare const VERSION = "0.10.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,12 +1,12 @@
-import { a as list, r as defineCliCommand } from "./command-CK9Cn8HV.js";
-import { i as run, n as createCli, r as help, t as commandNames } from "./run-CM_2g6KQ.js";
-import { t as VERSION } from "./version-DNRW4DAP.js";
+import { a as list, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { i as run, n as createCli, r as help, t as commandNames } from "./run-BLJj7SuM.js";
+import { t as VERSION } from "./version-D1wM9DNb.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-Caiz_0so.js";
 import { t as toCatalog } from "./catalog-Di15TkM2.js";
-import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-ZAYeh4Yn.js";
-import { A as renderFiles, j as emitBlockConfig, n as runGen } from "./run-DaHfUUO9.js";
-import { s as loadConfig } from "./config-CLHpTk9Y.js";
-import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { a as buildModel, r as emitModule, t as GENERATED_HEADER } from "./emit-j0zZ6NE_.js";
+import { S as emitBlockConfig, n as runGen, x as renderFiles } from "./run-DliGNdjI.js";
+import { s as loadConfig } from "./config-Bi_UBxXl.js";
+import { a as serializeSnapshot, d as managementSource, f as pgSource, i as parseSnapshot, l as introspect, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-B1dL-RZL.js → init-BwLTO6XG.js}

@@ -1,14 +1,15 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-BNBPI4Eu.js";
-import { a as findConfig, s as loadConfig } from "./config-CLHpTk9Y.js";
+import { a as findConfig, s as loadConfig } from "./config-Bi_UBxXl.js";
 import { n as applyPlan, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-B0zoJUYX.js";
-import { n as installCommand, t as detectProject } from "./detect-DYDUBLU4.js";
-import { s as enablePgDelta } from "./write-BS6F3Yvz.js";
+import { _ as suggestedIntegrations, a as CANCELLED, c as overwrite, d as templateContextFor, f as templatePlan, g as resolveIntegrations, h as needsLib, l as packagesFor, m as baseFiles, n as blockConfigImport, o as chooseIntegrations, p as TEMPLATES, r as blocksWiringPath, s as integrationFiles, u as parseIntegrations } from "./add-CUS0AiBh.js";
+import { n as installCommand, t as detectProject } from "./detect-BeLVeNpA.js";
+import { s as enablePgDelta } from "./write-Dp1XlAVM.js";
+import { n as latestMigrationVersion } from "./migration-safety-LaGVPPuD.js";
 import { a as CONVENTION_COMPLETIONS, c as hasConventionFlags, i as CONVENTION_ARGS, l as promptConventions, n as AUTHZ_NOTE, o as conventionFlags, r as createUrlParam, s as defaultConventions, t as writeDesign, u as withConventions } from "./design-edit-B-WsnhUF.js";
-import { t as syncModules } from "./sync-DFx-6t5n.js";
+import { t as syncModules } from "./sync-CJ-ft-tl.js";
 import { existsSync } from "node:fs";
 import { join, posix, resolve } from "node:path";
 import { glob, readFile } from "node:fs/promises";
@@ -271,12 +272,18 @@ async function runInit(config, args, prompts, now = () => /* @__PURE__ */ new Da
 	let generated = posix.normalize(posix.join(project.srcDir, "lib/supabase/generated.ts"));
 	if (hasConfig) generated = inPackage ? (await loadConfig(root)).output : config.output;
 	const templateContext = templateContextFor(project, generated);
+	const migrationSince = await latestMigrationVersion(root) ?? await latestMigrationVersion(config.root);
+	const since = migrationSince === void 0 ? {} : { migrationSince };
 	const files = withDesign([
 		...baseFiles(templateContext, casing, needsLib(integrations), integrations, workflow, chosen?.value, chosen === null ? {
 			...keys.sql === void 0 ? {} : { sql: keys.sql },
 			...keys.blocks === void 0 ? {} : { blocks: keys.blocks },
-			provider: conventions.access === "provider"
-		} : { provider: conventions.access === "provider" }),
+			provider: conventions.access === "provider",
+			...since
+		} : {
+			provider: conventions.access === "provider",
+			...since
+		}),
 		...integrationFiles(integrations, templateContext),
 		...chosen === null ? [] : [{
 			path: blocksWiringPath(templateContext),

package/dist/cli/{introspect-BPcFi8ow.js → introspect-B-gXAIqs.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { c as serializeGenerator, s as restrictSchemas } from "./typegen--TfvOPLh.js";
-import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { a as serializeSnapshot, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
 import { n as applyPlan, o as insideRoot, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-0I9zylYy.js";
+import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-BNhagtpw.js";
 //#region src/cli/commands/introspect.ts
 const ARGS = {
 	out: {

package/dist/cli/{keys-jsxCNJdz.js → keys-hwtdwdkT.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
 import { t as display } from "./io-BiPX-_J1.js";
 import { m as supabaseDir } from "./supabase-toml-DjLgBYEo.js";
 import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";

package/dist/cli/live-BFfYoE0_.js

@@ -0,0 +1,329 @@
+import { r as errorText } from "./errors-Caiz_0so.js";
+import "./snapshot-Dvcx0BSl.js";
+import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-CNcvDOLt.js";
+//#region src/cli/doctor/reserved-roles.ts
+/**
+* supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
+* drop or change the memberships of these.
+*/
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_functions_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer"
+]);
+/** Reserved roles whose settings (`alter role ... set`) supautils allows changing. */
+const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"authenticated",
+	"anon",
+	"service_role"
+]);
+/**
+* Roles that Supabase's own services log in as. Their statements (PostgREST's
+* schema cache query, Auth and Storage migrations) aren't the app's.
+*/
+const PLATFORM_ROLES = /* @__PURE__ */ new Set([...RESERVED_ROLES, "authenticator"]);
+/** Comments and string literals blanked, newlines kept so offsets map to lines. */
+const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
+const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
+/** Why a statement changes a reserved role, or undefined when it doesn't. */
+function reservedRoleChange(statement) {
+	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
+	if (alter) {
+		const role = roleNames(alter[2])[0];
+		const verb = alter[1].toLowerCase();
+		const next = alter[3].toLowerCase();
+		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
+		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
+		return;
+	}
+	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
+	if (!membership) return;
+	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
+	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
+}
+/** Where a statement ends, including statements inside `do` blocks and function bodies. */
+const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
+/** Statements in schema files and migrations that supautils rejects on Supabase. */
+function reservedRoles(context) {
+	return (context.sqlFiles ?? []).flatMap((file) => {
+		const code = sqlCode(file.text);
+		const findings = [];
+		let start = 0;
+		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
+			const until = end?.index ?? code.length;
+			const statement = code.slice(start, until);
+			const reason = reservedRoleChange(statement);
+			if (reason !== void 0) {
+				const at = start + statement.search(/\S/);
+				const line = code.slice(0, at).split("\n").length;
+				findings.push({
+					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
+					target: `${file.path}:${String(line)}`,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			start = until + (end?.[0].length ?? 0);
+		}
+		return findings;
+	});
+}
+//#endregion
+//#region src/cli/doctor/live.ts
+/** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
+const SLOW_MEAN_MS = 50;
+const SLOW_CALLS = 1e3;
+/** Rows `--explain` reads, like a `findMany()` under Supabase's default `max_rows`. */
+const EXPLAIN_LIMIT = 1e3;
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const ident = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const literal = (text) => `'${text.replaceAll("'", "''")}'`;
+const oneLine = (query, max = 160) => {
+	const flat = query.replaceAll(/\s+/g, " ").trim();
+	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+};
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+/** The schema `pg_stat_statements` lives in, when the extension is installed. */
+async function statementsView(db) {
+	const [row] = await db.query(`select n.nspname as schema from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'`);
+	return row ? `${ident(row.schema)}.pg_stat_statements` : void 0;
+}
+/** The first exposed table a statement names, to locate it in the SQL files. */
+function tableIn(query, tables) {
+	return tables.find((table) => {
+		const schema = escape(table.schema);
+		const name = escape(table.name);
+		return new RegExp(`(?:"${schema}"|\\b${schema})\\.(?:"${name}"|${name}\\b)`).test(query);
+	});
+}
+const live = (context) => context.database;
+/**
+* Function calls and self time so far in this transaction. The view can
+* still hold unflushed counts from earlier transactions, so callers diff two
+* readings.
+*/
+async function functionTimes(db) {
+	const rows = await db.query(`select schemaname || '.' || funcname as name, calls, self_time from pg_stat_xact_user_functions`);
+	return new Map(rows.map((row) => [row.name, {
+		calls: Number(row.calls),
+		selfTime: Number(row.self_time)
+	}]));
+}
+/** Node types, timings and loops of an `EXPLAIN (ANALYZE, FORMAT JSON)` plan; never rows. */
+function summarizePlan(output) {
+	const nodes = [];
+	const perRowSubPlans = [];
+	let initPlans = 0;
+	const walk = (node) => {
+		const loops = node["Actual Loops"] ?? 1;
+		const ms = (node["Actual Total Time"] ?? 0).toFixed(2);
+		const on = node["Relation Name"] ? ` on ${node["Relation Name"]}` : "";
+		const sub = node["Subplan Name"] ? `${node["Subplan Name"]}: ` : "";
+		nodes.push(`${sub}${node["Node Type"]}${on} ${ms} ms ×${loops}`);
+		if (node["Parent Relationship"] === "InitPlan") initPlans += 1;
+		if (node["Parent Relationship"] === "SubPlan" && loops > 1) perRowSubPlans.push(`${sub}${node["Node Type"]}${on} ×${loops}`);
+		for (const child of node.Plans ?? []) walk(child);
+	};
+	walk(output.Plan);
+	return {
+		nodes,
+		initPlans,
+		perRowSubPlans,
+		executionMs: output["Execution Time"] ?? 0
+	};
+}
+const ROLE = /^[a-z_][a-z0-9_]*$/;
+async function explainTable(db, table, claims) {
+	const role = typeof claims["role"] === "string" ? claims["role"] : "anon";
+	if (!ROLE.test(role)) throw new Error(`Invalid role "${role}" in the claims`);
+	await db.query("begin");
+	try {
+		await db.query(`set local statement_timeout = '30s'`);
+		let tracked = true;
+		await db.query("savepoint bs_track");
+		try {
+			await db.query(`set local track_functions = 'all'`);
+			await db.query("release savepoint bs_track");
+		} catch {
+			tracked = false;
+			await db.query("rollback to savepoint bs_track");
+		}
+		await db.query(`select set_config('request.jwt.claims', ${literal(JSON.stringify(claims))}, true)`);
+		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
+		await db.query(`set local role ${ident(role)}`);
+		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident(table.schema)}.${ident(table.name)} limit ${EXPLAIN_LIMIT}`);
+		const raw = row?.["QUERY PLAN"];
+		const plan = typeof raw === "string" ? JSON.parse(raw) : raw;
+		if (!plan?.[0]) throw new Error("EXPLAIN returned no plan");
+		const functions = tracked ? [...await functionTimes(db)].map(([name, after]) => {
+			const start = before.get(name);
+			return {
+				name,
+				calls: after.calls - (start?.calls ?? 0),
+				selfTime: after.selfTime - (start?.selfTime ?? 0)
+			};
+		}).filter((fn) => fn.calls > 0).sort((a, b) => b.selfTime - a.selfTime) : void 0;
+		return {
+			summary: summarizePlan(plan[0]),
+			functions
+		};
+	} finally {
+		await db.query("rollback");
+	}
+}
+function resolveTable(context, name) {
+	return name.includes(".") ? catalogOf(context).tables.find((table) => qualified(table) === name) : exposed(context).find((table) => table.name === name);
+}
+const LIVE_RULES = [
+	{
+		code: "BS208",
+		severity: "warning",
+		title: "Queries spill to temporary files",
+		description: "Sorts and hashes that exceed `work_mem` write temporary files, which is slow. Reads `pg_stat_database` and, when installed, the top statements from `pg_stat_statements`. When every statement that spilled ran as a Supabase service role (PostgREST's schema cache query as `authenticator`, Auth or Storage) or came from better-supabase's own catalog reads (`introspect`, `gen`, `doctor`), there is no finding.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			try {
+				const [stats] = await db.query(`select temp_files, temp_bytes, current_setting('work_mem') as work_mem from pg_stat_database where datname = current_database()`);
+				const files = Number(stats?.temp_files ?? 0);
+				if (files === 0) return [];
+				let top = "";
+				const view = await statementsView(db);
+				if (view) {
+					const spilled = await db.query(`select s.query, s.temp_blks_written, r.rolname as role from ${view} s left join pg_roles r on r.oid = s.userid where s.temp_blks_written > 0 order by s.temp_blks_written desc limit 50`).catch(() => []);
+					const statements = spilled.filter((statement) => !statement.query.startsWith("/* better-supabase */") && (statement.role === null || !PLATFORM_ROLES.has(statement.role))).slice(0, 5);
+					if (spilled.length > 0 && statements.length === 0) return [];
+					if (statements.length > 0) top = ` Top statements by temporary blocks written: ${statements.map((statement) => `${oneLine(statement.query, 100)} (${statement.temp_blks_written} blocks)`).join("; ")}.`;
+				}
+				return [{
+					message: `${files} temporary files (${megabytes(Number(stats?.temp_bytes ?? 0))}) since the statistics were reset; work_mem is ${stats?.work_mem}. Add indexes so large sorts go away, or raise work_mem for the role that runs them.${top}`,
+					target: "pg_stat_database:temp_files"
+				}];
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_database (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS209",
+		severity: "warning",
+		title: "Slow frequent statements",
+		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
+		async check(context) {
+			if (!context.stats) return [];
+			const db = live(context);
+			if (!db) return [];
+			if ("skipped" in db) return [{
+				severity: "info",
+				message: `Skipped --stats: ${db.skipped}`
+			}];
+			try {
+				const view = await statementsView(db);
+				if (!view) return [{
+					severity: "info",
+					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
+				}];
+				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
+				const tables = exposed(context);
+				return statements.map((statement) => {
+					const table = tableIn(statement.query, tables);
+					return {
+						message: `${Number(statement.mean_exec_time).toFixed(1)} ms mean over ${statement.calls} calls: ${oneLine(statement.query)}`,
+						target: `pg_stat_statements:${statement.queryid}`,
+						...table ? { object: tableObject(table) } : {}
+					};
+				});
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_statements (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS225",
+		severity: "info",
+		title: "pg_stat_statements is not installed",
+		description: "`pg_stat_statements` records the time and calls of each statement, which `--stats` (BS209), BS208 and the Supabase query performance report read. Without it there is no record of which queries are slow. Needs a database; saved snapshots skip it.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			if (context.stats && context.codes?.includes("BS209")) return [];
+			try {
+				if (await statementsView(db)) return [];
+			} catch {
+				return [];
+			}
+			return [{
+				message: `pg_stat_statements is not installed on the ${db.describe}, so nothing records which statements are slow. Run \`create extension if not exists pg_stat_statements with schema extensions;\` in a migration.`,
+				target: "extension:pg_stat_statements"
+			}];
+		}
+	},
+	{
+		code: "BS212",
+		severity: "info",
+		title: "RLS plan for a table",
+		description: `\`--explain <tables>\` runs \`EXPLAIN (ANALYZE, BUFFERS)\` on \`select * from <table> limit ${EXPLAIN_LIMIT}\` as the given claims, in a transaction that is rolled back. It reports node types, timings and loops, never rows, and warns when a policy SubPlan runs once per row.`,
+		async check(context) {
+			const request = context.explain;
+			if (!request) return [];
+			const db = live(context);
+			if (!db || "skipped" in db || !db.session) return [{
+				severity: "warning",
+				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
+			}];
+			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
+			const findings = [];
+			for (const name of request.tables) {
+				const table = resolveTable(context, name);
+				if (!table) {
+					findings.push({
+						severity: "warning",
+						message: `--explain: no table "${name}" in the exposed schemas; qualify tables in other schemas, like better_supabase.memberships.`
+					});
+					continue;
+				}
+				try {
+					const { summary, functions } = await explainTable(db, table, request.claims);
+					const helpers = functions ? functions.length > 0 ? ` Function time: ${functions.map((fn) => {
+						const self = fn.selfTime;
+						const share = summary.executionMs > 0 ? Math.round(self / summary.executionMs * 100) : 0;
+						return `${fn.name} ${self.toFixed(2)} ms over ${plural(fn.calls, "call")} (${share}%)`;
+					}).join(", ")}.` : " No tracked function ran; inlined SQL functions are part of the plan." : " Function times need `track_functions`, which this role may not set; showing the plan only.";
+					const perRow = summary.perRowSubPlans.length > 0 ? ` Per-row SubPlans: ${summary.perRowSubPlans.join(", ")}; wrap the policy's function calls in \`(select ...)\` so they run once as an InitPlan.` : "";
+					findings.push({
+						...summary.perRowSubPlans.length > 0 ? { severity: "warning" } : {},
+						message: `${qualified(table)} as ${who}: ${summary.executionMs.toFixed(2)} ms, ${plural(summary.initPlans, "InitPlan")}. Plan: ${summary.nodes.join(" > ")}.${perRow}${helpers}`,
+						target: `${qualified(table)}:explain`,
+						object: tableObject(table)
+					});
+				} catch (cause) {
+					findings.push({
+						severity: "warning",
+						message: `--explain ${qualified(table)} failed: ${errorText(cause)}`,
+						target: `${qualified(table)}:explain`
+					});
+				}
+			}
+			return findings;
+		}
+	}
+];
+//#endregion
+export { reservedRoles as i, ident as n, literal as r, LIVE_RULES as t };