better-supabase 0.9.0 → 0.11.0

package/dist/cli/{adopt-CebmlHL-.js → adopt-Ht34C3QD.js}

@@ -1,13 +1,14 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as display } from "./io-BiPX-_J1.js";
-import { t as toCatalog } from "./catalog-Di15TkM2.js";
-import { t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { t as toCatalog } from "./catalog-Cm6BtquM.js";
+import { t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
 import { n as applyPlan, s as planResult } from "./files-DDvAwTko.js";
-import { d as setBlockInJson, u as setBlockInConfig } from "./config-edit-Ct1lXe8a.js";
-import { t as blockNames } from "./blocks-Dq25D80b.js";
-import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-0I9zylYy.js";
+import { d as setBlockInJson, f as setPathInConfig, p as setPathInJson, u as setBlockInConfig } from "./config-edit-Ct1lXe8a.js";
+import { t as blockNames } from "./blocks-jIvPqPtw.js";
+import { n as latestMigrationVersion } from "./migration-safety-DjVpz2D6.js";
+import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
 import { readFile } from "node:fs/promises";
 import { SQL_MODULES, adoptedColumnProblems, adoptedTables, migrationOptionUses, moduleIdType } from "better-supabase/sql";
 import { toSnake } from "better-supabase";
@@ -139,8 +140,9 @@ function matchTables(block, tables, from, schemas, errors) {
 	}
 	return chosen;
 }
-/** A `create table` per adopted table, for `adoptedColumnProblems`. */
-const declaration = (table) => `create table ${table.schema}.${table.name} (\n${table.columns.map((column) => `  "${column.name}" ${column.udt}`).join(",\n")}\n);`;
+const enumType = (column) => `"${column.typeSchema ?? "public"}"."${column.udt}"`;
+/** A `create table` per adopted table, with its enum types, for `adoptedColumnProblems`. */
+const declaration = (table) => [...table.columns.filter((column) => column.isEnum === true).map((column) => `create type ${enumType(column)} as enum ();`), `create table ${table.schema}.${table.name} (\n${table.columns.map((column) => `  "${column.name}" ${column.isEnum === true ? enumType(column) : column.udt}`).join(",\n")}\n);`].join("\n");
 /** The adopt-mode entry for `block` over `tables`, and what can't map. */
 function proposeAdoption(block, tables, options = {}) {
 	const module = SQL_MODULES[block];
@@ -276,6 +278,23 @@ const adoptSchemas = (config) => [.../* @__PURE__ */ new Set(["public", ...confi
 function withAdoptedBlock(file, source, proposal) {
 	return file.endsWith(".json") ? setBlockInJson(source, proposal.block, proposal.entry) : setBlockInConfig(source, proposal.block, proposal.entry);
 }
+/**
+* `edit` with `doctor.migrationSafety.since` set to the newest migration when
+* the config has none, so doctor's lock checks skip the migrations that ran
+* before the tables were adopted.
+*/
+async function withMigrationSince(config, file, edit) {
+	if (!edit.ok || config.doctor.migrationSafety?.since !== void 0) return edit;
+	const since = await latestMigrationVersion(config.root);
+	if (since === void 0) return edit;
+	const path = [
+		"doctor",
+		"migrationSafety",
+		"since"
+	];
+	const next = file.endsWith(".json") ? setPathInJson(edit.text, path, since) : setPathInConfig(edit.text, path, since);
+	return next.ok ? next : edit;
+}
 /** The tables `loadSnapshot` reads, for the adopt commands. */
 function snapshotTables(config, env, source) {
 	return async () => existingTables(toCatalog(await loadSnapshot(config, env, source)).tables);
@@ -321,7 +340,7 @@ async function runAdopt(config, args, deps) {
 			}
 		};
 	}
-	const edit = withAdoptedBlock(file, await readFile(file, "utf-8"), proposal);
+	const edit = await withMigrationSince(config, file, withAdoptedBlock(file, await readFile(file, "utf-8"), proposal));
 	const shown = display(config.root, file);
 	if (!edit.ok) return {
 		code: 1,

package/dist/cli/{agent-CCt_aXpJ.js → agent-CCrTYK3W.js}

@@ -173,4 +173,4 @@ function databaseHost(url) {
 	}
 }
 //#endregion
-export { resolveAgent as a, missingInputNext as i, databaseHost as n, isLocalDatabaseUrl as r, checkConsent as t };
+export { missingInputNext as a, isLocalDatabaseUrl as i, consentToken as n, resolveAgent as o, databaseHost as r, checkConsent as t };

package/dist/cli/{apply-Dxk8AUNU.js → apply-4BmTvj2A.js}

@@ -1,14 +1,15 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as display } from "./io-BiPX-_J1.js";
-import { a as findConfig, s as loadConfig } from "./config-CLHpTk9Y.js";
+import { a as findConfig, s as loadConfig } from "./config-C4e_RrmL.js";
 import { n as applyPlan, s as planResult } from "./files-DDvAwTko.js";
 import { h as setPresetInJson, m as setPresetInConfig, n as addBlocksToJson, t as addBlocksToConfig } from "./config-edit-Ct1lXe8a.js";
-import { a as withAdoptedBlock, c as hasDefaultTable, i as snapshotTables, l as proposeAdoption, n as adoptSchemas, o as adoptableBlocks, s as describeProposal } from "./adopt-CebmlHL-.js";
-import { n as SOURCE_ARGS, r as sourceArgs } from "./source-args-0I9zylYy.js";
+import { a as withAdoptedBlock, c as hasDefaultTable, i as snapshotTables, l as proposeAdoption, n as adoptSchemas, o as adoptableBlocks, s as describeProposal } from "./adopt-Ht34C3QD.js";
+import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
 import { a as CONVENTION_COMPLETIONS, c as hasConventionFlags, i as CONVENTION_ARGS, n as AUTHZ_NOTE, o as conventionFlags, r as createUrlParam, t as writeDesign, u as withConventions } from "./design-edit-B-WsnhUF.js";
-import { t as syncModules } from "./sync-DFx-6t5n.js";
+import { n as ident } from "./live-CLxJNC0r.js";
+import { t as syncModules } from "./sync-DBvknfOK.js";
 import { posix, resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 import { PRESET_NAMES, designConfig, designOf, diffAppTables, encodePreset, isPresetName, presetOf, resolvePreset } from "better-supabase/preset";
@@ -35,7 +36,7 @@ const APPLY_ARGS = {
 	},
 	"allow-breaking": {
 		type: "boolean",
-		description: "Write a design that drops, renames or retypes app table columns, or makes one required without a default"
+		description: "Write a design with breaking app table changes (a rename, a retyped or required column, a tighter constraint); renames print their alter statements"
 	},
 	"dry-run": {
 		type: "boolean",
@@ -109,6 +110,24 @@ async function designFor(config, input, preset) {
 function describeBreaking(changes) {
 	return ["Breaking changes to app tables:", ...changes.flatMap((change) => [`  ${change.summary}`, ...change.steps.map((step, index) => `    ${String(index + 1)}. ${step}`)])];
 }
+/** The statements that rename the tables and columns `changes` renames, in order. */
+function renameStatements(changes) {
+	return changes.flatMap((change) => {
+		if (change.from === void 0) return [];
+		if (change.kind === "table.renamed") return [`alter table public.${ident(change.from)} rename to ${ident(change.table)};`];
+		if (change.kind === "column.renamed" && change.column !== void 0) return [`alter table public.${ident(change.table)} rename column ${ident(change.from)} to ${ident(change.column)};`];
+		return [];
+	});
+}
+/** How to run `renames` before `sql sync` creates the new names. */
+function describeRenames(renames, renamedTables, file) {
+	return renames.length === 0 ? [] : [
+		"Run these in a migration before `better-supabase sql sync`, so the renamed tables and columns keep their rows:",
+		...renames.map((statement) => `  ${statement}`),
+		...renamedTables.length === 0 ? [] : [`Then remove ${renamedTables.join(", ")} from appTables in ${file}: apply keeps the tables a design leaves out.`],
+		""
+	];
+}
 /** The config file edited for `--only`: the `preset` key, or the blocks. */
 function edited(file, source, name, preset, only) {
 	const json = file.endsWith(".json");
@@ -177,7 +196,11 @@ async function runApply(rootConfig, args, rootDeps) {
 		blocks: []
 	} : preset);
 	if (conflict !== void 0) throw new CliError("usage", conflict);
-	const breaking = design?.appTables === void 0 ? [] : diffAppTables(config.appTables, design.appTables, { keepMissing: true }).filter((change) => change.breaking);
+	const changes = design?.appTables === void 0 ? [] : diffAppTables(config.appTables, design.appTables);
+	const kept = changes.filter((change) => change.kind === "table.dropped").map((change) => change.table);
+	const renamedTables = changes.flatMap((change) => change.kind === "table.renamed" && change.from !== void 0 ? [change.from] : []);
+	const breaking = changes.filter((change) => change.breaking && change.kind !== "table.dropped");
+	const renames = renameStatements(breaking);
 	const shown = display(config.root, file);
 	if (breaking.length > 0 && args["allow-breaking"] !== true && args["dry-run"] !== true) return {
 		code: 1,
@@ -185,7 +208,8 @@ async function runApply(rootConfig, args, rootDeps) {
 		data: {
 			file: shown,
 			written: false,
-			breaking
+			breaking,
+			kept
 		},
 		error: `Nothing was written: the design has ${breaking.length === 1 ? "a breaking change" : `${String(breaking.length)} breaking changes`} to tables the app already has. Follow the steps above, or pass --allow-breaking to write it anyway.`
 	};
@@ -202,7 +226,11 @@ async function runApply(rootConfig, args, rootDeps) {
 	};
 	const paint = deps.paint ?? plain;
 	let text = withDesign.text;
-	const lines = breaking.length === 0 ? [] : [...describeBreaking(breaking), ""];
+	const lines = [
+		...breaking.length === 0 ? [] : [...describeBreaking(breaking), ""],
+		...describeRenames(renames, renamedTables, shown),
+		...kept.length === 0 ? [] : [`Kept ${kept.join(", ")}: the design doesn't name ${kept.length === 1 ? "it" : "them"}, and apply keeps the tables a design leaves out. Remove ${kept.length === 1 ? "it" : "them"} from appTables in ${shown} to drop ${kept.length === 1 ? "it" : "them"}.`, ""]
+	];
 	if (createUrlParam(input, "authz") !== void 0) lines.push(AUTHZ_NOTE, "");
 	let adopted = {};
 	if (args.adopt === true) {
@@ -225,7 +253,9 @@ async function runApply(rootConfig, args, rootDeps) {
 	const data = {
 		file: shown,
 		adopted,
-		contents: text
+		contents: text,
+		kept,
+		...renames.length === 0 ? {} : { renames }
 	};
 	if (text === source) {
 		lines.push(`${shown} already holds the preset.`);

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-CM_2g6KQ.js";
+import { i as run } from "./run-nX5ffQM_.js";
 import { t as colorEnabled } from "./style-2JfIPVMQ.js";
 import { existsSync } from "node:fs";
 import { basename } from "node:path";

package/dist/cli/{blocks-Bzz326nn.js → blocks-bBI050w6.js}

@@ -1 +1 @@
-export { n as blocksListCommand, r as blocksSearchCommand, i as blocksViewCommand } from "./blocks-Dq25D80b.js";
+export { n as blocksListCommand, r as blocksSearchCommand, i as blocksViewCommand } from "./blocks-jIvPqPtw.js";

package/dist/cli/{blocks-Dq25D80b.js → blocks-jIvPqPtw.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { PRESET_CATALOG, glueCommand } from "better-supabase/preset";
 import { SQL_MODULES } from "better-supabase/sql";

package/dist/cli/{cache-Cx6qlRDR.js → cache-CVJmPGpd.js}

@@ -1,4 +1,4 @@
-import { t as VERSION } from "./version-DNRW4DAP.js";
+import { t as VERSION } from "./version-CUKjFbNd.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-BNBPI4Eu.js";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -17,7 +17,11 @@ const literalArray = (values) => `array[${values.map((value) => `'${value.replac
 const LARGE_TABLE_ROWS = 1e4;
 const RELATIONS = (schemas) => `
 select c.oid::int8 as id, n.nspname as schema, c.relname as name,
-  c.reltuples >= ${LARGE_TABLE_ROWS} as large
+  c.reltuples >= ${LARGE_TABLE_ROWS} as large,
+  (select pn.nspname || '.' || pc.relname from pg_inherits i
+    join pg_class pc on pc.oid = i.inhparent
+    join pg_namespace pn on pn.oid = pc.relnamespace
+    where i.inhrelid = c.oid and c.relispartition) as partition_of
 from pg_class c
 join pg_namespace n on n.oid = c.relnamespace
 where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
@@ -163,7 +167,7 @@ cross join lateral aclexplode(a.attacl) acl
 left join pg_roles r on r.oid = acl.grantee
 where n.nspname = any(${schemas})
   and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated'))
-  and acl.privilege_type in ('INSERT', 'UPDATE')
+  and acl.privilege_type in ('SELECT', 'INSERT', 'UPDATE')
 group by 1, 2, 3
 order by 1, 2, 3`;
 const BUCKETS = `
@@ -351,7 +355,8 @@ async function readExtras(db, schemas, hooks = []) {
 					role: grant.role,
 					privileges: grant.privileges
 				})),
-				...relation.large ? { large: true } : {}
+				...relation.large ? { large: true } : {},
+				...relation.partition_of ? { partitionOf: relation.partition_of } : {}
 			};
 		}),
 		buckets: buckets.map((row) => ({

package/dist/cli/{catalog-Di15TkM2.js → catalog-Cm6BtquM.js}

@@ -121,7 +121,8 @@ function toCatalog(snapshot) {
 			policies: extra?.policies ?? [],
 			triggers: extra?.triggers ?? [],
 			grants: extra?.grants ?? [],
-			...extra?.columnGrants ? { columnGrants: extra.columnGrants } : {}
+			...extra?.columnGrants ? { columnGrants: extra.columnGrants } : {},
+			...extra?.partitionOf ? { partitionOf: extra.partitionOf } : {}
 		};
 	};
 	const tables = [

package/dist/cli/{codemod-woL4cVe0.js → codemod-vsknM1Ue.js}

@@ -1,7 +1,7 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
-import { t as migrateCliCall } from "./moved-D9OT_Uyy.js";
+import { t as migrateCliCall } from "./moved-BmtFuMK3.js";
 import { i as changedFiles, n as applyPlan, r as changeLines, s as planResult } from "./files-DDvAwTko.js";
 import { _ as codeRanges, a as configObject, c as mask, g as skipSpace, i as closingIndex, l as properties, o as indentAt } from "./config-edit-Ct1lXe8a.js";
 import { extname, join, relative, resolve } from "node:path";

package/dist/cli/{command-CK9Cn8HV.js → command-DLCZeHdo.js}

@@ -581,6 +581,29 @@ const COMMANDS = [
 			when: "--apply"
 		}]
 	},
+	{
+		name: "db",
+		description: "Runs SQL files against the database: the local stack by default, or the one in the connection string",
+		group: "local",
+		docs: "/docs/cli/db",
+		effects: [{
+			kind: "database",
+			access: "write"
+		}],
+		subcommands: [{
+			name: "query",
+			description: "Runs each file as one multi-statement script, in order, optionally in a single transaction",
+			docs: "/docs/cli/db#query",
+			examples: [{
+				command: "better-supabase db query --single-transaction a.sql b.sql",
+				description: "Runs both files, or neither when one fails"
+			}],
+			effects: [{
+				kind: "database",
+				access: "write"
+			}]
+		}]
+	},
 	{
 		name: "doctor",
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --fail-on warning",
@@ -609,6 +632,23 @@ const COMMANDS = [
 		docs: "/docs/cli/config#print-the-resolved-config",
 		effects: []
 	},
+	{
+		name: "mcp",
+		description: "Serves the CLI to coding agents as an MCP server on stdio: read-only tools, and file writes with --allow-writes and the user's consent",
+		group: "inspect",
+		docs: "/docs/cli/mcp",
+		examples: [{
+			command: "better-supabase mcp",
+			description: "Starts the read-only server; add it to the agent's MCP config"
+		}, {
+			command: "better-supabase mcp --allow-writes",
+			description: "Adds gen, sql_sync, apply and add, each behind a consent token"
+		}],
+		effects: [READS_DATABASE, {
+			kind: "files",
+			when: "--allow-writes"
+		}]
+	},
 	{
 		name: "sql",
 		description: "Low-level SQL module commands: lists, adds, syncs, upgrades and prints module files without touching app code, and writes their data migration",

package/dist/cli/{completion-CWoDmFZr.js → completion-BAm8SwGQ.js}

@@ -1,5 +1,5 @@
-import { l as COMPLETE_COMMAND, n as completionValues, o as listArgs, t as GLOBAL_ARGS } from "./command-CK9Cn8HV.js";
-import { o as isVariadic, r as commandArgs } from "./parse-DE59XyWt.js";
+import { l as COMPLETE_COMMAND, n as completionValues, o as listArgs, t as GLOBAL_ARGS } from "./command-DLCZeHdo.js";
+import { o as isVariadic, r as commandArgs } from "./parse-ksnw4phM.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [
 	"bash",

package/dist/cli/{completion-BO5UK6bG.js → completion-CEZ-c3ja.js}

@@ -1 +1 @@
-export { n as complete, r as completionLines } from "./completion-CWoDmFZr.js";
+export { n as complete, r as completionLines } from "./completion-BAm8SwGQ.js";

package/dist/cli/{completion-J3dqnNoW.js → completion-D2BObVth.js}

@@ -1,6 +1,6 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
-import { a as isShell, i as completionScript, t as SHELLS } from "./completion-CWoDmFZr.js";
+import { a as isShell, i as completionScript, t as SHELLS } from "./completion-BAm8SwGQ.js";
 //#region src/cli/commands/completion.ts
 const ARGS = { shell: {
 	type: "positional",

package/dist/cli/{config-CLHpTk9Y.js → config-C4e_RrmL.js}

@@ -1,18 +1,18 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { i as readStdin, t as display } from "./io-BiPX-_J1.js";
 import { c as resolve$1, i as extname$1, n as basename$1, o as join$1, r as dirname$1, s as normalize$1, t as resolveModulePath } from "./dist-DuiMMRbJ.js";
-import { C as record, D as string, E as strictObject, O as union, S as rawCheck, T as safeParse, _ as number, a as array, b as picklist, c as getDotPath, d as literal, f as maxLength, g as nullable, h as minValue, k as unknown, l as integer, m as minLength, o as boolean, p as maxValue, s as custom, u as lazy, v as objectWithRest, w as regex, x as pipe, y as optional } from "./env-DMw_MBe5.js";
+import { _ as parse$1, d as readSupabaseToml, g as tomlNumber, s as findUp } from "./supabase-toml-BC5sNVKU.js";
+import { A as string, C as picklist, D as regex, E as record, M as unknown, O as safeParse, S as optional, T as rawCheck, _ as minValue, a as array, c as exactOptional, f as lazy, g as minLength, h as maxValue, j as union, k as strictObject, l as getDotPath, m as maxLength, o as boolean, p as literal, s as custom, u as integer, v as nullable, w as pipe, x as objectWithRest, y as number } from "./env-C8R7Nf0a.js";
 import { n as INTEGRATIONS, t as GEN_TASKS } from "./names-D6LrQnOv.js";
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
-import { n as readStackStatus } from "./stack-status-CRanl-CN.js";
-import { d as readSupabaseToml, g as tomlNumber, s as findUp } from "./supabase-toml-DjLgBYEo.js";
+import { n as readStackStatus } from "./stack-status-Cb_D79ZR.js";
 import * as nodeUtil from "node:util";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { readFile, rm } from "node:fs/promises";
 import { pathToFileURL } from "node:url";
 import { SCOPE_ID_TYPES, scopeProblems } from "better-supabase/sql";
-import { APP_COLUMN_FORMATS, APP_COLUMN_TYPES, APP_ON_DELETE_ACTIONS, APP_ROLLUP_AGGREGATES, SKILLS_AGENTS, providerApiProblem, resolveConfig } from "better-supabase/config";
+import { APP_COLUMN_ACCESS, APP_COLUMN_FORMATS, APP_COLUMN_TYPES, APP_ON_DELETE_ACTIONS, APP_ROLLUP_AGGREGATES, APP_TABLE_EVENT_KINDS, SKILLS_AGENTS, providerApiProblem, resolveConfig } from "better-supabase/config";
 import { homedir } from "node:os";
 //#region ../../node_modules/.pnpm/rc9@3.1.0/node_modules/rc9/dist/_chunks/libs/flat.mjs
 function isBuffer(obj) {
@@ -690,6 +690,13 @@ const strings = array(string());
 const stringRecord = record(string(), string());
 const privilege = pipe(string(), regex(/^(?:select|insert|update|delete|(?:select|insert|update)\s*\(\s*(?:[a-z_][a-z0-9_$]*(?:\s*,\s*[a-z_][a-z0-9_$]*)*|\*(?:\s*,\s*-\s*[a-z_][a-z0-9_$]*)*)\s*\))$/, "Use select, insert, update or delete, name columns such as \"update(title, body)\", or exclude them from every column with \"select(*, -secret)\""));
 const privileges = array(privilege);
+const triggerValue = union([string(), strictObject({
+	from: string(),
+	via: lazy(() => triggerValue),
+	select: string(),
+	key: exactOptional(string())
+})]);
+const triggerValues = record(string(), triggerValue);
 const pluginFlag = union([boolean(), record(string(), unknown())]);
 const isGenerator = (value) => typeof value === "object" && value !== null && "name" in value && typeof value.name === "string" && "generate" in value && typeof value.generate === "function";
 const generator = custom(isGenerator, "must be a generator: { name, generate(input) }");
@@ -987,14 +994,24 @@ const ENTRIES = {
 		triggers: optional(array(strictObject({
 			topic: string(),
 			table: string(),
-			values: optional(stringRecord),
+			values: optional(triggerValues),
 			events: optional(array(picklist([
 				"insert",
 				"update",
 				"delete"
 			]))),
-			event: optional(string()),
-			payload: optional(picklist(["keys", "row"]))
+			event: optional(union([string(), strictObject({
+				insert: optional(string()),
+				update: optional(string()),
+				delete: optional(string())
+			})])),
+			payload: optional(union([picklist(["keys", "row"]), record(string(), union([triggerValue, strictObject({ sql: string() })]))])),
+			topics: optional(array(strictObject({
+				topic: string(),
+				values: optional(triggerValues)
+			}))),
+			functionSchema: optional(string()),
+			when: optional(strictObject({ changed: pipe(array(string()), minLength(1)) }))
 		})))
 	})),
 	entitlements: optional(strictObject({
@@ -1061,6 +1078,10 @@ const ENTRIES = {
 		rank: optional(strictObject({
 			column: string(),
 			group: optional(string())
+		})),
+		versions: optional(strictObject({
+			columns: strings,
+			auto: boolean()
 		}))
 	}))),
 	appTables: optional(record(string(), strictObject({
@@ -1082,7 +1103,8 @@ const ENTRIES = {
 			min: optional(number()),
 			max: optional(number()),
 			comment: optional(string()),
-			identity: optional(boolean())
+			identity: optional(boolean()),
+			access: optional(picklist(APP_COLUMN_ACCESS))
 		}))),
 		scope: optional(picklist([
 			"inherit",
@@ -1104,7 +1126,11 @@ const ENTRIES = {
 			})),
 			permissions: optional(record(string(), string())),
 			rank: optional(union([literal(true), strictObject({ group: optional(string()) })])),
-			softDelete: optional(boolean())
+			softDelete: optional(boolean()),
+			versions: optional(union([literal(true), strictObject({
+				columns: optional(strings),
+				auto: optional(boolean())
+			})]))
 		})),
 		rollups: optional(record(string(), strictObject({
 			table: string(),
@@ -1119,7 +1145,11 @@ const ENTRIES = {
 		lookups: optional(record(string(), strictObject({
 			via: string(),
 			column: string()
-		})))
+		}))),
+		events: optional(union([literal(true), strictObject({
+			on: optional(array(picklist(APP_TABLE_EVENT_KINDS))),
+			include: optional(strings)
+		})]))
 	}))),
 	blocks: optional(lazy((input) => Array.isArray(input) ? strings : objectWithRest({ access: optional(accessBlock) }, strictObject(blockEntries)))),
 	sql: optional(strictObject({
@@ -1183,7 +1213,8 @@ const ENTRIES = {
 		output: optional(string()),
 		sources: optional(strings),
 		policyHelperLimit: optional(number()),
-		claimsLimit: optional(number())
+		claimsLimit: optional(number()),
+		migrationSafety: optional(strictObject({ since: optional(string()) }))
 	})),
 	gen: optional(strictObject({
 		tasks: optional(array(picklist(GEN_TASKS))),
@@ -1396,9 +1427,10 @@ async function stdinDatabaseUrl(enabled, io) {
 * local stack: the `[db] port` in `config.toml`, else the running stack's
 * `DB_URL`, else port 54322.
 */
-async function databaseUrl(config, env, fromStdin) {
+async function databaseUrl(config, env, fromStdin, stack = env.BSB_STACK) {
 	const given = databaseUrlCredential(config, env, fromStdin);
 	if (given) return given.value;
+	if (stack !== void 0 && stack !== "") return namedStackUrl(config.root, stack);
 	let resolved = localUrls.get(config);
 	if (!resolved) {
 		resolved = localDatabaseUrl(config.root, env);
@@ -1406,6 +1438,16 @@ async function databaseUrl(config, env, fromStdin) {
 	}
 	return resolved;
 }
+/** The database of `supabase/stacks/<name>/config.toml`, a stack kept for one purpose such as tests or a demo. */
+async function namedStackUrl(root, name) {
+	if (!/^[a-z0-9][a-z0-9_-]*$/u.test(name)) throw new CliError("invalid_value", `--stack "${name}" must be lowercase letters, digits, dashes or underscores.`, { flag: "--stack" });
+	const toml = await readSupabaseToml(root);
+	const file = toml ? join(dirname(resolve(root, toml.path)), "stacks", name, "config.toml") : void 0;
+	const db = file !== void 0 && existsSync(file) ? parse$1(await readFile(file, "utf-8"))["db"] : void 0;
+	const port = typeof db === "object" && db !== null && "port" in db && typeof db.port === "number" ? db.port : void 0;
+	if (port === void 0) throw new CliError("not_found", `The stack "${name}" has no [db] port in supabase/stacks/${name}/config.toml.`, { flag: "--stack" });
+	return `postgresql://postgres:postgres@127.0.0.1:${port}/postgres`;
+}
 /** One lookup per loaded config, so a run asks `supabase status` at most once. */
 const localUrls = /* @__PURE__ */ new WeakMap();
 async function localDatabaseUrl(root, env) {

package/dist/cli/{config-MuKY9kUj.js → config-CC5DXgKX.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { n as redact, r as redactUrl } from "./redact-PjNswZOs.js";
 import { t as display } from "./io-BiPX-_J1.js";
 //#region src/cli/commands/config.ts

package/dist/cli/{config-C1d-mbUA.js → config-CynctXbc.js}

@@ -1 +1 @@
-export { t as applyEnvironment, n as databaseUrl, r as defaultConfig, i as discoverConfig, a as findConfig, o as importExport, s as loadConfig, c as readSupabasePort, l as stdinDatabaseUrl } from "./config-CLHpTk9Y.js";
+export { t as applyEnvironment, n as databaseUrl, r as defaultConfig, i as discoverConfig, a as findConfig, o as importExport, s as loadConfig, c as readSupabasePort, l as stdinDatabaseUrl } from "./config-C4e_RrmL.js";

package/dist/cli/db-BxMRcHrY.js

@@ -0,0 +1,90 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
+import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CCrTYK3W.js";
+import { t as display } from "./io-BiPX-_J1.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-C4e_RrmL.js";
+import { t as connect } from "./db-DT1bGB02.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-BDiUhsH8.js";
+import { resolve } from "node:path";
+import { readFile } from "node:fs/promises";
+//#region src/cli/commands/db.ts
+const ARGS = {
+	file: {
+		type: "positional",
+		required: true,
+		variadic: true,
+		description: "SQL files, run in the order given"
+	},
+	"single-transaction": {
+		type: "boolean",
+		description: "Wrap every file in one transaction, so a failure keeps none"
+	}
+};
+/** Runs each file as one multi-statement script and reports the files it ran. */
+async function runDbQuery(config, args, env, open = connect, dbUrl, requireConsent = () => {}) {
+	const files = [...args._];
+	if (files.length === 0) throw new CliError("usage", "Pass at least one SQL file.", { flag: "file" });
+	const scripts = [];
+	for (const file of files) {
+		const path = resolve(config.root, file);
+		try {
+			scripts.push({
+				name: display(config.root, path),
+				sql: await readFile(path, "utf-8")
+			});
+		} catch (cause) {
+			throw new CliError("invalid_input", `Could not read ${file}: ${errorText(cause)}.`);
+		}
+	}
+	const url = await databaseUrl(config, env, dbUrl, args.stack ?? env.BSB_STACK);
+	if (!isLocalDatabaseUrl(url)) requireConsent({
+		effect: "database-write",
+		detail: `db query runs ${String(files.length)} file(s) against ${databaseHost(url)}`
+	});
+	const single = args["single-transaction"] === true;
+	const { client, close } = await open(url);
+	const ran = [];
+	try {
+		if (single) await client.query("begin");
+		for (const script of scripts) try {
+			await client.query(script.sql);
+			ran.push(script.name);
+		} catch (cause) {
+			if (single) await client.query("rollback");
+			return {
+				code: 1,
+				errorCode: "failed",
+				error: `${script.name}: ${errorText(cause)}${single ? " (nothing was kept)" : ""}`,
+				data: {
+					ran,
+					failed: script.name
+				}
+			};
+		}
+		if (single) await client.query("commit");
+	} finally {
+		await close();
+	}
+	return {
+		code: 0,
+		output: ran.map((name) => `Ran ${name}`).join("\n"),
+		data: {
+			ran,
+			singleTransaction: single
+		}
+	};
+}
+const dbQueryCommand = defineCliCommand({
+	meta: commandMeta("db query"),
+	args: {
+		...ARGS,
+		...DB_URL_STDIN_ARG,
+		...STACK_ARG
+	},
+	run: async (args, { config, env, io, log, requireConsent }) => {
+		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+		return log.progress("Running the SQL files", () => runDbQuery(config, args, env, connect, dbUrl, requireConsent));
+	}
+});
+//#endregion
+export { dbQueryCommand };

package/dist/cli/{detect-DYDUBLU4.js → detect-DQsVeBHg.js}

@@ -1,7 +1,7 @@
 import { n as shellQuote } from "./shell-Btv_4Yhe.js";
-import { o as findSupabaseRoot } from "./supabase-toml-DjLgBYEo.js";
-import { t as i } from "./jsonc-D5Fu67jw.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { o as findSupabaseRoot } from "./supabase-toml-BC5sNVKU.js";
+import { t as i } from "./jsonc-D5Fu67jw.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { readFile } from "node:fs/promises";