better-supabase 0.9.0 → 0.11.0

package/dist/cli/migration-safety-DjVpz2D6.js

@@ -0,0 +1,206 @@
+import { c as splitStatements } from "./shared-DKLuA1Tp.js";
+import { join } from "node:path";
+import { readdir } from "node:fs/promises";
+//#region src/cli/doctor/migration-safety.ts
+const NAME = String.raw`(?:"[^"]+"|[\w$]+)`;
+const TABLE = String.raw`(${NAME}(?:\s*\.\s*${NAME})?)`;
+const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global\s+|local\s+)?(?:temporary|temp|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${TABLE}`, "iu");
+const ALTER_TABLE = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${TABLE}`, "iu");
+const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${NAME}\s+)?on\s+(?:only\s+)?${TABLE}`, "iu");
+const ADD_CONSTRAINT = /\badd\s+(?:constraint\s+(?:"[^"]+"|[\w$]+)\s+)?(foreign\s+key|check)\b/iu;
+const NOT_VALID = /\bnot\s+valid\b/iu;
+const ALTER_TYPE = /\balter\s+(?:column\s+)?(?:"[^"]+"|[\w$]+)\s+(?:set\s+data\s+)?type\b/iu;
+const SET_NOT_NULL = /\bset\s+not\s+null\b/iu;
+const VALIDATE = /\bvalidate\s+constraint\b/iu;
+const ADD_COLUMN_DEFAULT = /\badd\s+(?:column\s+)?(?:if\s+not\s+exists\s+)?(?:"[^"]+"|[\w$]+)\s[^,]*?\bdefault\s+([^,]+)/giu;
+const VOLATILE = /\b(?:gen_random_uuid|uuid_generate_v[14]|clock_timestamp|timeofday|random|nextval|statement_timestamp)\s*\(/iu;
+const LOCK_TIMEOUT = /^set\s+(?:local\s+)?lock_timeout\b/iu;
+const EXCLUSIVE = /^(?:drop\s+table|truncate|vacuum\s+full|reindex\b(?!.*\bconcurrently\b)|lock\s+table|cluster\b)/iu;
+const DROP = /^drop\s+table\b|\bdrop\s+(?:column\s+)?(?!constraint\b|default\b|not\b|identity\b|expression\b)(?:if\s+exists\s+)?(?:"[^"]+"|[\w$]+)/iu;
+const RENAME = /\brename\s+(?!constraint\b)(?:column\s+)?(?:(?:"[^"]+"|[\w$]+)\s+)?to\b/iu;
+/** `name` without quotes and with `public.` for an unqualified name, lower-cased. */
+function tableKey(name) {
+	const parts = name.split(".").map((part) => part.trim().replaceAll("\"", "").toLowerCase());
+	return parts.length === 1 ? `public.${parts[0] ?? ""}` : parts.join(".");
+}
+/** The version a migration file name or a `since` value starts with. */
+function migrationVersion(name) {
+	const base = name.slice(name.lastIndexOf("/") + 1);
+	return base.replace(/\.sql$/u, "").split("_")[0] ?? base;
+}
+/**
+* The newest migration under `<root>/<supabaseDir>/migrations`, which `init`
+* and `adopt` write to `doctor.migrationSafety.since` so the migrations that
+* already ran aren't checked offline.
+*/
+async function latestMigrationVersion(root, supabaseDir = "supabase") {
+	return (await readdir(join(root, supabaseDir, "migrations")).catch(() => [])).filter((name) => name.endsWith(".sql")).map(migrationVersion).toSorted().at(-1);
+}
+const statementsCache = /* @__PURE__ */ new WeakMap();
+function parse(file) {
+	let parsed = statementsCache.get(file);
+	if (parsed === void 0) {
+		const statements = splitStatements(file.text);
+		parsed = {
+			file,
+			statements,
+			created: new Set(statements.flatMap((statement) => {
+				const match = CREATE_TABLE.exec(statement.text);
+				return match?.[1] === void 0 ? [] : [tableKey(match[1])];
+			}))
+		};
+		statementsCache.set(file, parsed);
+	}
+	return parsed;
+}
+const pending = /* @__PURE__ */ new WeakMap();
+/**
+* The migrations to check: with a database, the ones it hasn't applied;
+* offline, the ones after `doctor.migrationSafety.since`, or the newest one
+* without it.
+*/
+function unappliedMigrations(context) {
+	let files = pending.get(context);
+	if (files === void 0) {
+		files = findUnapplied(context);
+		pending.set(context, files);
+	}
+	return files;
+}
+async function findUnapplied(context) {
+	const dir = `${context.configToml?.dir ?? "supabase"}/migrations/`;
+	const migrations = (context.sqlFiles ?? []).filter((file) => file.path.startsWith(dir)).toSorted((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	const db = context.database;
+	if (db !== void 0 && !("skipped" in db)) try {
+		const rows = await db.query("select version from supabase_migrations.schema_migrations");
+		const applied = new Set(rows.map((row) => row.version));
+		return migrations.filter((file) => !applied.has(migrationVersion(file.path)));
+	} catch {}
+	const since = context.config.doctor.migrationSafety?.since;
+	if (since === void 0) return migrations.slice(-1);
+	const after = migrationVersion(since);
+	return migrations.filter((file) => migrationVersion(file.path) > after);
+}
+/** A rule that runs `check` on each statement of the unapplied migrations. */
+function perStatement(check) {
+	return async (context) => (await unappliedMigrations(context)).flatMap((file) => {
+		const parsed = parse(file);
+		return parsed.statements.flatMap((statement) => {
+			const message = check(parsed, statement);
+			return message === void 0 ? [] : [{
+				message: `${file.path}:${String(statement.line)}: ${message}`,
+				target: `${file.path}:${String(statement.line)}`,
+				location: {
+					file: file.path,
+					line: statement.line
+				}
+			}];
+		});
+	});
+}
+/** The table an `alter table` statement changes, unless the same file created it. */
+function alteredTable(parsed, statement) {
+	const match = ALTER_TABLE.exec(statement.text);
+	const table = match?.[1] === void 0 ? void 0 : tableKey(match[1]);
+	return table === void 0 || parsed.created.has(table) ? void 0 : table;
+}
+const indexWithoutConcurrently = (parsed, statement) => {
+	const match = CREATE_INDEX.exec(statement.text);
+	if (match === null || match[1] !== void 0 || match[2] === void 0) return;
+	const table = tableKey(match[2]);
+	return parsed.created.has(table) ? void 0 : `creates an index on ${table} without concurrently, which blocks writes to it until the index is built.`;
+};
+const constraintWithoutNotValid = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	const kind = ADD_CONSTRAINT.exec(statement.text)?.[1];
+	if (table === void 0 || kind === void 0 || NOT_VALID.test(statement.text)) return;
+	return `adds a ${kind.toLowerCase().replace(/\s+/u, " ")} to ${table} without not valid, which scans every row while it holds a lock.`;
+};
+const rewriteOrScan = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	if (table === void 0) return;
+	if (ALTER_TYPE.test(statement.text)) return `changes a column type of ${table}, which can rewrite the table under an access exclusive lock.`;
+	const validated = parsed.statements.some((each) => each.line < statement.line && VALIDATE.test(each.text) && alteredTable(parsed, each) === table);
+	return SET_NOT_NULL.test(statement.text) && !validated ? `sets not null on a column of ${table}, which scans every row under an access exclusive lock.` : void 0;
+};
+const volatileDefault = (parsed, statement) => {
+	const table = alteredTable(parsed, statement);
+	if (table === void 0) return;
+	for (const match of statement.text.matchAll(ADD_COLUMN_DEFAULT)) if (VOLATILE.test(match[1] ?? "")) return `adds a column to ${table} with a volatile default (${(match[1] ?? "").trim()}), which rewrites every row.`;
+};
+/** Whether `statement` takes an access exclusive lock on a table others use. */
+function takesExclusiveLock(parsed, statement) {
+	if (EXCLUSIVE.test(statement.text)) return true;
+	const match = CREATE_INDEX.exec(statement.text);
+	if (match?.[2] !== void 0 && match[1] === void 0) return !parsed.created.has(tableKey(match[2]));
+	return alteredTable(parsed, statement) !== void 0;
+}
+async function missingLockTimeout(context) {
+	return (await unappliedMigrations(context)).flatMap((file) => {
+		const parsed = parse(file);
+		const first = parsed.statements.find((statement) => takesExclusiveLock(parsed, statement));
+		if (first === void 0) return [];
+		return parsed.statements.some((statement) => statement.line <= first.line && LOCK_TIMEOUT.test(statement.text)) ? [] : [{
+			message: `${file.path} locks tables it didn't create (line ${String(first.line)}) without setting lock_timeout, so a long query ahead of it queues every read and write behind the migration.`,
+			target: file.path,
+			location: {
+				file: file.path,
+				line: first.line
+			}
+		}];
+	});
+}
+const dropOrRename = (parsed, statement) => {
+	const isDropTable = /^drop\s+table\b/iu.test(statement.text);
+	const table = alteredTable(parsed, statement);
+	if (isDropTable) return "drops a table; app code that still reads it fails once this runs.";
+	if (table === void 0) return;
+	if (RENAME.test(statement.text)) return `renames ${table} or one of its columns; app code that uses the old name fails once this runs.`;
+	return DROP.test(statement.text) ? `drops a column of ${table}; app code that still reads it fails once this runs.` : void 0;
+};
+const MIGRATION_SAFETY_RULES = [
+	{
+		code: "BS229",
+		severity: "warning",
+		title: "Index created without concurrently",
+		description: "A migration creates an index on an existing table without `concurrently`. The build holds a lock that blocks inserts, updates and deletes on the table until it finishes. Use `create index concurrently`, in a migration file of its own: the statement can't run inside a transaction block.",
+		check: perStatement(indexWithoutConcurrently)
+	},
+	{
+		code: "BS230",
+		severity: "warning",
+		title: "Constraint added without not valid",
+		description: "A migration adds a foreign key or check to an existing table without `not valid`, so Postgres checks every row while it holds the lock. Add it with `not valid`, then run `alter table ... validate constraint` in a later statement, which takes a lighter lock.",
+		check: perStatement(constraintWithoutNotValid)
+	},
+	{
+		code: "BS231",
+		severity: "warning",
+		title: "Column type change or set not null",
+		description: "A migration changes a column type or sets `not null` on an existing table. A type change can rewrite the table, and `set not null` scans every row, both under an access exclusive lock. For `not null`, add `check (column is not null) not valid`, validate it, then set not null. For a type, add a new column and backfill it.",
+		check: perStatement(rewriteOrScan)
+	},
+	{
+		code: "BS232",
+		severity: "warning",
+		title: "Column added with a volatile default",
+		description: "A migration adds a column with a volatile default, such as `gen_random_uuid()` or `clock_timestamp()`, to an existing table. Postgres writes the value into every row under an access exclusive lock. Add the column without a default, backfill it in batches, then set the default.",
+		check: perStatement(volatileDefault)
+	},
+	{
+		code: "BS233",
+		severity: "warning",
+		title: "Migration without lock_timeout",
+		description: "A migration takes an access exclusive lock on an existing table without `set lock_timeout`. While it waits behind a long query, every read and write of the table queues behind it. Start the file with `set lock_timeout = '5s';` and retry the migration when it times out.",
+		check: missingLockTimeout
+	},
+	{
+		code: "BS234",
+		severity: "info",
+		title: "Migration drops or renames",
+		description: `A migration drops or renames a table or column. App code deployed before it still uses the old name and fails once it runs. Expand and contract: add the new shape, deploy app code that uses it, then remove the old one in a later migration.`,
+		check: perStatement(dropOrRename)
+	}
+];
+//#endregion
+export { latestMigrationVersion as n, MIGRATION_SAFETY_RULES as t };

package/dist/cli/{module-migration-YFFdWC5X.js → module-migration-CPhuiY8C.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
+import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-BC5sNVKU.js";
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
-import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-DjLgBYEo.js";
 import { n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
 import { existsSync } from "node:fs";
 import { dirname, join, relative, resolve, sep } from "node:path";
@@ -171,7 +171,7 @@ function moduleKeyProblems(provider, keys) {
 		const problem = unsafeKey(provider, entry.key);
 		if (!problem) return [];
 		const fn = entry.scope === "platform" ? "authorization.functions.isPlatform" : "authorization.functions.idsWith";
-		const setting = `blocks.${entry.module}.permissions.${entry.action}`;
+		const setting = entry.setting ?? `blocks.${entry.module}.permissions.${entry.action}`;
 		const fix = problem.status === "incomplete" ? `The provider's SQL functions check role and scope, not the key's other conditions, so the module would grant it everywhere in the scope. Set ${setting} to a permission marked sqlComplete: true.` : `${problem.fix} If the provider doesn't define it, set ${setting} to a key it lists.`;
 		return [{
 			target: setting,

package/dist/cli/{moved-D9OT_Uyy.js → moved-BmtFuMK3.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-Caiz_0so.js";
-import { s as positionalIndex } from "./parse-DE59XyWt.js";
+import { s as positionalIndex } from "./parse-ksnw4phM.js";
 //#region src/cli/core/moved.ts
 /** Commands renamed in 0.9, longest prefix first. */
 const MOVED_COMMANDS = [

package/dist/cli/{parse-DE59XyWt.js → parse-ksnw4phM.js}

@@ -1,5 +1,5 @@
 import { r as __toESM } from "./rolldown-runtime-kJ_i4yPo.js";
-import { t as GLOBAL_ARGS } from "./command-CK9Cn8HV.js";
+import { t as GLOBAL_ARGS } from "./command-DLCZeHdo.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 //#region src/cli/core/parse.ts
 /** Global options that take a value, so a command name is never the token after them. */

package/dist/cli/{preset-DmcC4nWE.js → preset-B1o6KbFp.js}

@@ -1,4 +1,4 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { PRESET_FIELDS, decodePreset, encodePreset, isPresetCode, listNames, presetConfig, presetOf, resolvePreset } from "better-supabase/preset";
 //#region src/cli/commands/preset.ts

package/dist/cli/{run-DaHfUUO9.js → run-Bb8Nn8Ax.js}

@@ -1,19 +1,18 @@
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, n as importPath, t as display } from "./io-BiPX-_J1.js";
-import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-Cx6qlRDR.js";
+import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-CVJmPGpd.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { d as typegenVersion, f as typegenVersionNotice, i as oxfmtInstalled, l as stabilizeMetadata, r as generateDatabaseTypes } from "./typegen--TfvOPLh.js";
-import { t as toCatalog } from "./catalog-Di15TkM2.js";
-import { a as buildModel, i as metaPaths, l as prop, n as emitMeta, o as generatorModel, r as emitModule, t as GENERATED_HEADER, u as q } from "./emit-ZAYeh4Yn.js";
-import { C as accessRequirements, D as providerLabel, E as moduleKeyProblems, O as unsafeKey, S as accessProviderMode, T as entitlementsMode, c as writeLatestMigration, l as writesMigrations, n as READ_SETS_SUFFIX, r as latestMigration, s as sameModuleMigration, v as migrationsDir, w as entitlementRequirements, x as compiledReadSets } from "./module-migration-YFFdWC5X.js";
-import { h as tomlGet, p as sqlWorkflow, r as detectWorkflow } from "./supabase-toml-DjLgBYEo.js";
-import { t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { a as buildModel, i as metaPaths, l as prop, n as emitMeta, o as generatorModel, r as emitModule, t as GENERATED_HEADER, u as q } from "./emit-56LAG_Px.js";
+import { C as accessRequirements, D as providerLabel, E as moduleKeyProblems, O as unsafeKey, S as accessProviderMode, T as entitlementsMode, c as writeLatestMigration, l as writesMigrations, n as READ_SETS_SUFFIX, r as latestMigration, s as sameModuleMigration, v as migrationsDir, w as entitlementRequirements, x as compiledReadSets } from "./module-migration-CPhuiY8C.js";
+import { t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
 import { a as hasConflicts, c as fileDiff, i as changedFiles, n as applyPlan, r as changeLines } from "./files-DDvAwTko.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-DKLuA1Tp.js";
 import { existsSync } from "node:fs";
 import { basename, dirname, isAbsolute, posix, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
 import { PRESET_CATALOG } from "better-supabase/preset";
-import { BLOCK_OPTION_SCHEMAS, SQL_MODULES, moduleHidingColumns, moduleLayout, modulePermissionKeys, renderModules, resolveModule, resolveModules, sameModuleFile } from "better-supabase/sql";
+import { BLOCK_OPTION_SCHEMAS, SQL_MODULES, appTableEventTypes, moduleHidingColumns, moduleLayout, modulePermissionKeys, renderModules, resolveModule, resolveModules, sameModuleFile } from "better-supabase/sql";
 //#region src/cli/gen/blocks.ts
 /** `blocks.generated.ts`, next to the main generated module. */
 function blockConfigPath(config) {
@@ -84,21 +83,48 @@ function literal(value, indent) {
 	}
 	return JSON.stringify(value);
 }
+/** Every event type the app tables emit, in config order. */
+function appTableEvents(config) {
+	return Object.entries(config.appTables).flatMap(([name, table]) => appTableEventTypes(name, table));
+}
+/** `appTableEvents` and `appTableEventSchemas`, for app tables that set `events`. */
+function appTableEventLines(types) {
+	if (types.length === 0) return [];
+	return [
+		"",
+		"/**",
+		" * The events `appTables.<table>.events` writes to the outbox, for `onBlockEvent` and the sinks.",
+		" * @public",
+		" */",
+		"export const appTableEvents = defineEvents({",
+		...types.map((type) => `  ${prop(type)}: event<AppTableEventData>(),`),
+		"});",
+		"",
+		"/**",
+		" * The app table events with an open payload, for AsyncAPI's `cloudEvents.blocks`.",
+		" * @public",
+		" */",
+		"export const appTableEventSchemas = {",
+		...types.map((type) => `  ${prop(type)}: true,`),
+		"} as const;"
+	];
+}
 /**
 * `blocks.generated.ts`: each installed block's schema, API schema and the
-* options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`.
-* `undefined` when the config installs no blocks.
+* options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`,
+* and the app table events. `undefined` when the config installs no blocks.
 */
 function emitBlockConfig(config, options = {}) {
 	if (config.blockNames.length === 0) return;
 	const entries = blockConfigEntries(config);
+	const events = appTableEvents(config);
 	const runtime = options.runtimeImport ?? "better-supabase";
 	return {
 		path: blockConfigPath(config),
 		contents: [
 			GENERATED_HEADER,
 			"",
-			`import type { GeneratedBlocks } from ${q(`${runtime}/blocks`)};`,
+			events.length === 0 ? `import type { GeneratedBlocks } from ${q(`${runtime}/blocks`)};` : `import {\n  type AppTableEventData,\n  defineEvents,\n  event,\n  type GeneratedBlocks,\n} from ${q(`${runtime}/blocks`)};`,
 			"",
 			"/**",
 			" * The installed blocks' settings from the `blocks` config, for",
@@ -106,6 +132,7 @@ function emitBlockConfig(config, options = {}) {
 			" * and the options its SQL and TypeScript halves share.",
 			" */",
 			`export const blockConfig = ${literal(entries, "")} as const satisfies GeneratedBlocks;`,
+			...appTableEventLines(events),
 			""
 		].join("\n")
 	};
@@ -294,65 +321,6 @@ async function splinterTables(context, lint) {
 	}));
 }
 //#endregion
-//#region src/cli/doctor/shared.ts
-const catalogs = /* @__PURE__ */ new WeakMap();
-/** The project's SQL workflow: `sql.workflow`, or the one `config.toml` and the schema files imply. */
-function workflowOf(context) {
-	const toml = context.configToml;
-	if (context.config.sql.workflow !== void 0 || toml === void 0) return sqlWorkflow(context.config, toml);
-	const schemas = `${toml.dir}/schemas/`;
-	return detectWorkflow(context.config.root, toml, (context.sqlFiles ?? []).some((file) => file.path.startsWith(schemas)));
-}
-/** The snapshot joined per table and function, computed once per snapshot. */
-function catalogOf(context) {
-	let catalog = catalogs.get(context.snapshot);
-	if (!catalog) {
-		catalog = toCatalog(context.snapshot);
-		catalogs.set(context.snapshot, catalog);
-	}
-	return catalog;
-}
-/** `[api] schemas` from `config.toml`, the schemas PostgREST serves, or `config.schemas` without one. */
-function exposedSchemas(context) {
-	const listed = context.configToml ? tomlGet(context.configToml.document, ["api", "schemas"]) : void 0;
-	return Array.isArray(listed) && listed.every((entry) => typeof entry === "string") ? listed : context.config.schemas;
-}
-const exposed = (context) => {
-	const schemas = exposedSchemas(context);
-	return catalogOf(context).tables.filter((table) => schemas.includes(table.schema));
-};
-const qualified = (table) => `${table.schema}.${table.name}`;
-const tableObject = (table) => ({
-	kind: "table",
-	schema: table.schema,
-	name: table.name
-});
-const policyObject = (table, policy) => ({
-	kind: "policy",
-	schema: table.schema,
-	name: policy.name,
-	table: table.name
-});
-const splitTexts = /* @__PURE__ */ new Map();
-const SPLIT_CACHE_SIZE = 64;
-/** `text` split into lines; doctor locates many objects in the same SQL files. */
-function linesOf(text) {
-	let lines = splitTexts.get(text);
-	if (!lines) {
-		if (splitTexts.size >= SPLIT_CACHE_SIZE) splitTexts.clear();
-		lines = text.split("\n");
-		splitTexts.set(text, lines);
-	}
-	return lines;
-}
-/** Line number (1-based) of the first line matching `pattern`. */
-function lineOf(text, pattern) {
-	const index = linesOf(text).findIndex((line) => pattern.test(line));
-	return index === -1 ? void 0 : index + 1;
-}
-/** The keys of `authorization.permissions`, for `api-keys` scopes `"catalog"`. */
-const permissionCatalogKeys = (context) => context.config.authorization?.permissions?.map((entry) => entry.key);
-//#endregion
 //#region src/cli/doctor/rls.ts
 const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /** `'it''s'` and other string literals, blanked so their text can't match. */
@@ -626,7 +594,28 @@ const TIMEOUT_ROLES = [
 	"authenticated",
 	"authenticator"
 ];
+/** Partitions of an RLS table that have RLS off: queried by name, they skip the parent's policies. */
+function partitionsWithoutRls(context) {
+	const tables = catalogOf(context).tables;
+	const byName = new Map(tables.map((table) => [qualified(table), table]));
+	return tables.flatMap((table) => {
+		if (table.partitionOf === void 0 || table.rls || !context.config.schemas.includes(table.schema)) return [];
+		if (!byName.get(table.partitionOf)?.rls) return [];
+		return [{
+			message: `${qualified(table)} is a partition of ${table.partitionOf}, which has RLS on, but RLS is off on the partition. A query that names the partition skips the parent's policies, and Data API roles with a grant on it read every row. Run \`alter table ${qualified(table)} enable row level security;\`, and add the same enable to the code that creates new partitions.`,
+			target: qualified(table),
+			object: tableObject(table)
+		}];
+	});
+}
 const RLS_RULES = [
+	{
+		code: "BS343",
+		severity: "error",
+		title: "Partition without row level security",
+		description: "A table in `schemas` is a partition of a table with RLS on, but has RLS off itself. Policies belong to the parent, so a query that names the partition (`select * from events_default`) never applies them. This includes the default partition. Enable RLS on every partition when you create it; the partition functions of the SQL modules (`ensure_partitions`, ADR 0038) already do.",
+		check: partitionsWithoutRls
+	},
 	{
 		code: "BS205",
 		severity: "warning",
@@ -1536,4 +1525,4 @@ async function runGen(options) {
 	};
 }
 //#endregion
-export { renderFiles as A, policyObject as C, advisorRule as D, workflowOf as E, splinterTables as O, permissionCatalogKeys as S, tableObject as T, withoutStrings as _, METADATA_GAPS_TEXT as a, exposedSchemas as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, emitBlockConfig as j, render as k, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, catalogOf as v, qualified as w, lineOf as x, exposed as y };
+export { emitBlockConfig as S, withoutStrings as _, METADATA_GAPS_TEXT as a, render as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, advisorRule as v, renderFiles as x, splinterTables as y };

package/dist/cli/{run-CM_2g6KQ.js → run-nX5ffQM_.js}

@@ -1,10 +1,10 @@
-import { c as COMMANDS, d as GROUPS, f as RESERVED_NAMES, h as runCommand, i as joinRepeated, m as parseArgs$2, o as listArgs, s as runsWithInvalidConfig, t as GLOBAL_ARGS, u as DOCS_ORIGIN } from "./command-CK9Cn8HV.js";
+import { c as COMMANDS, d as GROUPS, f as RESERVED_NAMES, h as runCommand, i as joinRepeated, m as parseArgs$2, o as listArgs, s as runsWithInvalidConfig, t as GLOBAL_ARGS, u as DOCS_ORIGIN } from "./command-DLCZeHdo.js";
 import { n as highlight, r as painter } from "./style-2JfIPVMQ.js";
-import { t as VERSION } from "./version-DNRW4DAP.js";
+import { t as VERSION } from "./version-CUKjFbNd.js";
 import { n as CliError, o as toCliError } from "./errors-Caiz_0so.js";
-import { a as resolveAgent, i as missingInputNext, t as checkConsent } from "./agent-CCt_aXpJ.js";
-import { a as globalFlags, c as resolveCommand, i as commandTree, n as closestName, o as isVariadic, r as commandArgs, t as checkArgs } from "./parse-DE59XyWt.js";
-import { n as movedCommand, r as movedFlag } from "./moved-D9OT_Uyy.js";
+import { a as missingInputNext, o as resolveAgent, t as checkConsent } from "./agent-CCrTYK3W.js";
+import { a as globalFlags, c as resolveCommand, i as commandTree, n as closestName, o as isVariadic, r as commandArgs, t as checkArgs } from "./parse-ksnw4phM.js";
+import { n as movedCommand, r as movedFlag } from "./moved-BmtFuMK3.js";
 import { n as HTTP_CHANNEL, t as EXEC_CHANNEL } from "./trace-VbdO6bcN.js";
 import { stripVTControlCharacters } from "node:util";
 import { subscribe, unsubscribe } from "node:diagnostics_channel";
@@ -16,39 +16,41 @@ import { resolve } from "node:path";
 * Each loads on demand, so `--version` and `--help` import no command.
 */
 const LOADERS = [
-	["init", () => import("./init-B1dL-RZL.js").then((m) => m.initCommand)],
-	["add", () => import("./add-CT6p5psO.js").then((m) => m.addCommand)],
-	["apply", () => import("./apply-Dxk8AUNU.js").then((m) => m.applyCommand)],
-	["adopt", () => import("./adopt-C9jl8z0h.js").then((m) => m.adoptCommand)],
-	["preset decode", () => import("./preset-DmcC4nWE.js").then((m) => m.presetDecodeCommand)],
-	["preset info", () => import("./preset-DmcC4nWE.js").then((m) => m.presetInfoCommand)],
-	["blocks list", () => import("./blocks-Bzz326nn.js").then((m) => m.blocksListCommand)],
-	["blocks view", () => import("./blocks-Bzz326nn.js").then((m) => m.blocksViewCommand)],
-	["blocks search", () => import("./blocks-Bzz326nn.js").then((m) => m.blocksSearchCommand)],
-	["skills list", () => import("./skills-v34NDb2D.js").then((m) => m.skillsListCommand)],
-	["skills install", () => import("./skills-v34NDb2D.js").then((m) => m.skillsInstallCommand)],
-	["completion", () => import("./completion-J3dqnNoW.js").then((m) => m.completionCommand)],
-	["env", () => import("./env-D3gZ-OHj.js").then((m) => m.envCommand)],
-	["keys", () => import("./keys-jsxCNJdz.js").then((m) => m.keysCommand)],
-	["gen", () => import("./gen-B344S1Oy.js").then((m) => m.genCommand)],
-	["introspect", () => import("./introspect-BPcFi8ow.js").then((m) => m.introspectCommand)],
-	["spec emit", () => import("./spec-De0cfceR.js").then((m) => m.specEmitCommand)],
-	["spec validate", () => import("./spec-De0cfceR.js").then((m) => m.specValidateCommand)],
-	["scaffold api", () => import("./scaffold-Dsjr7sOT.js").then((m) => m.scaffoldApiCommand)],
-	["scaffold screens", () => import("./scaffold-Dsjr7sOT.js").then((m) => m.scaffoldScreensCommand)],
-	["seed", () => import("./seed-DtRFysBe.js").then((m) => m.seedCommand)],
-	["doctor", () => import("./doctor-SGw36h1D.js").then((m) => m.doctorCommand)],
-	["config", () => import("./config-MuKY9kUj.js").then((m) => m.configCommand)],
-	["sql list", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlListCommand)],
-	["sql add", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlAddCommand)],
-	["sql sync", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlSyncCommand)],
-	["sql upgrade", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlUpgradeCommand)],
-	["sql data", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlDataCommand)],
-	["sql print", () => import("./sql-0I1EQ3JG.js").then((m) => m.sqlPrintCommand)],
-	["codemod 0.4", () => import("./codemod-woL4cVe0.js").then((m) => m.codemodCommand("0.4"))],
-	["codemod 0.5", () => import("./codemod-woL4cVe0.js").then((m) => m.codemodCommand("0.5"))],
-	["codemod 0.6", () => import("./codemod-woL4cVe0.js").then((m) => m.codemodCommand("0.6"))],
-	["codemod 0.9", () => import("./codemod-woL4cVe0.js").then((m) => m.codemodCommand("0.9"))]
+	["init", () => import("./init-Cx7DDAdQ.js").then((m) => m.initCommand)],
+	["add", () => import("./add-DzRJEHzD.js").then((m) => m.addCommand)],
+	["apply", () => import("./apply-4BmTvj2A.js").then((m) => m.applyCommand)],
+	["adopt", () => import("./adopt-DDy50yz9.js").then((m) => m.adoptCommand)],
+	["preset decode", () => import("./preset-B1o6KbFp.js").then((m) => m.presetDecodeCommand)],
+	["preset info", () => import("./preset-B1o6KbFp.js").then((m) => m.presetInfoCommand)],
+	["blocks list", () => import("./blocks-bBI050w6.js").then((m) => m.blocksListCommand)],
+	["blocks view", () => import("./blocks-bBI050w6.js").then((m) => m.blocksViewCommand)],
+	["blocks search", () => import("./blocks-bBI050w6.js").then((m) => m.blocksSearchCommand)],
+	["skills list", () => import("./skills-CUx7S0bk.js").then((m) => m.skillsListCommand)],
+	["skills install", () => import("./skills-CUx7S0bk.js").then((m) => m.skillsInstallCommand)],
+	["completion", () => import("./completion-D2BObVth.js").then((m) => m.completionCommand)],
+	["env", () => import("./env-D-O91RK1.js").then((m) => m.envCommand)],
+	["keys", () => import("./keys-6ufnWeZl.js").then((m) => m.keysCommand)],
+	["gen", () => import("./gen-D2E8osBE.js").then((m) => m.genCommand)],
+	["introspect", () => import("./introspect-Ck7aa6v0.js").then((m) => m.introspectCommand)],
+	["spec emit", () => import("./spec-DjHpWZJM.js").then((m) => m.specEmitCommand)],
+	["spec validate", () => import("./spec-DjHpWZJM.js").then((m) => m.specValidateCommand)],
+	["scaffold api", () => import("./scaffold-fO-FJGoO.js").then((m) => m.scaffoldApiCommand)],
+	["scaffold screens", () => import("./scaffold-fO-FJGoO.js").then((m) => m.scaffoldScreensCommand)],
+	["seed", () => import("./seed-C_BmN498.js").then((m) => m.seedCommand)],
+	["db query", () => import("./db-BxMRcHrY.js").then((m) => m.dbQueryCommand)],
+	["doctor", () => import("./doctor-D47sFjh9.js").then((m) => m.doctorCommand)],
+	["config", () => import("./config-CC5DXgKX.js").then((m) => m.configCommand)],
+	["mcp", () => import("./mcp-BVWvEoKo.js").then((m) => m.mcpCommand)],
+	["sql list", () => import("./sql-C4ymac2h.js").then((m) => m.sqlListCommand)],
+	["sql add", () => import("./sql-C4ymac2h.js").then((m) => m.sqlAddCommand)],
+	["sql sync", () => import("./sql-C4ymac2h.js").then((m) => m.sqlSyncCommand)],
+	["sql upgrade", () => import("./sql-C4ymac2h.js").then((m) => m.sqlUpgradeCommand)],
+	["sql data", () => import("./sql-C4ymac2h.js").then((m) => m.sqlDataCommand)],
+	["sql print", () => import("./sql-C4ymac2h.js").then((m) => m.sqlPrintCommand)],
+	["codemod 0.4", () => import("./codemod-vsknM1Ue.js").then((m) => m.codemodCommand("0.4"))],
+	["codemod 0.5", () => import("./codemod-vsknM1Ue.js").then((m) => m.codemodCommand("0.5"))],
+	["codemod 0.6", () => import("./codemod-vsknM1Ue.js").then((m) => m.codemodCommand("0.6"))],
+	["codemod 0.9", () => import("./codemod-vsknM1Ue.js").then((m) => m.codemodCommand("0.9"))]
 ];
 /** The built-in commands, for `createCli`. */
 function builtinCommands() {
@@ -447,7 +449,7 @@ function cliFromTree(init, extra = {}) {
 		};
 		if (argv[0] === "__complete") {
 			const words = argv[1] === "--" ? argv.slice(2) : argv.slice(1);
-			const lines = await import("./completion-BO5UK6bG.js").then(async ({ complete, completionLines }) => completionLines(await complete(tree, words))).catch(() => "");
+			const lines = await import("./completion-CEZ-c3ja.js").then(async ({ complete, completionLines }) => completionLines(await complete(tree, words))).catch(() => "");
 			if (lines !== "") out(lines);
 			return {
 				code: 0,
@@ -576,8 +578,8 @@ function cliFromTree(init, extra = {}) {
 		try {
 			const [loaded, { defaultConfig, discoverConfig, loadConfig }, { configEnvironment, isCi, parseEnv }] = await Promise.all([
 				node.load(),
-				import("./config-C1d-mbUA.js"),
-				import("./env-DJ4ZaJpe.js")
+				import("./config-CynctXbc.js"),
+				import("./env-B7TWPEt0.js")
 			]);
 			command = loaded;
 			rawArgs = joinRepeated(rest, listArgs(command));
@@ -681,4 +683,4 @@ const help = (command, color) => defaultCli.help(command, color);
 /** The names `run()` dispatches. */
 const commandNames = () => defaultCli.commandNames();
 //#endregion
-export { run as i, createCli as n, help as r, commandNames as t };
+export { envelope as a, run as i, createCli as n, help as r, commandNames as t };

package/dist/cli/{scaffold-CFdDq36-.js → scaffold-DcXr4z7M.js}

@@ -1,11 +1,11 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as display } from "./io-BiPX-_J1.js";
-import { d as applyCasing, i as metaPaths } from "./emit-ZAYeh4Yn.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { d as applyCasing, i as metaPaths } from "./emit-56LAG_Px.js";
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
 import { a as hasConflicts, n as applyPlan, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { t as detectProject } from "./detect-DYDUBLU4.js";
+import { t as detectProject } from "./detect-DQsVeBHg.js";
 import { existsSync } from "node:fs";
 import { posix, resolve } from "node:path";
 import { FIELD_FORMATS } from "better-supabase/config";

package/dist/cli/{scaffold-Dsjr7sOT.js → scaffold-fO-FJGoO.js}

@@ -1 +1 @@
-export { r as scaffoldApiCommand, i as scaffoldScreensCommand } from "./scaffold-CFdDq36-.js";
+export { r as scaffoldApiCommand, i as scaffoldScreensCommand } from "./scaffold-DcXr4z7M.js";

package/dist/cli/{seed-DldDdXWO.js → seed-BmOC6_iz.js}

@@ -1,11 +1,11 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
-import { n as databaseHost, r as isLocalDatabaseUrl } from "./agent-CCt_aXpJ.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
+import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CCrTYK3W.js";
 import { t as display } from "./io-BiPX-_J1.js";
-import { l as stdinDatabaseUrl, n as databaseUrl, o as importExport } from "./config-CLHpTk9Y.js";
-import { m as supabaseDir } from "./supabase-toml-DjLgBYEo.js";
+import { l as stdinDatabaseUrl, n as databaseUrl, o as importExport } from "./config-C4e_RrmL.js";
+import { m as supabaseDir } from "./supabase-toml-BC5sNVKU.js";
 import { t as connect } from "./db-DT1bGB02.js";
 import { a as hasConflicts, n as applyPlan, o as insideRoot, r as changeLines, s as planResult, t as PLAN_ARGS } from "./files-DDvAwTko.js";
-import { t as DB_URL_STDIN_ARG } from "./source-args-0I9zylYy.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-BDiUhsH8.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
@@ -49,7 +49,7 @@ async function runSeed(config, args, env, open = connect, dbUrl, requireConsent
 			note: `${statements.length} table${statements.length === 1 ? "" : "s"}`
 		}]
 	};
-	const url = args.apply === true && args["dry-run"] !== true && args.check !== true ? await databaseUrl(config, env, dbUrl) : void 0;
+	const url = args.apply === true && args["dry-run"] !== true && args.check !== true ? await databaseUrl(config, env, dbUrl, args.stack ?? env.BSB_STACK) : void 0;
 	if (url !== void 0 && !isLocalDatabaseUrl(url)) requireConsent({
 		effect: "database-write",
 		detail: `seed --apply inserts rows into ${databaseHost(url)}`
@@ -101,6 +101,7 @@ const seedCommand = defineCliCommand({
 	args: {
 		...ARGS,
 		...DB_URL_STDIN_ARG,
+		...STACK_ARG,
 		...PLAN_ARGS
 	},
 	run: async (args, { config, env, io, log, requireConsent }) => {

package/dist/cli/seed-C_BmN498.js

@@ -0,0 +1 @@
+export { n as seedCommand } from "./seed-BmOC6_iz.js";