supaschema 0.1.0-rc.1

package/dist/sql/ast.d.ts

@@ -0,0 +1,42 @@
+export type AstNode = Record<string, unknown>;
+export interface QualifiedName {
+    name: string;
+    schema: string;
+}
+export interface AstStatement {
+    byteStart: number;
+    node: AstNode;
+    tag: string;
+    text: string;
+}
+export declare function asRecord(value: unknown): AstNode | undefined;
+export declare function readArray(value: unknown): unknown[];
+export declare function readString(value: unknown): string | undefined;
+export declare function readBoolean(value: unknown): boolean;
+export declare function readNumber(value: unknown): number | undefined;
+export declare function stringValue(value: unknown): string | undefined;
+export declare function listItems(value: unknown): unknown[];
+export declare function stringList(value: unknown): string[];
+export declare function astStatements(ast: unknown, sql: string): AstStatement[];
+export declare function rangeVarName(value: unknown): QualifiedName | undefined;
+export declare function qualifiedName(value: unknown): QualifiedName | undefined;
+export declare function typeNameToSql(value: unknown): string;
+export declare function roleSpecName(value: unknown): string | undefined;
+export interface FunctionIdentity extends QualifiedName {
+    signature: string;
+}
+export declare function functionIdentity(funcname: unknown, parameters: unknown): FunctionIdentity | undefined;
+export declare function objectWithArgsIdentity(value: unknown): FunctionIdentity | undefined;
+export interface ColumnFacts {
+    name: string;
+    notNull: boolean;
+    hasDefault: boolean;
+    identity: boolean;
+    generated: boolean;
+    hasInlineConstraint: boolean;
+    type: string;
+    location: number;
+}
+export declare function collectReferences(value: unknown, into?: Set<string>): Set<string>;
+export declare function columnFacts(value: unknown): ColumnFacts | undefined;
+//# sourceMappingURL=ast.d.ts.map

package/dist/sql/ast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ast.d.ts","sourceRoot":"","sources":["../../src/sql/ast.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE9C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,GAAG,SAAS,CAE5D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,CAEnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE7D;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,EAAE,CAMnD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAInD;AAED,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,YAAY,EAAE,CA0BvE;AAID,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAUtE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAYvE;AAoBD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMpD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAO/D;AAED,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,OAAO,EACjB,UAAU,EAAE,OAAO,GAClB,gBAAgB,GAAG,SAAS,CAmB9B;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAQnF;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE,GAAG,CAAC,MAAM,CAAa,GAAG,GAAG,CAAC,MAAM,CAAC,CAsC5F;AAaD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,SAAS,CA8CnE"}

package/dist/sql/ast.js

@@ -0,0 +1,241 @@
+export function asRecord(value) {
+    return value && typeof value === "object" ? value : undefined;
+}
+export function readArray(value) {
+    return Array.isArray(value) ? value : [];
+}
+export function readString(value) {
+    return typeof value === "string" ? value : undefined;
+}
+export function readBoolean(value) {
+    if (value === true) {
+        return true;
+    }
+    const booleanNode = asRecord(asRecord(value)?.Boolean);
+    return booleanNode?.boolval === true;
+}
+export function readNumber(value) {
+    return typeof value === "number" ? value : undefined;
+}
+export function stringValue(value) {
+    return readString(asRecord(asRecord(value)?.String)?.sval);
+}
+export function listItems(value) {
+    const direct = readArray(value);
+    if (direct.length > 0) {
+        return direct;
+    }
+    return readArray(asRecord(asRecord(value)?.List)?.items);
+}
+export function stringList(value) {
+    return listItems(value)
+        .map((item) => stringValue(item))
+        .filter((item) => item !== undefined);
+}
+export function astStatements(ast, sql) {
+    const statements = [];
+    const bytes = Buffer.from(sql, "utf8");
+    for (const raw of readArray(asRecord(ast)?.stmts)) {
+        const record = asRecord(raw);
+        const node = asRecord(record?.stmt);
+        if (!node) {
+            continue;
+        }
+        const tag = Object.keys(node)[0] ?? "";
+        const location = readNumber(record?.stmt_location) ?? 0;
+        const length = readNumber(record?.stmt_len);
+        const end = length === undefined ? bytes.length : location + length;
+        let byteStart = location;
+        while (byteStart < end && asciiWhitespace.has(bytes[byteStart] ?? -1)) {
+            byteStart += 1;
+        }
+        statements.push({
+            byteStart,
+            node,
+            tag,
+            text: bytes.subarray(byteStart, end).toString("utf8").trimEnd(),
+        });
+    }
+    return statements;
+}
+const asciiWhitespace = new Set([0x20, 0x09, 0x0a, 0x0d, 0x0c, 0x0b]);
+export function rangeVarName(value) {
+    const relation = asRecord(asRecord(value)?.RangeVar) ?? asRecord(value);
+    const relname = readString(relation?.relname);
+    if (!relname) {
+        return undefined;
+    }
+    return {
+        name: relname,
+        schema: readString(relation?.schemaname) ?? "public",
+    };
+}
+export function qualifiedName(value) {
+    const parts = stringList(value);
+    if (parts.length === 0) {
+        return undefined;
+    }
+    if (parts.length === 1) {
+        return { name: parts[0] ?? "", schema: "public" };
+    }
+    return {
+        name: parts.at(-1) ?? "",
+        schema: parts.at(-2) ?? "public",
+    };
+}
+const internalTypeNames = new Map([
+    ["bool", "boolean"],
+    ["bpchar", "character"],
+    ["char", '"char"'],
+    ["float4", "real"],
+    ["float8", "double precision"],
+    ["int2", "smallint"],
+    ["int4", "integer"],
+    ["int8", "bigint"],
+    ["time", "time without time zone"],
+    ["varbit", "bit varying"],
+    ["timestamp", "timestamp without time zone"],
+    ["timestamptz", "timestamp with time zone"],
+    ["timetz", "time with time zone"],
+    ["varchar", "character varying"],
+]);
+export function typeNameToSql(value) {
+    const typeName = asRecord(asRecord(value)?.TypeName) ?? asRecord(value);
+    const names = stringList(typeName?.names).filter((name) => name !== "pg_catalog");
+    const base = names.map((name) => internalTypeNames.get(name) ?? name).join(".");
+    const arraySuffix = "[]".repeat(readArray(typeName?.arrayBounds).length);
+    return `${base}${arraySuffix}`;
+}
+export function roleSpecName(value) {
+    const role = asRecord(asRecord(value)?.RoleSpec) ?? asRecord(value);
+    const roletype = readString(role?.roletype);
+    if (roletype === "ROLESPEC_PUBLIC") {
+        return "PUBLIC";
+    }
+    return readString(role?.rolename);
+}
+export function functionIdentity(funcname, parameters) {
+    const name = qualifiedName(funcname);
+    if (!name) {
+        return undefined;
+    }
+    const args = [];
+    for (const item of readArray(parameters)) {
+        const parameter = asRecord(asRecord(item)?.FunctionParameter);
+        if (!parameter) {
+            continue;
+        }
+        const mode = readString(parameter.mode) ?? "FUNC_PARAM_DEFAULT";
+        if (mode === "FUNC_PARAM_OUT" || mode === "FUNC_PARAM_TABLE") {
+            continue;
+        }
+        const prefix = mode === "FUNC_PARAM_VARIADIC" ? "VARIADIC " : "";
+        args.push(`${prefix}${typeNameToSql(parameter.argType)}`);
+    }
+    return { ...name, signature: args.join(", ") };
+}
+export function objectWithArgsIdentity(value) {
+    const object = asRecord(asRecord(value)?.ObjectWithArgs) ?? asRecord(value);
+    const name = qualifiedName(object?.objname);
+    if (!name) {
+        return undefined;
+    }
+    const args = readArray(object?.objargs).map((item) => typeNameToSql(item));
+    return { ...name, signature: args.join(", ") };
+}
+export function collectReferences(value, into = new Set()) {
+    if (Array.isArray(value)) {
+        for (const item of value) {
+            collectReferences(item, into);
+        }
+        return into;
+    }
+    const record = asRecord(value);
+    if (!record) {
+        return into;
+    }
+    const rangeVar = asRecord(record.RangeVar);
+    if (rangeVar) {
+        const name = rangeVarName(rangeVar);
+        if (name) {
+            into.add(`${name.schema}.${name.name}`);
+        }
+    }
+    const funcCall = asRecord(record.FuncCall);
+    if (funcCall) {
+        const name = qualifiedNameWhenQualified(funcCall.funcname);
+        if (name) {
+            into.add(`${name.schema}.${name.name}`);
+        }
+    }
+    const typeName = asRecord(record.TypeName);
+    if (typeName) {
+        const name = qualifiedNameWhenQualified(typeName.names);
+        if (name && name.schema !== "pg_catalog") {
+            into.add(`${name.schema}.${name.name}`);
+        }
+    }
+    for (const child of Object.values(record)) {
+        if (child && typeof child === "object") {
+            collectReferences(child, into);
+        }
+    }
+    return into;
+}
+function qualifiedNameWhenQualified(value) {
+    const parts = stringList(value);
+    if (parts.length < 2) {
+        return undefined;
+    }
+    return {
+        name: parts.at(-1) ?? "",
+        schema: parts.at(-2) ?? "",
+    };
+}
+export function columnFacts(value) {
+    const column = asRecord(asRecord(value)?.ColumnDef);
+    const name = readString(column?.colname);
+    if (!column || !name) {
+        return undefined;
+    }
+    let notNull = false;
+    let hasDefault = false;
+    let identity = false;
+    let generated = false;
+    let hasInlineConstraint = false;
+    for (const item of readArray(column.constraints)) {
+        const constraint = asRecord(asRecord(item)?.Constraint);
+        const contype = readString(constraint?.contype);
+        switch (contype) {
+            case "CONSTR_NOTNULL":
+                notNull = true;
+                break;
+            case "CONSTR_DEFAULT":
+                hasDefault = true;
+                break;
+            case "CONSTR_IDENTITY":
+                identity = true;
+                break;
+            case "CONSTR_GENERATED":
+                generated = true;
+                break;
+            case "CONSTR_NULL":
+                break;
+            default:
+                if (contype !== undefined) {
+                    hasInlineConstraint = true;
+                }
+                break;
+        }
+    }
+    return {
+        generated,
+        hasDefault,
+        hasInlineConstraint,
+        identity,
+        location: readNumber(column.location) ?? -1,
+        name,
+        notNull,
+        type: typeNameToSql(column.typeName),
+    };
+}

package/dist/sql/canonical-nodes.d.ts

@@ -0,0 +1,5 @@
+type Scope = string | null;
+export declare function canonicalPolicyNode(node: unknown, scopes?: Scope[]): unknown;
+export declare function canonicalViewNode(node: unknown, scopes: Scope[]): unknown;
+export {};
+//# sourceMappingURL=canonical-nodes.d.ts.map

package/dist/sql/canonical-nodes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-nodes.d.ts","sourceRoot":"","sources":["../../src/sql/canonical-nodes.ts"],"names":[],"mappings":"AAEA,KAAK,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC;AAE3B,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,GAAE,KAAK,EAAO,GAAG,OAAO,CA0ChF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAkBzE"}

package/dist/sql/canonical-nodes.js

@@ -0,0 +1,101 @@
+import { asRecord } from "./ast.js";
+export function canonicalPolicyNode(node, scopes = []) {
+    if (Array.isArray(node)) {
+        return node.map((item) => canonicalPolicyNode(item, scopes));
+    }
+    if (typeof node !== "object" || node === null) {
+        return node;
+    }
+    const record = node;
+    const typeCast = asRecord(record.TypeCast);
+    if (typeCast && asRecord(typeCast.arg)?.A_Const !== undefined) {
+        return canonicalPolicyNode(typeCast.arg, scopes);
+    }
+    // A subquery inside a policy expression is its own SELECT scope. pg_get_expr
+    // qualifies that subquery's columns with its relation (`members.item_id`)
+    // where the declarative source writes them bare (`item_id`); stripping the
+    // sole-from-relation qualifier of the innermost scope converges both lanes,
+    // exactly as canonicalViewNode does. Correlated refs to an outer scope keep
+    // their written qualification (the conservative stance that never masks a
+    // real change).
+    const selectStmt = asRecord(record.SelectStmt);
+    if (selectStmt) {
+        const next = [...scopes, soleFromRelation(selectStmt)];
+        const inner = {};
+        for (const [key, value] of Object.entries(selectStmt)) {
+            inner[key] = canonicalPolicyNode(value, next);
+        }
+        return { ...record, SelectStmt: inner };
+    }
+    const columnRef = asRecord(record.ColumnRef);
+    if (columnRef) {
+        return { ...record, ColumnRef: canonicalColumnRef(columnRef, scopes) };
+    }
+    const result = {};
+    for (const [key, value] of Object.entries(record)) {
+        if (key === "ResTarget" && typeof value === "object" && value !== null) {
+            const { name: _alias, ...rest } = value;
+            result[key] = canonicalPolicyNode(rest, scopes);
+            continue;
+        }
+        result[key] = canonicalPolicyNode(value, scopes);
+    }
+    return result;
+}
+export function canonicalViewNode(node, scopes) {
+    if (Array.isArray(node)) {
+        return node.map((item) => canonicalViewNode(item, scopes));
+    }
+    if (typeof node !== "object" || node === null) {
+        return node;
+    }
+    const record = node;
+    const selectStmt = asRecord(record.SelectStmt);
+    if (selectStmt) {
+        const next = [...scopes, soleFromRelation(selectStmt)];
+        return { ...record, SelectStmt: canonicalChildren(selectStmt, next) };
+    }
+    const columnRef = asRecord(record.ColumnRef);
+    if (columnRef) {
+        return { ...record, ColumnRef: canonicalColumnRef(columnRef, scopes) };
+    }
+    return canonicalChildren(record, scopes);
+}
+function canonicalColumnRef(columnRef, scopes) {
+    const fields = columnRef.fields;
+    if (!Array.isArray(fields) || fields.length !== 2) {
+        return columnRef;
+    }
+    const qualifier = stringField(fields[0]);
+    const innermost = scopes.at(-1);
+    if (qualifier === undefined || innermost === null || qualifier !== innermost) {
+        return columnRef;
+    }
+    return { ...columnRef, fields: [fields[1]] };
+}
+function soleFromRelation(selectStmt) {
+    const fromClause = selectStmt.fromClause;
+    if (!Array.isArray(fromClause) || fromClause.length !== 1) {
+        return null;
+    }
+    const rangeVar = asRecord(asRecord(fromClause[0])?.RangeVar);
+    if (!rangeVar) {
+        return null;
+    }
+    const aliasName = asRecord(rangeVar.alias)?.aliasname;
+    if (typeof aliasName === "string") {
+        return aliasName;
+    }
+    return typeof rangeVar.relname === "string" ? rangeVar.relname : null;
+}
+function canonicalChildren(record, scopes) {
+    const result = {};
+    for (const [key, child] of Object.entries(record)) {
+        result[key] = canonicalViewNode(child, scopes);
+    }
+    return result;
+}
+function stringField(field) {
+    const sval = asRecord(asRecord(field)?.String)?.sval;
+    return typeof sval === "string" ? sval : undefined;
+}

package/dist/sql/extract-helpers.d.ts

@@ -0,0 +1,18 @@
+import type { Diagnostic, SchemaObject, SupaschemaConfig } from "../core.js";
+import type { AstNode } from "./ast.js";
+export type ParseStatementResult = {
+    diagnostics: Diagnostic[];
+    objects: SchemaObject[];
+};
+export declare function alterTableObjects(node: AstNode, statement: string, ordinal: number, file: string | undefined): SchemaObject[] | undefined;
+/**
+ * Reads the OWNED BY target from ALTER SEQUENCE options: `null` for
+ * OWNED BY NONE, the dotted column path otherwise, `undefined` when the
+ * statement carries no owned_by option (other ALTER SEQUENCE forms stay
+ * unsupported).
+ */
+export declare function sequenceOwnedByOption(options: unknown): string | null | undefined;
+export declare function extensionSchemaOption(options: unknown): string | undefined;
+export declare function withManagedSchemaDiagnostics(objects: SchemaObject[], statement: string, config: SupaschemaConfig, file: string | undefined): ParseStatementResult;
+export declare function supabaseViewSecurityDiagnostics(objects: SchemaObject[], config: SupaschemaConfig): Diagnostic[];
+//# sourceMappingURL=extract-helpers.d.ts.map

package/dist/sql/extract-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-helpers.d.ts","sourceRoot":"","sources":["../../src/sql/extract-helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE7E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAIxC,MAAM,MAAM,oBAAoB,GAAG;IACjC,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC;AAEF,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,OAAO,EACb,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,YAAY,EAAE,GAAG,SAAS,CAgE5B;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,CAajF;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAY1E;AAED,wBAAgB,4BAA4B,CAC1C,OAAO,EAAE,YAAY,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,oBAAoB,CAMtB;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,YAAY,EAAE,EACvB,MAAM,EAAE,gBAAgB,GACvB,UAAU,EAAE,CA0Bd"}

package/dist/sql/extract-helpers.js

@@ -0,0 +1,127 @@
+import { diagnostic } from "../diagnostics.js";
+import { asRecord, rangeVarName, readArray, readString, stringList } from "./ast.js";
+import { makeObject } from "./statements.js";
+export function alterTableObjects(node, statement, ordinal, file) {
+    const table = rangeVarName(node.relation);
+    if (!table) {
+        return undefined;
+    }
+    const command = readArray(node.cmds)
+        .map((item) => asRecord(asRecord(item)?.AlterTableCmd))
+        .find((item) => item !== undefined);
+    const subtype = readString(command?.subtype);
+    if (subtype === "AT_AddConstraint") {
+        const constraint = asRecord(asRecord(command?.def)?.Constraint);
+        const name = readString(constraint?.conname);
+        if (!name) {
+            return undefined;
+        }
+        return [
+            makeObject({
+                kind: "constraint",
+                name,
+                schema: table.schema,
+                table: table.name,
+            }, statement, ordinal, file),
+        ];
+    }
+    if (subtype === "AT_EnableRowSecurity" ||
+        subtype === "AT_DisableRowSecurity" ||
+        subtype === "AT_ForceRowSecurity" ||
+        subtype === "AT_NoForceRowSecurity") {
+        return [
+            makeObject({ kind: "rls", name: table.name, schema: table.schema, table: table.name }, statement, ordinal, file, { rlsSubtype: subtype }),
+        ];
+    }
+    if (subtype === "AT_ColumnDefault") {
+        const column = readString(command?.name);
+        if (!column) {
+            return undefined;
+        }
+        return [
+            makeObject({ kind: "table", name: table.name, schema: table.schema }, statement, ordinal, file, {
+                columnDefaultAmendment: { column, expression: command?.def ?? null },
+            }),
+        ];
+    }
+    return undefined;
+}
+/**
+ * Reads the OWNED BY target from ALTER SEQUENCE options: `null` for
+ * OWNED BY NONE, the dotted column path otherwise, `undefined` when the
+ * statement carries no owned_by option (other ALTER SEQUENCE forms stay
+ * unsupported).
+ */
+export function sequenceOwnedByOption(options) {
+    for (const item of readArray(options)) {
+        const defElem = asRecord(asRecord(item)?.DefElem);
+        if (readString(defElem?.defname) !== "owned_by") {
+            continue;
+        }
+        const parts = stringList(defElem?.arg);
+        if (parts.length === 0) {
+            return undefined;
+        }
+        return parts.at(-1) === "none" ? null : parts.join(".");
+    }
+    return undefined;
+}
+export function extensionSchemaOption(options) {
+    for (const item of readArray(options)) {
+        const defElem = asRecord(asRecord(item)?.DefElem);
+        if (readString(defElem?.defname) !== "schema") {
+            continue;
+        }
+        const value = readString(asRecord(asRecord(defElem?.arg)?.String)?.sval);
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+export function withManagedSchemaDiagnostics(objects, statement, config, file) {
+    const diagnostics = [];
+    for (const object of objects) {
+        diagnostics.push(...managedSchemaDiagnostics(object, statement, config, file));
+    }
+    return { diagnostics, objects };
+}
+export function supabaseViewSecurityDiagnostics(objects, config) {
+    if (config.adapter !== "supabase-auto") {
+        return [];
+    }
+    const diagnostics = [];
+    for (const object of objects) {
+        if (object.ref.kind !== "view" || (object.ref.schema ?? "public") !== "public") {
+            continue;
+        }
+        if (object.metadata.securityInvoker === true) {
+            continue;
+        }
+        diagnostics.push(diagnostic("SUPA_SUPABASE_VIEW_SECURITY_INVOKER", "warning", `view "public"."${object.ref.name}" in an exposed schema does not set security_invoker`, {
+            file: object.file,
+            hint: "Add WITH (security_invoker = true) so row level security applies to the querying role.",
+            ref: object.ref,
+        }));
+    }
+    return diagnostics;
+}
+function managedSchemaDiagnostics(object, statement, config, file) {
+    if (config.adapter !== "supabase-auto") {
+        return [];
+    }
+    const refSchema = object.ref.kind === "schema" ? object.ref.name : object.ref.schema;
+    const metadataSchema = typeof object.metadata.schema === "string" ? object.metadata.schema : undefined;
+    const schema = [refSchema, metadataSchema].find((candidate) => candidate !== undefined && config.managedSchemas.includes(candidate));
+    if (!schema) {
+        return [];
+    }
+    return [
+        diagnostic("SUPA_SUPABASE_MANAGED_SCHEMA", "error", `schema "${schema}" is managed by Supabase and is not a declarative source owner`, {
+            file,
+            hint: `Move this statement out of the declarative tree, or exclude the schema with config schemas.exclude: ["${schema}"].`,
+            ref: object.ref,
+            statement,
+        }),
+    ];
+}

package/dist/sql/extract.d.ts

@@ -0,0 +1,13 @@
+import type { Diagnostic, ExtractOptions, SchemaObject } from "../core.js";
+type ExtractObjectsOptions = ExtractOptions & {
+    file?: string;
+    startOrdinal?: number;
+};
+type ExtractObjectsResult = {
+    diagnostics: Diagnostic[];
+    nextOrdinal: number;
+    objects: SchemaObject[];
+};
+export declare function extractObjectsFromSql(sql: string, options?: ExtractObjectsOptions): Promise<ExtractObjectsResult>;
+export {};
+//# sourceMappingURL=extract.d.ts.map

package/dist/sql/extract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract.d.ts","sourceRoot":"","sources":["../../src/sql/extract.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EAGd,YAAY,EAEb,MAAM,YAAY,CAAC;AAiCpB,KAAK,qBAAqB,GAAG,cAAc,GAAG;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB,CAAC;AAcF,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,EACX,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CA6C/B"}