supatool 0.4.3 → 0.5.0

package/dist/bin/supatool.js

@@ -258,7 +258,8 @@ program
             connectionString: config.connectionString,
             schemaDir: options.schemaDir,
             tablePattern: options.tables,
-            force: options.force
+            force: options.force,
+            migrationConfig: config.migration
         });
     }
     catch (error) {
@@ -276,6 +277,7 @@ program
     .option('--auto-apply', 'Auto-apply to remote (no confirmation)')
     .option('--dry-run', 'Preview changes only (recommended)')
     .option('--generate-only', 'Generate migration files only (no apply)')
+    .option('--rls <mode>', 'RLS migration mode: rewrite = DROP+CREATE policies (default: skip)', 'skip')
     .option('--config <path>', 'Configuration file path')
     .action(async (options) => {
     const config = (0, sync_1.resolveConfig)({
@@ -328,7 +330,9 @@ program
             force: isAutoApply,
             dryRun: isDryRun,
             generateOnly: isGenerateOnly,
-            requireConfirmation: !isDryRun && !isAutoApply && !isGenerateOnly
+            requireConfirmation: !isDryRun && !isAutoApply && !isGenerateOnly,
+            migrationConfig: config.migration,
+            rlsMode: options.rls
         });
     }
     catch (error) {

package/dist/sync/config.js

@@ -72,27 +72,85 @@ function loadConfig(configPath) {
  */
 function resolveConfig(options, configPath) {
     const fileConfig = loadConfig(configPath);
+    const connectionString = options.connectionString ||
+        process.env.SUPABASE_CONNECTION_STRING ||
+        process.env.DATABASE_URL ||
+        fileConfig.connectionString;
     return {
-        connectionString: options.connectionString ||
-            process.env.SUPABASE_CONNECTION_STRING ||
-            process.env.DATABASE_URL ||
-            fileConfig.connectionString,
+        connectionString,
         schemaDir: options.schemaDir || fileConfig.schemaDir || './supabase/schemas',
-        tablePattern: options.tablePattern || fileConfig.tablePattern || '*'
+        tablePattern: options.tablePattern || fileConfig.tablePattern || '*',
+        migration: fileConfig.migration
     };
 }
 /**
- * Generate config file template
+ * Generate config file template (no connection string — use .env.local)
  */
 function createConfigTemplate(outputPath) {
     const template = {
-        connectionString: "postgresql://user:password@host:port/database",
         schemaDir: "./supabase/schemas",
         tablePattern: "*",
-        "_comment": "It is recommended to set connection string in .env or .env.local file using SUPABASE_CONNECTION_STRING or DATABASE_URL"
+        migration: {
+            naming: "timestamp",
+            "_naming_comment": "Use 'sequential' for NNN_description.sql format, 'timestamp' for YYYYMMDDHHMMSS_description.sql",
+            dir: "supabase/migrations"
+        },
+        "_comment": "Set credentials in .env.local — never put secrets in this file."
     };
     fs.writeFileSync(outputPath, JSON.stringify(template, null, 2), 'utf-8');
-    console.log(`Configuration template generated: ${outputPath}`);
-    console.log('⚠️  Remember to add the configuration file to .gitignore!');
-    console.log('💡 Manage connection string in .env or .env.local file');
+    console.log(`Config template generated: ${outputPath}`);
+    ensureEnvLocalTemplate();
+    checkGitignore(outputPath);
+}
+/**
+ * Write .env.local template if it doesn't exist yet.
+ */
+function ensureEnvLocalTemplate() {
+    const envLocalPath = path.join(process.cwd(), '.env.local');
+    if (fs.existsSync(envLocalPath))
+        return;
+    const template = [
+        '# supatool credentials — never commit this file',
+        '# Option A: Supabase URL + service role key (recommended)',
+        'SUPABASE_URL=https://your-project-ref.supabase.co',
+        'SUPABASE_SERVICE_ROLE_KEY=your-service-role-key',
+        '',
+        '# Option B: direct connection string',
+        '# SUPABASE_CONNECTION_STRING=postgresql://user:password@host:port/database',
+    ].join('\n') + '\n';
+    fs.writeFileSync(envLocalPath, template, 'utf-8');
+    console.log('.env.local template created — fill in your credentials.');
+}
+/**
+ * Warn if the config file or .env.local are not covered by .gitignore.
+ */
+function checkGitignore(configPath) {
+    const gitignorePath = path.join(process.cwd(), '.gitignore');
+    if (!fs.existsSync(gitignorePath)) {
+        console.warn('Warning: .gitignore not found. Make sure to exclude .env.local and supatool.config.json.');
+        return;
+    }
+    const content = fs.readFileSync(gitignorePath, 'utf-8');
+    const lines = content.split('\n').map(l => l.trim());
+    const missing = [];
+    const configFile = path.basename(configPath);
+    if (!lines.some(l => l === configFile || l === `/${configFile}`)) {
+        missing.push(configFile);
+    }
+    if (!lines.some(l => l === '.env.local' || l === '*.local')) {
+        missing.push('.env.local');
+    }
+    if (missing.length > 0) {
+        console.warn(`\nWarning: The following are NOT in .gitignore — add them to avoid committing secrets:`);
+        for (const f of missing) {
+            console.warn(`  ${f}`);
+        }
+        // Auto-append to .gitignore
+        const toAdd = missing.map(f => f).join('\n') + '\n';
+        fs.appendFileSync(gitignorePath, '\n# supatool\n' + toAdd);
+        console.log(`Auto-added to .gitignore: ${missing.join(', ')}`);
+    }
+    else {
+        console.log('.gitignore OK — credentials files are excluded.');
+    }
 }

package/dist/sync/generateMigration.js

@@ -34,9 +34,36 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateMigrationFile = generateMigrationFile;
+exports.generateRenameTableMigrationFile = generateRenameTableMigrationFile;
+exports.generateFunctionMigrationFile = generateFunctionMigrationFile;
+exports.generateRlsMigrationFile = generateRlsMigrationFile;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const diff_1 = require("diff");
+/**
+ * Resolve migration filename based on naming config
+ */
+function resolveMigrationFilename(migrationDir, description, naming = 'timestamp') {
+    if (naming === 'sequential') {
+        // Find max NNN from existing files
+        let max = 0;
+        if (fs.existsSync(migrationDir)) {
+            for (const f of fs.readdirSync(migrationDir)) {
+                const m = f.match(/^(\d+)_/);
+                if (m)
+                    max = Math.max(max, parseInt(m[1], 10));
+            }
+        }
+        const next = String(max + 1).padStart(3, '0');
+        return `${next}_${description}.sql`;
+    }
+    // Default: timestamp
+    const ts = new Date().toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\..+/, '')
+        .replace('T', '');
+    return `${ts}_${description}.sql`;
+}
 /**
  * Generate ALTER TABLE statements from DDL diff
  */
@@ -112,8 +139,8 @@ function generateAlterStatements(tableName, fromDdl, toDdl) {
 /**
  * Generate migration file
  */
-async function generateMigrationFile(tableName, fromDdl, toDdl, projectDir = '.') {
-    const migrationDir = path.join(projectDir, 'supabase', 'migrations');
+async function generateMigrationFile(tableName, fromDdl, toDdl, projectDir = '.', migrationConfig) {
+    const migrationDir = path.join(projectDir, migrationConfig?.dir ?? 'supabase/migrations');
     // Create migrations directory
     if (!fs.existsSync(migrationDir)) {
         fs.mkdirSync(migrationDir, { recursive: true });
@@ -121,20 +148,14 @@ async function generateMigrationFile(tableName, fromDdl, toDdl, projectDir = '.'
     // Generate ALTER TABLE statements
     const alterStatements = generateAlterStatements(tableName, fromDdl, toDdl);
     if (alterStatements.length === 0) {
-        return await generateManualMigrationTemplate(tableName, fromDdl, toDdl, projectDir);
+        return await generateManualMigrationTemplate(tableName, fromDdl, toDdl, projectDir, migrationConfig);
     }
-    // Generate filename from timestamp
-    const now = new Date();
-    const timestamp = now.toISOString()
-        .replace(/[-:]/g, '')
-        .replace(/\..+/, '')
-        .replace('T', '');
-    const filename = `${timestamp}_update_${tableName}.sql`;
+    const filename = resolveMigrationFilename(migrationDir, `update_${tableName}`, migrationConfig?.naming);
     const filepath = path.join(migrationDir, filename);
     // Build migration file content
     const content = `-- Migration generated by supatool
 -- Table: ${tableName}
--- Generated at: ${now.toISOString()}
+-- Generated at: ${new Date().toISOString()}
 
 ${alterStatements.join('\n')}
 `;
@@ -187,20 +208,14 @@ function analyzeDiffForTemplate(fromDdl, toDdl) {
 /**
  * Generate manual migration template
  */
-async function generateManualMigrationTemplate(tableName, fromDdl, toDdl, projectDir) {
-    const migrationDir = path.join(projectDir, 'supabase', 'migrations');
+async function generateManualMigrationTemplate(tableName, fromDdl, toDdl, projectDir, migrationConfig) {
+    const migrationDir = path.join(projectDir, migrationConfig?.dir ?? 'supabase/migrations');
     if (!fs.existsSync(migrationDir)) {
         fs.mkdirSync(migrationDir, { recursive: true });
     }
     // Analyze diff
     const { removedColumns, addedColumns } = analyzeDiffForTemplate(fromDdl, toDdl);
-    // Generate filename from timestamp
-    const now = new Date();
-    const timestamp = now.toISOString()
-        .replace(/[-:]/g, '')
-        .replace(/\..+/, '')
-        .replace('T', '');
-    const filename = `${timestamp}_manual_update_${tableName}.sql`;
+    const filename = resolveMigrationFilename(migrationDir, `manual_update_${tableName}`, migrationConfig?.naming);
     const filepath = path.join(migrationDir, filename);
     // Build template from actual changes
     let migrationStatements = [];
@@ -263,14 +278,100 @@ ${migrationStatements.join('\n')}
     return filepath;
 }
 /**
- * Advanced diff analysis (detect column changes)
+ * Generate a RENAME TABLE migration when a table appears renamed.
+ * (old exists on remote, new exists on local, columns are highly similar)
+ */
+async function generateRenameTableMigrationFile(schema, oldName, newName, projectDir = '.', migrationConfig) {
+    const migrationDir = path.join(projectDir, migrationConfig?.dir ?? 'supabase/migrations');
+    if (!fs.existsSync(migrationDir)) {
+        fs.mkdirSync(migrationDir, { recursive: true });
+    }
+    const filename = resolveMigrationFilename(migrationDir, `rename_${schema}_${oldName}_to_${newName}`, migrationConfig?.naming);
+    const filepath = path.join(migrationDir, filename);
+    const content = `-- Migration generated by supatool
+-- Rename table: ${schema}.${oldName} → ${schema}.${newName}
+-- Generated at: ${new Date().toISOString()}
+-- WARNING: Review carefully before applying. supatool detected this as a rename
+--          based on column similarity, but it may be an unrelated add/drop pair.
+
+ALTER TABLE ${schema === 'public' ? '' : schema + '.'}${oldName} RENAME TO ${newName};
+`;
+    fs.writeFileSync(filepath, content, 'utf-8');
+    console.log(`Rename migration generated: ${filename}`);
+    return filepath;
+}
+/**
+ * Normalize function DDL for comparison (strip supatool header comment, trailing whitespace)
  */
-function analyzeColumnChanges(tableName, localDdl, remoteDdl) {
+function normalizeFunctionDdl(ddl) {
+    return ddl
+        .split('\n')
+        .filter(line => !line.startsWith('-- Generated by supatool'))
+        .join('\n')
+        .replace(/\s+$/, '')
+        .trim();
+}
+/**
+ * Generate a migration file for a changed function.
+ * localDdl is used as-is (must be valid CREATE OR REPLACE FUNCTION DDL).
+ */
+async function generateFunctionMigrationFile(schema, funcName, localDdl, remoteDdl, projectDir = '.', migrationConfig) {
+    const normalizedLocal = normalizeFunctionDdl(localDdl);
+    const normalizedRemote = normalizeFunctionDdl(remoteDdl);
+    if (normalizedLocal === normalizedRemote)
+        return null;
+    const migrationDir = path.join(projectDir, migrationConfig?.dir ?? 'supabase/migrations');
+    if (!fs.existsSync(migrationDir)) {
+        fs.mkdirSync(migrationDir, { recursive: true });
+    }
+    const filename = resolveMigrationFilename(migrationDir, `update_fn_${schema}_${funcName}`, migrationConfig?.naming);
+    const filepath = path.join(migrationDir, filename);
+    const content = `-- Migration generated by supatool
+-- Function: ${schema}.${funcName}
+-- Generated at: ${new Date().toISOString()}
+
+${normalizedLocal.endsWith(';') ? normalizedLocal : normalizedLocal + ';'}
+`;
+    fs.writeFileSync(filepath, content, 'utf-8');
+    console.log(`Function migration generated: ${filename}`);
+    return filepath;
+}
+/**
+ * Generate DROP POLICY IF EXISTS + CREATE POLICY statements for changed policies.
+ */
+async function generateRlsMigrationFile(changedPolicies, droppedPolicies, projectDir = '.', migrationConfig) {
+    if (changedPolicies.length === 0 && droppedPolicies.length === 0)
+        return null;
+    const migrationDir = path.join(projectDir, migrationConfig?.dir ?? 'supabase/migrations');
+    if (!fs.existsSync(migrationDir)) {
+        fs.mkdirSync(migrationDir, { recursive: true });
+    }
     const statements = [];
-    // Simple case: detect column name change
-    const localLines = localDdl.split('\n').map(line => line.trim()).filter(line => line);
-    const remoteLines = remoteDdl.split('\n').map(line => line.trim()).filter(line => line);
-    // Advanced detection (type change, default change) to be implemented later
-    // Currently only basic add/remove
-    return statements;
+    for (const p of droppedPolicies) {
+        statements.push(`DROP POLICY IF EXISTS "${p.policyName}" ON ${p.tableName};`);
+    }
+    for (const p of changedPolicies) {
+        statements.push(`DROP POLICY IF EXISTS "${p.policyName}" ON ${p.tableName};`);
+        const permissive = p.permissive ? 'PERMISSIVE' : 'RESTRICTIVE';
+        const roles = p.roles || 'public';
+        let sql = `CREATE POLICY "${p.policyName}" ON ${p.tableName}\n` +
+            `  AS ${permissive} FOR ${p.cmd} TO ${roles}`;
+        if (p.qual)
+            sql += `\n  USING (${p.qual})`;
+        if (p.withCheck)
+            sql += `\n  WITH CHECK (${p.withCheck})`;
+        sql += ';';
+        statements.push(sql);
+    }
+    const filename = resolveMigrationFilename(migrationDir, 'update_rls', migrationConfig?.naming);
+    const filepath = path.join(migrationDir, filename);
+    const content = `-- Migration generated by supatool
+-- RLS policies: ${changedPolicies.length} changed, ${droppedPolicies.length} dropped
+-- Generated at: ${new Date().toISOString()}
+
+${statements.join('\n\n')}
+`;
+    fs.writeFileSync(filepath, content, 'utf-8');
+    console.log(`RLS migration generated: ${filename}`);
+    return filepath;
 }

package/dist/sync/sync.js

@@ -1,14 +1,63 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.syncAllTables = syncAllTables;
+const path = __importStar(require("path"));
 const parseLocalSchemas_1 = require("./parseLocalSchemas");
 const fetchRemoteSchemas_1 = require("./fetchRemoteSchemas");
 const writeSchema_1 = require("./writeSchema");
+const fs = __importStar(require("fs"));
 const generateMigration_1 = require("./generateMigration");
 const diff_1 = require("diff");
 const utils_1 = require("./utils");
 // Global approval state (shared with writeSchema.ts)
 let globalApproveAll = false;
+/**
+ * Extract column names from a CREATE TABLE DDL string.
+ */
+function extractColumnNames(ddl) {
+    const match = ddl.match(/CREATE TABLE[^(]*\(([\s\S]*)\)/i);
+    if (!match)
+        return [];
+    return match[1]
+        .split(',')
+        .map(line => line.trim())
+        .filter(line => !line.match(/^(PRIMARY|CONSTRAINT|UNIQUE|FOREIGN|CHECK)/i))
+        .map(line => { const m = line.match(/^([a-zA-Z_]\w*)/); return m ? m[1] : ''; })
+        .filter(Boolean);
+}
 /**
  * Normalize DDL string (unify spaces, newlines, tabs)
  */
@@ -37,7 +86,7 @@ function formatSQL(sql) {
 /**
  * Synchronize all table schemas
  */
-async function syncAllTables({ connectionString, schemaDir, tablePattern = '*', force = false, dryRun = false, generateOnly = false, requireConfirmation = false }) {
+async function syncAllTables({ connectionString, schemaDir, tablePattern = '*', force = false, dryRun = false, generateOnly = false, requireConfirmation = false, migrationConfig, rlsMode = 'skip' }) {
     // Reset approval state
     (0, writeSchema_1.resetApprovalState)();
     const localSchemas = await (0, parseLocalSchemas_1.parseLocalSchemas)(schemaDir);
@@ -53,6 +102,34 @@ async function syncAllTables({ connectionString, schemaDir, tablePattern = '*',
     }
     // Fetch only the remote schemas for target tables
     const remoteSchemas = await (0, fetchRemoteSchemas_1.fetchRemoteSchemas)(connectionString, targetLocalTables);
+    // --- Table rename detection ---
+    // Tables that exist locally but not remotely (potential new name)
+    const localOnly = targetLocalTables.filter(t => !remoteSchemas[t]);
+    // Tables that exist remotely but not locally (potential old name)
+    const remoteOnly = Object.keys(remoteSchemas).filter(t => !localSchemas[t]);
+    for (const newName of localOnly) {
+        const localDdl = localSchemas[newName]?.ddl ?? '';
+        const localCols = extractColumnNames(localDdl);
+        if (localCols.length === 0)
+            continue;
+        for (const oldName of remoteOnly) {
+            const remoteDdl = remoteSchemas[oldName]?.ddl ?? '';
+            const remoteCols = extractColumnNames(remoteDdl);
+            if (remoteCols.length === 0)
+                continue;
+            const shared = localCols.filter(c => remoteCols.includes(c)).length;
+            const similarity = shared / Math.max(localCols.length, remoteCols.length);
+            if (similarity >= 0.7) {
+                console.warn(`⚠️  Possible table rename detected: "${oldName}" → "${newName}" ` +
+                    `(${Math.round(similarity * 100)}% column match). ` +
+                    `Generating rename migration — review before applying.`);
+                // Infer schema from CREATE TABLE <schema>.<table> in DDL (default public)
+                const schemaMatch = localDdl.match(/CREATE TABLE\s+(\w+)\.\w+/i);
+                const schema = schemaMatch ? schemaMatch[1] : 'public';
+                await (0, generateMigration_1.generateRenameTableMigrationFile)(schema, oldName, newName, process.cwd(), migrationConfig);
+            }
+        }
+    }
     for (const tableName of targetLocalTables) {
         const local = localSchemas[tableName];
         const remote = remoteSchemas[tableName];
@@ -129,7 +206,7 @@ async function syncAllTables({ connectionString, schemaDir, tablePattern = '*',
                     // Generate migration file (local → remote diff)
                     const migrationPath = await (0, generateMigration_1.generateMigrationFile)(tableName, normalizedRemote, // from (current remote state)
                     normalizedLocal, // to (local target state)
-                    process.cwd());
+                    process.cwd(), migrationConfig);
                     if (migrationPath) {
                         console.log(`[${tableName}] 📝 UPDATE migration generated: ${migrationPath}`);
                     }
@@ -140,4 +217,197 @@ async function syncAllTables({ connectionString, schemaDir, tablePattern = '*',
             }
         }
     }
+    // --- Function diff: scan local rpc/*.sql vs remote ---
+    await syncFunctions(connectionString, schemaDir, migrationConfig);
+    // --- RLS diff ---
+    if (rlsMode === 'rewrite') {
+        await syncRls(connectionString, schemaDir, migrationConfig);
+    }
+}
+/**
+ * Scan local <schemaDir>/<schema>/rpc/*.sql, compare with remote pg_get_functiondef,
+ * and generate CREATE OR REPLACE migrations for any changed functions.
+ */
+async function syncFunctions(connectionString, schemaDir, migrationConfig) {
+    const { Client } = await Promise.resolve().then(() => __importStar(require('pg')));
+    // Collect all local rpc sql files: { schema, funcName, localDdl }
+    const entries = [];
+    if (!fs.existsSync(schemaDir))
+        return;
+    for (const schemaEntry of fs.readdirSync(schemaDir, { withFileTypes: true })) {
+        if (!schemaEntry.isDirectory())
+            continue;
+        const rpcDir = path.join(schemaDir, schemaEntry.name, 'rpc');
+        if (!fs.existsSync(rpcDir))
+            continue;
+        for (const file of fs.readdirSync(rpcDir)) {
+            if (!file.endsWith('.sql'))
+                continue;
+            const funcName = file.replace(/\.sql$/, '');
+            const localDdl = fs.readFileSync(path.join(rpcDir, file), 'utf-8');
+            entries.push({ schema: schemaEntry.name, funcName, localDdl });
+        }
+    }
+    if (entries.length === 0)
+        return;
+    const client = new Client({ connectionString });
+    await client.connect();
+    let changed = 0;
+    try {
+        for (const { schema, funcName, localDdl } of entries) {
+            const result = await client.query(`SELECT pg_get_functiondef(p.oid) as definition
+         FROM pg_proc p
+         JOIN pg_namespace n ON p.pronamespace = n.oid
+         WHERE n.nspname = $1 AND p.proname = $2
+         LIMIT 1`, [schema, funcName]);
+            if (result.rows.length === 0) {
+                // Function not in remote yet — generate migration to create it
+                const migrationPath = await (0, generateMigration_1.generateFunctionMigrationFile)(schema, funcName, localDdl, '', process.cwd(), migrationConfig);
+                if (migrationPath) {
+                    console.log(`[${schema}.${funcName}] 📝 NEW function migration generated: ${migrationPath}`);
+                    changed++;
+                }
+                continue;
+            }
+            const remoteDdl = result.rows[0].definition;
+            const migrationPath = await (0, generateMigration_1.generateFunctionMigrationFile)(schema, funcName, localDdl, remoteDdl, process.cwd(), migrationConfig);
+            if (migrationPath) {
+                console.log(`[${schema}.${funcName}] 📝 UPDATE function migration generated: ${migrationPath}`);
+                changed++;
+            }
+        }
+    }
+    finally {
+        await client.end();
+    }
+    if (changed === 0) {
+        console.log('Functions: no differences found');
+    }
+    else {
+        console.log(`Functions: ${changed} migration(s) generated`);
+    }
+}
+/**
+ * Fetch remote RLS policies, compare with local <schemaDir>/<schema>/rls/*.sql,
+ * and generate DROP + CREATE migrations for changed/new/deleted policies.
+ */
+async function syncRls(connectionString, schemaDir, migrationConfig) {
+    const { Client } = await Promise.resolve().then(() => __importStar(require('pg')));
+    const client = new Client({ connectionString });
+    await client.connect();
+    try {
+        // Fetch all policies from remote
+        const result = await client.query(`
+      SELECT schemaname, tablename, policyname, cmd,
+             array_to_string(roles, ',') as roles,
+             qual, with_check,
+             permissive
+      FROM pg_policies
+      ORDER BY schemaname, tablename, policyname
+    `);
+        // Build remote policy map: key = "schema.table.policyname"
+        const remoteMap = new Map();
+        for (const row of result.rows) {
+            const tableQualified = row.schemaname === 'public'
+                ? row.tablename
+                : `${row.schemaname}.${row.tablename}`;
+            const key = `${row.schemaname}.${row.tablename}.${row.policyname}`;
+            remoteMap.set(key, {
+                policyName: row.policyname,
+                tableName: tableQualified,
+                cmd: row.cmd ?? 'ALL',
+                roles: row.roles ?? 'public',
+                qual: row.qual ?? null,
+                withCheck: row.with_check ?? null,
+                permissive: row.permissive !== 'RESTRICTIVE'
+            });
+        }
+        // Build local policy map from rls/*.sql files
+        const localMap = new Map(); // key → raw SQL
+        if (fs.existsSync(schemaDir)) {
+            for (const schemaEntry of fs.readdirSync(schemaDir, { withFileTypes: true })) {
+                if (!schemaEntry.isDirectory())
+                    continue;
+                const rlsDir = path.join(schemaDir, schemaEntry.name, 'rls');
+                if (!fs.existsSync(rlsDir))
+                    continue;
+                for (const file of fs.readdirSync(rlsDir)) {
+                    if (!file.endsWith('.sql'))
+                        continue;
+                    // filename: tablename__policyname.sql
+                    const baseName = file.replace(/\.sql$/, '');
+                    const key = `${schemaEntry.name}.${baseName.replace('__', '.')}`;
+                    localMap.set(key, fs.readFileSync(path.join(rlsDir, file), 'utf-8'));
+                }
+            }
+        }
+        // Detect changes: remote policies not matching local
+        const changed = [];
+        const dropped = [];
+        // Policies in remote that differ from local (or absent in local → drop)
+        for (const [key, remotePolicy] of remoteMap) {
+            if (!localMap.has(key)) {
+                // Remote has policy but local doesn't — local wins: drop it
+                dropped.push({ policyName: remotePolicy.policyName, tableName: remotePolicy.tableName });
+            }
+            // If local has it, we trust local as SSoT — will re-create from local below
+        }
+        // Policies in local but not in remote, or that differ → re-create
+        for (const [key, localSql] of localMap) {
+            const remotePolicy = remoteMap.get(key);
+            const normalizedLocal = localSql.replace(/\s+/g, ' ').trim();
+            if (!remotePolicy) {
+                // New policy in local
+                changed.push(parsePolicySql(localSql, key));
+            }
+            else {
+                // Compare: rebuild remote SQL and compare normalized
+                const remoteSql = buildPolicySql(remotePolicy);
+                if (normalizedLocal !== remoteSql.replace(/\s+/g, ' ').trim()) {
+                    changed.push(parsePolicySql(localSql, key));
+                }
+            }
+        }
+        const migrationPath = await (0, generateMigration_1.generateRlsMigrationFile)(changed, dropped, process.cwd(), migrationConfig);
+        if (!migrationPath) {
+            console.log('RLS: no differences found');
+        }
+        else {
+            console.log(`RLS: ${changed.length} changed, ${dropped.length} dropped`);
+        }
+    }
+    finally {
+        await client.end();
+    }
+}
+function buildPolicySql(p) {
+    const permissive = p.permissive ? 'PERMISSIVE' : 'RESTRICTIVE';
+    let sql = `CREATE POLICY "${p.policyName}" ON ${p.tableName} AS ${permissive} FOR ${p.cmd} TO ${p.roles}`;
+    if (p.qual)
+        sql += ` USING (${p.qual})`;
+    if (p.withCheck)
+        sql += ` WITH CHECK (${p.withCheck})`;
+    return sql + ';';
+}
+function parsePolicySql(sql, key) {
+    // Best-effort parse of CREATE POLICY DDL to RlsPolicy struct
+    const tableMatch = sql.match(/ON\s+(\S+)/i);
+    const policyMatch = sql.match(/CREATE POLICY\s+"?([^"\s]+)"?/i);
+    const cmdMatch = sql.match(/FOR\s+(SELECT|INSERT|UPDATE|DELETE|ALL)/i);
+    const rolesMatch = sql.match(/TO\s+([^\n]+?)(?:\s+USING|\s+WITH CHECK|;|$)/i);
+    const usingMatch = sql.match(/USING\s*\(([^)]+)\)/i);
+    const withCheckMatch = sql.match(/WITH CHECK\s*\(([^)]+)\)/i);
+    const permissive = !/RESTRICTIVE/i.test(sql);
+    const parts = key.split('.');
+    const policyName = policyMatch?.[1] ?? parts[parts.length - 1];
+    const tableName = tableMatch?.[1] ?? `${parts[0]}.${parts[1]}`;
+    return {
+        policyName,
+        tableName,
+        cmd: cmdMatch?.[1] ?? 'ALL',
+        roles: rolesMatch?.[1]?.trim() ?? 'public',
+        qual: usingMatch?.[1] ?? null,
+        withCheck: withCheckMatch?.[1] ?? null,
+        permissive
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "supatool",
-  "version": "0.4.3",
+  "version": "0.5.0",
   "description": "CLI for Supabase: extract schema (tables, views, RLS, RPC) to files + llms.txt for LLM, deploy local schema, seed export. CRUD code gen deprecated.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",