Prod deploy

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"

.github/workflows/ci.yml

@@ -28,7 +28,7 @@ jobs:
  go tool gotestsum -- -race -v -count=1 ./... \
  -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: code-coverage-report
  path: coverage.out
@@ -39,7 +39,7 @@ jobs:
  - test
  runs-on: ubuntu-latest
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: code-coverage-report
  - uses: coverallsapp/github-action@v2

.github/workflows/install.yml

@@ -28,7 +28,7 @@ jobs:
  mv tmp.$$.json package.json
  npm pack
 
- - uses: actions/upload-artifact@v4
+ - uses: actions/upload-artifact@v5
  with:
  name: installer
  path: supabase-1.28.0.tgz
@@ -41,7 +41,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -57,7 +57,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -73,7 +73,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -96,7 +96,7 @@ jobs:
  os: [ubuntu-latest, macos-latest, windows-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 
@@ -115,7 +115,7 @@ jobs:
  os: [ubuntu-latest, macos-latest]
  runs-on: ${{ matrix.os }}
  steps:
- - uses: actions/download-artifact@v5
+ - uses: actions/download-artifact@v6
  with:
  name: installer
 

cmd/db.go

@@ -101,8 +101,6 @@ var (
  if usePgSchema {
  differ = diff.DiffPgSchema
  fmt.Fprintln(os.Stderr, utils.Yellow("WARNING:"), "--use-pg-schema flag is experimental and may not include all entities, such as views and grants.")
- } else if !viper.GetBool("EXPERIMENTAL") {
- differ = diff.DiffSchemaMigraBash
  }
  return diff.Run(cmd.Context(), schema, file, flags.DbConfig, differ, afero.NewOsFs())
  },

cmd/inspect.go

@@ -18,6 +18,7 @@ import (
 	"github.com/supabase/cli/internal/inspect/replication_slots"
 	"github.com/supabase/cli/internal/inspect/role_stats"
 	"github.com/supabase/cli/internal/inspect/table_stats"
+	"github.com/supabase/cli/internal/inspect/traffic_profile"
 	"github.com/supabase/cli/internal/inspect/vacuum_stats"
 	"github.com/supabase/cli/internal/utils/flags"
 )
@@ -135,6 +136,14 @@ var (
  },
 	}
 
+	inspectTrafficProfileCmd = &cobra.Command{
+ Use: "traffic-profile",
+ Short: "Show read/write activity ratio for tables based on block I/O operations",
+ RunE: func(cmd *cobra.Command, args []string) error {
+ return traffic_profile.Run(cmd.Context(), flags.DbConfig, afero.NewOsFs())
+ },
+	}
+
 	inspectCacheHitCmd = &cobra.Command{
  Deprecated: `use "db-stats" instead.`,
  Use: "cache-hit",
@@ -270,6 +279,7 @@ func init() {
 	inspectDBCmd.AddCommand(inspectBloatCmd)
 	inspectDBCmd.AddCommand(inspectVacuumStatsCmd)
 	inspectDBCmd.AddCommand(inspectTableStatsCmd)
+	inspectDBCmd.AddCommand(inspectTrafficProfileCmd)
 	inspectDBCmd.AddCommand(inspectRoleStatsCmd)
 	inspectDBCmd.AddCommand(inspectDBStatsCmd)
 	// DEPRECATED

docs/supabase/inspect/db-traffic-profile.md

@@ -0,0 +1,24 @@
+# db-traffic-profile
+
+This command analyzes table I/O patterns to show read/write activity ratios based on block-level operations. It combines data from PostgreSQL's `pg_stat_user_tables` (for tuple operations) and `pg_statio_user_tables` (for block I/O) to categorize each table's workload profile.
+
+
+The command classifies tables into categories:
+- **Read-Heavy** - Read operations are more than 5x write operations (e.g., 1:10, 1:50)
+- **Write-Heavy** - Write operations are more than 20% of read operations (e.g., 1:2, 1:4, 2:1, 10:1)
+- **Balanced** - Mixed workload where writes are between 20% and 500% of reads
+- **Read-Only** - Only read operations detected
+- **Write-Only** - Only write operations detected
+
+```
+SCHEMA │ TABLE │ BLOCKS READ │ WRITE TUPLES │ BLOCKS WRITE │ ACTIVITY RATIO
+───────┼──────────────┼─────────────┼──────────────┼──────────────┼────────────────────
+public │ user_events │ 450,234 │ 9,004,680│ 23,450 │ 20:1 (Write-Heavy)
+public │ users │ 89,203 │ 12,451│ 1,203 │ 7.2:1 (Read-Heavy)
+public │ sessions │ 15,402 │ 14,823│ 2,341 │ ≈1:1 (Balanced)
+public │ cache_data │ 123,456 │ 0│ 0 │ Read-Only
+auth │ audit_logs │ 0 │ 98,234│ 12,341 │ Write-Only
+```
+
+**Note:** This command only displays tables that have had both read and write activity. Tables with no I/O operations are not shown. The classification ratio threshold (default: 5:1) determines when a table is considered "heavy" in one direction versus balanced.
+

go.mod

@@ -17,7 +17,7 @@ require (
 	github.com/docker/docker v28.5.1+incompatible
 	github.com/docker/go-connections v0.6.0
 	github.com/fsnotify/fsnotify v1.9.0
-	github.com/getsentry/sentry-go v0.36.0
+	github.com/getsentry/sentry-go v0.36.1
 	github.com/go-errors/errors v1.5.1
 	github.com/go-git/go-git/v5 v5.16.3
 	github.com/go-playground/validator/v10 v10.28.0

go.sum

@@ -300,8 +300,8 @@ github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIp
 github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/getkin/kin-openapi v0.131.0 h1:NO2UeHnFKRYhZ8wg6Nyh5Cq7dHk4suQQr72a4pMrDxE=
 github.com/getkin/kin-openapi v0.131.0/go.mod h1:3OlG51PCYNsPByuiMB0t4fjnNlIDnaEDsjiKUV8nL58=
-github.com/getsentry/sentry-go v0.36.0 h1:UkCk0zV28PiGf+2YIONSSYiYhxwlERE5Li3JPpZqEns=
-github.com/getsentry/sentry-go v0.36.0/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
+github.com/getsentry/sentry-go v0.36.1 h1:kMJt0WWsxWATUxkvFgVBZdIeHSk/Oiv5P0jZ9e5m/Lw=
+github.com/getsentry/sentry-go v0.36.1/go.mod h1:p5Im24mJBeruET8Q4bbcMfCQ+F+Iadc4L48tB1apo2c=
 github.com/ghostiam/protogetter v0.3.15 h1:1KF5sXel0HE48zh1/vn0Loiw25A9ApyseLzQuif1mLY=
 github.com/ghostiam/protogetter v0.3.15/go.mod h1:WZ0nw9pfzsgxuRsPOFQomgDVSWtDLJRfQJEhsGbmQMA=
 github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c=

internal/branches/get/get.go

@@ -90,7 +90,7 @@ func getPoolerConfig(ctx context.Context, ref string) (api.SupavisorConfigRespon
  return result, errors.Errorf("unexpected get pooler status %d: %s", resp.StatusCode(), string(resp.Body))
 	}
 	for _, config := range *resp.JSON200 {
- if config.DatabaseType == api.PRIMARY {
+ if config.DatabaseType == api.SupavisorConfigResponseDatabaseTypePRIMARY {
  return config, nil
  }
 	}

internal/db/diff/templates/migra.ts

@@ -1,4 +1,4 @@
-import { createClient } from "npm:@pgkit/client";
+import { createClient, sql } from "npm:@pgkit/client";
 import { Migration } from "npm:@pgkit/migra";
 
 // Avoids error on self-signed certificate
@@ -20,7 +20,12 @@ const extensionSchemas = [
 ];
 
 try {
- let sql = "";
+ // Step down from login role to postgres
+ await clientHead.query(sql`set role postgres`);
+ // Force schema qualified references for pg_get_expr
+ await clientHead.query(sql`set search_path = ''`);
+ await clientBase.query(sql`set search_path = ''`);
+ let result = "";
  for (const schema of includedSchemas) {
  const m = await Migration.create(clientBase, clientHead, {
  schema,
@@ -35,7 +40,7 @@ try {
  } else {
  m.add_all_changes(true);
  }
-sql += m.sql;
+result += m.sql;
  }
  if (includedSchemas.length === 0) {
  // Migra does not ignore custom types and triggers created by extensions, so we diff
@@ -48,7 +53,7 @@ try {
  e.set_safety(false);
  e.add(e.changes.schemas({ creations_only: true }));
  e.add_extension_changes();
-sql += e.sql;
+result += e.sql;
  }
  // Diff user defined entities in non-managed schemas, including extensions.
  const m = await Migration.create(clientBase, clientHead, {
@@ -61,7 +66,7 @@ try {
  });
  m.set_safety(false);
  m.add_all_changes(true);
-sql += m.sql;
+result += m.sql;
  // For managed schemas, we want to include triggers and RLS policies only.
  for (const schema of managedSchemas) {
  const s = await Migration.create(clientBase, clientHead, {
@@ -73,10 +78,10 @@ try {
  s.add(s.changes.rlspolicies({ drops_only: true }));
  s.add(s.changes.rlspolicies({ creations_only: true }));
  s.add(s.changes.triggers({ creations_only: true }));
-sql += s.sql;
+result += s.sql;
  }
  }
- console.log(sql);
+ console.log(result);
 } catch (e) {
  console.error(e);
 } finally {

internal/db/pull/pull.go

@@ -7,7 +7,6 @@ import (
 	"math"
 	"os"
 	"path/filepath"
-	"slices"
 	"strconv"
 	"strings"
 
@@ -17,7 +16,6 @@ import (
 	"github.com/spf13/afero"
 	"github.com/supabase/cli/internal/db/diff"
 	"github.com/supabase/cli/internal/db/dump"
-	"github.com/supabase/cli/internal/db/start"
 	"github.com/supabase/cli/internal/migration/list"
 	"github.com/supabase/cli/internal/migration/new"
 	"github.com/supabase/cli/internal/migration/repair"
@@ -26,10 +24,9 @@ import (
 )
 
 var (
-	errMissing = errors.New("No migrations found")
-	errInSync = errors.New("No schema changes found")
-	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
-	managedSchemas = []string{"auth", "storage", "realtime"}
+	errMissing = errors.New("No migrations found")
+	errInSync = errors.New("No schema changes found")
+	errConflict = errors.Errorf("The remote database's migration history does not match local files in %s directory.", utils.MigrationsDir)
 )
 
 func Run(ctx context.Context, schema []string, config pgconn.Config, name string, fsys afero.Fs, options ...func(*pgx.ConnConfig)) error {
@@ -63,24 +60,16 @@ func run(ctx context.Context, schema []string, path string, conn *pgx.Conn, fsys
  if err = dumpRemoteSchema(ctx, path, config, fsys); err != nil {
  return err
  }
- // Pull changes in managed schemas automatically
- if err = diffRemoteSchema(ctx, managedSchemas, path, config, fsys); errors.Is(err, errInSync) {
+ // Run a second pass to pull in changes from default privileges and managed schemas
+ if err = diffRemoteSchema(ctx, nil, path, config, fsys); errors.Is(err, errInSync) {
  err = nil
  }
  return err
 	} else if err != nil {
  return err
 	}
-	// 2. Fetch user defined schemas
-	if len(schema) == 0 {
- var err error
- if schema, err = migration.ListUserSchemas(ctx, conn); err != nil {
- return err
- }
- schema = append(schema, managedSchemas...)
-	}
-	// 3. Fetch remote schema changes
-	return diffUserSchemas(ctx, schema, path, config, fsys)
+	// 2. Fetch remote schema changes
+	return diffRemoteSchema(ctx, schema, path, config, fsys)
 }
 
 func dumpRemoteSchema(ctx context.Context, path string, config pgconn.Config, fsys afero.Fs) error {
@@ -103,7 +92,7 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	if err != nil {
  return err
 	}
-	if len(output) == 0 {
+	if trimmed := strings.TrimSpace(output); len(trimmed) == 0 {
  return errors.New(errInSync)
 	}
 	// Append to existing migration file since we run this after dump
@@ -118,59 +107,6 @@ func diffRemoteSchema(ctx context.Context, schema []string, path string, config
 	return nil
 }
 
-func diffUserSchemas(ctx context.Context, schema []string, path string, config pgconn.Config, fsys afero.Fs) error {
-	var managed, user []string
-	for _, s := range schema {
- if slices.Contains(managedSchemas, s) {
- managed = append(managed, s)
- } else {
- user = append(user, s)
- }
-	}
-	fmt.Fprintln(os.Stderr, "Creating shadow database...")
-	shadow, err := diff.CreateShadowDatabase(ctx, utils.Config.Db.ShadowPort)
-	if err != nil {
- return err
-	}
-	defer utils.DockerRemove(shadow)
-	if err := start.WaitForHealthyService(ctx, start.HealthTimeout, shadow); err != nil {
- return err
-	}
-	if err := diff.MigrateShadowDatabase(ctx, shadow, fsys); err != nil {
- return err
-	}
-	shadowConfig := pgconn.Config{
- Host: utils.Config.Hostname,
- Port: utils.Config.Db.ShadowPort,
- User: "postgres",
- Password: utils.Config.Db.Password,
- Database: "postgres",
-	}
-	// Diff managed and user defined schemas separately
-	var output string
-	if len(user) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(user, ","))
- if output, err = diff.DiffSchemaMigraBash(ctx, shadowConfig, config, user); err != nil {
- return err
- }
-	}
-	if len(managed) > 0 {
- fmt.Fprintln(os.Stderr, "Diffing schemas:", strings.Join(managed, ","))
- if result, err := diff.DiffSchemaMigra(ctx, shadowConfig, config, managed); err != nil {
- return err
- } else {
- output += result
- }
-	}
-	if len(output) == 0 {
- return errors.New(errInSync)
-	}
-	if err := utils.WriteFile(path, []byte(output), fsys); err != nil {
- return errors.Errorf("failed to write dump file: %w", err)
-	}
-	return nil
-}
-
 func assertRemoteInSync(ctx context.Context, conn *pgx.Conn, fsys afero.Fs) error {
 	remoteMigrations, err := migration.ListRemoteMigrations(ctx, conn)
 	if err != nil {

internal/db/pull/pull_test.go

@@ -83,24 +83,6 @@ func TestPullSchema(t *testing.T) {
  assert.Equal(t, []byte("test"), contents)
 	})
 
-	t.Run("throws error on load user schema failure", func(t *testing.T) {
- // Setup in-memory fs
- fsys := afero.NewMemMapFs()
- path := filepath.Join(utils.MigrationsDir, "0_test.sql")
- require.NoError(t, afero.WriteFile(fsys, path, []byte(""), 0644))
- // Setup mock postgres
- conn := pgtest.NewConn()
- defer conn.Close(t)
- conn.Query(migration.LIST_MIGRATION_VERSION).
- Reply("SELECT 1", []any{"0"}).
- Query(migration.ListSchemas, migration.ManagedSchemas).
- ReplyError(pgerrcode.DuplicateTable, `relation "test" already exists`)
- // Run test
- err := run(context.Background(), nil, "", conn.MockClient(t), fsys)
- // Check error
- assert.ErrorContains(t, err, `ERROR: relation "test" already exists (SQLSTATE 42P07)`)
-	})
-
 	t.Run("throws error on diff failure", func(t *testing.T) {
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()

internal/gen/bearerjwt/bearerjwt_test.go

@@ -180,6 +180,7 @@ func TestGenerateToken(t *testing.T) {
  claims := jwt.MapClaims{}
  // Setup in-memory fs
  fsys := afero.NewMemMapFs()
+ require.NoError(t, utils.WriteFile("supabase/keys.json", []byte("[]"), fsys))
  require.NoError(t, utils.WriteFile("supabase/config.toml", []byte(`
  [auth]
  signing_keys_path = "./keys.json"