better-supabase 0.10.0 → 0.12.0

package/dist/cli/{doctor-wACp5w6N.js → doctor-DOfy6kjt.js}

@@ -1,25 +1,28 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-D_HI1mp1.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-dfdVhU_2.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
-import { t as VERSION } from "./version-D1wM9DNb.js";
+import { t as VERSION } from "./version-B7akdvDv.js";
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, t as display } from "./io-BiPX-_J1.js";
-import { t as CACHE_DIR } from "./cache-CPBYJAkb.js";
+import { t as CACHE_DIR } from "./cache-DQwgb3rg.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { c as configFor, s as notNullTag } from "./emit-j0zZ6NE_.js";
-import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-DliGNdjI.js";
-import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-CLkZ8jpw.js";
-import { l as stdinDatabaseUrl } from "./config-Bi_UBxXl.js";
-import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-DjLgBYEo.js";
+import { c as configFor, s as notNullTag } from "./emit-56LAG_Px.js";
+import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-BhJKAanr.js";
+import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-CPhuiY8C.js";
+import { l as stdinDatabaseUrl } from "./config-yZ55rsKZ.js";
+import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-BC5sNVKU.js";
+import { t as PROCESS_ENV } from "./env-C8R7Nf0a.js";
+import { n as readStackStatus } from "./stack-status-_NUgd-g5.js";
 import { t as connect } from "./db-DT1bGB02.js";
-import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-Dvcx0BSl.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-BBKFojqM.js";
 import { n as applyPlan, o as insideRoot, r as changeLines } from "./files-DDvAwTko.js";
-import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-CNcvDOLt.js";
-import { t as MIGRATION_SAFETY_RULES } from "./migration-safety-LaGVPPuD.js";
-import { i as sourceFlags, n as SOURCE_ARGS } from "./source-args-BNhagtpw.js";
-import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-BFfYoE0_.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-DikbSOE0.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-DKLuA1Tp.js";
+import { t as MIGRATION_SAFETY_RULES } from "./migration-safety-DjVpz2D6.js";
+import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-Cwo7zwvq.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-CkV3d3yp.js";
+import { i as staleVariables, r as stackEnvValues, t as PREFIX_NAMES } from "./stack-env-_uWWNHWq.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BGkle6WM.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -27,6 +30,107 @@ import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { SECRET_COLUMNS, SQL_MODULES, adoptedTables, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, moduleVersion, renderModules, sameModuleFile, sameTenantColumn, sameTenantTrigger, sharedRolesProblems, subjectColumns } from "better-supabase/sql";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
 import { defineBucket, parseSize } from "better-supabase/storage";
+//#region src/cli/doctor/env.ts
+const PUBLIC_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+function envEntries(file) {
+	return file.text.split("\n").flatMap((raw, index) => {
+		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+		if (!match) return [];
+		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+		return [{
+			key: match[1],
+			value,
+			line: index + 1
+		}];
+	});
+}
+const PREFIXES = [...new Set(Object.values(PREFIX_NAMES).filter((prefix) => prefix !== ""))];
+/** The names `stackEnvValues` writes, with or without a browser prefix; not the CLI's own `SUPABASE_BIN` or `SUPABASE_ACCESS_TOKEN`. */
+const STACK_VARIABLE = /(?:^|_)SUPABASE_(?:URL|PUBLISHABLE_KEY|SECRET_KEY|JWKS_URL|DB_URL|JWT_SECRET)$/;
+const exportsStackVariable = (shell) => Object.entries(shell).some(([name, value]) => value !== void 0 && value !== "" && STACK_VARIABLE.test(name));
+/**
+* Reads the running stack only when the shell exports a `SUPABASE_*`
+* variable, so a doctor run without one never starts `supabase status`.
+*/
+async function loadStackEnvCheck(root, env, signal) {
+	const shell = env[PROCESS_ENV] ?? {};
+	if (!exportsStackVariable(shell)) return { skipped: "No SUPABASE_* variable is exported." };
+	try {
+		const result = await readStackStatus(root, env, { signal });
+		if (!result.ok) return { skipped: "The local stack is not running." };
+		const values = { ...stackEnvValues(result.status, "") };
+		if (values["SUPABASE_URL"] === void 0) return { skipped: "supabase status has no API_URL." };
+		for (const prefix of PREFIXES) {
+			values[`${prefix}SUPABASE_URL`] = values["SUPABASE_URL"];
+			if (values["SUPABASE_PUBLISHABLE_KEY"] !== void 0) values[`${prefix}SUPABASE_PUBLISHABLE_KEY`] = values["SUPABASE_PUBLISHABLE_KEY"];
+		}
+		return {
+			shell,
+			values
+		};
+	} catch (cause) {
+		return { skipped: errorText(cause) };
+	}
+}
+/** Checks on env files and the variables the shell exports (BS501 to BS503). */
+const ENV_RULES = [
+	{
+		code: "BS501",
+		severity: "error",
+		title: "Secret in a browser variable",
+		description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
+		check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
+			message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
+			target: `${file.path}:${entry.key}`,
+			location: {
+				file: file.path,
+				line: entry.line
+			}
+		})))
+	},
+	{
+		code: "BS502",
+		severity: "warning",
+		title: "Env file with secrets is not ignored by git",
+		description: "Env files holding a secret key or database password should never be committed.",
+		check: (context) => {
+			const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+			const ignored = (path) => patterns.some((pattern) => {
+				const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+				return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
+			});
+			return context.envFiles.flatMap((file) => {
+				const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
+				if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
+				return [{
+					message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
+					target: file.path,
+					location: {
+						file: file.path,
+						line: secret.line
+					}
+				}];
+			});
+		}
+	},
+	{
+		code: "BS503",
+		severity: "warning",
+		title: "Exported Supabase variable differs from the running stack",
+		description: "A SUPABASE_* variable exported in the shell has another value than the local stack, so the app talks to a stale stack (often another worktree's port). Values are redacted: host and port for URLs, a SHA-256 fingerprint for keys. Unset the variable, or start the app with `better-supabase run -- <cmd>`, which overrides it.",
+		check: ({ stackEnv }) => stackEnv === void 0 || "skipped" in stackEnv ? [] : staleVariables(stackEnv.shell, stackEnv.values).map((stale) => ({
+			target: stale.variable,
+			message: `${stale.message} Unset it or start the app with better-supabase run -- <cmd>.`
+		}))
+	}
+];
+//#endregion
 //#region src/cli/doctor/adoption.ts
 const tagText = (notNull) => notNull === true ? "@notNull" : `@notNull(${notNull.join(", ")})`;
 const sameNotNull = (a, b) => a === true || b === true ? a === b : a !== void 0 && a.length === b.length && a.every((name) => b.includes(name));
@@ -124,6 +228,22 @@ const ADOPTION_RULES = [
 			});
 		}
 	},
+	{
+		code: "BS344",
+		severity: "warning",
+		title: "Adopted webhook endpoints without a format",
+		description: "An adopted `webhooks-out` endpoints table that maps no `format` column sends every endpoint in `blocks.webhooks-out.options.defaultFormat`. Its default changed from the 0.8 body (`standard`) to `cloudevents` in 0.9, so receivers built for the old body break without any change to the config. `sql sync` refuses this config; doctor reports it for configs it loads without that check. Set `defaultFormat` explicitly, or add a format column and map it in `columns.endpoints.format`.",
+		check: (context) => {
+			const block = context.config.blocks["webhooks-out"];
+			if (block?.mode !== "adopt" || block.options?.["defaultFormat"] !== void 0 || typeof block.columns?.["endpoints"]?.["format"] === "string") return [];
+			const adopted = adoptedTables(context.config.blocks).find((entry) => entry.module === "webhooks-out" && entry.logical === "endpoints");
+			const table = adopted === void 0 ? void 0 : catalogOf(context).tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+			return [{
+				message: `${adopted === void 0 ? "The adopted endpoints table" : `${adopted.schema}.${adopted.table}`} ${table?.columns.some((column) => column.name === "format") ? "has a format column the config doesn't map" : "has no format column"}, so every endpoint gets blocks.webhooks-out.options.defaultFormat, which defaults to "cloudevents" since 0.9 ("standard" before). Set defaultFormat to the body your receivers expect, or map columns.endpoints.format.`,
+				target: "blocks.webhooks-out.options.defaultFormat"
+			}];
+		}
+	},
 	{
 		code: "BS341",
 		severity: "warning",
@@ -302,7 +422,7 @@ const splitName = (qualified) => {
 		name: qualified.slice(dot + 1)
 	};
 };
-const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const escapeRegExp$2 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /**
 * The claims the provider's hook writes that a second writer would
 * contradict, with the tenant claim it writes to.
@@ -310,7 +430,7 @@ const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 function ownedClaims(hook) {
 	return [.../* @__PURE__ */ new Set([...hook.ownedClaims, ...hook.tenantClaim ? [hook.tenantClaim] : []])];
 }
-const quotedName = (schema, name) => `(?:"?${escapeRegExp$1(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$1(name)}"?`;
+const quotedName = (schema, name) => `(?:"?${escapeRegExp$2(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$2(name)}"?`;
 const createsFunction = (fn) => new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${quotedName(fn.schema, fn.name)}\\s*\\(`, "i");
 /** The SQL file that has the provider's hook marker and creates `fn`. */
 function markerFileFor(context, fn) {
@@ -334,7 +454,7 @@ function wrapsProviderHook(hook, source) {
 /** Which of `claims` the hook body writes through `jsonb_set` or `jsonb_build_object`. */
 function writtenClaims(source, claims) {
 	return claims.filter((claim) => {
-		const name = escapeRegExp$1(claim);
+		const name = escapeRegExp$2(claim);
 		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
 	});
 }
@@ -921,6 +1041,187 @@ async function fileState(context, file) {
 	};
 }
 //#endregion
+//#region src/cli/doctor/attachment-subjects.ts
+/** The attachments subjects as the block resolves them, with the per-subject keys each one has. */
+function attachmentSubjects(context) {
+	const registry = context.config.subjects;
+	const raw = context.config.blocks["attachments"]?.options?.["subjects"];
+	return (raw === void 0 ? Object.keys(registry).map((type) => [type, {}]) : Array.isArray(raw) ? raw.filter((type) => typeof type === "string").map((type) => [type, {}]) : isRecord(raw) ? Object.entries(raw).flatMap(([type, entry]) => isRecord(entry) ? [[type, entry]] : []) : []).flatMap(([type, entry]) => {
+		const registered = registry[type];
+		const table = entry["table"] ?? registered?.table;
+		const tenant = entry["tenant"] ?? registered?.tenant ?? "organization_id";
+		if (typeof table !== "string" || typeof tenant !== "string") return [];
+		const own = isRecord(entry["permissions"]) ? Object.keys(entry["permissions"]) : [];
+		const fromRegistry = Object.keys(registered?.permissions ?? {}).filter((key) => key !== "read");
+		const subjectRead = typeof entry["permission"] === "string" || registered?.permissions?.["read"] !== void 0 ? ["read"] : [];
+		return [{
+			type,
+			table,
+			tenant,
+			keys: /* @__PURE__ */ new Set([
+				...own,
+				...fromRegistry,
+				...subjectRead
+			])
+		}];
+	});
+}
+/**
+* Whether `expression` only checks that the caller is a member of the row's
+* tenant: `current_tenant_id()`, a `*_ids_with` or `*member_*ids` function in
+* any schema (the provider's own helpers included), `can('tenant', ...)` or
+* `member_can`, joined by `and`, with a soft-delete `is null` allowed. A
+* permission call passes only with one of `keys`.
+*/
+function tenantOnly(expression, column, keys) {
+	const col = `(?:"?\\w+"?\\.)?"?${escape$1(column)}"?(?:::\\w+)?`;
+	const key = `'([^']*)'(?:::text)?`;
+	const atoms = [
+		`${col}\\s*=\\s*\\(?\\s*(?:select\\s+)?better_supabase\\.current_tenant_id\\(\\)(?:\\s+as\\s+\\w+)?`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*_ids_with\\(\\s*${key}\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*member_\\w*ids\\(\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`better_supabase\\.can\\(\\s*'tenant'(?:::text)?\\s*,\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`better_supabase\\.member_can\\(\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`(?:"?\\w+"?\\.)?"?\\w+"?\\s+is\\s+null`
+	];
+	const used = [];
+	let rest = expression;
+	for (const atom of atoms) rest = rest.replaceAll(new RegExp(atom, "gi"), (_match, key) => {
+		if (typeof key === "string") used.push(key);
+		return " ";
+	});
+	return used.every((key) => keys.has(key)) && rest.replaceAll(/\band\b|[()\s]/gi, "") === "";
+}
+/** The top-level `or` branches of `expression`, outer parentheses removed. */
+function branches(expression) {
+	let text = expression.trim();
+	while (text.startsWith("(") && closingParen(text) === text.length - 1) text = text.slice(1, -1).trim();
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (depth === 0 && /^\sor\s/i.test(text.slice(index, index + 4))) {
+			parts.push(text.slice(start, index));
+			start = index + 4;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts;
+}
+/** The index of the parenthesis closing the one at the start of `text`. */
+function closingParen(text) {
+	let depth = 0;
+	for (let index = 0; index < text.length; index += 1) if (text[index] === "(") depth += 1;
+	else if (text[index] === ")") {
+		depth -= 1;
+		if (depth === 0) return index;
+	}
+	return -1;
+}
+/** Tenant membership alone lets the caller through: the whole check, or one `or` branch of it. */
+function tenantSuffices(expression, column, keys) {
+	return [expression, ...branches(expression)].some((part) => tenantOnly(part, column, keys));
+}
+function attachmentSubjectsOnDefaults(context) {
+	if (!context.config.blockNames.includes("attachments")) return [];
+	const { tables } = catalogOf(context);
+	const overrides = context.config.blocks["attachments"]?.permissions ?? {};
+	const actions = [{
+		action: "read",
+		commands: ["select"],
+		what: "reads"
+	}, {
+		action: "upload",
+		commands: ["insert", "update"],
+		what: "writes"
+	}];
+	return attachmentSubjects(context).flatMap(({ type, table: name, tenant, keys }) => {
+		const [schema, bare] = name.includes(".") ? name.split(".", 2) : ["public", name];
+		const table = tables.find((candidate) => candidate.schema === schema && candidate.name === bare);
+		if (table?.kind !== "table" || !table.rls) return [];
+		const stricter = actions.filter(({ action, commands }) => {
+			if (keys.has(action)) return false;
+			const blockKey = overrides[action] ?? `attachments.${action}`;
+			return commands.some((command) => {
+				const applying = table.policies.filter((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, "authenticated"));
+				if (command !== "select" && applying.length === 0) return false;
+				return !applying.some((policy) => {
+					const expression = command === "select" ? policy.using : policy.check ?? policy.using;
+					return expression !== null && tenantSuffices(expression, tenant, /* @__PURE__ */ new Set([blockKey]));
+				});
+			});
+		});
+		if (stricter.length === 0) return [];
+		const target = `${table.schema}.${table.name}`;
+		return [{
+			message: `Attachments on ${type} use the block-wide ${stricter.map(({ action }) => action).join(" and ")} key, but ${target} checks more than tenant membership for ${stricter.map(({ what: verb }) => verb).join(" and ")}, so any member of the tenant gets the files of a ${type} they can't open. Set ${stricter.map(({ action }) => action === "read" ? `blocks.attachments.options.subjects.${type}.permissions.read` : `subjects.${type}.permissions.upload`).join(" and ")} to the key the table checks.`,
+			target,
+			object: tableObject(table)
+		}];
+	});
+}
+//#endregion
+//#region src/cli/doctor/audit-coverage.ts
+const escapeRegExp$1 = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** `exempt` entries: a glob, or `{ table, reason }` where `table` is a glob. */
+function exemptions(value) {
+	return (Array.isArray(value) ? value : []).flatMap((entry) => {
+		if (typeof entry === "string") return [{
+			glob: entry,
+			reason: void 0
+		}];
+		if (typeof entry === "object" && entry !== null && "table" in entry && typeof entry.table === "string") {
+			const reason = "reason" in entry && typeof entry.reason === "string" ? entry.reason.trim() : "";
+			return [{
+				glob: entry.table,
+				reason: reason === "" ? void 0 : reason
+			}];
+		}
+		return [];
+	});
+}
+/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
+const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp$1).join(".*")}$`, "i"));
+/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
+function moduleOwned(context) {
+	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const module of Object.values(context.config.blocks)) {
+		if (module?.schema !== void 0) schemas.add(module.schema);
+		for (const table of Object.values(module?.tables ?? {})) {
+			if (table === null) continue;
+			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
+		}
+	}
+	return {
+		schemas,
+		tables
+	};
+}
+/**
+* Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is
+* in `blocks`, and exemptions that give no reason.
+*/
+function unauditedTables(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const entries = exemptions(context.config.blocks["audit"]?.options?.["exempt"]);
+	const exempt = globs(entries.map((entry) => entry.glob));
+	const owned = moduleOwned(context);
+	const unaudited = catalogOf(context).tables.filter((table) => table.kind === "table" && table.partitionOf === void 0 && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name.startsWith("bs_audit") || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
+		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt as \`{ table: '${qualified(table)}', reason: '...' }\`.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+	const unexplained = entries.filter((entry) => entry.reason === void 0).map((entry) => ({
+		message: `blocks.audit.options.exempt lists ${entry.glob} without a reason. Write it as { table: '${entry.glob}', reason: 'why its changes need no audit entry' } so a reviewer can tell an intended gap from a forgotten table.`,
+		target: `blocks.audit.options.exempt:${entry.glob}`
+	}));
+	return [...unaudited, ...unexplained];
+}
+//#endregion
 //#region src/cli/doctor/modules.ts
 /** The non-empty string at a dotted path, as the tenant() plugin reads it. */
 function claimAt(claims, path) {
@@ -1242,35 +1543,6 @@ function duplicateTriggers(context) {
 		}));
 	}));
 }
-/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
-const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp).join(".*")}$`, "i"));
-/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
-function moduleOwned(context) {
-	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
-	const tables = /* @__PURE__ */ new Set();
-	for (const module of Object.values(context.config.blocks)) {
-		if (module?.schema !== void 0) schemas.add(module.schema);
-		for (const table of Object.values(module?.tables ?? {})) {
-			if (table === null) continue;
-			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
-		}
-	}
-	return {
-		schemas,
-		tables
-	};
-}
-/** Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is in `blocks`. */
-function unauditedTables(context) {
-	if (!context.config.blockNames.includes("audit")) return [];
-	const exempt = globs(context.config.blocks["audit"]?.options?.["exempt"]);
-	const owned = moduleOwned(context);
-	return catalogOf(context).tables.filter((table) => table.kind === "table" && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name === "bs_audit" || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
-		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt.`,
-		target: qualified(table),
-		object: tableObject(table)
-	}));
-}
 /** RLS tables in `config.schemas` without a restrictive `session_active()` policy, when `sessions` is in `blocks`. */
 function sessionlessTables(context) {
 	if (!context.config.blockNames.includes("sessions")) return [];
@@ -1369,7 +1641,7 @@ const MODULE_RULES = [
 		code: "BS315",
 		severity: "warning",
 		title: "Table without an audit trigger",
-		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `schema.table` globs such as `public.*_archive`.",
+		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `{ table, reason }` entries where `table` is a `schema.table` glob such as `public.*_archive`; a bare glob string still works but gets a finding that asks for the reason. Partitions are covered by their parent.",
 		check: unauditedTables
 	},
 	{
@@ -1449,6 +1721,13 @@ const MODULE_RULES = [
 		description: "A table in `config.subjects` has row level security disabled. `can_subject` treats a row the caller can read as visible, so without RLS every signed-in user passes the visibility half of the check for every row.",
 		check: subjectsWithoutRls
 	},
+	{
+		code: "BS345",
+		severity: "warning",
+		title: "Attachments subject on block-wide keys with stricter RLS",
+		description: "An `attachments` subject has no `read` or `upload` key of its own, so its files are checked with the block-wide `attachments.read` and `attachments.upload` keys, but the subject table's own policies check more than tenant membership: a permission key of their own, an owner or `auth.uid()` comparison, or another condition. Any member of the tenant then reads and uploads files of rows they can't open. Doctor recognizes `current_tenant_id()`, `tenant_ids_with`, `member_<tenant>_ids`, `can('tenant', ...)` and `member_can` with the block's key as tenant membership. Set `subjects.<type>.permissions.upload`, or `blocks.attachments.options.subjects.<type>.permissions` for `read`, to the keys the table checks.",
+		check: attachmentSubjectsOnDefaults
+	},
 	{
 		code: "BS335",
 		severity: "warning",
@@ -2369,25 +2648,6 @@ function tomlLocation(context, key) {
 		line
 	} : void 0;
 }
-const PUBLIC_PREFIXES = [
-	"NEXT_PUBLIC_",
-	"VITE_",
-	"PUBLIC_",
-	"EXPO_PUBLIC_",
-	"NUXT_PUBLIC_"
-];
-function envEntries(file) {
-	return file.text.split("\n").flatMap((raw, index) => {
-		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
-		if (!match) return [];
-		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
-		return [{
-			key: match[1],
-			value,
-			line: index + 1
-		}];
-	});
-}
 /**
 * `db.x.aggregate(`, an `_sum:`/`_avg:`/`_min:`/`_max:` include or a list
 * with `facetCounts: true`.
@@ -2793,45 +3053,6 @@ const RULES = [
 				target: `${qualified(table)}.${key.name}`,
 				object: tableObject(table)
 			})))
-		},
-		{
-			code: "BS501",
-			severity: "error",
-			title: "Secret in a browser variable",
-			description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
-			check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
-				message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
-				target: `${file.path}:${entry.key}`,
-				location: {
-					file: file.path,
-					line: entry.line
-				}
-			})))
-		},
-		{
-			code: "BS502",
-			severity: "warning",
-			title: "Env file with secrets is not ignored by git",
-			description: "Env files holding a secret key or database password should never be committed.",
-			check: (context) => {
-				const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
-				const ignored = (path) => patterns.some((pattern) => {
-					const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
-					return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
-				});
-				return context.envFiles.flatMap((file) => {
-					const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
-					if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
-					return [{
-						message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
-						target: file.path,
-						location: {
-							file: file.path,
-							line: secret.line
-						}
-					}];
-				});
-			}
 		}
 	],
 	...RLS_RULES,
@@ -2849,7 +3070,8 @@ const RULES = [
 	...FLAG_RULES,
 	...REALTIME_RULES,
 	...ADOPTION_RULES,
-	...MIGRATION_SAFETY_RULES
+	...MIGRATION_SAFETY_RULES,
+	...ENV_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {
@@ -3337,14 +3559,15 @@ async function runDoctor(config, args, env, options = {}) {
 		...options.advisors === void 0 ? {} : { advisors: options.advisors },
 		...options.database === void 0 ? {} : { database: options.database }
 	};
-	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers] = await Promise.all([
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers, stackEnv] = await Promise.all([
 		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
 		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
 		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml, sqlWorkflow(config, toml))]),
 		readText(config.root, ".gitignore"),
 		sourceFiles(config),
 		compiledReadSets(config).catch((cause) => ({ skipped: errorText(cause) })),
-		options.peers ?? peerVersions(config.root).catch(() => [])
+		options.peers ?? peerVersions(config.root).catch(() => []),
+		options.stackEnv ?? (rules.some((rule) => rule.code === "BS503") ? loadStackEnvCheck(config.root, env, options.signal) : void 0)
 	]).catch(async (cause) => {
 		await opened.close();
 		throw cause;
@@ -3364,6 +3587,7 @@ async function runDoctor(config, args, env, options = {}) {
 		sources,
 		readSets,
 		peers,
+		...stackEnv ? { stackEnv } : {},
 		...live.advisors ? { advisors: live.advisors } : {},
 		...live.database ? { database: live.database } : {},
 		...stats ? { stats } : {},

package/dist/cli/{emit-j0zZ6NE_.js → emit-56LAG_Px.js}

@@ -2,7 +2,7 @@ import { n as CliError } from "./errors-Caiz_0so.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { s as restrictSchemas, u as tsTypeOf } from "./typegen--TfvOPLh.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { t as toCatalog } from "./catalog-Di15TkM2.js";
+import { t as toCatalog } from "./catalog-Cm6BtquM.js";
 import { resolveProviderSql } from "better-supabase/sql";
 import { DEFAULT_CLAIMS, tenantClaimPaths } from "better-supabase/config";
 import { toCamel } from "better-supabase";
@@ -856,9 +856,13 @@ function updateEntries(columns, name) {
 		return `${prop(column[name])}?: ${nullable(column.tsType, column.nullable)};`;
 	});
 }
-/** Postgres passes `null` to any argument, so every argument accepts it. */
+/**
+* Postgres passes `null` to any argument, so every argument accepts it. An
+* optional argument also accepts `undefined`, which `rpc()` leaves out, so
+* `exactOptionalPropertyTypes` apps can pass a maybe-missing value.
+*/
 function argEntries(fn) {
-	return fn.args.map((arg) => `${prop(arg.name)}${arg.optional ? "?" : ""}: ${nullable(arg.tsType, true)};`);
+	return fn.args.map((arg) => `${prop(arg.name)}${arg.optional ? "?" : ""}: ${nullable(arg.tsType, true)}${arg.optional ? " | undefined" : ""};`);
 }
 function enrichedDatabase(model) {
 	const schemas = model.config.schemas.flatMap((schema) => {
@@ -1004,6 +1008,8 @@ const RESERVED_EXPORTS = [
 	"WhereOf",
 	"OrderByOf",
 	"OrderTermOf",
+	"WritableColumnOf",
+	"GeneratedColumnOf",
 	"buckets",
 	"topics",
 	"subjectTypes",
@@ -1022,7 +1028,7 @@ function emitModule(model, options) {
 		`import { defineSchema, type Schema${options.inlineMeta ? ", type SchemaMeta" : ""} } from ${q(runtime)};`
 	];
 	const storagePaths = model.tables.some((table) => table.columns.some((column) => column.storage !== void 0));
-	lines.push(`import type { EnrichDatabase, MutableWhere, OrderByArg, OrderByInput${storagePaths ? ", StoragePath" : ""} } from ${q(runtime)};`, `import type { Database as SupabaseDatabase } from ${q(options.databaseTypesImport ?? "./database.types.ts")};`);
+	lines.push(`import type { EnrichDatabase, GeneratedColumns, MutableWhere, OrderByArg, OrderByInput${storagePaths ? ", StoragePath" : ""}, WritableColumns } from ${q(runtime)};`, `import type { Database as SupabaseDatabase } from ${q(options.databaseTypesImport ?? "./database.types.ts")};`);
 	const byFile = /* @__PURE__ */ new Map();
 	for (const entry of model.jsonImports) {
 		const list = byFile.get(entry.from) ?? [];
@@ -1049,7 +1055,7 @@ function emitModule(model, options) {
 		lines.push(`export const ${claim(constant, source)} = [${column.values.map(q).join(", ")}] as const;`, `export type ${claim(typeName, source)} = (typeof ${constant})[number];`);
 	}
 	if (model.enums.length > 0) lines.push("");
-	lines.push(...modelsType(model), "", ...functionsType(model), "", "export type TableName = keyof Models;", "/** Constraint names for `isConflict`, `isCheck` and `isForeignKey`. */", "export type UniqueConstraint = { [T in TableName]: Extract<keyof Models[T]['UniqueKeys'], string> }[TableName];", "export type CheckConstraint = Models[TableName]['Checks'];", "export type ForeignKeyConstraint = Models[TableName]['ForeignKeys'];", "export type RowOf<T extends TableName> = Models[T]['Row'];", "export type InsertOf<T extends TableName> = Models[T]['Insert'];", "export type UpdateOf<T extends TableName> = Models[T]['Update'];", "/** A `where` for `T` you can assign to one key at a time. */", "export type WhereOf<T extends TableName> = MutableWhere<Models, T>;", "/** An `orderBy` for `T`: one sort or a list, by column or to-one relation. */", "export type OrderByOf<T extends TableName> = OrderByArg<Models, T>;", "/** One sort term of `T`'s `orderBy`, by column or to-one relation. */", "export type OrderTermOf<T extends TableName> = OrderByInput<Models, T>;", "");
+	lines.push(...modelsType(model), "", ...functionsType(model), "", "export type TableName = keyof Models;", "/** Constraint names for `isConflict`, `isCheck` and `isForeignKey`. */", "export type UniqueConstraint = { [T in TableName]: Extract<keyof Models[T]['UniqueKeys'], string> }[TableName];", "export type CheckConstraint = Models[TableName]['Checks'];", "export type ForeignKeyConstraint = Models[TableName]['ForeignKeys'];", "export type RowOf<T extends TableName> = Models[T]['Row'];", "export type InsertOf<T extends TableName> = Models[T]['Insert'];", "export type UpdateOf<T extends TableName> = Models[T]['Update'];", "/** A `where` for `T` you can assign to one key at a time. */", "export type WhereOf<T extends TableName> = MutableWhere<Models, T>;", "/** An `orderBy` for `T`: one sort or a list, by column or to-one relation. */", "export type OrderByOf<T extends TableName> = OrderByArg<Models, T>;", "/** One sort term of `T`'s `orderBy`, by column or to-one relation. */", "export type OrderTermOf<T extends TableName> = OrderByInput<Models, T>;", "/** Columns of `T` that `Insert` and `Update` accept. */", "export type WritableColumnOf<T extends TableName> = WritableColumns<Models, T>;", "/** Columns of `T` the database fills (generated columns): in `Row`, never writable. */", "export type GeneratedColumnOf<T extends TableName> = GeneratedColumns<Models, T>;", "");
 	if (model.meta.buckets) lines.push("/** Bucket configs for `defineBucket` from `better-supabase/storage`. */", `export const buckets = ${JSON.stringify(model.meta.buckets, null, 2)} as const;`, "");
 	if (model.meta.topics) lines.push("/** Topic templates for `defineTopic` from `better-supabase/realtime`. */", `export const topics = ${JSON.stringify(model.meta.topics, null, 2)} as const;`, "");
 	const subjects = Object.keys(model.config.subjects);

package/dist/cli/{env-Ch99nTQw.js → env-B7TWPEt0.js}

@@ -1 +1 @@
-export { t as PROCESS_ENV, n as configEnvironment, r as isCi, i as parseEnv } from "./env-Cf5OTqbK.js";
+export { t as PROCESS_ENV, n as configEnvironment, r as isCi, i as parseEnv } from "./env-C8R7Nf0a.js";

package/dist/cli/{env-Cf5OTqbK.js → env-C8R7Nf0a.js}

@@ -1070,7 +1070,8 @@ function parseEnv(env) {
 				HOME: optionalString,
 				CI: optionalString,
 				BETTER_SUPABASE_ENV: optionalString,
-				BETTER_SUPABASE_AGENT: optionalString
+				BETTER_SUPABASE_AGENT: optionalString,
+				BSB_STACK: optionalString
 			},
 			runtimeEnv: env,
 			isServer: true,

package/dist/cli/env-Cmu99uKR.js

@@ -0,0 +1 @@
+export { n as envCommand } from "./env-Dh5K5t2U.js";