better-supabase 0.12.0 → 0.14.0

package/dist/cli/run-KXjrgNCH.js

@@ -0,0 +1,2378 @@
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+import { a as sameText, n as importPath, t as display } from "./io-DH1kcmmP.js";
+import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-C3K_wOE2.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { d as typegenVersion, f as typegenVersionNotice, i as oxfmtInstalled, l as stabilizeMetadata, r as generateDatabaseTypes } from "./typegen-F9GEjpvD.js";
+import { t as detectProject } from "./detect-RApSAA8v.js";
+import { a as buildModel, d as applyCasing, i as metaPaths, l as prop, n as emitMeta, o as generatorModel, r as emitModule, t as GENERATED_HEADER, u as q } from "./emit-DbQeLlHt.js";
+import { C as accessRequirements, D as providerLabel, E as moduleKeyProblems, O as unsafeKey, S as accessProviderMode, T as entitlementsMode, c as writeLatestMigration, l as writesMigrations, n as READ_SETS_SUFFIX, r as latestMigration, s as sameModuleMigration, v as migrationsDir, w as entitlementRequirements, x as compiledReadSets } from "./module-migration-CbX-jRhV.js";
+import { t as loadSnapshot } from "./snapshot-Dkwxc1uV.js";
+import { a as hasConflicts, c as fileDiff, i as changedFiles, n as applyPlan, r as changeLines } from "./files-C5JfVnj5.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-CCpxS5if.js";
+import { existsSync } from "node:fs";
+import { basename, dirname, isAbsolute, posix, relative, resolve, sep } from "node:path";
+import { readFile } from "node:fs/promises";
+import { entityNames } from "better-supabase/blocks";
+import { blockEntities, blockEntityRenames, blockSubjectTypes, tenantNameOf } from "better-supabase/config";
+import { PRESET_CATALOG } from "better-supabase/preset";
+import { BLOCK_OPTION_SCHEMAS, DEFAULT_ROLES, SQL_MODULES, appTableEventTypes, moduleHidingColumns, moduleLayout, modulePermissionKeys, renderModules, resolveModule, resolveModules, sameModuleFile } from "better-supabase/sql";
+//#region src/cli/gen/block-names.ts
+const PLACEHOLDER = /\{(\.\.\.)?([A-Za-z_][\w]*)\}/g;
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function camel$1(name) {
+	return name.replaceAll(/[-_]([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function pascal$2(name) {
+	const camelled = camel$1(name);
+	return camelled.charAt(0).toUpperCase() + camelled.slice(1);
+}
+function union(values) {
+	return [...new Set(values)].toSorted().map((value) => q(value)).join(" | ");
+}
+/**
+* A template with `{placeholders}` as an arrow function over their values: `(v:
+* { readonly userId: string }) => \`notifications:${v.userId}\``. `rename` maps
+* a placeholder to the property the caller passes.
+*/
+function templateFunction(template, rename = (name) => name, value = "string") {
+	const names = [];
+	let body = "";
+	let last = 0;
+	for (const match of template.matchAll(PLACEHOLDER)) {
+		const name = rename(match[2] ?? "");
+		if (!names.includes(name)) names.push(name);
+		body += `${literalPart(template.slice(last, match.index))}\${String(v.${name})}`;
+		last = match.index + match[0].length;
+	}
+	body += literalPart(template.slice(last));
+	if (names.length === 0) return `() => ${q(template)}`;
+	return `(v: { ${names.map((name) => `readonly ${name}: ${value}`).join("; ")} }) => \`${body}\``;
+}
+function literalPart(text) {
+	return text.replaceAll(/[`\\]|\$\{/g, (match) => `\\${match}`);
+}
+/** Permission keys by owner (block, subject or app table), then action. */
+function permissionGroups(config) {
+	const groups = {};
+	for (const entry of modulePermissionKeys(config.blocks, config.blockNames)) groups[entry.module] = {
+		...groups[entry.module],
+		[entry.action]: entry.key
+	};
+	for (const [name, subject] of Object.entries(config.subjects)) if (subject.permissions) groups[name] = {
+		...groups[name],
+		...subject.permissions
+	};
+	for (const table of Object.values(config.appTables)) {
+		const subject = table.subject;
+		if (subject?.permissions) groups[subject.type] = {
+			...groups[subject.type],
+			...subject.permissions
+		};
+	}
+	return groups;
+}
+/** Whether `blocks.generated.ts` exports `permissions`. */
+function hasPermissionConstants(config) {
+	return Object.values(permissionGroups(config)).some((group) => Object.keys(group).length > 0);
+}
+function permissionLines(config) {
+	const groups = permissionGroups(config);
+	const keys = Object.values(groups).flatMap((group) => Object.values(group));
+	if (keys.length === 0) return [];
+	return [
+		"",
+		"/**",
+		" * The permission keys the installed blocks, subjects and app tables check,",
+		" * by owner and action.",
+		" * @public",
+		" */",
+		"export const permissions = {",
+		...Object.entries(groups).toSorted(([a], [b]) => a.localeCompare(b)).flatMap(([owner, actions]) => [
+			`  ${prop(owner)}: {`,
+			...Object.entries(actions).map(([action, key]) => `    ${prop(action)}: ${q(key)},`),
+			"  },"
+		]),
+		"} as const;",
+		"",
+		"/**",
+		" * Every permission key, for `defineAuthorizer<PermissionKey>()` and",
+		" * the `permission` of actions and routes.",
+		" * @public",
+		" */",
+		`export type PermissionKey = ${union(keys)};`
+	];
+}
+function roleLines(config, entries) {
+	if (entries["access"] === void 0) return [];
+	const access = config.blocks.access;
+	const settings = typeof access === "object" ? access : void 0;
+	if ((settings?.model ?? "roles") !== "roles") return [];
+	const roles = settings?.roles ?? DEFAULT_ROLES;
+	return [
+		"",
+		"/** The roles `blocks.access.roles` defines. @public */",
+		`export type RoleName = ${union(Object.keys(roles))};`
+	];
+}
+function blockEventLists(entries) {
+	return PRESET_CATALOG.manifests.flatMap((manifest) => {
+		const entry = entries[manifest.name];
+		const events = manifest.events;
+		if (entry === void 0 || events === void 0 || !manifest.client) return [];
+		const names = entityNames(entry.names?.entities ?? []);
+		const renamed = names.rename(events.type);
+		return [{
+			specifier: renamed === events.type ? `import type { ${events.type} } from ${q(manifest.client.subpath)};` : "",
+			type: renamed,
+			types: events.types.map((type) => names.rename(type))
+		}];
+	});
+}
+function eventLines(entries) {
+	const lists = blockEventLists(entries);
+	if (lists.length === 0) return {
+		specifiers: [],
+		imports: [],
+		lines: []
+	};
+	const types = [...new Set(lists.flatMap((list) => list.types))].toSorted();
+	return {
+		specifiers: ["type Events"],
+		imports: lists.flatMap((list) => list.specifier === "" ? [] : [list.specifier]),
+		lines: [
+			"",
+			"/** Every installed block's events: type to data. @public */",
+			`export type BlockEvents = ${lists.map((list) => list.type).join(" & ")};`,
+			"",
+			"/**",
+			" * The installed blocks' event types under the configured names, for",
+			" * `onBlockEvent` and the sinks.",
+			" * @public",
+			" */",
+			"export const blockEvents: Events<BlockEvents> = {",
+			"  types: [",
+			...types.map((type) => `    ${q(type)},`),
+			"  ],",
+			"};",
+			"",
+			"/**",
+			" * The block events with an open payload, for AsyncAPI's `cloudEvents.blocks`.",
+			" * @public",
+			" */",
+			"export const blockEventSchemas = {",
+			...types.map((type) => `  ${q(type)}: true,`),
+			"} as const;"
+		]
+	};
+}
+function urlLines(config, entries) {
+	const templates = /* @__PURE__ */ new Map();
+	for (const name of Object.keys(entries)) for (const entity of blockEntities(name, config.blocks)) if (entity.url !== void 0) templates.set(camel$1(entity.to.singular), entity.url);
+	for (const [type, subject] of Object.entries(config.subjects)) {
+		const key = camel$1(type);
+		if (subject.url !== void 0 && !templates.has(key)) templates.set(key, subject.url);
+	}
+	const urls = [...templates].map(([key, template]) => `  ${prop(key)}: ${templateFunction(template, (column) => applyCasing(column, config.casing), "string | number")},`);
+	return urls.length === 0 ? [] : [
+		"",
+		"/**",
+		" * The path of each subject type with a `url`: block entities, `subjects`",
+		" * and app table subjects.",
+		" * @public",
+		" */",
+		"export const urls = {",
+		...urls,
+		"} as const;"
+	];
+}
+function topicLines(entries) {
+	const topics = Object.entries(entries).flatMap(([name, entry]) => Object.entries(entry.options).flatMap(([option, value]) => {
+		if (!/^(?:topic|[a-z]+Topic)$/.test(option) || typeof value !== "string") return [];
+		const key = option === "topic" ? camel$1(name) : `${camel$1(name)}${pascal$2(option.replace(/Topic$/, ""))}`;
+		return [`  ${prop(key)}: ${templateFunction(value)},`];
+	}));
+	return topics.length === 0 ? [] : [
+		"",
+		"/** The realtime topics the blocks broadcast on, with their placeholders filled. @public */",
+		"export const topics = {",
+		...topics,
+		"} as const;"
+	];
+}
+function pathLines(config) {
+	const paths = Object.entries(config.buckets).map(([name, bucket]) => {
+		const key = prop(camel$1(name));
+		return typeof bucket.path === "string" ? `  ${key}: ${templateFunction(bucket.path)},` : `  ${key}: [${bucket.path.map((path) => templateFunction(path)).join(", ")}],`;
+	});
+	return paths.length === 0 ? [] : [
+		"",
+		"/** Object paths in each bucket, from `buckets.<name>.path`. @public */",
+		"export const paths = {",
+		...paths,
+		"} as const;"
+	];
+}
+function optionOf(config, module, option) {
+	return config.blockNames.includes(module) || config.blocks[module] !== void 0 ? resolveModule(config.blocks[module]).options[option] : void 0;
+}
+function settingKeys(config) {
+	const option = optionOf(config, "settings", "schemas");
+	const schemas = isRecord(option) && isRecord(option["schemas"]) ? option["schemas"] : option;
+	if (!isRecord(schemas)) return [];
+	return [
+		"user",
+		"organization",
+		"platform"
+	].flatMap((scope) => {
+		const keys = schemas[scope];
+		return isRecord(keys) ? Object.keys(keys) : [];
+	});
+}
+function meterNames(config) {
+	const option = optionOf(config, "usage", "meters");
+	return isRecord(option) && typeof option["table"] !== "string" ? Object.keys(option) : [];
+}
+function keyUnionLines(config) {
+	return [[
+		"SettingKey",
+		"`blocks.settings.options.schemas`",
+		settingKeys(config)
+	], [
+		"MeterName",
+		"`blocks.usage.options.meters`",
+		meterNames(config)
+	]].flatMap(([name, source, keys]) => keys.length === 0 ? [] : [
+		"",
+		`/** The keys ${source} names. @public */`,
+		`export type ${name} = ${union(keys)};`
+	]);
+}
+/**
+* The constants app code references by name, from the config: permission keys,
+* role names, block events, entity URLs, realtime topics, bucket paths, and the
+* settings and meter keys.
+*/
+function nameConstantLines(config, entries) {
+	const events = eventLines(entries);
+	return {
+		specifiers: events.specifiers,
+		imports: events.imports,
+		lines: [
+			...permissionLines(config),
+			...roleLines(config, entries),
+			...events.lines,
+			...urlLines(config, entries),
+			...topicLines(entries),
+			...pathLines(config),
+			...keyUnionLines(config)
+		]
+	};
+}
+//#endregion
+//#region src/cli/gen/blocks.ts
+/** `blocks.generated.ts`, next to the main generated module. */
+function blockConfigPath(config) {
+	return posix.join(posix.dirname(config.output), "blocks.generated.ts");
+}
+function hasSchema(module) {
+	return module in BLOCK_OPTION_SCHEMAS;
+}
+/**
+* How the tenant rename, the modules' renamed entities and their
+* `blocks.<module>.functions` rename the block's functions and payload keys, or
+* undefined when nothing does. `blocks.access.functions` is the custom model's
+* templates, not renames.
+*/
+function namingOf(config, modules) {
+	const functions = Object.fromEntries(modules.flatMap((module) => module === "access" ? [] : Object.entries(resolveModule(config.blocks[module]).functions)));
+	const entities = modules.flatMap((module) => blockEntityRenames(module, config.blocks));
+	const tenant = tenantNameOf(config.blocks);
+	const renames = Object.keys(functions).length > 0;
+	if (tenant === void 0 && !renames && entities.length === 0) return;
+	return {
+		...tenant === void 0 ? {} : { tenant },
+		...renames ? { functions } : {},
+		...entities.length === 0 ? {} : { entities }
+	};
+}
+/**
+* The generated config of every installed block: its schema, its API schema,
+* and the options marked `client` with the configured value or the module's
+* default. Blocks without a creator get an entry too, since `block.using(...)`
+* builds them with these options.
+*/
+function blockConfigEntries(config) {
+	const installed = new Set(resolveModules(config.blockNames, {
+		modules: config.blocks,
+		...config.sql.scope === void 0 ? {} : { scope: config.sql.scope }
+	}).map((module) => module.name));
+	const entries = [];
+	for (const manifest of PRESET_CATALOG.manifests) {
+		const modules = manifest.sql.filter((module) => installed.has(module));
+		const [main] = modules;
+		if (main === void 0) continue;
+		const resolved = resolveModule(config.blocks[main]);
+		const options = {};
+		for (const module of modules) {
+			if (!hasSchema(module)) continue;
+			const configured = resolveModule(config.blocks[module]).options;
+			for (const [key, spec] of Object.entries(BLOCK_OPTION_SCHEMAS[module].specs)) {
+				if (!spec.client) continue;
+				const value = configured[key] ?? spec.default;
+				if (value !== void 0) options[key] = value;
+			}
+		}
+		const names = namingOf(config, modules);
+		entries.push([manifest.name, {
+			schema: resolved.schema,
+			...resolved.api === void 0 ? {} : { api: resolved.api.schema },
+			options,
+			...names === void 0 ? {} : { names }
+		}]);
+	}
+	return Object.fromEntries(entries);
+}
+function literal(value, indent) {
+	if (Array.isArray(value)) return `[${value.map((entry) => literal(entry, indent)).join(", ")}]`;
+	if (typeof value === "object" && value !== null) {
+		const entries = Object.entries(value);
+		if (entries.length === 0) return "{}";
+		const inner = `${indent}  `;
+		return `{\n${entries.map(([key, entry]) => `${inner}${prop(key)}: ${literal(entry, inner)},`).join("\n")}\n${indent}}`;
+	}
+	return JSON.stringify(value);
+}
+/** Every event type the app tables emit, in config order. */
+function appTableEvents(config) {
+	return Object.entries(config.appTables).flatMap(([name, table]) => appTableEventTypes(name, table));
+}
+/**
+* `appTableEvents` and `appTableEventSchemas`, for app tables that set
+* `events`.
+*/
+function appTableEventLines(types) {
+	if (types.length === 0) return [];
+	return [
+		"",
+		"/**",
+		" * The events `appTables.<table>.events` writes to the outbox, for `onBlockEvent` and the sinks.",
+		" * @public",
+		" */",
+		"export const appTableEvents = defineEvents({",
+		...types.map((type) => `  ${prop(type)}: event<AppTableEventData>(),`),
+		"});",
+		"",
+		"/**",
+		" * The app table events with an open payload, for AsyncAPI's `cloudEvents.blocks`.",
+		" * @public",
+		" */",
+		"export const appTableEventSchemas = {",
+		...types.map((type) => `  ${prop(type)}: true,`),
+		"} as const;"
+	];
+}
+const CATALOG_BLOCKS = new Map(PRESET_CATALOG.blocks.map((block) => [block.name, block]));
+const MANIFESTS = new Map(PRESET_CATALOG.manifests.map((manifest) => [manifest.name, manifest]));
+/** The installed blocks with their final names, for `GeneratorModel.blocks`. */
+function generatorBlocks(config) {
+	return Object.entries(blockConfigEntries(config)).map(([name, entry]) => {
+		const manifest = MANIFESTS.get(CATALOG_BLOCKS.get(name)?.manifest ?? "");
+		const owned = manifest?.name === name ? manifest : void 0;
+		const client = owned?.client ?? void 0;
+		const renames = entityNames(entry.names?.entities ?? []);
+		return {
+			name,
+			schema: entry.schema,
+			client: client === void 0 ? void 0 : {
+				export: renames.rename(client.export),
+				subpath: client.subpath
+			},
+			entities: blockEntities(name, config.blocks).map((entity) => ({
+				key: entity.key,
+				from: { ...entity.from },
+				to: { ...entity.to },
+				primary: entity.primary,
+				table: entity.table,
+				url: entity.url,
+				schemas: owned?.entitySchemas?.[entity.key] ?? {}
+			}))
+		};
+	});
+}
+/**
+* For each installed block whose entities `blocks.<name>.entities` renames: the
+* block under its renamed constant (`tasksBlock`) and an alias for each type
+* named after one of its entities (`Task<F>`, `TasksEvents`).
+*/
+function renamedBlockLines(entries) {
+	const imports = [];
+	const lines = [];
+	for (const manifest of PRESET_CATALOG.manifests) {
+		const renames = entries[manifest.name]?.names?.entities ?? [];
+		if (manifest.client === null || renames.length === 0) continue;
+		const names = entityNames(renames);
+		const block = manifest.client.export;
+		const renamed = names.rename(block);
+		const local = renamed === block ? `default${pascal$1(block)}` : block;
+		const types = (manifest.entityTypes ?? []).filter((type) => !(type.name.endsWith("Options") && manifest.entityTypes?.some((other) => `${other.name}Options` === type.name)));
+		const alias = `${pascal$1(camelOf(manifest.name))}Renames`;
+		const key = q(manifest.name);
+		const localOf = (name) => names.rename(name) === name ? `Default${name}` : name;
+		const specifiers = [...types.map((type) => localOf(type.name) === type.name ? `  type ${type.name},` : `  type ${type.name} as ${localOf(type.name)},`), `  ${local === block ? block : `${block} as ${local}`},`];
+		imports.push([
+			"import {",
+			...specifiers,
+			`} from ${q(manifest.client.subpath)};`
+		].join("\n"));
+		lines.push("", `type ${alias} = (typeof blockConfig)[${key}]["names"]["entities"];`, "", "/**", ` * The \`${manifest.name}\` block under the names \`blocks.${manifest.name}.entities\` gives it.`, " * @public", " */", `export const ${renamed} = renameBlock(${local}, blockConfig[${key}].names);`, ...types.flatMap((type) => {
+			const name = names.rename(type.name);
+			const source = localOf(type.name);
+			if (type.name.endsWith("Events")) return [
+				"",
+				"/** @public */",
+				`export type ${name} = RenamedEvents<${source}, ${alias}>;`
+			];
+			return type.fields === true ? [
+				"",
+				"/** @public */",
+				`export type ${name}<F extends object = Record<never, never>> = RenamedType<${source}<F>, ${alias}>;`
+			] : [
+				"",
+				"/** @public */",
+				`export type ${name} = RenamedType<${source}, ${alias}>;`
+			];
+		}));
+	}
+	return {
+		specifiers: imports.length === 0 ? [] : [
+			"renameBlock",
+			"type RenamedEvents",
+			"type RenamedType"
+		],
+		imports,
+		lines
+	};
+}
+function camelOf(name) {
+	return name.replaceAll(/-([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function pascal$1(name) {
+	return name.charAt(0).toUpperCase() + name.slice(1);
+}
+/**
+* `blocks.generated.ts`: each installed block's schema, API schema and the
+* options its TypeScript side reads, for `defineBlocks(blockConfig, ...)`, and
+* the app table events. `undefined` when the config installs no blocks.
+*/
+function emitBlockConfig(config, options = {}) {
+	if (config.blockNames.length === 0) return;
+	const entries = blockConfigEntries(config);
+	const events = appTableEvents(config);
+	const runtime = options.runtimeImport ?? "better-supabase";
+	const renamed = renamedBlockLines(entries);
+	const constants = nameConstantLines(config, entries);
+	const specifiers = [
+		...events.length === 0 ? [] : [
+			"type AppTableEventData",
+			"defineEvents",
+			"event"
+		],
+		"type GeneratedBlocks",
+		...renamed.specifiers,
+		...constants.specifiers
+	].toSorted((a, b) => a.replace("type ", "").localeCompare(b.replace("type ", "")));
+	const blocksImport = specifiers.length === 1 ? `import type { GeneratedBlocks } from ${q(`${runtime}/blocks`)};` : `import {\n${specifiers.map((name) => `  ${name},`).join("\n")}\n} from ${q(`${runtime}/blocks`)};`;
+	return {
+		path: blockConfigPath(config),
+		contents: [
+			GENERATED_HEADER,
+			"",
+			blocksImport,
+			...renamed.imports,
+			...constants.imports,
+			"",
+			"/**",
+			" * The installed blocks' settings from the `blocks` config, for",
+			" * `defineBlocks(blockConfig, { ... })`: each block's schema, API schema",
+			" * and the options its SQL and TypeScript halves share.",
+			" */",
+			`export const blockConfig = ${literal(entries, "")} as const satisfies GeneratedBlocks;`,
+			...renamed.lines,
+			...appTableEventLines(events),
+			...constants.lines,
+			""
+		].join("\n")
+	};
+}
+//#endregion
+//#region src/cli/gen/features.ts
+/** `names` and every block they require, from the catalog. */
+function withRequired(names) {
+	const requires = new Map(PRESET_CATALOG.blocks.map((block) => [block.name, block.requires]));
+	const found = /* @__PURE__ */ new Set();
+	const add = (name) => {
+		if (!found.has(name)) {
+			found.add(name);
+			for (const required of requires.get(name) ?? []) add(required);
+		}
+	};
+	for (const name of names) add(name);
+	return [...found];
+}
+function camel(name) {
+	return name.replaceAll(/[-_]([a-z0-9])/g, (_, c) => c.toUpperCase());
+}
+function pascal(name) {
+	const named = camel(name);
+	return named.charAt(0).toUpperCase() + named.slice(1);
+}
+function kebab(name) {
+	return name.replaceAll("_", "-");
+}
+/**
+* The subject types a block's SQL serves, which is where its sections load: the
+* types `blocks.<name>.options.subjects` names, or every tenant-scoped
+* registered subject when it names none. Versions keep only the listed types
+* and the subjects with `versions` set.
+*/
+function servedSubjects(config, block) {
+	const listed = resolveModule(config.blocks[block]).options["subjects"];
+	const registry = Object.entries(config.subjects);
+	const named = Array.isArray(listed) ? listed.filter((type) => typeof type === "string") : typeof listed === "object" && listed !== null ? Object.keys(listed) : void 0;
+	if (block === "versions") {
+		const versioned = registry.filter(([, entry]) => entry.versions !== void 0).map(([type]) => type);
+		return /* @__PURE__ */ new Set([...named ?? [], ...versioned]);
+	}
+	if (named !== void 0) return new Set(named);
+	return new Set(registry.filter(([, entry]) => entry.tenant !== false).map(([type]) => type));
+}
+function sectionBlocks(config) {
+	const manifests = new Map(PRESET_CATALOG.manifests.map((manifest) => [manifest.name, manifest]));
+	return generatorBlocks(config).flatMap((block) => {
+		const manifest = manifests.get(block.name);
+		if (manifest?.sections === void 0 || manifest.client === null || block.client === void 0) return [];
+		const renamed = block.client.export !== manifest.client.export;
+		return [{
+			name: block.name,
+			key: camel(block.name),
+			local: block.client.export,
+			from: renamed ? void 0 : block.client.subpath,
+			sections: manifest.sections
+		}];
+	});
+}
+/** Each section name once, from the first block that declares it. */
+function ownedSections(blocks) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const block of blocks) for (const [name, writes] of Object.entries(block.sections)) if (!seen.has(name)) seen.set(name, writes);
+	return [...seen];
+}
+function featureFile(config, path, type, blocks, extras) {
+	const generated = importPath(path, blockConfigPath(config));
+	const fromGenerated = [
+		"blockConfig",
+		...extras.permissions ? ["permissions"] : [],
+		...blocks.filter((block) => block.from === void 0).map((b) => b.local)
+	].toSorted((a, b) => a.localeCompare(b));
+	const imports = [
+		"import { defineRecordFeature } from \"better-supabase/records\";",
+		...blocks.flatMap((block) => block.from === void 0 ? [] : [`import { ${block.local} } from ${q(block.from)};`]),
+		...extras.access === void 0 ? [] : [`import { accessBlock } from ${q(extras.access)};`]
+	].toSorted((a, b) => a.localeCompare(b));
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			...imports,
+			"",
+			`import { ${fromGenerated.join(", ")} } from ${q(generated)};`,
+			"",
+			"/**",
+			` * The ${type} record page: a section for each installed block that adds one.`,
+			" * Pass it to `recordServer`, `recordQueries` or `createRecordProvider`.",
+			" */",
+			`export const ${camel(type)}Feature = defineRecordFeature({`,
+			`  type: ${q(type)},`,
+			"  blocks: {",
+			...blocks.map((block) => block.key === block.local ? `    ${block.key},` : `    ${block.key}: ${block.local},`),
+			"  },",
+			"  config: blockConfig,",
+			...extras.permissions ? ["  permissions,"] : [],
+			...extras.access === void 0 ? [] : ["  access: accessBlock,"],
+			"});",
+			""
+		].join("\n")
+	};
+}
+function actionName(type, section, write) {
+	return `${write}${pascal(type)}${pascal(section)}`;
+}
+function serverFile(config, path, type, feature) {
+	const server = posix.join(posix.dirname(config.output), "server.ts");
+	const name = camel(type);
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"import \"server-only\";",
+			"",
+			"import { recordServer } from \"better-supabase/next\";",
+			"",
+			`import { bs } from ${q(importPath(path, server))};`,
+			`import { ${name}Feature } from ${q(importPath(path, feature))};`,
+			"",
+			"/**",
+			` * Loads a ${type}'s sections in a Server Component, outside \`"use cache"\`,`,
+			" * and runs its section writes as Server Actions.",
+			" */",
+			`export const ${name}Record = recordServer(bs, ${name}Feature);`,
+			""
+		].join("\n")
+	};
+}
+function actionsFile(path, type, server, sections) {
+	const name = camel(type);
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"\"use server\";",
+			"",
+			`import { ${name}Record } from ${q(importPath(path, server))};`,
+			...sections.flatMap(([section, writes]) => writes.map((write) => `\nexport const ${actionName(type, section, write)} = ${name}Record.actions.${section}.${write};`)),
+			""
+		].join("\n")
+	};
+}
+function providerFile(path, type, feature, actions) {
+	const name = camel(type);
+	const Name = pascal(type);
+	const names = actions?.sections.flatMap(([section, writes]) => writes.map((write) => actionName(type, section, write))) ?? [];
+	const withActions = actions === void 0 || names.length === 0 ? void 0 : {
+		path: actions.path,
+		sections: actions.sections
+	};
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"\"use client\";",
+			"",
+			"import { createElement, type ReactNode } from \"react\";",
+			"",
+			"import { createRecordProvider } from \"better-supabase/react\";",
+			"",
+			...withActions === void 0 ? [] : [
+				"import {",
+				...names.map((action) => `  ${action},`),
+				`} from ${q(importPath(path, withActions.path))};`
+			],
+			`import { ${name}Feature } from ${q(importPath(path, feature))};`,
+			"",
+			`const kit = createRecordProvider(${name}Feature);`,
+			"",
+			...withActions === void 0 ? [] : [
+				"const writes = {",
+				...withActions.sections.flatMap(([section, writes]) => writes.length === 0 ? [] : [
+					`  ${section}: {`,
+					...writes.map((write) => `    ${write}: ${actionName(type, section, write)},`),
+					"  },"
+				]),
+				"};",
+				""
+			],
+			`export type ${Name}RecordProviderProps = Omit<`,
+			"  Parameters<typeof kit.RecordProvider>[0],",
+			"  \"writes\"",
+			">;",
+			"",
+			"/**",
+			` * Holds a ${type}'s sections for its children and follows \`topic\`.`,
+			withActions === void 0 ? " * Writes run on the client, under RLS." : " * Writes run as the generated Server Actions.",
+			" */",
+			`export function ${Name}RecordProvider(`,
+			`  props: ${Name}RecordProviderProps,`,
+			"): ReactNode {",
+			withActions === void 0 ? "  return createElement(kit.RecordProvider, props);" : "  return createElement(kit.RecordProvider, { ...props, writes });",
+			"}",
+			"",
+			`/** The ${type} record context: \`{ state, actions, meta }\`. */`,
+			`export const use${Name}Record = kit.useRecord;`,
+			""
+		].join("\n")
+	};
+}
+function queriesFile(path, type, feature) {
+	const name = camel(type);
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"import {",
+			"  recordQueries,",
+			"  type RecordQueriesOptions,",
+			"} from \"better-supabase/query\";",
+			"",
+			`import { ${name}Feature } from ${q(importPath(path, feature))};`,
+			"",
+			"/**",
+			` * TanStack Query options for a ${type}'s sections and writes, over the`,
+			" * block clients `createBlocks` builds.",
+			" */",
+			`export const ${name}Queries = (`,
+			"  clients: Parameters<typeof recordQueries>[1],",
+			"  options?: RecordQueriesOptions,",
+			`) => recordQueries(${name}Feature, clients, options);`,
+			""
+		].join("\n")
+	};
+}
+/**
+* `features/` next to the main module: one record feature per subject with a
+* section for each installed block that serves it, and the bindings for the
+* project's frameworks. Subjects the section blocks and the blocks they require
+* register themselves (a comment's message, an attachment) get none. Empty with
+* `generateFeatures: false`.
+*/
+function emitFeatures(config, frameworks = []) {
+	if (!config.generateFeatures || config.blockNames.length === 0) return [];
+	const blocks = sectionBlocks(config);
+	if (blocks.length === 0) return [];
+	const served = new Map(blocks.map((block) => [block.name, servedSubjects(config, block.name)]));
+	const access = PRESET_CATALOG.manifests.find((manifest) => manifest.name === "access")?.client;
+	const extras = {
+		access: new Set(generatorBlocks(config).map((block) => block.name)).has("access") ? access?.subpath : void 0,
+		permissions: hasPermissionConstants(config)
+	};
+	const next = frameworks.includes("next");
+	const react = next || frameworks.includes("vite") || frameworks.includes("expo");
+	const query = frameworks.includes("tanstack-query");
+	const dir = posix.join(posix.dirname(config.output), "features");
+	const files = [];
+	const features = [];
+	const inner = new Set(withRequired(blocks.map((block) => block.name)).flatMap((name) => blockSubjectTypes(name, config.blocks)));
+	for (const type of Object.keys(config.subjects).toSorted()) {
+		if (inner.has(type)) continue;
+		const own = blocks.filter((block) => served.get(block.name)?.has(type));
+		if (own.length === 0) continue;
+		const base = posix.join(dir, kebab(type), kebab(type));
+		const feature = `${base}-feature.ts`;
+		const sections = ownedSections(own);
+		files.push(featureFile(config, feature, type, own, extras));
+		features.push([type, feature]);
+		if (next) {
+			const server = `${base}-server.ts`;
+			const actions = `${base}-actions.ts`;
+			files.push(serverFile(config, server, type, feature), actionsFile(actions, type, server, sections), providerFile(`${base}-provider.ts`, type, feature, {
+				path: actions,
+				sections
+			}));
+		} else if (react) files.push(providerFile(`${base}-provider.ts`, type, feature, void 0));
+		if (query) files.push(queriesFile(`${base}-queries.ts`, type, feature));
+	}
+	if (features.length === 0) return [];
+	const index = posix.join(dir, "index.ts");
+	files.push({
+		path: index,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			...features.map(([type, path]) => `export { ${camel(type)}Feature } from ${q(importPath(index, path))};`),
+			""
+		].join("\n")
+	});
+	return files;
+}
+//#endregion
+//#region src/cli/gen/navigation.ts
+function plural(word) {
+	if (/[^aeiou]y$/.test(word)) return `${word.slice(0, -1)}ies`;
+	if (/(?:s|x|z|ch|sh)$/.test(word)) return `${word}es`;
+	return `${word}s`;
+}
+function label(type) {
+	const words = type.split(/[-_]/);
+	const last = words.length - 1;
+	const named = words.map((word, index) => index === last ? plural(word) : word).join(" ");
+	return named.charAt(0).toUpperCase() + named.slice(1);
+}
+/**
+* The subjects whose `url` has a list route: the path without its last segment,
+* such as `/customers` for `/customers/{id}`. A route with a placeholder before
+* the last segment is nested under another record and has no top-level entry.
+*/
+function listedSubjects(config) {
+	return Object.entries(config.subjects).toSorted(([a], [b]) => a.localeCompare(b)).flatMap(([type, entry]) => {
+		const url = entry.url;
+		if (url === void 0) return [];
+		const last = url.lastIndexOf("/");
+		const href = url.slice(last) === `/{${entry.id ?? "id"}}` ? url.slice(0, last) : url;
+		if (href === "" || href.includes("{")) return [];
+		return [{
+			type,
+			label: label(type),
+			href,
+			record: url,
+			permission: entry.permissions?.["read"]
+		}];
+	});
+}
+function navigationFile(path, listed) {
+	const hrefs = /* @__PURE__ */ new Set();
+	const items = listed.filter((subject) => !hrefs.has(subject.href) && hrefs.add(subject.href)).map((subject) => [
+		"  {",
+		`    type: ${q(subject.type)},`,
+		`    label: ${q(subject.label)},`,
+		`    href: ${q(subject.href)},`,
+		`    record: ${q(subject.record)},`,
+		`    permission: ${subject.permission === void 0 ? "undefined" : q(subject.permission)},`,
+		"  },"
+	].join("\n"));
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"/** A list route for a registered subject, from `subjects.<type>.url`. */",
+			"export interface NavigationItem {",
+			"  readonly type: string;",
+			"  readonly label: string;",
+			"  /** The list route. */",
+			"  readonly href: string;",
+			"  /** The record route, with `{column}` placeholders. */",
+			"  readonly record: string;",
+			"  /** The permission key `subjects.<type>.permissions.read` names. */",
+			"  readonly permission: string | undefined;",
+			"}",
+			"",
+			"export const navigation: readonly NavigationItem[] = [",
+			...items,
+			"];",
+			""
+		].join("\n")
+	};
+}
+function commandsFile(path, subjects) {
+	const items = subjects.map((subject) => [
+		"  {",
+		`    id: ${q(`go-to-${subject.type.replaceAll("_", "-")}`)},`,
+		`    label: ${q(`Go to ${subject.label.toLowerCase()}`)},`,
+		`    group: "Navigation",`,
+		`    keywords: [${q(subject.type)}],`,
+		`    href: ${q(subject.href)},`,
+		`    permission: ${subject.permission === void 0 ? "undefined" : q(subject.permission)},`,
+		"  },"
+	].join("\n"));
+	return {
+		path,
+		contents: [
+			GENERATED_HEADER,
+			"",
+			"/** A command palette entry that opens a subject's list route. */",
+			"export interface Command {",
+			"  readonly id: string;",
+			"  readonly label: string;",
+			"  readonly group: string;",
+			"  readonly keywords: readonly string[];",
+			"  readonly href: string;",
+			"  /** The permission key the command needs, when the subject names one. */",
+			"  readonly permission: string | undefined;",
+			"}",
+			"",
+			"export const commands: readonly Command[] = [",
+			...items,
+			"];",
+			""
+		].join("\n")
+	};
+}
+/**
+* `navigation.generated.ts` and `commands.generated.ts` next to the typed
+* client: plain typed arrays with one entry per subject that has a list route,
+* carrying the read permission so the app can hide what the caller can't open.
+* Subjects that share a list route share one navigation entry, the first by
+* type name.
+*/
+function emitNavigation(config) {
+	const subjects = listedSubjects(config);
+	if (subjects.length === 0) return [];
+	const dir = posix.dirname(config.output);
+	return [navigationFile(posix.join(dir, "navigation.generated.ts"), subjects), commandsFile(posix.join(dir, "commands.generated.ts"), subjects)];
+}
+//#endregion
+//#region src/cli/gen/render.ts
+/**
+* Renders every generated file for a snapshot, without touching disk:
+* `database.types.ts` (what `supabase gen types` prints), the main module,
+* `blocks.generated.ts` when the config installs blocks, the record features in
+* `features/`, then each configured generator's files.
+*/
+async function renderFiles(config, snapshot, options = {}) {
+	return (await render(config, snapshot, options)).files;
+}
+async function render(config, snapshot, options = {}) {
+	const model = buildModel(snapshot, config);
+	const runtime = options.runtimeImport ? { runtimeImport: options.runtimeImport } : {};
+	const output = resolve(config.root, config.output);
+	const typegenOptions = {
+		schemas: config.schemas,
+		postgrestVersion: config.postgrestVersion
+	};
+	const databaseTypes = await cachedDatabaseTypes(config.root, [
+		typegenOptions,
+		await oxfmtInstalled(),
+		snapshot.generator
+	], () => generateDatabaseTypes(snapshot.generator, typegenOptions));
+	const metaFiles = metaPaths(config.output);
+	const main = emitModule(model, {
+		databaseTypesImport: importPath(output, resolve(config.root, config.databaseTypesOutput)),
+		importPathFor: (from) => importPath(output, resolve(config.root, from)),
+		metaImport: `./${basename(metaFiles.js)}`,
+		...options.inlineMeta ? { inlineMeta: true } : {},
+		...runtime
+	});
+	const meta = emitMeta(model, {
+		types: `./${basename(metaFiles.dts)}`,
+		...runtime
+	});
+	const files = [
+		{
+			path: config.databaseTypesOutput,
+			contents: databaseTypes
+		},
+		{
+			path: config.output,
+			contents: main
+		},
+		{
+			path: metaFiles.js,
+			contents: meta.js
+		},
+		{
+			path: metaFiles.dts,
+			contents: meta.dts
+		}
+	];
+	const blockConfig = emitBlockConfig(config, runtime);
+	if (blockConfig) files.push(blockConfig);
+	if (config.generateFeatures) {
+		const frameworks = options.frameworks ?? (await detectProject(config.root)).frameworks;
+		files.push(...emitFeatures(config, frameworks), ...emitNavigation(config));
+	}
+	const owners = new Map(files.map((file) => [resolve(config.root, file.path), "gen"]));
+	let view;
+	for (const generator of config.generators) {
+		let extra;
+		try {
+			extra = await generator.generate({
+				meta: model.meta,
+				introspection: model.introspection,
+				extras: snapshot.extras,
+				config,
+				output,
+				importPath: (from, to) => importPath(resolve(config.root, from), resolve(config.root, to)),
+				model: view ??= generatorModel(model, generatorBlocks(config)),
+				...runtime
+			});
+		} catch (cause) {
+			throw new CliError("generator_failed", `generator "${generator.name}" failed: ${errorText(cause)}`, { cause });
+		}
+		for (const file of extra) {
+			const path = resolve(config.root, file.path);
+			const inside = relative(config.root, path);
+			if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new CliError("generator_failed", `generator "${generator.name}" wrote ${file.path}, which is outside the project root`);
+			const owner = owners.get(path);
+			if (owner !== void 0) throw new CliError("generator_failed", `generator "${generator.name}" wrote ${file.path}, which ${owner === "gen" ? "better-supabase gen writes" : `generator "${owner}" also writes`}`);
+			owners.set(path, generator.name);
+			files.push(file);
+		}
+	}
+	return {
+		files,
+		warnings: model.warnings,
+		notices: model.notices
+	};
+}
+//#endregion
+//#region src/cli/doctor/advisor-rules.ts
+/**
+* One request per advisor category, shared by the advisor rules and the rules
+* that defer to them.
+*/
+const fetched = /* @__PURE__ */ new WeakMap();
+function lintsOf(advisors, category) {
+	let byCategory = fetched.get(advisors);
+	if (!byCategory) {
+		byCategory = /* @__PURE__ */ new Map();
+		fetched.set(advisors, byCategory);
+	}
+	let lints = byCategory.get(category);
+	if (!lints) {
+		lints = advisors.lints(category);
+		byCategory.set(category, lints);
+	}
+	return lints;
+}
+const ADVISOR_SEVERITY = {
+	ERROR: "error",
+	WARN: "warning",
+	INFO: "info"
+};
+function lintObject(lint) {
+	const { schema, name, type } = lint.metadata ?? {};
+	if (typeof schema !== "string" || typeof name !== "string") return;
+	if (type === "table" || type === "view") return {
+		kind: "table",
+		schema,
+		name
+	};
+	if (type === "function") return {
+		kind: "function",
+		schema,
+		name
+	};
+}
+function lintFinding(lint) {
+	const object = lintObject(lint);
+	return {
+		severity: ADVISOR_SEVERITY[lint.level] ?? "warning",
+		title: lint.title,
+		message: `${lint.detail.replaceAll("\\`", "`")} [${lint.name}]`,
+		target: object ? `${object.schema}.${object.name}` : lint.cache_key,
+		help: lint.remediation,
+		...object ? { object } : {}
+	};
+}
+/**
+* A rule that reports one category of Supabase's advisors (splinter) as
+* findings.
+*/
+function advisorRule(code, category, title, description) {
+	return {
+		code,
+		severity: "warning",
+		title,
+		description,
+		async check(context) {
+			const { advisors } = context;
+			if (!advisors) return [];
+			if ("skipped" in advisors) return [{
+				severity: "info",
+				message: `Skipped the ${category} advisor: ${advisors.skipped}`
+			}];
+			try {
+				return (await lintsOf(advisors, category)).map(lintFinding);
+			} catch (cause) {
+				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${errorText(cause)}` }];
+			}
+		}
+	};
+}
+/** The performance advisor rule the duplicate rules defer to. */
+const PERFORMANCE_ADVISOR = "BS200";
+/**
+* The tables splinter reports `lint` for (`schema.table`), when the performance
+* advisor runs in this run and its lints loaded. A rule that repeats the lint
+* (BS207, BS216) drops its findings for these tables; with `undefined` (no
+* advisors, a saved snapshot, an advisor error, or BS200 not in the run) it
+* reports them itself.
+*/
+async function splinterTables(context, lint) {
+	const { advisors } = context;
+	if (!advisors || "skipped" in advisors) return;
+	if (!context.codes?.includes(PERFORMANCE_ADVISOR)) return;
+	let lints;
+	try {
+		lints = await lintsOf(advisors, "performance");
+	} catch {
+		return;
+	}
+	return new Set(lints.flatMap((entry) => {
+		if (entry.name !== lint) return [];
+		const object = lintObject(entry);
+		return object ? [`${object.schema}.${object.name}`] : [];
+	}));
+}
+//#endregion
+//#region src/cli/doctor/rls.ts
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** `'it''s'` and other string literals, blanked so their text can't match. */
+const withoutStrings = (text) => text.replaceAll(/'(?:[^']|'')*'/g, "''");
+const functionName = (fn) => `${fn.schema}.${fn.name}`;
+const functionObject = (fn) => ({
+	kind: "function",
+	schema: fn.schema,
+	name: fn.name
+});
+/** The functions policies call, by `schema.name`; overloads share a key. */
+function functionsByName(context) {
+	const map = /* @__PURE__ */ new Map();
+	for (const fn of context.snapshot.extras.functions ?? []) {
+		const key = functionName(fn);
+		const list = map.get(key);
+		if (list) list.push(fn);
+		else map.set(key, [fn]);
+	}
+	return map;
+}
+/** Argument lists of every call to `schema.name(...)` in an expression. */
+function callArguments(expression, fn) {
+	if (!expression) return [];
+	const text = withoutStrings(expression);
+	const pattern = new RegExp(`(?<![\\w."])(?:"?${escape(fn.schema)}"?\\.)?"?${escape(fn.name)}"?\\s*\\(`, "g");
+	const calls = [];
+	for (const match of text.matchAll(pattern)) {
+		const start = match.index + match[0].length;
+		let depth = 1;
+		let end = start;
+		while (end < text.length && depth > 0) {
+			if (text[end] === "(") depth += 1;
+			else if (text[end] === ")") depth -= 1;
+			end += 1;
+		}
+		calls.push(text.slice(start, end - 1));
+	}
+	return calls;
+}
+/**
+* The first column of `table` an argument list refers to, bare or as
+* `table.column`.
+*/
+function columnArgument(args, table) {
+	return table.columns.find((column) => new RegExp(`(?<![\\w."$:])(?:"?${escape(table.name)}"?\\.)?"?${escape(column.name)}"?(?![\\w"(.$])`).test(args))?.name;
+}
+const expressions = (policy) => [policy.using, policy.check];
+/**
+* Why Postgres can't inline `fn` into the query that calls it, or `undefined`
+* when it can: only `language sql` functions that are not volatile, not
+* security definer and have no `set` options are inlined.
+*/
+function notInlinable(fn) {
+	if (fn.language !== "sql") return `a ${fn.language} function`;
+	if (fn.volatility === "volatile") return "a volatile function";
+	if (fn.securityDefiner) return "a security definer function";
+	const settings = Object.keys(fn.settings);
+	if (settings.length > 0) return `a function with \`set ${settings.join(", ")}\``;
+}
+const rlsTables$1 = (context) => exposed(context).filter((table) => table.rls);
+const COMMANDS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+/** Policies apply to every role when they list `public` or none. */
+const appliesTo = (policy, role) => policy.roles.length === 0 || policy.roles.includes("public") || policy.roles.includes(role);
+/** Commands and roles that more than one permissive policy of the table covers. */
+function permissiveOverlaps(table) {
+	const permissive = table.policies.filter((policy) => policy.permissive);
+	const roles = /* @__PURE__ */ new Set();
+	for (const policy of permissive) {
+		const named = policy.roles.filter((role) => role !== "public");
+		if (named.length < policy.roles.length || policy.roles.length === 0) {
+			roles.add("anon");
+			roles.add("authenticated");
+		}
+		for (const role of named) roles.add(role);
+	}
+	const overlaps = [];
+	for (const command of COMMANDS) for (const role of [...roles].toSorted()) {
+		const policies = permissive.filter((policy) => (policy.command === "all" || policy.command === command) && appliesTo(policy, role)).map((policy) => policy.name);
+		if (policies.length > 1) overlaps.push({
+			command,
+			role,
+			policies
+		});
+	}
+	return overlaps;
+}
+const WRITES = ["insert", "update"];
+const API_ROLES = ["anon", "authenticated"];
+const NOT_ALIAS = /* @__PURE__ */ new Set([
+	"where",
+	"join",
+	"inner",
+	"left",
+	"right",
+	"full",
+	"cross",
+	"on",
+	"using",
+	"group",
+	"order",
+	"limit",
+	"union",
+	"natural",
+	"lateral",
+	"as"
+]);
+/**
+* The body of `schema.name` from the snapshot, else from the first SQL file
+* that creates it.
+*/
+function functionBody(context, schema, name) {
+	const introspected = context.snapshot.generator.functions.find((fn) => fn.schema === schema && fn.name === name && fn.definition)?.definition;
+	if (introspected) return introspected;
+	const creates = new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+(?:"?${escape(schema)}"?\\.)?"?${escape(name)}"?\\s*\\([\\s\\S]*?\\bas\\s+(\\$\\w*\\$)([\\s\\S]*?)\\1`, "i");
+	for (const file of context.sqlFiles ?? []) {
+		const match = creates.exec(file.text);
+		if (match) return match[2];
+	}
+}
+const helpersByContext = /* @__PURE__ */ new WeakMap();
+/** The functions policies call, and the functions those call, with their bodies. */
+function policyHelpers(context) {
+	let helpers = helpersByContext.get(context);
+	if (!helpers) {
+		helpers = findPolicyHelpers(context);
+		helpersByContext.set(context, helpers);
+	}
+	return helpers;
+}
+function findPolicyHelpers(context) {
+	const known = context.snapshot.generator.functions;
+	const queue = catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? []));
+	const bodies = /* @__PURE__ */ new Map();
+	while (queue.length > 0) {
+		const key = queue.pop();
+		if (bodies.has(key)) continue;
+		const dot = key.indexOf(".");
+		const body = functionBody(context, key.slice(0, dot), key.slice(dot + 1));
+		if (!body) continue;
+		const text = withoutStrings(body);
+		bodies.set(key, text);
+		for (const fn of known) {
+			const called = `${fn.schema}.${fn.name}`;
+			if (!bodies.has(called) && callArguments(text, fn).length > 0) queue.push(called);
+		}
+	}
+	return bodies;
+}
+/**
+* Tables a function body reads (`from` and `join`), with the names it refers to
+* them by.
+*/
+function readTables(body, tables) {
+	const found = /* @__PURE__ */ new Map();
+	for (const match of body.matchAll(/\b(?:from|join)\s+(?:"?(\w+)"?\s*\.\s*)?"?(\w+)"?(?:\s+(?:as\s+)?"?(\w+)"?)?/gi)) {
+		const [, schema, name, alias] = match;
+		const table = tables.find((t) => t.name === name && t.schema === schema) ?? (schema ? void 0 : tables.find((t) => t.name === name && t.schema === "public") ?? tables.find((t) => t.name === name));
+		if (!table) continue;
+		const names = found.get(table) ?? /* @__PURE__ */ new Set([table.name]);
+		if (alias && !NOT_ALIAS.has(alias.toLowerCase())) names.add(alias);
+		found.set(table, names);
+	}
+	return [...found].map(([table, names]) => ({
+		table,
+		names: [...names]
+	}));
+}
+/**
+* Columns that decide who may read other rows, by `schema.table`: the columns
+* of the tables policy helpers read that their bodies mention (qualified, or
+* bare when the body reads one table), and the manifest's `decidingColumns`. A
+* subject's `deletedAt` column and a module's `hidingColumns` only hide rows,
+* so they count only when the manifest lists them.
+*/
+function grantColumns(context) {
+	const tables = catalogOf(context).tables;
+	const columns = /* @__PURE__ */ new Map();
+	const entry = (table, column) => {
+		const byColumn = columns.get(table) ?? /* @__PURE__ */ new Map();
+		columns.set(table, byColumn);
+		const existing = byColumn.get(column);
+		if (existing) return existing;
+		const created = {
+			helpers: /* @__PURE__ */ new Set(),
+			provider: false
+		};
+		byColumn.set(column, created);
+		return created;
+	};
+	const softDeleted = /* @__PURE__ */ new Set([...Object.values(context.config.subjects).flatMap((subject) => subject.deletedAt === void 0 ? [] : [`${subject.table.includes(".") ? subject.table : `public.${subject.table}`}.${subject.deletedAt}`]), ...context.config.blockNames.length > 0 ? moduleHidingColumns(context.config.blockNames, moduleLayout(context.config)) : []]);
+	for (const [helper, body] of policyHelpers(context)) {
+		const read = readTables(body, tables);
+		for (const { table, names } of read) for (const column of table.columns) {
+			if (softDeleted.has(`${qualified(table)}.${column.name}`)) continue;
+			const col = `"?${escape(column.name)}"?(?![\\w"(])`;
+			const qualifiedColumn = new RegExp(`(?<![\\w"])(?:${names.map((name) => `"?${escape(name)}"?`).join("|")})\\s*\\.\\s*${col}`, "i");
+			const bare = new RegExp(`(?<![\\w."])${col}`, "i");
+			if (qualifiedColumn.test(body) || read.length === 1 && bare.test(body)) entry(qualified(table), column.name).helpers.add(helper);
+		}
+	}
+	for (const deciding of context.config.authorization?.decidingColumns ?? []) {
+		const dot = deciding.lastIndexOf(".");
+		if (dot > 0) entry(deciding.slice(0, dot), deciding.slice(dot + 1)).provider = true;
+	}
+	return columns;
+}
+/**
+* Whether `role` may run `command` on rows of `table` at all: no RLS, or a
+* permissive policy for it.
+*/
+const policyAllows = (table, command, role) => !table.rls || table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+/**
+* Whether `grant` reaches `role`: granted to it, or to PUBLIC, which every role
+* inherits.
+*/
+const grantsTo = (grant, role) => grant.role === role || grant.role === "PUBLIC";
+/**
+* Whether every call of `name` (`schema.function`) in `expressions` takes no
+* arguments inside `(select ...)`, which Postgres runs once per statement. An
+* argument may come from the row, and then it runs per row.
+*/
+function onlyWrapped(name, expressions) {
+	const dot = name.indexOf(".");
+	const call = `"?${escape(name.slice(0, dot))}"?\\s*\\.\\s*"?${escape(name.slice(dot + 1))}"?\\s*\\(`;
+	const any = new RegExp(`(?<![\\w."])${call}`, "gi");
+	const wrapped = new RegExp(`\\(\\s*select\\s+${call}\\s*\\)`, "gi");
+	let calls = 0;
+	let wraps = 0;
+	for (const expression of expressions) if (expression) {
+		calls += expression.match(any)?.length ?? 0;
+		wraps += expression.match(wrapped)?.length ?? 0;
+	}
+	return calls > 0 && calls === wraps;
+}
+/**
+* Whether every permissive policy that lets `role` run `command` holds `column`
+* to a tenant the caller acts in, with no `or` around it: equal to
+* `current_tenant_id()`, passed to `can('tenant', column, ...)`, or in `(select
+* tenant_ids_with(...))` or `(select member_<tenant>_ids())`. A write can't
+* name a tenant the caller isn't in then. The guest branch `ctx.scope.guest`
+* adds (`or (column, ...) in (select g.tenant ... portal_subjects(...) g)`)
+* pins it to a tenant the caller is a guest of, so it doesn't count as an
+* `or`.
+*/
+function pinnedToTenant(table, column, command, role) {
+	if (!table.rls) return false;
+	const col = `"?${escape(column)}"?`;
+	const pin = new RegExp([
+		`(?<![\\w."])${col}\\s*=\\s*\\(?\\s*(?:select\\s+)?better_supabase\\.current_tenant_id\\(\\)`,
+		`better_supabase\\.can\\(\\s*'tenant'(?:::text)?\\s*,\\s*${col}\\s*,`,
+		`(?<![\\w."])${col}\\s+in\\s+\\(\\s*select\\s+better_supabase\\.(?:tenant_ids_with|member_\\w+_ids)\\(`
+	].join("|"), "i");
+	const guest = new RegExp(`\\bor\\s+\\(*\\(?${col}\\)?(?:::text)?\\s*,(?:[^()]|\\([^()]*\\))*\\)\\s+in\\s+\\(\\s*select\\s+g\\.tenant\\b[^()]*from\\s+better_supabase\\.portal_(?:subjects|parties)\\([^()]*\\)\\s+g(?:\\([^()]*\\))?\\)`, "gi");
+	const applying = table.policies.filter((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+	return applying.length > 0 && applying.every((policy) => {
+		const check = (policy.check ?? policy.using)?.replaceAll(guest, "");
+		return check !== void 0 && !/\bor\b/i.test(check) && pin.test(check);
+	});
+}
+/**
+* The grant columns `role` may write with `command`, through a table-level or a
+* column-level grant. A single-column primary key is left out (its uniqueness
+* stops a write from taking over another row), and so is a column every policy
+* pins to the request's tenant, unless the provider lists it in `deciding`.
+*/
+function writableColumns(table, columns, command, role, deciding = /* @__PURE__ */ new Set()) {
+	if (!policyAllows(table, command, role)) return [];
+	const privilege = command.toUpperCase();
+	const tableLevel = table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege));
+	const risky = columns.filter((column) => deciding.has(column) || !(table.primaryKey.length === 1 && table.primaryKey[0] === column) && !pinnedToTenant(table, column, command, role));
+	if (tableLevel) return risky;
+	return risky.filter((column) => (table.columnGrants ?? []).some((grant) => grantsTo(grant, role) && grant.column === column && grant.privileges.includes(privilege)));
+}
+/** PostgREST's default for `db-hoisted-tx-settings`. */
+const DEFAULT_HOISTED = [
+	"statement_timeout",
+	"plan_filter.statement_cost_limit",
+	"default_transaction_isolation"
+];
+const TIMEOUT_ROLES = [
+	"anon",
+	"authenticated",
+	"authenticator"
+];
+/**
+* Partitions of an RLS table that have RLS off: queried by name, they skip the
+* parent's policies.
+*/
+function partitionsWithoutRls(context) {
+	const tables = catalogOf(context).tables;
+	const byName = new Map(tables.map((table) => [qualified(table), table]));
+	return tables.flatMap((table) => {
+		if (table.partitionOf === void 0 || table.rls || !context.config.schemas.includes(table.schema)) return [];
+		if (!byName.get(table.partitionOf)?.rls) return [];
+		return [{
+			message: `${qualified(table)} is a partition of ${table.partitionOf}, which has RLS on, but RLS is off on the partition. A query that names the partition skips the parent's policies, and Data API roles with a grant on it read every row. Run \`alter table ${qualified(table)} enable row level security;\`, and add the same enable to the code that creates new partitions.`,
+			target: qualified(table),
+			object: tableObject(table)
+		}];
+	});
+}
+const RLS_RULES = [
+	{
+		code: "BS343",
+		severity: "error",
+		title: "Partition without row level security",
+		description: "A table in `schemas` is a partition of a table with RLS on, but has RLS off itself. Policies belong to the parent, so a query that names the partition (`select * from events_default`) never applies them. This includes the default partition. Enable RLS on every partition when you create it; the partition functions of the SQL modules (`ensure_partitions`, ADR 0038) already do.",
+		check: partitionsWithoutRls
+	},
+	{
+		code: "BS205",
+		severity: "warning",
+		title: "Policy calls a slow function once per row",
+		description: "A policy passes a column of the row to a function Postgres cannot inline: plpgsql, volatile, security definer, or with a `set` option such as `search_path`. It runs once for every row the query reads.",
+		check: (context) => {
+			const functions = functionsByName(context);
+			return rlsTables$1(context).flatMap((table) => table.policies.flatMap((policy) => {
+				for (const name of policy.functions ?? []) {
+					const slow = functions.get(name)?.find((fn) => notInlinable(fn) !== void 0);
+					if (!slow) continue;
+					const column = expressions(policy).flatMap((expression) => callArguments(expression, slow)).map((args) => columnArgument(args, table)).find((found) => found !== void 0);
+					if (!column) continue;
+					const fix = slow.securityDefiner || Object.keys(slow.settings).length > 0 ? "" : `, or make it \`language sql stable\` so Postgres inlines it`;
+					return [{
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${name}(${column}), ${notInlinable(slow)}, with a column of the row, so it runs once per row. Have a helper return the allowed values once and compare: \`${column} in (select <helper>())\`${fix}.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}];
+				}
+				return [];
+			}));
+		}
+	},
+	{
+		code: "BS206",
+		severity: "warning",
+		title: "Security definer policy helper that cannot be inlined",
+		description: "A security definer function is used in many policies. Postgres never inlines a security definer function, so a call that takes a column of the row runs once per row. Wrapped in `(select ...)`, or returning a set the policy compares with `in (select ...)`, it runs once per statement.",
+		check: (context) => {
+			const limit = context.config.doctor.policyHelperLimit;
+			const functions = functionsByName(context);
+			const uses = /* @__PURE__ */ new Map();
+			for (const table of rlsTables$1(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
+				if (onlyWrapped(name, [policy.using, policy.check])) continue;
+				const list = uses.get(name) ?? [];
+				list.push(`${qualified(table)}.${policy.name}`);
+				uses.set(name, list);
+			}
+			return [...uses].flatMap(([name, policies]) => {
+				if (policies.length <= limit) return [];
+				const fn = functions.get(name)?.find((candidate) => candidate.securityDefiner);
+				if (!fn) return [];
+				const shown = policies.slice(0, 5).join(", ");
+				const more = policies.length > 5 ? ` and ${policies.length - 5} more` : "";
+				return [{
+					message: `${name} is a security definer ${fn.language} function used in ${policies.length} policies (${shown}${more}; the limit is ${limit}). Postgres can't inline it, so call it as \`(select ${name}(...))\` when its arguments don't come from the row, or return the allowed ids as a set and compare with \`column in (select ${name}())\`, so it runs once per statement.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS207",
+		severity: "warning",
+		title: "Several permissive policies for one command and role",
+		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. When the performance advisor (BS200) runs, splinter's `multiple_permissive_policies` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "multiple_permissive_policies");
+			return rlsTables$1(context).flatMap((table) => {
+				if (splinter?.has(qualified(table))) return [];
+				const overlaps = permissiveOverlaps(table);
+				if (overlaps.length === 0) return [];
+				const first = table.policies.find((policy) => policy.name === overlaps[0].policies[0]);
+				const list = overlaps.map((overlap) => `${overlap.command} for ${overlap.role}: ${overlap.policies.join(", ")}`).join("; ");
+				return [{
+					message: `${qualified(table)} has several permissive policies per command and role (${list}). Postgres runs all of them for every row; merge each group into one policy.`,
+					target: qualified(table),
+					object: policyObject(table, first)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS213",
+		severity: "warning",
+		title: "API roles can write the columns that grant access",
+		description: "RLS helpers decide access from columns such as `memberships.user_id`, `memberships.role` or `contacts.customer_id`, and an authorization provider lists them as `decidingColumns`. When `anon` or `authenticated` may insert or update one of them, and a policy lets them write the row, a user can grant themselves access. A table-level grant counts even after a column-level revoke. A single-column primary key, a tenant column every write policy pins to a tenant the caller acts in (`current_tenant_id()`, `can('tenant', column, ...)`, `tenant_ids_with(...)` or the membership helper `member_organization_ids()`, alone or next to a guest's grant from `portal_subjects()`), a subject's `deletedAt` column in `config.subjects` and a block's soft-delete column (they only hide rows) don't count unless the provider lists them.",
+		check: (context) => {
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			return [...grantColumns(context)].flatMap(([name, byColumn]) => {
+				const table = tables.get(name);
+				if (!table) return [];
+				const columns = table.columns.map((column) => column.name).filter((column) => byColumn.has(column)).toSorted();
+				const deciding = new Set(columns.filter((column) => byColumn.get(column).provider));
+				const writes = [];
+				const fix = [];
+				for (const role of API_ROLES) {
+					const tableLevel = [];
+					const revoked = /* @__PURE__ */ new Set();
+					for (const command of WRITES) {
+						const writable = writableColumns(table, columns, command, role, deciding);
+						if (writable.length === 0) continue;
+						writes.push(`${role} may ${command} ${writable.join(", ")}`);
+						const privilege = command.toUpperCase();
+						if (table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege))) {
+							tableLevel.push(command);
+							for (const column of writable) revoked.add(column);
+							continue;
+						}
+						const fromPublic = (table.columnGrants ?? []).some((grant) => grant.role === "PUBLIC" && writable.includes(grant.column) && grant.privileges.includes(privilege));
+						fix.push(`revoke ${command} (${writable.join(", ")}) on ${name} from ${fromPublic ? `${role}, public` : role};`);
+					}
+					if (tableLevel.length === 0) continue;
+					const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && tableLevel.some((command) => grant.privileges.includes(command.toUpperCase())));
+					fix.push(`revoke ${tableLevel.join(", ")} on ${name} from ${fromPublic ? `${role}, public` : role};`);
+					const rest = table.columns.map((column) => column.name).filter((column) => !revoked.has(column));
+					if (rest.length > 0) fix.push(`grant ${tableLevel.map((command) => `${command} (${rest.join(", ")})`).join(", ")} on ${name} to ${role};`);
+				}
+				if (writes.length === 0) return [];
+				const helpers = [...new Set(columns.flatMap((column) => [...byColumn.get(column).helpers]))].toSorted();
+				const listed = [...deciding];
+				const readers = [...helpers.length > 0 ? [`${helpers.join(", ")} read${helpers.length === 1 ? "s" : ""} them to decide access`] : [], ...listed.length > 0 ? [`the authorization provider lists ${listed.join(", ")} as deciding columns`] : []].join(", and ");
+				return [{
+					message: `${name}: ${writes.join("; ")}. ${readers}, so a user who writes them can grant themselves access. Revoke the columns and grant the rest:\n${fix.join("\n")}`,
+					target: name,
+					object: tableObject(table)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS211",
+		severity: "info",
+		title: "Statement timeouts for the Data API roles",
+		description: "PostgREST switches to `anon` or `authenticated` for each request, so their `statement_timeout` limits Data API queries. A function's own `set statement_timeout` only applies when PostgREST hoists it (`pgrst.db_hoisted_tx_settings`). `idle_in_transaction_session_timeout` ends sessions that leave a transaction open; it applies to the role a connection logs in as.",
+		check: (context) => {
+			const settings = context.snapshot.extras.roleSettings;
+			if (!settings) return [];
+			const values = (setting) => TIMEOUT_ROLES.map((role) => `${role} ${settings[role]?.[setting] ?? "not set"}`).join(", ");
+			const findings = [{
+				message: `statement_timeout: ${values("statement_timeout")}. idle_in_transaction_session_timeout: ${values("idle_in_transaction_session_timeout")}. Unset roles use the database default.`,
+				target: "roles:statement_timeout"
+			}];
+			const configured = settings["authenticator"]?.["pgrst.db_hoisted_tx_settings"];
+			if ((configured ? configured.split(",").map((setting) => setting.trim()) : DEFAULT_HOISTED).includes("statement_timeout")) return findings;
+			for (const fn of context.snapshot.extras.functions ?? []) {
+				const timeout = fn.settings["statement_timeout"];
+				if (!timeout || !context.config.schemas.includes(fn.schema)) continue;
+				findings.push({
+					severity: "warning",
+					message: `${functionName(fn)}(${fn.signature}) sets statement_timeout = ${timeout}, but pgrst.db_hoisted_tx_settings (${configured}) leaves it out, so the setting doesn't limit the RPC. Add statement_timeout to it, or set the timeout on the role.`,
+					target: `${functionName(fn)}:statement_timeout`,
+					object: functionObject(fn)
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS224",
+		severity: "warning",
+		title: "Data API role without a timeout",
+		description: "Without `statement_timeout`, one slow Data API query holds a connection until it finishes; without `idle_in_transaction_session_timeout`, a client that leaves a transaction open holds its locks. PostgREST applies the settings of `anon` and `authenticated` to each request, and the login role's (`authenticator`) apply when the request role sets none, so doctor accepts either. A value of 0 turns the timeout off and counts as unset.",
+		check: (context) => {
+			const settings = context.snapshot.extras.roleSettings;
+			if (!settings) return [];
+			const value = (role, setting) => {
+				const set = settings[role]?.[setting];
+				return set === void 0 || /^0(?:\s*m?s)?$/i.test(set.trim()) ? void 0 : set;
+			};
+			const example = {
+				statement_timeout: "'8s'",
+				idle_in_transaction_session_timeout: "'60s'"
+			};
+			return ["anon", "authenticated"].flatMap((role) => Object.keys(example).filter((setting) => value(role, setting) === void 0 && value("authenticator", setting) === void 0).map((setting) => ({
+				message: `${role} has no ${setting}, and authenticator sets none either, so a Data API request as ${role} has no limit. Run \`alter role ${role} set ${setting} = ${example[setting]};\` in a migration, then \`notify pgrst, 'reload config';\`.`,
+				target: `${role}:${setting}`
+			})));
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/authorization.ts
+const TEMPLATE_EFFECT = {
+	memberIds: "their membership checks read the tenant module's memberships table instead of the provider",
+	idsWithFor: "their checks of another user's tenant permissions (can_user, member_can) raise 0A000 (ACCESS_CALLER_ONLY) or are skipped",
+	isPlatformFor: "their checks of another user's platform permissions (platform_can) answer false or are skipped",
+	canAssignFor: "better_supabase.can_assign_as is not written and the inviter's right to assign the role is not checked again when the invitation is accepted"
+};
+/** The optional templates installed modules call that the provider doesn't set. */
+function missingTemplates(context, provider) {
+	const installed = new Set(context.config.blockNames);
+	const callers = /* @__PURE__ */ new Map();
+	for (const module of Object.values(SQL_MODULES)) {
+		if (!installed.has(module.name)) continue;
+		for (const name of module.providerFunctions ?? []) {
+			if (provider.functions[name] !== void 0) continue;
+			if (name === "canAssignFor" && context.config.blocks.access?.functions?.canAssignFor) continue;
+			callers.set(name, [...callers.get(name) ?? [], module.name]);
+		}
+	}
+	return [...callers].map(([name, modules]) => ({
+		severity: "warning",
+		message: `The ${modules.join(", ")} ${modules.length > 1 ? "modules call" : "module calls"} authorization.functions.${name}, which ${providerLabel(provider)} doesn't set, so under the provider model ${TEMPLATE_EFFECT[name] ?? "those calls fail"}. Use a provider that sets ${name}${name === "canAssignFor" ? ", or set blocks.access.functions.canAssignFor" : ""}.`,
+		target: `authorization.functions.${name}`
+	}));
+}
+/**
+* Tables whose generated policies call the provider's functions by role and
+* scope only.
+*/
+const SUPPORT_SESSION_APPROVAL = "support-session";
+const POLICY_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
+const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
+const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
+const escapeRegExp = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+/**
+* A pattern for a filled template: `{permission}` captures the key literal
+* (optionally passed by name), `{scope}` captures the scope name, and
+* whitespace may differ.
+*/
+function templatePattern(template) {
+	const source = template.split(/(\{\w+\})/).map((part) => {
+		if (part === "{permission}") return String.raw`(?:\w+\s*=>\s*)?'((?:[^']|'')*)'`;
+		if (part === "{scope}") return "([a-z][a-z0-9_]*)";
+		if (/^\{\w+\}$/.test(part)) return String.raw`[\s\S]*?`;
+		return escapeRegExp(part.trim()).replaceAll(/\s+/g, String.raw`\s*`);
+	}).filter((part) => part !== "").join(String.raw`\s*`);
+	return new RegExp(source, "gi");
+}
+/**
+* The keys and scopes a policy body passes to the provider's `idsWith` and
+* `isPlatform`.
+*/
+function providerCalls(provider, body) {
+	const calls = [];
+	const { idsWith, isPlatform } = provider.functions;
+	const groups = (template) => [...template.matchAll(/\{(permission|scope)\}/g)].map((match) => match[1]);
+	const idsGroups = groups(idsWith);
+	for (const match of body.matchAll(templatePattern(idsWith))) {
+		const key = match[idsGroups.indexOf("permission") + 1];
+		if (key === void 0) continue;
+		const scopeIndex = idsGroups.indexOf("scope");
+		calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: scopeIndex === -1 ? provider.tenantScope : match[scopeIndex + 1]
+		});
+	}
+	const platformGroups = groups(isPlatform);
+	for (const match of body.matchAll(templatePattern(isPlatform))) {
+		const key = match[platformGroups.indexOf("permission") + 1];
+		if (key !== void 0) calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: "platform"
+		});
+	}
+	return calls;
+}
+/**
+* Policies better-supabase generates (`bs_` names) on `storage.objects` and
+* `realtime.messages` that call the provider's templates, with the keys they
+* pass. The first file that declares a policy wins, matching the `sqlFiles`
+* order (declarative schemas, then the newest migration).
+*/
+function providerPolicies(provider, files) {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	for (const file of files) for (const match of file.text.matchAll(POLICY)) {
+		const name = unquote(match[1]);
+		const table = match[2].split(".").map((part) => unquote(part.trim())).join(".");
+		if (!POLICY_TABLES.has(table) || !name.startsWith("bs_")) continue;
+		const id = `${table}.${name}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const calls = providerCalls(provider, match[3]);
+		if (calls.length === 0) continue;
+		found.push({
+			name,
+			table,
+			calls,
+			file: file.path,
+			line: file.text.slice(0, match.index).split("\n").length
+		});
+	}
+	return found;
+}
+/**
+* `buckets` entries whose access policy reaches the provider's functions:
+* through `sql` templates, or through the access contract under the `provider`
+* model. Their keys and scope (the tenant scope for `tenant`).
+*/
+function providerBucketKeys(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	const providerModel = config.blocks.access?.model === "provider";
+	return Object.entries(config.buckets).flatMap(([bucket, entry]) => {
+		const policy = entry.policy;
+		if (policy === void 0 || typeof policy === "string") return [];
+		if (policy.sql === void 0 && !providerModel) return [];
+		const scope = policy.scope ?? "tenant";
+		return [{
+			bucket,
+			keys: [...new Set(Object.values(policy.access).filter((key) => typeof key === "string"))],
+			scope: scope === "tenant" ? provider.tenantScope : scope
+		}];
+	});
+}
+/**
+* Why a policy's scope can't work with the provider: a scope it doesn't
+* declare, or a key it grants only at other scopes.
+*/
+function placementProblems(provider, call, where) {
+	if (call.scope === "platform") return [];
+	const label = providerLabel(provider);
+	if (!provider.scopes.some((scope) => scope.name === call.scope)) return [`${where} uses scope "${call.scope}", which ${label} doesn't declare. Use one of ${provider.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`];
+	const declared = provider.permissions?.find((permission) => permission.key === call.key)?.scopes;
+	if (!declared || declared.length === 0 || declared.includes(call.scope)) return [];
+	return [`${where} checks "${call.key}" at scope "${call.scope}", but ${label} grants it at ${declared.map((scope) => `"${scope}"`).join(", ")}, so its SQL functions never grant it there. Use scope "${declared[0]}".`];
+}
+/**
+* The provider's memberships for the `entitlements` SQL module, when that mode
+* is valid.
+*/
+function entitlementsModule(context) {
+	const mode = entitlementsMode(context.config);
+	return mode.kind === "provider" ? mode.provider : void 0;
+}
+/**
+* The provider for the `provider` access model, when `blocks` installs
+* `access`.
+*/
+function accessModule(context) {
+	if (!resolveModules(context.config.blockNames, {}).some((module) => module.name === "access")) return { kind: "off" };
+	return accessProviderMode(context.config);
+}
+/**
+* Checks a function a template calls against `authorization.requires` and the
+* database: listed, executable by `role`, and present when the snapshot read
+* its schema. `undefined` when it passes.
+*/
+function requirementProblem(context, provider, requirement, caller) {
+	const label = providerLabel(provider);
+	const listed = (provider.requires ?? []).filter((entry) => entry.function === requirement.function);
+	if (provider.requires !== void 0 && listed.length === 0) return { message: `${caller} calls ${requirement.function}, but ${label} doesn't list it in authorization.requires. Use a provider version that lists every function its templates call.` };
+	if (listed.length > 0 && !listed.some((entry) => entry.role === requirement.role)) return { message: `${label} says only ${listed.map((entry) => entry.role).join(", ")} may execute ${requirement.function}, but ${caller} calls it as ${requirement.role}. Grant it execute to ${requirement.role} through the provider.` };
+	const schema = requirement.function.slice(0, requirement.function.indexOf("."));
+	if (!context.snapshot.schemas.includes(schema)) return;
+	return catalogOf(context).functions.some((fn) => `${fn.schema}.${fn.name}` === requirement.function) ? void 0 : { message: `${requirement.function} is not in the database, but ${caller} calls it. Apply the provider's migration before the SQL modules.` };
+}
+const AUTHORIZATION_RULES = [
+	{
+		code: "BS214",
+		severity: "error",
+		title: "Permission the provider's SQL functions don't fully answer in a Storage or Realtime policy",
+		description: "An access policy on a bucket or topic that reaches the authorization provider's functions (through `sql` templates, or through the access contract under the `provider` model) decides by role and scope only. A permission whose `authorization.permissions` entry isn't `sqlComplete: true` would grant every object or topic in the scope, so it is reported, and so is a key the provider doesn't list or every key when it lists no permissions. A scope the provider doesn't declare, and a key checked at another scope than its entry's `scopes`, are reported too. Doctor reads the keys from `buckets` in the config and from the generated `bs_` policies on `storage.objects` and `realtime.messages`. It also warns when a bucket's `sql` templates differ from the provider's `idsWith` and `isPlatform`, since a copy goes stale when the provider changes; `sql: \"provider\"` renders them at `gen` time instead.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const findings = [];
+			for (const { bucket, keys, scope } of providerBucketKeys(context.config)) for (const key of keys) {
+				for (const message of placementProblems(provider, {
+					key,
+					scope
+				}, `buckets.${bucket} ("${key}")`)) findings.push({
+					message,
+					target: `buckets.${bucket}:${key}`
+				});
+				const problem = unsafeKey(provider, key);
+				if (!problem) continue;
+				findings.push({
+					message: `buckets.${bucket} uses "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
+					target: `buckets.${bucket}:${key}`
+				});
+			}
+			for (const [bucket, entry] of Object.entries(context.config.buckets)) {
+				const sql = typeof entry.policy === "object" ? entry.policy.sql : void 0;
+				if (typeof sql !== "object") continue;
+				const stale = ["idsWith", "isPlatform"].filter((name) => sql[name] !== provider.functions[name]);
+				if (stale.length === 0) continue;
+				findings.push({
+					severity: "warning",
+					message: `buckets.${bucket} copies sql templates that differ from ${providerLabel(provider)}'s ${stale.join(" and ")}. Set sql: "provider" so gen renders the provider's templates.`,
+					target: `buckets.${bucket}.policy.sql`
+				});
+			}
+			for (const policy of providerPolicies(provider, context.sqlFiles ?? [])) {
+				const seen = /* @__PURE__ */ new Set();
+				for (const call of policy.calls) for (const message of placementProblems(provider, call, `Policy "${policy.name}" on ${policy.table}`)) {
+					if (seen.has(message)) continue;
+					seen.add(message);
+					findings.push({
+						message,
+						target: `${policy.table}.${policy.name}:${call.key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+				for (const key of new Set(policy.calls.map((call) => call.key))) {
+					const problem = unsafeKey(provider, key);
+					if (!problem) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to the provider's SQL functions, but it ${problem.reason}. ${problem.fix}`,
+						target: `${policy.table}.${policy.name}:${key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS408",
+		severity: "warning",
+		title: "The entitlements module can't read the provider's memberships",
+		description: "With `entitlements.memberships: 'provider'` (the default with `authorization`), the `entitlements` SQL module reads memberships through the provider's `memberIds` template (in `has_entitlement`, as `authenticated`) and `memberIdsFor` (in `feature_claims`, which the provider's hook calls as `supabase_auth_admin`). Doctor warns when the provider can't back that mode (no tenant scope, an id type the module doesn't render, no `memberIds` or `memberIdsFor`), when its hook doesn't fill `claims.features` from `better_supabase.feature_claims` (unless `entitlements.claim` is `false`), when no membership table covers the tenant scope, and when a function those templates call is missing from `authorization.requires`, not executable by that role, or not in the database.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("entitlements")) return [];
+			const mode = entitlementsMode(context.config);
+			if (mode.kind === "tenant") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "entitlements.memberships"
+			}];
+			const provider = context.config.authorization;
+			const label = providerLabel(provider);
+			const findings = [];
+			const features = context.config.claims.features;
+			const hook = provider.tokenHook;
+			if (hook && context.config.entitlements.claim !== false) {
+				const claims = hook.registeredClaims ?? [];
+				const featureClaim = claims.find((claim) => claim.name === features);
+				if (featureClaim?.function !== "better_supabase.feature_claims") {
+					const registered = claims.find((claim) => claim.function === "better_supabase.feature_claims");
+					findings.push({
+						message: registered ? `The hook of ${label} fills the "${registered.name}" claim from better_supabase.feature_claims, but claims.features is "${features}", so hasEntitlement() never finds the plan features. Set claims.features to "${registered.name}".` : featureClaim ? `The hook of ${label} fills the "${features}" claim from ${featureClaim.function}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point the provider's "${features}" claim at better_supabase.feature_claims.` : `The hook of ${label} has no "${features}" claim, so it never writes the plan features hasEntitlement() reads. Have it fill "${features}" from better_supabase.feature_claims, or set \`entitlements.claim: false\` to keep the features out of the token and check them in SQL with has_entitlement.`,
+						target: `claims.${features}`
+					});
+				}
+			}
+			const scope = mode.provider.scope;
+			if (provider.memberships === void 0) findings.push({
+				severity: "info",
+				message: `${label} lists no authorization.memberships, so entitlement_members() can't tell which tables hold "${scope}" memberships and plan changes never invalidate sessions.`,
+				target: "authorization.memberships"
+			});
+			else if (mode.provider.memberships.length === 0) findings.push({
+				message: `${label} maps no membership table to scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a membership table for "${scope}" to the provider.`,
+				target: "authorization.memberships"
+			});
+			for (const requirement of entitlementRequirements(mode.provider)) {
+				const problem = requirementProblem(context, provider, requirement, requirement.caller);
+				if (!problem) continue;
+				findings.push({
+					...requirement.kind === "member-for" && problem.message.includes("may execute") ? { severity: "info" } : {},
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS409",
+		severity: "warning",
+		title: "The authorization provider and the better-supabase config disagree",
+		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `claims.tenant` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `claims.scope` is neither `tenant` nor the provider's tenant scope, notes when the provider sets `suspension` or `roleSources` but `blocks.access.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const label = providerLabel(provider);
+			const findings = (provider.problems ?? []).map((problem) => ({
+				message: `${label}: ${problem}`,
+				target: "authorization"
+			}));
+			const tenantClaim = provider.tokenHook?.tenantClaim;
+			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
+				message: `The hook of ${label} writes the active tenant to "${tenantClaim}", but claims.tenant is "${context.config.claims.tenant}". Set claims.tenant to "${tenantClaim}", or change the provider's tenant claim.`,
+				target: "claims.tenant"
+			});
+			const scope = context.config.claims.scope;
+			if (scope !== "tenant" && scope !== provider.tenantScope) findings.push({
+				severity: "info",
+				message: `claims.scope is "${scope}", but the tenant scope of ${label} is "${provider.tenantScope}". The tenant module's membership claims then use another scope than the provider's. Set claims.scope to "${provider.tenantScope}" (or "tenant").`,
+				target: "claims.scope"
+			});
+			const model = context.config.blocks.access?.model ?? "roles";
+			const unread = [...provider.suspension ? ["suspension"] : [], ...provider.roleSources && provider.roleSources.length > 0 ? ["roleSources"] : []];
+			if (model !== "provider" && unread.length > 0) findings.push({
+				severity: "info",
+				message: `${label} sets ${unread.join(" and ")}, but blocks.access.model is "${model}", so the SQL modules ignore ${unread.length > 1 ? "them" : "it"}. Set blocks.access.model to "provider" to use them, or set blocks.access.disabled yourself.`,
+				target: `authorization.${unread[0]}`
+			});
+			return findings;
+		}
+	},
+	{
+		code: "BS411",
+		severity: "error",
+		title: "The provider access model can't use the authorization provider",
+		description: "With `blocks.access.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `blocks.access.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter).",
+		check: (context) => {
+			const mode = accessModule(context);
+			if (mode.kind === "off") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "authorization"
+			}];
+			const provider = context.config.authorization;
+			const findings = [];
+			for (const requirement of accessRequirements(mode.access)) {
+				const problem = requirementProblem(context, provider, requirement, "the provider access model (can() and the SQL modules)");
+				if (problem) findings.push({
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			findings.push(...moduleKeyProblems(provider, modulePermissionKeys(context.config.blocks, context.config.blockNames)));
+			if ((context.config.blocks.access?.functions?.canAssign ?? provider.functions.canAssign) === void 0) findings.push({
+				severity: "warning",
+				message: `Neither blocks.access.functions.canAssign nor ${providerLabel(provider)} sets canAssign, so under the provider model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes. Use a provider that sets authorization.functions.canAssign, or set blocks.access.functions.canAssign.`,
+				target: "blocks.access.functions.canAssign"
+			});
+			findings.push(...missingTemplates(context, provider));
+			return findings;
+		}
+	},
+	{
+		code: "BS413",
+		severity: "warning",
+		title: "Support sessions are not tied to the provider's read-only check",
+		description: "Support sessions default to read-only. Write functions refuse them through the built-in act check, or through authorization.functions.actorMayWrite when the provider sets it. With the provider access model, doctor warns when support is installed and actorMayWrite is missing, so the provider's helper is not the one the writes call.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("support-sessions")) return [];
+			if ((context.config.blocks.access?.model ?? "roles") !== "provider") return [];
+			const provider = context.config.authorization;
+			if (provider === void 0 || provider.functions.actorMayWrite !== void 0) return [];
+			return [{
+				message: `Support sessions are installed and blocks.access.model is "provider", but ${providerLabel(provider)} does not set authorization.functions.actorMayWrite. Writes use the built-in act check. Set actorMayWrite to the provider's read-only helper.`,
+				target: "authorization.functions.actorMayWrite"
+			}];
+		}
+	},
+	{
+		code: "BS414",
+		severity: "warning",
+		title: "Access contract answers from built-in roles next to a provider",
+		description: "With `authorization` set, `blocks.access.model` defaults to `provider`, so `better_supabase.can()` and `better_supabase.tenant_ids_with()` answer from the provider's templates. When the config sets another model, those functions answer from the built-in roles instead, which the provider never sees. Doctor reports each policy and each function in `schemas` that calls them, so a check that looks provider-backed is not silently role-backed.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const model = context.config.blocks.access?.model;
+			if (provider === void 0 || !context.config.blockNames.includes("access") || model === void 0 || model === "provider") return [];
+			const why = `blocks.access.model is "${model}", so it answers from the built-in roles, not ${providerLabel(provider)}. Remove the model to use the provider, or call the provider's function directly.`;
+			const findings = [];
+			for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+				const calls = contractCalls(`${policy.using ?? ""} ${policy.check ?? ""}`);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `Policy "${policy.name}" on ${qualified(table)} calls ${calls.join(" and ")}, but ${why}`,
+					target: `${qualified(table)}.${policy.name}`,
+					object: policyObject(table, policy)
+				});
+			}
+			for (const fn of context.snapshot.generator.functions) {
+				if (fn.schema === "better_supabase" || !context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				const calls = contractCalls(fn.definition);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `${fn.schema}.${fn.name} calls ${calls.join(" and ")}, but ${why}`,
+					target: `${fn.schema}.${fn.name}`
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS334",
+		severity: "info",
+		title: "A policy checks a role name instead of a permission",
+		description: "`member_organization_ids()`, `has_organization_role()` and `organization_member_role()` answer by role name. Under an authorization provider they take membership from its `memberIds`, but a role list in the policy still names roles the provider may not have. `better_supabase.tenant_ids_with('<permission>')` and `member_can()` check a permission, so they follow renames, the provider and the delegation cap. Doctor reports each app policy and each function in `schemas` that calls a role helper.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("tenant")) return [];
+			const findings = [];
+			const advice = "check a permission with better_supabase.tenant_ids_with('<permission>') or member_can() instead, so it follows the provider and the delegation cap.";
+			for (const table of catalogOf(context).tables) {
+				if (table.schema === "better_supabase") continue;
+				for (const policy of table.policies) {
+					if (policy.name.startsWith("bs_")) continue;
+					const calls = roleHelperCalls(`${policy.using ?? ""} ${policy.check ?? ""}`);
+					if (calls.length === 0) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${calls.join(" and ")}; ${advice}`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					});
+				}
+			}
+			for (const fn of context.snapshot.generator.functions) {
+				if (fn.schema === "better_supabase" || !context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				const calls = roleHelperCalls(fn.definition);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `${fn.schema}.${fn.name} calls ${calls.join(" and ")}; ${advice}`,
+					target: `${fn.schema}.${fn.name}`
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS415",
+		severity: "warning",
+		title: "The provider sets the deprecated canApprove template",
+		description: "`authorization.functions.isApprover` replaces `canApprove`: one eligibility check for tool calls, support sessions and the app's own approvals, with `{kind}` and `{subject}` instead of `{tool}`. 0.9 still reads `canApprove` when `isApprover` is unset, and drops it in a later minor release.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (provider?.functions.canApprove === void 0) return [];
+			return [{
+				message: `${providerLabel(provider)} sets authorization.functions.canApprove, which is deprecated. Set isApprover with {kind}, {subject} and {tenant}; {kind} is 'ai-tool' and {subject} the tool name for AI tool calls.`,
+				target: "authorization.functions.canApprove"
+			}];
+		}
+	},
+	{
+		code: "BS416",
+		severity: "warning",
+		title: "isApprover has no branch for support sessions",
+		description: "With the provider access model, the `support-sessions` module asks `authorization.functions.isApprover` who may approve a support request, with `{kind}` set to `'support-session'`, instead of its built-in platform check. A template that only handles `'ai-tool'` answers false, so no admin can approve a support request and every start that needs a second admin stays pending. Doctor warns when the template, and every function it calls, never names `support-session`.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const support = context.config.blocks["support-sessions"];
+			const isApprover = provider?.functions.isApprover;
+			if (provider === void 0 || isApprover === void 0 || !context.config.blockNames.includes("support-sessions") || (context.config.blocks.access?.model ?? "roles") !== "provider" || support?.options?.["approval"] === "none") return [];
+			if (isApprover.includes(SUPPORT_SESSION_APPROVAL)) return [];
+			const called = new Set(templateCalls(isApprover));
+			if (context.snapshot.generator.functions.some((fn) => called.has(`${fn.schema}.${fn.name}`.toLowerCase()) && fn.definition.includes(SUPPORT_SESSION_APPROVAL))) return [];
+			return [{
+				message: `Support sessions are installed, but ${providerLabel(provider)}'s isApprover template never handles {kind} = '${SUPPORT_SESSION_APPROVAL}', so it answers false and no admin can approve a support request. Add a '${SUPPORT_SESSION_APPROVAL}' branch (for example platform staff with the support permission), or set blocks["support-sessions"].options.approval to "none".`,
+				target: "authorization.functions.isApprover"
+			}];
+		}
+	},
+	{
+		code: "BS417",
+		severity: "warning",
+		title: "The provider declares teams but sets no teamIdsOf template",
+		description: "With the provider access model, `team_ids_of()` and the team sharing in `saved-views` and `collections` call `authorization.functions.teamIdsOf` for a caller's teams. Without it, `team_ids_of()` reads the teams block's own `team_members`, which a provider that keeps its own teams never fills, and `saved-views` and `collections` without the teams block share with no team. Doctor warns when the provider declares a `team` scope, one of those blocks is installed, and the template is unset.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (provider === void 0 || provider.functions.teamIdsOf !== void 0 || (context.config.blocks.access?.model ?? "roles") !== "provider" || !provider.scopes.some((scope) => TEAM_SCOPE.test(scope.name))) return [];
+			const sharing = TEAM_BLOCKS.filter((name) => context.config.blockNames.includes(name));
+			if (sharing.length === 0) return [];
+			return [{
+				message: `${providerLabel(provider)} declares a team scope, but sets no authorization.functions.teamIdsOf, so ${sharing.join(", ")} can't see its teams. Set teamIdsOf to a set-returning call with {user}, for example "provider.team_ids_of({user})".`,
+				target: "authorization.functions.teamIdsOf"
+			}];
+		}
+	}
+];
+const TEAM_SCOPE = /^teams?$/;
+const TEAM_BLOCKS = [
+	"teams",
+	"saved-views",
+	"collections"
+];
+const TEMPLATE_CALL = /\b("?[a-z_][a-z0-9_$]*"?)\s*\.\s*("?[a-z_][a-z0-9_$]*"?)\s*\(/gi;
+/** The `schema.function` names a template calls, lowercased and unquoted. */
+function templateCalls(template) {
+	return [...withoutStrings(template).matchAll(TEMPLATE_CALL)].map((match) => `${match[1]}.${match[2]}`.replaceAll("\"", "").toLowerCase());
+}
+const CONTRACT_CALL = /\bbetter_supabase"?\s*\.\s*"?(can|tenant_ids_with)"?\s*\(/gi;
+const ROLE_HELPER_CALL = /\bbetter_supabase"?\s*\.\s*"?(member_organization_ids|has_organization_role|organization_member_role)"?\s*\(/gi;
+/** The tenant role helpers `text` calls, outside string literals. */
+function roleHelperCalls(text) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of withoutStrings(text).matchAll(ROLE_HELPER_CALL)) names.add(`better_supabase.${match[1].toLowerCase()}()`);
+	return [...names].toSorted();
+}
+/** The access contract functions `text` calls, outside string literals. */
+function contractCalls(text) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of withoutStrings(text).matchAll(CONTRACT_CALL)) names.add(`better_supabase.${match[1].toLowerCase()}()`);
+	return [...names].toSorted();
+}
+//#endregion
+//#region src/cli/gen/manifest.ts
+/**
+* The files the last `gen` wrote, so the next one can remove those it no longer
+* writes.
+*/
+const MANIFEST = `${CACHE_DIR}/gen-manifest.json`;
+const manifestPath = (root, path) => relative(root, resolve(root, path)).split(sep).join("/");
+async function readManifest(root) {
+	const parsed = await readFile(resolve(root, MANIFEST), "utf-8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1 || !("files" in parsed) || !Array.isArray(parsed.files)) return [];
+	return parsed.files.filter((path) => typeof path === "string");
+}
+/**
+* Files in the last manifest that this run doesn't generate and that still
+* exist inside the root.
+*/
+async function leftoverFiles(root, generated) {
+	const current = new Set(generated);
+	return (await readManifest(root)).filter((path) => {
+		const inside = relative(root, resolve(root, path));
+		return !current.has(path) && inside !== "" && !inside.startsWith("..") && !isAbsolute(inside) && existsSync(resolve(root, path));
+	});
+}
+const writeManifest = (root, files) => writeAtomic(resolve(root, MANIFEST), `${JSON.stringify({
+	version: 1,
+	files: files.toSorted()
+}, null, 2)}\n`).catch(() => void 0);
+//#endregion
+//#region src/cli/introspect/from-metadata.ts
+/**
+* What the extras query set reads that a `GeneratorMetadata` document leaves
+* out.
+*/
+const METADATA_GAPS = [
+	"multi-column unique keys and checks",
+	"foreign key actions",
+	"indexes",
+	"triggers",
+	"policies",
+	"grants",
+	"storage buckets",
+	"the realtime publication"
+];
+/** `METADATA_GAPS` as one phrase for notices. */
+const METADATA_GAPS_TEXT = `${METADATA_GAPS.slice(0, -1).join(", ")} or ${METADATA_GAPS.at(-1) ?? ""}`;
+/**
+* Builds a snapshot from a `GeneratorMetadata` document alone, for `gen
+* --metadata`. Relations come from `relationships`, single-column unique keys
+* from `is_unique` and single-column checks from `check`, named as Postgres
+* names them by default (`<table>_<column>_key`, `<table>_<column>_check`).
+* Everything else the extras carry is empty, and `extras.fromMetadata` says
+* so.
+*/
+function fromMetadata(document) {
+	const { metadata } = stabilizeMetadata(document);
+	const tableIds = new Set(metadata.tables.map((table) => table.id));
+	const tables = [
+		...metadata.tables,
+		...metadata.foreignTables,
+		...metadata.views,
+		...metadata.materializedViews
+	].map((relation) => {
+		const columns = metadata.columns.filter((column) => column.table_id === relation.id).toSorted((a, b) => a.ordinal_position - b.ordinal_position);
+		const own = tableIds.has(relation.id);
+		return {
+			id: relation.id,
+			schema: relation.schema,
+			name: relation.name,
+			primaryKey: [],
+			uniques: own ? columns.filter((column) => column.is_unique).map((column) => ({
+				name: `${relation.name}_${column.name}_key`,
+				columns: [column.name]
+			})) : [],
+			foreignKeys: own ? metadata.relationships.filter((fk) => fk.schema === relation.schema && fk.relation === relation.name).map((fk) => ({
+				name: fk.foreign_key_name,
+				onDelete: "no action",
+				onUpdate: "no action"
+			})).toSorted((a, b) => byCodePoint(a.name, b.name)) : [],
+			checks: own ? columns.flatMap((column) => column.check === null ? [] : [{
+				name: `${relation.name}_${column.name}_check`,
+				definition: `CHECK ((${column.check}))`
+			}]) : [],
+			indexes: [],
+			policies: [],
+			triggers: [],
+			grants: []
+		};
+	});
+	return {
+		version: 2,
+		schemas: [...new Set(metadata.schemas.map((schema) => schema.name))].toSorted(byCodePoint),
+		generator: metadata,
+		extras: {
+			tables,
+			buckets: [],
+			realtime: [],
+			fromMetadata: true
+		}
+	};
+}
+//#endregion
+//#region src/cli/gen/notices.ts
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt. @supabase/postgrest-typegen pins oxfmt 0.66.0 as its peer; to allow a newer one, add it to peerDependencyRules.allowedVersions in pnpm-workspace.yaml, keyed \"@supabase/postgrest-typegen>oxfmt\".";
+const METADATA_ONLY = `Notice: the schema came from a GeneratorMetadata document, which has no ${METADATA_GAPS_TEXT}. Unique keys and checks cover single columns, relations have no onDelete, and columns a before-insert trigger fills stay required on insert. Run \`better-supabase gen\` against the database for the full model.`;
+/**
+* The formatter, typegen version and metadata-only notices, the model's notices
+* and the config warnings, one line each.
+*/
+async function generationNotices(snapshot, warnings, notices = []) {
+	const typegen = typegenVersionNotice(await typegenVersion());
+	return [
+		...await oxfmtInstalled() ? [] : [UNFORMATTED],
+		...typegen ? [typegen] : [],
+		...snapshot.extras.fromMetadata ? [METADATA_ONLY] : [],
+		...notices,
+		...warnings.map((warning) => `Warning: ${warning}`)
+	];
+}
+//#endregion
+//#region src/cli/gen/run.ts
+/** The `read-sets` SQL module file for `config.readSets`, if any are configured. */
+async function readSetFile(config) {
+	if (config.readSets.length === 0) return;
+	const readSets = await compiledReadSets(config);
+	const { appTables: _appTables, ...layout } = moduleLayout(config, config.sql.testsDir, readSets);
+	return renderModules(["read-sets"], layout)[0];
+}
+/**
+* `buckets` keys that reach the authorization provider's functions but aren't
+* marked `sqlComplete: true` in `authorization.permissions`, as error lines.
+*/
+function rowConditionedBuckets(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	return providerBucketKeys(config).flatMap(({ bucket, keys }) => keys.flatMap((key) => {
+		const problem = unsafeKey(provider, key);
+		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
+	}));
+}
+/**
+* The exit `gen` stops with when bucket keys aren't fully answered by the
+* provider's SQL functions.
+*/
+function refuseRowConditionedBuckets(config) {
+	const refused = rowConditionedBuckets(config);
+	return refused.length === 0 || !config.authorization ? void 0 : {
+		code: 1,
+		error: `The SQL functions of ${providerLabel(config.authorization)} decide by role and scope only, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
+	};
+}
+async function runGen(options) {
+	const { config } = options;
+	const refused = refuseRowConditionedBuckets(config);
+	if (refused) return refused;
+	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
+	const { files, warnings, notices } = await render(config, snapshot);
+	const migrations = !options.isolated && await writesMigrations(config);
+	const pathsOf = (readSets) => [...files, ...readSets && !migrations ? [readSets] : []].map((file) => manifestPath(config.root, file.path));
+	const notice = (await generationNotices(snapshot, warnings, notices)).map((line) => `\n${line}`).join("");
+	const readSetsOf = () => options.isolated ? Promise.resolve(void 0) : readSetFile(config);
+	const leftoversOf = (generated) => options.isolated ? Promise.resolve([]) : leftoverFiles(config.root, generated);
+	if (options.check) {
+		const readSets = await readSetsOf();
+		const generated = pathsOf(readSets);
+		const leftovers = await leftoversOf(generated);
+		const stale = [];
+		const diffs = [];
+		const compare = (file, current) => {
+			const shown = display(config.root, file.path);
+			stale.push(shown);
+			diffs.push(fileDiff(shown, current, file.contents, options.paint));
+		};
+		for (const file of files) {
+			const path = resolve(config.root, file.path);
+			const current = existsSync(path) ? await readFile(path, "utf-8") : void 0;
+			if (!sameText(current, file.contents)) compare(file, current);
+		}
+		if (readSets && migrations) {
+			const latest = await latestMigration(config, READ_SETS_SUFFIX);
+			if (!sameModuleMigration(latest?.text, readSets.contents)) compare({
+				path: latest?.path ?? `${migrationsDir(config)}/<stamp>_better_supabase_read_sets.sql`,
+				contents: readSets.contents
+			}, latest?.text);
+		} else if (readSets) {
+			const path = resolve(config.root, readSets.path);
+			const current = existsSync(path) ? await readFile(path, "utf-8") : void 0;
+			if (!sameModuleFile(current, readSets.contents)) compare(readSets, current);
+		}
+		if (stale.length > 0 || leftovers.length > 0) {
+			const lines = [...stale.map((path) => `  ${path}`), ...leftovers.map((path) => `  ${path} (no longer generated)`)];
+			return {
+				code: 1,
+				output: `${diffs.join("\n\n")}${notice}`,
+				error: `Generated files are out of date:\n${lines.join("\n")}\nRun \`better-supabase gen\`.`,
+				errorCode: "check_failed",
+				data: {
+					upToDate: false,
+					stale,
+					leftovers,
+					warnings
+				}
+			};
+		}
+		return {
+			code: 0,
+			output: `Generated files are up to date (${generated.length}).${notice}`,
+			data: {
+				upToDate: true,
+				stale: [],
+				leftovers: [],
+				warnings
+			}
+		};
+	}
+	const flags = {
+		"dry-run": options.dryRun,
+		force: options.force
+	};
+	const plan = (entries, remove = []) => ({
+		root: config.root,
+		regenerate: "better-supabase gen",
+		files: entries.map((file) => ({
+			path: file.path,
+			contents: file.contents
+		})),
+		remove
+	});
+	const changes = [...(await applyPlan(plan(files), flags)).changes];
+	const readSets = await readSetsOf();
+	if (readSets && migrations) {
+		const migration = await writeLatestMigration(config, READ_SETS_SUFFIX, readSets.contents, {
+			now: /* @__PURE__ */ new Date(),
+			dryRun: options.dryRun === true
+		});
+		changes.push({
+			file: migration.path,
+			outcome: migration.line.startsWith("Unchanged ") ? "unchanged" : "create"
+		});
+	}
+	const generated = pathsOf(readSets);
+	changes.push(...(await applyPlan(plan([], await leftoversOf(generated)), flags)).changes);
+	if (readSets && !migrations) {
+		const path = resolve(config.root, readSets.path);
+		changes.push(...(await applyPlan({
+			...plan([{
+				...readSets,
+				path
+			}]),
+			root: dirname(path),
+			base: config.root
+		}, flags)).changes);
+	}
+	const applied = {
+		mode: options.dryRun === true ? "dry-run" : "write",
+		changes,
+		diffs: [],
+		drift: false
+	};
+	const written = changedFiles(applied);
+	if (!options.isolated && options.dryRun !== true) await writeManifest(config.root, generated);
+	const tables = snapshot.extras.tables.filter((table) => config.schemas.includes(table.schema)).length;
+	const lines = changeLines(applied).filter((line) => !line.startsWith("Unchanged "));
+	return {
+		...hasConflicts(applied) ? {
+			code: 1,
+			errorCode: "file_conflict",
+			error: "Some generated files were written by hand, so gen left them alone. Pass --force to overwrite them."
+		} : { code: 0 },
+		output: `${lines.length === 0 ? `No changes (${tables} tables).` : `${lines.join("\n")}\n${options.dryRun === true ? "Would generate" : "Generated"} ${tables} tables.`}${notice}`,
+		data: {
+			tables,
+			written,
+			files: changes,
+			warnings
+		}
+	};
+}
+//#endregion
+export { emitBlockConfig as S, withoutStrings as _, METADATA_GAPS_TEXT as a, render as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, advisorRule as v, renderFiles as x, splinterTables as y };