better-supabase 0.13.0 → 0.15.0

package/dist/cli/doctor-DDrEM6S1.js

@@ -0,0 +1,4561 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { i as plain } from "./style-Bm2X5JrN.js";
+import { t as VERSION } from "./version-Du4CgONY.js";
+import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
+import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
+import { a as sameText, t as display } from "./io-DH1kcmmP.js";
+import { t as CACHE_DIR } from "./cache-CXgR_Ahi.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { C as satisfies, S as peerVersions, c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot, u as MetadataRejectedError } from "./snapshot-C8MVPyO8.js";
+import { d as configFor, r as renderFiles, u as notNullTag } from "./render-ucJmUyuM.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { i as request } from "./source-DANaJJVc.js";
+import { A as providerLabel, S as moduleLayoutFor, b as blockDeclaredTables, i as migrationHolds, o as migrationModules, r as latestMigration, t as MODULES_SUFFIX, x as migrationsDir, y as compiledReadSets } from "./module-migration-aPCckev6.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-9t5ec_N7.js";
+import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-CncmQbO0.js";
+import { t as PROCESS_ENV } from "./env-DMgjB_4y.js";
+import { n as readStackStatus } from "./stack-status-B_Ipd_-z.js";
+import { t as connect } from "./db-CQCLx7cx.js";
+import { a as hasContentMapper, c as supportsContentMappers, i as contentMapperSetup$1, n as TSCONFIG_SNIPPET, o as needsRunExternalCode, t as RUN_EXTERNAL_CODE } from "./content-mapper-DNs7lTu7.js";
+import { c as insideRoot, i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
+import { S as splinterTables, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as appTablesOf, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$2, v as BLOCK_PREFIX, x as advisorRule, y as blockTargets } from "./run-CvYVAztY.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-LZroULBe.js";
+import { o as wiringFor, r as configInstances, t as MIGRATION_SAFETY_RULES } from "./migration-safety-D7PhzFxm.js";
+import { t as orphanedBlockFiles } from "./orphans-BAboqyVM.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-iEeH15ck.js";
+import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
+import { i as PLUGIN_SUBPATH_RENAMES, n as BLOCK_SUBPATH_RENAMES, o as SPEC_SUBPATH_RENAMES, t as BLOCK_EXPORT_RENAMES } from "./codemod-block-renames-BuSaTE_G.js";
+import { n as PLATFORM_SCHEMAS } from "./in-stack-diff-DQTW53Vf.js";
+import { i as staleVariables, r as stackEnvValues, t as PREFIX_NAMES } from "./stack-env-6hS-WEmh.js";
+import { a as readSharedMemory, n as listStacks, t as branchName } from "./stacks-BYlQ96WS.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-DVx9Zgbj.js";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
+import { SECRET_COLUMNS, SQL_MODULES, TENANT_SCOPE_POLICY, adoptedTables, blockFileState, blockSqlVersion, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, hasColumnAccess, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, notNullCheckName, renderBlocks, sameBlockFile, sameTenantColumn, sameTenantTrigger, scopePolicyName, sharedRolesProblems, subjectColumns, widenedCommands } from "better-supabase/sql";
+import { defineBucket, parseSize } from "better-supabase/storage";
+//#region src/cli/doctor/env.ts
+const PUBLIC_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+function envEntries(file) {
+	return file.text.split("\n").flatMap((raw, index) => {
+		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+		if (!match) return [];
+		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+		return [{
+			key: match[1],
+			value,
+			line: index + 1
+		}];
+	});
+}
+const PREFIXES = [...new Set(Object.values(PREFIX_NAMES).filter((prefix) => prefix !== ""))];
+/**
+* The names `stackEnvValues` writes, with or without a browser prefix; not the
+* CLI's own `SUPABASE_BIN` or `SUPABASE_ACCESS_TOKEN`.
+*/
+const STACK_VARIABLE = /(?:^|_)SUPABASE_(?:URL|PUBLISHABLE_KEY|SECRET_KEY|JWKS_URL|DB_URL|JWT_SECRET)$/;
+const exportsStackVariable = (shell) => Object.entries(shell).some(([name, value]) => value !== void 0 && value !== "" && STACK_VARIABLE.test(name));
+/**
+* Reads the running stack only when the shell exports a `SUPABASE_*` variable,
+* so a doctor run without one never starts `supabase status`.
+*/
+async function loadStackEnvCheck(root, env, signal) {
+	const shell = env[PROCESS_ENV] ?? {};
+	if (!exportsStackVariable(shell)) return { skipped: "No SUPABASE_* variable is exported." };
+	try {
+		const result = await readStackStatus(root, env, { signal });
+		if (!result.ok) return { skipped: "The local stack is not running." };
+		const values = { ...stackEnvValues(result.status, "") };
+		if (values["SUPABASE_URL"] === void 0) return { skipped: "supabase status has no API_URL." };
+		for (const prefix of PREFIXES) {
+			values[`${prefix}SUPABASE_URL`] = values["SUPABASE_URL"];
+			if (values["SUPABASE_PUBLISHABLE_KEY"] !== void 0) values[`${prefix}SUPABASE_PUBLISHABLE_KEY`] = values["SUPABASE_PUBLISHABLE_KEY"];
+		}
+		return {
+			shell,
+			values
+		};
+	} catch (cause) {
+		return { skipped: errorText(cause) };
+	}
+}
+/** Checks on env files and the variables the shell exports (BS501 to BS503). */
+const ENV_RULES = [
+	{
+		code: "BS501",
+		severity: "error",
+		title: "Secret in a browser variable",
+		description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
+		check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
+			message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
+			target: `${file.path}:${entry.key}`,
+			location: {
+				file: file.path,
+				line: entry.line
+			}
+		})))
+	},
+	{
+		code: "BS502",
+		severity: "warning",
+		title: "Env file with secrets is not ignored by git",
+		description: "Env files holding a secret key or database password should never be committed.",
+		check: (context) => {
+			const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+			const ignored = (path) => patterns.some((pattern) => {
+				const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+				return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
+			});
+			return context.envFiles.flatMap((file) => {
+				const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
+				if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
+				return [{
+					message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
+					target: file.path,
+					location: {
+						file: file.path,
+						line: secret.line
+					}
+				}];
+			});
+		}
+	},
+	{
+		code: "BS503",
+		severity: "warning",
+		title: "Exported Supabase variable differs from the running stack",
+		description: "A SUPABASE_* variable exported in the shell has another value than the local stack, so the app talks to a stale stack (often another worktree's port). Values are redacted: host and port for URLs, a SHA-256 fingerprint for keys. Unset the variable, or start the app with `better-supabase dev run -- <cmd>`, which overrides it.",
+		check: ({ stackEnv }) => stackEnv === void 0 || "skipped" in stackEnv ? [] : staleVariables(stackEnv.shell, stackEnv.values).map((stale) => ({
+			target: stale.variable,
+			message: `${stale.message} Unset it or start the app with better-supabase dev run -- <cmd>.`
+		}))
+	}
+];
+//#endregion
+//#region src/cli/doctor/adoption.ts
+const tagText = (notNull) => notNull === true ? "@notNull" : `@notNull(${notNull.join(", ")})`;
+const sameNotNull = (a, b) => a === true || b === true ? a === b : a !== void 0 && a.length === b.length && a.every((name) => b.includes(name));
+/**
+* Checks for adopted schemas: config the SQL could carry, and references and
+* exports the modules leave open.
+*/
+const ADOPTION_RULES = [
+	{
+		code: "BS338",
+		severity: "info",
+		title: "gen.functions.notNull entry a comment tag could replace",
+		description: "`gen` reads `@notNull` and `@notNull(a, b)` from a function's comment. A `gen.functions.<name>.notNull` entry for a function in the read schemas can move to the comment, next to the SQL it describes. A config entry wins over the tag.",
+		check: (context) => {
+			const { config } = context;
+			return catalogOf(context).functions.flatMap((fn) => {
+				const notNull = configFor(config.functions, fn.schema, fn.name)?.notNull;
+				if (notNull === void 0 || !config.schemas.includes(fn.schema)) return [];
+				const name = `${fn.schema}.${fn.name}`;
+				const tag = notNullTag(fn.comment);
+				const wanted = tagText(notNull);
+				let message;
+				if (sameNotNull(tag, notNull)) message = `functions.${fn.name}.notNull matches the ${wanted} tag on ${name}(${fn.signature}). Remove the config entry.`;
+				else if (tag === void 0) message = `functions.${fn.name}.notNull can move to the function: add \`${wanted}\` to the comment on ${name}(${fn.signature}) (\`comment on function ${name}(${fn.signature}) is '${wanted}';\`), then remove the config entry.`;
+				else message = `functions.${fn.name}.notNull (${wanted}) differs from the ${tagText(tag)} tag on ${name}(${fn.signature}), and the config entry wins. Make them agree, then remove the config entry.`;
+				return [{
+					message,
+					target: `${name}(${fn.signature})`
+				}];
+			});
+		}
+	},
+	{
+		code: "BS339",
+		severity: "warning",
+		title: "expose excludes a column the table doesn't have",
+		description: "`upgrade` turns `select(*, -col)` in `expose` into the table's declared columns minus the excluded ones. An excluded column the table no longer has excludes nothing, and a renamed secret column is then granted under its new name. Remove the exclusion, or exclude the new name.",
+		check: (context) => {
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			return Object.entries(context.config.expose).flatMap(([key, roles]) => {
+				const table = tables.get(key.includes(".") ? key : `public.${key}`);
+				if (table === void 0) return [];
+				const columns = new Set(table.columns.map((column) => column.name));
+				return [...new Set([
+					...roles.anon,
+					...roles.authenticated,
+					...roles.serviceRole
+				].flatMap((privilege) => excludedColumns(privilege)).filter((column) => !columns.has(column)))].map((column) => ({
+					message: `expose.${key} excludes "${column}", which ${qualified(table)} doesn't have, so it excludes nothing. Remove "-${column}", or exclude the column's new name.`,
+					target: `${qualified(table)}.${column}`
+				}));
+			});
+		}
+	},
+	{
+		code: "BS340",
+		severity: "info",
+		title: "Tenant foreign key without a same-tenant trigger",
+		description: "A foreign key checks that the referenced row exists, not that it belongs to the row's tenant. Doctor lists each single-column key between two tables that both have the tenant column, when the key doesn't include that column and the table has no `bsb_same_tenant_<column>` trigger. List the reference in `blocks.memberships.options.sameTenant`, or set `sameTenant: { auto: true }` to derive every one from the schema files.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("memberships")) return [];
+			const tenant = sameTenantColumn(moduleLayout(context.config));
+			const { tables } = catalogOf(context);
+			const tenantTables = new Set(tables.filter((table) => table.columns.some((column) => column.name === tenant)).map(qualified));
+			return tables.filter((table) => context.config.schemas.includes(table.schema) && tenantTables.has(qualified(table))).flatMap((table) => {
+				const triggers = new Set(table.triggers.map((trigger) => trigger.name));
+				return table.foreignKeys.flatMap((key) => {
+					const [column] = key.columns;
+					if (column === void 0 || key.columns.length !== 1 || column === tenant || !tenantTables.has(`${key.refSchema}.${key.refTable}`) || triggers.has(sameTenantTrigger(column))) return [];
+					return [{
+						message: `${qualified(table)}.${column} references ${key.refSchema}.${key.refTable}, and both have ${tenant}, but no trigger checks that the referenced row has the same ${tenant}. Add it to blocks.memberships.options.sameTenant, or set sameTenant: { auto: true }.`,
+						target: `${qualified(table)}.${column}`
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS342",
+		severity: "error",
+		title: "Enum column of the app's that a module writes as text",
+		description: "A module writes a text parameter or computed text value into a column of the app's table that the snapshot declares as an enum; string literals are fine. Postgres has no implicit cast from text to an enum, so the module's functions fail when they run. Columns the module casts to their declared type, such as the tags `kind` and the numbering `entity`, may be enums.",
+		check: (context) => {
+			const { tables } = catalogOf(context);
+			const ownTables = Object.fromEntries(tables.map((table) => [qualified(table), "database"]));
+			return adoptedTables(context.config.blocks, ownTables).flatMap((adopted) => {
+				const table = tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+				if (table === void 0) return [];
+				return adopted.textColumns.flatMap((logical) => {
+					const name = adopted.columns[logical];
+					const column = table.columns.find((entry) => entry.name === name);
+					if (column?.isEnum !== true || column.isArray) return [];
+					const target = `${qualified(table)}.${column.name}`;
+					return [{
+						message: `blocks.${adopted.module} writes text into ${target} (${adopted.logical}.${logical}), which is the enum ${column.typeSchema}.${column.udt}. Postgres does not cast text to an enum, so the module's functions fail. Change the column to text with a check constraint on its values.`,
+						target
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS344",
+		severity: "warning",
+		title: "App webhook endpoints without a format",
+		description: "A `webhooks-out` endpoints table of the app's that maps no `format` column sends every endpoint in `blocks.webhooks-out.options.defaultFormat`. Its default changed from the 0.8 body (`standard`) to `cloudevents` in 0.9, so receivers built for the old body break without any change to the config. `upgrade` refuses this config; doctor reports it for configs it loads without that check. Set `defaultFormat` explicitly, or add a format column and map it in `columns.endpoints.format`.",
+		check: (context) => {
+			const block = context.config.blocks["webhooks-out"];
+			if (block === void 0 || block.options?.["defaultFormat"] !== void 0 || typeof block.columns?.["endpoints"]?.["format"] === "string") return [];
+			const adopted = adoptedTables(context.config.blocks, appTablesOf(context)).find((entry) => entry.module === "webhooks-out" && entry.logical === "endpoints");
+			if (adopted === void 0) return [];
+			const table = catalogOf(context).tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+			return [{
+				message: `${`${adopted.schema}.${adopted.table}`} ${table?.columns.some((column) => column.name === "format") ? "has a format column the config doesn't map" : "has no format column"}, so every endpoint gets blocks.webhooks-out.options.defaultFormat, which defaults to "cloudevents" since 0.9 ("standard" before). Set defaultFormat to the body your receivers expect, or map columns.endpoints.format.`,
+				target: "blocks.webhooks-out.options.defaultFormat"
+			}];
+		}
+	},
+	{
+		code: "BS341",
+		severity: "warning",
+		title: "Data export includes a column that looks like a secret",
+		description: "A data export writes every column of each table it reads, except the ones in `omit`. Doctor reports columns of the exported tables, including the ones `autoTables` finds, whose name matches `token`, `secret`, `_hash`, `password`, `api_key` or `license_key` and that no `omit` and no `omitPattern` leaves out. Add the column to the table's `omit`, keep the table out of exports with `export: false` or `autoTables.exclude`, or set `blocks.data-lifecycle.options.omitPattern`.",
+		check: (context) => {
+			const plan = dataExportPlan(moduleLayout(context.config), context.config.blockNames);
+			if (plan === void 0) return [];
+			const secret = new RegExp(SECRET_COLUMNS, "i");
+			const omitted = patternOf(plan.omitPattern);
+			const tables = catalogOf(context).tables;
+			const byName = new Map(tables.map((table) => [qualified(table), table]));
+			const exported = [...plan.tables.map((entry) => ({
+				table: byName.get(entry.name),
+				omit: entry.omit
+			})), ...autoExported(plan, tables)];
+			const findings = /* @__PURE__ */ new Map();
+			for (const { table, omit } of exported) {
+				if (table === void 0) continue;
+				for (const column of table.columns) {
+					const target = `${qualified(table)}.${column.name}`;
+					if (!secret.test(column.name) || omit.includes(column.name) || omitted?.test(column.name) === true || findings.has(target)) continue;
+					findings.set(target, {
+						message: `Data exports of ${qualified(table)} include ${column.name}, which looks like a secret. Add it to the table's omit, keep the table out of exports, or set blocks.data-lifecycle.options.omitPattern.`,
+						target
+					});
+				}
+			}
+			return [...findings.values()];
+		}
+	}
+];
+const NO_OMIT = [];
+/** The tables `autoTables` adds to exports, which omit nothing. */
+function autoExported(plan, tables) {
+	const { auto } = plan;
+	if (auto === void 0) return [];
+	return tables.filter((table) => auto.schemas.includes(table.schema) && !auto.excluded(qualified(table)) && table.columns.some((column) => auto.columns.includes(column.name))).map((table) => ({
+		table,
+		omit: NO_OMIT
+	}));
+}
+/** `omitPattern` as a JavaScript regex; undefined when off or not valid there. */
+function patternOf(pattern) {
+	if (pattern === void 0) return;
+	try {
+		return new RegExp(pattern, "i");
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/cli/doctor/app-table-scope.ts
+const SCHEMA = "public";
+const COMMANDS$1 = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+/**
+* The app tables whose table the app's own schema creates, so their entries
+* enrich it. Without `sqlFiles`, none.
+*/
+function enrichedAppTables(context) {
+	if (context.sqlFiles === void 0) return /* @__PURE__ */ new Set();
+	const created = blockDeclaredTables(context.sqlFiles, context.config.schemas);
+	return new Set(Object.keys(context.config.appTables).filter((name) => !created.has(`${SCHEMA}.${name}`)));
+}
+/** The app tables in `tenant` or `user` scope. */
+function scopedAppTables(context) {
+	const enriched = enrichedAppTables(context);
+	return Object.entries(context.config.appTables).flatMap(([name, config]) => {
+		const scope = config.scope === void 0 || config.scope === "inherit" ? context.config.sql.scope ?? "tenant" : config.scope;
+		if (scope === "none") return [];
+		return [{
+			name,
+			scope,
+			column: scope === "user" ? "user_id" : context.config.extensions.tenant?.column ?? "organization_id",
+			enriched: enriched.has(name)
+		}];
+	});
+}
+const WRITES = [
+	"INSERT",
+	"UPDATE",
+	"DELETE"
+];
+const ROW_PRIVILEGES = /* @__PURE__ */ new Set(["SELECT", ...WRITES]);
+/**
+* The grants an enriched app table holds beyond what its scope grants, for anon
+* and authenticated. Truncate, references and trigger are BS111's.
+*/
+function broaderGrants(context, name) {
+	const config = context.config.appTables[name];
+	const table = catalogOf(context).tables.find((entry) => entry.schema === SCHEMA && entry.name === name);
+	if (config === void 0 || table === void 0 || context.config.expose[`${SCHEMA}.${name}`] !== void 0 || context.config.expose[name] !== void 0) return {
+		grants: [],
+		columns: false
+	};
+	const scope = config.scope === void 0 || config.scope === "inherit" ? context.config.sql.scope ?? "tenant" : config.scope;
+	const columns = hasColumnAccess(config);
+	const allowed = /* @__PURE__ */ new Set([...columns ? [] : ["SELECT"], ...scope === "none" ? [] : columns ? ["DELETE"] : WRITES]);
+	return {
+		grants: table.grants.flatMap((grant) => grant.role === "anon" || grant.role === "authenticated" ? grant.privileges.filter((privilege) => ROW_PRIVILEGES.has(privilege) && (grant.role === "anon" || !allowed.has(privilege))).map((privilege) => `${privilege.toLowerCase()} to ${grant.role}`) : []),
+		columns
+	};
+}
+/** The `<table>_<column>_not_null` check an enriched table's scope column gets. */
+const scopeCheckName = (table) => notNullCheckName(`${ident$1(SCHEMA)}.${ident$1(table.name)}`, ident$1(table.column));
+const APP_TABLE_SCOPE_RULES = [{
+	code: "BS237",
+	severity: "warning",
+	title: "App table keeps permissive policies or grants of its own",
+	description: "An app table in `tenant` or `user` scope has permissive policies next to the ones its scope renders, usually the app's own policies on a table that a `tables.<name>` entry enriches. Postgres ORs permissive policies, so each one widens what the scope allows. In `tenant` scope the restrictive `bsb_tenant_scope` policy still keeps rows inside the member's tenants, so this is a hint (info) to check the roles and permissions those policies skip. In `user` scope, or without `bsb_tenant_scope`, nothing narrows them: a signed-in user reaches every row they allow. Drop the app's policies, or make them restrictive. Enriching never revokes the app's grants either, so the rule also lists the grants anon and authenticated hold on an enriched table beyond what its scope grants: a hint (info) while row level security filters the rows, and a warning when the entry restricts columns (`access` or `encrypted`), since a table-level grant reaches every column.",
+	check: (context) => {
+		const { tables } = catalogOf(context);
+		const grants = [...enrichedAppTables(context)].flatMap((name) => {
+			const broader = broaderGrants(context, name);
+			if (broader.grants.length === 0) return [];
+			const label = `${SCHEMA}.${name}`;
+			return [{
+				message: broader.columns ? `${label} keeps the app's table-level grants (${broader.grants.join(", ")}), which reach the columns tables.${name} restricts. Revoke them in the app's schema; the column grants stay.` : `${label} keeps the app's grants beyond its scope (${broader.grants.join(", ")}). Row level security still filters the rows; revoke them in the app's schema if nothing needs them.`,
+				...broader.columns ? {} : { severity: "info" },
+				target: label,
+				object: {
+					kind: "table",
+					schema: SCHEMA,
+					name
+				}
+			}];
+		});
+		return [...scopedAppTables(context).flatMap((app) => {
+			const table = tables.find((entry) => entry.schema === SCHEMA && entry.name === app.name);
+			if (table === void 0) return [];
+			const own = new Set(COMMANDS$1.map((command) => scopePolicyName({
+				name: app.name,
+				enrich: app.enriched
+			}, command)));
+			const extra = table.policies.filter((policy) => policy.permissive && !own.has(policy.name));
+			if (extra.length === 0) return [];
+			const narrowed = app.scope === "tenant" && table.policies.some((policy) => !policy.permissive && policy.name === TENANT_SCOPE_POLICY);
+			const names = extra.map((policy) => policy.name).join(", ");
+			const label = `${SCHEMA}.${app.name}`;
+			return [{
+				message: narrowed ? `${label} has permissive policies of its own (${names}). ${TENANT_SCOPE_POLICY} keeps rows inside the member's tenants, but within a tenant these widen what tables.${app.name} allows. Check that they need no role or permission.` : `${label} has permissive policies of its own (${names}), and nothing narrows them to the ${app.scope === "user" ? "signed-in user's rows" : "member's tenants"}. Drop them, or make them restrictive.`,
+				...narrowed ? { severity: "info" } : {},
+				target: label,
+				object: {
+					kind: "table",
+					schema: SCHEMA,
+					name: app.name
+				}
+			}];
+		}), ...grants];
+	}
+}, {
+	code: "BS238",
+	severity: "warning",
+	title: "Rows of an enriched app table without an owner",
+	description: "A `tables.<name>` entry enriched a table the app already has, and some of its rows have no value in the scope column (`organization_id`, or `user_id` in `user` scope). The scope's policies match no member or user for them, so nobody but the service role reads or writes those rows, and updates to them fail the scope column's `not valid` check. Fill the column with `better-supabase db backfill`, then `doctor --fix` validates the check (BS236). Needs a database; saved snapshots skip it.",
+	async check(context) {
+		const db = context.database;
+		if (!db || "skipped" in db) return [];
+		const { tables } = catalogOf(context);
+		const findings = [];
+		for (const app of scopedAppTables(context)) {
+			const table = tables.find((entry) => entry.schema === SCHEMA && entry.name === app.name);
+			if (!app.enriched || !table?.columns.some((column) => column.name === app.column)) continue;
+			const label = `${SCHEMA}.${app.name}`;
+			const object = {
+				kind: "table",
+				schema: SCHEMA,
+				name: app.name
+			};
+			let missing;
+			try {
+				const [row] = await db.query(`select count(*) as missing from ${ident$1(SCHEMA)}.${ident$1(app.name)} where ${ident$1(app.column)} is null`);
+				missing = Number(row?.missing ?? 0);
+			} catch (cause) {
+				findings.push({
+					message: `Could not count the rows of ${label} without ${app.column}: ${errorText(cause)}`,
+					target: `${label}.${app.column}`,
+					object
+				});
+				continue;
+			}
+			if (missing === 0) continue;
+			findings.push({
+				message: `${label} has ${missing} ${missing === 1 ? "row" : "rows"} without ${app.column}, which no ${app.scope === "user" ? "user" : "member"} reads or writes, and updates to them fail ${scopeCheckName(app)}. Fill it with \`better-supabase db backfill ${app.name}.${app.column} --from <table.column> via <column>\` (or --value), then run \`better-supabase doctor --fix\`.`,
+				target: `${label}.${app.column}`,
+				object
+			});
+		}
+		return findings;
+	}
+}];
+//#endregion
+//#region src/cli/doctor/cookies.ts
+const TOKENS_ONLY = /\bencode\s*:\s*["'`]tokens-only["'`]/;
+/**
+* Imports that create the browser client, which writes the session cookie in
+* the browser.
+*/
+const BROWSER_SIDE = /from\s+["']better-supabase\/client["']|\bcreateBrowserClient\s*\(/;
+/** Imports that read or refresh the session cookie on the server. */
+const SERVER_SIDE = /from\s+["']better-supabase\/(?:server|next|ssr|hono|orpc|edge|expo)["']|\bcreateServerClient\s*\(/;
+function cookieSide(file) {
+	const browser = BROWSER_SIDE.test(file.text);
+	if (browser === SERVER_SIDE.test(file.text)) return;
+	return browser ? "browser" : "server";
+}
+/**
+* Files on one side of the session cookie that set `encode: 'tokens-only'`
+* while files on the other side don't (BS412).
+*/
+function encodingDrift(context) {
+	const sides = context.sources.flatMap((file) => {
+		const side = cookieSide(file);
+		return side ? [{
+			file,
+			side,
+			tokensOnly: TOKENS_ONLY.test(file.text)
+		}] : [];
+	});
+	const tokensOnly = sides.filter((entry) => entry.tokensOnly);
+	if (tokensOnly.length === 0) return [];
+	const findings = [];
+	for (const side of ["browser", "server"]) {
+		const set = tokensOnly.find((entry) => entry.side === side);
+		if (!set) continue;
+		const other = side === "browser" ? "server" : "browser";
+		const unset = sides.filter((entry) => entry.side === other && !entry.tokensOnly);
+		if (unset.length === 0) continue;
+		const line = lineOf(set.file.text, TOKENS_ONLY) ?? 1;
+		findings.push({
+			message: `${set.file.path} writes the session cookie with \`encode: 'tokens-only'\`, but the ${other} side (${unset.map((entry) => entry.file.path).join(", ")}) uses the default \`user-and-tokens\`. Set the same \`encode\` on both sides.`,
+			target: `${set.file.path}:encode`,
+			location: {
+				file: set.file.path,
+				line
+			}
+		});
+	}
+	return findings;
+}
+const COOKIE_RULES = [{
+	code: "BS412",
+	severity: "info",
+	title: "Session cookie encoding differs between server and browser",
+	description: "`@supabase/ssr` needs the same `cookies.encode` on the server and in the browser client. With `tokens-only` on one side only, the other side writes the user object back into the cookie, or reads a session without one and `session.user` throws.",
+	check: encodingDrift
+}];
+//#endregion
+//#region src/cli/doctor/dependencies.ts
+function contentMapperSetup(context) {
+	const setup = context.contentMapper;
+	if (context.config.gen.contentMapper !== true || setup === void 0) return [];
+	const findings = [];
+	if (!hasContentMapper(setup.tsconfig)) findings.push({
+		message: `gen.contentMapper is on, but tsconfig.json doesn't list the content mapper, so schema.bsb has no types. Add ${TSCONFIG_SNIPPET} next to compilerOptions, or run \`better-supabase init --content-mapper\`.`,
+		target: "tsconfig.json"
+	});
+	if (setup.typescript === void 0 || !supportsContentMappers(setup.typescript)) findings.push({
+		message: `gen.contentMapper needs TypeScript 7.1 or later, but the project resolves ${setup.typescript === void 0 ? "no typescript" : `typescript@${setup.typescript}`}. Install typescript@7.1, or turn gen.contentMapper off and run \`better-supabase gen\` to write the files again.`,
+		target: "typescript"
+	});
+	if (setup.typecheck !== void 0 && needsRunExternalCode(setup.typecheck)) findings.push({
+		message: `The typecheck script runs tsc without ${RUN_EXTERNAL_CODE}, so tsc doesn't load the content mapper and every import of schema.bsb fails. Add ${RUN_EXTERNAL_CODE} to it.`,
+		target: "package.json"
+	});
+	return findings;
+}
+const DEPENDENCY_RULES = [{
+	code: "BS601",
+	severity: "warning",
+	title: "Peer outside its range",
+	description: "An optional peer of better-supabase is installed at a version outside the range better-supabase declares. With strict peer checks the install fails, and the subpath that needs the peer can break at runtime.",
+	check: (context) => (context.peers ?? []).flatMap((peer) => peer.installed !== void 0 && satisfies(peer.installed, peer.range) === false ? [{
+		message: `${peer.name}@${peer.installed} is installed, but better-supabase needs ${peer.range}. Install a version in that range, or remove ${peer.name} if nothing imports it.`,
+		target: peer.name
+	}] : [])
+}, {
+	code: "BS602",
+	severity: "error",
+	title: "Content mapper not set up",
+	description: "gen.contentMapper is on, but tsc can't load the content mapper: tsconfig.json has no contentMappers entry for better-supabase, the project resolves TypeScript older than 7.1, or the typecheck script runs tsc without --runExternalCode. Imports of schema.bsb then have no types.",
+	check: contentMapperSetup
+}];
+//#endregion
+//#region src/cli/doctor/flags.ts
+/** Flags past their `expires_at` extra column that aren't archived. */
+async function expiredFlags(context) {
+	const db = context.database;
+	if (!db || "skipped" in db) return [];
+	let query;
+	try {
+		query = expiredFlagsQuery(moduleLayout(context.config), context.config.blockNames);
+	} catch {
+		return [];
+	}
+	if (!query) return [];
+	let rows;
+	try {
+		rows = await db.query(query);
+	} catch {
+		return [];
+	}
+	return rows.map((row) => ({
+		message: `Flag "${row.key}" expired on ${row.expires_at}${row.owner ? ` (owner: ${row.owner})` : ""}. Remove its checks from the code, then archive it with \`flags.upsert("${row.key}", { archived: true })\`, or move \`expires_at\` when it stays.`,
+		target: `flags:${row.key}`
+	}));
+}
+const FLAG_RULES = [{
+	code: "BS336",
+	severity: "warning",
+	title: "Flag past its expiry",
+	description: "The flags table has an `expires_at` column (`blocks['flags'].options.extraColumns`), and a flag on the live database that isn't archived has an `expires_at` in the past. A release flag that outlives its rollout keeps a dead branch in the code. The finding names the `owner` column when the table has one.",
+	check: expiredFlags
+}];
+//#endregion
+//#region src/cli/doctor/hooks.ts
+/** Claims past this size make every request carry a large cookie and header. */
+const HOOK_CLAIMS_LIMIT = 2048;
+/**
+* The BS405 limits. With a provider hook budget, `doctor.claimsLimit` (else the
+* budget's bytes) limits its claims and the whole token keeps 2048; without
+* one, `doctor.claimsLimit` limits the whole token.
+*/
+function claimsLimits(context) {
+	const configured = context.config.doctor.claimsLimit;
+	const budget = providerHook(context)?.budget;
+	return budget ? {
+		token: HOOK_CLAIMS_LIMIT,
+		budget: {
+			bytes: configured ?? budget.bytes,
+			claims: budget.claims,
+			...budget.truncatedClaim ? { truncatedClaim: budget.truncatedClaim } : {}
+		}
+	} : { token: configured ?? HOOK_CLAIMS_LIMIT };
+}
+/** The module function that fills the `memberships` claim. */
+const MODULE_MEMBERSHIPS = /better_supabase\s*\.\s*membership_claims\b/i;
+const providerHook = (context) => context.config.authorization?.tokenHook;
+const splitName = (qualified) => {
+	const dot = qualified.indexOf(".");
+	return {
+		schema: qualified.slice(0, dot),
+		name: qualified.slice(dot + 1)
+	};
+};
+const escapeRegExp$2 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* The claims the provider's hook writes that a second writer would contradict,
+* with the tenant claim it writes to.
+*/
+function ownedClaims(hook) {
+	return [.../* @__PURE__ */ new Set([...hook.ownedClaims, ...hook.tenantClaim ? [hook.tenantClaim] : []])];
+}
+const quotedName = (schema, name) => `(?:"?${escapeRegExp$2(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$2(name)}"?`;
+const createsFunction = (fn) => new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${quotedName(fn.schema, fn.name)}\\s*\\(`, "i");
+/** The SQL file that has the provider's hook marker and creates `fn`. */
+function markerFileFor(context, fn) {
+	const marker = providerHook(context)?.markers?.hook;
+	if (marker === void 0) return;
+	const creates = createsFunction(fn);
+	return (context.sqlFiles ?? []).find((file) => file.text.includes(marker) && creates.test(file.text));
+}
+/** Whether `fn` is the provider's hook: by its name or its marker file. */
+function isProviderHook(context, fn) {
+	const hook = providerHook(context);
+	if (!hook) return false;
+	if (hook.function === `${fn.schema}.${fn.name}`) return true;
+	return markerFileFor(context, fn) !== void 0;
+}
+/** Whether the hook body calls the provider's hook (a wrapper around it). */
+function wrapsProviderHook(hook, source) {
+	const { schema, name } = splitName(hook.function);
+	return new RegExp(`${quotedName(schema, name)}\\s*\\(`, "i").test(source);
+}
+/**
+* Which of `claims` the hook body writes through `jsonb_set` or
+* `jsonb_build_object`.
+*/
+function writtenClaims(source, claims) {
+	return claims.filter((claim) => {
+		const name = escapeRegExp$2(claim);
+		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
+	});
+}
+const API_ROLES$1 = ["authenticated", "anon"];
+/** Hooks enabled in `config.toml`, matched with their introspected functions. */
+function configuredHooks(context) {
+	if (!context.configToml) return [];
+	const introspected = context.snapshot.extras.hooks ?? [];
+	return pgFunctionHooks(context.configToml.document).map((config) => ({
+		config,
+		extras: introspected.find((hook) => hook.hook === config.hook && hook.schema === config.schema && hook.name === config.name)
+	}));
+}
+function hookLocation(context, hook) {
+	if (!context.configToml) return;
+	const line = lineOf(context.configToml.text, new RegExp(`^\\s*\\[auth\\.hook\\.${hook}\\]`));
+	return line ? {
+		file: context.configToml.path,
+		line
+	} : void 0;
+}
+const signatureOf = (fn) => `${fn.schema}.${fn.name}(${fn.signature})`;
+/** What is wrong with who may call a hook function, and the SQL that fixes it. */
+function grantProblems(fn) {
+	const problems = [];
+	const fix = [];
+	if (!fn.schemaUsage.includes("supabase_auth_admin")) {
+		problems.push(`supabase_auth_admin has no usage on schema ${fn.schema}`);
+		fix.push(`grant usage on schema ${fn.schema} to supabase_auth_admin;`);
+	}
+	if (!fn.execute.includes("supabase_auth_admin")) {
+		problems.push("supabase_auth_admin may not execute it");
+		fix.push(`grant execute on function ${signatureOf(fn)} to supabase_auth_admin;`);
+	}
+	const exposedTo = API_ROLES$1.filter((role) => fn.execute.includes(role));
+	if (exposedTo.length > 0 || fn.publicExecute) {
+		const roles = [...exposedTo, ...fn.publicExecute ? ["public"] : []];
+		problems.push(`${roles.join(", ")} may execute it, so any client can call it through the API`);
+		fix.push(`revoke execute on function ${signatureOf(fn)} from authenticated, anon, public;`);
+	}
+	return {
+		problems,
+		fix
+	};
+}
+const MIGRATIONS = /(?:^|\/)supabase\/migrations\//;
+/**
+* The file that grants `fn` to `supabase_auth_admin`: a migration with the
+* provider's grants marker; under pg-delta, which carries grants, the
+* declarative schema file that defines `fn`; and without declarative schemas,
+* the migration that defines it. `supabase db diff` drops grants, so migra only
+* counts the marked migration.
+*/
+function grantsSourceFor(context, fn, workflow) {
+	const grants = new RegExp(`grant\\s+execute\\s+on\\s+function\\s+${quotedName(fn.schema, fn.name)}\\s*\\([^)]*\\)\\s*to\\s+[^;]*\\bsupabase_auth_admin\\b`, "i");
+	const creates = createsFunction(fn);
+	const marker = providerHook(context)?.markers?.grants;
+	return (context.sqlFiles ?? []).find((file) => grants.test(file.text) && (marker !== void 0 && file.text.includes(marker) || workflow === "pg-delta" && !MIGRATIONS.test(file.path) && creates.test(file.text) || workflow === "migrations" && MIGRATIONS.test(file.path) && creates.test(file.text)))?.path;
+}
+/**
+* Configured hook functions whose grants are wrong (BS404, `doctor
+* --fix-grants`).
+*/
+function hookGrantProblems(context) {
+	const workflow = workflowOf(context);
+	return configuredHooks(context).flatMap(({ config, extras }) => (extras?.functions ?? []).flatMap((fn) => {
+		const { problems, fix } = grantProblems(fn);
+		if (problems.length === 0) return [];
+		const file = grantsSourceFor(context, fn, workflow);
+		const provider = context.config.authorization;
+		const command = provider?.tokenHook?.grantsCommand;
+		return [{
+			hook: config.hook,
+			fn,
+			problems,
+			fix: file ? {
+				kind: "migration",
+				file
+			} : provider && isProviderHook(context, fn) ? {
+				kind: "provider",
+				name: providerLabel(provider),
+				...command ? { command } : {}
+			} : {
+				kind: "sql",
+				sql: fix
+			}
+		}];
+	}));
+}
+/** The sentence that tells the reader how to apply `fix`. */
+function grantFixText(fix, workflow) {
+	switch (fix.kind) {
+		case "sql": return `${grantFixPlace(workflow)} (\`doctor --fix-grants\` prints every block):\n${fix.sql.join("\n")}`;
+		case "provider": return fix.command ? `It is the hook of ${fix.name}, so let the provider write the grants: \`${fix.command}\`.` : `It is the hook of ${fix.name}, so let the provider write the grants.`;
+		case "migration": return workflow === "pg-delta" ? `${fix.file} grants it, so the database is behind: run \`supabase db schema declarative sync\`, then apply the migrations (\`supabase migration up\`).` : `${fix.file} grants it, so the database is behind the migrations: apply them (\`supabase migration up\`).`;
+		default: return fix;
+	}
+}
+/** Where the grants go under `workflow`. */
+function grantFixPlace(workflow) {
+	switch (workflow) {
+		case "pg-delta": return "Add to the schema file that defines the function, then run `supabase db schema declarative sync`";
+		case "migra": return "Append to the migration `supabase db diff` wrote";
+		case "migrations": return "Add to a new migration (`supabase migration new auth_hook_grants`), then apply it (`supabase migration up`)";
+		default: return workflow;
+	}
+}
+/**
+* `doctor --fix-grants`: the SQL block for every BS404 problem, as one
+* migration snippet.
+*/
+function hookGrantBlock(problems, workflow = "pg-delta") {
+	if (problems.length === 0) return "-- Every configured Auth hook function has its grants.";
+	const lines = ["-- Auth hook grants (better-supabase doctor --fix-grants).", workflow === "migra" ? "-- `supabase db diff` does not carry function grants; append this to its migration." : `-- ${grantFixPlace(workflow)}.`];
+	for (const { fn, hook, fix } of problems) {
+		const name = `${signatureOf(fn)} ([auth.hook.${hook}])`;
+		switch (fix.kind) {
+			case "sql":
+				lines.push("", `-- ${name}`, ...fix.sql);
+				break;
+			case "provider":
+				lines.push("", `-- ${name} is the hook of ${fix.name}${fix.command ? `: ${fix.command}` : ""}`);
+				break;
+			case "migration":
+				lines.push("", workflow === "pg-delta" ? `-- ${name}: ${fix.file} grants it; run \`supabase db schema declarative sync\`, then \`supabase migration up\`.` : `-- ${name}: ${fix.file} grants it; run \`supabase migration up\`.`);
+				break;
+			default: return fix;
+		}
+	}
+	return lines.join("\n");
+}
+const emptySearchPath = (fn) => {
+	const value = fn.settings["search_path"];
+	return value === "" || value === "\"\"" || value === "''";
+};
+/**
+* Auth's issuer shape (`{url}/auth/v1`); doctor has no project URL to put in
+* it.
+*/
+const DOCTOR_ISSUER = "https://doctor.invalid/auth/v1";
+/**
+* Runs the hook as Auth does for `userId` (as `supabase_auth_admin` when the
+* connecting role may switch to it), in a transaction that is rolled back.
+* Undefined when `auth.users` has no such user.
+*/
+async function withHookEvent(db, userId, run) {
+	await db.query("begin");
+	try {
+		await db.query(`set local statement_timeout = '10s'`);
+		const [user] = await db.query(`select set_config('better_supabase.hook_event', jsonb_build_object(
+        'user_id', u.id,
+        'authentication_method', 'password',
+        'claims', jsonb_build_object(
+          'aud', 'authenticated', 'role', 'authenticated', 'sub', u.id,
+          'email', coalesce(u.email, ''), 'phone', coalesce(u.phone, ''),
+          'app_metadata', coalesce(u.raw_app_meta_data, '{}'::jsonb),
+          'user_metadata', coalesce(u.raw_user_meta_data, '{}'::jsonb),
+          'aal', 'aal1', 'session_id', gen_random_uuid(),
+          'is_anonymous', coalesce(u.is_anonymous, false),
+          'amr', jsonb_build_array(jsonb_build_object(
+            'method', 'password', 'timestamp', extract(epoch from now())::int8
+          )),
+          'iss', ${literal$1(DOCTOR_ISSUER)},
+          'iat', extract(epoch from now())::int8,
+          'exp', extract(epoch from now())::int8 + 3600
+        )
+      )::text, true) as event
+      from auth.users u where u.id = ${literal$1(userId)}::uuid`);
+		if (!user?.event) return;
+		const [role] = await db.query(`select case when exists(select 1 from pg_roles where rolname = 'supabase_auth_admin')
+        then pg_has_role('supabase_auth_admin', 'member') else false end as member`);
+		if (role?.member) await db.query("set local role supabase_auth_admin");
+		return await run();
+	} finally {
+		await db.query("rollback");
+	}
+}
+const hookCall = (fn) => `${ident$1(fn.schema)}.${ident$1(fn.name)}(current_setting('better_supabase.hook_event')::jsonb) -> 'claims'`;
+/** The claims the hook returns for `userId`, or undefined without that user. */
+async function hookClaims(db, fn, userId) {
+	return withHookEvent(db, userId, async () => {
+		const [row] = await db.query(`select ${hookCall(fn)} as claims`);
+		const claims = typeof row?.claims === "string" ? JSON.parse(row.claims) : row?.claims;
+		return isRecord(claims) ? claims : {};
+	});
+}
+async function hookClaimsSize(db, fn, userId, budget) {
+	const budgetSql = budget && budget.claims.length > 0 ? budget.claims.map((claim) => `coalesce(octet_length((c -> ${literal$1(claim)})::text), 0)`).join(" + ") : "0";
+	const truncatedSql = budget?.truncatedClaim ? `c ->> ${literal$1(budget.truncatedClaim)} = 'true'` : "false";
+	return withHookEvent(db, userId, async () => {
+		const [row] = await db.query(`select octet_length(c::text) as bytes,
+        octet_length((c -> 'memberships')::text) as memberships,
+        ${budgetSql} as budget,
+        ${truncatedSql} as truncated
+      from (select ${hookCall(fn)} as c) h`);
+		return {
+			bytes: Number(row?.bytes ?? 0),
+			memberships: Number(row?.memberships ?? 0),
+			budget: Number(row?.budget ?? 0),
+			truncated: row?.truncated === true
+		};
+	});
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"host.docker.internal"
+]);
+/** The `secrets = ...` line of `[auth.hook.<hook>]` reads an `env()` value. */
+function secretsFromEnv(text, hook) {
+	const start = text.search(new RegExp(`^\\s*\\[auth\\.hook\\.${hook}\\]`, "m"));
+	if (start < 0) return false;
+	const rest = text.slice(start).split("\n").slice(1);
+	const end = rest.findIndex((line) => /^\s*\[/.test(line));
+	const section = (end === -1 ? rest : rest.slice(0, end)).join("\n");
+	return /^\s*secrets\s*=\s*["']env\(/m.test(section);
+}
+/**
+* What is wrong with one Standard Webhooks secret (`v1,whsec_<base64>`), the
+* format Auth signs HTTP hook requests with. Never quotes the secret.
+*/
+function secretProblem(secret) {
+	const match = /^v1,whsec_([A-Za-z0-9+/]+={0,2})$/.exec(secret.trim());
+	if (!match) return "is not in the `v1,whsec_<base64>` format";
+	const bytes = atob(match[1]).length;
+	return bytes < 24 || bytes > 64 ? `decodes to ${bytes} bytes; Standard Webhooks secrets are 24 to 64` : void 0;
+}
+const HOOK_RULES = [
+	{
+		code: "BS404",
+		severity: "error",
+		title: "Auth hook function grants",
+		description: "Auth calls Postgres hook functions as `supabase_auth_admin`, which needs usage on the schema and execute on the function. Nobody else should be able to call them: a client calling the custom access token hook through the API sees what it adds for any user id.",
+		check: (context) => [...configuredHooks(context).flatMap(({ config, extras }) => {
+			if (!extras || extras.functions.length > 0) return [];
+			const location = hookLocation(context, config.hook);
+			return [{
+				message: `[auth.hook.${config.hook}] calls ${config.schema}.${config.name}, which does not exist. Sign-ins fail until it does.`,
+				target: `[auth.hook.${config.hook}]`,
+				...location ? { location } : {}
+			}];
+		}), ...hookGrantProblems(context).map(({ hook, fn, problems, fix }) => ({
+			message: `${signatureOf(fn)} ([auth.hook.${hook}]): ${problems.join("; ")}. ${grantFixText(fix, workflowOf(context))}`,
+			target: signatureOf(fn),
+			object: {
+				kind: "function",
+				schema: fn.schema,
+				name: fn.name
+			}
+		}))]
+	},
+	{
+		code: "BS405",
+		severity: "warning",
+		title: "Custom access token hook shape",
+		description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back. It warns when the whole token's claims pass ${HOOK_CLAIMS_LIMIT} bytes (\`tooling.doctor.claimsLimit\` without a provider budget). When the authorization provider's hook has a \`budget\`, it also warns when the budget's claims pass its bytes (or \`tooling.doctor.claimsLimit\`), measured with \`octet_length\` of each claim.`,
+		async check(context) {
+			const findings = [];
+			const limits = claimsLimits(context);
+			for (const { config, extras } of configuredHooks(context)) {
+				if (config.hook !== "custom_access_token" || !extras) continue;
+				for (const fn of extras.functions) {
+					const object = {
+						kind: "function",
+						schema: fn.schema,
+						name: fn.name
+					};
+					const problems = [];
+					if (fn.volatility !== "stable") problems.push(`it is ${fn.volatility}; declare it \`stable\``);
+					if (!emptySearchPath(fn)) problems.push("it has no `set search_path = ''`; add it and qualify every table");
+					if (problems.length > 0) findings.push({
+						message: `${signatureOf(fn)}: ${problems.join("; ")}.`,
+						target: signatureOf(fn),
+						object
+					});
+					if (!context.hookUser) continue;
+					const db = context.database;
+					if (!db || "skipped" in db || !db.session) {
+						findings.push({
+							severity: "info",
+							message: `Measuring the hook's claims needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
+							target: `${signatureOf(fn)}:claims`
+						});
+						continue;
+					}
+					try {
+						const size = await hookClaimsSize(db, fn, context.hookUser, limits.budget);
+						if (size === void 0) {
+							findings.push({
+								severity: "info",
+								message: `--as ${context.hookUser}: no such user in auth.users, so the hook was not called.`,
+								target: `${signatureOf(fn)}:claims`
+							});
+							continue;
+						}
+						if (limits.budget !== void 0 && size.budget > limits.budget.bytes) findings.push({
+							message: `${signatureOf(fn)} returns ${size.budget} bytes of ${limits.budget.claims.join(" and ")} for ${context.hookUser}, over the hook's budget of ${limits.budget.bytes}. Raise the provider's budget and \`tooling.doctor.claimsLimit\` together, or move claims out of the token.`,
+							target: `${signatureOf(fn)}:budget`,
+							object
+						});
+						if (size.bytes > limits.token) findings.push({
+							message: `${signatureOf(fn)} returns ${size.bytes} bytes of claims for ${context.hookUser} (limit ${limits.token}, memberships ${size.memberships}). Every request carries them twice (cookie and header); keep ids and roles in the token and look up the rest.`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+						if (size.truncated) findings.push({
+							severity: "info",
+							message: `${signatureOf(fn)} sets ${limits.budget?.truncatedClaim ?? "its truncated claim"} for ${context.hookUser}: the token lists only some entries (memberships ${size.memberships} bytes). Server checks for this user need a database lookup.`,
+							target: `${signatureOf(fn)}:truncated`,
+							object
+						});
+					} catch (cause) {
+						findings.push({
+							message: `Calling ${signatureOf(fn)} for ${context.hookUser} failed: ${errorText(cause)}`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+					}
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS407",
+		severity: "error",
+		title: "Two authorization hooks",
+		description: "When the authorization provider's hook (`authorization.tokenHook`) owns claims such as `memberships`, `roles` or the tenant claim, a custom access token hook that also calls `better_supabase.membership_claims`, or writes one of those claims itself, gives them a second source that drifts from the provider's. Use the provider's hook and drop the extra writes. Claims the provider's hook fills from other functions (`registeredClaims`, such as `features` from `better_supabase.feature_claims`) are not reported; a hook that wraps the provider's and writes one of those claims again is.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const hook = provider?.tokenHook;
+			if (!provider || !hook) return [];
+			const label = providerLabel(provider);
+			const registered = new Map((hook.registeredClaims ?? []).map((claim) => [claim.name, claim.function]));
+			const owned = ownedClaims(hook);
+			const findings = [];
+			for (const { config, extras } of configuredHooks(context)) {
+				if (config.hook !== "custom_access_token" || !extras) continue;
+				for (const fn of extras.functions) {
+					if (fn.source === void 0 || isProviderHook(context, fn)) continue;
+					const module = owned.includes("memberships") && MODULE_MEMBERSHIPS.test(fn.source);
+					const wrapper = wrapsProviderHook(hook, fn.source);
+					const written = writtenClaims(fn.source, [...owned, ...wrapper ? registered.keys() : []]);
+					if (!module && written.length === 0) continue;
+					const location = hookLocation(context, config.hook);
+					const what = [...module ? ["calls better_supabase.membership_claims"] : [], ...written.length > 0 ? [`writes ${written.join(", ")}`] : []].join(" and ");
+					const extra = written.filter((claim) => registered.has(claim));
+					const sources = extra.map((claim) => `${claim} from ${registered.get(claim)}`).join(", ");
+					findings.push({
+						message: `${signatureOf(fn)} ${what}, but the hook of ${label} (${hook.function}) owns those claims${extra.length > 0 ? ` (it already writes ${sources})` : ""}. Keep one source: use the provider's hook and remove these writes from yours.`,
+						target: signatureOf(fn),
+						object: {
+							kind: "function",
+							schema: fn.schema,
+							name: fn.name
+						},
+						...location ? { location } : {}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS410",
+		severity: "warning",
+		title: "HTTP auth hooks",
+		description: "Auth calls an `http://` or `https://` hook with a request signed by the Standard Webhooks secret in `secrets` (`v1,whsec_<base64>`, several joined with `|`). Doctor can't read the endpoint's code, so it reports each HTTP hook and checks what it can: the secret's format, that it comes from `env()` rather than the committed file, and that a non-local endpoint uses https. Verify the request in the endpoint with `authHook` from `better-supabase/blocks/webhooks`.",
+		check: (context) => {
+			const toml = context.configToml;
+			if (!toml) return [];
+			return httpHooks(toml.document).flatMap(({ hook, uri, secrets }) => {
+				const location = hookLocation(context, hook);
+				const at = location ? { location } : {};
+				const target = `[auth.hook.${hook}]`;
+				const findings = [{
+					severity: "info",
+					message: `${target} calls ${uri.origin}${uri.pathname} over HTTP. Doctor can't check its code; verify the signature there with authHook from better-supabase/blocks/webhooks.`,
+					target,
+					...at
+				}];
+				if (uri.protocol === "http:" && !LOCAL_HOSTS.has(uri.hostname)) findings.push({
+					message: `${target} sends claims and its signature to ${uri.host} over plain http. Use https.`,
+					target,
+					...at
+				});
+				const fromEnv = secretsFromEnv(toml.text, hook);
+				if (secrets === void 0 || secrets.trim() === "") {
+					findings.push({
+						severity: "error",
+						message: `${target} has no \`secrets\`, so Auth can't sign its requests. Set \`secrets = "env(AUTH_HOOK_SECRET)"\` with a \`v1,whsec_<base64>\` value.`,
+						target,
+						...at
+					});
+					return findings;
+				}
+				if (!fromEnv) findings.push({
+					message: `${target} has its secret written in ${toml.path}, which is committed. Move it to an env file and read it with \`secrets = "env(AUTH_HOOK_SECRET)"\`.`,
+					target,
+					...at
+				});
+				if (fromEnv && secrets.trim().startsWith("env(")) return findings;
+				const problems = secrets.split("|").flatMap((secret, index) => {
+					const problem = secretProblem(secret);
+					return problem ? [`secret ${index + 1} ${problem}`] : [];
+				});
+				if (problems.length > 0) findings.push({
+					severity: "error",
+					message: `${target}: ${problems.join("; ")}. Auth rejects the config; generate one with \`openssl rand -base64 32\` and prefix it with \`v1,whsec_\`.`,
+					target,
+					...at
+				});
+				return findings;
+			});
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/lite.ts
+const RPC_CALL = /(?:\.|\$)rpc\s*\(|\brpcTransport\s*\(/;
+const MISSING_FEATURES = [{
+	feature: "Realtime",
+	pattern: /from\s+["']better-supabase\/realtime["']|\.channel\s*\(|\.removeChannel\s*\(/
+}, {
+	feature: "Edge Functions",
+	pattern: /\.functions\.invoke\s*\(|\bfunctions\(\)\.invoke\s*\(/
+}];
+/**
+* The `[db] driver` of a Supabase Lite project, or `undefined` for any other
+* project.
+*/
+function liteDriver(context) {
+	try {
+		return liteDriverOf(context.configToml);
+	} catch {
+		return;
+	}
+}
+function rpcOnSqlite(context) {
+	const driver = liteDriver(context);
+	if (driver === void 0 || !isSqliteLiteDriver(driver)) return [];
+	return context.sources.flatMap((file) => {
+		const line = lineOf(file.text, RPC_CALL);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} calls a Postgres function, but Supabase Lite's ${driver} driver has no rpc(), so the call returns an unsupported error. Switch [db] driver to "pglite" or "postgres" in supabase/config.toml, or replace the function with table queries.`,
+			target: `${file.path}:rpc`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	});
+}
+function missingLiteFeature(context) {
+	if (liteDriver(context) === void 0) return [];
+	return context.sources.flatMap((file) => MISSING_FEATURES.flatMap(({ feature, pattern }) => {
+		const line = lineOf(file.text, pattern);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} uses ${feature}, which Supabase Lite does not implement on any driver. Run the full Supabase stack for this feature, or move the project off Lite with \`supabase lite upgrade\`.`,
+			target: `${file.path}:${feature}`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	}));
+}
+const LITE_RULES = [{
+	code: "BS328",
+	severity: "warning",
+	title: "rpc() on a Supabase Lite SQLite driver",
+	description: "`[db] driver` in `config.toml` is `sqlite-postgres` or `sqlite`, which have no `rpc()`, but the app calls a Postgres function. Those calls return an `unsupported` error.",
+	check: rpcOnSqlite
+}, {
+	code: "BS329",
+	severity: "warning",
+	title: "Feature Supabase Lite does not implement",
+	description: "`config.toml` sets `[db] driver`, so the project runs on Supabase Lite, but the app uses Realtime or Edge Functions, which Lite does not implement.",
+	check: missingLiteFeature
+}];
+//#endregion
+//#region src/cli/doctor/metadata.ts
+/**
+* Rules that read what a `GeneratorMetadata` document leaves out (policies,
+* grants, indexes, triggers, buckets, the realtime publication, foreign key
+* actions, multi-column constraints, role settings, hook functions). On a
+* snapshot built from such a document they would report what is missing from
+* the document, not from the database, so they skip with an info finding.
+*/
+const EXTRAS_RULES = /* @__PURE__ */ new Set([
+	"BS103",
+	"BS106",
+	"BS107",
+	"BS108",
+	"BS109",
+	"BS110",
+	"BS111",
+	"BS112",
+	"BS113",
+	"BS114",
+	"BS115",
+	"BS116",
+	"BS117",
+	"BS204",
+	"BS205",
+	"BS206",
+	"BS207",
+	"BS210",
+	"BS211",
+	"BS224",
+	"BS213",
+	"BS215",
+	"BS216",
+	"BS217",
+	"BS218",
+	"BS219",
+	"BS301",
+	"BS302",
+	"BS303",
+	"BS305",
+	"BS306",
+	"BS337",
+	"BS338",
+	"BS340",
+	"BS310",
+	"BS315",
+	"BS404",
+	"BS405",
+	"BS406",
+	"BS407"
+]);
+/**
+* The info finding for a rule in `EXTRAS_RULES` that did not run, or
+* `undefined` when it can.
+*/
+function skippedForMetadata(snapshot, rule, help) {
+	if (!snapshot.extras.fromMetadata || !EXTRAS_RULES.has(rule.code)) return;
+	return {
+		code: rule.code,
+		severity: "info",
+		title: rule.title,
+		help,
+		message: `Skipped: the schema came from a GeneratorMetadata document (--metadata), which has no ${METADATA_GAPS_TEXT}. Run doctor against the database to run this check.`
+	};
+}
+//#endregion
+//#region src/cli/doctor/module-files.ts
+/** The `blocks` files as this release renders them, next to what is on disk. */
+async function moduleFiles(context) {
+	if (context.config.blockNames.length === 0 && Object.keys(context.config.appTables).length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind === "invalid") return [];
+	const readSets = context.readSets;
+	const skipped = readSets !== void 0 && "skipped" in readSets;
+	let rendered;
+	try {
+		rendered = renderBlocks(context.config.blockNames, await moduleLayoutFor(context.config, {
+			names: context.config.blockNames,
+			testsDir: context.config.sql.testsDir,
+			readSets: skipped ? [] : readSets,
+			entitlementsProvider: entitlementsModule(context),
+			accessProvider: access.kind === "provider" ? access.access : void 0,
+			permissionCatalog: permissionCatalogKeys(context)
+		}));
+	} catch {
+		return [];
+	}
+	const files = rendered.filter((file) => !(skipped && file.module === "read-sets"));
+	if (workflowOf(context) === "migrations") {
+		const latest = await latestMigration(context.config, MODULES_SUFFIX);
+		const versions = migrationModules(latest?.text ?? "");
+		const path = latest?.path ?? `${migrationsDir(context.config)}/<stamp>_better_supabase_modules.sql`;
+		return Promise.all(files.map(async (file) => {
+			if (file.kind === "test") return fileState(context, file);
+			const installed = versions.get(file.instance ?? file.module);
+			return {
+				file,
+				path,
+				installed,
+				current: latest === void 0 ? void 0 : migrationHolds(latest.text, file.contents) ? file.contents : latest.text,
+				behind: file.kind === "schema" && installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+			};
+		}));
+	}
+	return Promise.all(files.map((file) => fileState(context, file)));
+}
+async function fileState(context, file) {
+	const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
+	const installed = current === void 0 ? void 0 : moduleFileVersion(current)?.version ?? 1;
+	return {
+		file,
+		path: file.path,
+		current,
+		installed,
+		behind: installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+	};
+}
+//#endregion
+//#region src/cli/doctor/app-table-policies.ts
+/**
+* Block policies (`bsb_*`, permissive) on the app's tables that grant a command
+* more than the app's own permissive policies do. Postgres ORs permissive
+* policies, so a block policy whose condition no app policy repeats can open
+* rows the app's policies keep closed. A command the app has no policy for is
+* the block's to grant.
+*/
+function widenedAppTablePolicies(context) {
+	const tables = adoptedTables(context.config.blocks, appTablesOf(context));
+	if (tables.length === 0) return [];
+	const modules = /* @__PURE__ */ new Map();
+	for (const table of tables) {
+		const target = `${table.schema}.${table.table}`;
+		modules.set(target, (modules.get(target) ?? /* @__PURE__ */ new Set()).add(table.module));
+	}
+	return catalogOf(context).tables.flatMap((table) => {
+		const target = qualified(table);
+		const owners = modules.get(target);
+		if (owners === void 0) return [];
+		const permissive = table.policies.filter((policy) => policy.permissive);
+		const own = permissive.filter((policy) => !policy.name.startsWith(BLOCK_PREFIX));
+		const blocks = [...owners].map((module) => `blocks.${module}`).join(" or ");
+		return permissive.filter((policy) => policy.name.startsWith(BLOCK_PREFIX)).flatMap((policy) => {
+			const widened = widenedCommands(policy, own);
+			if (widened.length === 0) return [];
+			const reason = `no policy of the app's for ${widened.join(", ")} reaches its roles with a condition it repeats (alone or with more "and" operands), so it can open rows the app's policies keep closed`;
+			return [{
+				message: `${blocks} adds policy ${policy.name} on ${target}, and ${reason}. Postgres ORs permissive policies; doctor compares conditions as text and can't prove that one implies another. If the block's condition is what the app means, repeat it in the app's policy; otherwise narrow the permission key it checks, or drop ${policy.name} in a schema file that runs after the block's.`,
+				target: `${target}.${policy.name}`,
+				object: {
+					kind: "policy",
+					schema: table.schema,
+					table: table.name,
+					name: policy.name
+				}
+			}];
+		});
+	});
+}
+const KEPT_TRIGGER = /^-- (\S+) keeps updated_at current with its own trigger (\S+)\.$/gm;
+/**
+* App tables whose own trigger keeps `updated_at` current, so the block skipped
+* its `bsb_updated_at` trigger there.
+*/
+async function keptUpdatedAtTriggers(context) {
+	return (await moduleFiles(context)).flatMap(({ file }) => file.kind === "schema" ? [...file.contents.matchAll(KEPT_TRIGGER)].map(([, target = "", trigger = ""]) => {
+		const dot = target.indexOf(".");
+		return {
+			message: `blocks.${file.instance ?? file.module} runs over ${target}, which keeps updated_at current with its own trigger ${trigger}, so the block adds no bsb_updated_at trigger there. Keep ${trigger} firing on update; if you drop it, run \`better-supabase upgrade\` to add the block's.`,
+			target,
+			object: {
+				kind: "table",
+				schema: target.slice(0, dot),
+				name: target.slice(dot + 1)
+			}
+		};
+	}) : []);
+}
+/**
+* Whether a deprecated table or column name belongs to the app: the app's
+* tables keep the app's names, as custom blocks' tables do.
+*/
+function keepsAppsName(context) {
+	const adopted = context.config.blockNames.some((name) => moduleDeprecations().some((entry) => entry.module === name && (entry.kind === "table" || entry.kind === "column"))) ? adoptedTables(context.config.blocks, appTablesOf(context)) : [];
+	return (entry) => {
+		if (entry.kind !== "table" && entry.kind !== "column") return false;
+		if ((context.config.blocks[entry.module]?.mode ?? "managed") !== "managed") return true;
+		const name = entry.kind === "table" ? entry.symbol.slice(entry.symbol.lastIndexOf(".") + 1) : entry.symbol.slice(0, entry.symbol.indexOf("."));
+		return adopted.some((table) => table.module === entry.module && (name === table.logical || name === table.table || name === SQL_MODULES[table.module]?.names?.tables[table.logical]?.name));
+	};
+}
+//#endregion
+//#region src/cli/doctor/attachment-subjects.ts
+/**
+* The attachments subjects as the block resolves them, with the per-subject
+* keys each one has.
+*/
+function attachmentSubjects(context) {
+	const registry = context.config.subjects;
+	const raw = context.config.blocks["attachments"]?.on;
+	return (raw === void 0 ? Object.keys(registry).map((type) => [type, {}]) : Array.isArray(raw) ? raw.filter((type) => typeof type === "string").map((type) => [type, {}]) : isRecord(raw) ? Object.entries(raw).flatMap(([type, entry]) => isRecord(entry) ? [[type, entry]] : []) : []).flatMap(([type, entry]) => {
+		const registered = registry[type];
+		const table = entry["table"] ?? registered?.table;
+		const tenant = entry["tenant"] ?? registered?.tenant ?? "organization_id";
+		if (typeof table !== "string" || typeof tenant !== "string") return [];
+		const own = isRecord(entry["permissions"]) ? Object.keys(entry["permissions"]) : [];
+		const fromRegistry = Object.keys(registered?.permissions ?? {}).filter((key) => key !== "read");
+		const subjectRead = typeof entry["permission"] === "string" || registered?.permissions?.["read"] !== void 0 ? ["read"] : [];
+		return [{
+			type,
+			table,
+			tenant,
+			keys: /* @__PURE__ */ new Set([
+				...own,
+				...fromRegistry,
+				...subjectRead
+			])
+		}];
+	});
+}
+/**
+* Whether `expression` only checks that the caller is a member of the row's
+* tenant: `current_tenant_id()`, a `*_ids_with` or `*member_*ids` function in
+* any schema (the provider's own helpers included), `can('tenant', ...)` or
+* `member_can`, joined by `and`, with a soft-delete `is null` allowed. A
+* permission call passes only with one of `keys`.
+*/
+function tenantOnly(expression, column, keys) {
+	const col = `(?:"?\\w+"?\\.)?"?${escape$2(column)}"?(?:::\\w+)?`;
+	const key = `'([^']*)'(?:::text)?`;
+	const atoms = [
+		`${col}\\s*=\\s*\\(?\\s*(?:select\\s+)?better_supabase\\.current_tenant_id\\(\\)(?:\\s+as\\s+\\w+)?`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*_ids_with\\(\\s*${key}\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*member_\\w*ids\\(\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`better_supabase\\.can\\(\\s*'tenant'(?:::text)?\\s*,\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`better_supabase\\.member_can\\(\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`(?:"?\\w+"?\\.)?"?\\w+"?\\s+is\\s+null`
+	];
+	const used = [];
+	let rest = expression;
+	for (const atom of atoms) rest = rest.replaceAll(new RegExp(atom, "gi"), (_match, key) => {
+		if (typeof key === "string") used.push(key);
+		return " ";
+	});
+	return used.every((key) => keys.has(key)) && rest.replaceAll(/\band\b|[()\s]/gi, "") === "";
+}
+/** The top-level `or` branches of `expression`, outer parentheses removed. */
+function branches(expression) {
+	let text = expression.trim();
+	while (text.startsWith("(") && closingParen(text) === text.length - 1) text = text.slice(1, -1).trim();
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (depth === 0 && /^\sor\s/i.test(text.slice(index, index + 4))) {
+			parts.push(text.slice(start, index));
+			start = index + 4;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts;
+}
+/** The index of the parenthesis closing the one at the start of `text`. */
+function closingParen(text) {
+	let depth = 0;
+	for (let index = 0; index < text.length; index += 1) if (text[index] === "(") depth += 1;
+	else if (text[index] === ")") {
+		depth -= 1;
+		if (depth === 0) return index;
+	}
+	return -1;
+}
+/**
+* Tenant membership alone lets the caller through: the whole check, or one `or`
+* branch of it.
+*/
+function tenantSuffices(expression, column, keys) {
+	return [expression, ...branches(expression)].some((part) => tenantOnly(part, column, keys));
+}
+function attachmentSubjectsOnDefaults(context) {
+	if (!context.config.blockNames.includes("attachments")) return [];
+	const { tables } = catalogOf(context);
+	const overrides = context.config.blocks["attachments"]?.permissions ?? {};
+	const actions = [{
+		action: "read",
+		commands: ["select"],
+		what: "reads"
+	}, {
+		action: "upload",
+		commands: ["insert", "update"],
+		what: "writes"
+	}];
+	return attachmentSubjects(context).flatMap(({ type, table: name, tenant, keys }) => {
+		const [schema, bare] = name.includes(".") ? name.split(".", 2) : ["public", name];
+		const table = tables.find((candidate) => candidate.schema === schema && candidate.name === bare);
+		if (table?.kind !== "table" || !table.rls) return [];
+		const stricter = actions.filter(({ action, commands }) => {
+			if (keys.has(action)) return false;
+			const blockKey = overrides[action] ?? `attachments.${action}`;
+			return commands.some((command) => {
+				const applying = table.policies.filter((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, "authenticated"));
+				if (command !== "select" && applying.length === 0) return false;
+				return !applying.some((policy) => {
+					const expression = command === "select" ? policy.using : policy.check ?? policy.using;
+					return expression !== null && tenantSuffices(expression, tenant, /* @__PURE__ */ new Set([blockKey]));
+				});
+			});
+		});
+		if (stricter.length === 0) return [];
+		const target = `${table.schema}.${table.name}`;
+		return [{
+			message: `Attachments on ${type} use the block-wide ${stricter.map(({ action }) => action).join(" and ")} key, but ${target} checks more than tenant membership for ${stricter.map(({ what: verb }) => verb).join(" and ")}, so any member of the tenant gets the files of a ${type} they can't open. Set ${stricter.map(({ action }) => action === "read" ? `blocks.attachments.on.${type}.permissions.read` : `subjects.${type}.permissions.upload`).join(" and ")} to the key the table checks.`,
+			target,
+			object: tableObject(table)
+		}];
+	});
+}
+//#endregion
+//#region src/cli/doctor/audit-coverage.ts
+const escapeRegExp$1 = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** `exempt` entries: a glob, or `{ table, reason }` where `table` is a glob. */
+function exemptions(value) {
+	return (Array.isArray(value) ? value : []).flatMap((entry) => {
+		if (typeof entry === "string") return [{
+			glob: entry,
+			reason: void 0
+		}];
+		if (typeof entry === "object" && entry !== null && "table" in entry && typeof entry.table === "string") {
+			const reason = "reason" in entry && typeof entry.reason === "string" ? entry.reason.trim() : "";
+			return [{
+				glob: entry.table,
+				reason: reason === "" ? void 0 : reason
+			}];
+		}
+		return [];
+	});
+}
+/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
+const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp$1).join(".*")}$`, "i"));
+/**
+* The module schemas and the app tables SQL modules adopted, which the audit
+* trigger skips.
+*/
+function moduleOwned(context) {
+	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const module of Object.values(context.config.blocks)) {
+		if (module?.schema !== void 0) schemas.add(module.schema);
+		for (const table of Object.values(module?.tables ?? {})) {
+			if (table === null || table === void 0) continue;
+			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
+		}
+	}
+	return {
+		schemas,
+		tables
+	};
+}
+/**
+* Tables in `config.schemas` without the `bsb_audit` trigger, when `audit` is
+* in `blocks`, and exemptions that give no reason.
+*/
+function unauditedTables(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const entries = exemptions(context.config.blocks["audit"]?.options?.["exempt"]);
+	const exempt = globs(entries.map((entry) => entry.glob));
+	const owned = moduleOwned(context);
+	const unaudited = catalogOf(context).tables.filter((table) => table.kind === "table" && table.partitionOf === void 0 && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => /^bsb?_audit/.test(trigger.name) || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
+		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt as \`{ table: '${qualified(table)}', reason: '...' }\`.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+	const unexplained = entries.filter((entry) => entry.reason === void 0).map((entry) => ({
+		message: `blocks.audit.options.exempt lists ${entry.glob} without a reason. Write it as { table: '${entry.glob}', reason: 'why its changes need no audit entry' } so a reviewer can tell an intended gap from a forgotten table.`,
+		target: `blocks.audit.options.exempt:${entry.glob}`
+	}));
+	return [...unaudited, ...unexplained];
+}
+//#endregion
+//#region src/cli/doctor/block-on.ts
+/** The record types `on` names: list entries or object keys. */
+function namedTypes(on) {
+	if (Array.isArray(on)) return on.filter((type) => typeof type === "string");
+	return isRecord(on) ? Object.keys(on) : [];
+}
+/**
+* Block entries whose `on` names a type `config.records` doesn't register. The
+* block's SQL refuses such a type when it renders, so this reports it before
+* `gen`.
+*/
+function onUnknownRecordTypes(context) {
+	const registered = new Set(Object.keys(context.config.subjects));
+	return Object.entries(context.config.blocks).flatMap(([instance, entry]) => namedTypes(entry?.on).filter((type) => !registered.has(type)).map((type) => ({
+		message: `blocks.${instance}.on names "${type}", which is not a record type. Register it in config.records, or remove it from on.`,
+		target: `blocks.${instance}.on.${type}`
+	})));
+}
+//#endregion
+//#region src/cli/doctor/modules.ts
+/** The non-empty string at a dotted path, as membershipsExtension() reads it. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of path.split(".")) value = isRecord(value) ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function contractChecks(context) {
+	return customContracts(context.config.blockNames, moduleLayout(context.config, context.config.sql.testsDir, [], void 0, void 0, permissionCatalogKeys(context))).flatMap((contract) => contract.functions.map((fn) => ({
+		module: contract.module,
+		schema: contract.schema,
+		name: fn.name,
+		args: contractSignature(fn, contract.idType),
+		returns: fn.returns.replaceAll("{id}", contract.idType)
+	})));
+}
+const escapeRegExp = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const ident = (name) => `"?${escapeRegExp(name)}"?`;
+/** Whether a `create function schema.name(` appears in the SQL files. */
+function declared(context, check) {
+	const pattern = new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${ident(check.schema)}\\.${ident(check.name)}\\s*\\(`, "i");
+	return (context.sqlFiles ?? []).some((file) => pattern.test(file.text));
+}
+const normalize$1 = (types) => types.replaceAll(/\s+/g, " ").replaceAll(/\s*,\s*/g, ", ").trim();
+const PRE_REQUEST_HOOK = `select h.hook,
+  coalesce(pg_catalog.strpos(pg_catalog.pg_get_functiondef(pg_catalog.to_regproc(h.hook)), 'better_supabase.check_request') > 0, false) as calls
+from (
+  select (
+    select pg_catalog.split_part(setting, '=', 2)
+    from pg_catalog.pg_db_role_setting s
+    join pg_catalog.pg_roles r on r.oid = s.setrole
+    cross join lateral pg_catalog.unnest(s.setconfig) setting
+    where r.rolname = 'authenticator' and s.setdatabase = 0
+      and setting like 'pgrst.db_pre_request=%'
+    limit 1
+  ) as hook
+) h`;
+/**
+* `rate-limit` in `blocks` without PostgREST's pre-request hook reaching
+* `check_request()`.
+*/
+async function rateLimitHook(context) {
+	const db = context.database;
+	if (!context.config.blockNames.includes("rate-limit") || context.config.blocks["rate-limit"]?.options?.["preRequest"] === false || !db || "skipped" in db) return [];
+	let rows;
+	try {
+		rows = await db.query(PRE_REQUEST_HOOK);
+	} catch {
+		return [];
+	}
+	const [row] = rows;
+	if (!row || row.hook === "better_supabase.check_request" || row.calls) return [];
+	return [{
+		message: row.hook === null ? "pgrst.db_pre_request isn't set for authenticator, so better_supabase.check_request() never runs. Apply the migration `better-supabase add --adopt` writes, which sets it." : `pgrst.db_pre_request is ${row.hook}, which doesn't call better_supabase.check_request(), so rate limits never apply. Call it from ${row.hook}.`,
+		target: "authenticator pgrst.db_pre_request"
+	}];
+}
+const DANGLING_AUDIT = `select a.target::oid::text as oid
+from better_supabase.audited_tables a
+where pg_catalog.to_regclass('better_supabase.audited_tables') is not null
+  and not exists (select 1 from pg_catalog.pg_class c where c.oid = a.target::oid)
+order by 1`;
+/** `better_supabase.audited_tables` rows whose table no longer exists. */
+async function danglingAuditRegistrations(context) {
+	const db = context.database;
+	if (!context.config.blockNames.includes("audit") || !db || "skipped" in db) return [];
+	let rows;
+	try {
+		rows = await db.query(DANGLING_AUDIT);
+	} catch {
+		return [];
+	}
+	return rows.map((row) => ({
+		message: `better_supabase.audited_tables registers the table with oid ${row.oid}, which no longer exists. It was dropped before the audit module's sql_drop event trigger was installed. Run \`better-supabase upgrade\` and apply the migration \`better-supabase add --adopt\` writes, which deletes such rows, or run \`delete from better_supabase.audited_tables where not exists (select 1 from pg_catalog.pg_class c where c.oid = target::oid)\`.`,
+		target: `better_supabase.audited_tables ${row.oid}`
+	}));
+}
+/**
+* Columns the modules use on the app's tables that the live database lacks:
+* every table the database has may be the app's.
+*/
+async function missingAdoptedColumns(context) {
+	const db = context.database;
+	if (!db || "skipped" in db) return [];
+	const tables = adoptedTables(context.config.blocks, appTablesOf(context));
+	if (tables.length === 0) return [];
+	const names = tables.map((table) => `(${literal$1(table.schema)}, ${literal$1(table.table)})`).join(", ");
+	let rows;
+	try {
+		rows = await db.query(`select table_schema as schema, table_name as name, column_name as column
+      from information_schema.columns
+      where (table_schema, table_name) in (${names})`);
+	} catch {
+		return [];
+	}
+	return tables.flatMap((table) => {
+		const target = `${table.schema}.${table.table}`;
+		const object = {
+			kind: "table",
+			schema: table.schema,
+			name: table.table
+		};
+		const present = new Set(rows.filter((row) => row.schema === table.schema && row.name === table.table).map((row) => row.column));
+		if (present.size === 0) return [{
+			message: `blocks.${table.module} uses ${target} for its ${table.logical} table, which the database does not have. Create it, or point blocks.${table.module} at the existing table.`,
+			target,
+			object
+		}];
+		const added = SQL_MODULES[table.module]?.names?.tables[table.logical] !== void 0;
+		const fix = (logical) => added ? `Apply the block's migration (\`better-supabase upgrade\`), which adds it, or map blocks.${table.module}.columns.${table.logical}.${logical} to the column that holds it.` : `Map the column in blocks.${table.module}.on to the one that holds it, or add it.`;
+		return Object.entries(table.columns).filter(([, column]) => !present.has(column)).map(([logical, column]) => ({
+			message: `blocks.${table.module} runs over ${target} and uses ${target}.${column} (${table.logical}.${logical}), but the table has no such column. ${fix(logical)}`,
+			target: `${target}.${column}`,
+			object
+		}));
+	});
+}
+const EVENT_TRIGGER_FIX = "Event triggers belong to no schema, so a schema diff limited to some schemas (`supabase db schema declarative sync -s ...`) leaves them out of the migration. Run `better-supabase upgrade`, then `better-supabase add --adopt`: the module's data migration creates it.";
+/**
+* Event triggers the `blocks` create that the database, or every migration,
+* lacks.
+*/
+async function missingEventTriggers(context) {
+	const expected = moduleEventTriggers(context.config.blockNames);
+	if (expected.length === 0) return [];
+	const db = context.database;
+	if (db && !("skipped" in db)) {
+		let rows;
+		try {
+			rows = await db.query("select evtname as name from pg_catalog.pg_event_trigger");
+		} catch {
+			return [];
+		}
+		const present = new Set(rows.map((row) => row.name));
+		return expected.filter((trigger) => !present.has(trigger.name)).map((trigger) => ({
+			message: `The database has no event trigger ${trigger.name}, which the ${trigger.module} module creates. ${EVENT_TRIGGER_FIX}`,
+			target: trigger.name
+		}));
+	}
+	const toml = context.configToml;
+	if (toml === void 0) return [];
+	const migrations = (context.sqlFiles ?? []).filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	return expected.filter((trigger) => {
+		const pattern = new RegExp(`create\\s+event\\s+trigger\\s+${ident(trigger.name)}\\s`, "i");
+		return !migrations.some((file) => pattern.test(file.text));
+	}).map((trigger) => ({
+		message: `No migration creates the event trigger ${trigger.name}, which the ${trigger.module} module creates, so a database built from the migrations lacks it. ${EVENT_TRIGGER_FIX}`,
+		target: trigger.name
+	}));
+}
+/**
+* Custom-mode modules whose contract functions the database or SQL files don't
+* have.
+*/
+async function missingContracts(context) {
+	const checks = contractChecks(context);
+	if (checks.length === 0) return [];
+	const db = context.database;
+	const live = db && !("skipped" in db) ? db : void 0;
+	if (!live) return checks.filter((check) => !declared(context, check)).map((check) => ({
+		message: `blocks.${check.module} is in custom mode, but no SQL file declares ${check.schema}.${check.name}(${check.args}). Write it, or switch the module to adopt or managed.`,
+		target: `${check.schema}.${check.name}`,
+		object: {
+			kind: "function",
+			schema: check.schema,
+			name: check.name
+		}
+	}));
+	const names = checks.map((check) => `(${literal$1(check.schema)}, ${literal$1(check.name)})`).join(", ");
+	let rows;
+	try {
+		rows = await live.query(`select n.nspname as schema, p.proname as name,
+        oidvectortypes(p.proargtypes) as args,
+        format_type(p.prorettype, null) as returns
+      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where (n.nspname, p.proname) in (${names})`);
+	} catch (cause) {
+		return [{
+			severity: "info",
+			message: `Reading the custom module contract functions failed: ${errorText(cause)}`,
+			target: "modules"
+		}];
+	}
+	return checks.flatMap((check) => {
+		const found = rows.filter((row) => row.schema === check.schema && row.name === check.name);
+		const target = `${check.schema}.${check.name}`;
+		const object = {
+			kind: "function",
+			schema: check.schema,
+			name: check.name
+		};
+		if (found.length === 0) return [{
+			message: `blocks.${check.module} is in custom mode, but ${target}(${check.args}) doesn't exist. Write it, or switch the module to adopt or managed.`,
+			target,
+			object
+		}];
+		const match = found.find((row) => normalize$1(row.args) === normalize$1(check.args));
+		if (!match) return [{
+			message: `${target} takes (${found.map((row) => row.args).join(" | ")}); the ${check.module} contract calls it with (${check.args}).`,
+			target,
+			object
+		}];
+		if (normalize$1(match.returns) !== normalize$1(check.returns)) return [{
+			message: `${target}(${check.args}) returns ${match.returns}; the ${check.module} contract expects ${check.returns}.`,
+			target,
+			object
+		}];
+		return [];
+	});
+}
+/**
+* With the tenant claim as the active tenant, the hook must put it in the
+* token.
+*/
+async function missingTenantClaim(context) {
+	if (!context.config.blockNames.includes("memberships")) return [];
+	if ((context.config.blocks.permissions?.activeTenant ?? DEFAULT_ACTIVE_TENANT) !== "claim") return [];
+	const userId = context.hookUser;
+	const db = context.database;
+	if (!userId || !db || "skipped" in db || !db.session) return [];
+	const claim = context.config.claims.tenant;
+	const findings = [];
+	for (const { config, extras } of configuredHooks(context)) {
+		if (config.hook !== "custom_access_token" || !extras) continue;
+		for (const fn of extras.functions) {
+			const target = `${signatureOf(fn)}:${claim}`;
+			let claims;
+			try {
+				claims = await hookClaims(db, fn, userId);
+			} catch {
+				continue;
+			}
+			if (claims === void 0) continue;
+			if (tenantClaimPaths(claim).some((path) => claimAt(claims, path) !== void 0)) continue;
+			findings.push({
+				message: `${signatureOf(fn)} returns no \`${claim}\` claim for ${userId} (top level or app_metadata), and blocks.permissions.activeTenant is 'claim', so current_tenant_id() is null and membershipsExtension() rejects their requests. Write the claim in the hook, or set blocks.permissions.activeTenant to 'resolver' (with ServerOptions.tenant) or a profile column.`,
+				target,
+				object: {
+					kind: "function",
+					schema: fn.schema,
+					name: fn.name
+				}
+			});
+		}
+	}
+	return findings;
+}
+/**
+* Where a deprecated symbol is used: a call, a qualified name or a claim
+* lookup.
+*/
+function deprecationPattern(entry) {
+	const [first = "", second] = entry.symbol.split(".");
+	const qualified = second === void 0 ? ident(first) : `${ident(first)}\\.${ident(second)}`;
+	switch (entry.kind) {
+		case "function": return new RegExp(`${qualified}\\s*\\(`, "i");
+		case "table":
+		case "column": return new RegExp(`(?<![\\w."])${qualified}(?![\\w"])`, "i");
+		case "claim": {
+			const name = escapeRegExp(entry.symbol);
+			return new RegExp(`->>?\\s*'${name}'|#>>?\\s*'\\{[^}]*\\b${name}\\b[^}]*\\}'`, "i");
+		}
+		default: {
+			const never = entry.kind;
+			throw new TypeError(`Unknown deprecation kind ${String(never)}`);
+		}
+	}
+}
+const bareWord = (name) => new RegExp(`(?<![\\w"])${ident(name)}(?![\\w"])`, "i");
+/**
+* The line where `text` uses a deprecated symbol. A column also counts
+* unqualified (`m.org_id`) in a statement that names its table, or in a policy
+* on that table.
+*/
+function lineOfUse(entry, text, policyTable) {
+	const direct = lineOf(text, deprecationPattern(entry));
+	if (direct !== void 0 || entry.kind !== "column") return direct;
+	const [table = "", column = ""] = entry.symbol.split(".");
+	let offset = 0;
+	for (const statement of text.split(";")) {
+		const named = policyTable === table || bareWord(table).test(statement);
+		const at = statement.search(bareWord(column));
+		if (named && at !== -1) return text.slice(0, offset + at).split("\n").length;
+		offset += statement.length + 1;
+	}
+}
+/**
+* SQL files and policies that still use a symbol a SQL module deprecated or
+* removed.
+*/
+function deprecatedSymbols(context) {
+	const configured = new Set(Object.values(context.config.claims));
+	const appsName = keepsAppsName(context);
+	const entries = moduleDeprecations().filter((entry) => context.config.blockNames.includes(entry.module) && !(entry.kind === "claim" && configured.has(entry.symbol)) && !appsName(entry));
+	if (entries.length === 0) return [];
+	const files = (context.sqlFiles ?? []).filter((file) => !/(^|\/)supabase\/migrations\//.test(file.path) && moduleFileVersion(file.text) === void 0);
+	const findings = [];
+	for (const entry of entries) {
+		const status = entry.removed === void 0 ? `deprecated since ${entry.since}` : `removed in ${entry.removed}`;
+		const advice = `the ${entry.module} module's ${entry.kind} ${entry.symbol}, ${status}. Use ${entry.use}.`;
+		for (const file of files) {
+			const line = lineOfUse(entry, file.text);
+			if (line === void 0) continue;
+			findings.push({
+				message: `${file.path} uses ${advice}`,
+				target: `${file.path}:${entry.symbol}`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+		}
+		for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+			if (lineOfUse(entry, `${policy.using ?? ""}\n${policy.check ?? ""}`, table.name) === void 0) continue;
+			findings.push({
+				message: `Policy "${policy.name}" on ${qualified(table)} uses ${advice}`,
+				target: `${qualified(table)}.${policy.name}:${entry.symbol}`,
+				object: policyObject(table, policy)
+			});
+		}
+	}
+	return findings;
+}
+/** Module triggers and the equivalent triggers they replace. */
+const EQUIVALENT_TRIGGERS = [{
+	trigger: "bsb_updated_at",
+	call: "track_updated_at",
+	pattern: /updated_at|moddatetime|touch/i
+}, {
+	trigger: "bsb_audit",
+	call: "audit",
+	pattern: /audit/i
+}];
+/** Tables where a module trigger and an older trigger do the same work. */
+function duplicateTriggers(context) {
+	return catalogOf(context).tables.flatMap((table) => EQUIVALENT_TRIGGERS.flatMap(({ trigger, call, pattern }) => {
+		if (!table.triggers.some((entry) => entry.name.replace(/^bs_/, "bsb_") === trigger)) return [];
+		return table.triggers.filter((entry) => entry.name.replace(/^bs_/, "bsb_") !== trigger && pattern.test(entry.function.split(".").at(-1) ?? "")).map((entry) => ({
+			message: `${qualified(table)} has ${trigger} and ${entry.name} (${entry.function}), so both run on every write. Drop ${entry.name}, or run \`select better_supabase.${call}('${qualified(table)}', replace_trigger => true)\` in a migration.`,
+			target: `${qualified(table)}.${entry.name}`,
+			object: tableObject(table)
+		}));
+	}));
+}
+/**
+* RLS tables in `config.schemas` without a restrictive `session_active()`
+* policy, when `sessions` is in `blocks`.
+*/
+function sessionlessTables(context) {
+	if (!context.config.blockNames.includes("sessions")) return [];
+	const exclude = globs(context.config.blocks["sessions"]?.options?.["exclude"]);
+	const owned = moduleOwned(context);
+	return catalogOf(context).tables.filter((table) => table.kind === "table" && table.rls && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exclude.some((pattern) => pattern.test(qualified(table))) && !table.policies.some((policy) => !policy.permissive && `${policy.using ?? ""} ${policy.check ?? ""}`.includes("session_active()"))).map((table) => ({
+		message: `${qualified(table)} has no restrictive session_active() policy, so a signed-out or revoked session keeps its access until the token expires. Set blocks['sessions'].options.policies to true and run \`better-supabase upgrade\`, add the policy by hand, or list the table in blocks['sessions'].options.exclude.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+}
+/**
+* `better_supabase` and every `blocks.*.schema` that `[api] schemas` serves
+* through the Data API.
+*/
+function exposedModuleSchemas(context) {
+	if (context.config.blockNames.length === 0) return [];
+	const moduleSchemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	for (const module of Object.values(context.config.blocks)) if (module?.schema !== void 0) moduleSchemas.add(module.schema);
+	return exposedSchemas(context).filter((schema) => moduleSchemas.has(schema)).map((schema) => ({
+		message: `The Data API serves the module schema ${schema}, so its tables and internal helpers are reachable over REST and RPC. Remove it from [api] schemas in supabase/config.toml (and the dashboard's exposed schemas), set blocks.<module>.api to an exposed schema such as "api" so \`better-supabase add\` writes security invoker entry points there, and call them with rpcTransport(supabase, { schema: "api" }).`,
+		target: schema
+	}));
+}
+function migrationOptions(context) {
+	const module = new Set(context.config.blockNames);
+	return migrationOptionUses(context.config.blocks).filter((use) => module.has(use.module)).map((use) => ({
+		message: `${use.message} It exists to adopt an existing schema; remove it once your data matches the managed default.`,
+		target: `blocks.${use.module}.options.${use.option}`
+	}));
+}
+/**
+* A roles table shared by tenant and platform roles without `where` on both
+* sides.
+*/
+function sharedRoleTables(context) {
+	if (context.config.blockNames.length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind !== "provider") return [];
+	let problems;
+	try {
+		problems = sharedRolesProblems(context.config.blockNames, moduleLayout(context.config, context.config.sql.testsDir, [], entitlementsModule(context), access.access, permissionCatalogKeys(context)));
+	} catch {
+		return [];
+	}
+	return problems.map(({ setting, message }) => ({
+		message: `${message} Without it, ${setting.startsWith("blocks.memberships.") ? "an organization invitation, accept or role change can resolve a platform role" : "a platform invitation can resolve a tenant role"}.`,
+		target: setting
+	}));
+}
+const MODULE_RULES = [
+	{
+		code: "BS307",
+		severity: "error",
+		title: "Custom SQL module without its contract",
+		description: "A module in `blocks` uses `mode: 'custom'`, so the app writes its contract functions. One is missing or has another signature, and the modules and TypeScript APIs that call it fail at run time.",
+		check: missingContracts
+	},
+	{
+		code: "BS308",
+		severity: "warning",
+		title: "Tenant claim the hook does not write",
+		description: "With the `tenant` module and `blocks.permissions.activeTenant: 'claim'`, `current_tenant_id()` and `membershipsExtension()` read the tenant from the `auth.organization.claim` claim, at the top level or in `app_metadata`. With `--as <user id>` doctor calls the custom access token hook for that user and warns when the claims it returns have neither. The default source, `'resolver'`, takes the tenant from the request instead.",
+		check: missingTenantClaim
+	},
+	{
+		code: "BS309",
+		severity: "warning",
+		title: "Deprecated SQL module symbol",
+		description: "A schema file or policy uses a function, table, column or claim that a SQL module deprecated or removed. Deprecated symbols keep a wrapper for at least one minor release; removed ones fail at run time.",
+		check: deprecatedSymbols
+	},
+	{
+		code: "BS310",
+		severity: "warning",
+		title: "Duplicate module trigger",
+		description: "A table has a module trigger (`bsb_updated_at`, `bsb_audit`) and another trigger that does the same work, so both run on every write.",
+		check: duplicateTriggers
+	},
+	{
+		code: "BS313",
+		severity: "warning",
+		title: "Rate limits not wired to PostgREST",
+		description: "The `rate-limit` module is in `blocks`, but on the live database `pgrst.db_pre_request` for the `authenticator` role is unset or names a function that doesn't call `better_supabase.check_request()`, so Data API requests are never counted.",
+		check: rateLimitHook
+	},
+	{
+		code: "BS312",
+		severity: "error",
+		title: "Module schema exposed through the Data API",
+		description: "`[api] schemas` in `config.toml` lists `better_supabase` or a `blocks.*.schema`. The module schemas hold internal tables and helpers that are granted to `authenticated` for policies, so exposing them makes those callable over REST and RPC.",
+		check: exposedModuleSchemas
+	},
+	{
+		code: "BS314",
+		severity: "warning",
+		title: "Migration-only module option",
+		description: "A module over the app's tables sets an option that only exists to match an existing schema: plain invitation tokens, webhook secrets or credentials in a column, non-text webhook ids, a custom outbox source, or audit values mapped to an adopted log's. Remove it once the data matches the managed default.",
+		check: migrationOptions
+	},
+	{
+		code: "BS315",
+		severity: "warning",
+		title: "Table without an audit trigger",
+		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bsb_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `{ table, reason }` entries where `table` is a `schema.table` glob such as `public.*_archive`; a bare glob string still works but gets a finding that asks for the reason. Partitions are covered by their parent.",
+		check: unauditedTables
+	},
+	{
+		code: "BS319",
+		severity: "error",
+		title: "SQL alters a reserved role",
+		description: "A schema file, SQL module or migration alters, drops or changes the memberships of a role supautils reserves on Supabase (`supabase_admin`, `supabase_auth_admin`, `supabase_storage_admin`, `pgbouncer` and the other platform roles). The statement fails on a hosted project. `authenticator`, `authenticated`, `anon` and `service_role` accept `alter role ... set` (for example `pgrst.db_pre_request` or `statement_timeout`) and nothing else.",
+		check: reservedRoles
+	},
+	{
+		code: "BS320",
+		severity: "warning",
+		title: "Table without the session policy",
+		description: "The `sessions` module is in `blocks`, and a table with RLS in `schemas` has no restrictive policy that calls `better_supabase.session_active()`, so a token whose session was signed out, or whose user was banned or deleted, keeps reaching it until it expires. `blocks['sessions'].options.policies` writes the policy on every table; `options.exclude` lists the tables to skip, as `schema.table` globs.",
+		check: sessionlessTables
+	},
+	{
+		code: "BS322",
+		severity: "warning",
+		title: "Audit registration of a dropped table",
+		description: "The `audit` module is in `blocks`, and `better_supabase.audited_tables` on the live database has a row whose table no longer exists. A table dropped before the module's `sql_drop` event trigger was installed keeps its row; the module's data migration deletes such rows.",
+		check: danglingAuditRegistrations
+	},
+	{
+		code: "BS323",
+		severity: "warning",
+		title: "Module event trigger missing",
+		description: "A module in `blocks` creates an event trigger (`bsb_audit_forget_dropped` for `audit`, `bsb_ensure_rls` for `rls-guard`) that the live database lacks, or, without a database, that no migration creates. Event triggers belong to no schema, so a schema diff limited to some schemas leaves them out; the module's data migration creates them.",
+		check: missingEventTriggers
+	},
+	{
+		code: "BS324",
+		severity: "error",
+		title: "Shared roles table without a role condition",
+		description: "Under the `provider` model, the tenant module's `roleThrough` and the invitations module's `platformRoles.through` name the same roles table, and one of them has no `where` condition on `{row}`. That side then resolves a role id or key of the other kind: an organization invitation, accept or `update_member_role` can grant a platform role, or a platform invitation a tenant role. `upgrade` refuses the config; set `where` on both, such as `{row}.scope = 'organization'` and `{row}.scope = 'system'`.",
+		check: sharedRoleTables
+	},
+	{
+		code: "BS325",
+		severity: "warning",
+		title: "Audit log readable only as the service role",
+		description: "The `audit` module defaults `eventRoles` to `service_role` and `readPolicy` to false, so `audit.list()` under a user session is 403. Set `options.readPolicy: true` and include `authenticated` in `options.eventRoles` when the app lists the log as the signed-in user.",
+		check: auditUserSession
+	},
+	{
+		code: "BS326",
+		severity: "warning",
+		title: "Admin Auth call without a secret key in env files",
+		description: "`deleteAccount` and `bsb.admin()` need `SUPABASE_SECRET_KEY`. The env files doctor reads do not set it, so those calls fail at run time.",
+		check: missingSecretKey
+	},
+	{
+		code: "BS327",
+		severity: "warning",
+		title: "aal2 required without MFA enabled",
+		description: "The app calls `requireAal('aal2')` (or otherwise requires aal2), but `[auth.mfa.totp]` in `config.toml` does not enable enroll and verify, so no user can satisfy the check.",
+		check: aal2WithoutMfa
+	},
+	{
+		code: "BS330",
+		severity: "error",
+		title: "App table without a column a block uses",
+		description: "A block runs over a table of the app's, and the live database lacks a column its SQL names, so its functions fail until the block's migration adds it. The check reads every column the module's SQL names (`blocks.<name>.tables` and `columns`, with the defaults for unmapped ones); columns mapped to `null` are skipped. A column on a table that `blocks.<name>.on` names isn't added by the block: map it or add it.",
+		check: missingAdoptedColumns
+	},
+	{
+		code: "BS331",
+		severity: "error",
+		title: "Subject registry names a missing table or column",
+		description: "An entry in `config.records` names a table, or a column of it (`id`, `tenant`, `title`, `deletedAt`, the `url` placeholders, `rank` and `search`), that the snapshot lacks. `subject_title`, `subject_url`, `can_subject` and every module that falls back to the registry then fail when they run.",
+		check: missingSubjectColumns
+	},
+	{
+		code: "BS332",
+		severity: "warning",
+		title: "Subject table without RLS",
+		description: "A table in `config.records` has row level security disabled. `can_subject` treats a row the caller can read as visible, so without RLS every signed-in user passes the visibility half of the check for every row.",
+		check: subjectsWithoutRls
+	},
+	{
+		code: "BS345",
+		severity: "warning",
+		title: "Attachments subject on block-wide keys with stricter RLS",
+		description: "An `attachments` subject has no `read` or `upload` key of its own, so its files are checked with the block-wide `attachments.read` and `attachments.upload` keys, but the subject table's own policies check more than tenant membership: a permission key of their own, an owner or `auth.uid()` comparison, or another condition. Any member of the tenant then reads and uploads files of rows they can't open. Doctor recognizes `current_tenant_id()`, `tenant_ids_with`, `member_<tenant>_ids`, `can('tenant', ...)` and `member_can` with the block's key as tenant membership. Set `subjects.<type>.permissions.upload`, or `blocks.attachments.on.<type>.permissions` for `read`, to the keys the table checks.",
+		check: attachmentSubjectsOnDefaults
+	},
+	{
+		code: "BS346",
+		severity: "warning",
+		title: "Block on names an unknown record type",
+		description: "A block entry's `on` lists a type, or has a key, that `config.records` doesn't register, so the block's SQL refuses it when `gen` renders the migration. Register the type in `config.records` or remove it from `on`.",
+		check: onUnknownRecordTypes
+	},
+	{
+		code: "BS347",
+		severity: "warning",
+		title: "Block policy widens an app table's access",
+		description: "A block runs over a table of the app's and adds its own permissive policy there, named `bsb_<table>_<command>` so it never replaces one of the app's. Postgres ORs permissive policies, so when the app has its own policies for that command and none has the same condition (or `true`) for the same roles, the block's policy can let a user reach rows the app's policies keep closed. A block condition that is the app's, or one of its `or` operands, with more `and` operands is narrower and isn't reported, nor is a command the app has no policy for, which is the block's to grant. Doctor compares the conditions as text. When an app policy covers the block's in this sense, `upgrade` leaves the block's policy out. Repeat the block's condition in the app's policy when it is what the app means; otherwise narrow the permission key the block checks, or drop the `bsb_` policy in a schema file that runs after the block's.",
+		check: widenedAppTablePolicies
+	},
+	{
+		code: "BS348",
+		severity: "info",
+		title: "App table keeps its own updated_at trigger",
+		description: "A block runs over a table of the app's that already has a trigger keeping `updated_at` current (one that calls `set_updated_at`, `moddatetime` or a function that sets `new.updated_at`), so the block adds no `bsb_updated_at` trigger there. Keep that trigger firing on update; if you drop it, run `better-supabase upgrade` to add the block's.",
+		check: keptUpdatedAtTriggers
+	},
+	{
+		code: "BS335",
+		severity: "warning",
+		title: "Partitioned table created unpartitioned",
+		description: "A block's `options.partitioned` is on (`audit`, `outbox`, `usage` with `history`, `webhooks` or `notifications`), but its table was created before it: the primary key is `id` alone, so the table isn't partitioned by month and its purge deletes row by row. The tables are `better_supabase.audit_events`, `outbox_events`, `usage_history`, `webhook_deliveries` and `notification_delivery_events`. Postgres can't convert a table in place. Create a partitioned table, copy the rows over and swap the names in a maintenance window, or turn the option off.",
+		check: unpartitionedTables
+	}
+];
+/**
+* The table each block's `options.partitioned` partitions, and the option it
+* also needs.
+*/
+const PARTITIONED_TABLES = [
+	{
+		block: "audit",
+		table: "audit_events"
+	},
+	{
+		block: "outbox",
+		table: "outbox_events"
+	},
+	{
+		block: "usage",
+		table: "usage_history",
+		requires: "history"
+	},
+	{
+		block: "webhooks",
+		table: "webhook_deliveries"
+	},
+	{
+		block: "notifications",
+		table: "notification_delivery_events"
+	}
+];
+function unpartitionedTables(context) {
+	const { tables } = catalogOf(context);
+	return PARTITIONED_TABLES.flatMap(({ block, table, requires }) => {
+		const options = context.config.blocks[block]?.options ?? {};
+		if (!context.config.blockNames.includes(block) || options["partitioned"] !== true || requires !== void 0 && options[requires] !== true) return [];
+		if (tables.find((candidate) => candidate.schema === "better_supabase" && candidate.name === table)?.primaryKey.length !== 1) return [];
+		return [{
+			message: `better_supabase.${table} isn't partitioned, so blocks.${block}.options.partitioned has no effect on it. Postgres can't convert it in place: copy the rows into a partitioned table in a maintenance window, or turn the option off.`,
+			target: `better_supabase.${table}`
+		}];
+	});
+}
+function subjectTables(context) {
+	const catalog = catalogOf(context);
+	return Object.entries(context.config.subjects).flatMap(([type, entry]) => {
+		const [schema, name] = entry.table.includes(".") ? entry.table.split(".", 2) : ["public", entry.table];
+		if (schema === void 0 || name === void 0) return [];
+		if (!context.snapshot.schemas.includes(schema)) return [];
+		return [{
+			type,
+			entry,
+			schema,
+			name,
+			table: catalog.tables.find((candidate) => candidate.schema === schema && candidate.name === name)
+		}];
+	});
+}
+function missingSubjectColumns(context) {
+	return subjectTables(context).flatMap(({ type, entry, schema, name, table }) => {
+		const target = `${schema}.${name}`;
+		if (!table) return [{
+			message: `subjects.${type} names ${target}, which the database does not have. Create the table, or point subjects.${type}.table at the existing one.`,
+			target
+		}];
+		const present = new Set(table.columns.map((column) => column.name));
+		return subjectColumns(entry).filter(([, column]) => !present.has(column)).map(([path, column]) => ({
+			message: `subjects.${type}.${path} names ${target}.${column}, but the table has no such column. Map it to the column that holds the value, or add the column.`,
+			target: `${target}.${column}`,
+			object: tableObject(table)
+		}));
+	});
+}
+function subjectsWithoutRls(context) {
+	return subjectTables(context).flatMap(({ type, table }) => table?.kind === "table" && !table.rls ? [{
+		message: `subjects.${type} is ${table.schema}.${table.name}, which has row level security disabled, so can_subject treats every row as visible. Enable RLS and add the policies that scope it.`,
+		target: `${table.schema}.${table.name}`,
+		object: tableObject(table)
+	}] : []);
+}
+function auditUserSession(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const options = context.config.blocks["audit"]?.options ?? {};
+	const roles = Array.isArray(options["eventRoles"]) ? options["eventRoles"].filter((role) => typeof role === "string") : ["service_role"];
+	if (options["readPolicy"] === true && roles.includes("authenticated")) return [];
+	if (!context.sources.some((file) => /\baudit\.(list|listAll)\s*\(/.test(file.text))) return [];
+	return [{
+		message: "blocks.audit leaves the log readable only as the service role (`eventRoles` defaults to service_role, `readPolicy` defaults to false), but the app calls audit.list() or audit.listAll() as a user. Set options.readPolicy to true and include authenticated in options.eventRoles.",
+		target: "blocks.audit"
+	}];
+}
+function missingSecretKey(context) {
+	if (!context.sources.some((file) => /\bdeleteAccount\b|\.admin\s*\(|supabaseAdmin\b/.test(file.text))) return [];
+	if (context.envFiles.some((file) => /^\s*(?:SUPABASE_SECRET_KEY|SUPABASE_SERVICE_ROLE_KEY)\s*=/m.test(file.text))) return [];
+	return [{
+		message: "The app calls deleteAccount or bsb.admin(), which need SUPABASE_SECRET_KEY, but no env file doctor reads sets it. Add it to .env.local (and the hosted environments), listed without a value in .env.example.",
+		target: "SUPABASE_SECRET_KEY"
+	}];
+}
+function aal2WithoutMfa(context) {
+	const toml = context.configToml;
+	if (!toml) return [];
+	if (!context.sources.some((file) => /requireAal\s*\(\s*['"]aal2['"]/.test(file.text))) return [];
+	const enroll = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"enroll_enabled"
+	]);
+	const verify = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"verify_enabled"
+	]);
+	if (enroll === true && verify === true) return [];
+	return [{
+		message: "The app requires aal2, but [auth.mfa.totp] in config.toml does not set enroll_enabled and verify_enabled to true, so no user can satisfy the check.",
+		target: toml.path,
+		location: {
+			file: toml.path,
+			line: lineOf(toml.text, /^\[auth\.mfa\.totp\]/) ?? 1
+		}
+	}];
+}
+//#endregion
+//#region src/cli/doctor/not-valid.ts
+/** `(organization_id IS NOT NULL)` as `organization_id`. */
+const NOT_NULL = /^\(*\s*("(?:[^"]|"")+"|[\w$]+)\s+is\s+not\s+null\s*\)*$/iu;
+const notNullColumn = (expression) => NOT_NULL.exec(expression)?.[1]?.replace(/^"(.*)"$/su, "$1");
+/**
+* Lifts the statement timeout of the introspection connection for one
+* statement, since a validate scans the whole table.
+*/
+const untimed = (sql) => `begin; set local statement_timeout = 0; ${sql} commit;`;
+const NOT_VALID_RULES = [{
+	code: "BS236",
+	severity: "info",
+	title: "Not valid check ready to validate",
+	description: "A check constraint was added `not valid`, the expand step for a column that existing rows don't fill yet, and no row fails it any more. `doctor --fix` runs `alter table ... validate constraint`, which scans the table without blocking writes. After that, `set not null` on the column needs no scan. A check that rows still fail is reported as info, with the `db backfill` command for a not-null check; BS238 reports the scope column of an enriched app table instead. Needs a database; saved snapshots skip it.",
+	async check(context) {
+		const db = context.database;
+		if (!db || "skipped" in db) return [];
+		let checks;
+		try {
+			checks = await db.query(`select n.nspname as schema, t.relname as table, c.conname as name, pg_get_expr(c.conbin, c.conrelid) as expression
+from pg_catalog.pg_constraint c
+join pg_catalog.pg_class t on t.oid = c.conrelid
+join pg_catalog.pg_namespace n on n.oid = t.relnamespace
+where c.contype = 'c' and not c.convalidated and t.relkind in ('r', 'p')
+  and n.nspname not like 'pg\\_%'
+  and n.nspname not in (${[...PLATFORM_SCHEMAS].map(literal$1).join(", ")})
+order by 1, 2, 3`);
+		} catch (cause) {
+			return [{ message: `Could not read the not valid checks (${db.describe}): ${errorText(cause)}` }];
+		}
+		const findings = [];
+		const owned = new Set(context.codes?.includes("BS238") === true ? scopedAppTables(context).filter((table) => table.enriched).map((table) => `public.${table.name}:${scopeCheckName(table)}`) : []);
+		for (const check of checks) {
+			const table = `${ident$1(check.schema)}.${ident$1(check.table)}`;
+			const where = `${check.schema}.${check.table}`;
+			const target = `${where}:${check.name}`;
+			const object = {
+				kind: "table",
+				schema: check.schema,
+				name: check.table
+			};
+			const column = notNullColumn(check.expression);
+			let failing;
+			try {
+				const [row] = await db.query(`select exists (select 1 from ${table} where not (${check.expression})) as failing`);
+				failing = row?.failing === true;
+			} catch (cause) {
+				findings.push({
+					message: `Could not check ${check.name} on ${where}: ${errorText(cause)}`,
+					target,
+					object
+				});
+				continue;
+			}
+			if (failing) {
+				if (owned.has(target)) continue;
+				findings.push({
+					message: `${where} has the not valid check ${check.name} (${check.expression}), and rows still fail it.${column === void 0 ? " Fix those rows, then run `better-supabase doctor --fix`." : ` Fill ${column} with \`better-supabase db backfill ${check.schema === "public" ? "" : `${check.schema}.`}${check.table}.${column} --from <table.column> via <column>\` (or --value), then run \`better-supabase doctor --fix\`.`}`,
+					target,
+					object
+				});
+				continue;
+			}
+			findings.push({
+				message: `${where} has the not valid check ${check.name} (${check.expression}), and no row fails it. Run \`better-supabase doctor --fix\` to validate it${column === void 0 ? "." : `; then \`alter table ${table} alter column ${ident$1(column)} set not null\` needs no scan.`}`,
+				target,
+				object,
+				fix: untimed(`alter table ${table} validate constraint ${ident$1(check.name)};`)
+			});
+		}
+		return findings;
+	}
+}];
+//#endregion
+//#region src/cli/doctor/pgdelta.ts
+/** `config.toml` when the project runs the pg-delta workflow. */
+function pgdeltaToml(context) {
+	const toml = context.configToml;
+	return toml !== void 0 && workflowOf(context) === "pg-delta" ? toml : void 0;
+}
+/**
+* Comments blanked out, so a commented-out statement never matches and line
+* numbers stay.
+*/
+function withoutComments(text) {
+	return text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, (comment) => " ".repeat(comment.length));
+}
+const lineAt$1 = (text, index) => text.slice(0, index).split("\n").length;
+/**
+* The declarative schema files pg-delta loads, outside the SQL module files
+* better-supabase writes, when the project diffs with pg-delta.
+*/
+function pgdeltaSchemaFiles(context) {
+	const toml = pgdeltaToml(context);
+	if (toml === void 0) return [];
+	const schemas = `${declarativeSchemasDir(toml, "pg-delta")}/`;
+	return (context.sqlFiles ?? []).filter((file) => file.path.startsWith(schemas) && !/^-- @(?:bsb-block|bs-module) /m.test(file.text));
+}
+const BULK_GRANT = /\bgrant\b[^;]*?\bon\s+all\s+(tables|routines|functions|procedures|sequences)\s+in\s+schema\s+("?[\w$]+"?(?:\s*,\s*"?[\w$]+"?)*)\s+to\s+([^;]*)/gi;
+/** Grantees a bulk grant must not reach: the Data API roles and `public`. */
+const API_ROLES = /\b(anon|authenticated|public)\b/i;
+/** `do` blocks; group 2 is the body. */
+const DO_BLOCK = /\bdo\s+(\$[\w]*\$)([\s\S]*?)\1/gi;
+const CATALOG = /\b(information_schema\.\w+|(?:pg_catalog\.)?pg_(?:class|tables|views|proc|namespace|attribute|trigger|constraint|index|type|policies|matviews))\b/i;
+const EXECUTES = /\b(execute|perform)\b/i;
+function bulkGrants(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(BULK_GRANT)].filter((match) => API_ROLES.test(match[3])).map((match) => ({
+			message: `${file.path} grants on all ${match[1].toLowerCase()} in schema ${match[2]} at once. pg-delta gives a bulk grant no dependency position, so it can run after the per-object revokes and open functions and tables to anon and authenticated again. Grant each object by name next to its definition, or set Supabase default privileges (alter default privileges in schema ... grant ...) for objects created later.`,
+			target: file.path,
+			location: {
+				file: file.path,
+				line: lineAt$1(text, match.index)
+			}
+		}));
+	});
+}
+function catalogLoops(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(DO_BLOCK)].flatMap((match) => {
+			const body = match[2];
+			const catalog = CATALOG.exec(body);
+			if (!catalog || !EXECUTES.test(body)) return [];
+			return [{
+				message: `${file.path} has a do block that reads ${catalog[1]} to create objects. pg-delta runs a do block with no dependency position, before the tables it looks for exist, so it creates nothing and the diff never sees its objects. Write the statements it would generate (one trigger, grant or policy per table) as static SQL, or call a per-table function such as better_supabase.audit('<table>') or track_updated_at('<table>') once per table.`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt$1(text, match.index)
+				}
+			}];
+		});
+	});
+}
+const CREATE_EXTENSION = /\bcreate\s+extension\s+(?:if\s+not\s+exists\s+)?"?([\w-]+)"?/gi;
+/**
+* `text` without comments and with string literals blanked, keeping every
+* offset, so an error message that tells the reader to `create extension`
+* doesn't count as one.
+*/
+const statements = (text) => withoutComments(text).replaceAll(/'(?:[^']|'')*'/g, (literal) => literal.replaceAll(/[^\n]/g, " "));
+/**
+* Extensions a pg-delta schema file creates, SQL module files included, that no
+* migration creates. pg-delta can leave an extension that owns its own schema
+* (`pgmq`) out of the generated migration.
+*/
+function missingExtensions(context) {
+	const toml = pgdeltaToml(context);
+	if (toml === void 0) return [];
+	const schemas = `${declarativeSchemasDir(toml, "pg-delta")}/`;
+	const files = context.sqlFiles ?? [];
+	const migrations = files.filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	const created = new Set(migrations.flatMap((file) => [...statements(file.text).matchAll(CREATE_EXTENSION)].map((match) => match[1].toLowerCase())));
+	const seen = /* @__PURE__ */ new Set();
+	return files.filter((file) => file.path.startsWith(schemas)).flatMap((file) => {
+		const text = statements(file.text);
+		return [...text.matchAll(CREATE_EXTENSION)].flatMap((match) => {
+			const name = match[1].toLowerCase();
+			if (created.has(name) || seen.has(name)) return [];
+			seen.add(name);
+			const module = /^-- @(?:bsb-block|bs-module) /m.test(file.text);
+			return [{
+				message: `${file.path} creates the extension ${name}, but no migration creates it. pg-delta can leave an extension that owns its own schema out of the generated migration, and a database built from the migrations then lacks it. ${module ? "Run `better-supabase upgrade`: it writes the extension into a migration that runs before the schema migration." : `Add \`create extension if not exists ${name};\` to a migration that runs before the one that uses it.`}`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt$1(text, match.index)
+				}
+			}];
+		});
+	});
+}
+/** Statements in declarative schema files that pg-delta can't order. */
+const PGDELTA_RULES = [
+	{
+		code: "BS317",
+		severity: "warning",
+		title: "Bulk grant in a pg-delta schema file",
+		description: "A `grant ... on all tables|routines|sequences in schema ... to anon|authenticated|public` statement in `supabase/schemas` under pg-delta. pg-delta can't place it after the objects it covers or before the revokes that narrow them, so it can re-open functions and tables to `anon` and `authenticated`.",
+		check: bulkGrants
+	},
+	{
+		code: "BS318",
+		severity: "warning",
+		title: "Catalog loop in a pg-delta schema file",
+		description: "A `do` block in `supabase/schemas` under pg-delta that reads the catalog (`information_schema`, `pg_class`, ...) to create objects. pg-delta runs it before the tables exist, so it creates nothing.",
+		check: catalogLoops
+	},
+	{
+		code: "BS321",
+		severity: "warning",
+		title: "Extension missing from the migrations under pg-delta",
+		description: "A `create extension` in `supabase/schemas` (a SQL module's file included) under pg-delta that no migration repeats. pg-delta can leave an extension that owns its own schema, such as `pgmq`, out of the generated migration.",
+		check: missingExtensions
+	}
+];
+//#endregion
+//#region src/cli/doctor/policies.ts
+const AUTH_ROLE = /\bauth"?\s*\.\s*"?role"?\s*\(\s*\)/i;
+/** A check of who is calling: the JWT, the user id, or the session role. */
+const CALLER_CHECK = /\bauth"?\s*\.\s*"?(?:uid|jwt)"?\s*\(|request\.jwt|\b(?:current_user|session_user|current_role)\b|has_organization_role|member_organization_ids/i;
+const USER_METADATA = /\buser_metadata\b/i;
+/** Privileges an API role never needs on a table. */
+const NEEDLESS = [
+	"TRUNCATE",
+	"REFERENCES",
+	"TRIGGER"
+];
+const policyText = (policy) => withoutStrings(`${policy.using ?? ""} ${policy.check ?? ""}`);
+/** A permissive policy lets `role` run `command` on the table. */
+const allows = (table, command, role) => table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+/** Policy commands on `storage.objects` the SQL files create, by policy name. */
+function storagePolicies(context) {
+	const commands = /* @__PURE__ */ new Map();
+	const pattern = /create\s+policy\s+("(?:[^"]|"")+"|\S+)\s+on\s+"?storage"?\s*\.\s*"?objects"?\b([^;]*)/gi;
+	for (const file of context.sqlFiles ?? []) for (const match of withoutStrings(file.text).matchAll(pattern)) {
+		const name = match[1];
+		if (commands.has(name)) continue;
+		const command = /\bfor\s+(select|insert|update|delete|all)\b/i.exec(match[2])?.[1];
+		commands.set(name, command?.toLowerCase() ?? "all");
+	}
+	return commands;
+}
+const POLICY_RULES = [
+	{
+		code: "BS109",
+		severity: "warning",
+		title: "auth.role() in a policy or function",
+		description: "Supabase deprecated `auth.role()`. Scope the policy with `to authenticated`, or read the claim with `(select auth.jwt() ->> 'role')`.",
+		check: (context) => {
+			const findings = [];
+			for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+				if (!AUTH_ROLE.test(policyText(policy))) continue;
+				findings.push({
+					message: `Policy "${policy.name}" on ${qualified(table)} calls auth.role(), which Supabase deprecated. Use \`to authenticated\` on the policy, or \`(select auth.jwt() ->> 'role')\`.`,
+					target: `${qualified(table)}.${policy.name}`,
+					object: policyObject(table, policy)
+				});
+			}
+			const bodies = new Map(policyHelpers(context));
+			for (const fn of context.snapshot.generator.functions) {
+				if (!context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				bodies.set(`${fn.schema}.${fn.name}`, withoutStrings(fn.definition));
+			}
+			for (const [name, body] of bodies) {
+				if (!AUTH_ROLE.test(body)) continue;
+				const dot = name.indexOf(".");
+				findings.push({
+					message: `${name} calls auth.role(), which Supabase deprecated. Read \`auth.jwt() ->> 'role'\` instead.`,
+					target: name,
+					object: {
+						kind: "function",
+						schema: name.slice(0, dot),
+						name: name.slice(dot + 1)
+					}
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS110",
+		severity: "warning",
+		title: "Update policy without a select policy or with check",
+		description: "An update has to find the rows first, so without a select policy for the same role it matches no rows and reports success. Without `with check`, Postgres checks the new row against `using`, which hides whether moving a row to another owner or tenant is allowed.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (!table.rls) return [];
+			return table.policies.flatMap((policy) => {
+				if (!policy.permissive || policy.command !== "update") return [];
+				const blind = (policy.roles.length === 0 || policy.roles.includes("public") ? ["anon", "authenticated"] : policy.roles).filter((role) => !allows(table, "select", role));
+				const target = `${qualified(table)}.${policy.name}`;
+				if (blind.length > 0) return [{
+					message: `Policy "${policy.name}" on ${qualified(table)} allows update for ${blind.join(", ")}, but no select policy does, so updates match no rows without an error. Add a select policy for ${blind.join(", ")}.`,
+					target,
+					object: policyObject(table, policy)
+				}];
+				if (policy.check !== null) return [];
+				return [{
+					severity: "info",
+					message: `Policy "${policy.name}" on ${qualified(table)} has no \`with check\`, so Postgres checks updated rows against \`using\`. State the rule for the new row with \`with check (...)\`.`,
+					target,
+					object: policyObject(table, policy)
+				}];
+			});
+		})
+	},
+	{
+		code: "BS111",
+		severity: "warning",
+		title: "API roles hold privileges they don't use",
+		description: "`anon` and `authenticated` never need `truncate`, `references` or `trigger`, and `truncate` skips RLS. A grant to `anon` on a table no policy opens to it does nothing except list the table in the Data API schema.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const findings = [];
+			for (const role of ["anon", "authenticated"]) {
+				const privileges = new Set(table.grants.filter((grant) => grant.role === role).flatMap((grant) => grant.privileges));
+				const needless = NEEDLESS.filter((privilege) => privileges.has(privilege));
+				if (needless.length > 0) findings.push({
+					message: `${role} has ${needless.join(", ").toLowerCase()} on ${qualified(table)}. \`truncate\` bypasses RLS. Run \`revoke ${needless.join(", ").toLowerCase()} on table ${qualified(table)} from ${role};\`.`,
+					target: `${qualified(table)}:${role}`,
+					object: tableObject(table)
+				});
+				if (role !== "anon" || !table.rls) continue;
+				const unused = COMMANDS$2.filter((command) => privileges.has(command.toUpperCase()) && !allows(table, command, role));
+				if (unused.length > 0) findings.push({
+					severity: "info",
+					message: `anon has ${unused.join(", ")} on ${qualified(table)}, but no policy allows it for anon, so the grant only lists the table in the Data API schema. Run \`revoke ${unused.join(", ")} on table ${qualified(table)} from anon;\`.`,
+					target: `${qualified(table)}:anon:unused`,
+					object: tableObject(table)
+				});
+			}
+			return findings;
+		})
+	},
+	{
+		code: "BS112",
+		severity: "warning",
+		title: "Exposed security definer function that doesn't check the caller",
+		description: "A `security definer` function in an exposed schema runs as its owner, past RLS, and the Data API serves it at `/rpc`. When anon or authenticated may execute it and its body never reads `auth.uid()` or `auth.jwt()`, any caller gets the owner's access. Check the caller, revoke `execute`, or move it to a schema the API doesn't expose.",
+		check: (context) => (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+			if (!fn.securityDefiner || !context.config.schemas.includes(fn.schema)) return [];
+			const callers = fn.execute ?? [];
+			if (callers.length === 0) return [];
+			const body = functionBody(context, fn.schema, fn.name);
+			if (body === void 0 || CALLER_CHECK.test(body)) return [];
+			return [{
+				message: `${fn.schema}.${fn.name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and it never checks auth.uid() or auth.jwt(). Check the caller, run \`revoke execute on function ${fn.schema}.${fn.name}(${fn.signature}) from ${callers.join(", ")};\`, or move it to a private schema.`,
+				target: `${fn.schema}.${fn.name}`,
+				object: functionObject(fn)
+			}];
+		})
+	},
+	{
+		code: "BS113",
+		severity: "info",
+		title: "Storage upload policy without the upsert policies",
+		description: "An upload with `upsert: true` (`x-upsert`) needs `select` and `update` policies on `storage.objects` besides `insert`; without them, replacing an existing file fails with a 403. Doctor reads the policies in `supabase/schemas` and the migrations.",
+		check: (context) => {
+			const commands = new Set(storagePolicies(context).values());
+			if (!commands.has("insert") || commands.has("all")) return [];
+			const missing = ["select", "update"].filter((command) => !commands.has(command));
+			if (missing.length === 0) return [];
+			return [{
+				message: `storage.objects has an insert policy but no ${missing.join(" or ")} policy, so uploads with \`upsert: true\` fail with 403 when the file exists. Add ${missing.join(" and ")} policies with the same bucket and path check.`,
+				target: "storage.objects"
+			}];
+		}
+	},
+	{
+		code: "BS114",
+		severity: "error",
+		title: "Policy helper reads user_metadata",
+		description: "Users can change their own `raw_user_meta_data` with `auth.updateUser()`, so a helper that reads `user_metadata` to decide access lets them grant themselves rights. Read `app_metadata`, which only the service role can write. Splinter's `rls_references_user_metadata` covers the policy text; this covers the functions policies call.",
+		check: (context) => [...policyHelpers(context).keys()].flatMap((name) => {
+			const dot = name.indexOf(".");
+			const body = functionBody(context, name.slice(0, dot), name.slice(dot + 1));
+			if (!body || !USER_METADATA.test(body)) return [];
+			return [{
+				message: `${name} reads user_metadata, which users can write themselves, and policies call it. Read \`auth.jwt() -> 'app_metadata'\` instead.`,
+				target: name,
+				object: {
+					kind: "function",
+					schema: name.slice(0, dot),
+					name: name.slice(dot + 1)
+				}
+			}];
+		})
+	},
+	{
+		code: "BS115",
+		severity: "warning",
+		title: "Table without a policy still granted to the Data API",
+		description: "A table with RLS on and no permissive policy for `anon` or `authenticated` answers every Data API request with no rows or a denied write, yet a grant lists it in the API schema. Under `blocks['grants'].options.fromPolicies`, `better-supabase upgrade` revokes these grants and keeps `service_role`; until the migration is applied, doctor reports the live grants. Tables in `expose` are skipped.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table" || !table.rls) return [];
+			const options = configFor(context.config.tables, table.schema, table.name);
+			if (options?.exclude || options?.serviceRole) return [];
+			if (context.config.expose[qualified(table)] ?? context.config.expose[table.name]) return [];
+			const roles = ["anon", "authenticated"].filter((role) => table.grants.some((grant) => (grant.role === role || grant.role === "PUBLIC") && grant.privileges.length > 0));
+			if (roles.length === 0) return [];
+			if (table.policies.some((policy) => policy.permissive && roles.some((role) => appliesTo(policy, role)))) return [];
+			return [{
+				message: `${qualified(table)} has RLS on and no permissive policy for ${roles.join(" or ")}, but ${roles.join(" and ")} still hold grants on it. Run \`revoke all on table ${qualified(table)} from public, anon, authenticated;\`, or set \`blocks['grants'].options.fromPolicies\` and run \`better-supabase upgrade\` so the migration revokes it.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS116",
+		severity: "warning",
+		title: "Security definer function open to the API roles without being exposed",
+		description: "Postgres grants `execute` on a new function to `public`, so a `security definer` function in an exposed schema is callable at `/rpc` by `anon` and `authenticated` unless it is revoked. When no `expose` entry lists it and no policy calls it, nothing in the project says the API roles should reach it. Doctor never revokes it; list it in `expose` with the roles that call it, or revoke `execute` from `public`, `anon` and `authenticated` and grant it back to those roles.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			const listed = /* @__PURE__ */ new Set([...Object.keys(context.config.exposeFunctions).map((signature) => {
+				const name = signature.slice(0, signature.indexOf("(")).trim();
+				return name.includes(".") ? name : `public.${name}`;
+			})]);
+			const inPolicies = new Set(catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? [])));
+			return (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+				const name = `${fn.schema}.${fn.name}`;
+				const callers = fn.execute ?? [];
+				if (!fn.securityDefiner || !schemas.includes(fn.schema) || callers.length === 0 || listed.has(name) || inPolicies.has(name)) return [];
+				return [{
+					message: `${name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and no \`expose\` entry or policy uses it. Run \`revoke all on function ${name}(${fn.signature}) from public, anon, authenticated;\`, then \`grant execute on function ${name}(${fn.signature}) to <the roles that call it>;\`, or list it in \`expose\`.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS117",
+		severity: "warning",
+		title: "Policy without a role",
+		description: "A policy without `to`, or with `to public`, applies to `public`, which is every role, `anon` included. Postgres then evaluates it for requests it was never meant for, and a later change to its expression can open the table to signed-out users. Name the roles with `to authenticated` (or `to anon, authenticated`). Restrictive policies only narrow access, so they are skipped.",
+		check: (context) => catalogOf(context).tables.flatMap((table) => table.policies.filter((policy) => policy.permissive && (policy.roles.length === 0 || policy.roles.includes("public"))).map((policy) => ({
+			message: `Policy "${policy.name}" on ${qualified(table)} applies to public (no \`to\` role, or \`to public\`), which is every role, anon included. Recreate it with \`to authenticated\`, or list the roles that need it.`,
+			target: `${qualified(table)}.${policy.name}`,
+			object: policyObject(table, policy)
+		})))
+	},
+	{
+		code: "BS215",
+		severity: "warning",
+		title: "Policy calls a helper per row that could run once",
+		description: "A call such as `current_tenant_id()` takes no column of the row, so its result is the same for every row. Wrapped as `(select current_tenant_id())`, Postgres runs it once per statement as an InitPlan. Splinter's `auth_rls_initplan` covers `auth.*` calls; this covers your own helpers.",
+		check: (context) => {
+			const volatility = new Map((context.snapshot.extras.functions ?? []).map((fn) => [`${fn.schema}.${fn.name}`, fn.volatility]));
+			return exposed(context).flatMap((table) => {
+				if (!table.rls) return [];
+				return table.policies.flatMap((policy) => {
+					const text = policyText(policy);
+					const bare = (policy.functions ?? []).filter((name) => {
+						const dot = name.indexOf(".");
+						const schema = name.slice(0, dot);
+						if (schema === "auth" || volatility.get(name) === "immutable") return false;
+						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$2(schema)}"?\\.)?"?${escape$2(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
+					});
+					if (bare.length === 0) return [];
+					return [{
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${bare.map((name) => `${name}()`).join(", ")} without \`(select ...)\`, so it runs once per row. Write \`(select ${bare[0]}())\`.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}];
+				});
+			});
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/realtime.ts
+/** The comment `topic.trigger(..., { payload: "row" })` puts on its function. */
+const ROW_PAYLOAD_MARKER = "better-supabase: payload row";
+const BROADCAST_ROW = /realtime\.broadcast_changes\s*\([^;]*\b(?:new|old)\b|'old_record'/i;
+/** Whether a trigger function body sends `new` or `old` whole. */
+function sendsWholeRow(source) {
+	return BROADCAST_ROW.test(source.replaceAll(/--[^\n]*/g, ""));
+}
+/** Realtime checks that read the trigger functions in the snapshot. */
+const REALTIME_RULES = [{
+	code: "BS337",
+	severity: "warning",
+	title: "Broadcast trigger sends whole rows",
+	description: "A trigger function sends the whole row to Realtime with `realtime.broadcast_changes(..., new, old)` or `old_record` and `record`, and has no `payload: \"row\"` marker. Subscribers then see every column, including ones their column grants hide.",
+	check: (context) => catalogOf(context).tables.flatMap((table) => table.triggers.filter((trigger) => trigger.source !== void 0 && trigger.comment !== ROW_PAYLOAD_MARKER && sendsWholeRow(trigger.source)).map((trigger) => ({
+		message: `${trigger.name} on ${qualified(table)} calls ${trigger.function}(), which broadcasts whole rows. Regenerate it with \`topic.trigger()\`, whose default payload sends the primary key and the topic values, or pass \`payload: "row"\` to keep whole rows on purpose.`,
+		target: `${qualified(table)}.${trigger.name}`,
+		object: tableObject(table)
+	})))
+}];
+//#endregion
+//#region src/cli/doctor/removed-apis.ts
+const SPECIFIER = /from\s+["']better-supabase\/([\w./-]+)["']/g;
+const NAMED_IMPORT = /import\s+(?:type\s+)?\{([^}]*)\}\s+from\s+["']better-supabase(?:\/[\w./-]+)?["']/g;
+/** Names 0.15 removed without a one-to-one replacement, with what replaces them. */
+const REMOVED_NAMES = [
+	{
+		pattern: /\b(?:sectionAction|recordServer|defineRecordFeature)\b/,
+		replacement: "the generated record type (`bsb.record(<type>Record)` from `@/lib/supabase/records/<type>`)"
+	},
+	{
+		pattern: /["'][@~]?\/?[\w/]*supabase\/features\//,
+		replacement: "the generated `records/<type>` file"
+	},
+	{
+		pattern: /\b(?:fileMaintenance|updateMaintenance|listMaintenance|maintenanceRequestInputSchema)\b/,
+		replacement: "a tasks instance (`block: \"tasks\"`) and its client"
+	},
+	{
+		pattern: /\bpass_credit_entries\b/,
+		replacement: "`credits(passId)` on the ledger"
+	},
+	{
+		pattern: /\.blockRouter\(/,
+		replacement: "`bsb.router(defineApi(betterSupabase, options))`, which routes every block instance and table"
+	},
+	{
+		pattern: /\brequireTenant\b/,
+		replacement: "`requireOrganization` (`bsb codemod 0.15` renames it)"
+	},
+	{
+		pattern: /["']better-supabase\/(?:blocks\/[\w-]+\/(?:react|vue|svelte|solid)|chat-sdk\/react)["']/,
+		replacement: "the block's React hooks from the registry (`npx shadcn add @better-supabase/use-<block>`), or `useBlockController(create<Block>Controller, options)` from `better-supabase/vue`, `/svelte` or `/solid`"
+	},
+	{
+		pattern: /["']better-supabase\/powersync\/react["']|\buseWatch\b/,
+		replacement: "`engine: powersyncEngine(database, { connector })` on the client and the generated data hooks; `useSyncStatus()` and `useConflicts()` come from `better-supabase/react`"
+	},
+	{
+		pattern: /\bsqliteTables\b/,
+		replacement: "`powersyncEngine(database)`, which refreshes the hooks that read a changed table"
+	},
+	{
+		pattern: /["']better-supabase\/expo-sqlite["']|\bexpoSqliteExecutor\b/,
+		replacement: "`sqliteEngine(expoSqliteDatabase(db))` from `better-supabase/sqlite`, passed as the client's `engine`"
+	},
+	{
+		pattern: /["']better-supabase\/tanstack-db\/supabase["']|\bsupabaseCollection\b/,
+		replacement: "`collectionOptions` from `better-supabase/tanstack-db`, with `tanstackDbEngine({ collections })` and `live: realtimeChanges(...)` for Realtime"
+	},
+	{
+		pattern: /["']better-supabase\/flows["']|\b(?:createFlows|defineFlow|conversationToWorkItem|applicationToEmployee|bookingToEngagement|quoteToOrder)\b/,
+		replacement: "the default automations the blocks ship, run by `createRuleSink` with the conversion actions (`taskFromConversationAction`, `employeeFromApplicationAction`, `orderFromQuoteAction`) in `createActionRegistry`; confirmed bookings become engagements through a database trigger"
+	},
+	{
+		pattern: /\b(?:RuleActionHandler|RuleActionCall)\b/,
+		replacement: "`defineAction` and `createActionRegistry([...])`, passed to `createRuleDispatcher({ actions })` (`ActionHandler`, `ActionCall`)"
+	},
+	{
+		pattern: /\bRULE_ACTION_(?:UNKNOWN|INVALID)\b/,
+		replacement: "the hints `ACTION_UNKNOWN` and `ACTION_CONFIG_INVALID`"
+	},
+	{
+		pattern: /\btriggers\.onEvent\b|\b(?:triggerMatches|triggerWhenProblem|OutboxLikeEvent|WorkflowSinkEvent)\b/,
+		replacement: "an automation whose `workflow` action (`workflowAction(builder)`) starts the definition on the outbox event"
+	}
+];
+function lineAt(text, index) {
+	return text.slice(0, index).split("\n").length;
+}
+function renamedSubpath(subpath) {
+	if (Object.hasOwn(BLOCK_SUBPATH_RENAMES, subpath)) return `better-supabase/${BLOCK_SUBPATH_RENAMES[subpath]}`;
+	if (Object.hasOwn(PLUGIN_SUBPATH_RENAMES, subpath)) {
+		const to = PLUGIN_SUBPATH_RENAMES[subpath];
+		return to ? `better-supabase/${to}` : "better-supabase";
+	}
+	if (Object.hasOwn(SPEC_SUBPATH_RENAMES, subpath)) return `better-supabase/${SPEC_SUBPATH_RENAMES[subpath]}`;
+}
+/**
+* App code that still imports a subpath or name 0.15 renamed or removed
+* (BS418).
+*/
+function removedApis(context) {
+	const findings = [];
+	for (const file of context.sources) {
+		for (const match of file.text.matchAll(SPECIFIER)) {
+			const subpath = match[1] ?? "";
+			const to = renamedSubpath(subpath);
+			if (to !== void 0) findings.push({
+				message: `${file.path} imports \`better-supabase/${subpath}\`, which 0.15 renamed to \`${to}\`. Run \`bsb codemod 0.15\`.`,
+				target: `${file.path}:${subpath}`,
+				location: {
+					file: file.path,
+					line: lineAt(file.text, match.index)
+				}
+			});
+		}
+		for (const match of file.text.matchAll(NAMED_IMPORT)) {
+			const names = (match[1] ?? "").split(",").map((name) => name.trim().replace(/^type\s+/, "").split(/\s+as\s+/)[0]?.trim()).filter((name) => Boolean(name));
+			for (const name of names) if (Object.hasOwn(BLOCK_EXPORT_RENAMES, name)) findings.push({
+				message: `${file.path} imports \`${name}\`, which 0.15 renamed to \`${BLOCK_EXPORT_RENAMES[name]}\`. Run \`bsb codemod 0.15\`.`,
+				target: `${file.path}:${name}`,
+				location: {
+					file: file.path,
+					line: lineAt(file.text, match.index)
+				}
+			});
+		}
+		for (const { pattern, replacement } of REMOVED_NAMES) {
+			const match = pattern.exec(file.text);
+			if (match) findings.push({
+				message: `${file.path} uses \`${match[0].replaceAll(/["']/g, "")}\`, which 0.15 removed. Use ${replacement} instead.`,
+				target: `${file.path}:${match[0]}`,
+				location: {
+					file: file.path,
+					line: lineAt(file.text, match.index)
+				}
+			});
+		}
+	}
+	return findings;
+}
+const REMOVED_API_RULES = [{
+	code: "BS418",
+	severity: "warning",
+	title: "Code uses an API that 0.15 renamed or removed",
+	description: "0.15 renamed blocks and their subpaths, turned the built-in plugins into block extensions, moved the OpenAPI, AsyncAPI, Arazzo and Overlay subpaths into `better-supabase/spec`, replaced record features with record types and flows with default automations. `better-supabase codemod 0.15` rewrites the renames; the removed APIs need the replacement the finding names.",
+	check: removedApis
+}];
+//#endregion
+//#region src/cli/doctor/schema-design.ts
+/** The `format` the database reports for each app column type. */
+const APP_COLUMN_FORMAT = {
+	text: "text",
+	uuid: "uuid",
+	integer: "int4",
+	bigint: "int8",
+	numeric: "numeric",
+	boolean: "bool",
+	timestamptz: "timestamptz",
+	date: "date",
+	jsonb: "jsonb",
+	"text[]": "_text"
+};
+/**
+* Whether a partial index's predicate only skips rows where a key column is
+* null, like `(customer_id IS NOT NULL)`: those rows reference nothing, so the
+* index still serves the key.
+*/
+const skipsNullKeys = (predicate, columns) => {
+	if (!predicate) return false;
+	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$2(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
+};
+/**
+* Whether the first `columns.length` columns of an index are exactly `columns`,
+* in any order, and it holds every row that references something.
+*/
+const covers = (index, columns) => (!index.partial || skipsNullKeys(index.predicate, columns)) && index.columns.length >= columns.length && index.columns.slice(0, columns.length).every((column) => columns.includes(column));
+/** Foreign keys of `table` that no index starts with. */
+const unindexedForeignKeys = (table) => table.foreignKeys.filter((key) => !table.indexes.some((index) => covers(index, key.columns)));
+const SOFT_DELETE = /^(?:deleted|archived)_at$/;
+/** Operators that need a GIN index on jsonb or array columns. */
+const CONTAINS = String.raw`(?:@>|<@|\?\||\?&|\?|&&)`;
+/**
+* `.contains("tags"`, `.containedBy('meta'`, `.overlaps("labels"`, supabase-js
+* filters.
+*/
+const CLIENT_CONTAINS = /\.(?:contains|containedBy|overlaps)\(\s*["'`]([A-Za-z_]\w*)["'`]/g;
+/** Column types Postgres' wiki and the Supabase skills advise against. */
+const AVOID = {
+	timestamp: "timestamptz",
+	varchar: "text with a check constraint",
+	bpchar: "text",
+	money: "numeric",
+	json: "jsonb"
+};
+/**
+* A Supabase direct (`db.<ref>.supabase.co`) or session-pooler (`:5432`)
+* connection string.
+*/
+const DIRECT_URL = /postgres(?:ql)?:\/\/[^\s"'`]*@(?:db\.[a-z0-9]+\.supabase\.co(?::5432)?|[\w.-]+\.pooler\.supabase\.com:5432)\b/i;
+/** Files that show the app runs on serverless or edge functions. */
+const SERVERLESS = /\bexport\s+(?:const\s+runtime|async\s+function\s+(?:GET|POST|PUT|PATCH|DELETE)|default\s+\{\s*(?:async\s+)?fetch)\b|\bDeno\.serve\(/;
+/** A connection string through Supavisor's transaction pooler (port 6543). */
+const TRANSACTION_POOLER = /postgres(?:ql)?:\/\/[^\s"'`]*:6543\b/i;
+/** `import postgres from "postgres"` or `require("postgres")`: postgres.js. */
+const POSTGRES_JS = /\bfrom\s+["']postgres["']|\brequire\(\s*["']postgres["']\s*\)/;
+const PREPARE_OFF = /\bprepare\s*:\s*false\b/;
+const PRISMA = /["']@prisma\/client["']|\bnew\s+PrismaClient\b/;
+const OFFSET_PAGINATION = /\bpagination\s*:\s*["'`]offset["'`]/;
+const EXACT_COUNT = /\bcount\s*:\s*["'`]exact["'`]/;
+/** `format_type` names of scalar results that a JSON number can't hold exactly. */
+const WIDE_RESULT = /^(?:bigint|numeric)(?:\[\])?$/;
+function lines(file) {
+	return file.text.split("\n").map((text, index) => ({
+		line: index + 1,
+		text
+	}));
+}
+const SCHEMA_DESIGN_RULES = [
+	{
+		code: "BS216",
+		severity: "info",
+		title: "Foreign key without an index",
+		description: "Deletes and updates on the referenced table scan the referencing table for each row, and joins on the key can't use an index. Add an index that starts with the key's columns; a partial index counts when its `where` only skips rows whose key is null (`where customer_id is not null`). When the performance advisor (BS200) runs, splinter's `unindexed_foreign_keys` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "unindexed_foreign_keys");
+			return exposed(context).flatMap((table) => {
+				if (table.kind !== "table" || splinter?.has(qualified(table))) return [];
+				return unindexedForeignKeys(table).map((key) => ({
+					message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) has no index that starts with its columns, so deletes on ${key.refSchema}.${key.refTable} scan ${qualified(table)}. Run \`create index on ${qualified(table)} (${key.columns.join(", ")});\`.`,
+					target: `${qualified(table)}.${key.name}`,
+					object: tableObject(table)
+				}));
+			});
+		}
+	},
+	{
+		code: "BS217",
+		severity: "warning",
+		title: "Tenant foreign key that can cross tenants",
+		description: "When a tenant table references another tenant table by `id` alone, a row can point at a parent in another organization; RLS checks each row, not the pair. Reference `(id, organization_id)` with a composite foreign key, backed by `unique (id, organization_id)` on the parent.",
+		check: (context) => {
+			const column = context.config.extensions.tenant?.column;
+			if (!column) return [];
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			const hasTenant = (table) => table?.columns.some((entry) => entry.name === column) ?? false;
+			return exposed(context).flatMap((table) => {
+				if (table.kind !== "table" || !hasTenant(table)) return [];
+				return table.foreignKeys.flatMap((key) => {
+					if (key.columns.includes(column)) return [];
+					const parent = tables.get(`${key.refSchema}.${key.refTable}`);
+					if (!hasTenant(parent) || parent === table) return [];
+					return [{
+						message: `${qualified(table)}.${key.name} references ${key.refSchema}.${key.refTable} (${key.refColumns.join(", ")}) without ${column}, so a row can point at another tenant's ${key.refTable}. Add \`unique (${[...key.refColumns, column].join(", ")})\` to ${key.refTable} and reference \`(${[...key.columns, column].join(", ")})\`.`,
+						target: `${qualified(table)}.${key.name}`,
+						object: tableObject(table)
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS218",
+		severity: "info",
+		title: "Soft-delete table without a partial index",
+		description: "Queries on a table with `deleted_at` or `archived_at` read the live rows (`where deleted_at is null`). A partial index with that predicate stays small and matches those queries.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const column = table.columns.find((entry) => SOFT_DELETE.test(entry.name) && entry.nullable);
+			if (!column) return [];
+			const isNull = new RegExp(`"?${escape$2(column.name)}"?\\s+IS\\s+NULL`, "i");
+			if (table.indexes.some((index) => index.partial && (index.predicate === void 0 || index.predicate !== null && isNull.test(index.predicate)))) return [];
+			return [{
+				message: `${qualified(table)} soft-deletes with ${column.name}, but no index has \`where ${column.name} is null\`. Index the live rows you list, for example \`create index on ${qualified(table)} (created_at desc) where ${column.name} is null;\`.`,
+				target: `${qualified(table)}.${column.name}`,
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS219",
+		severity: "warning",
+		title: "Containment filter on a column without a GIN index",
+		description: "`@>`, `<@`, `?` and `&&` on jsonb and array columns, and the `.contains()`, `.containedBy()` and `.overlaps()` filters, can only use a GIN index. Without one, every query reads the whole table. Doctor looks in policies, exposed functions and `tooling.doctor.sources`.",
+		check: (context) => {
+			const tables = exposed(context).filter((table) => table.kind === "table");
+			const policyText = (table) => withoutStrings(table.policies.map((policy) => `${policy.using ?? ""} ${policy.check ?? ""}`).join(" "));
+			const functions = context.snapshot.generator.functions.filter((fn) => context.config.schemas.includes(fn.schema) && fn.definition).map((fn) => withoutStrings(fn.definition)).join("\n");
+			const filtered = /* @__PURE__ */ new Set();
+			for (const file of context.sources) for (const match of file.text.matchAll(CLIENT_CONTAINS)) filtered.add(match[1]);
+			return tables.flatMap((table) => {
+				const own = policyText(table);
+				return table.columns.filter((column) => {
+					if (!column.isArray && column.udt !== "jsonb") return false;
+					if (table.indexes.some((index) => index.columns[0] === column.name && (index.method === void 0 || index.method === "gin"))) return false;
+					const used = new RegExp(`"?${escape$2(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$2(column.name)}\\b`);
+					return filtered.has(column.name) || used.test(own) || functions.includes(table.name) && used.test(functions);
+				}).map((column) => ({
+					message: `${qualified(table)}.${column.name} is filtered by containment but has no GIN index, so each query scans the table. Run \`create index on ${qualified(table)} using gin (${column.name}${column.udt === "jsonb" ? " jsonb_path_ops" : ""});\`${column.udt === "jsonb" ? " (`jsonb_path_ops` supports `@>` only; drop it for `?`)" : ""}.`,
+					target: `${qualified(table)}.${column.name}`,
+					object: tableObject(table)
+				}));
+			});
+		}
+	},
+	{
+		code: "BS220",
+		severity: "info",
+		title: "Column type to avoid",
+		description: "`timestamp` drops the time zone, `varchar(n)` and `char(n)` only add a length check `text` does with a constraint, `money` rounds by locale and `json` reparses on every read. Use `timestamptz`, `text`, `numeric` and `jsonb`.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const columns = table.columns.filter((column) => column.typeSchema === "pg_catalog" && column.udt in AVOID);
+			if (columns.length === 0) return [];
+			return [{
+				message: `${qualified(table)}: ${columns.map((column) => `${column.name} is ${column.udt}, use ${AVOID[column.udt]}`).join("; ")}.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS221",
+		severity: "warning",
+		title: "Direct database connection in a serverless app",
+		description: "Each serverless or edge invocation opens its own connection. Through the direct host or the session pooler on port 5432 they exhaust `max_connections`; the transaction pooler on port 6543 shares them. The direct host is also IPv6 only.",
+		check: (context) => {
+			if (!(context.sources.some((file) => SERVERLESS.test(file.text)) || context.envFiles.some((file) => /^\s*VERCEL\w*=/m.test(file.text)))) return [];
+			return context.envFiles.flatMap((file) => lines(file).flatMap(({ line, text }) => {
+				if (/^\s*#/.test(text) || !DIRECT_URL.test(text)) return [];
+				const key = /^\s*(?:export\s+)?(\w+)\s*=/.exec(text)?.[1];
+				return [{
+					message: `${file.path}${key ? `:${key}` : ""} connects through port 5432 or the direct host, but the app runs on serverless functions. Use the transaction pooler: \`postgres://postgres.<ref>:<password>@<region>.pooler.supabase.com:6543/postgres\`.`,
+					target: `${file.path}${key ? `:${key}` : ""}`,
+					location: {
+						file: file.path,
+						line
+					}
+				}];
+			}));
+		}
+	},
+	{
+		code: "BS222",
+		severity: "warning",
+		title: "Column that can exceed a JavaScript number",
+		description: "`int8` and `numeric` decode as `number` by default, which matches `supabase gen types` but loses precision past 2^53 (or 15 to 17 significant digits). An `int8` identity or sequence keeps growing toward that limit, and `numeric` usually holds exact amounts. Set `gen.codecs.int8` to `bigint` or `string`, or `gen.codecs.numeric` to `string`.",
+		check: (context) => {
+			const { int8, numeric } = context.config.codecs;
+			if (int8 !== "number" && numeric !== "number") return [];
+			return exposed(context).flatMap((table) => {
+				if (configFor(context.config.tables, table.schema, table.name)?.exclude) return [];
+				const columns = table.columns.filter((column) => column.udt === "int8" ? int8 === "number" && !column.isArray && (column.identity !== null || (column.default?.includes("nextval(") ?? false)) : column.udt === "numeric" && numeric === "number");
+				if (columns.length === 0) return [];
+				const codecs = [...columns.some((column) => column.udt === "int8") ? ["`int8: \"bigint\"`"] : [], ...columns.some((column) => column.udt === "numeric") ? ["`numeric: \"string\"`"] : []];
+				return [{
+					message: `${qualified(table)} ${columns.map((column) => `${column.name} (${column.udt})`).join(", ")} decode as number and lose precision past 2^53. Set ${codecs.join(" and ")} in \`codecs\`.`,
+					target: qualified(table),
+					object: tableObject(table)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS223",
+		severity: "info",
+		title: "Function returns an int8 or numeric scalar",
+		description: "PostgREST sends a scalar `int8` or `numeric` function result as a JSON number, which loses precision past 2^53 (or 15 to 17 significant digits) before any codec sees it. `$rpc` casts codec columns of table and record results to text, but a scalar has no column to cast. Return it as `text` when it can be that large.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			return context.snapshot.generator.functions.filter((fn) => schemas.includes(fn.schema) && WIDE_RESULT.test(fn.return_type)).map((fn) => ({
+				message: `${fn.schema}.${fn.name}(${fn.identity_argument_types}) returns ${fn.is_set_returning_function ? "setof " : ""}${fn.return_type}, which PostgREST sends as a JSON number and \`$rpc\` can't cast. Return it as text (\`returns ${fn.return_type.replace("bigint", "text").replace("numeric", "text")}\`, \`select total::text\`) when it can pass 2^53, or add BS223 to \`tooling.doctor.ignore\` when it stays small.`,
+				target: `${fn.schema}.${fn.name}`,
+				object: {
+					kind: "function",
+					schema: fn.schema,
+					name: fn.name
+				}
+			}));
+		}
+	},
+	{
+		code: "BS226",
+		severity: "warning",
+		title: "Prepared statements through the transaction pooler",
+		description: "The transaction pooler on port 6543 hands each transaction to any server connection, so a named prepared statement from one transaction is missing in the next and the query fails with `prepared statement does not exist`. postgres.js prepares statements unless `prepare: false`, and Prisma does unless the URL has `pgbouncer=true`. `pg` (and `better-supabase/postgres`) sends unnamed statements, which are safe. Doctor looks for a `:6543` URL in the env files and `tooling.doctor.sources`.",
+		check: (context) => {
+			const urls = [...context.envFiles, ...context.sources].flatMap((file) => lines(file).filter(({ text }) => !/^\s*(?:#|\/\/)/.test(text) && TRANSACTION_POOLER.test(text)).map(({ line, text }) => ({
+				file,
+				line,
+				text
+			})));
+			if (urls.length === 0) return [];
+			const findings = [];
+			for (const file of context.sources) {
+				if (!POSTGRES_JS.test(file.text) || PREPARE_OFF.test(file.text)) continue;
+				findings.push({
+					message: `${file.path} creates a postgres.js client without \`prepare: false\`, and the project connects through the transaction pooler on port 6543, so its prepared statements fail on the next transaction. Pass \`postgres(url, { prepare: false })\`.`,
+					target: `${file.path}:postgres`,
+					location: {
+						file: file.path,
+						line: lineOf(file.text, POSTGRES_JS) ?? 1
+					}
+				});
+			}
+			if (!context.sources.some((file) => PRISMA.test(file.text))) return findings;
+			for (const { file, line, text } of urls) {
+				if (/[?&]pgbouncer=true\b/.test(text)) continue;
+				const key = /^\s*(?:export\s+)?(\w+)\s*=/.exec(text)?.[1];
+				const target = `${file.path}${key ? `:${key}` : `:${line}`}`;
+				findings.push({
+					message: `${target} connects Prisma through the transaction pooler on port 6543 without \`pgbouncer=true\`, so Prisma's prepared statements fail on the next transaction. Add \`?pgbouncer=true\` to the URL, and use the session pooler or direct URL as \`directUrl\` for migrations.`,
+					target,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS227",
+		severity: "info",
+		title: "Offset pagination or exact counts",
+		description: "`pagination: \"offset\"` on a resource or list reads and discards every row before the page, so late pages get slower as the table grows, and rows written between requests shift the pages. `count: \"exact\"` counts every matching row on each request. Use `pagination: \"cursor\"`, and `count: \"planned\"` or `\"estimated\"` on large tables. Doctor looks in `tooling.doctor.sources`.",
+		check: (context) => context.sources.flatMap((file) => lines(file).flatMap(({ line, text }) => {
+			if (/^\s*(?:\/\/|\*)/.test(text)) return [];
+			const found = [];
+			if (OFFSET_PAGINATION.test(text)) found.push({
+				message: `${file.path}:${line} uses \`pagination: "offset"\`, so each page reads and skips every earlier row. Use \`pagination: "cursor"\` unless the UI needs page numbers, and keep \`[api] max_rows\` set so no request reads the whole table.`,
+				target: `${file.path}:${line}:pagination`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+			if (EXACT_COUNT.test(text)) found.push({
+				message: `${file.path}:${line} uses \`count: "exact"\`, which counts every matching row on each request. Use \`count: "planned"\` or \`"estimated"\` when the table can grow large.`,
+				target: `${file.path}:${line}:count`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+			return found;
+		}))
+	},
+	{
+		code: "BS228",
+		severity: "warning",
+		title: "App table column drifted from appTables",
+		description: "A column of an app table has a different type or nullability in the database than `appTables` gives it, usually after an edit by hand or a migration that wasn't regenerated. `gen` types the column from `appTables`, so the app reads values the database doesn't hold. A table or column the database doesn't have yet is left out: that is a migration not applied.",
+		check: (context) => {
+			const columns = new Map(context.snapshot.generator.columns.filter((column) => column.schema === "public").map((column) => [`${column.table}.${column.name}`, column]));
+			const enriched = enrichedAppTables(context);
+			return Object.entries(context.config.appTables).flatMap(([table, config]) => Object.entries(config.columns ?? {}).flatMap(([name, column]) => {
+				const found = columns.get(`${table}.${name}`);
+				if (found === void 0) return [];
+				const encrypted = column.encrypted === true;
+				const format = encrypted ? "text" : APP_COLUMN_FORMAT[column.type];
+				const nullable = column.nullable !== false || enriched.has(table) && found.is_nullable && column.default === void 0 && column.identity !== true;
+				const drift = [...found.format === format ? [] : [`is ${found.format} in the database and ${encrypted ? "encrypted text" : column.type} in appTables`], ...found.is_nullable === nullable ? [] : [nullable ? "is not null in the database and nullable in appTables" : "is nullable in the database and required in appTables"]];
+				return drift.length === 0 ? [] : [{
+					message: `public.${table}.${name} ${drift.join(", and ")}. Change appTables to match the database, or regenerate the migration with \`better-supabase upgrade\` and apply it. Follow the expand-and-contract steps from \`better-supabase add\` when rows depend on the old shape.`,
+					target: `public.${table}.${name}`,
+					object: {
+						kind: "table",
+						schema: "public",
+						name: table
+					}
+				}];
+			}));
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/stacks.ts
+/** The share of the segment limit in use from which BS700 warns. */
+const SEGMENT_WARNING_SHARE = .8;
+/**
+* Larger than the interlock segment every postmaster keeps (56 bytes), so the
+* stack keeps its shared buffers in System V memory.
+*/
+const SYSV_SEGMENT_BYTES = 1048576;
+const nearLimit = (memory) => memory.limit !== void 0 && memory.segments.length >= memory.limit * SEGMENT_WARNING_SHARE;
+function segmentsByStack(segments) {
+	const byStack = /* @__PURE__ */ new Map();
+	for (const segment of segments) if (segment.stackId !== void 0) byStack.set(segment.stackId, [...byStack.get(segment.stackId) ?? [], segment]);
+	return byStack;
+}
+/** Stacks that hold more than the interlock segment, so they use `sysv`. */
+function sysvStacks(memory) {
+	return [...segmentsByStack(memory.segments)].filter(([, segments]) => segments.length > 1 || segments.some((segment) => (segment.bytes ?? 0) > SYSV_SEGMENT_BYTES));
+}
+async function loadLocalStackCheck(root, env) {
+	try {
+		const memory = await readSharedMemory(root, env);
+		if (!memory.supported) return { skipped: "ipcs is not available." };
+		return {
+			memory,
+			stacks: nearLimit(memory) || sysvStacks(memory).length > 0 ? await listStacks(root, env).catch(() => []) : []
+		};
+	} catch (cause) {
+		return { skipped: errorText(cause) };
+	}
+}
+function stackName(id, stacks) {
+	const stack = stacks.find((each) => each.id === id);
+	return stack === void 0 ? id.slice(0, 12) : `${id.slice(0, 12)} (${branchName(stack.branch)} in ${stack.projectRoot})`;
+}
+/** Stacks BS700 names before it points at `stack ls`. */
+const NAMED_STACKS = 5;
+const megabytes = (bytes) => `${(bytes / 1048576).toFixed(0)} MB`;
+/** Checks on the machine's local stacks (BS700, BS701). */
+const STACK_RULES = [{
+	code: "BS700",
+	severity: "warning",
+	title: "Shared memory segments almost used up",
+	description: "Every running Postgres holds one System V shared memory segment, even with shared_memory_type = mmap. When the segment limit (32 on macOS) is reached, the next stack or shadow database fails with `could not create shared memory segment: No space left on device`. Prune stacks you no longer need with `better-supabase dev stack prune --stop-idle`, or raise the limit (`kern.sysv.shmmni` on macOS, `kernel.shmmni` on Linux).",
+	check: ({ localStacks }) => {
+		if (localStacks === void 0 || "skipped" in localStacks || !nearLimit(localStacks.memory)) return [];
+		const { memory, stacks } = localStacks;
+		const holders = [...segmentsByStack(memory.segments).keys()].map((id) => stackName(id, stacks));
+		const named = holders.slice(0, NAMED_STACKS).join(", ");
+		const more = holders.length > NAMED_STACKS ? ` and ${String(holders.length - NAMED_STACKS)} more (better-supabase dev stack ls lists them)` : "";
+		return [{
+			target: "kern.sysv.shmmni",
+			message: `${String(memory.segments.length)} of ${String(memory.limit)} shared memory segments are in use${holders.length === 0 ? "" : `, ${String(holders.length)} of them by managed stacks: ${named}${more}`}. Run better-supabase dev stack prune --stop-idle to free them.`
+		}];
+	}
+}, {
+	code: "BS701",
+	severity: "warning",
+	title: "Local stack uses System V shared memory",
+	description: "A stack whose Postgres runs with shared_memory_type or dynamic_shared_memory_type set to sysv holds its shared buffers and parallel query memory in System V segments, which fills the segment limit quickly. The defaults on macOS and Linux are mmap and posix; remove the override from the stack's Postgres settings.",
+	check: ({ localStacks }) => localStacks === void 0 || "skipped" in localStacks ? [] : sysvStacks(localStacks.memory).map(([id, segments]) => {
+		const bytes = segments.reduce((sum, segment) => sum + (segment.bytes ?? 0), 0);
+		return {
+			target: id,
+			message: `Stack ${stackName(id, localStacks.stacks)} holds ${String(segments.length)} shared memory segment(s)${bytes > 0 ? ` (${megabytes(bytes)})` : ""}, so it sets shared_memory_type or dynamic_shared_memory_type to sysv. Use mmap and posix, the defaults.`
+		};
+	})
+}];
+//#endregion
+//#region src/cli/doctor/wiring.ts
+const ENV_KEY = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+function listedKeys(files) {
+	return new Set(files.flatMap((file) => file.text.split("\n").flatMap((line) => {
+		const match = ENV_KEY.exec(line);
+		return match ? [match[1]] : [];
+	})));
+}
+const camel = (name) => name.replaceAll(/-([a-z0-9])/g, (_, letter) => letter.toUpperCase());
+const escape$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Whether a source line outside a comment passes the instance a provider:
+* `enrichment: blocks.enrichment.with({ provider })` or `.using(...)`.
+*/
+function wired(sources, entry) {
+	const keys = [.../* @__PURE__ */ new Set([entry.instance, camel(entry.instance)])].map(escape$1);
+	const pattern = new RegExp(`(?:^|[\\s{,])["']?(?:${keys.join("|")})["']?\\s*:\\s*[\\w$.\\[\\]"'-]*\\.(?:with|using)\\(`);
+	return sources.some((file) => file.text.split("\n").some((line) => {
+		const code = line.trim();
+		return !code.startsWith("//") && !code.startsWith("*") && pattern.test(code);
+	}));
+}
+/** The env keys and providers the installed blocks need (BS504, BS505). */
+const WIRING_RULES = [{
+	code: "BS504",
+	severity: "error",
+	title: "Env key a block needs is missing",
+	description: "An installed block reads a key that no env file lists and the shell doesn't set, so its route or worker fails at runtime. `better-supabase add` appends the keys to .env.example; set them in .env.local and every deployed environment.",
+	check: (context) => {
+		const plan = wiringFor(configInstances(context.config));
+		const listed = listedKeys(context.envFiles);
+		const shell = context.shellEnv ?? {};
+		return plan.env.filter((entry) => entry.required !== false && !listed.has(entry.key) && (shell[entry.key] ?? "") === "").map((entry) => ({
+			message: `${entry.blocks.join(", ")} ${entry.blocks.length === 1 ? "reads" : "read"} ${entry.key} (${entry.description}) but no env file lists it. Add it to .env.example and set it in .env.local and every deployed environment.`,
+			target: entry.key
+		}));
+	}
+}, {
+	code: "BS505",
+	severity: "error",
+	title: "Required provider is not wired",
+	description: "A block that can't run without an implementation (an enrichment provider, the mail providers) is installed, but no app source passes it one with `.with(...)` or `.using(...)`. Fill in its stub in providers.ts and spread `...providers` into `defineBlocks`.",
+	check: (context) => {
+		return wiringFor(configInstances(context.config)).providers.filter((entry) => entry.provider.required && !wired(context.sources, entry)).map((entry) => ({
+			message: `${entry.instance} needs \`${entry.provider.option}\` (an implementation of ${entry.provider.type} from ${entry.provider.from}). Fill in its stub in providers.ts, next to blocks.generated.ts (for example \`${entry.provider.option}: ${entry.provider.example}\`), and spread \`...providers\` into \`defineBlocks\`.`,
+			target: `${entry.instance}.${entry.provider.option}`
+		}));
+	}
+}];
+//#endregion
+//#region src/cli/doctor/workflow-builder.ts
+const BUILDER_EXECUTOR = /\b(?:GraphStepCall|executeGraph|nodeRunReporter)\b/;
+const ADMIN_CALL = /\badmin\s*\(/;
+function adminInBuilderExecutor(context) {
+	return context.sources.flatMap((file) => {
+		if (!BUILDER_EXECUTOR.test(file.text)) return [];
+		const line = lineOf(file.text, ADMIN_CALL);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} runs workflow-editor steps and calls admin(), which bypasses RLS for every step. Resolve the publisher's claims with builder.versions.runAs(call.version) in each step and query as them, so a demoted publisher's workflow stops.`,
+			target: `${file.path}:admin`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	});
+}
+const WORKFLOW_BUILDER_RULES = [{
+	code: "BS333",
+	severity: "warning",
+	title: "admin() inside a workflow-editor executor",
+	description: "A file that runs workflow-editor steps calls `admin()`. Steps run with the service role's rights instead of the publisher's, so a published workflow keeps running after its publisher loses a permission.",
+	check: adminInBuilderExecutor
+}];
+//#endregion
+//#region src/cli/doctor/rules.ts
+const DOCS_URL = "https://bettersupabase.com/docs/cli/doctor";
+const writes = (policy) => policy.command === "all" || policy.command === "insert" || policy.command === "update" || policy.command === "delete";
+const publicRoles = (policy) => policy.roles.length === 0 || policy.roles.some((role) => role === "public" || role === "anon");
+const isTrue = (expression) => expression !== null && /^\(*\s*true\s*\)*$/i.test(expression.trim());
+async function moduleVersionsBehind(context) {
+	const findings = [];
+	const upgrade = "Run `better-supabase upgrade`";
+	for (const { file, path, installed, behind } of await moduleFiles(context)) {
+		if (!behind || installed === void 0) continue;
+		findings.push({
+			message: `${path} has ${file.instance ?? file.module} version ${String(installed)}; this release ships version ${String(moduleFileVersion(file.contents)?.version ?? 1)}. ${upgrade}, then \`${migrationCommand(workflowOf(context))}\`.`,
+			target: path,
+			location: {
+				file: path,
+				line: 1
+			}
+		});
+	}
+	const db = context.database;
+	if (!db || "skipped" in db || context.config.blockNames.length === 0) return findings;
+	let rows;
+	try {
+		rows = await db.query("select name, version from better_supabase.blocks");
+	} catch {
+		try {
+			rows = await db.query("select name, version from better_supabase.modules");
+		} catch {
+			return findings;
+		}
+	}
+	for (const row of rows) {
+		const module = SQL_MODULES[row.name];
+		if (!module || !context.config.blockNames.includes(row.name)) continue;
+		const version = blockSqlVersion(module);
+		if (row.version >= version) continue;
+		findings.push({
+			message: `The database has ${row.name} version ${String(row.version)}; this release ships version ${String(version)}. ${upgrade} and apply the migrations it prints.`,
+			target: `better_supabase.blocks.${row.name}`
+		});
+	}
+	return findings;
+}
+function authSetting(context, key) {
+	return context.configToml ? tomlGet(context.configToml.document, ["auth", key]) : void 0;
+}
+function tomlLocation(context, key) {
+	if (!context.configToml) return;
+	const line = lineOf(context.configToml.text, new RegExp(`^\\s*${key}\\s*=`)) ?? lineOf(context.configToml.text, /^\[auth\]/);
+	return line ? {
+		file: context.configToml.path,
+		line
+	} : void 0;
+}
+/**
+* `db.x.aggregate(`, an `_sum:`/`_avg:`/`_min:`/`_max:` include or a list with
+* `facetCounts: true`.
+*/
+const AGGREGATE_USE = /\.aggregate\(|\b_(?:sum|avg|min|max)\s*:\s*\{|\bfacetCounts\s*:\s*true\b/;
+/**
+* A policy that reads memberships or the tenant claim: `is_member(...)`,
+* `current_tenant_id()`, `memberships`. The authorization provider's functions
+* (`authorization.requires`) count too.
+*/
+const TENANT_HELPER = /member|tenant|current_org|org_id/i;
+/**
+* A foreign key to the tenant table itself, whose own policies are usually
+* read-only.
+*/
+const TENANT_COLUMN = /^(?:organization|organization|tenant|team|workspace|account)_id$/;
+const COMMANDS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const MFA_FACTORS = /\bauth\.\s*"?mfa_factors\b/i;
+const RULES = [
+	...[
+		advisorRule("BS100", "security", "Supabase security advisor", "Findings from the Security Advisor (splinter): RLS disabled in exposed schemas, RLS without policies, mutable search_path, security definer functions callable by anon, exposed auth.users and more. Hosted projects use the Management API; local stacks and direct connections run the pinned splinter.sql."),
+		{
+			code: "BS103",
+			severity: "error",
+			title: "Policy allows anonymous writes",
+			description: "A permissive policy with `true` for anon or public lets anyone insert, update or delete rows.",
+			check: (context) => exposed(context).flatMap((table) => table.policies.filter((policy) => policy.permissive && writes(policy) && publicRoles(policy) && (isTrue(policy.using) || isTrue(policy.check))).map((policy) => ({
+				message: `Policy "${policy.name}" on ${qualified(table)} allows ${policy.command} for ${policy.roles.join(", ") || "public"} with \`true\`.`,
+				target: `${qualified(table)}.${policy.name}`,
+				object: policyObject(table, policy)
+			})))
+		},
+		{
+			code: "BS106",
+			severity: "error",
+			title: "Table not granted to the Data API",
+			description: "Hosted projects grant new tables to anon and authenticated unless the project turns default privileges off (auto_expose_new_tables = false locally). Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with RLS on and no permissive policy under `blocks['grants'].options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
+			check: (context) => {
+				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
+				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
+				return exposed(context).flatMap((table) => {
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude) return [];
+					const granted = (role) => new Set([...table.grants, ...table.columnGrants ?? []].filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
+					if (options?.serviceRole) {
+						const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && grant.privileges.length > 0);
+						return ["anon", "authenticated"].flatMap((role) => {
+							const have = [...granted(role)];
+							if (have.length === 0) return [];
+							const from = fromPublic ? `${role}, public` : role;
+							return [{
+								message: `${qualified(table)} has \`serviceRole: true\` in \`tables\`, but ${role} has ${have.join(", ")} on it, so the Data API reaches it. Remove it from \`expose\` and run \`revoke all on table ${qualified(table)} from ${from};\`.`,
+								target: `${qualified(table)}:${role}`,
+								object: tableObject(table)
+							}];
+						});
+					}
+					const serviceOnly = context.config.blockNames.includes("grants") && context.config.blocks["grants"]?.options?.["fromPolicies"] === true && table.rls && !table.policies.some((policy) => policy.permissive && (appliesTo(policy, "anon") || appliesTo(policy, "authenticated")));
+					const wanted = context.config.expose[qualified(table)] ?? context.config.expose[table.name] ?? {
+						anon: [],
+						authenticated: serviceOnly ? [] : ["select"]
+					};
+					return ["anon", "authenticated"].flatMap((role) => {
+						const have = granted(role);
+						const missing = wanted[role].filter((privilege) => !privilege.includes("(") && !have.has(privilege));
+						if (missing.length === 0) return [];
+						return [{
+							message: `${role} has no ${missing.join(", ")} on ${qualified(table)}, so the Data API answers 42501. Add it to \`expose\` and run \`better-supabase add grants\`, or run \`grant ${missing.join(", ")} on table ${qualified(table)} to ${role};\`.${note}`,
+							target: `${qualified(table)}:${role}`,
+							object: tableObject(table)
+						}];
+					});
+				});
+			}
+		},
+		{
+			code: "BS107",
+			severity: "warning",
+			title: "Tenant table without a policy for every command",
+			description: "A tenant-scoped table with policies for some commands but not all four denies the rest silently: an update or delete then affects 0 rows without an error. Add the missing policies, or a restrictive one, so the intent is explicit, and test it with `expectTenantIsolation`. On an app table a block runs over, only the app's own policies decide whether it's reported, since the block writes through its own functions.",
+			check: (context) => {
+				const column = context.config.extensions.tenant?.column;
+				const providerFunctions = [...new Set((context.config.authorization?.requires ?? []).flatMap((entry) => [entry.function, entry.function.slice(entry.function.indexOf(".") + 1)]))];
+				const tables = exposed(context);
+				const blocked = blockTargets(context);
+				const roots = new Set(tables.flatMap((table) => table.foreignKeys.filter((key) => key.columns.length === 1 && (column === void 0 ? TENANT_COLUMN.test(key.columns[0]) : key.columns[0] === column)).map((key) => `${key.refSchema}.${key.refTable}`)));
+				return tables.flatMap((table) => {
+					if (table.kind !== "table" || !table.rls) return [];
+					if (roots.has(qualified(table))) return [];
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude || options?.serviceRole) return [];
+					const forAuthenticated = (policy) => policy.roles.some((role) => ["authenticated", "public"].includes(role));
+					const blockTable = blocked.has(qualified(table));
+					const permissive = table.policies.filter((policy) => policy.permissive && forAuthenticated(policy));
+					const granting = permissive.filter((policy) => !(blockTable && policy.name.startsWith("bsb_")));
+					if (granting.length === 0) return [];
+					if (!(column !== void 0 && table.columns.some((entry) => entry.name === column) || granting.some((policy) => {
+						const text = [
+							policy.using ?? "",
+							policy.check ?? "",
+							...policy.functions ?? []
+						].join(" ");
+						return TENANT_HELPER.test(text) || providerFunctions.some((fn) => text.includes(fn));
+					}))) return [];
+					const denying = table.policies.filter((policy) => !policy.permissive && forAuthenticated(policy) && /^\s*false\s*$/i.test(policy.using ?? ""));
+					const covered = new Set([...permissive, ...denying].flatMap((policy) => policy.command === "all" ? COMMANDS : [policy.command]));
+					const missing = COMMANDS.filter((command) => !covered.has(command));
+					if (missing.length === 0) return [];
+					return [{
+						message: `${qualified(table)} is tenant-scoped but has no ${missing.join(", ")} policy for authenticated, so ${missing.join(" and ")} silently match no rows. Add the policies, or state the intent with a restrictive \`using (false)\` policy.`,
+						target: qualified(table),
+						object: tableObject(table)
+					}];
+				});
+			}
+		},
+		{
+			code: "BS108",
+			severity: "error",
+			title: "Policy reads auth.mfa_factors directly",
+			description: "`authenticated` has no access to `auth.mfa_factors`, so a policy that reads it fails every request with 42501. Check the factor in a `security definer` function such as `better_supabase.mfa_satisfied()` from the `mfa` SQL module.",
+			check: (context) => exposed(context).flatMap((table) => table.policies.filter((policy) => MFA_FACTORS.test(`${policy.using ?? ""} ${policy.check ?? ""}`)).map((policy) => ({
+				message: `Policy "${policy.name}" on ${qualified(table)} reads auth.mfa_factors, which authenticated can't select, so every request fails with 42501. Use \`(select better_supabase.mfa_satisfied())\` from \`better-supabase add mfa\` instead.`,
+				target: `${qualified(table)}.${policy.name}`,
+				object: policyObject(table, policy)
+			})))
+		},
+		advisorRule("BS200", "performance", "Supabase performance advisor", "Findings from the Performance Advisor (splinter): unindexed foreign keys, auth calls re-evaluated per row in policies, multiple permissive policies, unused and duplicate indexes and more."),
+		{
+			code: "BS204",
+			severity: "warning",
+			title: "Tenant column without an index",
+			description: "The memberships extension and organization policies filter every query on this column. A view is left out: a query on it uses the indexes of its tables.",
+			check: (context) => {
+				const tenant = context.config.extensions.tenant;
+				if (!tenant) return [];
+				return exposed(context).filter((table) => table.kind === "table" && table.columns.some((column) => column.name === tenant.column) && !table.indexes.some((index) => !index.partial && index.columns[0] === tenant.column)).map((table) => ({
+					message: `${qualified(table)}.${tenant.column} has no index starting with it.`,
+					target: `${qualified(table)}.${tenant.column}`,
+					object: tableObject(table)
+				}));
+			}
+		},
+		{
+			code: "BS210",
+			severity: "warning",
+			title: "Aggregates used while PostgREST disables them",
+			description: "PostgREST rejects `count()`, `sum()` and the other aggregates with PGRST123 unless `pgrst.db_aggregates_enabled` is on for the authenticator role. `aggregate()`, `_sum`/`_avg`/`_min`/`_max` includes and list `facetCounts` need it; `better-supabase/postgres` does not.",
+			check: (context) => {
+				const settings = context.snapshot.extras.roleSettings;
+				if (!settings) return [];
+				const enabled = settings["authenticator"]?.["pgrst.db_aggregates_enabled"];
+				if (enabled === "true" || enabled === "on") return [];
+				for (const file of context.sources) {
+					const line = lineOf(file.text, AGGREGATE_USE);
+					if (line === void 0) continue;
+					return [{
+						message: `${file.path} uses aggregates, but PostgREST has them off, so these requests fail with PGRST123. Run \`alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';\` in a migration.`,
+						target: "authenticator:pgrst.db_aggregates_enabled",
+						location: {
+							file: file.path,
+							line
+						}
+					}];
+				}
+				return [];
+			}
+		},
+		{
+			code: "BS301",
+			severity: "warning",
+			title: "Soft delete hidden by a select policy",
+			description: "PostgREST re-reads updated rows through the select policy. If it hides deleted rows, soft-deleting fails with an RLS error unless the update returns nothing.",
+			check: (context) => {
+				const softDelete = context.config.extensions.softDelete;
+				if (!softDelete) return [];
+				return exposed(context).flatMap((table) => {
+					if (!table.columns.some((column) => column.name === softDelete.column)) return [];
+					return table.policies.filter((policy) => (policy.command === "select" || policy.command === "all") && new RegExp(`\\b${softDelete.column}\\b\\s+IS\\s+NULL`, "i").test(policy.using ?? "")).map((policy) => ({
+						message: `Policy "${policy.name}" on ${qualified(table)} hides rows where ${softDelete.column} is set, so the trash extension can't read the row back. Filter deleted rows in queries (the extension does) instead of in the policy.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}));
+				});
+			}
+		},
+		{
+			code: "BS302",
+			severity: "warning",
+			title: "Bucket differs from the config",
+			description: "A bucket in `buckets` is missing or has different settings in the database.",
+			check: (context) => Object.entries(context.config.buckets).flatMap(([name, bucket]) => {
+				const id = bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
+				const defined = defineBucket({
+					id,
+					path: bucket.path,
+					...bucket.public === void 0 ? {} : { public: bucket.public },
+					...bucket.fileSizeLimit === void 0 ? {} : { fileSizeLimit: bucket.fileSizeLimit },
+					...bucket.allowedMimeTypes === void 0 ? {} : { allowedMimeTypes: bucket.allowedMimeTypes },
+					...bucket.versioning === void 0 ? {} : { versioning: bucket.versioning },
+					...bucket.lifecycle === void 0 ? {} : { lifecycle: bucket.lifecycle }
+				});
+				const actual = catalogOf(context).buckets.find((entry) => entry.id === id);
+				const inDatabase = defined.drift(actual).map((drift) => ({
+					message: `Bucket ${id}: ${drift.message}`,
+					target: `storage.buckets.${id}`
+				}));
+				const toml = context.configToml;
+				const declared = toml ? tomlGet(toml.document, [
+					"storage",
+					"buckets",
+					id
+				]) : void 0;
+				if (!toml || !declared || typeof declared !== "object" || Array.isArray(declared)) return inDatabase;
+				const entry = declared;
+				const size = entry["file_size_limit"];
+				const mimes = entry["allowed_mime_types"];
+				const line = lineOf(toml.text, new RegExp(`^\\[storage\\.buckets\\.${id.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\]`));
+				const inToml = defined.drift({
+					public: entry["public"] === true,
+					fileSizeLimit: typeof size === "string" || typeof size === "number" ? parseSize(size) : null,
+					allowedMimeTypes: Array.isArray(mimes) ? mimes.map(String) : null
+				}).map((drift) => ({
+					message: `${toml.path} [storage.buckets.${id}]: ${drift.message.replace(`Bucket "${id}" `, "")}`,
+					target: `[storage.buckets.${id}]`,
+					...line ? { location: {
+						file: toml.path,
+						line
+					} } : {}
+				}));
+				return [...inDatabase, ...inToml];
+			})
+		},
+		{
+			code: "BS303",
+			severity: "error",
+			title: "Generated code is out of date",
+			description: "The generated module no longer matches the database, so types and metadata are wrong. Same check as `gen --check`.",
+			check: async (context) => {
+				const stale = [];
+				for (const file of await renderFiles(context.config, context.snapshot)) {
+					const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
+					if (!sameText(current, file.contents)) stale.push({
+						message: `${file.path} is ${current === void 0 ? "missing" : "out of date"}. Run \`better-supabase gen\`.`,
+						target: file.path,
+						...current === void 0 ? {} : { location: {
+							file: file.path,
+							line: 1
+						} }
+					});
+				}
+				return stale;
+			}
+		},
+		{
+			code: "BS304",
+			severity: "warning",
+			title: "SQL module files are out of date",
+			description: "A module listed in `blocks` differs from the version in this release. Same check as `upgrade --check`.",
+			check: async (context) => {
+				const stale = [];
+				const workflow = workflowOf(context);
+				const states = await moduleFiles(context);
+				for (const { file, path, current, behind } of states) {
+					const migrated = workflow === "migrations" && file.kind !== "test";
+					const name = file.instance ?? file.module;
+					if (current !== void 0 && !migrated && blockFileState(current) === "edited") {
+						stale.push({
+							message: `${path} (${name}) was edited by hand. Move the change to an override file or a SQL hook, or run \`better-supabase upgrade --force\`.`,
+							target: path,
+							location: {
+								file: path,
+								line: 1
+							}
+						});
+						continue;
+					}
+					if (behind || sameBlockFile(current, file.contents)) continue;
+					const next = file.kind === "data" && !migrated ? "Run `better-supabase upgrade`, which also writes the rows into a migration, since a schema diff skips them." : `Run \`better-supabase upgrade\`, then \`${migrationCommand(workflow)}\`.`;
+					const subject = migrated ? `${name} in ${path} is ${current === void 0 ? "missing" : "out of date"}` : `${path} (${name}) is ${current === void 0 ? "missing" : "out of date"}`;
+					if (stale.some((finding) => finding.message === `${subject}. ${next}`)) continue;
+					stale.push({
+						message: `${subject}. ${next}`,
+						target: path,
+						...current === void 0 ? {} : { location: {
+							file: path,
+							line: 1
+						} }
+					});
+				}
+				if (workflow !== "migrations") {
+					const orphans = await orphanedBlockFiles(context.config, {
+						dir: context.config.sql.dir,
+						prefix: context.config.sql.prefix,
+						schemasDir: context.config.sql.dir
+					}, new Set(states.map((state) => state.file.path)));
+					for (const path of orphans) {
+						const current = await readFile(resolve(context.config.root, path), "utf-8").catch(() => "");
+						const edited = blockFileState(current) === "edited";
+						stale.push({
+							message: edited ? `${path} is left from a block that is no longer installed, and it was edited by hand. Move the change out, then delete the file or run \`better-supabase upgrade --force\`.` : `${path} is left from a block that is no longer installed. Run \`better-supabase upgrade\` to remove it.`,
+							target: path,
+							location: {
+								file: path,
+								line: 1
+							}
+						});
+					}
+				}
+				return stale;
+			}
+		},
+		{
+			code: "BS316",
+			severity: "warning",
+			title: "Legacy migra diff engine",
+			description: "`supabase/config.toml` has no `[experimental.pgdelta] enabled = true`, so the Supabase CLI diffs `supabase/schemas` with migra, which drops grants, comments and security-invoker views and needs the stack stopped. New projects from `supabase init` use pg-delta. Setting `database.sql.workflow` to `migra` or `migrations` silences it.",
+			check: (context) => {
+				const toml = context.configToml;
+				if (toml === void 0 || diffEngine(toml) === "pg-delta") return [];
+				if (context.config.sql.workflow !== void 0 && context.config.sql.workflow !== "pg-delta") return [];
+				const schemas = `${toml.dir}/schemas/`;
+				if (!(context.config.blockNames.length > 0 || (context.sqlFiles ?? []).some((file) => file.path.startsWith(schemas)))) return [];
+				const keep = context.config.sql.workflow === void 0 ? " To stay on migra, set `database.sql.workflow: \"migra\"` in better-supabase.config.ts." : "";
+				return [{
+					message: `${toml.path} uses the legacy migra engine. Add \`[experimental.pgdelta]\` with \`enabled = true\`, remove \`[db.migrations] schema_paths\`, and create migrations with \`supabase db schema declarative sync\` instead of \`supabase db diff\`.${keep}`,
+					target: toml.path,
+					location: {
+						file: toml.path,
+						line: 1
+					}
+				}];
+			}
+		},
+		{
+			code: "BS305",
+			severity: "warning",
+			title: "Live query table without change broadcasts",
+			description: "A table in `database.realtime.tables` has no `bsb_realtime` trigger, so live queries never hear about its changes.",
+			check: (context) => {
+				const tables = catalogOf(context).tables;
+				return context.config.realtime.tables.flatMap((name) => {
+					const table = tables.find((entry) => entry.name === name || qualified(entry) === name);
+					if (!table) return [{
+						message: `database.realtime.tables lists "${name}", which doesn't exist.`,
+						target: name
+					}];
+					if (table.triggers.some((trigger) => /^bsb?_realtime/.test(trigger.name))) return [];
+					return [{
+						message: `${qualified(table)} is in database.realtime.tables but has no broadcast trigger. Run \`better-supabase add realtime-tables\`, then \`${migrationCommand(workflowOf(context))}\`.`,
+						target: qualified(table),
+						object: tableObject(table)
+					}];
+				});
+			}
+		},
+		{
+			code: "BS306",
+			severity: "warning",
+			title: "Realtime delete events without keys",
+			description: "Tables in the `supabase_realtime` publication send the replica identity of deleted rows. With `nothing`, or `default` without a primary key, delete events carry no keys and clients cannot tell which row went away.",
+			check: (context) => {
+				const published = new Set(catalogOf(context).realtime);
+				return catalogOf(context).tables.filter((table) => published.has(qualified(table)) && (table.replicaIdentity === "NOTHING" || table.replicaIdentity === "DEFAULT" && table.primaryKey.length === 0)).map((table) => ({
+					message: `${qualified(table)} is published to Realtime with replica identity ${table.replicaIdentity?.toLowerCase() ?? "unknown"}${table.primaryKey.length === 0 ? " and no primary key" : ""}. Add a primary key or run \`alter table ${qualified(table)} replica identity full\`.`,
+					target: qualified(table),
+					object: tableObject(table)
+				}));
+			}
+		},
+		{
+			code: "BS311",
+			severity: "warning",
+			title: "SQL module behind its current version",
+			description: "A block file or `better_supabase.blocks` records an older module version than this release ships. Same check as `upgrade --check`.",
+			check: moduleVersionsBehind
+		},
+		{
+			code: "BS401",
+			severity: "warning",
+			title: "Refresh token reuse interval is 0",
+			description: "Server instances refreshing the same session at once need a reuse interval, or all but one of them sign the user out.",
+			check: (context) => {
+				if (!context.configToml) return [];
+				const rotation = authSetting(context, "enable_refresh_token_rotation");
+				const interval = authSetting(context, "refresh_token_reuse_interval");
+				if (rotation === false || rotation === "false" || interval === void 0 || Number(interval) > 0) return [];
+				const location = tomlLocation(context, "refresh_token_reuse_interval");
+				return [{
+					message: "refresh_token_reuse_interval = 0 with refresh token rotation. Use 10 (the Supabase default) so concurrent refreshes succeed.",
+					target: "[auth] refresh_token_reuse_interval",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS402",
+			severity: "info",
+			title: "Long access token lifetime",
+			description: "Tokens are verified locally without an auth call, so a revoked session stays valid until the token expires.",
+			check: (context) => {
+				if (!context.configToml) return [];
+				const expiry = Number(authSetting(context, "jwt_expiry") ?? 3600);
+				if (expiry <= 3600) return [];
+				const location = tomlLocation(context, "jwt_expiry");
+				return [{
+					message: `jwt_expiry is ${expiry}s. Keep it at 3600 or less; sessions refresh in the proxy.`,
+					target: "[auth] jwt_expiry",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS403",
+			severity: "info",
+			title: "Local stack signs tokens with a shared secret",
+			description: "Hosted projects sign with asymmetric keys. Using the same locally means local tokens verify through JWKS just like production.",
+			check: (context) => {
+				if (!context.configToml || authSetting(context, "signing_keys_path") || tomlGet(context.configToml.document, ["db", "driver"]) !== void 0) return [];
+				const location = tomlLocation(context, "signing_keys_path");
+				return [{
+					message: "No [auth] signing_keys_path. Run `better-supabase dev keys` to sign local tokens with ES256.",
+					target: "[auth] signing_keys_path",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS406",
+			severity: "warning",
+			title: "Foreign key to auth.users blocks account deletion",
+			description: "A foreign key to `auth.users` with `no action` or `restrict` makes `auth.admin.deleteUser` (and `deleteAccount`) fail with \"Database error deleting user\" while the user has rows. Use `on delete cascade` for data the user owns, or `on delete set null` for records that outlive them.",
+			check: (context) => catalogOf(context).tables.flatMap((table) => table.schema === "auth" ? [] : table.foreignKeys.filter((key) => key.refSchema === "auth" && key.refTable === "users" && (key.onDelete === "no action" || key.onDelete === "restrict")).map((key) => ({
+				message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) references auth.users with on delete ${key.onDelete}. Deleting the user fails while rows point at it; use on delete cascade or set null.`,
+				target: `${qualified(table)}.${key.name}`,
+				object: tableObject(table)
+			})))
+		}
+	],
+	...RLS_RULES,
+	...POLICY_RULES,
+	...SCHEMA_DESIGN_RULES,
+	...HOOK_RULES,
+	...COOKIE_RULES,
+	...REMOVED_API_RULES,
+	...AUTHORIZATION_RULES,
+	...LIVE_RULES,
+	...MODULE_RULES,
+	...PGDELTA_RULES,
+	...LITE_RULES,
+	...DEPENDENCY_RULES,
+	...WORKFLOW_BUILDER_RULES,
+	...FLAG_RULES,
+	...REALTIME_RULES,
+	...ADOPTION_RULES,
+	...MIGRATION_SAFETY_RULES,
+	...NOT_VALID_RULES,
+	...APP_TABLE_SCOPE_RULES,
+	...ENV_RULES,
+	...WIRING_RULES,
+	...STACK_RULES
+].toSorted((a, b) => byCodePoint(a.code, b.code));
+const RULE_CODES = RULES.map((rule) => rule.code);
+async function runRules(context, rules = RULES) {
+	const findings = [];
+	const scoped = {
+		...context,
+		codes: rules.map((rule) => rule.code)
+	};
+	for (const rule of rules) {
+		const help = `${DOCS_URL}#${rule.code.toLowerCase()}`;
+		const skipped = skippedForMetadata(context.snapshot, rule, help);
+		if (skipped) {
+			findings.push(skipped);
+			continue;
+		}
+		for (const input of await rule.check(scoped)) findings.push({
+			code: rule.code,
+			severity: rule.severity,
+			title: rule.title,
+			help,
+			...input
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor/format.ts
+const DOCTOR_FORMATS = [
+	"text",
+	"json",
+	"sarif",
+	"github"
+];
+const DOCTOR_REPORT_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/doctor-report-v1.json";
+const SARIF_SCHEMA_URL = "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";
+function summarize(findings) {
+	return {
+		errors: findings.filter((finding) => finding.severity === "error").length,
+		warnings: findings.filter((finding) => finding.severity === "warning").length,
+		infos: findings.filter((finding) => finding.severity === "info").length
+	};
+}
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+const SEVERITY_FORMAT = {
+	error: "red",
+	warning: "yellow",
+	info: "cyan"
+};
+function text(findings, paint) {
+	if (findings.length === 0) return "No problems found.";
+	const order = [
+		"error",
+		"warning",
+		"info"
+	];
+	const lines = [...findings].toSorted((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity) || byCodePoint(a.code, b.code)).flatMap((finding) => [
+		`${paint(SEVERITY_FORMAT[finding.severity], finding.severity.padEnd(7))} ${paint("bold", finding.code)} ${finding.title}${finding.location ? `  ${finding.location.file}:${finding.location.line}` : ""}`,
+		`        ${finding.message}`,
+		`        ${finding.help}`
+	]);
+	const summary = summarize(findings);
+	lines.push("", `${plural(summary.errors, "error")}, ${plural(summary.warnings, "warning")}, ${plural(summary.infos, "note")}.`);
+	return lines.join("\n");
+}
+function sarifLevel(severity) {
+	switch (severity) {
+		case "error": return "error";
+		case "warning": return "warning";
+		case "info": return "note";
+		default: return severity;
+	}
+}
+function sarif(findings, rules, version, fallback) {
+	return {
+		$schema: SARIF_SCHEMA_URL,
+		version: "2.1.0",
+		runs: [{
+			tool: { driver: {
+				name: "better-supabase doctor",
+				version,
+				informationUri: DOCS_URL,
+				rules: rules.map((rule) => ({
+					id: rule.code,
+					name: rule.title.replaceAll(/[^A-Za-z0-9]+(.)?/g, (_, char) => (char ?? "").toUpperCase()),
+					shortDescription: { text: rule.title },
+					fullDescription: { text: rule.description },
+					helpUri: `${DOCS_URL}#${rule.code.toLowerCase()}`,
+					defaultConfiguration: { level: sarifLevel(rule.severity) }
+				}))
+			} },
+			results: findings.map((finding) => ({
+				ruleId: finding.code,
+				ruleIndex: rules.findIndex((rule) => rule.code === finding.code),
+				level: sarifLevel(finding.severity),
+				message: { text: finding.message },
+				locations: [{ physicalLocation: {
+					artifactLocation: { uri: finding.location?.file ?? fallback },
+					region: { startLine: finding.location?.line ?? 1 }
+				} }],
+				partialFingerprints: { target: `${finding.code}:${finding.target ?? finding.message}` }
+			}))
+		}]
+	};
+}
+const escapeData = (value) => value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProperty = (value) => escapeData(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+function github(findings) {
+	return findings.map((finding) => {
+		return `::${finding.severity === "info" ? "notice" : finding.severity} ${[...finding.location ? [`file=${escapeProperty(finding.location.file)}`, `line=${finding.location.line}`] : [], `title=${escapeProperty(`${finding.code} ${finding.title}`)}`].join(",")}::${escapeData(`${finding.message} (${finding.help})`)}`;
+	}).join("\n");
+}
+function jsonReport(findings, version) {
+	return {
+		$schema: DOCTOR_REPORT_SCHEMA_URL,
+		version: 1,
+		tool: {
+			name: "better-supabase",
+			version
+		},
+		summary: summarize(findings),
+		findings
+	};
+}
+function formatReport(findings, options) {
+	switch (options.format) {
+		case "text": return text(findings, options.paint ?? plain);
+		case "json": return JSON.stringify(jsonReport(findings, options.version), null, 2);
+		case "sarif": return JSON.stringify(sarif(findings, options.rules, options.version, options.fallbackFile), null, 2);
+		case "github": return github(findings);
+		default: return options.format;
+	}
+}
+//#endregion
+//#region src/cli/doctor/inputs.ts
+const ENV_FILES = [
+	".env",
+	".env.local",
+	".env.example",
+	".env.development",
+	".env.development.local",
+	".env.production",
+	".env.production.local"
+];
+async function readText(root, path) {
+	const absolute = resolve(root, path);
+	return existsSync(absolute) ? {
+		path,
+		text: await readFile(absolute, "utf-8")
+	} : void 0;
+}
+/**
+* The declarative schemas in the diff engine's order, then the migrations
+* newest first.
+*/
+async function sqlFiles(root, toml, workflow) {
+	const read = async (path) => ({
+		path,
+		text: await readFile(resolve(root, path), "utf-8")
+	});
+	const schemas = await Promise.all((await schemaPaths(root, toml, workflow)).files.map(read));
+	const migrationsPath = `${toml?.dir ?? "supabase"}/migrations`;
+	const migrationsDir = resolve(root, migrationsPath);
+	const migrations = existsSync(migrationsDir) ? (await readdir(migrationsDir)).filter((name) => name.endsWith(".sql")).toSorted().toReversed().map((name) => `${migrationsPath}/${name}`) : [];
+	return [...schemas, ...await Promise.all(migrations.map(read))];
+}
+/** Files matching `doctor.sources`, skipping dependencies and build output. */
+async function sourceFiles(config) {
+	const files = [];
+	for await (const path of glob([...config.doctor.sources], {
+		cwd: config.root,
+		exclude: (name) => name === "node_modules" || name === ".next"
+	})) files.push({
+		path,
+		text: await readFile(resolve(config.root, path), "utf-8")
+	});
+	return files.toSorted((a, b) => byCodePoint(a.path, b.path));
+}
+//#endregion
+//#region src/cli/doctor/advisors.ts
+/**
+* Splinter (https://github.com/supabase/splinter), the linter behind the
+* dashboard's Security and Performance Advisors. It has no license, so it is
+* downloaded at this commit and checked against the hash instead of bundled.
+*/
+const SPLINTER_COMMIT = "e74a9e36cb12258cb67d1464bc1cb196e9cd8446";
+const SPLINTER_SHA256 = "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349";
+const SPLINTER_URL = `https://raw.githubusercontent.com/supabase/splinter/${SPLINTER_COMMIT}/splinter.sql`;
+function isLint(value) {
+	const lint = value;
+	return typeof lint === "object" && lint !== null && typeof lint.name === "string" && typeof lint.level === "string" && Array.isArray(lint.categories);
+}
+/** The hosted project's advisors (`GET /v1/projects/{ref}/advisors/{category}`). */
+function managementAdvisors(options) {
+	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
+	return {
+		describe: `project ${options.projectRef} advisors (Management API)`,
+		async lints(category) {
+			const url = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/advisors/${category}`;
+			const text = await request(url, {
+				what: `Management API ${category} advisors`,
+				headers: { authorization: `Bearer ${options.accessToken}` },
+				...options.fetch ? { fetch: options.fetch } : {}
+			});
+			const body = JSON.parse(text);
+			if (!Array.isArray(body.lints)) throw new CliError("request_failed", `Management API ${category} advisors returned no "lints".`);
+			return body.lints.filter(isLint);
+		}
+	};
+}
+/** The `[api] schemas` list of a `config.toml`, when it names any. */
+function apiSchemas(document) {
+	const value = document ? tomlGet(document, ["api", "schemas"]) : void 0;
+	if (!Array.isArray(value)) return [];
+	return value.filter((schema) => typeof schema === "string" && schema.trim() !== "");
+}
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/**
+* The read-only transaction splinter runs in, with `pgrst.db_schemas` set
+* first.
+*/
+function splinterScript(sql, schemas = []) {
+	return `begin read only;\n${schemas.length > 0 ? `set local pgrst.db_schemas = ${literal(schemas.join(","))};\n` : ""}${sql}\n;\nrollback;`;
+}
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** Downloads (once) and verifies the pinned `splinter.sql`. */
+async function splinterSql(options) {
+	const file = resolve(options.cacheDir, `splinter-${SPLINTER_COMMIT}.sql`);
+	if (existsSync(file)) {
+		const cached = await readFile(file, "utf-8");
+		if (sha256(cached) === SPLINTER_SHA256) return cached;
+	}
+	const text = await request(SPLINTER_URL, {
+		what: `Downloading splinter.sql from ${SPLINTER_URL}`,
+		...options.fetch ? { fetch: options.fetch } : {}
+	});
+	if (sha256(text) !== SPLINTER_SHA256) throw new CliError("integrity_failed", `splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
+	await mkdir(dirname(file), { recursive: true });
+	await writeFile(file, text);
+	return text;
+}
+/** `pg` returns one result per statement for a multi-statement query. */
+function lintRows(result) {
+	const results = Array.isArray(result) ? result : [result];
+	return results.find((entry) => entry.fields?.some((field) => field.name === "cache_key"))?.rows ?? results.at(-1)?.rows ?? [];
+}
+/**
+* Runs splinter against a database (local stack, `$DATABASE_URL` or
+* `--db-url-stdin`) in a read-only transaction that is rolled back.
+*/
+function splinterAdvisors(queryable, describe, options) {
+	let all;
+	const run = async () => {
+		const sql = await splinterSql(options);
+		return lintRows(await queryable.query(splinterScript(sql, options.schemas))).filter(isLint);
+	};
+	return {
+		describe: `${describe} (splinter ${SPLINTER_COMMIT.slice(0, 7)})`,
+		async lints(category) {
+			all ??= run();
+			const wanted = category.toUpperCase();
+			return (await all).filter((lint) => lint.categories.includes(wanted));
+		}
+	};
+}
+//#endregion
+//#region src/cli/doctor/live-source.ts
+/** Checks that read the database itself rather than the snapshot. */
+const LIVE_CODES = /* @__PURE__ */ new Set([
+	"BS100",
+	"BS200",
+	"BS208",
+	"BS209",
+	"BS212",
+	"BS225",
+	"BS236",
+	"BS238"
+]);
+/**
+* The database doctor reads, for advisors and live checks: the Management API
+* for hosted projects, one lazily opened connection otherwise (splinter runs
+* over it). Saved snapshots skip both.
+*/
+function openLive(config, env, source, pg) {
+	const none = { close: () => Promise.resolve() };
+	const file = snapshotFile(config, source);
+	if (file) {
+		const skipped = `reading the saved snapshot ${file}; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+		return {
+			...none,
+			advisors: { skipped },
+			database: { skipped }
+		};
+	}
+	let opened;
+	const open = () => opened ??= openSource(config, env, source, pg);
+	const target = managementTarget(config, env, source);
+	const database = {
+		describe: target ? `project ${target.projectRef} (Management API)` : "database",
+		session: !target,
+		async query(sql) {
+			return (await (await open()).queryable.query(sql)).rows;
+		}
+	};
+	const close = async () => {
+		if (opened) await (await opened).close();
+	};
+	if (target) return {
+		advisors: managementAdvisors(target),
+		database,
+		open,
+		close
+	};
+	let splinter;
+	const cacheDir = resolve(config.root, CACHE_DIR);
+	return {
+		advisors: {
+			describe: "database (splinter)",
+			async lints(category) {
+				splinter ??= Promise.all([open(), readSupabaseToml(config.root).catch(() => void 0)]).then(([db, toml]) => splinterAdvisors(db.queryable, db.describe, {
+					cacheDir,
+					schemas: apiSchemas(toml?.document)
+				}));
+				return (await splinter).lints(category);
+			}
+		},
+		database,
+		open,
+		close
+	};
+}
+//#endregion
+//#region src/cli/doctor/locate.ts
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* Where a table, function or policy is declared: declarative schemas first,
+* then the newest migration.
+*/
+function locate(files, object) {
+	const name = `"?${escape(object.name)}"?`;
+	const qualifiedName = `(?:"?${escape(object.schema)}"?\\.)?${name}`;
+	if (object.kind === "policy" && object.table !== void 0) {
+		const onTable = new RegExp(`create\\s+policy\\s+${name}\\s+on\\s+(?:only\\s+)?(?:"?${escape(object.schema)}"?\\.)?"?${escape(object.table)}"?(?:\\s|;|$)`, "i");
+		for (const file of files) {
+			const match = onTable.exec(file.text);
+			if (match) return {
+				file: file.path,
+				line: file.text.slice(0, match.index).split("\n").length
+			};
+		}
+		return;
+	}
+	const pattern = object.kind === "table" ? new RegExp(`create\\s+(?:unlogged\\s+)?table\\s+(?:if\\s+not\\s+exists\\s+)?${qualifiedName}(?:\\s|\\(|$)`, "i") : object.kind === "function" ? new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${qualifiedName}\\s*\\(`, "i") : new RegExp(`create\\s+policy\\s+${name}`, "i");
+	for (const file of files) {
+		const line = lineOf(file.text, pattern);
+		if (line) return {
+			file: file.path,
+			line
+		};
+	}
+}
+//#endregion
+//#region src/cli/doctor/options.ts
+/** The formats `--format` takes; `--json` picks the JSON one. */
+const FLAG_FORMATS = DOCTOR_FORMATS.filter((format) => format !== "json");
+/**
+* `--json` picks the JSON report; `--format`, then `doctor.format`, picks
+* between the others.
+*/
+function reportFormat(args, configured) {
+	if (args.format === "json") throw new CliError("usage", "--format json is now the global --json flag");
+	if (args.json === true) {
+		if (args.format !== void 0) throw new CliError("usage", "Pass --json or --format, not both");
+		return "json";
+	}
+	if (args.format === void 0) return configured;
+	const format = FLAG_FORMATS.find((candidate) => candidate === args.format);
+	if (!format) throw new CliError("invalid_value", `--format must be one of ${FLAG_FORMATS.join(", ")}`);
+	return format;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** `--as <uuid>` or `--claims <json>` as `request.jwt.claims`. */
+function explainClaims(args) {
+	const as = args.as;
+	const claims = args.claims;
+	if (as && claims) return { error: "Pass --as or --claims, not both" };
+	if (as) {
+		if (!UUID.test(as)) return { error: `--as takes a user id (uuid), got "${as}"` };
+		return {
+			sub: as,
+			role: "authenticated"
+		};
+	}
+	if (!claims) return { role: "anon" };
+	try {
+		const parsed = JSON.parse(claims);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { error: "--claims takes a JSON object" };
+		return {
+			role: "anon",
+			...parsed
+		};
+	} catch (cause) {
+		return { error: `--claims is not valid JSON: ${errorText(cause)}` };
+	}
+}
+//#endregion
+//#region src/cli/commands/doctor.ts
+const ARGS = {
+	format: {
+		type: "string",
+		description: "text, sarif (code scanning) or github (workflow annotations); also tooling.doctor.format, default text. --json for the JSON report",
+		valueHint: "format"
+	},
+	out: {
+		type: "string",
+		description: "Write the report to a file; also tooling.doctor.output",
+		valueHint: "file"
+	},
+	only: {
+		type: "string",
+		description: "Run only these checks, e.g. --only BS100,BS304; also tooling.doctor.only",
+		valueHint: "codes"
+	},
+	ignore: {
+		type: "string",
+		description: "Skip checks; also tooling.doctor.ignore in the config",
+		valueHint: "codes"
+	},
+	"fail-on": {
+		type: "string",
+		description: "Exit 1 on findings at this level: error (the default), warning (the default with tooling.doctor.strict) or never",
+		valueHint: "level"
+	},
+	metadata: {
+		type: "string",
+		description: "Check a GeneratorMetadata document (- for stdin); checks it lacks data for are skipped",
+		valueHint: "path|-"
+	},
+	stats: {
+		type: "boolean",
+		description: "Report slow frequent statements from pg_stat_statements (BS209)"
+	},
+	explain: {
+		type: "string",
+		description: "EXPLAIN ANALYZE these tables under RLS, rolled back (BS212)",
+		valueHint: "tables"
+	},
+	as: {
+		type: "string",
+		description: "Plan as this authenticated user, and measure the claims the custom access token hook returns for them (BS405)",
+		valueHint: "uuid"
+	},
+	claims: {
+		type: "string",
+		description: "Plan with these JWT claims ({\"role\":\"authenticated\",...})",
+		valueHint: "json"
+	},
+	"fix-grants": {
+		type: "boolean",
+		description: "Print the grant and revoke SQL BS404 asks for, to add to your schema or migration"
+	},
+	fix: {
+		type: "boolean",
+		description: "Run the SQL that resolves findings which carry a fix, such as validating a not valid check (BS236), against the database"
+	}
+};
+/** Where `--fix` writes, for the consent detail: a host, or the project. */
+async function fixTarget(config, env, options, projectRef) {
+	if (projectRef !== void 0) return {
+		local: false,
+		where: `project ${projectRef}`
+	};
+	const url = await databaseUrl(config, env, options.dbUrl).catch(() => void 0);
+	return url === void 0 ? {
+		local: false,
+		where: "the database"
+	} : {
+		local: isLocalDatabaseUrl(url),
+		where: databaseHost(url)
+	};
+}
+/**
+* Runs the fix of each finding that has one, and returns the findings left: the
+* ones without a fix, and the ones whose fix failed, with the error.
+*/
+async function applyFixes(findings, database, consent, log) {
+	if (findings.filter((finding) => finding.fix !== void 0).length === 0 || !database || "skipped" in database) return {
+		left: [...findings],
+		fixed: 0
+	};
+	await consent();
+	const left = [];
+	let fixed = 0;
+	for (const finding of findings) {
+		if (finding.fix === void 0) {
+			left.push(finding);
+			continue;
+		}
+		try {
+			await database.query(finding.fix);
+			fixed += 1;
+			log(`Fixed ${finding.code} ${finding.target ?? finding.title}.`);
+		} catch (cause) {
+			await database.query("rollback").catch(() => []);
+			left.push({
+				...finding,
+				message: `${finding.message} doctor --fix failed: ${errorText(cause)}`
+			});
+		}
+	}
+	return {
+		left,
+		fixed
+	};
+}
+async function runDoctor(config, args, env, options = {}) {
+	const format = reportFormat(args, config.doctor.format);
+	const only = args.only === void 0 ? [...config.doctor.only] : list(args.only);
+	const ignore = /* @__PURE__ */ new Set([...config.doctor.ignore, ...list(args.ignore)]);
+	const unknown = [...only, ...ignore].filter((code) => !RULE_CODES.includes(code));
+	if (unknown.length > 0) throw new CliError("usage", `Unknown check ${unknown.join(", ")}. Checks: ${RULE_CODES.join(", ")}`);
+	const explainTables = list(args.explain);
+	const stats = args.stats === true;
+	const claims = explainClaims(args);
+	if ("error" in claims) throw new CliError("usage", String(claims.error));
+	if (args.claims !== void 0 && explainTables.length === 0) throw new CliError("usage", "--claims plans a query, so it needs --explain <table>.");
+	const hookUser = args.as;
+	const asked = /* @__PURE__ */ new Set([
+		...stats ? ["BS209"] : [],
+		...explainTables.length > 0 ? ["BS212"] : [],
+		...hookUser ? ["BS405"] : []
+	]);
+	const fixGrants = args["fix-grants"] === true;
+	const rules = fixGrants ? RULES.filter((rule) => rule.code === "BS404") : RULES.filter((rule) => (only.length === 0 || only.includes(rule.code) || asked.has(rule.code)) && !ignore.has(rule.code));
+	const snapshotPath = args.snapshot;
+	const dbUrl = options.dbUrl;
+	const projectRef = args["project-ref"];
+	const source = {
+		...stats || explainTables.length > 0 || hookUser || args.fix === true ? { live: true } : {},
+		...snapshotPath ? { snapshotPath } : {},
+		...dbUrl ? { dbUrl } : {},
+		...projectRef ? { projectRef } : {},
+		...options.signal ? { signal: options.signal } : {}
+	};
+	const pg = options.connect ?? connect;
+	const wantsLive = hookUser !== void 0 || rules.some((rule) => LIVE_CODES.has(rule.code));
+	const opened = options.snapshot || !wantsLive ? {
+		advisors: options.advisors,
+		database: options.database,
+		close: () => Promise.resolve()
+	} : {
+		...openLive(config, env, source, pg),
+		...options.advisors === void 0 ? {} : { advisors: options.advisors },
+		...options.database === void 0 ? {} : { database: options.database }
+	};
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers, contentMapper, stackEnv, localStacks] = await Promise.all([
+		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
+		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
+		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml, sqlWorkflow(config, toml))]),
+		readText(config.root, ".gitignore"),
+		sourceFiles(config),
+		compiledReadSets(config).catch((cause) => ({ skipped: errorText(cause) })),
+		options.peers ?? peerVersions(config.root).catch(() => []),
+		options.contentMapper ?? (config.gen.contentMapper === true && rules.some((rule) => rule.code === "BS602") ? contentMapperSetup$1(config.root) : void 0),
+		options.stackEnv ?? (rules.some((rule) => rule.code === "BS503") ? loadStackEnvCheck(config.root, env, options.signal) : void 0),
+		options.localStacks ?? (rules.some((rule) => rule.code === "BS700" || rule.code === "BS701") ? loadLocalStackCheck(config.root, env) : void 0)
+	]).catch(async (cause) => {
+		await opened.close();
+		throw cause;
+	});
+	const replay = opened.open ? (await opened.open()).replay : void 0;
+	const live = replay ? {
+		advisors: options.advisors ?? { skipped: replay },
+		database: options.database ?? { skipped: replay }
+	} : opened;
+	const context = {
+		config,
+		snapshot,
+		sqlFiles: sql,
+		configToml,
+		envFiles,
+		gitignore: gitignore?.text ?? "",
+		sources,
+		readSets,
+		peers,
+		...contentMapper ? { contentMapper } : {},
+		...stackEnv ? { stackEnv } : {},
+		shellEnv: env[PROCESS_ENV] ?? {},
+		...localStacks ? { localStacks } : {},
+		...live.advisors ? { advisors: live.advisors } : {},
+		...live.database ? { database: live.database } : {},
+		...stats ? { stats } : {},
+		...hookUser ? { hookUser } : {},
+		...explainTables.length > 0 ? { explain: {
+			tables: explainTables,
+			claims
+		} } : {}
+	};
+	if (fixGrants) {
+		await opened.close();
+		return {
+			code: 0,
+			output: hookGrantBlock(hookGrantProblems(context), workflowOf(context))
+		};
+	}
+	let ran;
+	try {
+		ran = await runRules(context, rules);
+		if (args.fix === true) {
+			const count = ran.filter((finding) => finding.fix !== void 0).length;
+			({left: ran} = await applyFixes(ran, context.database, async () => {
+				const target = await fixTarget(config, env, options, projectRef);
+				if (!target.local) options.requireConsent?.({
+					effect: "database-write",
+					detail: `doctor --fix runs ${String(count)} fix(es) against ${target.where}`
+				});
+			}, options.log ?? (() => {})));
+		}
+	} finally {
+		await opened.close();
+	}
+	const findings = ran.map((finding) => {
+		if (finding.location || !finding.object) return finding;
+		const location = locate(sql, finding.object);
+		return location ? {
+			...finding,
+			location
+		} : finding;
+	});
+	const out = args.out ?? (format === config.doctor.format ? config.doctor.output : void 0);
+	const fromRepo = format === "sarif" || format === "github";
+	const repoRoot = findRepoRoot(config.root);
+	const repoPath = (file) => display(repoRoot, resolve(config.root, file));
+	const report = formatReport(fromRepo ? findings.map((finding) => finding.location ? {
+		...finding,
+		location: {
+			...finding.location,
+			file: repoPath(finding.location.file)
+		}
+	} : finding) : findings, {
+		format,
+		rules,
+		version: VERSION,
+		fallbackFile: repoPath(context.configToml?.path ?? "package.json"),
+		...options.paint && !out ? { paint: options.paint } : {}
+	});
+	const errors = findings.filter((finding) => finding.severity === "error").length;
+	const warnings = findings.filter((finding) => finding.severity === "warning").length;
+	const failOn = args["fail-on"] ?? (config.doctor.strict ? "warning" : "error");
+	if (failOn !== "error" && failOn !== "warning" && failOn !== "never") throw new CliError("usage", `--fail-on takes error, warning or never, got "${failOn}".`);
+	const code = failOn !== "never" && (errors > 0 || failOn === "warning" && warnings > 0) ? 1 : 0;
+	const failure = code === 0 ? {} : {
+		errorCode: "findings",
+		error: `Doctor found ${errors} errors and ${warnings} warnings${failOn === "warning" ? " (--fail-on warning)" : ""}.`
+	};
+	if (out) {
+		const applied = await applyPlan({
+			root: config.root,
+			regenerate: "better-supabase doctor",
+			files: [{
+				path: insideRoot(config.root, out, "--out"),
+				contents: `${report}\n`,
+				note: `${errors} errors, ${warnings} warnings`
+			}]
+		}, {});
+		return {
+			code,
+			output: changeLines(applied).join("\n"),
+			data: {
+				out,
+				errors,
+				warnings
+			},
+			...failure
+		};
+	}
+	return format === "json" ? {
+		code,
+		data: jsonReport(findings, VERSION),
+		...failure
+	} : {
+		code,
+		output: report,
+		...failure
+	};
+}
+const ruleCodes = () => [.../* @__PURE__ */ new Set([...RULE_CODES, ...LIVE_CODES])];
+const doctorCommand = defineCliCommand({
+	meta: commandMeta("doctor"),
+	args: {
+		...SOURCE_ARGS,
+		...ARGS
+	},
+	lists: [
+		"only",
+		"ignore",
+		"explain"
+	],
+	completions: {
+		format: () => FLAG_FORMATS,
+		only: ruleCodes,
+		ignore: ruleCodes
+	},
+	run: async (args, { config, cwd, env, io, log, paint, requireConsent, signal }) => {
+		if (args.metadata !== void 0) {
+			refuseWithMetadata([
+				...sourceFlags(args),
+				...args.stats === true ? ["--stats"] : [],
+				...args.explain === void 0 ? [] : ["--explain"],
+				...args.as === void 0 ? [] : ["--as"],
+				...args.fix === true ? ["--fix"] : []
+			]);
+			let snapshot;
+			try {
+				snapshot = await readMetadataSnapshot(args.metadata, cwd, io);
+			} catch (cause) {
+				if (cause instanceof MetadataRejectedError) return {
+					code: 65,
+					errorCode: "invalid_input",
+					error: cause.message
+				};
+				throw cause;
+			}
+			const skipped = `reading a GeneratorMetadata document; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+			return runDoctor(config, args, env, {
+				snapshot,
+				advisors: { skipped },
+				database: { skipped },
+				paint
+			});
+		}
+		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+		const check = () => runDoctor(config, args, env, {
+			paint,
+			requireConsent,
+			log: log.info,
+			...dbUrl ? { dbUrl } : {},
+			...signal ? { signal } : {}
+		});
+		return args.snapshot === void 0 ? log.progress("Checking the database", check) : check();
+	}
+});
+//#endregion
+export { doctorCommand };