better-supabase 0.13.0 → 0.15.0

package/dist/context-DBicfUNz.js

@@ -0,0 +1,41 @@
+import { i as userContext } from "./impersonation-DM3oWNoD.js";
+//#region src/auth/context.ts
+/** The repository context (`actor`, `claims`) for an auth state. */
+function authContext(auth) {
+	switch (auth.kind) {
+		case "user": return userContext(auth.user, auth.claims);
+		case "service": return {
+			actor: {
+				id: `service:${auth.keyName}`,
+				kind: "service",
+				role: "service_role"
+			},
+			claims: { role: "service_role" }
+		};
+		case "apiKey": return {
+			actor: auth.userId ? {
+				id: auth.userId,
+				kind: "user",
+				role: "authenticated"
+			} : {
+				id: `api-key:${auth.keyId}`,
+				kind: "service",
+				role: "authenticated"
+			},
+			claims: auth.claims,
+			...auth.organizationId ? { tenant: auth.organizationId } : {}
+		};
+		case "anon":
+		case "invalid": return {
+			actor: {
+				id: "anon",
+				kind: "anon",
+				role: "anon"
+			},
+			claims: { role: "anon" }
+		};
+		default: return auth;
+	}
+}
+//#endregion
+export { authContext as t };

package/dist/controller-BNZKd6bJ.js

@@ -0,0 +1,73 @@
+import { n as whileSignedIn, t as defineController } from "./controller-BEliOBOv.js";
+import { r as recordEventMatches } from "./record-bindings-DkBJpC5A.js";
+import { f as findBinding, p as loadBindings } from "./record-type-DRbnlj5q.js";
+//#region src/records/controller.ts
+/**
+* One record page's bindings for the signed-in user over one realtime
+* subscription (ADR 0030): it loads them with `loadBindings`, and loads a
+* binding again when `topic` carries one of its events.
+*/
+function createRecordController(options) {
+	const { source, subject, bindings } = options;
+	const topic = options.topic ?? null;
+	return defineController({
+		bindings: void 0,
+		summary: void 0,
+		status: "closed",
+		error: void 0
+	}, (state) => {
+		const tickets = /* @__PURE__ */ new Map();
+		const loadSummary = async () => {
+			if (subject === null || options.summary === void 0) return;
+			const ticket = (tickets.get("") ?? 0) + 1;
+			tickets.set("", ticket);
+			const result = await options.summary.summary(subject, bindings, options.summaryOptions);
+			if (tickets.get("") !== ticket) return;
+			state.set(result.ok ? {
+				summary: result.data,
+				error: void 0
+			} : { error: result.error });
+		};
+		const loadNamed = async (names) => {
+			if (subject === null || names.length === 0) return;
+			const mine = new Map(names.map((name) => {
+				const ticket = (tickets.get(name) ?? 0) + 1;
+				tickets.set(name, ticket);
+				return [name, ticket];
+			}));
+			const loaded = await loadBindings(source, subject, names, options);
+			const current = names.filter((name) => tickets.get(name) === mine.get(name));
+			if (current.length === 0) return;
+			state.set((snapshot) => ({ bindings: {
+				...snapshot.bindings,
+				...Object.fromEntries(current.map((name) => [name, loaded[name]]))
+			} }));
+		};
+		const refresh = async (names) => {
+			await (names === void 0 ? Promise.all([loadNamed(bindings), loadSummary()]) : loadNamed(names));
+		};
+		const stale = (event) => {
+			const matching = bindings.filter((name) => (findBinding(source.blocks, name)?.binding.events ?? []).some((pattern) => recordEventMatches(pattern, event)));
+			return matching.length === 0 ? bindings : matching;
+		};
+		return {
+			actions: { refresh },
+			start: () => subject === null ? void 0 : whileSignedIn(options.auth, () => {
+				refresh();
+				if (topic === null) return;
+				const { leave } = options.ports.topic(topic, {
+					onMessage: (event) => {
+						Promise.all([loadNamed(stale(event)), loadSummary()]);
+					},
+					onRejoin: () => void refresh(),
+					onStatus: (status) => {
+						state.set({ status });
+					}
+				});
+				return leave;
+			})
+		};
+	});
+}
+//#endregion
+export { createRecordController as t };

package/dist/controller-BrP0gn47.d.ts

@@ -0,0 +1,52 @@
+import { a as ClientAuth } from "./bind-CrMBwrPN.js";
+//#region src/blocks/controller.d.ts
+/**
+ * A block's client state, framework-agnostic. `subscribe` and `getSnapshot`
+ * follow the external-store contract, so React's `useSyncExternalStore`, a Vue
+ * `shallowRef` or a Svelte store wrap it in a few lines.
+ */
+interface Controller<S, A> {
+  /**
+   * Adds a listener. The first one starts the controller's work (loads,
+   * realtime, shortcuts) and the last one to leave stops it.
+   */
+  readonly subscribe: (listener: () => void) => () => void;
+  /** The current state; the same object until it changes. */
+  readonly getSnapshot: () => S;
+  readonly actions: A;
+  /**
+   * Stops the work and drops every listener; the controller stays idle after
+   * it.
+   */
+  readonly dispose: () => void;
+}
+/** The session a controller follows: `bsb.auth` from `createClient()`. */
+type AuthPort = Pick<ClientAuth, "current" | "subscribe">;
+interface ControllerState<S> {
+  readonly get: () => S;
+  /**
+   * Merges `patch` into the state; listeners hear of it only when a value
+   * changed.
+   */
+  readonly set: (patch: Partial<S> | ((current: S) => Partial<S>)) => void;
+  /**
+   * The current run: it changes when the controller starts or stops, so an
+   * answer that arrives after a restart is dropped with `run !== state.run()`.
+   */
+  readonly run: () => number;
+}
+interface ControllerParts<A> {
+  readonly actions: A;
+  /** Runs when the first listener subscribes; returns the cleanup. */
+  readonly start?: () => (() => void) | undefined;
+}
+/** Builds a controller from its initial state, its actions and its work. */
+declare function defineController<S extends object, A>(initial: S, build: (state: ControllerState<S>) => ControllerParts<A>): Controller<S, A>;
+/**
+ * Runs `effect` for the signed-in user, and again after its cleanup when
+ * another user signs in. Nothing runs while the session loads or is signed out.
+ * Returns the function that stops following the session.
+ */
+declare function whileSignedIn(auth: AuthPort, effect: (userId: string) => (() => void) | undefined): () => void;
+//#endregion
+export { defineController as a, ControllerState as i, Controller as n, whileSignedIn as o, ControllerParts as r, AuthPort as t };

package/dist/conversion-BAbucuXq.d.ts

@@ -0,0 +1,86 @@
+import { f as Result } from "./result-DZeA5KS6.js";
+import { Bt as Action, Ht as ActionContext, Vt as ActionCall } from "./define-block-BVcLQ3DF.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/blocks/automations/conversion.d.ts
+/** A record a conversion reads from or creates: its subject type and id. */
+interface ConversionRef {
+  readonly type: string;
+  readonly id: string;
+}
+/** The part of the relations block a conversion uses; `blocks.relations` fits. */
+interface ConversionRelations {
+  link(source: ConversionRef, target: ConversionRef, input: {
+    readonly kind: "created_from";
+  }): PromiseLike<Result<unknown>>;
+  convertedInto(origin: ConversionRef, intoType: string): PromiseLike<Result<string | undefined>>;
+}
+/**
+ * The clients every conversion gets; a conversion names the other blocks it
+ * needs.
+ */
+interface ConversionClients {
+  readonly relations: ConversionRelations;
+}
+/** What a conversion's hooks receive for one action call. */
+interface ConversionContext<C> {
+  readonly clients: C;
+  /** The organization the event belongs to. */
+  readonly tenant: string;
+  readonly call: ActionCall;
+  /** The record the event is about. */
+  readonly source: ConversionRef;
+}
+/** What `defineConversionAction` takes. */
+interface ConversionSpec<C extends ConversionClients, S, T> {
+  readonly kind: string;
+  readonly title: string;
+  readonly description?: string;
+  /**
+   * The subject type the action creates, such as `work_item`. A default
+   * automation's `config.targetType` overrides it with the renamed type.
+   */
+  readonly targetType: string;
+  /**
+   * The record the event is about. Default: the action context's subject.
+   * `undefined` skips the call.
+   */
+  readonly source?: (context: ActionContext) => ConversionRef | undefined;
+  /**
+   * The block clients for one organization, such as `createBlocks` with
+   * `tenant: () => tenant` over a service connection.
+   */
+  readonly clients: (tenant: string) => C | PromiseLike<C>;
+  /** Reads what `map` needs, such as the source record. */
+  readonly load?: (context: ConversionContext<C>) => PromiseLike<Result<S>>;
+  /** The target block's input schema; the mapped value must pass it. */
+  readonly input?: StandardSchemaV1<T>;
+  /** Turns what `load` read into the target block's input. */
+  readonly map: (loaded: S, context: ConversionContext<C>) => T;
+  /** Creates the target record and returns its id. */
+  readonly create: (input: T, context: ConversionContext<C>) => PromiseLike<Result<{
+    readonly id: string;
+  }>>;
+  /**
+   * The target block records the `created_from` link itself, as
+   * `employees.fromApplication` does.
+   */
+  readonly linksItself?: boolean;
+}
+/** What a conversion action did with one call. */
+type ConversionOutcome = {
+  readonly status: "created";
+  readonly target: ConversionRef;
+} | {
+  readonly status: "exists";
+  readonly target: ConversionRef;
+} | {
+  readonly status: "skipped";
+};
+/**
+ * An action that turns the event's record into a record of another block, once:
+ * the new record is linked `created_from` the source, so `relations.lineage`
+ * finds the chain and a retried event returns the first record (`exists`).
+ */
+declare function defineConversionAction<C extends ConversionClients, S = undefined, T = unknown>(spec: ConversionSpec<C, S, T>): Action;
+//#endregion
+export { ConversionRelations as a, ConversionRef as i, ConversionContext as n, ConversionSpec as o, ConversionOutcome as r, defineConversionAction as s, ConversionClients as t };

package/dist/conversion-Dq1S7xzE.js

@@ -0,0 +1,77 @@
+import { n as dbError } from "./errors-BVFgt8BZ.js";
+import { a as ok, r as err } from "./result-ntFBW2p2.js";
+import { r as defineAction } from "./automation-D41DXyvT.js";
+//#region src/blocks/automations/conversion.ts
+async function validated(schema, value) {
+	if (schema === void 0) return ok(value);
+	const checked = await schema["~standard"].validate(value);
+	if (checked.issues === void 0) return ok(checked.value);
+	return err(dbError("validation", "The conversion's mapped input doesn't pass the target schema", { issues: checked.issues.map((issue) => ({
+		message: issue.message,
+		...issue.path === void 0 ? {} : { path: issue.path.map((part) => typeof part === "object" ? part.key : part) }
+	})) }));
+}
+function targetTypeOf(call, fallback) {
+	const configured = call.action.config?.["targetType"];
+	return typeof configured === "string" && configured !== "" ? configured : fallback;
+}
+/**
+* An action that turns the event's record into a record of another block, once:
+* the new record is linked `created_from` the source, so `relations.lineage`
+* finds the chain and a retried event returns the first record (`exists`).
+*/
+function defineConversionAction(spec) {
+	return defineAction({
+		kind: spec.kind,
+		title: spec.title,
+		...spec.description === void 0 ? {} : { description: spec.description },
+		run: async (call) => {
+			const { context } = call;
+			const source = spec.source === void 0 ? {
+				type: context.subjectType,
+				id: context.subjectId
+			} : spec.source(context);
+			if (source === void 0 || source.id === "") return ok({ status: "skipped" });
+			const tenant = context.organizationId;
+			const targetType = targetTypeOf(call, spec.targetType);
+			const clients = await spec.clients(tenant);
+			const existing = await clients.relations.convertedInto(source, targetType);
+			if (!existing.ok) return existing;
+			if (existing.data !== void 0) return ok({
+				status: "exists",
+				target: {
+					type: targetType,
+					id: existing.data
+				}
+			});
+			const hooks = {
+				clients,
+				tenant,
+				call,
+				source
+			};
+			const skipped = ok(void 0);
+			const loaded = spec.load === void 0 ? skipped : await spec.load(hooks);
+			if (!loaded.ok) return loaded;
+			const { map } = spec;
+			const input = await validated(spec.input, map(loaded.data, hooks));
+			if (!input.ok) return input;
+			const created = await spec.create(input.data, hooks);
+			if (!created.ok) return created;
+			const target = {
+				type: targetType,
+				id: created.data.id
+			};
+			if (spec.linksItself !== true) {
+				const linked = await clients.relations.link(target, source, { kind: "created_from" });
+				if (!linked.ok) return linked;
+			}
+			return ok({
+				status: "created",
+				target
+			});
+		}
+	});
+}
+//#endregion
+export { defineConversionAction as t };

package/dist/create/index.d.ts

@@ -1,14 +1,13 @@
 /// <reference lib="esnext.temporal" />
-import { et as ModuleAccessProvider } from "../index-DdZcWH6q.js";
-import { Cn as AppColumnFormat, En as AppOnDeleteAction, Fn as AppTableVersions, at as Preset, vn as APP_ON_DELETE_ACTIONS, wn as AppColumnType, xn as AppColumnAccess } from "../codegen-DGtOsqz9.js";
-import { c as DesignChange, g as DesignErrorCode, p as CreateDesign, z as PresetInput } from "../index-PADpaDku.js";
+import { Nn as PresetSpec, Un as PresetName, g as BlockSqlAccessProvider, ir as AppColumnAccess, lr as AppOnDeleteAction, mt as PresetInput, or as AppColumnFormat, si as Preset, sr as AppColumnType, tr as APP_ON_DELETE_ACTIONS, vr as AppTableVersions } from "../context-CEuTKrkz.js";
+import { a as DesignChange, p as DesignErrorCode, u as CreateDesign } from "../index-C-qpk8EQ.js";
 import { a as SupabaseLint, o as SupabaseOrganization, s as SupabaseProject } from "../management-wtecfrNf.js";
 import { t as PresetMigrationFile } from "../types-DGHfTW8_.js";
 //#region src/create/design-computed.d.ts
 /** The aggregates a rollup takes (`APP_ROLLUP_AGGREGATES`). */
 export declare const ROLLUP_AGGREGATES: readonly ["count", "sum", "min", "max", "avg"];
 export type RollupAggregate = (typeof ROLLUP_AGGREGATES)[number];
-/** `appTables.<table>.rollups.<name>`; the shape of `AppRollupConfig`. */
+/** `tables.<table>.rollups.<name>`; the shape of `AppRollupConfig`. */
 export interface AppRollup {
   readonly table: string;
   readonly via: string;
@@ -19,7 +18,7 @@ export interface AppRollup {
     readonly equals: string;
   };
 }
-/** `appTables.<table>.lookups.<name>`; the shape of `AppLookupConfig`. */
+/** `tables.<table>.lookups.<name>`; the shape of `AppLookupConfig`. */
 export interface AppLookup {
   readonly via: string;
   readonly column: string;
@@ -75,8 +74,7 @@ export declare function tableWithoutComputed(table: AppTable, name: string): App
 /**
  * The tables with every rollup and lookup that no longer fits dropped: one
  * whose table, link or column was deleted or retyped, or whose name a column
- * now uses. `sql sync` would refuse them, and the design code would not
- * encode.
+ * now uses. `upgrade` would refuse them, and the design code would not encode.
  */
 export declare function prunedComputed(tables: Tables): Tables;
 /** The rollups that aggregate `from`, pointed at `to`. */
@@ -219,7 +217,7 @@ export declare function schemaRelations(tables: readonly SchemaTable[]): readonl
 //#endregion
 //#region src/create/design-subject.d.ts
 /**
- * Makes the rows a subject (`appTables.<table>.subject`); the shape of
+ * Makes the rows a subject (`tables.<table>.subject`); the shape of
  * `AppTableSubject`.
  */
 export interface AppSubject {
@@ -287,6 +285,11 @@ export interface AppColumn {
    * (ADR 0051).
    */
   readonly access?: AppColumnAccess;
+  /**
+   * Stores ciphertext with the tenant's Vault key; read through
+   * `<table>_reveal`.
+   */
+  readonly encrypted?: boolean;
 }
 export type AppScope = "inherit" | "user" | "none";
 export type AppTableId = "uuid" | "bigint";
@@ -303,6 +306,8 @@ export interface AppTable {
   readonly lookups?: Readonly<Record<string, AppLookup>>;
   /** Outbox events on insert, update and delete; the shape of `AppTableEvents`. */
   readonly events?: true | AppEvents;
+  /** One `read` audit entry per tenant per reveal call. */
+  readonly auditReads?: boolean;
 }
 /**
  * What the canvas adds to a preset: app tables, extra columns on block tables
@@ -435,7 +440,7 @@ export interface DesignIssue {
   readonly message: string;
 }
 /**
- * What would stop `sql sync` from writing the design: a table name a block
+ * What would stop `upgrade` from writing the design: a table name a block
  * already uses, a reference to a table the preset no longer installs, a
  * set-null delete on a required column, a composite key on a column the table
  * doesn't have, and extra columns for a block that is gone or no longer takes
@@ -465,7 +470,7 @@ export type DesignCheck = {
   readonly issues: readonly DesignIssue[];
 };
 /**
- * Checks a design against a preset with every rule the canvas and `sql sync`
+ * Checks a design against a preset with every rule the canvas and `upgrade`
  * apply, so a server, an MCP tool and the canvas share one answer. `input` is a
  * design object, a design code or a `/create` URL with `&design=`. It never
  * throws for a bad design or preset: each problem is an issue.
@@ -478,6 +483,11 @@ export declare function checkDesign(input: unknown, preset: PresetInput): Promis
  * which `appTables` refuses: nobody but the server could insert a row.
  */
 export declare function lockedWithoutDefault(column: AppColumn): boolean;
+/**
+ * Whether a column can be encrypted: not a `text[]`, and no unique key,
+ * reference or identity, which only work on the stored value.
+ */
+export declare function encryptable(column: AppColumn): boolean;
 /** Whether `min` and `max` apply to a `type` column, as a value or a length. */
 export declare function takesBounds(type: AppColumnType): boolean;
 /**
@@ -560,8 +570,8 @@ export declare function newDeployId(): string;
 export interface DeployRecord {
   readonly id: string;
   readonly ref: string;
-  /** The preset code. */
-  readonly preset: string;
+  /** The preset, as the config's `preset` key takes it. */
+  readonly preset: PresetName | PresetSpec;
   /** The design code, or `null` when the preset had no design. */
   readonly design: string | null;
   readonly migration: string;
@@ -574,9 +584,9 @@ export interface DeployQueryOptions {
 }
 /**
  * The SQL of one migration for the rendered files: every schema file, then
- * every data file, each in render order, which is the order `sql sync` and `sql
- * data` apply them. pgTAP tests stay out. Throws a `TypeError` when `id` holds
- * anything but letters, digits, `_` and `-`.
+ * every data file, each in render order, which is the order `upgrade` and `add
+ * --adopt` apply them. pgTAP tests stay out. Throws a `TypeError` when `id`
+ * holds anything but letters, digits, `_` and `-`.
  */
 export declare function deployQuery(files: readonly PresetMigrationFile[], options?: DeployQueryOptions): string;
 /** A database password for a new project: 32 base64url characters. */
@@ -606,8 +616,8 @@ export interface DeployResponse {
   /** The id written at the top of the migration; store it in a `DeployRecord`. */
   readonly id: string;
   readonly ref: string;
-  /** The preset code. */
-  readonly preset: string;
+  /** The preset, as the config's `preset` key takes it. */
+  readonly preset: PresetName | PresetSpec;
   /** The design code, or `null` when the preset had no design. */
   readonly design: string | null;
   readonly migration: string;
@@ -668,13 +678,13 @@ export declare function undoHistory<T>(current: History<T>, action: HistoryActio
  * a `provider` schema that no real project has: the preview says so next to the
  * output.
  */
-export declare function previewAccessProvider(preset: Preset): ModuleAccessProvider;
+export declare function previewAccessProvider(preset: Preset): BlockSqlAccessProvider;
 /**
- * The files `sql sync` writes for a config with only this preset and its
+ * The files `upgrade` writes for a config with only this preset and its
  * `/create` design (app tables and extra columns). With `access: "provider"`
  * the access functions come from `previewAccessProvider`.
  */
-export declare function previewFiles(code: string, design?: CreateDesign): readonly PresetMigrationFile[];
+export declare function previewFiles(input: PresetInput, design?: CreateDesign): readonly PresetMigrationFile[];
 //#endregion
 //#region src/create/sample-rows.d.ts
 /** One sample row: column name to the text the grid shows, or `null`. */
@@ -687,8 +697,9 @@ export declare const SAMPLE_ROW_COUNT = 8;
 /** Who reads the rows: a signed-in member, or server code with the service role. */
 export type SampleViewer = "member" | "server";
 /**
- * The columns of `table` a `viewer` can't select: `access: "server"` ones for a
- * member.
+ * The columns of `table` a `viewer` can't select: `access: "server"` and
+ * encrypted ones for a member, who reads an encrypted column through
+ * `<table>_reveal` instead.
  */
 export declare function hiddenColumns(table: AppTable | undefined, viewer: SampleViewer): readonly string[];
 /**
@@ -735,6 +746,6 @@ export type MigrationPlan = {
  * rename, a retype, a changed default or a change outside `appTables`, is
  * refused so a deploy never guesses.
  */
-export declare function migrationBetween(code: string, base: CreateDesign, next: CreateDesign): MigrationPlan;
+export declare function migrationBetween(preset: PresetInput, base: CreateDesign, next: CreateDesign): MigrationPlan;
 //#endregion
 export { type AppColumnAccess, type AppColumnType, APP_ON_DELETE_ACTIONS as ON_DELETE_ACTIONS, type AppOnDeleteAction as OnDeleteAction, type PresetMigrationFile };

package/dist/create/index.js

@@ -1,8 +1,8 @@
-import { c as PRESET_CATALOG, i as presetOf, s as resolvePreset, v as encodePreset } from "../config-V6HMvce5.js";
-import { a as appDefaultError, c as appReservedColumns, o as appIdentifierError, p as isAppDefault, s as appNameLengthError, x as APP_ON_DELETE_ACTIONS } from "../app-tables-0YZ9IskE.js";
-import { o as resolveConfig } from "../config-xUf0dj0t.js";
-import { _ as encodeDesign, a as DesignParseError, b as parseDesign, h as designOf, n as diffDesigns, o as DesignTooLongError, u as designConfig, y as jsonPointer } from "../preset-HNFqCWaD.js";
-import { D as SQL_MODULES, h as renderModules, i as moduleLayout } from "../sql-frpIs51D.js";
+import { a as presetOf, d as resolvePreset } from "../config-CcehOvbz.js";
+import { C as APP_ON_DELETE_ACTIONS, E as PRESET_CATALOG, a as appIdentifierError, m as isAppDefault, o as appNameLengthError, p as appDefaultError, s as appReservedColumns } from "../app-tables-D29Rahtg.js";
+import { c as resolveConfig } from "../config-DWGgUQCh.js";
+import { _ as jsonPointer, a as DesignParseError, h as encodeDesign, n as diffDesigns, o as DesignTooLongError, p as designOf, u as designConfig, v as parseDesign } from "../preset-CsHnIBJF.js";
+import { F as SQL_MODULES, h as renderBlocks, i as moduleLayout } from "../sql-ClHIdgKS.js";
 //#region src/create/column-keys.ts
 /** The most options a select takes, and the longest option. */
 const MAX_OPTIONS = 100;
@@ -42,6 +42,13 @@ const CONTROL = /\p{Cc}/u;
 function lockedWithoutDefault(column) {
 	return column.access !== void 0 && column.nullable === false && column.default === void 0 && column.identity !== true;
 }
+/**
+* Whether a column can be encrypted: not a `text[]`, and no unique key,
+* reference or identity, which only work on the stored value.
+*/
+function encryptable(column) {
+	return column.type !== "text[]" && column.unique !== true && column.references === void 0 && column.identity !== true;
+}
 /** Whether `min` and `max` apply to a `type` column, as a value or a length. */
 function takesBounds(type) {
 	return type === "text" || NUMBER_TYPES.has(type);
@@ -59,7 +66,7 @@ function fitsBound(type, value) {
 * integer and bigint, and a default an identity or the type refuses.
 */
 function fitted(column) {
-	const { format, options, min, max, identity, default: fallback, nullable, ...rest } = column;
+	const { format, options, min, max, identity, default: fallback, nullable, encrypted, ...rest } = column;
 	const { type } = column;
 	const counted = identity === true && (type === "integer" || type === "bigint");
 	const next = { ...rest };
@@ -70,6 +77,7 @@ function fitted(column) {
 	if (fitsBound(type, min)) next.min = min;
 	if (fitsBound(type, max)) next.max = max;
 	if (counted) next.identity = true;
+	if (encrypted === true && encryptable(next)) next.encrypted = true;
 	return next;
 }
 /** Why `option` can't join a select's `options`, or `undefined` when it can. */
@@ -320,8 +328,7 @@ function tableWithoutComputed(table, name) {
 /**
 * The tables with every rollup and lookup that no longer fits dropped: one
 * whose table, link or column was deleted or retyped, or whose name a column
-* now uses. `sql sync` would refuse them, and the design code would not
-* encode.
+* now uses. `upgrade` would refuse them, and the design code would not encode.
 */
 function prunedComputed(tables) {
 	return Object.fromEntries(Object.entries(tables).map(([name, table]) => {
@@ -956,7 +963,7 @@ function withDesign(data, design, preset) {
 //#endregion
 //#region src/create/design-issues.ts
 /**
-* What would stop `sql sync` from writing the design: a table name a block
+* What would stop `upgrade` from writing the design: a table name a block
 * already uses, a reference to a table the preset no longer installs, a
 * set-null delete on a required column, a composite key on a column the table
 * doesn't have, and extra columns for a block that is gone or no longer takes
@@ -1094,15 +1101,15 @@ function previewAccessProvider(preset) {
 	};
 }
 /**
-* The files `sql sync` writes for a config with only this preset and its
+* The files `upgrade` writes for a config with only this preset and its
 * `/create` design (app tables and extra columns). With `access: "provider"`
 * the access functions come from `previewAccessProvider`.
 */
-function previewFiles(code, design = {}) {
-	const preset = presetOf(code);
-	const config = resolveConfig(Object.keys(design).length === 0 ? { preset: code } : designConfig(resolvePreset(preset), design), "/");
+function previewFiles(input, design = {}) {
+	const preset = presetOf(input);
+	const config = resolveConfig(Object.keys(design).length === 0 ? { preset: input } : designConfig(resolvePreset(preset), design), "/");
 	const provider = preset.access === "provider" ? previewAccessProvider(preset) : void 0;
-	return renderModules(config.blockNames, moduleLayout(config, config.sql.testsDir, [], void 0, provider)).map((file) => ({
+	return renderBlocks(config.blockNames, moduleLayout(config, config.sql.testsDir, [], void 0, provider)).map((file) => ({
 		path: file.path,
 		module: file.module,
 		contents: file.contents
@@ -1264,7 +1271,7 @@ function tenantColumnOf(preset) {
 * Every module's file creates this table to record the installed modules. It
 * holds no app data, so the diagram leaves it out.
 */
-const BOOKKEEPING_TABLES = /* @__PURE__ */ new Set(["better_supabase.modules"]);
+const BOOKKEEPING_TABLES = /* @__PURE__ */ new Set(["better_supabase.blocks"]);
 const IDENT = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][A-Za-z0-9_$]*)`;
 const QNAME = String.raw`${IDENT}(?:\s*\.\s*${IDENT})?`;
 const CREATE_TABLE = /\bcreate\s+(?:(?:global\s+|local\s+)?(?:temp|temporary)\s+|unlogged\s+)?table\b/giu;
@@ -1593,7 +1600,7 @@ async function designFrom(input) {
 	return design;
 }
 /**
-* Checks a design against a preset with every rule the canvas and `sql sync`
+* Checks a design against a preset with every rule the canvas and `upgrade`
 * apply, so a server, an MCP tool and the canvas share one answer. `input` is a
 * design object, a design code or a `/create` URL with `&design=`. It never
 * throws for a bad design or preset: each problem is an issue.
@@ -1640,7 +1647,7 @@ async function checkDesign(input, preset) {
 			issues: [parseIssue(error)]
 		};
 	}
-	const data = schemaData(parseSchema(previewFiles(encodePreset(resolvedPreset)), { tenantColumn: tenantColumnOf(resolvedPreset) }), resolvedPreset.tenantName);
+	const data = schemaData(parseSchema(previewFiles(resolvedPreset), { tenantColumn: tenantColumnOf(resolvedPreset) }), resolvedPreset.tenantName);
 	const issues = designIssues(design, data, resolvedPreset);
 	if (issues.length > 0) return {
 		ok: false,
@@ -2001,9 +2008,9 @@ function newDeployId() {
 const DEPLOY_ID = /^[\w-]{1,64}$/u;
 /**
 * The SQL of one migration for the rendered files: every schema file, then
-* every data file, each in render order, which is the order `sql sync` and `sql
-* data` apply them. pgTAP tests stay out. Throws a `TypeError` when `id` holds
-* anything but letters, digits, `_` and `-`.
+* every data file, each in render order, which is the order `upgrade` and `add
+* --adopt` apply them. pgTAP tests stay out. Throws a `TypeError` when `id`
+* holds anything but letters, digits, `_` and `-`.
 */
 function deployQuery(files, options = {}) {
 	const { id } = options;
@@ -2094,12 +2101,13 @@ function undoHistory(current, action) {
 //#region src/create/sample-rows.ts
 const SAMPLE_ROW_COUNT = 8;
 /**
-* The columns of `table` a `viewer` can't select: `access: "server"` ones for a
-* member.
+* The columns of `table` a `viewer` can't select: `access: "server"` and
+* encrypted ones for a member, who reads an encrypted column through
+* `<table>_reveal` instead.
 */
 function hiddenColumns(table, viewer) {
 	if (viewer === "server") return [];
-	return Object.entries(table?.columns ?? {}).filter(([, column]) => column.access === "server").map(([key]) => key);
+	return Object.entries(table?.columns ?? {}).filter(([, column]) => column.access === "server" || column.encrypted === true).map(([key]) => key);
 }
 const USERS = "auth.users";
 const PEOPLE = [
@@ -2238,7 +2246,7 @@ const APP_TABLES_MODULE = "app-tables";
 * rename, a retype, a changed default or a change outside `appTables`, is
 * refused so a deploy never guesses.
 */
-function migrationBetween(code, base, next) {
+function migrationBetween(preset, base, next) {
 	const changes = diffDesigns(base, next);
 	const breaking = changes.filter((change) => change.breaking);
 	if (breaking.length > 0) return {
@@ -2252,8 +2260,8 @@ function migrationBetween(code, base, next) {
 		reason: "unsupported",
 		changes: unsupported
 	};
-	const before = new Map(previewFiles(code, base).map((file) => [file.path, file.contents]));
-	const differing = previewFiles(code, next).filter((file) => before.get(file.path) !== file.contents);
+	const before = new Map(previewFiles(preset, base).map((file) => [file.path, file.contents]));
+	const differing = previewFiles(preset, next).filter((file) => before.get(file.path) !== file.contents);
 	if (differing.some((file) => file.module !== APP_TABLES_MODULE)) return {
 		ok: false,
 		reason: "unsupported",
@@ -2266,4 +2274,4 @@ function migrationBetween(code, base, next) {
 	};
 }
 //#endregion
-export { APP_MODULE, COLUMN_KINDS, EMPTY_DESIGN, HISTORY_LIMIT, KIND_GROUPS, MIGRATION_NAME, APP_ON_DELETE_ACTIONS as ON_DELETE_ACTIONS, ROLLUP_AGGREGATES, SAMPLE_ROW_COUNT, addTable, appTableId, boundError, checkDesign, columnError, columnLabel, computedColumnRenamed, computedRows, computedTableRenamed, connect, dashboardUrl, defaultError, deleteColumn, deleteExtraColumn, deleteTable, deployBlocker, deployQuery, designIssues, duplicateTable, editTable, eventsColumnsEdited, filterColumns, fitted, fittedRollup, freeTableName, generatePassword, hiddenColumns, identifierError, initialHistory, isAppTable, isEmptyDesign, isRollupAggregate, keyColumnsOf, kindById, kindOf, lockedWithoutDefault, lookupSources, migrationBetween, moveTables, newDeployId, optionError, parseSchema, previewAccessProvider, previewFiles, prunedComputed, readableColumns, referenceFrom, renameColumn, renameTable, rollupColumns, rollupSources, sampleRows, schemaData, schemaRelations, setColumn, setColumnKind, setExtraColumn, setTableId, singular, subjectColumns, subjectColumnsEdited, subjectTypeError, suggestedProjectName, tableStatements, tableWithComputed, tableWithoutComputed, takesBounds, tenantColumnOf, tidy, undoHistory, updateTable, userConnection, withBounds, withDesign, withKind };
+export { APP_MODULE, COLUMN_KINDS, EMPTY_DESIGN, HISTORY_LIMIT, KIND_GROUPS, MIGRATION_NAME, APP_ON_DELETE_ACTIONS as ON_DELETE_ACTIONS, ROLLUP_AGGREGATES, SAMPLE_ROW_COUNT, addTable, appTableId, boundError, checkDesign, columnError, columnLabel, computedColumnRenamed, computedRows, computedTableRenamed, connect, dashboardUrl, defaultError, deleteColumn, deleteExtraColumn, deleteTable, deployBlocker, deployQuery, designIssues, duplicateTable, editTable, encryptable, eventsColumnsEdited, filterColumns, fitted, fittedRollup, freeTableName, generatePassword, hiddenColumns, identifierError, initialHistory, isAppTable, isEmptyDesign, isRollupAggregate, keyColumnsOf, kindById, kindOf, lockedWithoutDefault, lookupSources, migrationBetween, moveTables, newDeployId, optionError, parseSchema, previewAccessProvider, previewFiles, prunedComputed, readableColumns, referenceFrom, renameColumn, renameTable, rollupColumns, rollupSources, sampleRows, schemaData, schemaRelations, setColumn, setColumnKind, setExtraColumn, setTableId, singular, subjectColumns, subjectColumnsEdited, subjectTypeError, suggestedProjectName, tableStatements, tableWithComputed, tableWithoutComputed, takesBounds, tenantColumnOf, tidy, undoHistory, updateTable, userConnection, withBounds, withDesign, withKind };