better-supabase 0.14.0 → 0.15.1

package/dist/cli/run-BJ6IMs_H.js

@@ -0,0 +1,1440 @@
+import { r as errorText } from "./errors-BTe6A15O.js";
+import { a as sameText, t as display } from "./io-DH1kcmmP.js";
+import { c as writeAtomic, o as storeTypesModule, s as typesModuleKey, t as CACHE_DIR } from "./cache-DkplpIGe.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { _ as stabilizeMetadata, b as typegenVersionNotice, p as oxfmtInstalled, t as loadSnapshot, y as typegenVersion } from "./snapshot-Bzcigm7T.js";
+import { n as render } from "./render-lJmHr0y9.js";
+import { C as entitlementsMode, E as unsafeKey, S as entitlementRequirements, T as providerLabel, b as accessProviderMode, c as sameModuleMigration, l as writeLatestMigration, n as READ_SETS_SUFFIX, r as latestMigration, u as writesMigrations, w as moduleKeyProblems, x as accessRequirements, y as compiledReadSets } from "./module-migration-DOn6EmNz.js";
+import { s as schemaStampPath } from "./content-mapper-Cdx6arxu.js";
+import { a as changedFiles, d as fileDiff, i as changeLines, r as applyPlan, s as hasConflicts } from "./files-CX71yBm8.js";
+import { n as migrationsDir, o as writtenByBlocks } from "./sql-layout-rFP0oq1N.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-Bh-6IqJS.js";
+import { existsSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { readFile } from "node:fs/promises";
+import { SQL_MODULES, adoptedTables, declaredTables, moduleHidingColumns, moduleLayout, modulePermissionKeys, renderBlocks, resolveBlocks, sameBlockFile } from "better-supabase/sql";
+//#region src/cli/doctor/advisor-rules.ts
+/**
+* One request per advisor category, shared by the advisor rules and the rules
+* that defer to them.
+*/
+const fetched = /* @__PURE__ */ new WeakMap();
+function lintsOf(advisors, category) {
+	let byCategory = fetched.get(advisors);
+	if (!byCategory) {
+		byCategory = /* @__PURE__ */ new Map();
+		fetched.set(advisors, byCategory);
+	}
+	let lints = byCategory.get(category);
+	if (!lints) {
+		lints = advisors.lints(category);
+		byCategory.set(category, lints);
+	}
+	return lints;
+}
+const ADVISOR_SEVERITY = {
+	ERROR: "error",
+	WARN: "warning",
+	INFO: "info"
+};
+function lintObject(lint) {
+	const { schema, name, type } = lint.metadata ?? {};
+	if (typeof schema !== "string" || typeof name !== "string") return;
+	if (type === "table" || type === "view") return {
+		kind: "table",
+		schema,
+		name
+	};
+	if (type === "function") return {
+		kind: "function",
+		schema,
+		name
+	};
+}
+function lintFinding(lint) {
+	const object = lintObject(lint);
+	return {
+		severity: ADVISOR_SEVERITY[lint.level] ?? "warning",
+		title: lint.title,
+		message: `${lint.detail.replaceAll("\\`", "`")} [${lint.name}]`,
+		target: object ? `${object.schema}.${object.name}` : lint.cache_key,
+		help: lint.remediation,
+		...object ? { object } : {}
+	};
+}
+/**
+* A rule that reports one category of Supabase's advisors (splinter) as
+* findings.
+*/
+function advisorRule(code, category, title, description) {
+	return {
+		code,
+		severity: "warning",
+		title,
+		description,
+		async check(context) {
+			const { advisors } = context;
+			if (!advisors) return [];
+			if ("skipped" in advisors) return [{
+				severity: "info",
+				message: `Skipped the ${category} advisor: ${advisors.skipped}`
+			}];
+			try {
+				return (await lintsOf(advisors, category)).map(lintFinding);
+			} catch (cause) {
+				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${errorText(cause)}` }];
+			}
+		}
+	};
+}
+/** The performance advisor rule the duplicate rules defer to. */
+const PERFORMANCE_ADVISOR = "BS200";
+/**
+* The tables splinter reports `lint` for (`schema.table`), when the performance
+* advisor runs in this run and its lints loaded. A rule that repeats the lint
+* (BS207, BS216) drops its findings for these tables; with `undefined` (no
+* advisors, a saved snapshot, an advisor error, or BS200 not in the run) it
+* reports them itself.
+*/
+async function splinterTables(context, lint) {
+	const { advisors } = context;
+	if (!advisors || "skipped" in advisors) return;
+	if (!context.codes?.includes(PERFORMANCE_ADVISOR)) return;
+	let lints;
+	try {
+		lints = await lintsOf(advisors, "performance");
+	} catch {
+		return;
+	}
+	return new Set(lints.flatMap((entry) => {
+		if (entry.name !== lint) return [];
+		const object = lintObject(entry);
+		return object ? [`${object.schema}.${object.name}`] : [];
+	}));
+}
+//#endregion
+//#region src/cli/doctor/app-tables.ts
+/**
+* The app's tables in the database, as `ownTables`: those in `schemas` that no
+* block file or module migration creates.
+*/
+function appTablesOf(context) {
+	const created = new Set(declaredTables((context.sqlFiles ?? []).filter(writtenByBlocks), context.config.schemas));
+	return Object.fromEntries(catalogOf(context).tables.filter((table) => context.config.schemas.includes(table.schema) && !created.has(qualified(table))).map((table) => [qualified(table), "database"]));
+}
+/**
+* The views among the app's tables, and the columns of each, for the layout a
+* block reads them with.
+*/
+function appViewsOf(context) {
+	const own = appTablesOf(context);
+	const views = catalogOf(context).tables.filter((table) => table.kind === "view" && Object.hasOwn(own, qualified(table)));
+	return {
+		ownViews: Object.fromEntries(views.map((view) => [qualified(view), { updatable: view.insertable && view.updatable }])),
+		ownColumns: Object.fromEntries(views.map((view) => [qualified(view), view.columns.map((column) => column.name)]))
+	};
+}
+//#endregion
+//#region src/cli/doctor/block-policies.ts
+/** The prefix the render pass gives block policies on the app's tables. */
+const BLOCK_PREFIX = "bsb_";
+/** The app tables (`schema.table`) that blocks run over. */
+function blockTargets(context) {
+	return new Set(adoptedTables(context.config.blocks, appTablesOf(context)).map((table) => `${table.schema}.${table.table}`));
+}
+/**
+* Whether permissive policies that overlap on `table` are one app policy and
+* one block policy on an app table a block runs over. BS347 reports the pair
+* when the block's condition is wider; otherwise the app's policy repeats it.
+*/
+function appAndBlockPolicy(context) {
+	const targets = blockTargets(context);
+	return (table, policies) => targets.has(table) && policies.length === 2 && policies.filter((name) => name.startsWith("bsb_")).length === 1;
+}
+//#endregion
+//#region src/cli/doctor/rls.ts
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** `'it''s'` and other string literals, blanked so their text can't match. */
+const withoutStrings = (text) => text.replaceAll(/'(?:[^']|'')*'/g, "''");
+const functionName = (fn) => `${fn.schema}.${fn.name}`;
+const functionObject = (fn) => ({
+	kind: "function",
+	schema: fn.schema,
+	name: fn.name
+});
+/** The functions policies call, by `schema.name`; overloads share a key. */
+function functionsByName(context) {
+	const map = /* @__PURE__ */ new Map();
+	for (const fn of context.snapshot.extras.functions ?? []) {
+		const key = functionName(fn);
+		const list = map.get(key);
+		if (list) list.push(fn);
+		else map.set(key, [fn]);
+	}
+	return map;
+}
+/** Argument lists of every call to `schema.name(...)` in an expression. */
+function callArguments(expression, fn) {
+	if (!expression) return [];
+	const text = withoutStrings(expression);
+	const pattern = new RegExp(`(?<![\\w."])(?:"?${escape(fn.schema)}"?\\.)?"?${escape(fn.name)}"?\\s*\\(`, "g");
+	const calls = [];
+	for (const match of text.matchAll(pattern)) {
+		const start = match.index + match[0].length;
+		let depth = 1;
+		let end = start;
+		while (end < text.length && depth > 0) {
+			if (text[end] === "(") depth += 1;
+			else if (text[end] === ")") depth -= 1;
+			end += 1;
+		}
+		calls.push(text.slice(start, end - 1));
+	}
+	return calls;
+}
+/**
+* The first column of `table` an argument list refers to, bare or as
+* `table.column`.
+*/
+function columnArgument(args, table) {
+	return table.columns.find((column) => new RegExp(`(?<![\\w."$:])(?:"?${escape(table.name)}"?\\.)?"?${escape(column.name)}"?(?![\\w"(.$])`).test(args))?.name;
+}
+const expressions = (policy) => [policy.using, policy.check];
+/**
+* Why Postgres can't inline `fn` into the query that calls it, or `undefined`
+* when it can: only `language sql` functions that are not volatile, not
+* security definer and have no `set` options are inlined.
+*/
+function notInlinable(fn) {
+	if (fn.language !== "sql") return `a ${fn.language} function`;
+	if (fn.volatility === "volatile") return "a volatile function";
+	if (fn.securityDefiner) return "a security definer function";
+	const settings = Object.keys(fn.settings);
+	if (settings.length > 0) return `a function with \`set ${settings.join(", ")}\``;
+}
+const rlsTables$1 = (context) => exposed(context).filter((table) => table.rls);
+const COMMANDS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+/** Policies apply to every role when they list `public` or none. */
+const appliesTo = (policy, role) => policy.roles.length === 0 || policy.roles.includes("public") || policy.roles.includes(role);
+/** Commands and roles that more than one permissive policy of the table covers. */
+function permissiveOverlaps(table) {
+	const permissive = table.policies.filter((policy) => policy.permissive);
+	const roles = /* @__PURE__ */ new Set();
+	for (const policy of permissive) {
+		const named = policy.roles.filter((role) => role !== "public");
+		if (named.length < policy.roles.length || policy.roles.length === 0) {
+			roles.add("anon");
+			roles.add("authenticated");
+		}
+		for (const role of named) roles.add(role);
+	}
+	const overlaps = [];
+	for (const command of COMMANDS) for (const role of [...roles].toSorted()) {
+		const policies = permissive.filter((policy) => (policy.command === "all" || policy.command === command) && appliesTo(policy, role)).map((policy) => policy.name);
+		if (policies.length > 1) overlaps.push({
+			command,
+			role,
+			policies
+		});
+	}
+	return overlaps;
+}
+const WRITES = ["insert", "update"];
+const API_ROLES = ["anon", "authenticated"];
+const NOT_ALIAS = /* @__PURE__ */ new Set([
+	"where",
+	"join",
+	"inner",
+	"left",
+	"right",
+	"full",
+	"cross",
+	"on",
+	"using",
+	"group",
+	"order",
+	"limit",
+	"union",
+	"natural",
+	"lateral",
+	"as"
+]);
+/**
+* The body of `schema.name` from the snapshot, else from the first SQL file
+* that creates it.
+*/
+function functionBody(context, schema, name) {
+	const introspected = context.snapshot.generator.functions.find((fn) => fn.schema === schema && fn.name === name && fn.definition)?.definition;
+	if (introspected) return introspected;
+	const creates = new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+(?:"?${escape(schema)}"?\\.)?"?${escape(name)}"?\\s*\\([\\s\\S]*?\\bas\\s+(\\$\\w*\\$)([\\s\\S]*?)\\1`, "i");
+	for (const file of context.sqlFiles ?? []) {
+		const match = creates.exec(file.text);
+		if (match) return match[2];
+	}
+}
+const helpersByContext = /* @__PURE__ */ new WeakMap();
+/** The functions policies call, and the functions those call, with their bodies. */
+function policyHelpers(context) {
+	let helpers = helpersByContext.get(context);
+	if (!helpers) {
+		helpers = findPolicyHelpers(context);
+		helpersByContext.set(context, helpers);
+	}
+	return helpers;
+}
+function findPolicyHelpers(context) {
+	const known = context.snapshot.generator.functions;
+	const queue = catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? []));
+	const bodies = /* @__PURE__ */ new Map();
+	while (queue.length > 0) {
+		const key = queue.pop();
+		if (bodies.has(key)) continue;
+		const dot = key.indexOf(".");
+		const body = functionBody(context, key.slice(0, dot), key.slice(dot + 1));
+		if (!body) continue;
+		const text = withoutStrings(body);
+		bodies.set(key, text);
+		for (const fn of known) {
+			const called = `${fn.schema}.${fn.name}`;
+			if (!bodies.has(called) && callArguments(text, fn).length > 0) queue.push(called);
+		}
+	}
+	return bodies;
+}
+/**
+* Tables a function body reads (`from` and `join`), with the names it refers to
+* them by.
+*/
+function readTables(body, tables) {
+	const found = /* @__PURE__ */ new Map();
+	for (const match of body.matchAll(/\b(?:from|join)\s+(?:"?(\w+)"?\s*\.\s*)?"?(\w+)"?(?:\s+(?:as\s+)?"?(\w+)"?)?/gi)) {
+		const [, schema, name, alias] = match;
+		const table = tables.find((t) => t.name === name && t.schema === schema) ?? (schema ? void 0 : tables.find((t) => t.name === name && t.schema === "public") ?? tables.find((t) => t.name === name));
+		if (!table) continue;
+		const names = found.get(table) ?? /* @__PURE__ */ new Set([table.name]);
+		if (alias && !NOT_ALIAS.has(alias.toLowerCase())) names.add(alias);
+		found.set(table, names);
+	}
+	return [...found].map(([table, names]) => ({
+		table,
+		names: [...names]
+	}));
+}
+/**
+* Columns that decide who may read other rows, by `schema.table`: the columns
+* of the tables policy helpers read that their bodies mention (qualified, or
+* bare when the body reads one table), and the manifest's `decidingColumns`. A
+* subject's `deletedAt` column and a module's `hidingColumns` only hide rows,
+* so they count only when the manifest lists them.
+*/
+function grantColumns(context) {
+	const tables = catalogOf(context).tables;
+	const columns = /* @__PURE__ */ new Map();
+	const entry = (table, column) => {
+		const byColumn = columns.get(table) ?? /* @__PURE__ */ new Map();
+		columns.set(table, byColumn);
+		const existing = byColumn.get(column);
+		if (existing) return existing;
+		const created = {
+			helpers: /* @__PURE__ */ new Set(),
+			provider: false
+		};
+		byColumn.set(column, created);
+		return created;
+	};
+	const softDeleted = /* @__PURE__ */ new Set([...Object.values(context.config.subjects).flatMap((subject) => subject.deletedAt === void 0 ? [] : [`${subject.table.includes(".") ? subject.table : `public.${subject.table}`}.${subject.deletedAt}`]), ...context.config.blockNames.length > 0 ? moduleHidingColumns(context.config.blockNames, moduleLayout(context.config)) : []]);
+	for (const [helper, body] of policyHelpers(context)) {
+		const read = readTables(body, tables);
+		for (const { table, names } of read) for (const column of table.columns) {
+			if (softDeleted.has(`${qualified(table)}.${column.name}`)) continue;
+			const col = `"?${escape(column.name)}"?(?![\\w"(])`;
+			const qualifiedColumn = new RegExp(`(?<![\\w"])(?:${names.map((name) => `"?${escape(name)}"?`).join("|")})\\s*\\.\\s*${col}`, "i");
+			const bare = new RegExp(`(?<![\\w."])${col}`, "i");
+			if (qualifiedColumn.test(body) || read.length === 1 && bare.test(body)) entry(qualified(table), column.name).helpers.add(helper);
+		}
+	}
+	for (const deciding of context.config.authorization?.decidingColumns ?? []) {
+		const dot = deciding.lastIndexOf(".");
+		if (dot > 0) entry(deciding.slice(0, dot), deciding.slice(dot + 1)).provider = true;
+	}
+	return columns;
+}
+/**
+* Whether `role` may run `command` on rows of `table` at all: no RLS, or a
+* permissive policy for it.
+*/
+const policyAllows = (table, command, role) => !table.rls || table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+/**
+* Whether `grant` reaches `role`: granted to it, or to PUBLIC, which every role
+* inherits.
+*/
+const grantsTo = (grant, role) => grant.role === role || grant.role === "PUBLIC";
+/**
+* Constant arguments, as Postgres prints them back: string literals with an
+* optional cast, numbers, booleans and null.
+*/
+const LITERAL_ARGS = String.raw`(?:\s*(?:'(?:[^']|'')*'(?:::[\w ]+(?:\[\])?)?|-?\d+(?:\.\d+)?|true|false|null)\s*,?)*\s*`;
+/**
+* Whether every call of `name` (`schema.function`) in `expressions` takes only
+* constant arguments inside `(select ...)`, which Postgres runs once per
+* statement. An argument from the row makes it run per row.
+*/
+function onlyWrapped(name, expressions) {
+	const dot = name.indexOf(".");
+	const call = `"?${escape(name.slice(0, dot))}"?\\s*\\.\\s*"?${escape(name.slice(dot + 1))}"?\\s*\\(`;
+	const any = new RegExp(`(?<![\\w."])${call}`, "gi");
+	const wrapped = new RegExp(`\\(\\s*select\\s+${call}${LITERAL_ARGS}\\)(?:\\s+as\\s+"?\\w+"?)?\\s*\\)`, "gi");
+	let calls = 0;
+	let wraps = 0;
+	for (const expression of expressions) if (expression) {
+		calls += expression.match(any)?.length ?? 0;
+		wraps += expression.match(wrapped)?.length ?? 0;
+	}
+	return calls > 0 && calls === wraps;
+}
+/**
+* Whether every permissive policy that lets `role` run `command` holds `column`
+* to a tenant the caller acts in, with no `or` around it: equal to
+* `current_tenant_id()`, passed to `can('tenant', column, ...)`, or in `(select
+* tenant_ids_with(...))` or `(select member_<tenant>_ids())`. A write can't
+* name a tenant the caller isn't in then. The guest branch `ctx.scope.guest`
+* adds (`or (column, ...) in (select g.tenant ... portal_subjects(...) g)`)
+* pins it to a tenant the caller is a guest of, so it doesn't count as an
+* `or`.
+*/
+function pinnedToTenant(table, column, command, role) {
+	if (!table.rls) return false;
+	const col = `"?${escape(column)}"?`;
+	const pin = new RegExp([
+		`(?<![\\w."])${col}\\s*=\\s*\\(?\\s*(?:select\\s+)?better_supabase\\.current_tenant_id\\(\\)`,
+		`better_supabase\\.can\\(\\s*'tenant'(?:::text)?\\s*,\\s*${col}\\s*,`,
+		`(?<![\\w."])${col}\\s+in\\s+\\(\\s*select\\s+better_supabase\\.(?:tenant_ids_with|member_\\w+_ids)\\(`
+	].join("|"), "i");
+	const guest = new RegExp(`\\bor\\s+\\(*\\(?${col}\\)?(?:::text)?\\s*,(?:[^()]|\\([^()]*\\))*\\)\\s+in\\s+\\(\\s*select\\s+g\\.tenant\\b[^()]*from\\s+better_supabase\\.portal_(?:subjects|parties)\\([^()]*\\)\\s+g(?:\\([^()]*\\))?\\)`, "gi");
+	const applying = table.policies.filter((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+	return applying.length > 0 && applying.every((policy) => {
+		const check = (policy.check ?? policy.using)?.replaceAll(guest, "");
+		return check !== void 0 && !/\bor\b/i.test(check) && pin.test(check);
+	});
+}
+/**
+* The grant columns `role` may write with `command`, through a table-level or a
+* column-level grant. A single-column primary key is left out (its uniqueness
+* stops a write from taking over another row), and so is a column every policy
+* pins to the request's tenant, unless the provider lists it in `deciding`.
+*/
+function writableColumns(table, columns, command, role, deciding = /* @__PURE__ */ new Set()) {
+	if (!policyAllows(table, command, role)) return [];
+	const privilege = command.toUpperCase();
+	const tableLevel = table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege));
+	const risky = columns.filter((column) => deciding.has(column) || !(table.primaryKey.length === 1 && table.primaryKey[0] === column) && !pinnedToTenant(table, column, command, role));
+	if (tableLevel) return risky;
+	return risky.filter((column) => (table.columnGrants ?? []).some((grant) => grantsTo(grant, role) && grant.column === column && grant.privileges.includes(privilege)));
+}
+/** PostgREST's default for `db-hoisted-tx-settings`. */
+const DEFAULT_HOISTED = [
+	"statement_timeout",
+	"plan_filter.statement_cost_limit",
+	"default_transaction_isolation"
+];
+const TIMEOUT_ROLES = [
+	"anon",
+	"authenticated",
+	"authenticator"
+];
+/**
+* Partitions of an RLS table that have RLS off: queried by name, they skip the
+* parent's policies.
+*/
+function partitionsWithoutRls(context) {
+	const tables = catalogOf(context).tables;
+	const byName = new Map(tables.map((table) => [qualified(table), table]));
+	return tables.flatMap((table) => {
+		if (table.partitionOf === void 0 || table.rls || !context.config.schemas.includes(table.schema)) return [];
+		if (!byName.get(table.partitionOf)?.rls) return [];
+		return [{
+			message: `${qualified(table)} is a partition of ${table.partitionOf}, which has RLS on, but RLS is off on the partition. A query that names the partition skips the parent's policies, and Data API roles with a grant on it read every row. Run \`alter table ${qualified(table)} enable row level security;\`, and add the same enable to the code that creates new partitions.`,
+			target: qualified(table),
+			object: tableObject(table)
+		}];
+	});
+}
+const RLS_RULES = [
+	{
+		code: "BS343",
+		severity: "error",
+		title: "Partition without row level security",
+		description: "A table in `schemas` is a partition of a table with RLS on, but has RLS off itself. Policies belong to the parent, so a query that names the partition (`select * from events_default`) never applies them. This includes the default partition. Enable RLS on every partition when you create it; the partition functions of the SQL modules (`ensure_partitions`, ADR 0038) already do.",
+		check: partitionsWithoutRls
+	},
+	{
+		code: "BS205",
+		severity: "warning",
+		title: "Policy calls a slow function once per row",
+		description: "A policy passes a column of the row to a function Postgres cannot inline: plpgsql, volatile, security definer, or with a `set` option such as `search_path`. It runs once for every row the query reads.",
+		check: (context) => {
+			const functions = functionsByName(context);
+			return rlsTables$1(context).flatMap((table) => table.policies.flatMap((policy) => {
+				for (const name of policy.functions ?? []) {
+					const slow = functions.get(name)?.find((fn) => notInlinable(fn) !== void 0);
+					if (!slow) continue;
+					const column = expressions(policy).flatMap((expression) => callArguments(expression, slow)).map((args) => columnArgument(args, table)).find((found) => found !== void 0);
+					if (!column) continue;
+					const fix = slow.securityDefiner || Object.keys(slow.settings).length > 0 ? "" : `, or make it \`language sql stable\` so Postgres inlines it`;
+					return [{
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${name}(${column}), ${notInlinable(slow)}, with a column of the row, so it runs once per row. Have a helper return the allowed values once and compare: \`${column} in (select <helper>())\`${fix}.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}];
+				}
+				return [];
+			}));
+		}
+	},
+	{
+		code: "BS206",
+		severity: "warning",
+		title: "Security definer policy helper that cannot be inlined",
+		description: "A security definer function is used in many policies. Postgres never inlines a security definer function, so a call that takes a column of the row runs once per row. Wrapped in `(select ...)` with constant arguments, or returning a set the policy compares with `in (select ...)`, it runs once per statement.",
+		check: (context) => {
+			const limit = context.config.doctor.policyHelperLimit;
+			const functions = functionsByName(context);
+			const uses = /* @__PURE__ */ new Map();
+			for (const table of rlsTables$1(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
+				if (onlyWrapped(name, [policy.using, policy.check])) continue;
+				const list = uses.get(name) ?? [];
+				list.push(`${qualified(table)}.${policy.name}`);
+				uses.set(name, list);
+			}
+			return [...uses].flatMap(([name, policies]) => {
+				if (policies.length <= limit) return [];
+				const fn = functions.get(name)?.find((candidate) => candidate.securityDefiner);
+				if (!fn) return [];
+				const shown = policies.slice(0, 5).join(", ");
+				const more = policies.length > 5 ? ` and ${policies.length - 5} more` : "";
+				return [{
+					message: `${name} is a security definer ${fn.language} function used in ${policies.length} policies (${shown}${more}; the limit is ${limit}). Postgres can't inline it, so call it as \`(select ${name}(...))\` when its arguments don't come from the row, or return the allowed ids as a set and compare with \`column in (select ${name}())\`, so it runs once per statement.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS207",
+		severity: "warning",
+		title: "Several permissive policies for one command and role",
+		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. On an app table a block runs over, one app policy next to the block's `bsb_<table>_<command>` policy is left to BS347. When the performance advisor (BS200) runs, splinter's `multiple_permissive_policies` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "multiple_permissive_policies");
+			const paired = appAndBlockPolicy(context);
+			return rlsTables$1(context).flatMap((table) => {
+				if (splinter?.has(qualified(table))) return [];
+				const overlaps = permissiveOverlaps(table).filter((overlap) => !paired(qualified(table), overlap.policies));
+				if (overlaps.length === 0) return [];
+				const first = table.policies.find((policy) => policy.name === overlaps[0].policies[0]);
+				const list = overlaps.map((overlap) => `${overlap.command} for ${overlap.role}: ${overlap.policies.join(", ")}`).join("; ");
+				return [{
+					message: `${qualified(table)} has several permissive policies per command and role (${list}). Postgres runs all of them for every row; merge each group into one policy.`,
+					target: qualified(table),
+					object: policyObject(table, first)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS213",
+		severity: "warning",
+		title: "API roles can write the columns that grant access",
+		description: "RLS helpers decide access from columns such as `memberships.user_id`, `memberships.role` or `contacts.customer_id`, and an authorization provider lists them as `decidingColumns`. When `anon` or `authenticated` may insert or update one of them, and a policy lets them write the row, a user can grant themselves access. A table-level grant counts even after a column-level revoke. A single-column primary key, a tenant column every write policy pins to a tenant the caller acts in (`current_tenant_id()`, `can('tenant', column, ...)`, `tenant_ids_with(...)` or the membership helper `member_organization_ids()`, alone or next to a guest's grant from `portal_subjects()`), a subject's `deletedAt` column in `config.records` and a block's soft-delete column (they only hide rows) don't count unless the provider lists them.",
+		check: (context) => {
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			return [...grantColumns(context)].flatMap(([name, byColumn]) => {
+				const table = tables.get(name);
+				if (!table) return [];
+				const columns = table.columns.map((column) => column.name).filter((column) => byColumn.has(column)).toSorted();
+				const deciding = new Set(columns.filter((column) => byColumn.get(column).provider));
+				const writes = [];
+				const fix = [];
+				for (const role of API_ROLES) {
+					const tableLevel = [];
+					const revoked = /* @__PURE__ */ new Set();
+					for (const command of WRITES) {
+						const writable = writableColumns(table, columns, command, role, deciding);
+						if (writable.length === 0) continue;
+						writes.push(`${role} may ${command} ${writable.join(", ")}`);
+						const privilege = command.toUpperCase();
+						if (table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege))) {
+							tableLevel.push(command);
+							for (const column of writable) revoked.add(column);
+							continue;
+						}
+						const fromPublic = (table.columnGrants ?? []).some((grant) => grant.role === "PUBLIC" && writable.includes(grant.column) && grant.privileges.includes(privilege));
+						fix.push(`revoke ${command} (${writable.join(", ")}) on ${name} from ${fromPublic ? `${role}, public` : role};`);
+					}
+					if (tableLevel.length === 0) continue;
+					const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && tableLevel.some((command) => grant.privileges.includes(command.toUpperCase())));
+					fix.push(`revoke ${tableLevel.join(", ")} on ${name} from ${fromPublic ? `${role}, public` : role};`);
+					const rest = table.columns.map((column) => column.name).filter((column) => !revoked.has(column));
+					if (rest.length > 0) fix.push(`grant ${tableLevel.map((command) => `${command} (${rest.join(", ")})`).join(", ")} on ${name} to ${role};`);
+				}
+				if (writes.length === 0) return [];
+				const helpers = [...new Set(columns.flatMap((column) => [...byColumn.get(column).helpers]))].toSorted();
+				const listed = [...deciding];
+				const readers = [...helpers.length > 0 ? [`${helpers.join(", ")} read${helpers.length === 1 ? "s" : ""} them to decide access`] : [], ...listed.length > 0 ? [`the authorization provider lists ${listed.join(", ")} as deciding columns`] : []].join(", and ");
+				return [{
+					message: `${name}: ${writes.join("; ")}. ${readers}, so a user who writes them can grant themselves access. Revoke the columns and grant the rest:\n${fix.join("\n")}`,
+					target: name,
+					object: tableObject(table)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS211",
+		severity: "info",
+		title: "Statement timeouts for the Data API roles",
+		description: "PostgREST switches to `anon` or `authenticated` for each request, so their `statement_timeout` limits Data API queries. A function's own `set statement_timeout` only applies when PostgREST hoists it (`pgrst.db_hoisted_tx_settings`). `idle_in_transaction_session_timeout` ends sessions that leave a transaction open; it applies to the role a connection logs in as.",
+		check: (context) => {
+			const settings = context.snapshot.extras.roleSettings;
+			if (!settings) return [];
+			const values = (setting) => TIMEOUT_ROLES.map((role) => `${role} ${settings[role]?.[setting] ?? "not set"}`).join(", ");
+			const findings = [{
+				message: `statement_timeout: ${values("statement_timeout")}. idle_in_transaction_session_timeout: ${values("idle_in_transaction_session_timeout")}. Unset roles use the database default.`,
+				target: "roles:statement_timeout"
+			}];
+			const configured = settings["authenticator"]?.["pgrst.db_hoisted_tx_settings"];
+			if ((configured ? configured.split(",").map((setting) => setting.trim()) : DEFAULT_HOISTED).includes("statement_timeout")) return findings;
+			for (const fn of context.snapshot.extras.functions ?? []) {
+				const timeout = fn.settings["statement_timeout"];
+				if (!timeout || !context.config.schemas.includes(fn.schema)) continue;
+				findings.push({
+					severity: "warning",
+					message: `${functionName(fn)}(${fn.signature}) sets statement_timeout = ${timeout}, but pgrst.db_hoisted_tx_settings (${configured}) leaves it out, so the setting doesn't limit the RPC. Add statement_timeout to it, or set the timeout on the role.`,
+					target: `${functionName(fn)}:statement_timeout`,
+					object: functionObject(fn)
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS224",
+		severity: "warning",
+		title: "Data API role without a timeout",
+		description: "Without `statement_timeout`, one slow Data API query holds a connection until it finishes; without `idle_in_transaction_session_timeout`, a client that leaves a transaction open holds its locks. PostgREST applies the settings of `anon` and `authenticated` to each request, and the login role's (`authenticator`) apply when the request role sets none, so doctor accepts either. A value of 0 turns the timeout off and counts as unset.",
+		check: (context) => {
+			const settings = context.snapshot.extras.roleSettings;
+			if (!settings) return [];
+			const value = (role, setting) => {
+				const set = settings[role]?.[setting];
+				return set === void 0 || /^0(?:\s*m?s)?$/i.test(set.trim()) ? void 0 : set;
+			};
+			const example = {
+				statement_timeout: "'8s'",
+				idle_in_transaction_session_timeout: "'60s'"
+			};
+			return ["anon", "authenticated"].flatMap((role) => Object.keys(example).filter((setting) => value(role, setting) === void 0 && value("authenticator", setting) === void 0).map((setting) => ({
+				message: `${role} has no ${setting}, and authenticator sets none either, so a Data API request as ${role} has no limit. Run \`alter role ${role} set ${setting} = ${example[setting]};\` in a migration, then \`notify pgrst, 'reload config';\`.`,
+				target: `${role}:${setting}`
+			})));
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/authorization.ts
+const TEMPLATE_EFFECT = {
+	memberIds: "their membership checks read the tenant module's memberships table instead of the provider",
+	idsWithFor: "their checks of another user's tenant permissions (can_user, member_can) raise 0A000 (ACCESS_CALLER_ONLY) or are skipped",
+	isPlatformFor: "their checks of another user's platform permissions (platform_can) answer false or are skipped",
+	canAssignFor: "better_supabase.can_assign_as is not written and the inviter's right to assign the role is not checked again when the invitation is accepted"
+};
+/** The optional templates installed modules call that the provider doesn't set. */
+function missingTemplates(context, provider) {
+	const installed = new Set(context.config.blockNames);
+	const callers = /* @__PURE__ */ new Map();
+	for (const module of Object.values(SQL_MODULES)) {
+		if (!installed.has(module.name)) continue;
+		for (const name of module.providerFunctions ?? []) {
+			if (provider.functions[name] !== void 0) continue;
+			if (name === "canAssignFor" && context.config.blocks.permissions?.functions?.canAssignFor) continue;
+			callers.set(name, [...callers.get(name) ?? [], module.name]);
+		}
+	}
+	return [...callers].map(([name, modules]) => ({
+		severity: "warning",
+		message: `The ${modules.join(", ")} ${modules.length > 1 ? "modules call" : "module calls"} authorization.functions.${name}, which ${providerLabel(provider)} doesn't set, so under the provider model ${TEMPLATE_EFFECT[name] ?? "those calls fail"}. Use a provider that sets ${name}${name === "canAssignFor" ? ", or set blocks.permissions.functions.canAssignFor" : ""}.`,
+		target: `authorization.functions.${name}`
+	}));
+}
+/**
+* Tables whose generated policies call the provider's functions by role and
+* scope only.
+*/
+const SUPPORT_SESSION_APPROVAL = "support-session";
+const POLICY_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
+const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
+const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
+const escapeRegExp = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+/**
+* A pattern for a filled template: `{permission}` captures the key literal
+* (optionally passed by name), `{scope}` captures the scope name, and
+* whitespace may differ.
+*/
+function templatePattern(template) {
+	const source = template.split(/(\{\w+\})/).map((part) => {
+		if (part === "{permission}") return String.raw`(?:\w+\s*=>\s*)?'((?:[^']|'')*)'`;
+		if (part === "{scope}") return "([a-z][a-z0-9_]*)";
+		if (/^\{\w+\}$/.test(part)) return String.raw`[\s\S]*?`;
+		return escapeRegExp(part.trim()).replaceAll(/\s+/g, String.raw`\s*`);
+	}).filter((part) => part !== "").join(String.raw`\s*`);
+	return new RegExp(source, "gi");
+}
+/**
+* The keys and scopes a policy body passes to the provider's `idsWith` and
+* `isPlatform`.
+*/
+function providerCalls(provider, body) {
+	const calls = [];
+	const { idsWith, isPlatform } = provider.functions;
+	const groups = (template) => [...template.matchAll(/\{(permission|scope)\}/g)].map((match) => match[1]);
+	const idsGroups = groups(idsWith);
+	for (const match of body.matchAll(templatePattern(idsWith))) {
+		const key = match[idsGroups.indexOf("permission") + 1];
+		if (key === void 0) continue;
+		const scopeIndex = idsGroups.indexOf("scope");
+		calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: scopeIndex === -1 ? provider.tenantScope : match[scopeIndex + 1]
+		});
+	}
+	const platformGroups = groups(isPlatform);
+	for (const match of body.matchAll(templatePattern(isPlatform))) {
+		const key = match[platformGroups.indexOf("permission") + 1];
+		if (key !== void 0) calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: "platform"
+		});
+	}
+	return calls;
+}
+/**
+* Policies better-supabase generates (`bsb_` names) on `storage.objects` and
+* `realtime.messages` that call the provider's templates, with the keys they
+* pass. The first file that declares a policy wins, matching the `sqlFiles`
+* order (declarative schemas, then the newest migration).
+*/
+function providerPolicies(provider, files) {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	for (const file of files) for (const match of file.text.matchAll(POLICY)) {
+		const name = unquote(match[1]);
+		const table = match[2].split(".").map((part) => unquote(part.trim())).join(".");
+		if (!POLICY_TABLES.has(table) || !/^bsb?_/.test(name)) continue;
+		const id = `${table}.${name}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const calls = providerCalls(provider, match[3]);
+		if (calls.length === 0) continue;
+		found.push({
+			name,
+			table,
+			calls,
+			file: file.path,
+			line: file.text.slice(0, match.index).split("\n").length
+		});
+	}
+	return found;
+}
+/**
+* `buckets` entries whose access policy reaches the provider's functions:
+* through `sql` templates, or through the access contract under the `provider`
+* model. Their keys and scope (the tenant scope for `tenant`).
+*/
+function providerBucketKeys(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	const providerModel = config.blocks.permissions?.model === "provider";
+	return Object.entries(config.buckets).flatMap(([bucket, entry]) => {
+		const policy = entry.policy;
+		if (policy === void 0 || typeof policy === "string") return [];
+		if (policy.sql === void 0 && !providerModel) return [];
+		const scope = policy.scope ?? "tenant";
+		return [{
+			bucket,
+			keys: [...new Set(Object.values(policy.access).filter((key) => typeof key === "string"))],
+			scope: scope === "tenant" ? provider.tenantScope : scope
+		}];
+	});
+}
+/**
+* Why a policy's scope can't work with the provider: a scope it doesn't
+* declare, or a key it grants only at other scopes.
+*/
+function placementProblems(provider, call, where) {
+	if (call.scope === "platform") return [];
+	const label = providerLabel(provider);
+	if (!provider.scopes.some((scope) => scope.name === call.scope)) return [`${where} uses scope "${call.scope}", which ${label} doesn't declare. Use one of ${provider.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`];
+	const declared = provider.permissions?.find((permission) => permission.key === call.key)?.scopes;
+	if (!declared || declared.length === 0 || declared.includes(call.scope)) return [];
+	return [`${where} checks "${call.key}" at scope "${call.scope}", but ${label} grants it at ${declared.map((scope) => `"${scope}"`).join(", ")}, so its SQL functions never grant it there. Use scope "${declared[0]}".`];
+}
+/**
+* The provider's memberships for the `entitlements` SQL module, when that mode
+* is valid.
+*/
+function entitlementsModule(context) {
+	const mode = entitlementsMode(context.config);
+	return mode.kind === "provider" ? mode.provider : void 0;
+}
+/**
+* The provider for the `provider` access model, when `blocks` installs
+* `access`.
+*/
+function accessModule(context) {
+	if (!resolveBlocks(context.config.blockNames, {}).some((module) => module.name === "permissions")) return { kind: "off" };
+	return accessProviderMode(context.config);
+}
+/**
+* Checks a function a template calls against `authorization.requires` and the
+* database: listed, executable by `role`, and present when the snapshot read
+* its schema. `undefined` when it passes.
+*/
+function requirementProblem(context, provider, requirement, caller) {
+	const label = providerLabel(provider);
+	const listed = (provider.requires ?? []).filter((entry) => entry.function === requirement.function);
+	if (provider.requires !== void 0 && listed.length === 0) return { message: `${caller} calls ${requirement.function}, but ${label} doesn't list it in authorization.requires. Use a provider version that lists every function its templates call.` };
+	if (listed.length > 0 && !listed.some((entry) => entry.role === requirement.role)) return { message: `${label} says only ${listed.map((entry) => entry.role).join(", ")} may execute ${requirement.function}, but ${caller} calls it as ${requirement.role}. Grant it execute to ${requirement.role} through the provider.` };
+	const schema = requirement.function.slice(0, requirement.function.indexOf("."));
+	if (!context.snapshot.schemas.includes(schema)) return;
+	return catalogOf(context).functions.some((fn) => `${fn.schema}.${fn.name}` === requirement.function) ? void 0 : { message: `${requirement.function} is not in the database, but ${caller} calls it. Apply the provider's migration before the SQL modules.` };
+}
+const AUTHORIZATION_RULES = [
+	{
+		code: "BS214",
+		severity: "error",
+		title: "Permission the provider's SQL functions don't fully answer in a Storage or Realtime policy",
+		description: "An access policy on a bucket or topic that reaches the authorization provider's functions (through `sql` templates, or through the access contract under the `provider` model) decides by role and scope only. A permission whose `authorization.permissions` entry isn't `sqlComplete: true` would grant every object or topic in the scope, so it is reported, and so is a key the provider doesn't list or every key when it lists no permissions. A scope the provider doesn't declare, and a key checked at another scope than its entry's `scopes`, are reported too. Doctor reads the keys from `buckets` in the config and from the generated `bsb_` policies on `storage.objects` and `realtime.messages`. It also warns when a bucket's `sql` templates differ from the provider's `idsWith` and `isPlatform`, since a copy goes stale when the provider changes; `sql: \"provider\"` renders them at `gen` time instead.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const findings = [];
+			for (const { bucket, keys, scope } of providerBucketKeys(context.config)) for (const key of keys) {
+				for (const message of placementProblems(provider, {
+					key,
+					scope
+				}, `buckets.${bucket} ("${key}")`)) findings.push({
+					message,
+					target: `buckets.${bucket}:${key}`
+				});
+				const problem = unsafeKey(provider, key);
+				if (!problem) continue;
+				findings.push({
+					message: `buckets.${bucket} uses "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
+					target: `buckets.${bucket}:${key}`
+				});
+			}
+			for (const [bucket, entry] of Object.entries(context.config.buckets)) {
+				const sql = typeof entry.policy === "object" ? entry.policy.sql : void 0;
+				if (typeof sql !== "object") continue;
+				const stale = ["idsWith", "isPlatform"].filter((name) => sql[name] !== provider.functions[name]);
+				if (stale.length === 0) continue;
+				findings.push({
+					severity: "warning",
+					message: `buckets.${bucket} copies sql templates that differ from ${providerLabel(provider)}'s ${stale.join(" and ")}. Set sql: "provider" so gen renders the provider's templates.`,
+					target: `buckets.${bucket}.policy.sql`
+				});
+			}
+			for (const policy of providerPolicies(provider, context.sqlFiles ?? [])) {
+				const seen = /* @__PURE__ */ new Set();
+				for (const call of policy.calls) for (const message of placementProblems(provider, call, `Policy "${policy.name}" on ${policy.table}`)) {
+					if (seen.has(message)) continue;
+					seen.add(message);
+					findings.push({
+						message,
+						target: `${policy.table}.${policy.name}:${call.key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+				for (const key of new Set(policy.calls.map((call) => call.key))) {
+					const problem = unsafeKey(provider, key);
+					if (!problem) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to the provider's SQL functions, but it ${problem.reason}. ${problem.fix}`,
+						target: `${policy.table}.${policy.name}:${key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS408",
+		severity: "warning",
+		title: "The entitlements module can't read the provider's memberships",
+		description: "With `auth.entitlements.memberships: 'provider'` (the default with `authorization`), the `entitlements` SQL module reads memberships through the provider's `memberIds` template (in `has_entitlement`, as `authenticated`) and `memberIdsFor` (in `feature_claims`, which the provider's hook calls as `supabase_auth_admin`). Doctor warns when the provider can't back that mode (no tenant scope, an id type the module doesn't render, no `memberIds` or `memberIdsFor`), when its hook doesn't fill `auth.claims.features` from `better_supabase.feature_claims` (unless `auth.entitlements.claim` is `false`), when no membership table covers the tenant scope, and when a function those templates call is missing from `authorization.requires`, not executable by that role, or not in the database.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("entitlements")) return [];
+			const mode = entitlementsMode(context.config);
+			if (mode.kind === "tenant") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "entitlements.memberships"
+			}];
+			const provider = context.config.authorization;
+			const label = providerLabel(provider);
+			const findings = [];
+			const features = context.config.claims.features;
+			const hook = provider.tokenHook;
+			if (hook && context.config.entitlements.claim !== false) {
+				const claims = hook.registeredClaims ?? [];
+				const featureClaim = claims.find((claim) => claim.name === features);
+				if (featureClaim?.function !== "better_supabase.feature_claims") {
+					const registered = claims.find((claim) => claim.function === "better_supabase.feature_claims");
+					findings.push({
+						message: registered ? `The hook of ${label} fills the "${registered.name}" claim from better_supabase.feature_claims, but auth.claims.features is "${features}", so hasEntitlement() never finds the plan features. Set auth.claims.features to "${registered.name}".` : featureClaim ? `The hook of ${label} fills the "${features}" claim from ${featureClaim.function}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point the provider's "${features}" claim at better_supabase.feature_claims.` : `The hook of ${label} has no "${features}" claim, so it never writes the plan features hasEntitlement() reads. Have it fill "${features}" from better_supabase.feature_claims, or set \`auth.entitlements.claim: false\` to keep the features out of the token and check them in SQL with has_entitlement.`,
+						target: `claims.${features}`
+					});
+				}
+			}
+			const scope = mode.provider.scope;
+			if (provider.memberships === void 0) findings.push({
+				severity: "info",
+				message: `${label} lists no authorization.memberships, so entitlement_members() can't tell which tables hold "${scope}" memberships and plan changes never invalidate sessions.`,
+				target: "authorization.memberships"
+			});
+			else if (mode.provider.memberships.length === 0) findings.push({
+				message: `${label} maps no membership table to scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a membership table for "${scope}" to the provider.`,
+				target: "authorization.memberships"
+			});
+			for (const requirement of entitlementRequirements(mode.provider)) {
+				const problem = requirementProblem(context, provider, requirement, requirement.caller);
+				if (!problem) continue;
+				findings.push({
+					...requirement.kind === "member-for" && problem.message.includes("may execute") ? { severity: "info" } : {},
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS409",
+		severity: "warning",
+		title: "The authorization provider and the better-supabase config disagree",
+		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `auth.organization.claim` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `auth.claims.scope` is neither `tenant` nor the provider's tenant scope, notes when the provider sets `suspension` or `roleSources` but `blocks.permissions.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const label = providerLabel(provider);
+			const findings = (provider.problems ?? []).map((problem) => ({
+				message: `${label}: ${problem}`,
+				target: "authorization"
+			}));
+			const tenantClaim = provider.tokenHook?.tenantClaim;
+			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
+				message: `The hook of ${label} writes the active tenant to "${tenantClaim}", but auth.organization.claim is "${context.config.claims.tenant}". Set auth.organization.claim to "${tenantClaim}", or change the provider's tenant claim.`,
+				target: "claims.tenant"
+			});
+			const scope = context.config.claims.scope;
+			if (scope !== "tenant" && scope !== provider.tenantScope) findings.push({
+				severity: "info",
+				message: `auth.claims.scope is "${scope}", but the tenant scope of ${label} is "${provider.tenantScope}". The tenant module's membership claims then use another scope than the provider's. Set auth.claims.scope to "${provider.tenantScope}" (or "tenant").`,
+				target: "claims.scope"
+			});
+			const model = context.config.blocks.permissions?.model ?? "roles";
+			const unread = [...provider.suspension ? ["suspension"] : [], ...provider.roleSources && provider.roleSources.length > 0 ? ["roleSources"] : []];
+			if (model !== "provider" && unread.length > 0) findings.push({
+				severity: "info",
+				message: `${label} sets ${unread.join(" and ")}, but blocks.permissions.model is "${model}", so the SQL modules ignore ${unread.length > 1 ? "them" : "it"}. Set blocks.permissions.model to "provider" to use them, or set blocks.permissions.disabled yourself.`,
+				target: `authorization.${unread[0]}`
+			});
+			return findings;
+		}
+	},
+	{
+		code: "BS411",
+		severity: "error",
+		title: "The provider access model can't use the authorization provider",
+		description: "With `blocks.permissions.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `blocks.permissions.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter).",
+		check: (context) => {
+			const mode = accessModule(context);
+			if (mode.kind === "off") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "authorization"
+			}];
+			const provider = context.config.authorization;
+			const findings = [];
+			for (const requirement of accessRequirements(mode.access)) {
+				const problem = requirementProblem(context, provider, requirement, "the provider access model (can() and the SQL modules)");
+				if (problem) findings.push({
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			findings.push(...moduleKeyProblems(provider, modulePermissionKeys(context.config.blocks, context.config.blockNames)));
+			if ((context.config.blocks.permissions?.functions?.canAssign ?? provider.functions.canAssign) === void 0) findings.push({
+				severity: "warning",
+				message: `Neither blocks.permissions.functions.canAssign nor ${providerLabel(provider)} sets canAssign, so under the provider model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes. Use a provider that sets authorization.functions.canAssign, or set blocks.permissions.functions.canAssign.`,
+				target: "blocks.permissions.functions.canAssign"
+			});
+			findings.push(...missingTemplates(context, provider));
+			return findings;
+		}
+	},
+	{
+		code: "BS413",
+		severity: "warning",
+		title: "Support sessions are not tied to the provider's read-only check",
+		description: "Support sessions default to read-only. Write functions refuse them through the built-in act check, or through authorization.functions.actorMayWrite when the provider sets it. With the provider access model, doctor warns when support is installed and actorMayWrite is missing, so the provider's helper is not the one the writes call.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("impersonation")) return [];
+			if ((context.config.blocks.permissions?.model ?? "roles") !== "provider") return [];
+			const provider = context.config.authorization;
+			if (provider === void 0 || provider.functions.actorMayWrite !== void 0) return [];
+			return [{
+				message: `Support sessions are installed and blocks.permissions.model is "provider", but ${providerLabel(provider)} does not set authorization.functions.actorMayWrite. Writes use the built-in act check. Set actorMayWrite to the provider's read-only helper.`,
+				target: "authorization.functions.actorMayWrite"
+			}];
+		}
+	},
+	{
+		code: "BS414",
+		severity: "warning",
+		title: "Access contract answers from built-in roles next to a provider",
+		description: "With `authorization` set, `blocks.permissions.model` defaults to `provider`, so `better_supabase.can()` and `better_supabase.tenant_ids_with()` answer from the provider's templates. When the config sets another model, those functions answer from the built-in roles instead, which the provider never sees. Doctor reports each policy and each function in `schemas` that calls them, so a check that looks provider-backed is not silently role-backed.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const model = context.config.blocks.permissions?.model;
+			if (provider === void 0 || !context.config.blockNames.includes("permissions") || model === void 0 || model === "provider") return [];
+			const why = `blocks.permissions.model is "${model}", so it answers from the built-in roles, not ${providerLabel(provider)}. Remove the model to use the provider, or call the provider's function directly.`;
+			const findings = [];
+			for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+				const calls = contractCalls(`${policy.using ?? ""} ${policy.check ?? ""}`);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `Policy "${policy.name}" on ${qualified(table)} calls ${calls.join(" and ")}, but ${why}`,
+					target: `${qualified(table)}.${policy.name}`,
+					object: policyObject(table, policy)
+				});
+			}
+			for (const fn of context.snapshot.generator.functions) {
+				if (fn.schema === "better_supabase" || !context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				const calls = contractCalls(fn.definition);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `${fn.schema}.${fn.name} calls ${calls.join(" and ")}, but ${why}`,
+					target: `${fn.schema}.${fn.name}`
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS334",
+		severity: "info",
+		title: "A policy checks a role name instead of a permission",
+		description: "`member_organization_ids()`, `has_organization_role()` and `organization_member_role()` answer by role name. Under an authorization provider they take membership from its `memberIds`, but a role list in the policy still names roles the provider may not have. `better_supabase.tenant_ids_with('<permission>')` and `member_can()` check a permission, so they follow renames, the provider and the delegation cap. Doctor reports each app policy and each function in `schemas` that calls a role helper.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("memberships")) return [];
+			const findings = [];
+			const advice = "check a permission with better_supabase.tenant_ids_with('<permission>') or member_can() instead, so it follows the provider and the delegation cap.";
+			for (const table of catalogOf(context).tables) {
+				if (table.schema === "better_supabase") continue;
+				for (const policy of table.policies) {
+					if (/^bsb?_/.test(policy.name)) continue;
+					const calls = roleHelperCalls(`${policy.using ?? ""} ${policy.check ?? ""}`);
+					if (calls.length === 0) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${calls.join(" and ")}; ${advice}`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					});
+				}
+			}
+			for (const fn of context.snapshot.generator.functions) {
+				if (fn.schema === "better_supabase" || !context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				const calls = roleHelperCalls(fn.definition);
+				if (calls.length === 0) continue;
+				findings.push({
+					message: `${fn.schema}.${fn.name} calls ${calls.join(" and ")}; ${advice}`,
+					target: `${fn.schema}.${fn.name}`
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS415",
+		severity: "warning",
+		title: "The provider sets the deprecated canApprove template",
+		description: "`authorization.functions.isApprover` replaces `canApprove`: one eligibility check for tool calls, support sessions and the app's own approvals, with `{kind}` and `{subject}` instead of `{tool}`. 0.9 still reads `canApprove` when `isApprover` is unset, and drops it in a later minor release.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (provider?.functions.canApprove === void 0) return [];
+			return [{
+				message: `${providerLabel(provider)} sets authorization.functions.canApprove, which is deprecated. Set isApprover with {kind}, {subject} and {tenant}; {kind} is 'ai-tool' and {subject} the tool name for AI tool calls.`,
+				target: "authorization.functions.canApprove"
+			}];
+		}
+	},
+	{
+		code: "BS416",
+		severity: "warning",
+		title: "isApprover has no branch for support sessions",
+		description: "With the provider access model, the `impersonation` module asks `authorization.functions.isApprover` who may approve a support request, with `{kind}` set to `'support-session'`, instead of its built-in platform check. A template that only handles `'ai-tool'` answers false, so no admin can approve a support request and every start that needs a second admin stays pending. Doctor warns when the template, and every function it calls, never names `support-session`.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const support = context.config.blocks["impersonation"];
+			const isApprover = provider?.functions.isApprover;
+			if (provider === void 0 || isApprover === void 0 || !context.config.blockNames.includes("impersonation") || (context.config.blocks.permissions?.model ?? "roles") !== "provider" || support?.options?.["approval"] === "none") return [];
+			if (isApprover.includes(SUPPORT_SESSION_APPROVAL)) return [];
+			const called = new Set(templateCalls(isApprover));
+			if (context.snapshot.generator.functions.some((fn) => called.has(`${fn.schema}.${fn.name}`.toLowerCase()) && fn.definition.includes(SUPPORT_SESSION_APPROVAL))) return [];
+			return [{
+				message: `Support sessions are installed, but ${providerLabel(provider)}'s isApprover template never handles {kind} = '${SUPPORT_SESSION_APPROVAL}', so it answers false and no admin can approve a support request. Add a '${SUPPORT_SESSION_APPROVAL}' branch (for example platform staff with the support permission), or set blocks['impersonation'].options.approval to "none".`,
+				target: "authorization.functions.isApprover"
+			}];
+		}
+	},
+	{
+		code: "BS417",
+		severity: "warning",
+		title: "The provider declares teams but sets no teamIdsOf template",
+		description: "With the provider access model, `team_ids_of()` and the team sharing in `saved-views` and `collections` call `authorization.functions.teamIdsOf` for a caller's teams. Without it, `team_ids_of()` reads the teams block's own `team_members`, which a provider that keeps its own teams never fills, and `saved-views` and `collections` without the teams block share with no team. Doctor warns when the provider declares a `team` scope, one of those blocks is installed, and the template is unset.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (provider === void 0 || provider.functions.teamIdsOf !== void 0 || (context.config.blocks.permissions?.model ?? "roles") !== "provider" || !provider.scopes.some((scope) => TEAM_SCOPE.test(scope.name))) return [];
+			const sharing = TEAM_BLOCKS.filter((name) => context.config.blockNames.includes(name));
+			if (sharing.length === 0) return [];
+			return [{
+				message: `${providerLabel(provider)} declares a team scope, but sets no authorization.functions.teamIdsOf, so ${sharing.join(", ")} can't see its teams. Set teamIdsOf to a set-returning call with {user}, for example "provider.team_ids_of({user})".`,
+				target: "authorization.functions.teamIdsOf"
+			}];
+		}
+	}
+];
+const TEAM_SCOPE = /^teams?$/;
+const TEAM_BLOCKS = [
+	"teams",
+	"saved-views",
+	"collections"
+];
+const TEMPLATE_CALL = /\b("?[a-z_][a-z0-9_$]*"?)\s*\.\s*("?[a-z_][a-z0-9_$]*"?)\s*\(/gi;
+/** The `schema.function` names a template calls, lowercased and unquoted. */
+function templateCalls(template) {
+	return [...withoutStrings(template).matchAll(TEMPLATE_CALL)].map((match) => `${match[1]}.${match[2]}`.replaceAll("\"", "").toLowerCase());
+}
+const CONTRACT_CALL = /\bbetter_supabase"?\s*\.\s*"?(can|tenant_ids_with)"?\s*\(/gi;
+const ROLE_HELPER_CALL = /\bbetter_supabase"?\s*\.\s*"?(member_organization_ids|has_organization_role|organization_member_role)"?\s*\(/gi;
+/** The tenant role helpers `text` calls, outside string literals. */
+function roleHelperCalls(text) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of withoutStrings(text).matchAll(ROLE_HELPER_CALL)) names.add(`better_supabase.${match[1].toLowerCase()}()`);
+	return [...names].toSorted();
+}
+/** The access contract functions `text` calls, outside string literals. */
+function contractCalls(text) {
+	const names = /* @__PURE__ */ new Set();
+	for (const match of withoutStrings(text).matchAll(CONTRACT_CALL)) names.add(`better_supabase.${match[1].toLowerCase()}()`);
+	return [...names].toSorted();
+}
+//#endregion
+//#region src/cli/gen/manifest.ts
+/**
+* The files the last `gen` wrote, so the next one can remove those it no longer
+* writes.
+*/
+const MANIFEST = `${CACHE_DIR}/gen-manifest.json`;
+const manifestPath = (root, path) => relative(root, resolve(root, path)).split(sep).join("/");
+async function readManifest(root) {
+	const parsed = await readFile(resolve(root, MANIFEST), "utf-8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1 || !("files" in parsed) || !Array.isArray(parsed.files)) return [];
+	return parsed.files.filter((path) => typeof path === "string");
+}
+/**
+* Files in the last manifest that this run doesn't generate and that still
+* exist inside the root.
+*/
+async function leftoverFiles(root, generated) {
+	const current = new Set(generated);
+	return (await readManifest(root)).filter((path) => {
+		const inside = relative(root, resolve(root, path));
+		return !current.has(path) && inside !== "" && !inside.startsWith("..") && !isAbsolute(inside) && existsSync(resolve(root, path));
+	});
+}
+const writeManifest = (root, files) => writeAtomic(resolve(root, MANIFEST), `${JSON.stringify({
+	version: 1,
+	files: files.toSorted()
+}, null, 2)}\n`).catch(() => void 0);
+//#endregion
+//#region src/cli/introspect/from-metadata.ts
+/**
+* What the extras query set reads that a `GeneratorMetadata` document leaves
+* out.
+*/
+const METADATA_GAPS = [
+	"multi-column unique keys and checks",
+	"foreign key actions",
+	"indexes",
+	"triggers",
+	"policies",
+	"grants",
+	"storage buckets",
+	"the realtime publication"
+];
+/** `METADATA_GAPS` as one phrase for notices. */
+const METADATA_GAPS_TEXT = `${METADATA_GAPS.slice(0, -1).join(", ")} or ${METADATA_GAPS.at(-1) ?? ""}`;
+/**
+* Builds a snapshot from a `GeneratorMetadata` document alone, for `gen
+* --metadata`. Relations come from `relationships`, single-column unique keys
+* from `is_unique` and single-column checks from `check`, named as Postgres
+* names them by default (`<table>_<column>_key`, `<table>_<column>_check`).
+* Everything else the extras carry is empty, and `extras.fromMetadata` says
+* so.
+*/
+function fromMetadata(document) {
+	const { metadata } = stabilizeMetadata(document);
+	const tableIds = new Set(metadata.tables.map((table) => table.id));
+	const tables = [
+		...metadata.tables,
+		...metadata.foreignTables,
+		...metadata.views,
+		...metadata.materializedViews
+	].map((relation) => {
+		const columns = metadata.columns.filter((column) => column.table_id === relation.id).toSorted((a, b) => a.ordinal_position - b.ordinal_position);
+		const own = tableIds.has(relation.id);
+		return {
+			id: relation.id,
+			schema: relation.schema,
+			name: relation.name,
+			primaryKey: [],
+			uniques: own ? columns.filter((column) => column.is_unique).map((column) => ({
+				name: `${relation.name}_${column.name}_key`,
+				columns: [column.name]
+			})) : [],
+			foreignKeys: own ? metadata.relationships.filter((fk) => fk.schema === relation.schema && fk.relation === relation.name).map((fk) => ({
+				name: fk.foreign_key_name,
+				onDelete: "no action",
+				onUpdate: "no action"
+			})).toSorted((a, b) => byCodePoint(a.name, b.name)) : [],
+			checks: own ? columns.flatMap((column) => column.check === null ? [] : [{
+				name: `${relation.name}_${column.name}_check`,
+				definition: `CHECK ((${column.check}))`
+			}]) : [],
+			indexes: [],
+			policies: [],
+			triggers: [],
+			grants: []
+		};
+	});
+	return {
+		version: 2,
+		schemas: [...new Set(metadata.schemas.map((schema) => schema.name))].toSorted(byCodePoint),
+		generator: metadata,
+		extras: {
+			tables,
+			buckets: [],
+			realtime: [],
+			fromMetadata: true
+		}
+	};
+}
+//#endregion
+//#region src/cli/gen/notices.ts
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt. @supabase/postgrest-typegen pins oxfmt 0.66.0 as its peer; to allow a newer one, add it to peerDependencyRules.allowedVersions in pnpm-workspace.yaml, keyed \"@supabase/postgrest-typegen>oxfmt\".";
+const METADATA_ONLY = `Notice: the schema came from a GeneratorMetadata document, which has no ${METADATA_GAPS_TEXT}. Unique keys and checks cover single columns, relations have no onDelete, and columns a before-insert trigger fills stay required on insert. Run \`better-supabase gen\` against the database for the full model.`;
+/**
+* The formatter, typegen version and metadata-only notices, the model's notices
+* and the config warnings, one line each.
+*/
+async function generationNotices(snapshot, warnings, notices = []) {
+	const typegen = typegenVersionNotice(await typegenVersion());
+	return [
+		...await oxfmtInstalled() ? [] : [UNFORMATTED],
+		...typegen ? [typegen] : [],
+		...snapshot.extras.fromMetadata ? [METADATA_ONLY] : [],
+		...notices,
+		...warnings.map((warning) => `Warning: ${warning}`)
+	];
+}
+//#endregion
+//#region src/cli/gen/run.ts
+/** The `read-sets` SQL module file for `config.readSets`, if any are configured. */
+async function readSetFile(config) {
+	if (config.readSets.length === 0) return;
+	const readSets = await compiledReadSets(config);
+	const { appTables: _appTables, ...layout } = moduleLayout(config, config.sql.testsDir, readSets);
+	return renderBlocks(["read-sets"], layout)[0];
+}
+/**
+* `buckets` keys that reach the authorization provider's functions but aren't
+* marked `sqlComplete: true` in `authorization.permissions`, as error lines.
+*/
+function rowConditionedBuckets(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	return providerBucketKeys(config).flatMap(({ bucket, keys }) => keys.flatMap((key) => {
+		const problem = unsafeKey(provider, key);
+		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
+	}));
+}
+/**
+* The exit `gen` stops with when bucket keys aren't fully answered by the
+* provider's SQL functions.
+*/
+function refuseRowConditionedBuckets(config) {
+	const refused = rowConditionedBuckets(config);
+	return refused.length === 0 || !config.authorization ? void 0 : {
+		code: 1,
+		error: `The SQL functions of ${providerLabel(config.authorization)} decide by role and scope only, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
+	};
+}
+async function runGen(options) {
+	const { config } = options;
+	const refused = refuseRowConditionedBuckets(config);
+	if (refused) return refused;
+	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
+	const { files, warnings, notices, typesModule } = await render(config, snapshot);
+	const migrations = !options.isolated && await writesMigrations(config);
+	const pathsOf = (readSets) => [...files, ...readSets && !migrations ? [readSets] : []].map((file) => manifestPath(config.root, file.path));
+	const notice = (await generationNotices(snapshot, warnings, notices)).map((line) => `\n${line}`).join("");
+	const readSetsOf = () => options.isolated ? Promise.resolve(void 0) : readSetFile(config);
+	const leftoversOf = (generated) => options.isolated ? Promise.resolve([]) : leftoverFiles(config.root, generated);
+	if (options.check) {
+		const readSets = await readSetsOf();
+		const generated = pathsOf(readSets);
+		const leftovers = await leftoversOf(generated);
+		const stale = [];
+		const diffs = [];
+		const compare = (file, current) => {
+			const shown = display(config.root, file.path);
+			stale.push(shown);
+			diffs.push(fileDiff(shown, current, file.contents, options.paint));
+		};
+		for (const file of files) {
+			const path = resolve(config.root, file.path);
+			const current = existsSync(path) ? await readFile(path, "utf-8") : void 0;
+			if (!sameText(current, file.contents)) compare(file, current);
+		}
+		if (readSets && migrations) {
+			const latest = await latestMigration(config, READ_SETS_SUFFIX);
+			if (!sameModuleMigration(latest?.text, readSets.contents)) compare({
+				path: latest?.path ?? `${migrationsDir(config)}/<stamp>_better_supabase_read_sets.sql`,
+				contents: readSets.contents
+			}, latest?.text);
+		} else if (readSets) {
+			const path = resolve(config.root, readSets.path);
+			const current = existsSync(path) ? await readFile(path, "utf-8") : void 0;
+			if (!sameBlockFile(current, readSets.contents)) compare(readSets, current);
+		}
+		if (stale.length > 0 || leftovers.length > 0) {
+			const lines = [...stale.map((path) => `  ${path}`), ...leftovers.map((path) => `  ${path} (no longer generated)`)];
+			return {
+				code: 1,
+				output: `${diffs.join("\n\n")}${notice}`,
+				error: `Generated files are out of date:\n${lines.join("\n")}\nRun \`better-supabase gen\`.`,
+				errorCode: "check_failed",
+				data: {
+					upToDate: false,
+					stale,
+					leftovers,
+					warnings
+				}
+			};
+		}
+		return {
+			code: 0,
+			output: `Generated files are up to date (${generated.length}).${notice}`,
+			data: {
+				upToDate: true,
+				stale: [],
+				leftovers: [],
+				warnings
+			}
+		};
+	}
+	const flags = {
+		"dry-run": options.dryRun,
+		force: options.force
+	};
+	const plan = (entries, remove = []) => ({
+		root: config.root,
+		regenerate: "better-supabase gen",
+		files: entries.map((file) => ({
+			path: file.path,
+			contents: file.contents
+		})),
+		remove
+	});
+	const changes = [...(await applyPlan(plan(files), flags)).changes];
+	const readSets = await readSetsOf();
+	if (readSets && migrations) {
+		const migration = await writeLatestMigration(config, READ_SETS_SUFFIX, readSets.contents, {
+			now: /* @__PURE__ */ new Date(),
+			dryRun: options.dryRun === true
+		});
+		changes.push({
+			file: migration.path,
+			outcome: migration.line.startsWith("Unchanged ") ? "unchanged" : "create"
+		});
+	}
+	const generated = pathsOf(readSets);
+	changes.push(...(await applyPlan(plan([], await leftoversOf(generated)), flags)).changes);
+	if (readSets && !migrations) {
+		const path = resolve(config.root, readSets.path);
+		changes.push(...(await applyPlan({
+			...plan([{
+				...readSets,
+				path
+			}]),
+			root: dirname(path),
+			base: config.root
+		}, flags)).changes);
+	}
+	const applied = {
+		mode: options.dryRun === true ? "dry-run" : "write",
+		changes,
+		diffs: [],
+		drift: false
+	};
+	const written = changedFiles(applied);
+	if (!options.isolated && options.dryRun !== true) await writeManifest(config.root, generated);
+	if (typesModule !== void 0 && options.dryRun !== true) {
+		const configText = options.configFile ? await readFile(options.configFile, "utf-8").catch(() => void 0) : void 0;
+		const key = typesModuleKey(config, configText, snapshot);
+		if (await storeTypesModule(config.root, config.output, key, typesModule)) await writeAtomic(schemaStampPath(config.root, config.output), key).catch(() => void 0);
+	}
+	const tables = snapshot.extras.tables.filter((table) => config.schemas.includes(table.schema)).length;
+	const lines = changeLines(applied).filter((line) => !line.startsWith("Unchanged "));
+	return {
+		...hasConflicts(applied) ? {
+			code: 1,
+			errorCode: "file_conflict",
+			error: "Some generated files were written by hand, so gen left them alone. Pass --force to overwrite them."
+		} : { code: 0 },
+		output: `${lines.length === 0 ? `No changes (${tables} tables).` : `${lines.join("\n")}\n${options.dryRun === true ? "Would generate" : "Generated"} ${tables} tables.`}${notice}`,
+		data: {
+			tables,
+			written,
+			files: changes,
+			warnings
+		}
+	};
+}
+//#endregion
+export { splinterTables as C, advisorRule as S, withoutStrings as _, METADATA_GAPS_TEXT as a, appTablesOf as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, BLOCK_PREFIX as v, appViewsOf as x, blockTargets as y };