better-supabase 0.14.0 → 0.15.1

package/dist/cli/codemod-BbaE5dL_.js

@@ -0,0 +1,2435 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { i as plain } from "./style-Bm2X5JrN.js";
+import { n as CliError } from "./errors-BTe6A15O.js";
+import { t as migrateCliCall } from "./moved-CsfDQcyk.js";
+import { t as isRecord$1 } from "./guards-CUlDNYZs.js";
+import { a as changedFiles, i as changeLines, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
+import { i as schemasDirOf, n as migrationsDir, o as writtenByBlocks } from "./sql-layout-rFP0oq1N.js";
+import { a as configObject, c as mask, f as setPathInConfig, g as skipSpace, h as setPresetInJson, i as closingIndex, l as properties, m as setPresetInConfig, o as indentAt, p as setPathInJson, t as addBlocksToConfig, v as codeRanges } from "./config-edit-CrWfk8s3.js";
+import { i as legacyPrefixNames, n as LEGACY_PREFIXES, t as LEGACY_CLAIMS } from "./legacy-prefix-DkTA3Rhx.js";
+import { a as REVIEW_0_15, c as renameSubpaths, r as PLUGIN_IMPORT_RENAMES, s as SUBPATH_RENAMES_0_15, t as BLOCK_EXPORT_RENAMES } from "./codemod-block-renames-BuSaTE_G.js";
+import { a as RECORD_BINDING_RENAMES, n as groupConfigJson, r as groupConfigSource, t as cutRange } from "./config-group-C8tjut39.js";
+import { existsSync } from "node:fs";
+import { extname, join, relative, resolve } from "node:path";
+import { readFile, readdir, stat } from "node:fs/promises";
+import { DEFAULT_CONVENTIONS, presetSpec } from "better-supabase/preset";
+import { currentBlockName, renamedBlock } from "better-supabase/sql";
+import { BLOCK_EVENT_RENAMES } from "better-supabase/events";
+//#region src/cli/codemod-calls.ts
+/** Files whose CLI calls a codemod rewrites. */
+const CLI_CALL_FILE = /(?:^|[\\/])(?:package\.json|\.github[\\/]workflows[\\/][^\\/]+\.ya?ml)$/;
+/** Other files that run shell commands; their CLI calls are listed for review. */
+const SHELL_FILE = /(?:^|[\\/])(?:[^\\/]+\.(?:sh|bash|zsh|ya?ml)|Makefile|justfile|Dockerfile)$/;
+/** The bin, with an optional `@version`, followed by its arguments. */
+const BIN = /(?<![\w.@-])(?:better-supabase|bsb)(?:@[\w.^~-]+)?(?=[ \t])/g;
+/**
+* Where a call's arguments end: a line break, a shell operator, a closing quote
+* or a comment.
+*/
+const CALL_END = /\r?\n|&&|\|\||[;|)`]|\\?"|\s#/;
+/** `pnpm --filter better-supabase <script>` names the package, not the bin. */
+const PACKAGE_FILTER = /(?:--filter|-F)[= ]$/;
+function cliCalls(text, migrate) {
+	const calls = [];
+	for (const match of text.matchAll(BIN)) {
+		if (PACKAGE_FILTER.test(text.slice(0, match.index))) continue;
+		const start = match.index + match[0].length;
+		const tail = text.slice(start);
+		const end = start + (CALL_END.exec(tail)?.index ?? tail.length);
+		const words = text.slice(start, end).trim().split(/\s+/u);
+		const to = words[0] === "" ? void 0 : migrate(words);
+		if (to) calls.push({
+			start,
+			end,
+			bin: match[0],
+			to
+		});
+	}
+	return calls;
+}
+/**
+* A CLI call followed by `&&` and the same call again. The call starts after a
+* shell operator, a quote, a line break or a YAML `run:`, and the repeat ends
+* at one, so only whole commands match.
+*/
+const REPEATED_CALL = /((?:^|&&|\|\||[;:\n"'`(])[ \t]*)([^&|;\n"'`()]*?(?<![\w.@-])(?:better-supabase|bsb)(?:@[\w.^~-]+)?[ \t][^&|;\n"'`()]*?)[ \t]*&&[ \t]*\2(?=[ \t]*(?:&&|\|\||[;\n"'`)]|$))/g;
+/**
+* `text` with each run of identical CLI calls joined by `&&` kept once. Two old
+* commands can move to the same new one (`sql sync` and `sql upgrade` both
+* become `upgrade`), and running it twice in a row does the work twice.
+*/
+function collapseRepeatedCalls(text) {
+	let out = text;
+	let previous;
+	while (out !== previous) {
+		previous = out;
+		out = out.replaceAll(REPEATED_CALL, "$1$2");
+	}
+	return out;
+}
+/** `text` with every moved CLI call spelled the new way. */
+function rewriteCliCalls(text, migrate) {
+	const calls = cliCalls(text, migrate);
+	if (calls.length === 0) return text;
+	let out = "";
+	let cursor = 0;
+	for (const call of calls) {
+		const original = text.slice(call.start, call.end);
+		const trailing = /\s*$/u.exec(original)?.[0] ?? "";
+		out += `${text.slice(cursor, call.start)} ${call.to.join(" ")}${trailing}`;
+		cursor = call.end;
+	}
+	return collapseRepeatedCalls(out + text.slice(cursor));
+}
+/** One review line per moved CLI call, with the new spelling. */
+function cliCallHints(text, migrate) {
+	return cliCalls(text, migrate).map((call) => ({
+		line: text.slice(0, call.start).split("\n").length,
+		message: `This call uses a renamed command or flag: run \`${call.bin} ${call.to.join(" ")}\``
+	}));
+}
+//#endregion
+//#region src/cli/codemod-preset-code.ts
+/**
+* The 0.14 preset code layout, frozen: the fields in code order with their
+* values and widths, then one bit per block. Codes are no longer written; the
+* 0.15 codemod reads them into a preset object.
+*/
+const FIELDS = [
+	{
+		key: "framework",
+		values: [
+			"next",
+			"vite",
+			"tanstack-start",
+			"expo",
+			"sveltekit",
+			"nuxt",
+			"hono",
+			"astro",
+			"react-router"
+		],
+		bits: 5
+	},
+	{
+		key: "platforms",
+		values: [
+			"web",
+			"native",
+			"both"
+		],
+		bits: 2
+	},
+	{
+		key: "casing",
+		values: ["snake", "camel"],
+		bits: 2
+	},
+	{
+		key: "idType",
+		values: [
+			"uuid",
+			"text",
+			"bigint",
+			"integer"
+		],
+		bits: 3
+	},
+	{
+		key: "scope",
+		values: [
+			"tenant",
+			"user",
+			"none"
+		],
+		bits: 2
+	},
+	{
+		key: "tenantName",
+		values: [
+			"organization",
+			"workspace",
+			"team"
+		],
+		bits: 3
+	},
+	{
+		key: "access",
+		values: [
+			"roles",
+			"catalog",
+			"provider",
+			"custom"
+		],
+		bits: 3
+	},
+	{
+		key: "api",
+		values: ["none", "api"],
+		bits: 2
+	},
+	{
+		key: "integrations",
+		values: [
+			"next",
+			"hono",
+			"orpc",
+			"edge",
+			"expo",
+			"mcp",
+			"client",
+			"react"
+		],
+		bits: 16,
+		multi: true
+	}
+];
+/** The 0.14 block bits, in order; `null` marks a removed block. */
+const BLOCKS = [
+	"updated-at",
+	"actor",
+	"audit",
+	"tenant",
+	"invitations",
+	"reserved-slugs",
+	"jobs",
+	"idempotency",
+	"webhook-inbox",
+	"realtime-tables",
+	"jsonb-schemas",
+	"pgtap",
+	"grants",
+	"read-sets",
+	"mfa",
+	"entitlements",
+	"rate-limit",
+	"vector-search",
+	"access",
+	"support-sessions",
+	"organizations",
+	"profiles",
+	"outbox",
+	"notifications",
+	"webhooks-out",
+	"sessions",
+	"webhooks-in",
+	"api-keys",
+	"settings",
+	"usage",
+	"billing",
+	"flags",
+	"comments",
+	"attachments",
+	"data-lifecycle",
+	"sso",
+	"onboarding",
+	"waitlist",
+	"announcements",
+	"streams",
+	"credentials",
+	"workflows",
+	"workflow-sdk-world",
+	"workflow-builder",
+	"chat-sdk-state",
+	"inbox",
+	"ai-chat",
+	"ai-files",
+	"knowledge",
+	"memory",
+	"agents",
+	"connectors",
+	"ai-tasks",
+	"push",
+	"ai-cache",
+	"ai-providers",
+	"number-sequences",
+	"teams",
+	"tags",
+	"state-machine",
+	"custom-fields",
+	"share-links",
+	"reminders",
+	"imports",
+	"subjects",
+	"rank",
+	"saved-views",
+	"relations",
+	"bulk",
+	"search",
+	"metrics",
+	"calendar",
+	"bookings",
+	"versions",
+	"trash",
+	"reactions",
+	"approvals",
+	"access-requests",
+	"documents",
+	"catalog",
+	"inventory",
+	"drive",
+	"drive-files",
+	"orders",
+	"promotions",
+	"forms",
+	"signatures",
+	"time-tracking",
+	"identities",
+	"service-principals",
+	"templates",
+	"pipelines",
+	"parties",
+	"engagements",
+	"deals",
+	"work-items",
+	"quotes",
+	"invoices",
+	"sla",
+	"targets",
+	"hiring",
+	"employees",
+	"collections",
+	"ensure-rls",
+	"signing-keys",
+	"shared-signals",
+	"oauth-server",
+	"domains",
+	"reviews",
+	"leave",
+	"rules",
+	"vercel-marketplace",
+	"ledger",
+	"assets",
+	"scores",
+	"moderation",
+	"enrollments",
+	"guests",
+	"passes",
+	"billable-time",
+	"leases",
+	"expenses",
+	"donations",
+	"dispatch",
+	"shipments",
+	"contracts",
+	"controls",
+	"incidents",
+	"courses",
+	"messaging",
+	"channels",
+	"activity",
+	"mail-sync",
+	"segments",
+	"assignment",
+	"enrichment",
+	"forecasts",
+	"field-history",
+	"sequences",
+	"lead-scoring",
+	"posts",
+	"field-encryption"
+];
+const BASE62 = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+/** Whether `value` reads as a 0.14 preset code: `1` and base62 digits. */
+function isLegacyPresetCode(value) {
+	return /^1[0-9A-Za-z]+$/.test(value);
+}
+/**
+* The conventions and blocks a 0.14 preset code holds, the blocks under their
+* 0.15 names. Throws a TypeError when `code` isn't one.
+*/
+function decodeLegacyPresetCode(code) {
+	if (!isLegacyPresetCode(code)) throw new TypeError(`"${code}" is not a 0.14 preset code.`);
+	let value = 0n;
+	for (const char of code.slice(1)) value = value * 62n + BigInt(BASE62.indexOf(char));
+	const preset = {};
+	for (const field of FIELDS) {
+		const bits = value & (1n << BigInt(field.bits)) - 1n;
+		value >>= BigInt(field.bits);
+		if (field.multi === true) {
+			preset[field.key] = field.values.filter((_, index) => (bits >> BigInt(index) & 1n) === 1n);
+			continue;
+		}
+		const each = field.values[Number(bits)];
+		if (each === void 0) throw new TypeError(`Preset code "${code}" has an unknown ${field.key}.`);
+		preset[field.key] = each;
+	}
+	const blocks = [];
+	for (let index = 0; value > 0n; index += 1, value >>= 1n) {
+		const name = BLOCKS[index];
+		if ((value & 1n) === 1n && name !== null && name !== void 0) blocks.push(currentBlockName(name));
+	}
+	return {
+		...preset,
+		blocks
+	};
+}
+/** The preset a 0.14 code holds, as the name or object the config takes. */
+function specOfCode(code) {
+	const { blocks, ...decoded } = decodeLegacyPresetCode(code);
+	return presetSpec({
+		...DEFAULT_CONVENTIONS,
+		...decoded,
+		blocks: typeof blocks === "string" ? [blocks] : blocks ?? []
+	});
+}
+const PRESET_CODE = /(\bpreset\s*:\s*|"preset"\s*:\s*)(["'])((?:https?:\/\/[^"'?]*\?(?:[^"']*&)?preset=)?)(1[0-9A-Za-z]+)([^"']*)\2/;
+/**
+* `better-supabase.config.*` with a 0.14 preset code (or a Create URL holding
+* one) in `preset` rewritten to the preset object or name it holds.
+*/
+function convertConfigPresetCode(source, json) {
+	const match = PRESET_CODE.exec(source);
+	if (match === null || match[5] !== "") return {
+		ok: true,
+		text: source
+	};
+	const spec = specOfCode(match[4] ?? "");
+	return json ? setPresetInJson(source, spec) : setPresetInConfig(source, spec);
+}
+/**
+* A 0.14 design file (`{ preset: "<code>", design }`) as a 0.15 one: the design
+* with the preset object inside. Other JSON is returned as it is.
+*/
+function convertDesignFile(source) {
+	let value;
+	try {
+		value = JSON.parse(source);
+	} catch {
+		return {
+			ok: false,
+			reason: "it isn't valid JSON"
+		};
+	}
+	if (typeof value !== "object" || value === null || !("preset" in value) || !("design" in value) || typeof value.preset !== "string" || typeof value.design !== "object" || value.design === null) return {
+		ok: true,
+		text: source
+	};
+	const preset = isLegacyPresetCode(value.preset) ? specOfCode(value.preset) : value.preset;
+	return {
+		ok: true,
+		text: `${JSON.stringify({
+			...value.design,
+			preset
+		}, null, 2)}\n`
+	};
+}
+/** A design file Create downloaded (`better-supabase.design.json`). */
+const DESIGN_FILE_NAME = /(?:^|[\\/])[^\\/]*\.design\.json$/;
+const reviewOf = (edit) => edit.ok && "review" in edit ? edit.review : [];
+/** `edit`, then `convertConfigPresetCode` on its text, with both reviews. */
+function thenConvertPresetCode(edit, json) {
+	if (!edit.ok) return edit;
+	const converted = convertConfigPresetCode(edit.text, json);
+	return converted.ok ? {
+		ok: true,
+		text: converted.text,
+		review: [...reviewOf(edit), ...reviewOf(converted)]
+	} : converted;
+}
+/** A codemod's `designFile` rewrite as a result; a refusal is listed for review. */
+function designFileResult(source, rewrite) {
+	if (rewrite === void 0) return {
+		text: source,
+		review: []
+	};
+	const edit = rewrite(source);
+	return edit.ok ? {
+		text: edit.text,
+		review: reviewOf(edit)
+	} : {
+		text: source,
+		review: [{
+			line: 1,
+			message: `The design file wasn't rewritten: ${edit.reason}`
+		}]
+	};
+}
+//#endregion
+//#region src/cli/codemod-sql-names.ts
+/**
+* The 0.15 `bs_` to `bsb_` rename in the app's own SQL. The upgrade migration
+* renames the objects in the database, but SQL the app wrote (pgTAP tests, its
+* schema files, its newest migration) still names them the old way, so the
+* codemod lists those lines. It never rewrites SQL: a pushed migration must not
+* change, and a test may name an object on purpose.
+*/
+const LEGACY_NAME = /\bbs_[a-z0-9_]+/g;
+const CURRENT_NAME = /\bbsb_[a-z0-9_]+/g;
+/**
+* The `bs_` names the 0.15 rename covers, from the files better-supabase wrote:
+* their old `bs_` names before `upgrade` rewrites them, or the `bs_` form of
+* their `bsb_` names after.
+*/
+function renamedSqlNames(blockFiles) {
+	const text = blockFiles.join("\n");
+	return /* @__PURE__ */ new Set([...legacyPrefixNames(text), ...[...new Set(text.match(CURRENT_NAME))].map((name) => `bs_${name.slice(4)}`).filter((name) => !LEGACY_CLAIMS.has(name))]);
+}
+const renamed = (name, names) => names.has(name) || LEGACY_PREFIXES.some((prefix) => name.startsWith(prefix));
+/** One hint per line and renamed name in `sources`. */
+function sqlNameHints(sources, names) {
+	const hints = [];
+	for (const source of sources) for (const [index, line] of source.text.split("\n").entries()) for (const name of new Set(line.match(LEGACY_NAME))) if (renamed(name, names)) hints.push({
+		file: source.path,
+		line: index + 1,
+		message: `${name} is bsb_${name.slice(3)} since 0.15, and the upgrade migration renames it in the database. Rename it here, in SQL that runs after that migration.`
+	});
+	return hints;
+}
+async function sqlFiles(dir) {
+	if (!existsSync(dir)) return [];
+	const files = [];
+	for (const entry of await readdir(dir, { withFileTypes: true })) {
+		const full = join(dir, entry.name);
+		if (entry.isDirectory()) files.push(...await sqlFiles(full));
+		else if (entry.name.endsWith(".sql")) files.push(full);
+	}
+	return files.toSorted();
+}
+/**
+* Lines of the app's SQL that name a `bs_` object the 0.15 upgrade renames: the
+* pgTAP tests (`sql.testsDir`), the schema files no block wrote, and the newest
+* migration the app wrote. Older migrations already ran, so they stay as they
+* are.
+*/
+async function legacySqlNameHints(config) {
+	const read = async (path) => ({
+		path: relative(config.root, path).replaceAll("\\", "/"),
+		text: await readFile(path, "utf-8")
+	});
+	const [tests, schemas, migrations] = await Promise.all([
+		Promise.all((await sqlFiles(join(config.root, config.sql.testsDir))).map(read)),
+		Promise.all((await sqlFiles(join(config.root, await schemasDirOf(config)))).map(read)),
+		Promise.all((await sqlFiles(join(config.root, migrationsDir(config)))).map(read))
+	]);
+	const names = renamedSqlNames([...schemas, ...migrations].filter(writtenByBlocks).map((file) => file.text));
+	const latest = migrations.findLast((file) => !writtenByBlocks(file));
+	return sqlNameHints([
+		...tests.filter((file) => !writtenByBlocks(file)),
+		...schemas.filter((file) => !writtenByBlocks(file)),
+		...latest === void 0 ? [] : [latest]
+	], names);
+}
+//#endregion
+//#region src/cli/codemod-data-contract.ts
+/** The query guards named after the retired verbs. */
+const DATA_CONTRACT_OPTIONS = [{
+	call: "guards",
+	from: "noUnboundedFindMany",
+	to: "noUnboundedList"
+}, {
+	call: "guards",
+	from: "noDeleteManyWithoutWhere",
+	to: "noDeleteWithoutWhere"
+}];
+/** The lint rules named after the retired verbs. */
+const DATA_CONTRACT_STRINGS = {
+	"better-supabase/no-unbounded-find-many": "better-supabase/no-unbounded-list",
+	"better-supabase/no-delete-many-without-where": "better-supabase/no-empty-where"
+};
+const RENAMED = {
+	findMany: "list",
+	paginate: "page",
+	findById: "get",
+	createMany: "create",
+	upsertMany: "upsert"
+};
+const CALL = /\.(findMany|paginate|findById|createMany|upsertMany|updateMany|deleteMany|findUnique|findOnly|findFirst|exists)(\s*)\(/g;
+const REVIEW = "Rewrite this call by hand: its arguments aren't an object literal (see the 0.14 to 0.15 guide's data contract table)";
+/**
+* Rewrites the 0.14 repository methods to the 0.15 data contract. A call nested
+* in another rewritten call's arguments is rewritten on the next pass.
+*/
+function rewriteDataContract(source, options = {}) {
+	let text = source;
+	for (let pass = 0; pass < 4; pass += 1) {
+		const next = rewritePass(text, options);
+		if (next.text === text) return next;
+		text = next.text;
+	}
+	return rewritePass(text, options);
+}
+function rewritePass(source, options) {
+	const code = options.raw === true ? source : mask(source);
+	const edits = [];
+	const review = [];
+	for (const match of code.matchAll(CALL)) {
+		const method = match[1];
+		const name = match.index + 1;
+		const open = match.index + match[0].length - 1;
+		const close = closingIndex(code, open);
+		if (close === -1) continue;
+		const edit = rewrite(source, code, {
+			method,
+			name,
+			open,
+			close
+		});
+		if (edit === void 0) review.push({
+			line: source.slice(0, name).split("\n").length,
+			message: REVIEW
+		});
+		else if (edit !== "skip") edits.push(...edit);
+	}
+	return {
+		text: apply(source, edits),
+		review
+	};
+}
+function rewrite(source, code, call) {
+	const { method, name, open, close } = call;
+	const renamed = RENAMED[method];
+	if (renamed !== void 0) return [{
+		start: name,
+		end: name + method.length,
+		text: renamed
+	}];
+	const sole = soleArgument(code, open, close);
+	if (sole === "several") return method === "exists" ? "skip" : void 0;
+	const argument = sole === "none" ? void 0 : sole;
+	if (method === "exists") {
+		if (argument !== void 0 && (code[argument] !== "{" || !properties(source, code, argument)?.some((prop) => prop.key === "where"))) return "skip";
+		return [{
+			start: name,
+			end: name + method.length,
+			text: "count"
+		}, {
+			start: close + 1,
+			end: close + 1,
+			text: ".map((n) => n > 0)"
+		}];
+	}
+	if (method === "findFirst") return findFirst(source, code, call, argument);
+	if (argument === void 0 || code[argument] !== "{") return;
+	const props = properties(source, code, argument);
+	if (!props) return;
+	const text = (key) => {
+		const prop = props.find((entry) => entry.key === key);
+		return prop === void 0 ? void 0 : source.slice(prop.valueStart, prop.valueEnd);
+	};
+	const rest = (...without) => props.filter((prop) => prop.key === void 0 || !without.includes(prop.key)).map((prop) => source.slice(prop.start, prop.valueEnd));
+	const value = text("where");
+	if (value === void 0) return;
+	const where = value === "where" ? "where" : `where: ${value}`;
+	const options = (extra) => {
+		const items = [...extra];
+		return items.length === 0 ? "" : `, { ${items.join(", ")} }`;
+	};
+	const replace = (verb, args) => [{
+		start: name,
+		end: close + 1,
+		text: `${verb}(${args})`
+	}];
+	switch (method) {
+		case "updateMany": {
+			const data = text("data");
+			return data === void 0 ? void 0 : replace("update", `{ ${where} }, ${data}${options(rest("where", "data"))}`);
+		}
+		case "deleteMany": return replace("delete", `{ ${where} }${options(rest("where"))}`);
+		case "findUnique": return replace("get", `${value}${options([...rest("where"), "optional: true"])}`);
+		case "findOnly": return replace("get", `{ ${where} }${options([...rest("where"), "optional: true"])}`);
+		default: return;
+	}
+}
+function findFirst(source, code, call, argument) {
+	const { name, open, close } = call;
+	const first = {
+		start: close + 1,
+		end: close + 1,
+		text: ".map((rows) => rows[0] ?? null)"
+	};
+	const verb = {
+		start: name,
+		end: name + 9,
+		text: "list"
+	};
+	if (argument === void 0) return [
+		verb,
+		{
+			start: open + 1,
+			end: close,
+			text: "{ limit: 1 }"
+		},
+		first
+	];
+	if (code[argument] === "{") {
+		const end = closingIndex(code, argument);
+		const inner = source.slice(argument + 1, end).trim();
+		return [
+			verb,
+			{
+				start: argument,
+				end: end + 1,
+				text: inner.length === 0 ? "{ limit: 1 }" : `{ ${inner.replace(/,\s*$/, "")}, limit: 1 }`
+			},
+			first
+		];
+	}
+	const value = source.slice(argument, close).trim();
+	return [
+		verb,
+		{
+			start: open + 1,
+			end: close,
+			text: `{ ...${value}, limit: 1 }`
+		},
+		first
+	];
+}
+/** The index where the only argument starts. */
+function soleArgument(code, open, close) {
+	const start = open + 1 + (/^\s*/.exec(code.slice(open + 1))?.[0].length ?? 0);
+	if (start >= close) return "none";
+	let depth = 0;
+	for (let index = start; index < close; index += 1) {
+		const char = code[index];
+		if (char === "\"" || char === "'" || char === "`") index = Math.max(index, code.indexOf(char, index + 1));
+		else if ("({[".includes(char)) depth += 1;
+		else if (")}]".includes(char)) depth -= 1;
+		else if (char === "," && depth === 0 && code.slice(index + 1, close).trim() !== "") return "several";
+	}
+	return start;
+}
+function apply(text, edits) {
+	let out = "";
+	let cursor = 0;
+	for (const edit of edits.toSorted((a, b) => a.start - b.start)) {
+		if (edit.start < cursor) continue;
+		out += text.slice(cursor, edit.start) + edit.text;
+		cursor = edit.end;
+	}
+	return out + text.slice(cursor);
+}
+const REQUIRE_TENANT = /\brequireTenant\b/g;
+/**
+* The data contract moves, then `requireTenant` renamed to
+* `requireOrganization`.
+*/
+function rewrite015(text) {
+	const result = rewriteDataContract(text);
+	return {
+		text: result.text.replaceAll(REQUIRE_TENANT, "requireOrganization"),
+		review: result.review
+	};
+}
+//#endregion
+//#region src/cli/sql/config-adopt.ts
+const ADOPT = /(?:\bownership|"ownership"|'ownership')\s*:\s*(["'])adopt\1[ \t]*,?/g;
+const lineOf$1 = (text, index) => text.slice(0, index).split("\n").length;
+/** `[start, end)` to delete for the property matched at `start..end`. */
+function span(text, start, end) {
+	const lineStart = text.lastIndexOf("\n", start - 1) + 1;
+	const newline = text.indexOf("\n", end);
+	const lineEnd = newline === -1 ? text.length : newline;
+	if (text.slice(lineStart, start).trim() === "" && text.slice(end, lineEnd).trim() === "") {
+		const after = newline === -1 ? lineEnd : lineEnd + 1;
+		const before = text.slice(0, lineStart).trimEnd();
+		return text[end - 1] !== "," && before.endsWith(",") ? [before.length - 1, lineEnd] : [lineStart, after];
+	}
+	if (text[end - 1] === ",") return [start, end + (/^[ \t]*/.exec(text.slice(end))?.[0].length ?? 0)];
+	const before = text.slice(0, start).trimEnd();
+	return before.endsWith(",") ? [before.length - 1, end] : [start, end];
+}
+/** `source` without its `ownership: "adopt"` keys, and a review line each. */
+function removeAdoptOwnership(source, json) {
+	const code = json ? source : mask(source);
+	const spans = [];
+	const review = [];
+	for (const match of source.matchAll(ADOPT)) {
+		const start = match.index;
+		const value = source.indexOf(match[1], start + 9 + 1);
+		if (!json && (code[start] === " " || code[value] !== match[1])) continue;
+		const removed = span(source, start, start + match[0].length);
+		const linesBefore = spans.map(([from, to]) => source.slice(from, to).split("\n").length - 1).reduce((sum, count) => sum + count, 0);
+		review.push({
+			line: Math.max(lineOf$1(source, removed[0]) - linesBefore, 1),
+			message: "removed ownership: \"adopt\": the block now leaves alone every table your schema already has and keeps its tables and columns mappings. Run `better-supabase upgrade` to write its SQL over them"
+		});
+		spans.push(removed);
+	}
+	let text = source;
+	for (const [start, end] of spans.toReversed()) text = text.slice(0, start) + text.slice(end);
+	return {
+		text,
+		review
+	};
+}
+/** `edit` with `ownership: "adopt"` removed from every block. */
+function withoutAdoptOwnership(edit, json) {
+	if (!edit.ok) return edit;
+	const earlier = "review" in edit ? edit.review : [];
+	const { text, review } = removeAdoptOwnership(edit.text, json);
+	return {
+		ok: true,
+		text,
+		review: [...earlier, ...review]
+	};
+}
+//#endregion
+//#region src/cli/sql/config-block-names.ts
+const ENVIRONMENT_KEY = /^\$(?:development|production|test|ci)$/;
+const STRING = /(["'`])([a-z0-9-]+)\1/g;
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** An operation name (`<block>.<action>`) under its block's 0.15 name. */
+function currentOperationName(name) {
+	const dot = name.indexOf(".");
+	const to = dot === -1 ? void 0 : renamedBlock(name.slice(0, dot));
+	return to === void 0 ? name : `${to}${name.slice(dot)}`;
+}
+function applyEdits$2(source, edits) {
+	let text = source;
+	for (const edit of edits.toSorted((a, b) => b.start - a.start)) text = text.slice(0, edit.start) + edit.text + text.slice(edit.end);
+	return text;
+}
+/** The key token at `start` renamed to `to`, keeping its quotes. */
+function keyEdit(source, start, key, to) {
+	const quote = source[start];
+	const quoted = quote === "\"" || quote === "'";
+	const bare = /^[A-Za-z_$][\w$]*$/.test(to);
+	return {
+		start,
+		end: start + key.length + (quoted ? 2 : 0),
+		text: quoted ? `${quote}${to}${quote}` : bare ? to : `"${to}"`
+	};
+}
+/** Edits renaming the keys of the object literal at `open` with `rename`. */
+function keyEdits(source, code, open, rename) {
+	return (properties(source, code, open) ?? []).flatMap((prop) => {
+		if (prop.key === void 0 || prop.valueStart === prop.start) return [];
+		const to = rename(prop.key);
+		return to === prop.key ? [] : [keyEdit(source, prop.start, prop.key, to)];
+	});
+}
+/**
+* Edits renaming the block names among the string literals of the array at
+* `open`.
+*/
+function listEdits(source, code, open) {
+	const close = closingIndex(code, open);
+	if (close === -1) return [];
+	return [...source.slice(open, close).matchAll(STRING)].flatMap((match) => {
+		const to = renamedBlock(match[2]);
+		const start = open + match.index + 1;
+		return to === void 0 ? [] : [{
+			start,
+			end: start + match[2].length,
+			text: to
+		}];
+	});
+}
+/** The value at `index` when it opens an object or an array. */
+const opens = (code, index) => code[index] === "{" || code[index] === "[" ? code[index] : void 0;
+/** The value of `key` in the object literal at `open`, when it is a literal. */
+function valueOf(source, code, open, key) {
+	const prop = properties(source, code, open)?.find((entry) => entry.key === key);
+	return prop === void 0 || opens(code, prop.valueStart) === void 0 ? void 0 : prop.valueStart;
+}
+function objectEdits(source, code, open) {
+	const edits = [];
+	for (const prop of properties(source, code, open) ?? []) {
+		const kind = opens(code, prop.valueStart);
+		if (prop.key === void 0 || kind === void 0) continue;
+		if (prop.key === "blocks") edits.push(...kind === "[" ? listEdits(source, code, prop.valueStart) : keyEdits(source, code, prop.valueStart, (key) => renamedBlock(key) ?? key));
+		else if (prop.key === "preset" && kind === "{") {
+			const blocks = valueOf(source, code, prop.valueStart, "blocks");
+			if (blocks !== void 0 && code[blocks] === "[") edits.push(...listEdits(source, code, blocks));
+		} else if (prop.key === "auth" && kind === "{") {
+			const authorization = valueOf(source, code, prop.valueStart, "authorization");
+			const operations = authorization !== void 0 && code[authorization] === "{" ? valueOf(source, code, authorization, "operations") : void 0;
+			if (operations !== void 0 && code[operations] === "{") edits.push(...keyEdits(source, code, operations, currentOperationName));
+		} else if (prop.key === "$env" && kind === "{") {
+			for (const env of properties(source, code, prop.valueStart) ?? []) if (code[env.valueStart] === "{") edits.push(...objectEdits(source, code, env.valueStart));
+		} else if (ENVIRONMENT_KEY.test(prop.key) && kind === "{") edits.push(...objectEdits(source, code, prop.valueStart));
+	}
+	return edits;
+}
+/** `better-supabase.config.ts`, grouped, with the 0.15 block names. */
+function renameBlocksInSource(source) {
+	const code = mask(source);
+	const open = configObject(code);
+	if (open === void 0) return {
+		ok: false,
+		reason: "no defineConfig({...}) or default export object found"
+	};
+	return {
+		ok: true,
+		text: applyEdits$2(source, objectEdits(source, code, open))
+	};
+}
+function renameKeys(value, rename) {
+	return isObject(value) ? Object.fromEntries(Object.entries(value).map(([key, entry]) => [rename(key), entry])) : value;
+}
+const renameList = (value) => Array.isArray(value) ? value.map((entry) => typeof entry === "string" ? renamedBlock(entry) ?? entry : entry) : value;
+/** A parsed config object with the 0.15 block names. */
+function renameBlocksInConfig(config) {
+	const out = {};
+	for (const [key, value] of Object.entries(config)) if (key === "blocks") out[key] = Array.isArray(value) ? renameList(value) : renameKeys(value, (name) => renamedBlock(name) ?? name);
+	else if (key === "preset" && isObject(value)) out[key] = value["blocks"] === void 0 ? value : {
+		...value,
+		blocks: renameList(value["blocks"])
+	};
+	else if (key === "auth" && isObject(value)) {
+		const authorization = value["authorization"];
+		out[key] = isObject(authorization) ? {
+			...value,
+			authorization: authorization["operations"] === void 0 ? authorization : {
+				...authorization,
+				operations: renameKeys(authorization["operations"], currentOperationName)
+			}
+		} : value;
+	} else if (key === "$env" && isObject(value) || ENVIRONMENT_KEY.test(key) && isObject(value)) out[key] = key === "$env" ? Object.fromEntries(Object.entries(value).map(([name, entry]) => [name, isObject(entry) ? renameBlocksInConfig(entry) : entry])) : renameBlocksInConfig(value);
+	else out[key] = value;
+	return out;
+}
+/** `edit`, then the 0.15 block names on its text. */
+function withBlockNames(edit, json) {
+	if (!edit.ok) return edit;
+	if (!json) return renameBlocksInSource(edit.text);
+	const config = JSON.parse(edit.text);
+	if (!isObject(config)) return edit;
+	const renamed = renameBlocksInConfig(config);
+	return JSON.stringify(renamed) === JSON.stringify(config) ? edit : {
+		ok: true,
+		text: `${JSON.stringify(renamed, null, 2)}\n`
+	};
+}
+//#endregion
+//#region src/cli/sql/config-block-on.ts
+const OPTIONS = /\boptions\s*:\s*\{/g;
+const KEY_BEFORE = /(?:["']([\w-]+)["']|([A-Za-z_$][\w$-]*))\s*:\s*$/;
+function applyEdits$1(source, edits) {
+	let text = source;
+	for (const edit of edits.toSorted((a, b) => b.start - a.start)) text = text.slice(0, edit.start) + edit.text + text.slice(edit.end);
+	return text;
+}
+/** The `{` of the object literal that holds the code at `index`. */
+function enclosingObject(code, index) {
+	let depth = 0;
+	for (let at = index - 1; at >= 0; at -= 1) {
+		const char = code[at];
+		if (char === "}" || char === "]" || char === ")") depth += 1;
+		else if (char === "{" || char === "[" || char === "(") {
+			if (depth === 0) return char === "{" ? at : void 0;
+			depth -= 1;
+		}
+	}
+}
+/** The block an entry installs: its `block` string, or the key it sits under. */
+function blockOf(source, open, props) {
+	const block = props.find((prop) => prop.key === "block");
+	if (block !== void 0) return /^["']([\w-]+)["']$/.exec(source.slice(block.valueStart, block.valueEnd))?.[1];
+	const key = KEY_BEFORE.exec(source.slice(0, open));
+	return key?.[1] ?? key?.[2];
+}
+/** `{ deal: ["amount"] }` as `{ deal: { fields: ["amount"] } }`. */
+function wrapFields(source, code, open) {
+	return (properties(source, code, open) ?? []).flatMap((prop) => prop.key !== void 0 && code[prop.valueStart] === "[" ? [{
+		start: prop.valueStart,
+		end: prop.valueEnd,
+		text: `{ fields: ${source.slice(prop.valueStart, prop.valueEnd)} }`
+	}] : []);
+}
+/** `text` moved one object level out: two spaces fewer after each newline. */
+const outdented = (text) => text.replaceAll(/\n {2}/g, "\n");
+/** The edit that removes `props[index]` from its object literal. */
+function removal(props, index) {
+	const next = props[index + 1];
+	const previous = props[index - 1];
+	const prop = props[index];
+	if (next !== void 0) return {
+		start: prop.start,
+		end: next.start,
+		text: ""
+	};
+	return {
+		start: previous?.valueEnd ?? prop.start,
+		end: prop.valueEnd,
+		text: ""
+	};
+}
+const lineOf = (source, index) => source.slice(0, index).split("\n").length;
+/**
+* `source` with every `options.subjects` of a block entry moved to the entry's
+* `on`. An entry that already sets `on` is left and listed for review.
+*/
+function moveSubjectsToOnInSource(source) {
+	const code = mask(source);
+	const edits = [];
+	const review = [];
+	for (const match of code.matchAll(OPTIONS)) {
+		const valueOpen = match.index + match[0].length - 1;
+		const entryOpen = enclosingObject(code, match.index);
+		if (entryOpen === void 0) continue;
+		const entry = properties(source, code, entryOpen) ?? [];
+		const options = entry.find((prop) => prop.key === "options" && prop.valueStart === valueOpen);
+		const inner = properties(source, code, valueOpen) ?? [];
+		const index = inner.findIndex((prop) => prop.key === "subjects");
+		if (options === void 0 || index === -1) continue;
+		if (entry.some((prop) => prop.key === "on")) {
+			review.push({
+				line: lineOf(source, match.index),
+				message: "options.subjects moved to on, and this block already sets on: merge them into on"
+			});
+			continue;
+		}
+		const subjects = inner[index];
+		const shorthand = subjects.valueStart === subjects.start;
+		const wrap = !shorthand && code[subjects.valueStart] === "{" && blockOf(source, entryOpen, entry) === "field-history";
+		const slice = source.slice(subjects.valueStart, subjects.valueEnd);
+		const raw = shorthand ? "subjects" : wrap ? applyEdits$1(slice, wrapFields(source, code, subjects.valueStart).map((edit) => ({
+			...edit,
+			start: edit.start - subjects.valueStart,
+			end: edit.end - subjects.valueStart
+		}))) : slice;
+		const on = `on: ${outdented(raw)}`;
+		if (inner.length === 1) {
+			edits.push({
+				start: options.start,
+				end: options.valueEnd,
+				text: on
+			});
+			continue;
+		}
+		const multiline = code.slice(entryOpen, closingIndex(code, entryOpen)).includes("\n");
+		edits.push({
+			start: options.start,
+			end: options.start,
+			text: `${on},${multiline ? `\n${indentAt(source, options.start)}` : " "}`
+		}, removal(inner, index));
+	}
+	return {
+		text: applyEdits$1(source, edits),
+		review
+	};
+}
+function moveInObject(value) {
+	if (Array.isArray(value)) return value.map(moveInObject);
+	if (!isRecord$1(value)) return value;
+	const entries = Object.fromEntries(Object.entries(value).map(([key, entry]) => [key, moveInObject(entry)]));
+	const options = entries["options"];
+	if (!isRecord$1(options) || options["subjects"] === void 0 || entries["on"] !== void 0) return entries;
+	const { subjects, ...rest } = options;
+	const { options: _, ...withoutOptions } = entries;
+	return {
+		...withoutOptions,
+		on: subjects,
+		...Object.keys(rest).length > 0 && { options: rest }
+	};
+}
+/** Field history's `on`, with each column list as `{ fields }`. */
+function fieldHistoryOn(config) {
+	if (!isRecord$1(config) || !isRecord$1(config["blocks"])) return config;
+	const history = config["blocks"]["field-history"];
+	if (!isRecord$1(history) || !isRecord$1(history["on"])) return config;
+	const on = Object.fromEntries(Object.entries(history["on"]).map(([type, fields]) => [type, Array.isArray(fields) ? { fields } : fields]));
+	return {
+		...config,
+		blocks: {
+			...config["blocks"],
+			"field-history": {
+				...history,
+				on
+			}
+		}
+	};
+}
+/** `edit`, then every `options.subjects` moved to `on`. */
+function withSubjectsOn(edit, json) {
+	if (!edit.ok) return edit;
+	const before = "review" in edit ? edit.review : [];
+	if (!json) {
+		const moved = moveSubjectsToOnInSource(edit.text);
+		return {
+			ok: true,
+			text: moved.text,
+			review: [...before, ...moved.review]
+		};
+	}
+	const config = JSON.parse(edit.text);
+	const moved = fieldHistoryOn(moveInObject(config));
+	return {
+		ok: true,
+		text: JSON.stringify(moved) === JSON.stringify(config) ? edit.text : `${JSON.stringify(moved, null, 2)}\n`,
+		review: before
+	};
+}
+//#endregion
+//#region src/cli/sql/config-move.ts
+const lineStart = (source, index) => source.lastIndexOf("\n", index - 1) + 1;
+function propertySpan(source, code, open, props, index) {
+	const prop = props[index];
+	const previous = props[index - 1];
+	if (prop === void 0) throw new Error(`no property at ${index}`);
+	const close = closingIndex(code, open);
+	const multiline = code.slice(open, close).includes("\n");
+	const after = skipSpace(code, prop.valueEnd);
+	const hasComma = code[after] === ",";
+	const tailFrom = hasComma ? after + 1 : prop.valueEnd;
+	if (!multiline) {
+		const value = source.slice(prop.start, prop.valueEnd);
+		if (previous) return {
+			start: previous.valueEnd,
+			end: prop.valueEnd,
+			value,
+			keyAt: 0,
+			trailing: "",
+			hasComma,
+			multiline
+		};
+		return {
+			start: prop.start,
+			end: hasComma ? skipSpace(code, tailFrom) : prop.valueEnd,
+			value,
+			keyAt: 0,
+			trailing: "",
+			hasComma,
+			multiline
+		};
+	}
+	let before = open + 1;
+	if (previous) {
+		const comma = skipSpace(code, previous.valueEnd);
+		before = code[comma] === "," ? comma + 1 : previous.valueEnd;
+	}
+	const newline = source.slice(before, prop.start).indexOf("\n");
+	const start = newline === -1 ? prop.start : before + newline + 1;
+	const lineEnd = source.indexOf("\n", tailFrom);
+	const restIsBlank = lineEnd !== -1 && code.slice(tailFrom, lineEnd).trim() === "";
+	return {
+		start,
+		end: restIsBlank ? lineEnd + 1 : tailFrom,
+		value: source.slice(start, prop.valueEnd),
+		keyAt: prop.start - start,
+		trailing: restIsBlank ? source.slice(tailFrom, lineEnd).trimEnd() : "",
+		hasComma,
+		multiline
+	};
+}
+/** `modules: ...` as `blocks: ...`, keeping the key's quotes. */
+function renameKey(text, keyAt, prop) {
+	const head = text.slice(keyAt);
+	const quoted = /^(["'])modules\1/.exec(head);
+	if (quoted) {
+		const quote = quoted[1] ?? "\"";
+		return `${text.slice(0, keyAt)}${quote}blocks${quote}${head.slice(quoted[0].length)}`;
+	}
+	if (prop.valueStart === prop.start) return `${text.slice(0, keyAt)}blocks: modules${head.slice(7)}`;
+	return `${text.slice(0, keyAt)}blocks${head.slice(7)}`;
+}
+function reindent(text, from, to) {
+	return text.split("\n").map((line) => line.startsWith(from) ? to + line.slice(from.length) : line).join("\n");
+}
+const sortKey = (key) => (key ?? "").toLowerCase();
+function keysSorted(keys) {
+	return keys.every((key, index) => index === 0 || key !== void 0 && sortKey(keys[index - 1]) <= sortKey(key));
+}
+function rootKeys(source) {
+	const code = mask(source);
+	const root = configObject(code);
+	return (root === void 0 ? void 0 : properties(source, code, root))?.map((prop) => prop.key) ?? [];
+}
+function sortBlocksKey(source) {
+	const code = mask(source);
+	const root = configObject(code);
+	if (root === void 0) return source;
+	const props = properties(source, code, root);
+	const blocksIndex = props?.findIndex((prop) => prop.key === "blocks") ?? -1;
+	if (!props || blocksIndex === -1) return source;
+	const targetIndex = props.findIndex((prop, index) => index !== blocksIndex && sortKey(prop.key) > sortKey("blocks"));
+	if (targetIndex === -1 || targetIndex === blocksIndex + 1) return source;
+	const blocks = propertySpan(source, code, root, props, blocksIndex);
+	const target = props[targetIndex];
+	if (target.start > blocks.start) return source;
+	const at = blocks.multiline ? propertySpan(source, code, root, props, targetIndex).start : target.start;
+	const moved = blocks.multiline ? `${blocks.value},${blocks.trailing}\n` : `${blocks.value}, `;
+	return source.slice(0, at) + moved + source.slice(at, blocks.start) + source.slice(blocks.end);
+}
+/**
+* `source` with `sql.modules` moved to a top-level `blocks` key, placed right
+* after `sql`, or in sorted position when the config's top-level keys are
+* sorted. `sql` is dropped when nothing else is left in it. A config without
+* `sql.modules` comes back unchanged; one that also sets `blocks` is refused,
+* because the two need a merge by hand.
+*/
+function moveSqlModulesToBlocks(source) {
+	const edit = moveSqlModules(source);
+	return edit.ok && edit.text !== source && keysSorted(rootKeys(source)) ? {
+		ok: true,
+		text: sortBlocksKey(edit.text)
+	} : edit;
+}
+function moveSqlModules(source) {
+	const code = mask(source);
+	const root = configObject(code);
+	if (root === void 0) return /\bmodules\b/.test(code) ? {
+		ok: false,
+		reason: "it doesn't pass an object literal to defineConfig()"
+	} : {
+		ok: true,
+		text: source
+	};
+	const rootProps = properties(source, code, root);
+	if (!rootProps) return {
+		ok: false,
+		reason: "its config object can't be read"
+	};
+	const sqlIndex = rootProps.findIndex((prop) => prop.key === "sql");
+	const sql = rootProps[sqlIndex];
+	if (sql === void 0) return {
+		ok: true,
+		text: source
+	};
+	if (code[sql.valueStart] !== "{" || sql.valueStart === sql.start) return /\bmodules\b/.test(code) ? {
+		ok: false,
+		reason: "its `sql` value isn't an object literal; move `sql.modules` to `blocks` by hand"
+	} : {
+		ok: true,
+		text: source
+	};
+	const sqlProps = properties(source, code, sql.valueStart);
+	if (!sqlProps) return {
+		ok: false,
+		reason: "its `sql` object can't be read"
+	};
+	const modulesIndex = sqlProps.findIndex((prop) => prop.key === "modules");
+	const modules = sqlProps[modulesIndex];
+	if (modules === void 0) return {
+		ok: true,
+		text: source
+	};
+	if (rootProps.some((prop) => prop.key === "blocks")) return {
+		ok: false,
+		reason: "it sets both `sql.modules` and `blocks`; merge `sql.modules` into `blocks` by hand"
+	};
+	const cut = propertySpan(source, code, sql.valueStart, sqlProps, modulesIndex);
+	const outer = propertySpan(source, code, root, rootProps, sqlIndex);
+	const renamed = renameKey(cut.value, cut.keyAt, modules);
+	const sqlClose = closingIndex(code, sql.valueStart);
+	const leftover = source.slice(sql.valueStart + 1, cut.start) + source.slice(cut.end, sqlClose);
+	const dropSql = sqlProps.length === 1 && leftover.trim() === "";
+	if (!cut.multiline || !outer.multiline) {
+		const property = renamed.trim();
+		if (dropSql) return {
+			ok: true,
+			text: source.slice(0, sql.start) + property + source.slice(sql.valueEnd)
+		};
+		return {
+			ok: true,
+			text: `${source.slice(0, cut.start)}${source.slice(cut.end, sql.valueEnd)}, ${property}${source.slice(sql.valueEnd)}`
+		};
+	}
+	const sqlIndent = indentAt(source, sql.start);
+	const body = reindent(renamed, indentAt(source, modules.start), sqlIndent);
+	const moved = `${cut.start === modules.start ? sqlIndent + body : body},${cut.trailing}\n`;
+	if (dropSql) return {
+		ok: true,
+		text: source.slice(0, lineStart(source, sql.start)) + moved + source.slice(outer.end)
+	};
+	const atLineStart = source[outer.end - 1] === "\n";
+	return {
+		ok: true,
+		text: source.slice(0, cut.start) + source.slice(cut.end, sql.valueEnd) + (outer.hasComma ? "" : ",") + source.slice(sql.valueEnd, outer.end) + (atLineStart ? "" : "\n") + moved + source.slice(outer.end)
+	};
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function withBlocksSorted(config) {
+	const entries = Object.entries(config).filter(([key]) => key !== "blocks");
+	const after = entries.findIndex(([key]) => sortKey(key) > "blocks");
+	entries.splice(after === -1 ? entries.length : after, 0, ["blocks", config["blocks"]]);
+	return Object.fromEntries(entries);
+}
+/** `moveSqlModulesToBlocks` for `better-supabase.config.json`. */
+function moveSqlModulesToBlocksJson(source) {
+	let config;
+	try {
+		config = JSON.parse(source);
+	} catch {
+		return {
+			ok: false,
+			reason: "it isn't valid JSON"
+		};
+	}
+	if (!isRecord(config)) return {
+		ok: false,
+		reason: "it isn't a JSON object"
+	};
+	const sql = config["sql"];
+	if (!isRecord(sql) || !("modules" in sql)) return {
+		ok: true,
+		text: source
+	};
+	if ("blocks" in config) return {
+		ok: false,
+		reason: "it sets both `sql.modules` and `blocks`; merge `sql.modules` into `blocks` by hand"
+	};
+	const { modules, ...restSql } = sql;
+	const next = {};
+	for (const [key, value] of Object.entries(config)) {
+		if (key !== "sql") {
+			next[key] = value;
+			continue;
+		}
+		if (Object.keys(restSql).length > 0) next["sql"] = restSql;
+		next["blocks"] = modules;
+	}
+	const sorted = keysSorted(Object.keys(config)) ? withBlocksSorted(next) : next;
+	const indent = /^[ \t]+/m.exec(source)?.[0] ?? "  ";
+	return {
+		ok: true,
+		text: `${JSON.stringify(sorted, null, indent)}\n`
+	};
+}
+/** Review lines for `sql.modules` left in environment blocks after the move. */
+function environmentModules(text) {
+	return mask(text).split("\n").flatMap((line, index) => /\bmodules\s*:/.test(line) ? [{
+		line: index + 1,
+		message: "`sql.modules` in an environment block moves to `blocks` too"
+	}] : []);
+}
+//#endregion
+//#region src/cli/sql/config-plugins.ts
+/** The block each plugin flag became, and its column keys as block options. */
+const PLUGIN_BLOCKS = {
+	timestamps: {
+		block: "updated-at",
+		options: {
+			createdAt: "createdAt",
+			updatedAt: "updatedAt"
+		}
+	},
+	actor: {
+		block: "created-by",
+		options: {
+			createdBy: "createdBy",
+			updatedBy: "updatedBy",
+			impersonatedBy: "impersonatedBy"
+		}
+	},
+	softDelete: {
+		block: "trash",
+		options: { column: "deletedAt" }
+	}
+};
+const DEFAULT_ORGANIZATION_COLUMN = "organization_id";
+function movesOf(flags) {
+	const blocks = [];
+	let tenant = false;
+	for (const [name, flag] of Object.entries(flags)) {
+		if (name === "tenant") {
+			tenant = flag !== false;
+			continue;
+		}
+		const move = PLUGIN_BLOCKS[name];
+		if (move === void 0) return { reason: `plugins.${name} is not a plugin flag 0.14 had` };
+		if (flag === false) continue;
+		const options = {};
+		for (const [key, value] of Object.entries(flag)) {
+			const option = move.options[key];
+			if (option === void 0) return { reason: `plugins.${name}.${key} is not a column it took` };
+			options[option] = value;
+		}
+		blocks.push([move.block, options]);
+	}
+	return {
+		blocks,
+		tenant
+	};
+}
+/** A string literal's value, or undefined for any other expression. */
+function stringValue(text) {
+	return /^(["'])((?:(?!\1)[^\\])*)\1$/.exec(text.trim())?.[2];
+}
+function flagsInSource(source, code, open) {
+	const flags = {};
+	for (const prop of properties(source, code, open) ?? []) {
+		const value = source.slice(prop.valueStart, prop.valueEnd).trim();
+		if (prop.key === void 0) return { reason: "plugins has a spread or a computed key" };
+		if (value === "true" || value === "false") {
+			flags[prop.key] = value === "true" ? {} : false;
+			continue;
+		}
+		if (code[prop.valueStart] !== "{") return { reason: `plugins.${prop.key} isn't true, false or an object` };
+		const columns = {};
+		for (const inner of properties(source, code, prop.valueStart) ?? []) {
+			const column = stringValue(source.slice(inner.valueStart, inner.valueEnd));
+			if (inner.key === void 0 || column === void 0) return { reason: `plugins.${prop.key} has a key that isn't a string` };
+			columns[inner.key] = column;
+		}
+		flags[prop.key] = columns;
+	}
+	return flags;
+}
+/** Whether the `blocks` value names `memberships`, as a key or a list item. */
+const MEMBERSHIPS = /["']memberships["']|\bmemberships\s*:/;
+/** `better-supabase.config.ts` with `plugins` moved into blocks. */
+function movePluginsInSource(source) {
+	const code = mask(source);
+	const root = configObject(code);
+	if (root === void 0) return {
+		ok: true,
+		text: source
+	};
+	const props = properties(source, code, root) ?? [];
+	const index = props.findIndex((prop) => prop.key === "plugins");
+	const plugins = props[index];
+	if (plugins === void 0) return {
+		ok: true,
+		text: source
+	};
+	if (code[plugins.valueStart] !== "{") return {
+		ok: false,
+		reason: "its plugins key isn't a literal object"
+	};
+	const flags = flagsInSource(source, code, plugins.valueStart);
+	if ("reason" in flags) return {
+		ok: false,
+		reason: String(flags.reason)
+	};
+	const moves = movesOf(flags);
+	if ("reason" in moves) return {
+		ok: false,
+		reason: moves.reason
+	};
+	const multiline = code.slice(root, closingIndex(code, root)).includes("\n");
+	const cut = cutRange(source, code, root, props, index, multiline);
+	let edit = {
+		ok: true,
+		text: source.slice(0, cut.start) + source.slice(cut.end)
+	};
+	const blocks = props.find((prop) => prop.key === "blocks");
+	const memberships = blocks !== void 0 && MEMBERSHIPS.test(source.slice(blocks.valueStart, blocks.valueEnd));
+	const organization = organizationText(source, code, props);
+	const organizationColumn = /\bcolumn\s*:/.test(organization);
+	const onMissing = /\bonMissing\s*:/.test(organization);
+	const steps = [
+		...moves.blocks.flatMap(([block, options]) => [(text) => addBlocksToConfig(text, [block]), ...Object.entries(options).map(([key, value]) => (text) => setPathInConfig(text, [
+			"blocks",
+			block,
+			"options",
+			key
+		], value))]),
+		...moves.tenant && !memberships && !organizationColumn ? [(text) => setPathInConfig(text, [
+			"auth",
+			"organization",
+			"column"
+		], DEFAULT_ORGANIZATION_COLUMN)] : [],
+		...moves.tenant && !onMissing ? [(text) => setPathInConfig(text, [
+			"auth",
+			"organization",
+			"onMissing"
+		], "error")] : []
+	];
+	for (const step of steps) {
+		if (!edit.ok) return edit;
+		edit = step(edit.text);
+	}
+	return edit;
+}
+/** The source of `auth.organization`, or `""` without one. */
+function organizationText(source, code, props) {
+	const auth = props.find((prop) => prop.key === "auth");
+	if (auth === void 0 || code[auth.valueStart] !== "{") return "";
+	const organization = (properties(source, code, auth.valueStart) ?? []).find((prop) => prop.key === "organization");
+	return organization === void 0 ? "" : source.slice(organization.valueStart, organization.valueEnd);
+}
+const isColumns = (value) => isRecord$1(value) && Object.values(value).every((column) => typeof column === "string");
+function flagsInJson(plugins) {
+	if (!isRecord$1(plugins)) return { reason: "its plugins key isn't an object" };
+	const flags = {};
+	for (const [name, value] of Object.entries(plugins)) if (typeof value === "boolean") flags[name] = value ? {} : false;
+	else if (isColumns(value)) flags[name] = value;
+	else return { reason: `plugins.${name} isn't true, false or columns` };
+	return flags;
+}
+const objectAt$1 = (value) => isRecord$1(value) ? value : {};
+/** `movePluginsInSource` for `better-supabase.config.json`. */
+function movePluginsInJson(source) {
+	let config;
+	try {
+		config = JSON.parse(source);
+	} catch {
+		return {
+			ok: true,
+			text: source
+		};
+	}
+	if (!isRecord$1(config) || !("plugins" in config)) return {
+		ok: true,
+		text: source
+	};
+	const { plugins, ...rest } = config;
+	const flags = flagsInJson(plugins);
+	if ("reason" in flags) return {
+		ok: false,
+		reason: String(flags.reason)
+	};
+	const moves = movesOf(flags);
+	if ("reason" in moves) return {
+		ok: false,
+		reason: moves.reason
+	};
+	const listed = rest["blocks"] ?? {};
+	const blocks = Array.isArray(listed) ? Object.fromEntries(listed.map((name) => [String(name), {}])) : { ...objectAt$1(listed) };
+	const memberships = "memberships" in blocks;
+	for (const [block, options] of moves.blocks) {
+		const entry = objectAt$1(blocks[block]);
+		blocks[block] = {
+			...entry,
+			...Object.keys(options).length === 0 ? {} : { options: {
+				...objectAt$1(entry["options"]),
+				...options
+			} }
+		};
+	}
+	const next = {
+		...rest,
+		...moves.blocks.length === 0 && rest["blocks"] === void 0 ? {} : { blocks: moves.blocks.length === 0 ? rest["blocks"] : blocks }
+	};
+	if (moves.tenant) {
+		const auth = objectAt$1(next["auth"]);
+		const organization = objectAt$1(auth["organization"]);
+		next["auth"] = {
+			...auth,
+			organization: {
+				...memberships ? {} : { column: DEFAULT_ORGANIZATION_COLUMN },
+				onMissing: "error",
+				...organization
+			}
+		};
+	}
+	const indent = /^[ \t]+/m.exec(source)?.[0] ?? "  ";
+	return {
+		ok: true,
+		text: `${JSON.stringify(next, null, indent)}\n`
+	};
+}
+/** `edit` with `plugins` moved into blocks, after the regrouping. */
+function withoutPlugins(edit, json) {
+	if (!edit.ok) return edit;
+	return json ? movePluginsInJson(edit.text) : movePluginsInSource(edit.text);
+}
+//#endregion
+//#region src/cli/sql/config-webhook-format.ts
+const PATH = [
+	"blocks",
+	"webhooks-out",
+	"options",
+	"defaultFormat"
+];
+function needsPin(block) {
+	if (!isRecord$1(block) || block["mode"] !== "adopt") return false;
+	const options = block["options"];
+	const columns = block["columns"];
+	const endpoints = isRecord$1(columns) ? columns["endpoints"] : void 0;
+	return !(isRecord$1(options) && options["defaultFormat"] !== void 0) && !(isRecord$1(endpoints) && endpoints["format"] !== void 0);
+}
+function pinJson(source, format) {
+	let config;
+	try {
+		config = JSON.parse(source);
+	} catch {
+		return {
+			ok: false,
+			reason: "it isn't valid JSON"
+		};
+	}
+	const blocks = isRecord$1(config) ? config["blocks"] : void 0;
+	return isRecord$1(blocks) && needsPin(blocks["webhooks-out"]) ? setPathInJson(source, PATH, format) : void 0;
+}
+/** The object literal at `prop`'s value, or `undefined` when it isn't one. */
+function objectAt(source, code, prop) {
+	return prop && code[prop.valueStart] === "{" ? properties(source, code, prop.valueStart) : void 0;
+}
+function pinTs(source, format) {
+	const code = mask(source);
+	const root = configObject(code);
+	if (root === void 0) return;
+	const find = (props, key) => props?.find((prop) => prop.key === key);
+	const blockProp = find(objectAt(source, code, find(properties(source, code, root), "blocks")), "webhooks-out");
+	if (!blockProp) return;
+	const block = objectAt(source, code, blockProp);
+	if (!block) return {
+		ok: false,
+		reason: "its blocks[\"webhooks-out\"] isn't a literal object"
+	};
+	const mode = find(block, "mode");
+	const modeText = mode ? source.slice(mode.valueStart, mode.valueEnd).trim() : void 0;
+	if (modeText !== "\"adopt\"" && modeText !== "'adopt'") return;
+	const options = find(block, "options");
+	const columns = find(block, "columns");
+	if (options && !objectAt(source, code, options) || columns && !objectAt(source, code, columns)) return {
+		ok: false,
+		reason: "its blocks[\"webhooks-out\"] options or columns aren't literal objects"
+	};
+	const endpoints = find(objectAt(source, code, columns), "endpoints");
+	if (endpoints && !objectAt(source, code, endpoints)) return {
+		ok: false,
+		reason: "its blocks[\"webhooks-out\"].columns.endpoints isn't a literal object"
+	};
+	if (find(objectAt(source, code, options), "defaultFormat") || find(objectAt(source, code, endpoints), "format")) return;
+	return setPathInConfig(source, PATH, format);
+}
+/**
+* Pins `defaultFormat` to `format` where an adopted block leaves it to the
+* default.
+*/
+function pinWebhookFormat(source, json, format) {
+	return json ? pinJson(source, format) : pinTs(source, format);
+}
+/**
+* `edit` with `defaultFormat` pinned to `format` where an adopted webhooks-out
+* block needs it.
+*/
+function withWebhookFormat(edit, json, format) {
+	if (!edit.ok) return edit;
+	const earlier = "review" in edit ? edit.review : [];
+	const pin = pinWebhookFormat(edit.text, json, format);
+	if (pin === void 0) return {
+		ok: true,
+		text: edit.text,
+		review: earlier
+	};
+	if (!pin.ok) return {
+		ok: true,
+		text: edit.text,
+		review: [...earlier, {
+			line: 1,
+			message: `blocks["webhooks-out"] is adopted and maps no columns.endpoints.format, but defaultFormat wasn't pinned: ${pin.reason}. Set options.defaultFormat to "${format}" to keep the body endpoints get now`
+		}]
+	};
+	const line = pin.text.split("\n").findIndex((text) => text.includes("defaultFormat")) + 1;
+	return {
+		ok: true,
+		text: pin.text,
+		review: [...earlier, {
+			line: Math.max(line, 1),
+			message: `blocks["webhooks-out"] is adopted and maps no columns.endpoints.format, so the codemod set options.defaultFormat to "${format}", the body its endpoints get now. Change it if your receivers expect the other format`
+		}]
+	};
+}
+//#endregion
+//#region src/cli/codemod.ts
+/**
+* `better-supabase.config.*`, the files a codemod's `configFile` edit applies
+* to.
+*/
+const CONFIG_FILE = /(?:^|[\\/])better-supabase\.config\.(?:ts|mts|cts|js|mjs|cjs|json)$/;
+const OFFSET_PIN = {
+	key: "pagination",
+	value: "\"offset\"",
+	when: /\.page\b(?!\s*\()|\bpageCount\b|\btotalPages\b|\bpage\s*:|[?&]page=|["']page["']/,
+	message: "Lists and resources page by cursor (`after`, `nextCursor`, no total) unless `pagination: \"offset\"` is set. This file shows no page numbers, so the codemod left it: add `pagination: \"offset\"` if a UI elsewhere reads `page` or the total, or the list sorts by a relation"
+};
+const SQL_ADD_HINT = {
+	pattern: /(?<![\w.@-])(?:better-supabase|bsb)(?:@[\w.^~-]+)?\s+sql\s+add\b/,
+	message: "`sql add` still only writes the block's SQL; `add` also wires its clients and config. Use `add` unless the script needs the SQL alone"
+};
+const BLOCK_SQL_TYPES = "Context ContractFunction Names Layout File IdType AccessProvider EntitlementsProvider TableSpec Upgrade PermissionKey Audit Deprecation Extension Emit UpgradePlan Topic TestFile Action";
+const ENTITY_FORM_TYPES = " CustomField Field Input Options Result State Values";
+/** `from` and `to` prefixed to each space-separated suffix in `suffixes`. */
+function prefixed(from, to, suffixes) {
+	return Object.fromEntries(suffixes.split(" ").map((suffix) => [from + suffix, to + suffix]));
+}
+const CODEMODS = {
+	"0.4": {
+		name: "0.4",
+		description: "Renames from 0.3 to 0.4 (the naming page lists them)",
+		imports: {
+			createBrowser: "createClient",
+			BetterBrowser: "BetterClient",
+			BrowserOptions: "ClientOptions",
+			BrowserAuth: "ClientAuth",
+			BetterEnv: "HonoEnv",
+			HandlerOptions: "MiddlewareOptions",
+			Queries: "BetterQueries",
+			CreateQueriesOptions: "QueriesOptions",
+			Postgres: "BetterPostgres",
+			DefineSupabaseOptions: "SupabaseOptions"
+		},
+		members: [
+			{
+				from: "serverFor",
+				to: "contextForSession"
+			},
+			{
+				from: "toORPCError",
+				to: "toOrpcError"
+			},
+			{
+				from: "$table",
+				to: "$tableName",
+				notCalled: true
+			}
+		],
+		props: [{
+			component: "BetterSupabaseProvider",
+			from: "browser",
+			to: "client"
+		}],
+		review: [
+			{
+				pattern: /\.server\(\)/,
+				message: "`next.server()` is `bsb.context()` on the createNext() instance"
+			},
+			{
+				pattern: /\.handle\(\)/,
+				message: "Hono's `bsb.handle()` is `bsb.handler()`"
+			},
+			{
+				pattern: /\bmcp\.handler\b/,
+				message: "`mcp.handler` is `bsb.endpoint`"
+			},
+			{
+				pattern: /\.sb\b/,
+				message: "`client.sb` is `client.betterSupabase`"
+			},
+			{
+				pattern: /\btestExecutor\(\s*\{[^}]*\bsb\b/,
+				message: "`{ sb }` in testExecutor is `{ betterSupabase }`"
+			}
+		]
+	},
+	"0.5": {
+		name: "0.5",
+		description: "Renames from 0.4 to 0.5: createMcp's scopes is advertisedScopes",
+		options: [{
+			call: "createMcp",
+			from: "scopes",
+			to: "advertisedScopes"
+		}]
+	},
+	"0.6": {
+		name: "0.6",
+		description: "Changes from 0.5 to 0.6: kits become blocks and modules, org becomes organization (in event types too), $rpc returns table rows and records in the configured casing, and bucket publicUrl() and path() return a Result",
+		strings: {
+			...BLOCK_EVENT_RENAMES,
+			"org.*": "organization.*"
+		},
+		imports: {
+			KitEvent: "BlockEvent",
+			KitEventMap: "BlockEventMap",
+			KitEventType: "BlockEventType",
+			KitEventMeta: "BlockEventMeta",
+			KitEventPattern: "BlockEventPattern",
+			KitEventsMatching: "BlockEventsMatching",
+			onKitEvent: "onBlockEvent",
+			forwardKitEvents: "forwardBlockEvents",
+			ForwardKitOptions: "ForwardBlockOptions",
+			KIT_ATTRIBUTES: "BLOCK_ATTRIBUTES",
+			kitCloudEvent: "blockCloudEvent",
+			kitEventAttributes: "blockEventAttributes",
+			traceKitEvents: "traceBlockEvents",
+			KitTransport: "BlockTransport",
+			OrgEventData: "OrganizationEventData",
+			createOrgs: "createOrganizations",
+			Orgs: "Organizations",
+			OrgsOptions: "OrganizationsOptions",
+			CreateOrgOptions: "CreateOrganizationOptions",
+			OrgAttributes: "OrganizationAttributes",
+			orgLogoBucket: "organizationLogoBucket",
+			OrgLogoBucketOptions: "OrganizationLogoBucketOptions",
+			KitsConfig: "BlocksConfig",
+			KitModuleConfig: "BlockConfig",
+			KitMode: "BlockMode",
+			AccessKitConfig: "AccessBlockConfig",
+			renderKit: "renderModules",
+			kitLayout: "moduleLayout",
+			kitPermissionKeys: "modulePermissionKeys",
+			kitDeprecations: "moduleDeprecations",
+			kitFilePaths: "moduleFilePaths",
+			kitFileVersion: "moduleFileVersion",
+			sameKitFile: "sameModuleFile",
+			kitIdType: "moduleIdType",
+			isKitIdType: "isModuleIdType",
+			KIT_ID_TYPES: "MODULE_ID_TYPES",
+			KitIdType: "ModuleIdType",
+			KitContext: "ModuleContext",
+			KitLayout: "ModuleLayout",
+			KitFile: "ModuleFile",
+			KitNames: "ModuleNames",
+			KitTableSpec: "ModuleTableSpec",
+			KitContractFunction: "ModuleContractFunction",
+			KitDeprecation: "ModuleDeprecation",
+			KitPermissionKey: "ModulePermissionKey",
+			KitUpgrade: "ModuleUpgrade",
+			KitUpgradePlan: "ModuleUpgradePlan",
+			InstalledKitModule: "InstalledModule"
+		},
+		options: [{
+			call: "defineSupabase",
+			from: "maxUrlLength",
+			to: "urlLengthLimit"
+		}],
+		review: [
+			{
+				pattern: /from\s*["']better-supabase\/(orgs|jobs|notifications|webhooks)["']/,
+				message: "This subpath moved under `better-supabase/blocks/` (`orgs` is `blocks/organizations`; the outbox, entitlements and audit retention left `jobs` for their own blocks); the 0.5 to 0.6 guide maps each export"
+			},
+			{
+				pattern: /\bcreateInbox\b[^\n]*from\s*["']better-supabase\/(blocks\/)?jobs["']/,
+				message: "The webhook inbox is `createWebhookInbox` from `better-supabase/blocks/jobs`; `createInbox` is now the conversation inbox in `blocks/inbox`"
+			},
+			{
+				pattern: /\$rpc\s*(<|\()/,
+				message: "`$rpc` now returns table rows and `returns table (...)` records in the configured casing, with codecs applied: drop a snake-to-camel mapping of the result, or pass `{ raw: true }` to keep database names. Scalar results and `returns table` columns are now `| null` unless `functions.<name>.notNull` says otherwise"
+			},
+			{
+				pattern: /\.publicUrl\s*\(/,
+				message: "A connected bucket's `publicUrl()` returns a `Result` instead of throwing: read `.data` (`null` on an error) or check `.ok`"
+			},
+			{
+				pattern: /\.path\s*\(\s*\{/,
+				message: "A bucket definition's `path(values)` returns a `Result` instead of throwing, like the connected client's `path()`: read `.data` (`null` on an error) or check `.ok`"
+			}
+		]
+	},
+	"0.9": {
+		name: "0.9",
+		description: "Moves sql.modules to the top-level blocks key in better-supabase.config.*, rewrites CLI calls in package.json scripts and GitHub workflows to the new subcommands and flags (other shell files are listed), renames the config types (ModulesConfig to BlocksConfig, ModuleConfig to BlockConfig, AccessModuleConfig to AccessBlockConfig, ModuleMode to BlockMode), pins pagination: 'offset' on lists and resources in files that read page numbers, and lists behaviour changes for review: support sessions (denied without authorize, approved by a second admin), canApprove (now isApprover), outgoing webhook transforms and receivers (CloudEvents), gatewayOptions callers, generic problem types (about:blank), the delegation cap, role helpers, event and schedule starts (runAs), workflow builders, delivery and realtime fan-out, agent actors, share links, before_promotion_activate and comment subjects",
+		imports: {
+			ModulesConfig: "BlocksConfig",
+			ModuleConfig: "BlockConfig",
+			AccessModuleConfig: "AccessBlockConfig",
+			ModuleMode: "BlockMode"
+		},
+		configFile: (source, json) => {
+			const moved = json ? moveSqlModulesToBlocksJson(source) : moveSqlModulesToBlocks(source);
+			return withWebhookFormat(moved.ok && !json ? {
+				...moved,
+				review: environmentModules(moved.text)
+			} : moved, json, "standard");
+		},
+		cliCalls: migrateCliCall,
+		cliReview: [SQL_ADD_HINT],
+		pins: [{
+			call: "defineListQuery",
+			argument: 2,
+			...OFFSET_PIN
+		}, {
+			call: "defineResource",
+			argument: 2,
+			unless: ["list"],
+			...OFFSET_PIN
+		}],
+		review: [
+			{
+				pattern: /\bresources\s*:\s*\{/,
+				message: "The default list of each `defineApi` resource pages by cursor (`after`, `nextCursor`) unless the table has no primary key; set `pagination: \"offset\"` on a resource whose clients send `page` or read the total"
+			},
+			{
+				pattern: /\bsupportSessions\s*\(/,
+				message: "Support sessions refuse every start without `authorize` (or the server's `authorization.support.authorize`), and a start needs a request approved by a different admin unless `policy.approval` is `\"none\"`. `authorize: \"store\"` keeps the store-only check"
+			},
+			{
+				pattern: /\bcanApprove\b/,
+				message: "`authorization.functions.canApprove` is deprecated: set `isApprover` with `{kind}` (`'ai-tool'`), `{subject}` (the tool name, was `{tool}`) and `{tenant}`"
+			},
+			{
+				pattern: /\bcreateWebhooks\s*\(/,
+				message: "Outgoing webhooks send CloudEvents 1.0 (`application/cloudevents+json`) instead of `{ type, timestamp, data }`; a `transform` now returns only the event's `data`, and receivers read `data` from the CloudEvent. `sql upgrade` keeps existing endpoints on `format = 'standard'` (the 0.8 body) until you set each one to `cloudevents`"
+			},
+			{
+				pattern: /\bgatewayOptions\s*\(/,
+				message: "`gatewayOptions` ignores a `user` in its second argument; pass the caller's id as `context.userId`"
+			},
+			{
+				pattern: /bettersupabase\.com\/problems\/(invalid-request|unauthorized|forbidden|not-found|conflict|rate-limited|unexpected)\b|["'](Invalid request|Not found|Too many requests|Unexpected error)["']/,
+				message: "Generic problems use `type: \"about:blank\"` and the HTTP status phrase as `title` (`Bad Request`, `Not Found`, `Too Many Requests`, `Internal Server Error`); match on `kind` or `code` instead"
+			},
+			{
+				pattern: /\bpublish_webhook_event\s*\(/,
+				message: "`publish_webhook_event` takes `subject` and `read_permission` and delivers only to endpoints whose owner may read the event"
+			},
+			{
+				pattern: /\btoken_scope_allows\s*\(|["']oauth-client["']/,
+				message: "Delegated tokens are narrowed inside `member_can`, `platform_can` and `tenant_ids_with`: a permission passes only when one of the token's scopes maps to it. Map scopes in `blocks.access.scopes` or `authorization.delegation.scopes`; a `token_scope_allows` check in a write policy is now covered by the cap"
+			},
+			{
+				pattern: /\b(has_organization_role|member_organization_ids|organization_member_role)\s*\(/,
+				message: "Under the provider model the role helpers take membership from the provider's `memberIds`, and a role name check skips the delegation cap (doctor BS334): check a permission with `tenant_ids_with('<permission>')` or `member_can()`"
+			},
+			{
+				pattern: /\b(workflowStarter|startOnEvent)\s*\(/,
+				message: "Event and schedule starts need `runAs: { publisher, permissions }` (or a function returning it): a schedule start without it throws, and the run's context is the publisher's, capped to `permissions`"
+			},
+			{
+				pattern: /\bcreateBuilder\s*\(/,
+				message: "Published versions run as their publisher (`versions.runAs`), and versions published before 0.9 fail with `WORKFLOW_PUBLISHER_REVOKED` until republished. A version the organization owns runs as its default service principal: create one with `default: true` or set `automation.runAs`"
+			},
+			{
+				pattern: /\b(createNotifications|createReminders)\s*\(|\.fanOut\s*\(/,
+				message: "Under an authorization provider without `delivery.subscribers` or `delivery.audience`, an event about a registered subject reaches only users who may read it (`subjectReaders`), and realtime `fanOut` refuses it (`REALTIME_SUBSCRIBER_POLICY_REQUIRED`) until you pass a `policy`"
+			},
+			{
+				pattern: /\bkind\s*:\s*["']agent["']/,
+				message: "An `act` level `{ kind: \"agent\", sub, tools }` is now valid (build it with `agentClaims`) and writes with the user's rights unless it sets `read_only: true`; `tools` must be a list of names"
+			},
+			{
+				pattern: /\bcreate_share_link\b/,
+				message: "`create_share_link` takes `version_id` and `expires_at` after `role`; grants and revokes on the four-argument signature must name `(uuid, text, text, text, uuid, timestamptz)`"
+			},
+			{
+				pattern: /\bbefore_promotion_activate\b/,
+				message: "`promotions` now calls `before_promotion_activate(promotion uuid)` after every write that leaves a promotion active; a function of that name runs on each such save"
+			},
+			{
+				pattern: /\bcomments\s*:\s*\{/,
+				message: "With `config.records` set and no `subjects` option, comments accept only the registered subject types and require read on the subject row"
+			}
+		]
+	},
+	"0.11": {
+		name: "0.11",
+		description: "Pins blocks[\"webhooks-out\"].options.defaultFormat to \"cloudevents\" in better-supabase.config.* when the block is adopted and maps no columns.endpoints.format, since adopt mode requires it from 0.11; the 0.9 codemod pins \"standard\" instead for configs coming from 0.8",
+		configFile: (source, json) => withWebhookFormat({
+			ok: true,
+			text: source
+		}, json, "cloudevents")
+	},
+	"0.15": {
+		name: "0.15",
+		description: "Regroups better-supabase.config.* into database, auth, gen, api and tooling (subjects to records, appTables to tables, integrations to adapters, a block's mode, scope, entities and hooks to ownership, owner, names and callbacks, and removes ownership: \"adopt\", since a block now leaves alone the tables the schema already has; claims.tenant and the tenant plugin's column to auth.organization); renames the requireTenant option and helper to requireOrganization; renames the runtime instance bs to bsb (the CLI's short name) where a file creates, imports or destructures it, and the bs key on request contexts (ctx.bs, c.var.bs, locals.bs, context.bs) to bsb; renames imports: SqlModule to BlockSql, ModuleDefinition to BlockSqlDefinition and the other Module* SQL types to BlockSql*, SubjectRef to RecordRef, entityForm to recordForm, ShipmentCarrier to ShippingProvider, QueueBackend to QueueProvider; rewrites CLI calls in package.json scripts and GitHub workflows to the 0.15 commands (apply and adopt to add, sql sync and sql upgrade to upgrade, introspect to gen --save-snapshot, seed to db seed, env, run, keys and stack to dev); renames the blocks 0.15 renamed (work-items to tasks, parties to contacts, engagements to activities, access to permissions, rules to automations, jobs to queue, activity to timeline and the rest of the 0.14 to 0.15 guide's table) in the config's blocks and preset.blocks, in operation names under auth.authorization.operations, in better-supabase/blocks/<name> imports and in the exports named after them; turns a 0.14 preset code in the config's preset into the preset name or object it holds, and a 0.14 design file into a design with its preset inside; moves the plugins key into blocks (timestamps to updated-at, actor to created-by, softDelete to trash, with their columns as the block's options; tenant to auth.organization.column when memberships is not installed) and the better-supabase/plugins/* imports to the block extensions, better-supabase/lint guards and validation from better-supabase; moves repository calls to the data contract (findMany to list, paginate to page, findById, findUnique and findOnly to get, findFirst to list with limit: 1, exists to count, createMany and upsertMany to create and upsert with an array, updateMany and deleteMany to update and delete with a { where } filter); renames generateFeatures to gen.recordTypes, the record section exports to record bindings (defineSection to defineRecordBinding, commentsSection to commentsBinding, loadSections to loadBindings and the rest) and lists record feature imports, recordServer and sectionAction calls for the move to bsb.record; cache tags, query keys and the debug header and route that start with bs are listed for review, and so are the lines of the app's SQL tests, schema files and newest migration that name a bs_ object the upgrade renames to bsb_",
+		sqlNames: true,
+		bindings: {
+			bs: "bsb",
+			SqlModule: "BlockSql",
+			ModuleDefinition: "BlockSqlDefinition",
+			...prefixed("Module", "BlockSql", BLOCK_SQL_TYPES),
+			...prefixed("EntityForm", "RecordForm", ENTITY_FORM_TYPES),
+			renderModules: "renderBlocks",
+			resolveModules: "resolveBlocks",
+			resolveModule: "resolveBlock",
+			isModuleIdType: "isBlockSqlIdType",
+			sameModuleFile: "sameBlockFile",
+			InstalledModule: "InstalledBlock",
+			SkippedModule: "SkippedBlock",
+			SubjectRef: "RecordRef",
+			entityForm: "recordForm",
+			useEntityForm: "useRecordForm",
+			UseEntityFormOptions: "UseRecordFormOptions",
+			ShipmentCarrier: "ShippingProvider",
+			testShipmentCarrier: "testShippingProvider",
+			TestShipmentCarrierOptions: "TestShippingProviderOptions",
+			QueueBackend: "QueueProvider",
+			sqlQueueBackend: "sqlQueueProvider",
+			testQueueBackend: "testQueueProvider",
+			transportQueueBackend: "transportQueueProvider",
+			vercelQueueBackend: "vercelQueueProvider",
+			TestQueueBackendOptions: "TestQueueProviderOptions",
+			TransportQueueBackendOptions: "TransportQueueProviderOptions",
+			VercelQueueBackendOptions: "VercelQueueProviderOptions",
+			...RECORD_BINDING_RENAMES
+		},
+		imports: BLOCK_EXPORT_RENAMES,
+		subpathImports: PLUGIN_IMPORT_RENAMES,
+		subpaths: SUBPATH_RENAMES_0_15,
+		members: [{
+			from: "bs",
+			to: "bsb"
+		}],
+		options: DATA_CONTRACT_OPTIONS,
+		strings: {
+			...DATA_CONTRACT_STRINGS,
+			"bs-block": "bsb"
+		},
+		configFile: (source, json) => [
+			withoutPlugins,
+			withBlockNames,
+			withSubjectsOn,
+			thenConvertPresetCode,
+			withoutAdoptOwnership
+		].reduce((edit, step) => step(edit, json), json ? groupConfigJson(source) : groupConfigSource(source)),
+		designFile: convertDesignFile,
+		cliCalls: migrateCliCall,
+		source: rewrite015,
+		review: REVIEW_0_15
+	}
+};
+const SUPABASE_IMPORT = /\bfrom\s*["'](?:better-supabase(?:\/[\w./-]*)?|[^"']*supabase[^"']*)["']/;
+/**
+* Renames bindings a file declares, destructures or imports, in files that
+* import from `better-supabase` or a `supabase` module.
+*/
+function renameBindings(text, bindings) {
+	const ranges = codeRanges(text);
+	if (codeMatches(text, new RegExp(SUPABASE_IMPORT, "g"), ranges).length === 0) return text;
+	return renameIdentifiers(text, new Map(Object.entries(bindings).filter(([from]) => {
+		const name = escapeRegExp(from);
+		return codeMatches(text, new RegExp(`\\b(?:const|let|var|function)\\s+${name}(?![\\w$])|[{,]\\s*(?:type\\s+)?${name}\\s*(?:[,}]|as\\b)|\\(\\s*${name}\\s*[:,)]`, "g"), ranges).length > 0;
+	})));
+}
+function applyEdits(text, edits) {
+	let out = "";
+	let cursor = 0;
+	for (const edit of edits.toSorted((a, b) => a.start - b.start)) {
+		if (edit.start < cursor) continue;
+		out += text.slice(cursor, edit.start) + edit.text;
+		cursor = edit.end;
+	}
+	return out + text.slice(cursor);
+}
+const escapeRegExp = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function inCode(ranges, index) {
+	let low = 0;
+	let high = ranges.length - 1;
+	while (low <= high) {
+		const middle = Math.floor((low + high) / 2);
+		const [start, end] = ranges[middle];
+		if (index < start) high = middle - 1;
+		else if (index >= end) low = middle + 1;
+		else return true;
+	}
+	return false;
+}
+const OPENING = "({[";
+const CLOSING = ")}]";
+/** Matches of `pattern` that start in code. */
+function codeMatches(text, pattern, ranges) {
+	return [...text.matchAll(pattern)].filter((match) => inCode(ranges, match.index));
+}
+const IMPORT = /\b(import|export)\s+(type\s+)?\{([^}]*)\}\s*from\s*(["'])better-supabase(?:\/([\w./-]*))?\4/g;
+/** Renames imported names, from every subpath or only from `subpath`. */
+function renameImports(text, renames, subpath) {
+	const ranges = codeRanges(text);
+	const locals = /* @__PURE__ */ new Set();
+	const edits = [];
+	for (const match of codeMatches(text, IMPORT, ranges)) {
+		if (subpath !== void 0 && match[5] !== subpath) continue;
+		const list = match[3];
+		const listStart = match.index + match[0].indexOf("{") + 1;
+		const renamed = list.replaceAll(/(\btype\s+)?([\w$]+)(\s+as\s+[\w$]+)?/g, (spec, type, name, alias) => {
+			const to = renames[name];
+			if (to === void 0) return spec;
+			if (alias === void 0 && match[1] === "import") locals.add(name);
+			return `${type ?? ""}${to}${alias ?? ""}`;
+		});
+		if (renamed !== list) edits.push({
+			start: listStart,
+			end: listStart + list.length,
+			text: renamed
+		});
+	}
+	return {
+		text: applyEdits(text, edits),
+		locals
+	};
+}
+function renameIdentifiers(text, renames) {
+	if (renames.size === 0) return text;
+	const ranges = codeRanges(text);
+	const names = [...renames.keys()].map(escapeRegExp).join("|");
+	return applyEdits(text, codeMatches(text, new RegExp(`(?<![\\w$.])(?:${names})(?![\\w$])`, "g"), ranges).map((match) => ({
+		start: match.index,
+		end: match.index + match[0].length,
+		text: renames.get(match[0])
+	})));
+}
+function renameStrings(text, strings) {
+	const names = Object.keys(strings).map(escapeRegExp).join("|");
+	if (names === "") return text;
+	const ranges = codeRanges(text);
+	const pattern = new RegExp(`(["'\`])(${names})\\1`, "g");
+	return applyEdits(text, [...text.matchAll(pattern)].filter((match) => !inCode(ranges, match.index + 1)).map((match) => ({
+		start: match.index + 1,
+		end: match.index + 1 + match[2].length,
+		text: strings[match[2]]
+	})));
+}
+function renameMembers(text, members) {
+	const ranges = codeRanges(text);
+	return applyEdits(text, members.flatMap((member) => codeMatches(text, new RegExp(`\\.${escapeRegExp(member.from)}(?![\\w$])${member.notCalled === true ? "(?!\\s*\\()" : ""}`, "g"), ranges).map((match) => ({
+		start: match.index,
+		end: match.index + match[0].length,
+		text: `.${member.to}`
+	}))));
+}
+function renameProps(text, props) {
+	const ranges = codeRanges(text);
+	const edits = [];
+	for (const prop of props) {
+		const tag = new RegExp(`<${escapeRegExp(prop.component)}(?![\\w$.])`, "g");
+		for (const match of codeMatches(text, tag, ranges)) {
+			let depth = 0;
+			for (let index = match.index + match[0].length; index < text.length; index += 1) {
+				if (!inCode(ranges, index)) continue;
+				const char = text[index];
+				if (char === "{") depth += 1;
+				else if (char === "}") depth -= 1;
+				else if (char === ">" && depth === 0) break;
+				if (depth === 0 && /\s/.test(text[index - 1] ?? "") && text.startsWith(`${prop.from}=`, index)) edits.push({
+					start: index,
+					end: index + prop.from.length,
+					text: prop.to
+				});
+			}
+		}
+	}
+	return applyEdits(text, edits);
+}
+/** The index after the bracket that closes the one at `open`, in code only. */
+function closing(text, open, ranges) {
+	let depth = 0;
+	for (let index = open; index < text.length; index += 1) {
+		if (!inCode(ranges, index)) continue;
+		const char = text[index];
+		if (OPENING.includes(char)) depth += 1;
+		else if (CLOSING.includes(char)) {
+			depth -= 1;
+			if (depth === 0) return index + 1;
+		}
+	}
+	return text.length;
+}
+/**
+* Calls `visit(index, depth)` for each code character from `open` to its
+* closing bracket.
+*/
+function walkBrackets(text, open, ranges, visit) {
+	const end = closing(text, open, ranges);
+	let depth = 0;
+	for (let index = open; index < end; index += 1) {
+		if (!inCode(ranges, index)) continue;
+		const char = text[index];
+		if (OPENING.includes(char)) depth += 1;
+		else if (CLOSING.includes(char)) depth -= 1;
+		visit(index, depth, char);
+	}
+}
+/** Where `key` is a top-level key of the object literal at `open`. */
+function topLevelKeys(text, open, key, ranges) {
+	const keys = [];
+	let previous = "";
+	walkBrackets(text, open, ranges, (index, depth, char) => {
+		if (depth === 1 && (previous === "{" || previous === ",") && text.startsWith(key, index) && !/[\w$]/.test(text[index + key.length] ?? "")) {
+			const after = /^\s*(\S)/.exec(text.slice(index + key.length))?.[1];
+			if (after === ":") keys.push({
+				index,
+				shorthand: false
+			});
+			else if (after === "," || after === "}") keys.push({
+				index,
+				shorthand: true
+			});
+		}
+		if (depth === 1 && !/\s/.test(char)) previous = char;
+	});
+	return keys;
+}
+function renameOptions(text, options) {
+	const ranges = codeRanges(text);
+	const edits = [];
+	for (const option of options) {
+		const call = new RegExp(`(?<![\\w$.])${escapeRegExp(option.call)}\\s*(?:<[^>]*>)?\\s*\\(`, "g");
+		for (const match of codeMatches(text, call, ranges)) {
+			const objects = [];
+			walkBrackets(text, match.index + match[0].length - 1, ranges, (index, depth, char) => {
+				if (depth === 2 && char === "{") objects.push(index);
+			});
+			for (const object of objects) for (const { index, shorthand } of topLevelKeys(text, object, option.from, ranges)) edits.push({
+				start: index,
+				end: index + option.from.length,
+				text: shorthand ? `${option.to}: ${option.from}` : option.to
+			});
+		}
+	}
+	return applyEdits(text, edits);
+}
+/** The arguments of the call whose `(` is at `open`: start and end of each. */
+function callArguments(text, open, ranges) {
+	const args = [];
+	let start = open + 1;
+	const end = closing(text, open, ranges) - 1;
+	walkBrackets(text, open, ranges, (index, depth, char) => {
+		if (depth === 1 && char === ",") {
+			args.push({
+				start,
+				end: index
+			});
+			start = index + 1;
+		}
+	});
+	if (text.slice(start, end).trim() !== "") args.push({
+		start,
+		end
+	});
+	return args;
+}
+/**
+* Calls of `pin.call` whose options object lacks `pin.key`, with the insertion
+* when one is safe.
+*/
+function pinTargets(text, pin) {
+	const ranges = codeRanges(text);
+	const call = new RegExp(`(?<![\\w$.])${escapeRegExp(pin.call)}\\s*(?:<[^>]*>)?\\s*\\(`, "g");
+	const targets = [];
+	const entry = `${pin.key}: ${pin.value}`;
+	for (const match of codeMatches(text, call, ranges)) {
+		const open = match.index + match[0].length - 1;
+		const args = callArguments(text, open, ranges);
+		const arg = args[pin.argument];
+		if (arg === void 0) {
+			if (args.length !== pin.argument) {
+				targets.push({
+					call: match.index,
+					edit: void 0
+				});
+				continue;
+			}
+			const last = args.at(-1);
+			const at = last === void 0 ? open + 1 : last.end;
+			const trailing = text[at] === ",";
+			targets.push({
+				call: match.index,
+				edit: trailing ? {
+					start: at + 1,
+					end: at + 1,
+					text: ` { ${entry} }`
+				} : {
+					start: at,
+					end: at,
+					text: `, { ${entry} }`
+				}
+			});
+			continue;
+		}
+		const offset = text.slice(arg.start, arg.end).search(/\S/);
+		const object = arg.start + offset;
+		if (text[object] !== "{") {
+			targets.push({
+				call: match.index,
+				edit: void 0
+			});
+			continue;
+		}
+		if ([pin.key, ...pin.unless ?? []].some((key) => topLevelKeys(text, object, key, ranges).length > 0)) continue;
+		const spreads = [];
+		walkBrackets(text, object, ranges, (index, depth) => {
+			if (depth === 1 && text.startsWith("...", index)) spreads.push(index);
+		});
+		if (spreads.length > 0) {
+			targets.push({
+				call: match.index,
+				edit: void 0
+			});
+			continue;
+		}
+		const body = text.slice(object + 1, closing(text, object, ranges) - 1);
+		const first = /^[ \t]*\n([ \t]*)\S/.exec(body);
+		targets.push({
+			call: match.index,
+			edit: body.trim() === "" ? {
+				start: object,
+				end: object + body.length + 2,
+				text: `{ ${entry} }`
+			} : first ? {
+				start: object + 1,
+				end: object + 1,
+				text: `\n${first[1]}${entry},`
+			} : {
+				start: object + 1,
+				end: object + 1,
+				text: ` ${entry},`
+			}
+		});
+	}
+	return targets;
+}
+function pinOptions(text, pins) {
+	let out = text;
+	for (const pin of pins) if (pin.when.test(out)) out = applyEdits(out, pinTargets(out, pin).flatMap((target) => target.edit === void 0 ? [] : [target.edit]));
+	const review = pins.flatMap((pin) => pinTargets(out, pin).map((target) => ({
+		line: out.slice(0, target.call).split("\n").length,
+		message: pin.message
+	})));
+	return {
+		text: out,
+		review
+	};
+}
+/** Applies one codemod to a source file. */
+function applyCodemod(codemod, source, file) {
+	if (file !== void 0 && (CLI_CALL_FILE.test(file) || SHELL_FILE.test(file))) {
+		const hints = linesMatching(source, codemod.cliReview ?? []);
+		if (!codemod.cliCalls) return {
+			text: source,
+			review: hints
+		};
+		return CLI_CALL_FILE.test(file) ? {
+			text: rewriteCliCalls(source, codemod.cliCalls),
+			review: hints
+		} : {
+			text: source,
+			review: [...cliCallHints(source, codemod.cliCalls), ...hints]
+		};
+	}
+	if (file !== void 0 && DESIGN_FILE_NAME.test(file)) return designFileResult(source, codemod.designFile);
+	let text = source;
+	const refused = [];
+	if (codemod.configFile && file !== void 0 && CONFIG_FILE.test(file)) {
+		const json = file.endsWith(".json");
+		const edit = codemod.configFile(source, json);
+		if (edit.ok) {
+			text = edit.text;
+			refused.push(..."review" in edit ? edit.review : []);
+		} else refused.push({
+			line: 1,
+			message: `The config wasn't rewritten: ${edit.reason}`
+		});
+		if (json) return {
+			text,
+			review: refused
+		};
+	}
+	for (const [subpath, renames] of Object.entries(codemod.subpathImports ?? {})) {
+		const imported = renameImports(text, renames, subpath);
+		text = renameIdentifiers(imported.text, new Map([...imported.locals].map((name) => [name, renames[name]])));
+	}
+	if (codemod.subpaths) text = renameSubpaths(text, codemod.subpaths);
+	if (codemod.imports) {
+		const imported = renameImports(text, codemod.imports);
+		text = renameIdentifiers(imported.text, new Map([...imported.locals].map((name) => [name, codemod.imports[name]])));
+	}
+	if (codemod.bindings) text = renameBindings(text, codemod.bindings);
+	if (codemod.members) text = renameMembers(text, codemod.members);
+	if (codemod.props) text = renameProps(text, codemod.props);
+	if (codemod.options) text = renameOptions(text, codemod.options);
+	if (codemod.strings) text = renameStrings(text, codemod.strings);
+	if (codemod.source) {
+		const rewritten = codemod.source(text);
+		text = rewritten.text;
+		refused.push(...rewritten.review);
+	}
+	if (codemod.pins) {
+		const pinned = pinOptions(text, codemod.pins);
+		text = pinned.text;
+		refused.push(...pinned.review);
+	}
+	return {
+		text,
+		review: [...refused, ...linesMatching(text, codemod.review ?? [])]
+	};
+}
+/** One review line per line of `text` that a hint's pattern matches. */
+function linesMatching(text, hints) {
+	return hints.flatMap((hint) => text.split("\n").flatMap((line, index) => hint.pattern.test(line) ? [{
+		line: index + 1,
+		message: hint.message
+	}] : []));
+}
+//#endregion
+//#region src/cli/commands/codemod.ts
+const CODEMOD_ARGS = {
+	path: {
+		type: "positional",
+		required: false,
+		variadic: true,
+		description: "Files or directories to rewrite (default: the project)"
+	},
+	"dry-run": {
+		type: "boolean",
+		description: "Show the changes without writing them"
+	},
+	check: {
+		type: "boolean",
+		description: "Write nothing; exit 1 with a diff when a file would change"
+	}
+};
+const SOURCE_EXTENSIONS = /* @__PURE__ */ new Set([
+	".ts",
+	".tsx",
+	".mts",
+	".cts",
+	".js",
+	".jsx",
+	".mjs",
+	".cjs"
+]);
+const SKIPPED_DIRS = /* @__PURE__ */ new Set([
+	"node_modules",
+	".git",
+	".next",
+	".turbo",
+	".vercel",
+	"dist",
+	"build",
+	"coverage"
+]);
+/**
+* Source, config and script files under `path`, skipping dependencies, build
+* output and `.d.ts` files.
+*/
+async function sourceFiles(path) {
+	const info = await stat(path).catch(() => void 0);
+	if (!info) return [];
+	if (info.isFile()) return [path];
+	const files = [];
+	for (const entry of await readdir(path, { withFileTypes: true })) {
+		const full = join(path, entry.name);
+		if (entry.isDirectory()) {
+			if (!SKIPPED_DIRS.has(entry.name)) files.push(...await sourceFiles(full));
+		} else if (SOURCE_EXTENSIONS.has(extname(entry.name)) && !entry.name.endsWith(".d.ts") || CONFIG_FILE.test(entry.name) || DESIGN_FILE_NAME.test(entry.name) || CLI_CALL_FILE.test(full) || SHELL_FILE.test(entry.name)) files.push(full);
+	}
+	return files.toSorted();
+}
+async function runCodemod(config, args, paint = plain) {
+	const [name, ...paths] = args._ ?? [];
+	const names = Object.entries(CODEMODS).map(([key, codemod]) => `  ${key.padEnd(5)} ${codemod.description}`).join("\n");
+	if (name === void 0) throw new CliError("usage", `Name a codemod:\n${names}`);
+	const codemod = CODEMODS[name];
+	if (!codemod) throw new CliError("usage", `Unknown codemod "${name}". Codemods:\n${names}`);
+	const roots = (paths.length > 0 ? paths : ["."]).map((path) => resolve(config.root, path));
+	const files = [...new Set((await Promise.all(roots.map(sourceFiles))).flat())];
+	const dryRun = args["dry-run"] === true;
+	const edits = [];
+	const review = [];
+	for (const file of files) {
+		const source = await readFile(file, "utf-8");
+		const result = applyCodemod(codemod, source, file);
+		const path = relative(config.root, file);
+		review.push(...result.review.map((hint) => ({
+			file: path,
+			...hint
+		})));
+		if (result.text !== source) edits.push({
+			path: file,
+			contents: result.text,
+			policy: "edit"
+		});
+	}
+	if (codemod.sqlNames === true) review.push(...await legacySqlNameHints(config));
+	const plan = {
+		root: config.root,
+		regenerate: `better-supabase codemod ${codemod.name}`,
+		files: edits
+	};
+	const applied = await applyPlan(plan, args, paint);
+	const changed = changedFiles(applied);
+	if (applied.mode === "check" && applied.drift) return planResult(plan, applied, { data: { codemod: codemod.name } });
+	const lines = [...applied.mode === "write" ? [] : applied.diffs, changed.length === 0 ? `Nothing to change in ${String(files.length)} files.` : [...changeLines(applied), `${applied.mode === "write" ? "Updated" : "Would update"} ${String(changed.length)} of ${String(files.length)} files.`].join("\n")];
+	if (review.length > 0) lines.push("", "Check these by hand:", ...review.map((hint) => `  ${hint.file}:${String(hint.line)}: ${hint.message}`));
+	return {
+		code: 0,
+		output: lines.join("\n"),
+		data: {
+			codemod: codemod.name,
+			dryRun,
+			changed,
+			files: applied.changes,
+			review
+		}
+	};
+}
+/** The `codemod <name>` subcommand for one codemod in `CODEMODS`. */
+function codemodCommand(name) {
+	return defineCliCommand({
+		meta: commandMeta(`codemod ${name}`),
+		args: CODEMOD_ARGS,
+		runsWithInvalidConfig: true,
+		run: (args, { config, paint }) => runCodemod(config, {
+			...args,
+			_: [name, ...args._]
+		}, paint)
+	});
+}
+//#endregion
+export { codemodCommand };