better-supabase 0.15.0 → 0.15.1

package/dist/cli/legacy-prefix-DkTA3Rhx.js

@@ -0,0 +1,141 @@
+//#region src/cli/sql/legacy-prefix.ts
+/**
+* Prefixes of the names the library builds outside the module files (realtime
+* broadcast triggers, tenant checks, state transitions, JSON Schema checks).
+*/
+const LEGACY_PREFIXES = [
+	"bs_broadcast_",
+	"bs_same_tenant_",
+	"bs_transition_",
+	"bs_json_"
+];
+const LEGACY_NAME = /\bbs_[a-z0-9_]+/g;
+/**
+* JWT claims under their 0.14 name, which 0.15 module SQL still reads; they
+* name no database object.
+*/
+const LEGACY_CLAIMS = /* @__PURE__ */ new Set(["bs_permission_cap"]);
+/** The `bs_` object names in installed module SQL, before 0.15 renamed them. */
+function legacyPrefixNames(text) {
+	return [...new Set(text.match(LEGACY_NAME))].filter((name) => !LEGACY_CLAIMS.has(name)).toSorted();
+}
+const array = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
+/**
+* Renames the installed `bs_` triggers, policies, constraints, indexes and
+* functions to `bsb_`, so the module files' `drop ... if exists bsb_x` replace
+* them instead of adding a second copy. Only the names in `names` and the
+* runtime prefixes are renamed, and only while the new name is free, so the
+* step can run again.
+*/
+function legacyPrefixSql(names) {
+	return `do $bsb_rename$
+declare
+  v_names constant text[] := ${array(names)};
+  v_prefixes constant text[] := ${array(LEGACY_PREFIXES)};
+  r record;
+begin
+  for r in
+    select t.tgname as name, t.tgrelid::regclass::text as rel
+    from pg_trigger t
+    where not t.tgisinternal
+      and (t.tgname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(t.tgname, x)))
+      and not exists (select 1 from pg_trigger u where u.tgrelid = t.tgrelid and u.tgname = 'bsb_' || substr(t.tgname, 4))
+  loop
+    begin
+      execute format('alter trigger %I on %s rename to %I', r.name, r.rel, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select p.polname as name, p.polrelid::regclass::text as rel
+    from pg_policy p
+    where (p.polname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(p.polname, x)))
+      and not exists (select 1 from pg_policy q where q.polrelid = p.polrelid and q.polname = 'bsb_' || substr(p.polname, 4))
+  loop
+    begin
+      execute format('alter policy %I on %s rename to %I', r.name, r.rel, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select c.conname as name, c.conrelid::regclass::text as rel
+    from pg_constraint c
+    where c.conrelid <> 0
+      and (c.conname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(c.conname, x)))
+      and not exists (select 1 from pg_constraint d where d.conrelid = c.conrelid and d.conname = 'bsb_' || substr(c.conname, 4))
+  loop
+    begin
+      execute format('alter table %s rename constraint %I to %I', r.rel, r.name, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select n.nspname as schema, i.relname as name
+    from pg_class i
+    join pg_namespace n on n.oid = i.relnamespace
+    where i.relkind in ('i', 'I')
+      and (i.relname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(i.relname, x)))
+      and not exists (select 1 from pg_constraint c where c.conindid = i.oid)
+      and to_regclass(format('%I.%I', n.nspname, 'bsb_' || substr(i.relname, 4))) is null
+  loop
+    begin
+      execute format('alter index %I.%I rename to %I', r.schema, r.name, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+
+  for r in
+    select f.oid::regprocedure::text as fn, f.proname as name
+    from pg_proc f
+    join pg_namespace n on n.oid = f.pronamespace
+    where n.nspname not in ('pg_catalog', 'information_schema')
+      and (f.proname = any (v_names) or exists (select 1 from unnest(v_prefixes) x where starts_with(f.proname, x)))
+      and not exists (
+        select 1 from pg_proc g
+        where g.pronamespace = f.pronamespace and g.proname = 'bsb_' || substr(f.proname, 4)
+          and g.proargtypes = f.proargtypes
+      )
+  loop
+    begin
+      execute format('alter function %s rename to %I', r.fn, 'bsb_' || substr(r.name, 4));
+    exception when insufficient_privilege then
+      raise warning 'better-supabase: rename % to bsb_% by hand; the migration role does not own it', r.name, substr(r.name, 4);
+    end;
+  end loop;
+end
+$bsb_rename$;`;
+}
+/**
+* Creates `better_supabase.blocks` and copies the rows of the 0.14
+* `better_supabase.modules` table into it, so the schema diff that drops the
+* old table loses no installed versions.
+*/
+const legacyBlocksTableSql = `create schema if not exists better_supabase;
+create table if not exists better_supabase.blocks (
+  name text primary key,
+  version integer not null,
+  mode text not null,
+  installed_at timestamptz not null default now(),
+  updated_at timestamptz not null default now()
+);
+alter table better_supabase.blocks enable row level security;
+revoke all on better_supabase.blocks from anon, authenticated;
+grant select on better_supabase.blocks to service_role;
+do $bsb_blocks$
+begin
+  if to_regclass('better_supabase.modules') is not null then
+    insert into better_supabase.blocks (name, version, mode, installed_at, updated_at)
+    select name, version, mode, installed_at, updated_at from better_supabase.modules
+    on conflict (name) do nothing;
+  end if;
+end
+$bsb_blocks$;`;
+//#endregion
+export { legacyPrefixSql as a, legacyPrefixNames as i, LEGACY_PREFIXES as n, legacyBlocksTableSql as r, LEGACY_CLAIMS as t };

package/dist/cli/{live-iEeH15ck.js → live-Lmg-hYyO.js}

@@ -1,6 +1,6 @@
 import { r as errorText } from "./errors-BTe6A15O.js";
-import "./source-DANaJJVc.js";
-import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-LZroULBe.js";
+import "./source-WoLdcQzN.js";
+import { l as tableObject, n as exposed, s as qualified, t as catalogOf } from "./shared-Bh-6IqJS.js";
 //#region src/cli/doctor/reserved-roles.ts
 /**
 * Supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,

package/dist/cli/{mcp-BAPyaQ62.js → mcp-DQ1zR2eA.js}

@@ -1,6 +1,6 @@
 import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
-import { a as envelope, i as run } from "./run-DYhLBcFW.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { a as envelope, i as run } from "./run-DkB0fhc9.js";
+import { t as VERSION } from "./version-CyavsyGA.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { n as consentToken } from "./agent-CbuPvI2x.js";
 import { C as optional, D as record, N as unknown, a as array, d as is, j as string$1, k as safeParse, o as boolean, t as PROCESS_ENV, x as object } from "./env-DMgjB_4y.js";

package/dist/cli/{metadata-DVx9Zgbj.js → metadata-CZaxkv21.js}

@@ -1,8 +1,8 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as readStdin } from "./io-DH1kcmmP.js";
-import { m as parseMetadataDocument, u as MetadataRejectedError } from "./snapshot-C8MVPyO8.js";
-import { c as metaPaths, n as render } from "./render-ucJmUyuM.js";
-import { i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-CvYVAztY.js";
+import { m as parseMetadataDocument, u as MetadataRejectedError } from "./snapshot-Bzcigm7T.js";
+import { c as metaPaths, n as render } from "./render-lJmHr0y9.js";
+import { i as generationNotices, n as runGen, o as fromMetadata, r as UNFORMATTED, t as refuseRowConditionedBuckets } from "./run-BJ6IMs_H.js";
 import { basename, join, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
 import { jsonSchema, standardSchema, valibot, zod } from "better-supabase/config";

package/dist/cli/{migration-safety-D7PhzFxm.js → migration-safety-BbhLu2fo.js}

@@ -1,5 +1,5 @@
 import { f as INTEGRATIONS } from "./config-9t5ec_N7.js";
-import { c as splitStatements } from "./shared-LZroULBe.js";
+import { c as splitStatements } from "./shared-Bh-6IqJS.js";
 import { dirname, join, posix } from "node:path";
 import { readdir } from "node:fs/promises";
 import { INTEGRATION_INFO, groupEntries } from "better-supabase/config";

package/dist/cli/{module-migration-aPCckev6.js → module-migration-DOn6EmNz.js}

@@ -1,13 +1,11 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { d as TypegenMissingError, i as parseSnapshot } from "./snapshot-C8MVPyO8.js";
-import { a as toCatalog } from "./source-DANaJJVc.js";
-import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
+import { d as readSupabaseToml, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
 import { t as importFresh } from "./fresh-import-DzgsGHkX.js";
 import { i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
-import { existsSync } from "node:fs";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { a as sqlPlan, i as schemasDirOf, n as migrationsDir, r as moduleLayoutFor } from "./sql-layout-rFP0oq1N.js";
+import { resolve } from "node:path";
 import { readFile, readdir } from "node:fs/promises";
-import { MODULE_ID_TYPES, adoptedColumnProblems, auditRegistrations, compileReadSets, declaredPolicies, declaredTableColumns, declaredTables, declaredUpdatedAtTriggers, extensionSchema, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, policyGrants, renderBlocks, resolveBlocks, resolveExposeColumns, rlsTables, sameTenantLayout, scopeProblems, templateFunctions } from "better-supabase/sql";
+import { MODULE_ID_TYPES, compileReadSets, moduleIdType, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, renderBlocks, resolveBlocks, scopeProblems, templateFunctions } from "better-supabase/sql";
 import { isReadSet } from "better-supabase";
 //#region src/cli/authorization.ts
 /** How findings name the provider. */
@@ -210,215 +208,6 @@ const entitlementRequirements = (provider) => [...templateFunctions(provider.mem
 	role: "supabase_auth_admin"
 }))];
 //#endregion
-//#region src/cli/sql-layout.ts
-/** The folder the module data files sit next to, for the project's workflow. */
-async function schemasDirOf(config) {
-	const toml = await readSupabaseToml(config.root);
-	return declarativeSchemasDir(toml, sqlWorkflow(config, toml));
-}
-/** The declarative schema files, then the migrations oldest first. */
-async function schemaTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const migrations = resolve(config.root, migrationsDir(config));
-	const paths = [...(await schemaPaths(config.root, toml, sqlWorkflow(config, toml))).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
-	return Promise.all(paths.map(async (path) => ({
-		path,
-		text: await readFile(resolve(config.root, path), "utf-8")
-	})));
-}
-async function declarativeTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const { files } = await schemaPaths(config.root, toml, sqlWorkflow(config, toml));
-	if (files.length === 0) return schemaTexts(config);
-	return Promise.all(files.map(async (path) => ({
-		path,
-		text: await readFile(resolve(config.root, path), "utf-8")
-	})));
-}
-/**
-* The `better_supabase.audit(...)` calls in the declarative schemas, then the
-* migrations oldest first, so a later call or `unaudit` wins.
-*/
-async function auditedTables(config) {
-	return auditRegistrations(await schemaTexts(config));
-}
-/**
-* The layout `upgrade` and doctor render the module files with, so both see the
-* same grants, session policies, audit triggers and vector schema.
-*/
-async function moduleLayoutFor(config, input) {
-	const resolved = new Set(resolveBlocks(input.names, input.entitlementsProvider ? { entitlementsProvider: input.entitlementsProvider } : {}).map((module) => module.name));
-	const own = await ownLayout(config);
-	const adopted = adoptedColumnProblems(config.blocks, await declarativeTexts(config), config.schemas, own.ownTables);
-	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
-	const fromPolicies = resolved.has("grants") && config.blocks["grants"]?.options?.["fromPolicies"] === true;
-	const sessionPolicies = resolved.has("sessions") && config.blocks["sessions"]?.options?.["policies"] === true;
-	const sameTenant = config.blocks["memberships"]?.options?.["sameTenant"];
-	const autoSameTenant = resolved.has("memberships") && typeof sameTenant === "object" && sameTenant !== null && "auto" in sameTenant && sameTenant.auto === true;
-	const base = moduleLayout(config, input.testsDir, input.readSets ?? [], input.entitlementsProvider, input.accessProvider, input.permissionCatalog);
-	const grants = base.grants === void 0 ? void 0 : resolveExposeColumns(base.grants, await declarativeTexts(config), config.schemas);
-	return {
-		...base,
-		...grants === void 0 ? {} : { grants },
-		schemasDir: await schemasDirOf(config),
-		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
-		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
-		...fromPolicies ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
-		...fromPolicies ? { rlsTables: rlsTables(await declarativeTexts(config), config.schemas) } : {},
-		...autoSameTenant ? sameTenantLayout(await declarativeTexts(config), config.schemas) : {},
-		...fromPolicies || sessionPolicies ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {},
-		...own
-	};
-}
-/**
-* `ownTables`, `ownColumns`, `ownUpdatedAtTriggers` and `ownPolicies`: the
-* database's tables, then the app's files.
-*/
-async function ownLayout(config) {
-	const database = await databaseTables(config);
-	const own = (await declarativeTexts(config)).filter((source) => !writtenByBlocks(source));
-	const columns = Object.fromEntries([...declaredTableColumns(own, config.schemas)].map(([table, names]) => [table, [...names]]));
-	return {
-		ownTables: {
-			...database.tables,
-			...ownDeclaredTables(own, config.schemas)
-		},
-		ownColumns: {
-			...database.columns,
-			...columns
-		},
-		ownUpdatedAtTriggers: {
-			...database.updatedAtTriggers,
-			...declaredUpdatedAtTriggers(own, config.schemas)
-		},
-		ownPolicies: {
-			...database.policies,
-			...declaredPolicies(own, config.schemas)
-		}
-	};
-}
-/** A trigger function named like one that keeps `updated_at` current. */
-const UPDATED_AT_FUNCTION = /updated_at|moddatetime|touch/i;
-const BLOCK_MARKER = /^-- @(?:bsb-block|bsb-tables|bs-module|bs-app-tables)\b/m;
-const BLOCK_MIGRATION = /_better_supabase_[a-z_]+\.sql$/;
-/**
-* The `schema.table`s that the files better-supabase wrote create, among
-* `sources`; a table an app table entry enriches is not one of them.
-*/
-function blockDeclaredTables(sources, schemas) {
-	return new Set(declaredTables(sources.filter(writtenByBlocks), schemas));
-}
-/** A file better-supabase wrote: a block file or a module migration. */
-function writtenByBlocks(source) {
-	return BLOCK_MARKER.test(source.text) || BLOCK_MIGRATION.test(source.path);
-}
-/**
-* The tables in the saved snapshot (`source.snapshot`) that no block file or
-* module migration created, mapped to `database`. Without a snapshot, the app's
-* schema files and migrations stand in for it.
-*/
-async function databaseTables(config) {
-	const none = {
-		tables: {},
-		columns: {},
-		updatedAtTriggers: {},
-		policies: {}
-	};
-	const path = config.source.snapshot;
-	if (path === void 0 || !existsSync(resolve(config.root, path))) return none;
-	let snapshot;
-	try {
-		snapshot = await parseSnapshot(JSON.parse(await readFile(resolve(config.root, path), "utf-8")), path);
-	} catch (cause) {
-		if (cause instanceof TypegenMissingError) return none;
-		throw cause;
-	}
-	const created = blockDeclaredTables(await schemaTexts(config), config.schemas);
-	const tables = {};
-	const columns = {};
-	const updatedAtTriggers = {};
-	const policies = {};
-	for (const table of toCatalog(snapshot).tables) {
-		const name = `${table.schema}.${table.name}`;
-		if (config.schemas.includes(table.schema) && !created.has(name)) {
-			tables[name] = "database";
-			columns[name] = table.columns.map((column) => column.name);
-			const kept = table.triggers.find((trigger) => !trigger.name.startsWith("bsb_") && trigger.events.includes("update") && UPDATED_AT_FUNCTION.test(trigger.function));
-			if (kept !== void 0) updatedAtTriggers[name] = kept.name;
-			policies[name] = table.policies.filter((policy) => !policy.name.startsWith("bsb_"));
-		}
-	}
-	return {
-		tables,
-		columns,
-		updatedAtTriggers,
-		policies
-	};
-}
-/**
-* `schema.table` to the app's own schema file that creates it: every
-* declarative file, or migration, that better-supabase didn't write.
-*/
-function ownDeclaredTables(sources, schemas) {
-	const ownTables = {};
-	for (const source of sources) for (const table of declaredTables([source], schemas)) ownTables[table] ??= source.path;
-	return ownTables;
-}
-function vectorSchemaOf(sources) {
-	const schema = extensionSchema(sources, "vector");
-	return schema === void 0 ? {} : { vectorSchema: schema };
-}
-/**
-* The folder that holds both the project root and `sql.dir`: the root, or an
-* ancestor when `sql.dir` points at a shared stack. The `sql` commands write
-* SQL files only inside it.
-*/
-function sqlRoot(config) {
-	const dir = resolve(config.root, config.sql.dir);
-	let stop = resolve(config.root);
-	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
-	return stop;
-}
-/**
-* A plan for files under the project root or `sql.dir`, with paths relative to
-* the project root.
-*/
-function sqlPlan(config, plan) {
-	return {
-		...plan,
-		root: sqlRoot(config),
-		base: config.root,
-		files: plan.files.map((file) => ({
-			...file,
-			path: resolve(config.root, file.path)
-		})),
-		...plan.remove ? { remove: plan.remove.map((entry) => {
-			const path = resolve(config.root, typeof entry === "string" ? entry : entry.path);
-			return typeof entry === "string" ? path : {
-				...entry,
-				path
-			};
-		}) } : {}
-	};
-}
-/**
-* The migrations folder next to the `config.toml` found walking up from
-* `sql.dir`, relative to the root; `supabase/migrations` without one. The walk
-* stops where `sql.dir` and the root meet, so a `sql.dir` outside the project
-* (a shared stack in a monorepo) finds that stack's folder.
-*/
-function migrationsDir(config) {
-	const root = resolve(config.root);
-	let dir = resolve(root, config.sql.dir);
-	const stop = sqlRoot(config);
-	for (;;) {
-		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
-		if (dir === stop || dirname(dir) === dir) break;
-		dir = dirname(dir);
-	}
-	return "supabase/migrations";
-}
-//#endregion
 //#region src/cli/read-sets.ts
 /** Every read set exported by the modules in `config.readSets`. */
 async function loadReadSets(config) {
@@ -731,4 +520,4 @@ async function writeLatestMigration(config, suffix, contents, options) {
 	};
 }
 //#endregion
-export { providerLabel as A, sqlPlan as C, entitlementRequirements as D, accessRequirements as E, entitlementsMode as O, moduleLayoutFor as S, accessProviderMode as T, layoutFor as _, migrationInstances as a, blockDeclaredTables as b, sameModuleMigration as c, DATA_NEXT as d, dataMigration as f, layout as g, MEMBERSHIP_CLAIM_MODULES as h, migrationHolds as i, unsafeKey as j, moduleKeyProblems as k, writeLatestMigration as l, writeExtensionsMigration as m, READ_SETS_SUFFIX as n, migrationModules as o, migrationStamp as p, latestMigration as r, renderModuleMigration as s, MODULES_SUFFIX as t, writesMigrations as u, providerOwnsMemberships as v, writtenByBlocks as w, migrationsDir as x, compiledReadSets as y };
+export { entitlementsMode as C, unsafeKey as E, entitlementRequirements as S, providerLabel as T, layoutFor as _, migrationInstances as a, accessProviderMode as b, sameModuleMigration as c, DATA_NEXT as d, dataMigration as f, layout as g, MEMBERSHIP_CLAIM_MODULES as h, migrationHolds as i, writeLatestMigration as l, writeExtensionsMigration as m, READ_SETS_SUFFIX as n, migrationModules as o, migrationStamp as p, latestMigration as r, renderModuleMigration as s, MODULES_SUFFIX as t, writesMigrations as u, providerOwnsMemberships as v, moduleKeyProblems as w, accessRequirements as x, compiledReadSets as y };

package/dist/cli/{print-BeWO7OJY.js → print-D_xf8PPj.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { g as layout, o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-aPCckev6.js";
+import { g as layout, o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-DOn6EmNz.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { SQL_MODULES, contractSignature, customContracts, moduleBody, moduleFilePaths } from "better-supabase/sql";

package/dist/cli/{remove-B46Dmd2M.js → remove-BY_TOTRj.js}

@@ -2,14 +2,15 @@ import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { r as readIfExists, t as display } from "./io-DH1kcmmP.js";
-import { C as sqlPlan, _ as layoutFor } from "./module-migration-aPCckev6.js";
+import { _ as layoutFor } from "./module-migration-DOn6EmNz.js";
 import { i as changeLines, n as PLAN_ARGS, r as applyPlan, t as HAND_EDITED, u as planResult } from "./files-CX71yBm8.js";
-import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-BgsUjCan.js";
+import { a as sqlPlan } from "./sql-layout-rFP0oq1N.js";
+import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-DNOL9PDu.js";
 import { t as detectProject } from "./detect-D9JaAX20.js";
 import { _ as wiringBlocks, a as configObject, c as mask, i as closingIndex, l as properties } from "./config-edit-CrWfk8s3.js";
-import { n as guardedRemoval } from "./sync-btj01bcM.js";
+import { n as guardedRemoval } from "./sync-mANmYYoL.js";
 import { t as SQL_ARGS } from "./args-UEwg0l-N.js";
-import { t as blockNames } from "./blocks-BZHI8mRC.js";
+import { t as blockNames } from "./blocks-Cb7mILFU.js";
 import { i as tidyInline, t as cutRange } from "./config-group-C8tjut39.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/cli/{render-ucJmUyuM.js → render-lJmHr0y9.js}

@@ -1,10 +1,10 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { n as importPath } from "./io-DH1kcmmP.js";
-import { i as cachedTypesModule, n as cachedDatabaseTypes, s as typesModuleKey } from "./cache-CXgR_Ahi.js";
+import { i as cachedTypesModule, n as cachedDatabaseTypes, s as typesModuleKey } from "./cache-DkplpIGe.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { f as generateDatabaseTypes, h as restrictSchemas, p as oxfmtInstalled, v as tsTypeOf } from "./snapshot-C8MVPyO8.js";
+import { f as generateDatabaseTypes, h as restrictSchemas, p as oxfmtInstalled, v as tsTypeOf } from "./snapshot-Bzcigm7T.js";
 import { t as isRecord$1 } from "./guards-CUlDNYZs.js";
-import { a as toCatalog } from "./source-DANaJJVc.js";
+import { a as toCatalog } from "./source-WoLdcQzN.js";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve } from "node:path";
 import { entityNames } from "better-supabase/blocks";
 import { DEFAULT_CLAIMS, blockEntities, blockEntityRenames, blockSubjectTypes, tenantClaimPaths, tenantNameOf } from "better-supabase/config";

package/dist/cli/{run-CvYVAztY.js → run-BJ6IMs_H.js}

@@ -1,13 +1,14 @@
 import { r as errorText } from "./errors-BTe6A15O.js";
 import { a as sameText, t as display } from "./io-DH1kcmmP.js";
-import { c as writeAtomic, o as storeTypesModule, s as typesModuleKey, t as CACHE_DIR } from "./cache-CXgR_Ahi.js";
+import { c as writeAtomic, o as storeTypesModule, s as typesModuleKey, t as CACHE_DIR } from "./cache-DkplpIGe.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { _ as stabilizeMetadata, b as typegenVersionNotice, p as oxfmtInstalled, t as loadSnapshot, y as typegenVersion } from "./snapshot-C8MVPyO8.js";
-import { n as render } from "./render-ucJmUyuM.js";
-import { A as providerLabel, D as entitlementRequirements, E as accessRequirements, O as entitlementsMode, T as accessProviderMode, c as sameModuleMigration, j as unsafeKey, k as moduleKeyProblems, l as writeLatestMigration, n as READ_SETS_SUFFIX, r as latestMigration, u as writesMigrations, w as writtenByBlocks, x as migrationsDir, y as compiledReadSets } from "./module-migration-aPCckev6.js";
-import { s as schemaStampPath } from "./content-mapper-DNs7lTu7.js";
+import { _ as stabilizeMetadata, b as typegenVersionNotice, p as oxfmtInstalled, t as loadSnapshot, y as typegenVersion } from "./snapshot-Bzcigm7T.js";
+import { n as render } from "./render-lJmHr0y9.js";
+import { C as entitlementsMode, E as unsafeKey, S as entitlementRequirements, T as providerLabel, b as accessProviderMode, c as sameModuleMigration, l as writeLatestMigration, n as READ_SETS_SUFFIX, r as latestMigration, u as writesMigrations, w as moduleKeyProblems, x as accessRequirements, y as compiledReadSets } from "./module-migration-DOn6EmNz.js";
+import { s as schemaStampPath } from "./content-mapper-Cdx6arxu.js";
 import { a as changedFiles, d as fileDiff, i as changeLines, r as applyPlan, s as hasConflicts } from "./files-CX71yBm8.js";
-import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-LZroULBe.js";
+import { n as migrationsDir, o as writtenByBlocks } from "./sql-layout-rFP0oq1N.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-Bh-6IqJS.js";
 import { existsSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
@@ -121,6 +122,18 @@ function appTablesOf(context) {
 	const created = new Set(declaredTables((context.sqlFiles ?? []).filter(writtenByBlocks), context.config.schemas));
 	return Object.fromEntries(catalogOf(context).tables.filter((table) => context.config.schemas.includes(table.schema) && !created.has(qualified(table))).map((table) => [qualified(table), "database"]));
 }
+/**
+* The views among the app's tables, and the columns of each, for the layout a
+* block reads them with.
+*/
+function appViewsOf(context) {
+	const own = appTablesOf(context);
+	const views = catalogOf(context).tables.filter((table) => table.kind === "view" && Object.hasOwn(own, qualified(table)));
+	return {
+		ownViews: Object.fromEntries(views.map((view) => [qualified(view), { updatable: view.insertable && view.updatable }])),
+		ownColumns: Object.fromEntries(views.map((view) => [qualified(view), view.columns.map((column) => column.name)]))
+	};
+}
 //#endregion
 //#region src/cli/doctor/block-policies.ts
 /** The prefix the render pass gives block policies on the app's tables. */
@@ -1424,4 +1437,4 @@ async function runGen(options) {
 	};
 }
 //#endregion
-export { splinterTables as S, withoutStrings as _, METADATA_GAPS_TEXT as a, appTablesOf as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, BLOCK_PREFIX as v, advisorRule as x, blockTargets as y };
+export { splinterTables as C, advisorRule as S, withoutStrings as _, METADATA_GAPS_TEXT as a, appTablesOf as b, accessModule as c, RLS_RULES as d, appliesTo as f, policyHelpers as g, functionObject as h, generationNotices as i, entitlementsModule as l, functionBody as m, runGen as n, fromMetadata as o, escape as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, COMMANDS as u, BLOCK_PREFIX as v, appViewsOf as x, blockTargets as y };

package/dist/cli/{run-DYhLBcFW.js → run-DkB0fhc9.js}

@@ -1,6 +1,6 @@
 import { c as COMMANDS, d as GROUPS, f as RESERVED_NAMES, h as runCommand, i as joinRepeated, m as parseArgs$2, o as listArgs, s as runsWithInvalidConfig, t as GLOBAL_ARGS, u as DOCS_ORIGIN } from "./command-CQ61x6gN.js";
 import { n as highlight, r as painter } from "./style-Bm2X5JrN.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { t as VERSION } from "./version-CyavsyGA.js";
 import { n as CliError, o as toCliError } from "./errors-BTe6A15O.js";
 import { a as missingInputNext, o as resolveAgent, t as checkConsent } from "./agent-CbuPvI2x.js";
 import { a as globalFlags, c as resolveCommand, i as commandTree, n as closestName, o as isVariadic, r as commandArgs, t as checkArgs } from "./parse-B9Iv_-Pf.js";
@@ -16,35 +16,35 @@ import { resolve } from "node:path";
 * loads on demand, so `--version` and `--help` import no command.
 */
 const LOADERS = [
-	["init", () => import("./init-D-aDv9r5.js").then((m) => m.initCommand)],
-	["add", () => import("./add-DWjlVwvP.js").then((m) => m.addCommand)],
-	["remove", () => import("./remove-B46Dmd2M.js").then((m) => m.removeCommand)],
-	["upgrade", () => import("./upgrade-Dw3TMQzn.js").then((m) => m.upgradeCommand)],
-	["gen", () => import("./gen-MtijJQ9r.js").then((m) => m.genCommand)],
-	["doctor", () => import("./doctor-DDrEM6S1.js").then((m) => m.doctorCommand)],
+	["init", () => import("./init-BOw0SX65.js").then((m) => m.initCommand)],
+	["add", () => import("./add-CUH0rORo.js").then((m) => m.addCommand)],
+	["remove", () => import("./remove-BY_TOTRj.js").then((m) => m.removeCommand)],
+	["upgrade", () => import("./upgrade-BrNLt92u.js").then((m) => m.upgradeCommand)],
+	["gen", () => import("./gen-yRHOHW1b.js").then((m) => m.genCommand)],
+	["doctor", () => import("./doctor-C-VO-QQ2.js").then((m) => m.doctorCommand)],
 	["db query", () => import("./db-DrBI_HNv.js").then((m) => m.dbQueryCommand)],
 	["db diff", () => import("./db-DrBI_HNv.js").then((m) => m.dbDiffCommand)],
 	["db seed", () => import("./seed-D6XijwbR.js").then((m) => m.seedCommand)],
-	["db backfill", () => import("./backfill-nxPbcsns.js").then((m) => m.dbBackfillCommand)],
+	["db backfill", () => import("./backfill-VFzf-TJP.js").then((m) => m.dbBackfillCommand)],
 	["dev env", () => import("./env-CAU1nknN.js").then((m) => m.envCommand)],
 	["dev run", () => import("./run-BXx6D1aR.js").then((m) => m.runCommand)],
 	["dev keys", () => import("./keys-DGEpMbeB.js").then((m) => m.keysCommand)],
 	["dev stack ls", () => import("./stack-CWEHdO0b.js").then((m) => m.stackLsCommand)],
 	["dev stack prune", () => import("./stack-CWEHdO0b.js").then((m) => m.stackPruneCommand)],
-	["blocks list", () => import("./blocks-Cr4HGePW.js").then((m) => m.blocksListCommand)],
-	["blocks view", () => import("./blocks-Cr4HGePW.js").then((m) => m.blocksViewCommand)],
-	["blocks search", () => import("./blocks-Cr4HGePW.js").then((m) => m.blocksSearchCommand)],
-	["spec emit", () => import("./spec-g8_G5K7o.js").then((m) => m.specEmitCommand)],
-	["spec validate", () => import("./spec-g8_G5K7o.js").then((m) => m.specValidateCommand)],
-	["mcp", () => import("./mcp-BAPyaQ62.js").then((m) => m.mcpCommand)],
+	["blocks list", () => import("./blocks-Bn7WUca5.js").then((m) => m.blocksListCommand)],
+	["blocks view", () => import("./blocks-Bn7WUca5.js").then((m) => m.blocksViewCommand)],
+	["blocks search", () => import("./blocks-Bn7WUca5.js").then((m) => m.blocksSearchCommand)],
+	["spec emit", () => import("./spec-BF_dpwzW.js").then((m) => m.specEmitCommand)],
+	["spec validate", () => import("./spec-BF_dpwzW.js").then((m) => m.specValidateCommand)],
+	["mcp", () => import("./mcp-DQ1zR2eA.js").then((m) => m.mcpCommand)],
 	["skills list", () => import("./skills-toUan_OV.js").then((m) => m.skillsListCommand)],
 	["skills install", () => import("./skills-toUan_OV.js").then((m) => m.skillsInstallCommand)],
-	["codemod 0.4", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.4"))],
-	["codemod 0.5", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.5"))],
-	["codemod 0.6", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.6"))],
-	["codemod 0.9", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.9"))],
-	["codemod 0.11", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.11"))],
-	["codemod 0.15", () => import("./codemod-DSN7iAdg.js").then((m) => m.codemodCommand("0.15"))],
+	["codemod 0.4", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.4"))],
+	["codemod 0.5", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.5"))],
+	["codemod 0.6", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.6"))],
+	["codemod 0.9", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.9"))],
+	["codemod 0.11", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.11"))],
+	["codemod 0.15", () => import("./codemod-BbaE5dL_.js").then((m) => m.codemodCommand("0.15"))],
 	["completion", () => import("./completion-BwI0_Ap5.js").then((m) => m.completionCommand)],
 	["config", () => import("./config-CPux9Wa7.js").then((m) => m.configCommand)]
 ];

package/dist/cli/{shared-LZroULBe.js → shared-Bh-6IqJS.js}

@@ -1,4 +1,4 @@
-import { a as toCatalog } from "./source-DANaJJVc.js";
+import { a as toCatalog } from "./source-WoLdcQzN.js";
 import { h as tomlGet, p as sqlWorkflow, r as detectWorkflow } from "./supabase-toml-CncmQbO0.js";
 //#region src/cli/doctor/shared.ts
 const catalogs = /* @__PURE__ */ new WeakMap();

package/dist/cli/{snapshot-C8MVPyO8.js → snapshot-Bzcigm7T.js}

@@ -1,7 +1,7 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
-import { d as readExtras, l as TYPEGEN_VERSION, r as cachedIntrospect } from "./cache-CXgR_Ahi.js";
+import { d as readExtras, l as TYPEGEN_VERSION, r as cachedIntrospect } from "./cache-DkplpIGe.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { n as managementSource, r as pgSource } from "./source-DANaJJVc.js";
+import { n as managementSource, r as pgSource } from "./source-WoLdcQzN.js";
 import { n as databaseUrl, u as accessToken } from "./config-9t5ec_N7.js";
 import { d as readSupabaseToml, f as schemaPaths, h as tomlGet, u as pgFunctionHooks } from "./supabase-toml-CncmQbO0.js";
 import { t as connect } from "./db-CQCLx7cx.js";

package/dist/cli/{source-DANaJJVc.js → source-WoLdcQzN.js}

@@ -1,4 +1,4 @@
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { t as VERSION } from "./version-CyavsyGA.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { r as redactUrl } from "./redact-KGAk2Ul9.js";
 import { n as HTTP_CHANNEL } from "./trace-VbdO6bcN.js";

package/dist/cli/{spec-g8_G5K7o.js → spec-BF_dpwzW.js}

@@ -1 +1 @@
-export { n as specEmitCommand, i as specValidateCommand } from "./spec-DGVNMSSB.js";
+export { n as specEmitCommand, i as specValidateCommand } from "./spec-CZMiLhv_.js";

package/dist/cli/{spec-DGVNMSSB.js → spec-CZMiLhv_.js}

@@ -1,9 +1,9 @@
 import { n as __require, t as __commonJSMin } from "./rolldown-runtime-kJ_i4yPo.js";
 import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
-import { t as VERSION } from "./version-Du4CgONY.js";
+import { t as VERSION } from "./version-CyavsyGA.js";
 import { i as failedResult, n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { t as display } from "./io-DH1kcmmP.js";
-import { c as writeAtomic, t as CACHE_DIR } from "./cache-CXgR_Ahi.js";
+import { c as writeAtomic, t as CACHE_DIR } from "./cache-DkplpIGe.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
 import { t as importFresh } from "./fresh-import-DzgsGHkX.js";
 import { a as changedFiles, i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";