better-supabase 0.15.0 → 0.15.1

package/dist/{sql-ClHIdgKS.js → sql-OLVW4t08.js}

@@ -774,6 +774,108 @@ function declaredTables(files, schemas) {
 	}
 	return [...found];
 }
+const VIEW = /* @__PURE__ */ new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:(?:temp|temporary|recursive)\s+)?(materialized\s+)?view\s+(?:if\s+not\s+exists\s+)?(${TABLE_NAME$4})\s*(\()?`, "gi");
+const DROP_VIEW = /* @__PURE__ */ new RegExp(String.raw`\bdrop\s+(?:materialized\s+)?view\s+(?:if\s+exists\s+)?(${TABLE_NAME$4}(?:\s*,\s*${TABLE_NAME$4})*)`, "gi");
+const INSTEAD_OF_TRIGGER = /* @__PURE__ */ new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?trigger\s+${NAME$9}\s+instead\s+of\b[^;]*?\bon\s+(${TABLE_NAME$4})`, "gi");
+/**
+* What keeps Postgres from writing through a view to its table: a view that has
+* one of these is not auto-updatable.
+*/
+const NOT_UPDATABLE = /\b(?:(?:distinct|group\s+by|having|limit|offset|fetch\s+first|union|intersect|except|join|window)\b|over\s*\(|(?:count|sum|avg|min|max|array_agg|string_agg|jsonb_agg|json_agg|bool_and|bool_or)\s*\()/i;
+/** The word that ends a view's select list, at the top level. */
+const SELECT_END$1 = /\bfrom\b/i;
+const ALIAS = /* @__PURE__ */ new RegExp(String.raw`\bas\s+(${NAME$9})\s*$`, "i");
+const BARE_COLUMN = /* @__PURE__ */ new RegExp(String.raw`^(?:${NAME$9}\s*\.\s*)*(${NAME$9})$`);
+/**
+* The view's columns from its select list: each item's alias, or the column it
+* names. `undefined` when an item is `*` or has no name to read.
+*/
+function selectColumns(body) {
+	const select = /^\s*(?:\(\s*)?select\s+/i.exec(body);
+	if (select === null) return;
+	let rest = body.slice(select[0].length);
+	const distinct = /^distinct\s+on\s*\(/i.exec(rest);
+	if (distinct === null) rest = rest.replace(/^(?:distinct|all)\b/i, "");
+	else {
+		const close = closingParen(rest, distinct[0].length - 1);
+		if (close === -1) return;
+		rest = rest.slice(close + 1);
+	}
+	const end = topLevelIndex(rest, SELECT_END$1);
+	const items = splitTopLevel(end === -1 ? rest : rest.slice(0, end));
+	const columns = [];
+	for (const item of items) {
+		const alias = ALIAS.exec(item)?.[1] ?? BARE_COLUMN.exec(item.trim())?.[1];
+		if (alias === void 0 || item.trim().endsWith("*")) return;
+		columns.push(unquote$4(alias));
+	}
+	return columns;
+}
+/** The first match of `pattern` outside parentheses and quotes, or -1. */
+function topLevelIndex(text, pattern) {
+	let depth = 0;
+	let quote;
+	for (let i = 0; i < text.length; i += 1) {
+		const char = text[i];
+		if (quote) {
+			if (char === quote) quote = void 0;
+		} else if (char === "'" || char === "\"") quote = char;
+		else if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (depth === 0 && /\w/.test(char) && !/\w/.test(text[i - 1] ?? "") && pattern.exec(text.slice(i))?.index === 0) return i;
+	}
+	return -1;
+}
+/**
+* The views and materialized views `files` create, as `schema.view`, with their
+* columns and whether they are auto-updatable. A later `drop view` removes one.
+* Only views in `schemas` are kept.
+*/
+function declaredViews(files, schemas) {
+	const found = /* @__PURE__ */ new Map();
+	const insteadOf = /* @__PURE__ */ new Set();
+	for (const file of files) {
+		const text = withoutComments$1(file.text);
+		for (const match of text.matchAll(INSTEAD_OF_TRIGGER)) insteadOf.add(qualified$8(match[1]));
+		inOrder([[...text.matchAll(VIEW)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				const view = qualified$8(match[2]);
+				if (!schemas.includes(view.slice(0, view.indexOf(".")))) return;
+				let at = match.index + match[0].length;
+				let listed;
+				if (match[3] !== void 0) {
+					const close = closingParen(text, at - 1);
+					if (close === -1) return;
+					listed = splitTopLevel(text.slice(at, close)).map((column) => unquote$4(column.trim()));
+					at = close + 1;
+				}
+				const as = /\bas\b/i.exec(text.slice(at));
+				if (as === null) return;
+				const start = at + as.index + as[0].length;
+				const end = text.indexOf(";", start);
+				const body = text.slice(start, end === -1 ? text.length : end);
+				found.set(view, {
+					columns: listed ?? selectColumns(body),
+					updatable: match[1] === void 0 && !NOT_UPDATABLE.test(body)
+				});
+			}
+		})), [...text.matchAll(DROP_VIEW)].map((match) => ({
+			index: match.index,
+			apply: () => {
+				for (const view of droppedTables(match[1])) found.delete(view);
+			}
+		}))]);
+	}
+	for (const view of insteadOf) {
+		const entry = found.get(view);
+		if (entry !== void 0) found.set(view, {
+			...entry,
+			updatable: true
+		});
+	}
+	return found;
+}
 const RLS_TOGGLE = /* @__PURE__ */ new RegExp(String.raw`\balter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(${NAME$9}(?:\s*\.\s*${NAME$9})?)\s+(enable|disable)\s+row\s+level\s+security\b`, "gi");
 /**
 * The tables in `schemas` that `files` leave with row level security on: `alter
@@ -983,6 +1085,7 @@ function declaredUpdatedAtTriggers(files, schemas) {
 }
 //#endregion
 //#region src/sql/over-app-tables.ts
+const TABLE_NAME$3 = String.raw`${NAME$9}(?:\s*\.\s*${NAME$9})?`;
 /** Comments replaced by spaces, so offsets into `text` stay the same. */
 function maskComments(text) {
 	return text.replaceAll(/--[^\n]*/g, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " "));
@@ -1068,7 +1171,6 @@ function withoutUnmappedTables(sql, instance) {
 	if (use !== null) throw new TypeError(`Module "${instance}" needs table "${use[1]}", which blocks.${instance}.tables maps to null`);
 	return out;
 }
-const TABLE_NAME$3 = String.raw`${NAME$9}(?:\s*\.\s*${NAME$9})?`;
 const ALTER_CONSTRAINT = /* @__PURE__ */ new RegExp(String.raw`^[ \t]*alter\s+table\s+(?:only\s+)?(${TABLE_NAME$3})\s+(?:add\s+constraint|drop\s+constraint|validate\s+constraint|alter\s+column)\b[^;]*;[ \t]*\n?`, "gim");
 const REVOKE = /* @__PURE__ */ new RegExp(String.raw`^[ \t]*revoke\s[^;]*?\son\s+(?:table\s+)?(${TABLE_NAME$3})\s+from\b[^;]*;[ \t]*\n?`, "gim");
 const ENSURE_CHECK = /^do \$\$\nbegin\n {2}if coalesce\(obj_description\(\(\n\s+select c\.oid from pg_catalog\.pg_constraint c\n\s+where c\.conrelid = '([^']+)'::regclass[\s\S]*?\n\$\$;\n?/gm;
@@ -1082,6 +1184,42 @@ function withoutAppTableEdits(sql, appTables) {
 	const drop = (statement, table) => appTables.has(qualified$8(table)) ? "" : statement;
 	return sql.replaceAll(ALTER_CONSTRAINT, drop).replaceAll(REVOKE, drop).replaceAll(ENSURE_CHECK, drop);
 }
+/**
+* The relation a DDL statement builds or changes: its table, index, grant,
+* policy, trigger or comment target.
+*/
+const DDL_TARGETS = [
+	new RegExp(String.raw`^\s*create\s+(?:unlogged\s+)?table\s+(?:if\s+not\s+exists\s+)?(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${NAME$9}\s+)?on\s+(?:only\s+)?(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*(?:grant|revoke)\s[^;]*?\bon\s+(?:table\s+)?(${TABLE_NAME$3})\s+(?:to|from)\b`, "i"),
+	new RegExp(String.raw`^\s*(?:create|alter|drop)\s+policy\s+(?:if\s+exists\s+)?${NAME$9}\s+on\s+(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*create\s+(?:or\s+replace\s+)?(?:constraint\s+)?trigger\s+${NAME$9}\s[^;]*?\bon\s+(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*drop\s+trigger\s+(?:if\s+exists\s+)?${NAME$9}\s+on\s+(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*comment\s+on\s+table\s+(${TABLE_NAME$3})`, "i"),
+	new RegExp(String.raw`^\s*comment\s+on\s+column\s+(${TABLE_NAME$3})\s*\.\s*${NAME$9}`, "i")
+];
+/**
+* `sql` without the statements that build or change the app's views in `views`
+* (as `schema.view`): their `create table`, columns, constraints, indexes, row
+* level security, grants, revokes, policies, triggers and comments. The
+* functions that read the views stay.
+*/
+function overAppViews(sql, views) {
+	if (views.size === 0) return sql;
+	const said = /* @__PURE__ */ new Set();
+	return statementSpans(sql).map(([from, to]) => {
+		const statement = sql.slice(from, to);
+		const masked = maskComments(statement);
+		const target = DDL_TARGETS.map((pattern) => pattern.exec(masked)?.[1]).find((match) => match !== void 0);
+		const view = target === void 0 ? void 0 : qualified$8(target);
+		if (view === void 0 || !views.has(view)) return statement;
+		const lead = /^\s*/.exec(statement)[0];
+		if (said.has(view)) return "";
+		said.add(view);
+		return `${lead}-- ${view} is the app's view: this block writes only the functions that read it.`;
+	}).join("");
+}
 const COLUMN_NAME$1 = /^("(?:[^"]|"")+"|[a-z_][\w$]*)/i;
 const TABLE_CONSTRAINT$1 = /^(constraint|check|unique|primary|foreign|exclude|like)\b/i;
 function unquote$3(name) {
@@ -1157,8 +1295,13 @@ function appOwnedTables(input) {
 function tableOwnership(input, column, requiredColumn) {
 	const appOwned = appOwnedTables(input);
 	const overApp = appOwned.length > 0;
+	const views = input.source.ownViews ?? {};
 	return {
 		appOwned,
+		appViews: appOwned.filter((logical) => {
+			const parts = input.tableName(logical);
+			return Object.hasOwn(views, `${parts.schema}.${parts.name}`);
+		}),
 		owns: (logical) => {
 			input.tableName(logical);
 			return input.config.mode !== "custom" && !appOwned.includes(logical);
@@ -2255,6 +2398,83 @@ function guestOr(sql, checks) {
 	return live.length === 0 ? sql : `(${sql}) or ${live.join(" or ")}`;
 }
 //#endregion
+//#region src/sql/view-columns.ts
+const cache = /* @__PURE__ */ new WeakMap();
+/**
+* The columns of the app's views that a block reads. A view can't take the
+* columns a block would add to a table, so each optional column (`optional` in
+* the table's spec) a view lacks counts as mapped to `null`, unless the config
+* maps it; any other column a view lacks is in `missing`. Views whose columns
+* aren't known are left alone.
+*/
+function viewColumns(layout, modules, namesOf) {
+	const views = layout.ownViews;
+	if (modules === void 0 || views === void 0 || Object.keys(views).length === 0) return {
+		modules,
+		missing: []
+	};
+	const known = cache.get(layout)?.get(modules);
+	if (known !== void 0) return known;
+	const out = { ...modules };
+	const missing = [];
+	for (const [block, config] of Object.entries(modules)) {
+		const names = namesOf(block);
+		if (config === void 0 || names === void 0 || !Object.values(names.tables).some((spec) => spec.app !== void 0)) continue;
+		const ctx = createModuleContext(block, namesOf, {
+			modules,
+			...layout.ownTables ? { ownTables: layout.ownTables } : {},
+			ownViews: views
+		});
+		const configured = config.columns ?? {};
+		const columns = {};
+		for (const logical of ctx.appViews) {
+			const parts = ctx.tableName(logical);
+			const view = `${parts.schema}.${parts.name}`;
+			const has = layout.ownColumns?.[view];
+			const spec = names.tables[logical];
+			if (has === void 0 || spec.app === void 0) continue;
+			const unused = new Set(spec.app.unused?.(ctx));
+			for (const column of Object.keys(spec.columns)) {
+				if (unused.has(column) || !ctx.has(logical, column)) continue;
+				const physical = ctx.colName(logical, column);
+				if (has.includes(physical)) continue;
+				if (spec.optional?.includes(column) === true && configured[logical]?.[column] === void 0) columns[logical] = {
+					...columns[logical],
+					[column]: null
+				};
+				else missing.push({
+					block,
+					view,
+					column: physical
+				});
+			}
+		}
+		if (Object.keys(columns).length > 0) out[block] = {
+			...config,
+			columns: Object.fromEntries([.../* @__PURE__ */ new Set([...Object.keys(configured), ...Object.keys(columns)])].map((logical) => [logical, {
+				...configured[logical],
+				...columns[logical]
+			}]))
+		};
+	}
+	const result = {
+		modules: Object.keys(out).some((block) => out[block] !== modules[block]) ? out : modules,
+		missing
+	};
+	const byModules = cache.get(layout) ?? /* @__PURE__ */ new WeakMap();
+	byModules.set(modules, result);
+	cache.set(layout, byModules);
+	return result;
+}
+/**
+* Throws when a view of the app's at a block table's name lacks a column the
+* block needs, naming the view and the column.
+*/
+function assertViewColumns(missing) {
+	if (missing[0] === void 0) return;
+	throw new TypeError([...missing.map((each) => `blocks.${each.block} reads ${each.view}.${each.column}, which the view doesn't have.`), "Add the column to the view, or map it in blocks.<name>.columns to one the view has."].join("\n"));
+}
+//#endregion
 //#region src/sql/module-context.ts
 let bound;
 /**
@@ -2282,6 +2502,7 @@ function moduleContext(name, layout = {}, installed, instance) {
 		...layout.subjects ? { subjects: layout.subjects } : {},
 		...layout.appTables ? { appTables: Object.keys(layout.appTables) } : {},
 		...layout.ownTables ? { ownTables: layout.ownTables } : {},
+		...layout.ownViews ? { ownViews: layout.ownViews } : {},
 		...installed ? { installed } : {},
 		...layout.instances ? { instances: layout.instances } : {},
 		...instance === void 0 || instance === name ? {} : { instance },
@@ -2311,7 +2532,14 @@ function moduleContext(name, layout = {}, installed, instance) {
 * a roles table, gets the same `roleThrough`, unless the config sets one.
 */
 function withProviderDefaults(layout) {
-	return withProviderRoles(layout, withProviderSuspension(layout));
+	return viewColumnsOf(layout).modules;
+}
+/**
+* The provider defaults, then the optional columns the app's views lack mapped
+* to `null`, with the required columns they lack.
+*/
+function viewColumnsOf(layout) {
+	return viewColumns(layout, withProviderRoles(layout, withProviderSuspension(layout)), (module) => registry().modules[module]?.names);
 }
 /**
 * `blocks.permissions.disabled` from the provider's `suspension` under the
@@ -3057,7 +3285,7 @@ function tenantSql(ctx, layout) {
   )` : `  select has_organization_role.organization in (
     select ${ctx.fn("member_organization_ids")}(has_organization_role.roles)
   )`;
-	const memberRoleFilter = members.idsFor === void 0 ? "" : ` and m.${tenant} in (select p.id from ${members.idsFor("organization_member_role.member")} as p(id))`;
+	const memberRoleFilter = `${active}${members.idsFor === void 0 ? "" : ` and m.${tenant} in (select p.id from ${members.idsFor("organization_member_role.member")} as p(id))`}`;
 	const claimJson = ctx.text("claimFormat", "array") === "map" ? `coalesce(jsonb_object_agg(m.${tenant}::text, ${role}), '{}'::jsonb)` : `coalesce(jsonb_agg(jsonb_build_object(
       'scope', ${sqlString(ctx.claims.scope)},
       'id', m.${tenant},
@@ -7359,6 +7587,7 @@ const MAX_IDENTIFIER = 63;
 function lockModuleTable(ctx, logical, options = {}) {
 	const table = ctx.table(logical);
 	if (!ctx.appOwned.includes(logical)) return lockTable(table, options);
+	if (ctx.appViews.includes(logical)) return "";
 	return `alter table ${table} enable row level security;
 ${options.read ? `grant select on ${table} to authenticated;\n` : ""}grant all on ${table} to service_role;`;
 }
@@ -7377,7 +7606,7 @@ function asText(ctx, logical, expr) {
 * `where` clause.
 */
 function appUniqueIndex(ctx, logical, columns, where) {
-	if (!ctx.appOwned.includes(logical)) return "";
+	if (!ctx.appOwned.includes(logical) || ctx.appViews.includes(logical)) return "";
 	const physical = columns.map((column) => ctx.colName(logical, column));
 	const name = `${ctx.tableName(logical).name}_${physical.join("_")}_key`;
 	return `\ncreate unique index if not exists ${sqlIdent(name.slice(0, MAX_IDENTIFIER))} on ${ctx.table(logical)} (${physical.map((column) => sqlIdent(column)).join(", ")})${where === void 0 ? "" : ` where ${where}`};`;
@@ -68034,6 +68263,8 @@ $$;
 -- False when the token is narrower than the permission: a permission cap
 -- (bsb_permission_cap) without the key, or a delegated token whose scopes
 -- don't map to it. True for every other token, the service role included.
+-- 0.14 named the cap bs_permission_cap; 0.15 still reads it when the new
+-- claim is missing, so a cap from an older runAs keeps narrowing.
 create or replace function better_supabase.cap_allows(permission text)
 returns boolean
 language sql
@@ -68043,9 +68274,9 @@ set search_path = ''
 as $$
   select case
     when jwt is null then true
-    when jsonb_typeof(jwt -> 'bsb_permission_cap') = 'array'
+    when jsonb_typeof(cap) = 'array'
       and not exists (
-        select 1 from jsonb_array_elements_text(jwt -> 'bsb_permission_cap') c(key)
+        select 1 from jsonb_array_elements_text(cap) c(key)
         where better_supabase.permission_matches(c.key, cap_allows.permission)
       ) then false
     when coalesce(jwt ->> 'client_id', '') = ''
@@ -68065,6 +68296,9 @@ as $$
     )
   end
   from (select auth.jwt() as jwt) as token
+  cross join lateral (
+    select coalesce(jwt -> 'bsb_permission_cap', jwt -> 'bs_permission_cap') as cap
+  ) as capped
 $$;`;
 }
 //#endregion
@@ -123684,7 +123918,7 @@ function applyTenantScope(sql, ctx) {
 	const targets = [];
 	for (const [logical, spec] of Object.entries(ctx.names.tables)) {
 		const tenant = spec.lifecycle?.tenant;
-		if (tenant === void 0 || !ctx.hasTable(logical) || !ctx.has(logical, tenant)) continue;
+		if (tenant === void 0 || ctx.appViews.includes(logical) || !ctx.hasTable(logical) || !ctx.has(logical, tenant)) continue;
 		const name = ctx.tableName(logical);
 		const key = tableKey(`${name.schema}.${name.name}`);
 		const own = policies.filter((policy) => policy.target === key && !policy.restrictive && policy.authenticated);
@@ -125880,6 +126114,7 @@ function upgradePlan(installed, layout = {}, modules = SQL_MODULES) {
 			...entry.module === block ? {} : { instance: entry.module },
 			installed: names,
 			...layout.ownTables ? { ownTables: layout.ownTables } : {},
+			...layout.ownViews ? { ownViews: layout.ownViews } : {},
 			...providerIdType(layout),
 			...providerGuests(layout)
 		});
@@ -125928,6 +126163,7 @@ function moduleSql(module, ctx, layout) {
 function moduleBody(name, layout = {}) {
 	checkModules(layout.modules);
 	checkMigrationOptions(layout.modules, layout.ownTables);
+	assertViewColumns(viewColumnsOf(layout).missing);
 	const modules = resolveBlocks([name], layout);
 	const module = modules.find((entry) => entry.name === name);
 	const ctx = moduleContext(name, layout, modules.map((entry) => entry.name));
@@ -125939,11 +126175,11 @@ function moduleBody(name, layout = {}) {
 */
 function overApp(sql, ctx, layout) {
 	const appTables = appTableSet(ctx);
-	return withoutUnmappedColumns(withoutUnmappedTables(blockNamesOnAppTables(withoutAppTableEdits(overAppTables(sql, appTables, layout.ownColumns), appTables), appTables, layout.ownUpdatedAtTriggers), ctx.instance), ctx.instance);
+	return withoutUnmappedColumns(withoutUnmappedTables(blockNamesOnAppTables(withoutAppTableEdits(overAppTables(overAppViews(sql, appTableSet(ctx, ctx.appViews)), appTables, layout.ownColumns), appTables), appTables, layout.ownUpdatedAtTriggers), ctx.instance), ctx.instance);
 }
 /** The app's tables a module runs over, as `schema.table`. */
-function appTableSet(ctx) {
-	return new Set(ctx.manages ? ctx.appOwned.map((table) => {
+function appTableSet(ctx, tables = ctx.appOwned) {
+	return new Set(ctx.manages ? tables.map((table) => {
 		const parts = ctx.tableName(table);
 		return `${parts.schema}.${parts.name}`;
 	}) : []);
@@ -125989,6 +126225,7 @@ on conflict (name) do update
 function renderBlocks(names, layout = {}) {
 	checkModules(layout.modules);
 	checkMigrationOptions(layout.modules, layout.ownTables);
+	assertViewColumns(viewColumnsOf(layout).missing);
 	const modules = resolveBlocks(names, layout);
 	checkTenantName(modules, layout);
 	const installed = modules.map((module) => module.name);
@@ -126553,11 +126790,12 @@ function contextOf(name, layout) {
 * `ownTables` lists it or `blocks.<name>.on` names it, with the columns their
 * SQL names: mapped to `null` and unused optional columns are left out.
 */
-function adoptedTables(modules, ownTables) {
+function adoptedTables(modules, ownTables, views = {}) {
 	const tables = [];
 	const layout = {
 		modules,
-		...ownTables === void 0 ? {} : { ownTables }
+		...ownTables === void 0 ? {} : { ownTables },
+		...views
 	};
 	const contexts = Object.keys(modules).flatMap((name) => {
 		const mode = modules[name]?.mode ?? "managed";
@@ -126635,6 +126873,30 @@ function enumColumnProblems(modules, files, schemas, ownTables) {
 function enumColumnProblem(table, logical, column, type) {
 	return `blocks.${table.module} writes text into ${table.schema}.${table.table}.${column} (${table.logical}.${logical}), which is the enum ${type}. Postgres does not cast text to an enum, so the module's functions fail. Change the column to text with a check constraint on its values.`;
 }
+/** The block tables in `modules` that run over the app's views. */
+function adoptedViews(modules, ownTables, views) {
+	const layout = {
+		modules,
+		ownTables,
+		...views
+	};
+	return Object.keys(modules).flatMap((name) => {
+		const spec = SQL_MODULES[name]?.names?.tables;
+		const ctx = spec === void 0 ? void 0 : contextOf(name, layout);
+		if (spec === void 0 || ctx === void 0) return [];
+		return ctx.appViews.map((logical) => {
+			const { schema, name: table } = ctx.tableName(logical);
+			const view = `${schema}.${table}`;
+			return {
+				module: name,
+				logical,
+				view,
+				updatable: views.ownViews[view]?.updatable === true,
+				writes: spec[logical]?.app?.writes !== false
+			};
+		});
+	});
+}
 //#endregion
 //#region src/sql/foreign-keys.ts
 const TABLE_NAME = String.raw`${NAME$9}(?:\s*\.\s*${NAME$9})?`;
@@ -126993,4 +127255,4 @@ async function compileReadSets(sets) {
 	return Promise.all(names.map((name) => compileReadSet(byName.get(name))));
 }
 //#endregion
-export { isBlockSqlIdType as $, sameBlockFile as A, SECRET_COLUMNS as B, APP_TABLES_MODULE as C, blockFileState as D, blockSqlVersion as E, SQL_MODULES as F, migrationOptionUses as G, subjectColumns$1 as H, resolveBlocks as I, formerBlockName as J, BLOCK_RENAMES as K, TENANT_SCOPE_POLICY as L, moduleHidingColumns as M, modulePermissionKeys as N, isModuleDataFile as O, moduleSchemaExtensions as P, contractSignature as Q, excludedColumns as R, APP_TABLES_MARKER as S, scopePolicyName as T, sameTenantColumn as U, dataExportPlan as V, sameTenantTrigger as W, AUDIT_CATEGORIES as X, renamedBlock as Y, MODULE_ID_TYPES as Z, upgradePlan as _, tenantsQuery as a, extensionSchema as at, moduleDataDir as b, adoptedColumnProblems as c, auditRegistrations as ct, entityRenamePlan as d, moduleIdType as et, customContracts as f, moduleDeprecations as g, renderBlocks as h, moduleLayout as i, declaredUpdatedAtTriggers as it, moduleEventTriggers as j, moduleFileVersion as k, adoptedTables as l, moduleTopics as m, compileReadSets as n, declaredTableColumns as nt, expiredFlagsQuery as o, policyGrants as ot, moduleBody as p, currentBlockName as q, sharedRolesProblems as r, declaredTables as rt, sameTenantLayout as s, rlsTables as st, compileReadSet as t, BLOCK_OPTION_SCHEMAS as tt, instanceFunctions as u, declaredPolicies as v, appTablesFiles as w, moduleFilePaths as x, widenedCommands as y, resolveExposeColumns as z };
+export { contractSignature as $, moduleFileVersion as A, resolveExposeColumns as B, APP_TABLES_MARKER as C, blockSqlVersion as D, scopePolicyName as E, moduleSchemaExtensions as F, sameTenantTrigger as G, dataExportPlan as H, SQL_MODULES as I, currentBlockName as J, migrationOptionUses as K, resolveBlocks as L, moduleEventTriggers as M, moduleHidingColumns as N, blockFileState as O, modulePermissionKeys as P, MODULE_ID_TYPES as Q, TENANT_SCOPE_POLICY as R, moduleFilePaths as S, appTablesFiles as T, subjectColumns$1 as U, SECRET_COLUMNS as V, sameTenantColumn as W, renamedBlock as X, formerBlockName as Y, AUDIT_CATEGORIES as Z, moduleDeprecations as _, tenantsQuery as a, declaredUpdatedAtTriggers as at, widenedCommands as b, adoptedColumnProblems as c, policyGrants as ct, instanceFunctions as d, isBlockSqlIdType as et, entityRenamePlan as f, renderBlocks as g, moduleTopics as h, moduleLayout as i, declaredTables as it, sameBlockFile as j, isModuleDataFile as k, adoptedTables as l, rlsTables as lt, moduleBody as m, compileReadSets as n, BLOCK_OPTION_SCHEMAS as nt, expiredFlagsQuery as o, declaredViews as ot, customContracts as p, BLOCK_RENAMES as q, sharedRolesProblems as r, declaredTableColumns as rt, sameTenantLayout as s, extensionSchema as st, compileReadSet as t, moduleIdType as tt, adoptedViews as u, auditRegistrations as ut, upgradePlan as v, APP_TABLES_MODULE as w, moduleDataDir as x, declaredPolicies as y, excludedColumns as z };

package/dist/ssr/index.d.ts

@@ -1,6 +1,6 @@
 import { C as readSession, D as writeSession, E as sessionEncoding, S as pruneSessionChunks, T as sessionCookieName, _ as StoredSession, a as ResolveAuthOptions, b as clearSessionAtScopes, d as CookieOptions, f as CookieRecord, g as SessionEncoding, h as DEFAULT_SESSION_ENCODING, l as resolveAuth, m as CookieWrite, n as AuthResolver, p as CookieScope, r as AuthState, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as WriteSessionOptions, w as serializeCookie, x as parseCookies, y as applyCookieWrites } from "../resolve-CXX6DHv3.js";
 import { n as toSession, t as AuthSession } from "../view-DyFdMCqg.js";
-import { r as MembershipClaim } from "../entitlements-CJpYQXeE.js";
+import { r as MembershipClaim } from "../entitlements-BnhDBxLW.js";
 import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-DT_ICaK-.js";
 import { a as sessionStatus, i as clearSessionCookies, n as SessionStatus, o as authContext, r as SessionStatusOptions, t as ClearSessionCookiesOptions } from "../ended-gUsMZVNg.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type ClearSessionCookiesOptions, type CookieOptions, type CookieRecord, type CookieScope, type CookieWrite, DEFAULT_SESSION_ENCODING, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type SessionEncoding, type SessionStatus, type SessionStatusOptions, type StoredSession, type WriteSessionOptions, applyCookieWrites, authContext, clearSessionAtScopes, clearSessionCookies, parseCookies, pruneSessionChunks, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, sessionEncoding, sessionStatus, toSession, writeSession };

package/dist/{subject-readers-BNSzkqw_.d.ts → subject-readers-8GySC9Z8.d.ts}

@@ -1,5 +1,5 @@
 import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
-import { g as SubscriberPolicy } from "./authorization-hooks-Cs1vP_ej.js";
+import { g as SubscriberPolicy } from "./authorization-hooks-D_pwXlBs.js";
 //#region src/core/subject-readers.d.ts
 interface SubjectReadersOptions {
   /** The schema of the `subjects` module. Default `better_supabase`. */

package/dist/svelte/index.d.ts

@@ -2,12 +2,12 @@ import { b as DbError } from "../result-DZeA5KS6.js";
 import { Ct as Events, D as BlockEventPattern, T as BlockEvent, bt as EventMap, k as BlockEventsMatching } from "../events-vcqenSYU.js";
 import { pt as QuerySpec } from "../define-DFBnQyYg.js";
 import { $ as TemplateValues } from "../bucket-CiNi8sIw.js";
-import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-CJrQZQaa.js";
-import { t as AuthSnapshot } from "../bind-CrMBwrPN.js";
+import { g as TopicHandlers, m as Topic, p as SubscriptionStatus, r as PresenceMember, t as EventSchemas } from "../topic-DNFEFGKI.js";
+import { t as AuthSnapshot } from "../bind-h5jre2K0.js";
 import { t as AuthSession } from "../view-DyFdMCqg.js";
-import { n as Controller } from "../controller-BrP0gn47.js";
-import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-fsbFktYF.js";
-import { n as BlockOptions } from "../block-env-B_uEM2xz.js";
+import { n as Controller } from "../controller-DyPPMFSw.js";
+import { C as LiveCountSource, D as ProfileOf, E as PresenceTopic, O as UseActionOptions, S as LiveCountHookOptions, T as PresenceHookOptions, _ as ActionResultOf, a as DataRows, b as ClaimsOf, c as DataWrites, d as BlockMutationState, f as BlockQueryActions, g as ActionInputOf, h as BlockRefetchOn, i as DataRow, l as BlockEventSource, m as BlockQueryState, n as DataId, o as DataSource, p as BlockQueryOptions, r as DataListArgs, s as DataState, t as fieldErrorsOf, u as BlockMutationActions, v as ActionState, w as LiveQueryHookOptions, x as ClientLike, y as BroadcastOptions } from "../field-errors-DYtg1mwv.js";
+import { n as BlockOptions } from "../block-env-BrfRvPrj.js";
 import { n as BlockDataOf, r as BlockMethodName, t as BlockArgsOf } from "../block-method-CiVa2G-J.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { QueryClient } from "@tanstack/query-core";

package/dist/sveltekit/index.d.ts

@@ -1,10 +1,10 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
 import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-CFtehAsr.js";
+import { n as BetterServer } from "../server-types-7QPzW2bF.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BKyTeS-j.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-h5lP_5yj.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { i as tagFor } from "../tags-BjHflcHF.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";

package/dist/sveltekit/index.js

@@ -1,12 +1,12 @@
 import { t as DbException } from "../db-exception-Lngc1W49.js";
 import { r as dbErrorOf } from "../errors-BVFgt8BZ.js";
 import { c as toProblem } from "../problem-Bf0cJ7tk.js";
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B0b6MXYS.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-Dyks1lX1.js";
 import { t as defaultExpose } from "../respond-C3CcOZlA.js";
 import { r as tagFor } from "../tags-CIZTqtlY.js";
 import { i as requireCaller, o as runAction } from "../kit-5l-o8RxL.js";
 import { n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
-import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-DDdkR7FX.js";
+import { a as platformWaitUntil, i as localsOf, n as actionInput, r as frameworkEntry } from "../framework-BozTXRzt.js";
 import { i as refusalTarget } from "../refusal-ByBZcm0V.js";
 //#region src/bridges/sveltekit.ts
 /**

package/dist/tanstack-start/index.d.ts

@@ -1,10 +1,10 @@
 import { O as AnyFunctions, k as AnyModels } from "../types-DFdg_4yN.js";
 import { l as PermissionRef, t as AnyAuthorizer } from "../authorizer-B6X09otb.js";
 import { t as BetterSupabase } from "../define-DFBnQyYg.js";
-import { n as BetterServer } from "../server-types-CFtehAsr.js";
+import { n as BetterServer } from "../server-types-7QPzW2bF.js";
 import { a as AuthorizedContext, c as ResourceLoaderContext, i as AuthorizeOptions, l as Unwrapped, n as ActionParsed, o as BlockActionOptions, r as ActionResult, s as BlockRequireOptions } from "../kit-DOwKpSkA.js";
 import { t as RefusalRedirects } from "../refusal-CSntB_x8.js";
-import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-BKyTeS-j.js";
+import { n as FrameworkOptions, r as LocalsResource, t as FrameworkLocals } from "../framework-h5lP_5yj.js";
 import { t as Validated } from "../shared-CRRfQAKG.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/tanstack-start/index.js

@@ -1,8 +1,8 @@
-import { c as extendServer, o as withFlush, s as createServer } from "../adapter-B0b6MXYS.js";
+import { c as extendServer, o as withFlush, s as createServer } from "../adapter-Dyks1lX1.js";
 import { t as defaultExpose } from "../respond-C3CcOZlA.js";
 import { i as requireCaller, o as runAction } from "../kit-5l-o8RxL.js";
 import { n as bufferInPlace, t as around } from "../shared-Bf-I13Ht.js";
-import { i as localsOf, r as frameworkEntry } from "../framework-DDdkR7FX.js";
+import { i as localsOf, r as frameworkEntry } from "../framework-BozTXRzt.js";
 import { r as refusalResponse } from "../refusal-ByBZcm0V.js";
 //#region src/bridges/tanstack-start.ts
 /**

package/dist/{tenant-yYg0E2-n.d.ts → tenant-DzFsg0Pc.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSnapshot } from "./bind-CrMBwrPN.js";
+import { t as AuthSnapshot } from "./bind-h5jre2K0.js";
 import { t as AuthSession } from "./view-DyFdMCqg.js";
 //#region src/auth/tenant.d.ts
 /**

package/dist/testing/index.d.ts

@@ -7,35 +7,35 @@ import { a as CredentialSubject, i as CredentialRef, r as CredentialProvider } f
 import { n as SqlClient } from "../executor-hGjrop3A.js";
 import { a as BlockTransportMiddleware } from "../block-hooks-DZN2w69m.js";
 import { a as SessionActor, o as SessionDelegation } from "../actor-CoveJgya.js";
-import { P as QueueProvider } from "../types-SFRomQF7.js";
-import { n as Embedder } from "../knowledge-CtL-Vfgy.js";
+import { P as QueueProvider } from "../types-Czq9Xtpa.js";
+import { n as Embedder } from "../knowledge-F1IhRI4Q.js";
 import { a as AuthorizationProvider } from "../authorization-HZdJCaVm.js";
 import { o as StreamStore } from "../store-CpheI-lN.js";
 import { o as Authorizer } from "../authorizer-B6X09otb.js";
 import { J as DbStats, Zt as CacheAdapter, t as BetterSupabase, v as Db } from "../define-DFBnQyYg.js";
 import { X as StoragePath } from "../bucket-CiNi8sIw.js";
-import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-CFtehAsr.js";
+import { B as SupportSessionStore, a as ServerContext, c as ServerOptions } from "../server-types-7QPzW2bF.js";
 import { n as Impersonator } from "../impersonation-YTa9dZUv.js";
-import { tn as AnyRecordBinding } from "../define-block-BVcLQ3DF.js";
+import { tn as AnyRecordBinding } from "../define-block-DvvcM54N.js";
 import { n as Money } from "../money-BNRdJQzA.js";
 import { i as EventSink, t as CloudEvent } from "../cloud-event-CzZTJkXv.js";
-import { i as AuthorizationHooks } from "../authorization-hooks-Cs1vP_ej.js";
+import { i as AuthorizationHooks } from "../authorization-hooks-D_pwXlBs.js";
 import { s as SqlClaims, t as BetterPostgres } from "../pool-CrtT4dg-.js";
 import { r as GuardOptions } from "../respond-Dn1_YhC1.js";
 import { l as Transcriber, s as NoteTaker, u as TranscriberInput } from "../recordings-BBSJt_YV.js";
-import { n as Controller } from "../controller-BrP0gn47.js";
-import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-CAquecT_.js";
-import { At as Generator, Rt as GeneratorInput, Vt as GeneratorModel, Zt as ResolvedConfig } from "../context-CEuTKrkz.js";
+import { n as Controller } from "../controller-DyPPMFSw.js";
+import { c as AiTaskRunner, o as AiTaskRun, r as AiTask } from "../ai-schedules-D_Hz-ik5.js";
+import { Ht as GeneratorModel, Qt as ResolvedConfig, jt as Generator, zt as GeneratorInput } from "../context-TGX2eDS5.js";
 import { r as WebhookInput } from "../signatures-Dkx9OE8j.js";
 import { n as Payment, o as PaymentProvider } from "../payments-BYcN34Fp.js";
 import { t as NotificationChannel } from "../channel-BjvGO39m.js";
 import { a as DeliveryTransport } from "../delivery-n6lZGuGx.js";
 import { l as TaxProvider, r as TaxAddress } from "../tax-DPShHual.js";
 import { p as ShippingProvider, s as ShipmentAddress } from "../carrier-KzeYXVrW.js";
-import { L as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-BBQLbui9.js";
+import { L as WorkflowGraph, c as GraphCompiler, i as BuilderStarter, r as BuilderStartCall } from "../types-DsRfiQ0v.js";
 import { O as IncomingDestination, f as WebhookSecretStore, o as WebhookSigner, v as WebhookTransport } from "../signers-BAEzvTJ0.js";
 import { t as ApiModel } from "../model-hwpvole9.js";
-import { t as EveDocumentBackend } from "../eve-BFSwTu1z.js";
+import { t as EveDocumentBackend } from "../eve-B7jxYPCw.js";
 import { l as VersionOf, t as AnyDocumentFormat } from "../format-u-65igKI.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Message, StateAdapter } from "chat";

package/dist/{timeline-CtG0sehj.d.ts → timeline-WrFMgd3U.d.ts}

@@ -1,8 +1,8 @@
 import { D as ValidationIssue, t as AsyncResult } from "./result-DZeA5KS6.js";
 import { $ as RecordRef } from "./types-DFdg_4yN.js";
 import { o as FilterField } from "./filter-query-BXLs72G9.js";
-import { cn as RecordBindingResult, hn as TimelineItem, in as RecordBindingData } from "./define-block-BVcLQ3DF.js";
-import { A as BindingBlocks, F as LoadBindingsOptions, M as BindingName, N as BindingOf, P as BindingSource, V as PermissionSet, _ as RecordTypeBlocks, g as RecordType, h as RecordCan } from "./index-DLq69k3F.js";
+import { cn as RecordBindingResult, hn as TimelineItem, in as RecordBindingData } from "./define-block-DvvcM54N.js";
+import { A as BindingBlocks, F as LoadBindingsOptions, M as BindingName, N as BindingOf, P as BindingSource, V as PermissionSet, _ as RecordTypeBlocks, g as RecordType, h as RecordCan } from "./index-BfkltrGJ.js";
 import { c as ListParseOptions, m as ListSearchParams } from "./list-query-BDVutLFr.js";
 //#region src/records/list.d.ts
 /**

package/dist/{topic-CJrQZQaa.d.ts → topic-DNFEFGKI.d.ts}

@@ -3,7 +3,7 @@ import { D as AccessTopicPolicy, O as AnyFunctions, it as Row, k as AnyModels, u
 import { t as AuthorizationFunctions } from "./authorization-HZdJCaVm.js";
 import { t as BetterSupabase } from "./define-DFBnQyYg.js";
 import { $ as TemplateValues, Q as TemplateParams } from "./bucket-CiNi8sIw.js";
-import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-Cs1vP_ej.js";
+import { g as SubscriberPolicy, h as SubscriberEvent, i as AuthorizationHooks, m as Subscriber } from "./authorization-hooks-D_pwXlBs.js";
 import { t as RealtimeStatus } from "./realtime-status-BhNkb-Ow.js";
 import { RealtimeChannel, SupabaseClient } from "@supabase/supabase-js";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{types-CAQBmpDx.d.ts → types-A4yyKEsg.d.ts}

@@ -4,7 +4,7 @@ import { n as Logger } from "./logger-DWVYUmwi.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CRpAHrp_.js";
 import { t as BlockTransport } from "./block-transport-DWZSJrwN.js";
 import { n as BlockHooks } from "./block-hooks-DZN2w69m.js";
-import { n as Embedder } from "./knowledge-CtL-Vfgy.js";
+import { n as Embedder } from "./knowledge-F1IhRI4Q.js";
 //#region src/blocks/memory/types.d.ts
 type MemoryScope = "user" | "agent" | "chat" | "project" | "organization";
 type MemoryKind = "core" | "archival";