better-supabase 0.16.0 → 0.17.0

package/dist/blocks/workflows/index.d.ts

@@ -1,11 +1,11 @@
 import { b as DbError } from "../../result-DZeA5KS6.js";
 import { Ct as Events, _t as WorkflowRunEventData } from "../../events-vcqenSYU.js";
 import { a as dbTransport, o as rpcTransport, s as sqlTransport, t as BlockTransport } from "../../block-transport-DWZSJrwN.js";
-import { c as BlockOf } from "../../define-block-C1RHXz7L.js";
+import { c as BlockOf } from "../../define-block-Xxw8Hroe.js";
 import { _ as WorkflowsHooks, a as WorkflowRunStatus, c as WorkflowScheduleInput, d as WorkflowStartTicket, f as WorkflowStarter, g as Workflows, h as WorkflowTickResult, i as WorkflowRunRecord, l as WorkflowStartCall, m as WorkflowTickOptions, n as WorkflowRun, o as WorkflowRunsQuery, s as WorkflowSchedule, u as WorkflowStartRequest, v as WorkflowsOptions, y as createWorkflows } from "../../workflows-B0ZPAQu0.js";
-import { p as SubscriptionStatus } from "../../topic-CZXHhZye.js";
-import { n as TopicPort } from "../../watch-topic-BAxoPKZx.js";
-import { n as Controller, t as AuthPort } from "../../controller-BW-5Opig.js";
+import { p as SubscriptionStatus } from "../../topic-BtLz-qTI.js";
+import { n as TopicPort } from "../../watch-topic-tnfOTa3-.js";
+import { n as Controller, t as AuthPort } from "../../controller-CJUXhshv.js";
 //#region src/blocks/workflows/client.d.ts
 interface WorkflowRunsControllerOptions {
   readonly client: {

package/dist/cli/{add-I8OW-qJH.js → add-BinNYhFD.js}

@@ -1,8 +1,8 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { T as providerLabel, _ as layoutFor, h as MEMBERSHIP_CLAIM_MODULES, v as providerOwnsMemberships } from "./module-migration-O_IxewFs.js";
+import { T as providerLabel, _ as layoutFor, h as MEMBERSHIP_CLAIM_MODULES, v as providerOwnsMemberships } from "./module-migration-mKhX88V_.js";
 import { r as applyPlan } from "./files-CX71yBm8.js";
 import { n as addBlocksToJson, s as keyText, t as addBlocksToConfig } from "./config-edit-CrWfk8s3.js";
-import { a as write, i as unlistedModuleFiles, r as nextStep } from "./sync-CZMRB3aU.js";
+import { a as write, i as unlistedModuleFiles, r as nextStep } from "./sync-CHGMZCJ5.js";
 import { basename, dirname } from "node:path";
 import { readFile } from "node:fs/promises";
 import { SQL_MODULES, resolveBlocks } from "better-supabase/sql";

package/dist/cli/{add-D7TkPdco.js → add-DMcrsWjC.js}

@@ -1,22 +1,22 @@
 import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
-import { t as VERSION } from "./version-B2Dr6VmJ.js";
+import { t as VERSION } from "./version-T507a49w.js";
 import { a as parseNames, n as CliError } from "./errors-BTe6A15O.js";
 import { r as readIfExists, t as display } from "./io-DH1kcmmP.js";
-import { t as loadSnapshot } from "./snapshot-uTUlEzY2.js";
+import { t as loadSnapshot } from "./snapshot-C6vh_n3t.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { a as toCatalog } from "./source-D2gJHKwC.js";
-import { f as dataMigration } from "./module-migration-O_IxewFs.js";
-import { a as findConfig, f as INTEGRATIONS, s as loadConfig } from "./config-9t5ec_N7.js";
+import { a as toCatalog } from "./source-BZbEK5if.js";
+import { f as dataMigration } from "./module-migration-mKhX88V_.js";
+import { a as findConfig, f as INTEGRATIONS, s as loadConfig } from "./config-2rwFHbwj.js";
 import { i as changeLines, n as PLAN_ARGS, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
-import { a as wiringFiles, d as libEntry, f as needsLib, i as wiringChecklist, l as importFrom, n as latestMigrationVersion, o as wiringFor, p as resolveIntegrations, s as TEMPLATES, u as isIntegration } from "./migration-safety-BnnXPAro.js";
+import { a as wiringFiles, d as libEntry, f as needsLib, i as wiringChecklist, l as importFrom, n as latestMigrationVersion, o as wiringFor, p as resolveIntegrations, s as TEMPLATES, u as isIntegration } from "./migration-safety-NtB3dsRU.js";
 import { n as installCommand, t as detectProject } from "./detect-D9JaAX20.js";
 import { d as setBlockInJson, f as setPathInConfig, h as setPresetInJson, m as setPresetInConfig, n as addBlocksToJson, p as setPathInJson, r as addBlocksToWiring, t as addBlocksToConfig, u as setBlockInConfig } from "./config-edit-CrWfk8s3.js";
-import { t as syncModules } from "./sync-CZMRB3aU.js";
-import { t as addModules } from "./add-I8OW-qJH.js";
-import { n as ident } from "./live-DGdLR41j.js";
-import { t as blockNames } from "./blocks-xk-SE8gS.js";
-import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
+import { t as syncModules } from "./sync-CHGMZCJ5.js";
+import { t as addModules } from "./add-BinNYhFD.js";
+import { n as ident } from "./live-BvWGM4c3.js";
+import { t as blockNames } from "./blocks-DSgTifw0.js";
+import { i as sourceArgs, n as SOURCE_ARGS } from "./source-args-MTLYpifA.js";
 import { existsSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { readFile } from "node:fs/promises";
@@ -405,6 +405,8 @@ function proposeAdoption(block, tables, options = {}) {
 		if (Object.keys(mapped).length > 0) entryColumns[logical] = mapped;
 	}
 	const current = options.blocks?.[block];
+	const governed = current?.ownTablePolicies === void 0 ? [...chosen.values()].filter((table) => table !== null && (table.policies ?? []).some((policy) => policy.permissive && !policy.name.startsWith("bsb_"))).map((table) => `${table.schema}.${table.name}`) : [];
+	if (governed.length > 0) warnings.push(`${governed.join(", ")} already ${governed.length === 1 ? "has" : "have"} permissive policies of your own. To keep the block's bsb_ policies off ${governed.length === 1 ? "it" : "them"}, set blocks.${block}.ownTablePolicies: "app"; otherwise the block adds a policy for each command yours don't cover, and doctor (BS347) reports one that is wider than yours.`);
 	const entry = {
 		...current,
 		tables: entryTables,

package/dist/cli/add-z-3pXI6C.js

@@ -0,0 +1 @@
+export { t as addCommand } from "./add-DMcrsWjC.js";

package/dist/cli/{backfill-DIz5DnlQ.js → backfill-DxBB62Zr.js}

@@ -1,10 +1,10 @@
 import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
-import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-9t5ec_N7.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-2rwFHbwj.js";
 import { t as connect } from "./db-CQCLx7cx.js";
-import { n as ident } from "./live-DGdLR41j.js";
-import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-IpJRJO5t.js";
+import { n as ident } from "./live-BvWGM4c3.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-MTLYpifA.js";
 //#region src/cli/commands/backfill.ts
 const DEFAULT_BATCH = 1e3;
 const ARGS = {

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-MRET30vh.js";
+import { i as run } from "./run-D48ZEU58.js";
 import { t as colorEnabled } from "./style-Bm2X5JrN.js";
 import { existsSync } from "node:fs";
 import { basename } from "node:path";

package/dist/cli/{blocks-xk-SE8gS.js → blocks-DSgTifw0.js}

@@ -1,7 +1,7 @@
 import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { t as SQL_ARGS } from "./args-UEwg0l-N.js";
-import { n as listModules, t as printModule } from "./print-DosQIFSy.js";
+import { n as listModules, t as printModule } from "./print-Dh8iuPK3.js";
 import { t as decodePresetInput } from "./preset-BwmIfFnh.js";
 import { BLOCK_CATEGORIES } from "better-supabase/blocks";
 import { PRESET_CATALOG, PRESET_NAMES, glueCommand } from "better-supabase/preset";

package/dist/cli/{blocks-Bp5RPoft.js → blocks-rxOS-Mzz.js}

@@ -1 +1 @@
-export { n as blocksListCommand, r as blocksSearchCommand, i as blocksViewCommand } from "./blocks-xk-SE8gS.js";
+export { n as blocksListCommand, r as blocksSearchCommand, i as blocksViewCommand } from "./blocks-DSgTifw0.js";

package/dist/cli/{cache-AznIssjI.js → cache-oU0yHKf0.js}

@@ -1,4 +1,4 @@
-import { t as VERSION } from "./version-B2Dr6VmJ.js";
+import { t as VERSION } from "./version-T507a49w.js";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";

package/dist/cli/{codemod-Aewxza6i.js → codemod-Dsrv_3gQ.js}

@@ -4,7 +4,7 @@ import { n as CliError } from "./errors-BTe6A15O.js";
 import { t as migrateCliCall } from "./moved-CsfDQcyk.js";
 import { t as isRecord$1 } from "./guards-CUlDNYZs.js";
 import { a as changedFiles, i as changeLines, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
-import { i as schemasDirOf, n as migrationsDir, o as writtenByBlocks } from "./sql-layout-lUWenjJw.js";
+import { i as schemasDirOf, n as migrationsDir, o as writtenByBlocks } from "./sql-layout-26LSoifK.js";
 import { a as configObject, c as mask, f as setPathInConfig, g as skipSpace, h as setPresetInJson, i as closingIndex, l as properties, m as setPresetInConfig, o as indentAt, p as setPathInJson, t as addBlocksToConfig, v as codeRanges } from "./config-edit-CrWfk8s3.js";
 import { i as legacyPrefixNames, n as LEGACY_PREFIXES, t as LEGACY_CLAIMS } from "./legacy-prefix-DkTA3Rhx.js";
 import { a as REVIEW_0_15, c as renameSubpaths, r as PLUGIN_IMPORT_RENAMES, s as SUBPATH_RENAMES_0_15, t as BLOCK_EXPORT_RENAMES } from "./codemod-block-renames-BuSaTE_G.js";

package/dist/cli/{config-9t5ec_N7.js → config-2rwFHbwj.js}

@@ -778,6 +778,7 @@ const blockEntries = {
 		"user",
 		"none"
 	])),
+	ownTablePolicies: optional(picklist(["block", "app"])),
 	functions: optional(stringRecord),
 	permissions: optional(stringRecord),
 	names: optional(union([entityName, record(string(), union([entityName, strictObject({
@@ -1261,7 +1262,8 @@ const FLAT = {
 			"tenant",
 			"user",
 			"none"
-		]))
+		])),
+		ownTablePolicies: optional(picklist(["block", "app"]))
 	})),
 	seed: optional(strictObject({
 		entry: optional(string()),

package/dist/cli/{config-CBqkQjjN.js → config-C6XylzKz.js}

@@ -1 +1 @@
-export { t as applyEnvironment, n as databaseUrl, r as defaultConfig, i as discoverConfig, a as findConfig, o as importExport, s as loadConfig, c as readSupabasePort, l as stdinDatabaseUrl } from "./config-9t5ec_N7.js";
+export { t as applyEnvironment, n as databaseUrl, r as defaultConfig, i as discoverConfig, a as findConfig, o as importExport, s as loadConfig, c as readSupabasePort, l as stdinDatabaseUrl } from "./config-2rwFHbwj.js";

package/dist/cli/{content-mapper-DCrz6OIv.js → content-mapper-DLbXilBz.js}

@@ -1,6 +1,6 @@
 import { r as readIfExists } from "./io-DH1kcmmP.js";
-import { t as CACHE_DIR } from "./cache-AznIssjI.js";
-import { x as installedVersion } from "./snapshot-uTUlEzY2.js";
+import { t as CACHE_DIR } from "./cache-oU0yHKf0.js";
+import { x as installedVersion } from "./snapshot-C6vh_n3t.js";
 import { t as i } from "./jsonc-D5Fu67jw.js";
 import { resolve } from "node:path";
 import { createHash } from "node:crypto";

package/dist/cli/{db-DrBI_HNv.js → db-Bwrr3GHM.js}

@@ -2,11 +2,11 @@ import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
 import { t as display } from "./io-DH1kcmmP.js";
-import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-9t5ec_N7.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-2rwFHbwj.js";
 import { d as readSupabaseToml, f as schemaPaths, n as declarativeSchemasDir, p as sqlWorkflow } from "./supabase-toml-CncmQbO0.js";
 import { r as supabaseCli } from "./exec--Q1ZEWUW.js";
 import { t as connect } from "./db-CQCLx7cx.js";
-import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-IpJRJO5t.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-MTLYpifA.js";
 import { a as migrationFiles, i as isShadowFailure, o as migrationVersion, r as inStackDiff, t as MIGRATION_HEADER } from "./in-stack-diff-DQTW53Vf.js";
 import { dirname, join, resolve } from "node:path";
 import { mkdir, readFile, writeFile } from "node:fs/promises";

package/dist/cli/{doctor-DkOSLPEQ.js → doctor-CKt5Yyl4.js}

@@ -1,41 +1,41 @@
 import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
-import { t as VERSION } from "./version-B2Dr6VmJ.js";
+import { t as VERSION } from "./version-T507a49w.js";
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
 import { a as sameText, t as display } from "./io-DH1kcmmP.js";
-import { t as CACHE_DIR } from "./cache-AznIssjI.js";
+import { t as CACHE_DIR } from "./cache-oU0yHKf0.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { C as satisfies, S as peerVersions, c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot, u as MetadataRejectedError } from "./snapshot-uTUlEzY2.js";
-import { d as configFor, r as renderFiles, u as notNullTag } from "./render-5y5a1QZr.js";
+import { C as satisfies, S as peerVersions, c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, r as openSource, s as liteDriverOf, t as loadSnapshot, u as MetadataRejectedError } from "./snapshot-C6vh_n3t.js";
+import { d as configFor, r as renderFiles, u as notNullTag } from "./render-ChIwdIOJ.js";
 import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { i as request } from "./source-D2gJHKwC.js";
-import { T as providerLabel, i as migrationHolds, o as migrationModules, r as latestMigration, t as MODULES_SUFFIX, y as compiledReadSets } from "./module-migration-O_IxewFs.js";
-import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-9t5ec_N7.js";
+import { i as request } from "./source-BZbEK5if.js";
+import { T as providerLabel, i as migrationHolds, o as migrationModules, r as latestMigration, t as MODULES_SUFFIX, y as compiledReadSets } from "./module-migration-mKhX88V_.js";
+import { l as stdinDatabaseUrl, n as databaseUrl } from "./config-2rwFHbwj.js";
 import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-CncmQbO0.js";
 import { t as PROCESS_ENV } from "./env-DMgjB_4y.js";
 import { n as readStackStatus } from "./stack-status-B_Ipd_-z.js";
 import { t as connect } from "./db-CQCLx7cx.js";
-import { a as hasContentMapper, c as supportsContentMappers, i as contentMapperSetup$1, n as TSCONFIG_SNIPPET, o as needsRunExternalCode, t as RUN_EXTERNAL_CODE } from "./content-mapper-DCrz6OIv.js";
+import { a as hasContentMapper, c as supportsContentMappers, i as contentMapperSetup$1, n as TSCONFIG_SNIPPET, o as needsRunExternalCode, t as RUN_EXTERNAL_CODE } from "./content-mapper-DLbXilBz.js";
 import { c as insideRoot, i as changeLines, r as applyPlan } from "./files-CX71yBm8.js";
-import { C as splinterTables, S as advisorRule, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as appTablesOf, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$2, v as BLOCK_PREFIX, x as appViewsOf, y as blockTargets } from "./run-Bs4OKdDI.js";
-import { n as migrationsDir, r as moduleLayoutFor, t as blockDeclaredTables } from "./sql-layout-lUWenjJw.js";
-import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-BLqbvY2x.js";
-import { o as wiringFor, r as configInstances, t as MIGRATION_SAFETY_RULES } from "./migration-safety-BnnXPAro.js";
+import { C as splinterTables, S as advisorRule, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as appTablesOf, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$2, v as BLOCK_PREFIX, x as appViewsOf, y as blockTargets } from "./run-CLSHSVYo.js";
+import { n as migrationsDir, r as moduleLayoutFor, t as blockDeclaredTables } from "./sql-layout-26LSoifK.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-D0XBFSlz.js";
+import { o as wiringFor, r as configInstances, t as MIGRATION_SAFETY_RULES } from "./migration-safety-NtB3dsRU.js";
 import { t as orphanedBlockFiles } from "./orphans-BAboqyVM.js";
-import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-DGdLR41j.js";
-import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-BvWGM4c3.js";
+import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-MTLYpifA.js";
 import { i as PLUGIN_SUBPATH_RENAMES, n as BLOCK_SUBPATH_RENAMES, o as SPEC_SUBPATH_RENAMES, t as BLOCK_EXPORT_RENAMES } from "./codemod-block-renames-BuSaTE_G.js";
 import { n as PLATFORM_SCHEMAS } from "./in-stack-diff-DQTW53Vf.js";
 import { i as staleVariables, r as stackEnvValues, t as PREFIX_NAMES } from "./stack-env-6hS-WEmh.js";
 import { a as readSharedMemory, n as listStacks, t as branchName } from "./stacks-BYlQ96WS.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BfgHMe4q.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BNSdPuKp.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
-import { SECRET_COLUMNS, SQL_MODULES, TENANT_SCOPE_POLICY, adoptedTables, adoptedViews, blockFileState, blockSqlVersion, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, hasColumnAccess, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, notNullCheckName, renderBlocks, sameBlockFile, sameTenantColumn, sameTenantTrigger, scopePolicyName, sharedRolesProblems, subjectColumns, widenedCommands } from "better-supabase/sql";
+import { SECRET_COLUMNS, SQL_MODULES, TENANT_SCOPE_POLICY, adoptedTables, adoptedViews, appTablePolicyNotes, blockFileState, blockSqlVersion, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, hasColumnAccess, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, notNullCheckName, renderBlocks, sameBlockFile, sameTenantColumn, sameTenantTrigger, scopePolicyName, sharedRolesProblems, subjectColumns, widenedCommands } from "better-supabase/sql";
 import { defineBucket, parseSize } from "better-supabase/storage";
 //#region src/cli/doctor/env.ts
 const PUBLIC_PREFIXES = [
@@ -141,6 +141,166 @@ const ENV_RULES = [
 	}
 ];
 //#endregion
+//#region src/cli/doctor/module-files.ts
+/** The `blocks` files as this release renders them, next to what is on disk. */
+async function moduleFiles(context) {
+	if (context.config.blockNames.length === 0 && Object.keys(context.config.appTables).length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind === "invalid") return [];
+	const readSets = context.readSets;
+	const skipped = readSets !== void 0 && "skipped" in readSets;
+	let rendered;
+	try {
+		rendered = renderBlocks(context.config.blockNames, await moduleLayoutFor(context.config, {
+			names: context.config.blockNames,
+			testsDir: context.config.sql.testsDir,
+			readSets: skipped ? [] : readSets,
+			entitlementsProvider: entitlementsModule(context),
+			accessProvider: access.kind === "provider" ? access.access : void 0,
+			permissionCatalog: permissionCatalogKeys(context)
+		}));
+	} catch {
+		return [];
+	}
+	const files = rendered.filter((file) => !(skipped && file.module === "read-sets"));
+	if (workflowOf(context) === "migrations") {
+		const latest = await latestMigration(context.config, MODULES_SUFFIX);
+		const versions = migrationModules(latest?.text ?? "");
+		const path = latest?.path ?? `${migrationsDir(context.config)}/<stamp>_better_supabase_modules.sql`;
+		return Promise.all(files.map(async (file) => {
+			if (file.kind === "test") return fileState(context, file);
+			const installed = versions.get(file.instance ?? file.module);
+			return {
+				file,
+				path,
+				installed,
+				current: latest === void 0 ? void 0 : migrationHolds(latest.text, file.contents) ? file.contents : latest.text,
+				behind: file.kind === "schema" && installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+			};
+		}));
+	}
+	return Promise.all(files.map((file) => fileState(context, file)));
+}
+async function fileState(context, file) {
+	const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
+	const installed = current === void 0 ? void 0 : moduleFileVersion(current)?.version ?? 1;
+	return {
+		file,
+		path: file.path,
+		current,
+		installed,
+		behind: installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+	};
+}
+//#endregion
+//#region src/cli/doctor/app-table-policies.ts
+/**
+* Block policies (`bsb_*`, permissive) on the app's tables that grant a command
+* more than the app's own permissive policies do. Postgres ORs permissive
+* policies, so a block policy whose condition no app policy repeats can open
+* rows the app's policies keep closed. A command the app has no policy for is
+* the block's to grant.
+*/
+function widenedAppTablePolicies(context) {
+	const tables = adoptedTables(context.config.blocks, appTablesOf(context));
+	if (tables.length === 0) return [];
+	const modules = /* @__PURE__ */ new Map();
+	for (const table of tables) {
+		if (context.config.blocks[table.module]?.ownTablePolicies === "app") continue;
+		const target = `${table.schema}.${table.table}`;
+		modules.set(target, (modules.get(target) ?? /* @__PURE__ */ new Set()).add(table.module));
+	}
+	return catalogOf(context).tables.flatMap((table) => {
+		const target = qualified(table);
+		const owners = modules.get(target);
+		if (owners === void 0) return [];
+		const permissive = table.policies.filter((policy) => policy.permissive);
+		const own = permissive.filter((policy) => !policy.name.startsWith(BLOCK_PREFIX));
+		const blocks = [...owners].map((module) => `blocks.${module}`).join(" or ");
+		return permissive.filter((policy) => policy.name.startsWith(BLOCK_PREFIX)).flatMap((policy) => {
+			const widened = widenedCommands(policy, own);
+			if (widened.length === 0) return [];
+			const reason = `no policy of the app's for ${widened.join(", ")} reaches its roles with a condition it repeats (alone or with more "and" operands), so it can open rows the app's policies keep closed`;
+			return [{
+				message: `${blocks} adds policy ${policy.name} on ${target}, and ${reason}. Postgres ORs permissive policies; doctor compares conditions as text and can't prove that one implies another. If the block's condition is what the app means, repeat it in the app's policy; otherwise narrow the permission key it checks, drop ${policy.name} in a schema file that runs after the block's, or set ownTablePolicies: "app" on the block (or in database.sql) so the app's policies alone govern the table.`,
+				target: `${target}.${policy.name}`,
+				object: {
+					kind: "policy",
+					schema: table.schema,
+					table: table.name,
+					name: policy.name
+				}
+			}];
+		});
+	});
+}
+async function appTablesWithoutPolicies(context) {
+	const states = await moduleFiles(context);
+	const left = /* @__PURE__ */ new Map();
+	for (const { file } of states) {
+		if (file.kind !== "schema") continue;
+		for (const note of appTablePolicyNotes(file.contents)) {
+			const entry = left.get(note.table) ?? {
+				blocks: /* @__PURE__ */ new Set(),
+				commands: /* @__PURE__ */ new Set()
+			};
+			entry.blocks.add(`blocks.${file.instance ?? file.module}`);
+			for (const command of note.commands) entry.commands.add(command);
+			left.set(note.table, entry);
+		}
+	}
+	if (left.size === 0) return [];
+	return catalogOf(context).tables.flatMap((table) => {
+		const target = qualified(table);
+		const entry = left.get(target);
+		if (entry === void 0) return [];
+		const missing = [...entry.commands].filter((command) => !table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command)));
+		if (missing.length === 0) return [];
+		return [{
+			message: `${[...entry.blocks].join(" and ")} leaves the policies on ${target} to the app's (ownTablePolicies "app"), and ${target} ${table.rls ? "has row level security on" : "has row level security off, which the block's file turns on,"} but no permissive policy for ${missing.join(", ")}, which the block's own policies would have granted. Postgres then denies those commands to every caller, so the block's functions that run as the caller and its TypeScript API find no rows for them. Add the app's policy for each command the app uses, or set ownTablePolicies to "block" for this block.`,
+			target,
+			object: {
+				kind: "table",
+				schema: table.schema,
+				name: table.name
+			},
+			...missing.includes("select") ? {} : { severity: "info" }
+		}];
+	});
+}
+const KEPT_TRIGGER = /^-- (\S+) keeps updated_at current with its own trigger (\S+)\.$/gm;
+/**
+* App tables whose own trigger keeps `updated_at` current, so the block skipped
+* its `bsb_updated_at` trigger there.
+*/
+async function keptUpdatedAtTriggers(context) {
+	return (await moduleFiles(context)).flatMap(({ file }) => file.kind === "schema" ? [...file.contents.matchAll(KEPT_TRIGGER)].map(([, target = "", trigger = ""]) => {
+		const dot = target.indexOf(".");
+		return {
+			message: `blocks.${file.instance ?? file.module} runs over ${target}, which keeps updated_at current with its own trigger ${trigger}, so the block adds no bsb_updated_at trigger there. Keep ${trigger} firing on update; if you drop it, run \`better-supabase upgrade\` to add the block's.`,
+			target,
+			object: {
+				kind: "table",
+				schema: target.slice(0, dot),
+				name: target.slice(dot + 1)
+			}
+		};
+	}) : []);
+}
+/**
+* Whether a deprecated table or column name belongs to the app: the app's
+* tables keep the app's names, as custom blocks' tables do.
+*/
+function keepsAppsName(context) {
+	const adopted = context.config.blockNames.some((name) => moduleDeprecations().some((entry) => entry.module === name && (entry.kind === "table" || entry.kind === "column"))) ? adoptedTables(context.config.blocks, appTablesOf(context)) : [];
+	return (entry) => {
+		if (entry.kind !== "table" && entry.kind !== "column") return false;
+		if ((context.config.blocks[entry.module]?.mode ?? "managed") !== "managed") return true;
+		const name = entry.kind === "table" ? entry.symbol.slice(entry.symbol.lastIndexOf(".") + 1) : entry.symbol.slice(0, entry.symbol.indexOf("."));
+		return adopted.some((table) => table.module === entry.module && (name === table.logical || name === table.table || name === SQL_MODULES[table.module]?.names?.tables[table.logical]?.name));
+	};
+}
+//#endregion
 //#region src/cli/doctor/adoption.ts
 const tagText = (notNull) => notNull === true ? "@notNull" : `@notNull(${notNull.join(", ")})`;
 const sameNotNull = (a, b) => a === true || b === true ? a === b : a !== void 0 && a.length === b.length && a.every((name) => b.includes(name));
@@ -273,6 +433,13 @@ const ADOPTION_RULES = [
 			}));
 		}
 	},
+	{
+		code: "BS350",
+		severity: "warning",
+		title: "App table governs its policies but lacks one for a command",
+		description: "A block runs over a table of the app's with `ownTablePolicies: \"app\"`, so it adds none of its `bsb_` policies there, and the table has no permissive policy for a command one of those policies would have granted. With row level security on, or off (the block's file turns it on), Postgres denies that command to every caller, so the block's functions that run as the caller and its TypeScript API find no rows for it. A missing `select` policy is a warning, a missing write policy is info. Add the app's own policy for each command the app uses, or set `ownTablePolicies` back to `block` for the block.",
+		check: appTablesWithoutPolicies
+	},
 	{
 		code: "BS341",
 		severity: "warning",
@@ -1209,131 +1376,6 @@ function skippedForMetadata(snapshot, rule, help) {
 	};
 }
 //#endregion
-//#region src/cli/doctor/module-files.ts
-/** The `blocks` files as this release renders them, next to what is on disk. */
-async function moduleFiles(context) {
-	if (context.config.blockNames.length === 0 && Object.keys(context.config.appTables).length === 0) return [];
-	const access = accessModule(context);
-	if (access.kind === "invalid") return [];
-	const readSets = context.readSets;
-	const skipped = readSets !== void 0 && "skipped" in readSets;
-	let rendered;
-	try {
-		rendered = renderBlocks(context.config.blockNames, await moduleLayoutFor(context.config, {
-			names: context.config.blockNames,
-			testsDir: context.config.sql.testsDir,
-			readSets: skipped ? [] : readSets,
-			entitlementsProvider: entitlementsModule(context),
-			accessProvider: access.kind === "provider" ? access.access : void 0,
-			permissionCatalog: permissionCatalogKeys(context)
-		}));
-	} catch {
-		return [];
-	}
-	const files = rendered.filter((file) => !(skipped && file.module === "read-sets"));
-	if (workflowOf(context) === "migrations") {
-		const latest = await latestMigration(context.config, MODULES_SUFFIX);
-		const versions = migrationModules(latest?.text ?? "");
-		const path = latest?.path ?? `${migrationsDir(context.config)}/<stamp>_better_supabase_modules.sql`;
-		return Promise.all(files.map(async (file) => {
-			if (file.kind === "test") return fileState(context, file);
-			const installed = versions.get(file.instance ?? file.module);
-			return {
-				file,
-				path,
-				installed,
-				current: latest === void 0 ? void 0 : migrationHolds(latest.text, file.contents) ? file.contents : latest.text,
-				behind: file.kind === "schema" && installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
-			};
-		}));
-	}
-	return Promise.all(files.map((file) => fileState(context, file)));
-}
-async function fileState(context, file) {
-	const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
-	const installed = current === void 0 ? void 0 : moduleFileVersion(current)?.version ?? 1;
-	return {
-		file,
-		path: file.path,
-		current,
-		installed,
-		behind: installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
-	};
-}
-//#endregion
-//#region src/cli/doctor/app-table-policies.ts
-/**
-* Block policies (`bsb_*`, permissive) on the app's tables that grant a command
-* more than the app's own permissive policies do. Postgres ORs permissive
-* policies, so a block policy whose condition no app policy repeats can open
-* rows the app's policies keep closed. A command the app has no policy for is
-* the block's to grant.
-*/
-function widenedAppTablePolicies(context) {
-	const tables = adoptedTables(context.config.blocks, appTablesOf(context));
-	if (tables.length === 0) return [];
-	const modules = /* @__PURE__ */ new Map();
-	for (const table of tables) {
-		const target = `${table.schema}.${table.table}`;
-		modules.set(target, (modules.get(target) ?? /* @__PURE__ */ new Set()).add(table.module));
-	}
-	return catalogOf(context).tables.flatMap((table) => {
-		const target = qualified(table);
-		const owners = modules.get(target);
-		if (owners === void 0) return [];
-		const permissive = table.policies.filter((policy) => policy.permissive);
-		const own = permissive.filter((policy) => !policy.name.startsWith(BLOCK_PREFIX));
-		const blocks = [...owners].map((module) => `blocks.${module}`).join(" or ");
-		return permissive.filter((policy) => policy.name.startsWith(BLOCK_PREFIX)).flatMap((policy) => {
-			const widened = widenedCommands(policy, own);
-			if (widened.length === 0) return [];
-			const reason = `no policy of the app's for ${widened.join(", ")} reaches its roles with a condition it repeats (alone or with more "and" operands), so it can open rows the app's policies keep closed`;
-			return [{
-				message: `${blocks} adds policy ${policy.name} on ${target}, and ${reason}. Postgres ORs permissive policies; doctor compares conditions as text and can't prove that one implies another. If the block's condition is what the app means, repeat it in the app's policy; otherwise narrow the permission key it checks, or drop ${policy.name} in a schema file that runs after the block's.`,
-				target: `${target}.${policy.name}`,
-				object: {
-					kind: "policy",
-					schema: table.schema,
-					table: table.name,
-					name: policy.name
-				}
-			}];
-		});
-	});
-}
-const KEPT_TRIGGER = /^-- (\S+) keeps updated_at current with its own trigger (\S+)\.$/gm;
-/**
-* App tables whose own trigger keeps `updated_at` current, so the block skipped
-* its `bsb_updated_at` trigger there.
-*/
-async function keptUpdatedAtTriggers(context) {
-	return (await moduleFiles(context)).flatMap(({ file }) => file.kind === "schema" ? [...file.contents.matchAll(KEPT_TRIGGER)].map(([, target = "", trigger = ""]) => {
-		const dot = target.indexOf(".");
-		return {
-			message: `blocks.${file.instance ?? file.module} runs over ${target}, which keeps updated_at current with its own trigger ${trigger}, so the block adds no bsb_updated_at trigger there. Keep ${trigger} firing on update; if you drop it, run \`better-supabase upgrade\` to add the block's.`,
-			target,
-			object: {
-				kind: "table",
-				schema: target.slice(0, dot),
-				name: target.slice(dot + 1)
-			}
-		};
-	}) : []);
-}
-/**
-* Whether a deprecated table or column name belongs to the app: the app's
-* tables keep the app's names, as custom blocks' tables do.
-*/
-function keepsAppsName(context) {
-	const adopted = context.config.blockNames.some((name) => moduleDeprecations().some((entry) => entry.module === name && (entry.kind === "table" || entry.kind === "column"))) ? adoptedTables(context.config.blocks, appTablesOf(context)) : [];
-	return (entry) => {
-		if (entry.kind !== "table" && entry.kind !== "column") return false;
-		if ((context.config.blocks[entry.module]?.mode ?? "managed") !== "managed") return true;
-		const name = entry.kind === "table" ? entry.symbol.slice(entry.symbol.lastIndexOf(".") + 1) : entry.symbol.slice(0, entry.symbol.indexOf("."));
-		return adopted.some((table) => table.module === entry.module && (name === table.logical || name === table.table || name === SQL_MODULES[table.module]?.names?.tables[table.logical]?.name));
-	};
-}
-//#endregion
 //#region src/cli/doctor/attachment-subjects.ts
 /**
 * The attachments subjects as the block resolves them, with the per-subject
@@ -2093,7 +2135,7 @@ const MODULE_RULES = [
 		code: "BS347",
 		severity: "warning",
 		title: "Block policy widens an app table's access",
-		description: "A block runs over a table of the app's and adds its own permissive policy there, named `bsb_<table>_<command>` so it never replaces one of the app's. Postgres ORs permissive policies, so when the app has its own policies for that command and none has the same condition (or `true`) for the same roles, the block's policy can let a user reach rows the app's policies keep closed. A block condition that is the app's, or one of its `or` operands, with more `and` operands is narrower and isn't reported, nor is a command the app has no policy for, which is the block's to grant. Doctor compares the conditions as text. When an app policy covers the block's in this sense, `upgrade` leaves the block's policy out. Repeat the block's condition in the app's policy when it is what the app means; otherwise narrow the permission key the block checks, or drop the `bsb_` policy in a schema file that runs after the block's.",
+		description: "A block runs over a table of the app's and adds its own permissive policy there, named `bsb_<table>_<command>` so it never replaces one of the app's. Postgres ORs permissive policies, so when the app has its own policies for that command and none has the same condition (or `true`) for the same roles, the block's policy can let a user reach rows the app's policies keep closed. A block condition that is the app's, or one of its `or` operands, with more `and` operands is narrower and isn't reported, nor is a command the app has no policy for, which is the block's to grant. Doctor compares the conditions as text. When an app policy covers the block's in this sense, `upgrade` leaves the block's policy out. Repeat the block's condition in the app's policy when it is what the app means; otherwise narrow the permission key the block checks, drop the `bsb_` policy in a schema file that runs after the block's, or set `ownTablePolicies: \"app\"` on the block (or in `database.sql`) so the app's policies alone govern the table and the block adds none there.",
 		check: widenedAppTablePolicies
 	},
 	{

package/dist/cli/{gen-CFkYUnWq.js → gen-CeG6lbka.js}

@@ -1,21 +1,21 @@
 import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { a as parseNames, i as failedResult, n as CliError } from "./errors-BTe6A15O.js";
-import { u as catalogFingerprint } from "./cache-AznIssjI.js";
-import { a as serializeSnapshot, g as serializeGenerator, h as restrictSchemas, o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-uTUlEzY2.js";
-import { f as dataMigration } from "./module-migration-O_IxewFs.js";
-import { d as GEN_TASKS, p as isGenTask } from "./config-9t5ec_N7.js";
+import { u as catalogFingerprint } from "./cache-oU0yHKf0.js";
+import { a as serializeSnapshot, g as serializeGenerator, h as restrictSchemas, o as snapshotFile, r as openSource, t as loadSnapshot } from "./snapshot-C6vh_n3t.js";
+import { f as dataMigration } from "./module-migration-mKhX88V_.js";
+import { d as GEN_TASKS, p as isGenTask } from "./config-2rwFHbwj.js";
 import { c as insideRoot, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
-import { n as runGen } from "./run-Bs4OKdDI.js";
-import { t as syncModules } from "./sync-CZMRB3aU.js";
-import { t as addModules } from "./add-I8OW-qJH.js";
-import { n as listModules, t as printModule } from "./print-DosQIFSy.js";
-import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-IpJRJO5t.js";
-import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BfgHMe4q.js";
+import { n as runGen } from "./run-CLSHSVYo.js";
+import { t as syncModules } from "./sync-CHGMZCJ5.js";
+import { t as addModules } from "./add-BinNYhFD.js";
+import { n as listModules, t as printModule } from "./print-Dh8iuPK3.js";
+import { a as sourceFlags, i as sourceArgs, n as SOURCE_ARGS } from "./source-args-MTLYpifA.js";
+import { a as runMetadataGen, n as checkMetadataFlags, t as EMITS } from "./metadata-BNSdPuKp.js";
 import { a as runEnv } from "./env-BBl5L8Bf.js";
-import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-Cm2einTO.js";
-import { t as runSeed } from "./seed-Cz8PcXeT.js";
-import { t as upgrade } from "./upgrade-BFEIMC7U.js";
+import { c as watchLoop, o as parseInterval, r as specOptionsFromConfig, s as stampFiles, t as runSpec } from "./spec-B4LhpI6t.js";
+import { t as runSeed } from "./seed-CG-pA-5N.js";
+import { t as upgrade } from "./upgrade-C0dVsqNX.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/commands/sql.ts

package/dist/cli/index.d.ts

@@ -798,6 +798,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string, environment?: string, path?: string | undefined): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.16.0";
+export declare const VERSION = "0.17.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, Choice, Cli, CliArgs, CliCommand, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliLog, CliProblem, CliProblemExtensions, CommandResult, CreateCliOptions, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, Format, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, NextStep, Paint, Prompter, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };