better-supabase 0.17.0 → 0.18.0

package/dist/cli/powersync-D-0yV_L_.js

@@ -0,0 +1,283 @@
+import { p as commandMeta, r as defineCliCommand } from "./command-BWEEXmtz.js";
+import { c as layoutFor, i as stampAfter } from "./migrations-BoIyGczt.js";
+import { n as PLAN_ARGS, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";
+import { n as migrationsDir } from "./sql-layout-D8QrNvt4.js";
+import { existsSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { readFile, readdir } from "node:fs/promises";
+import { declaredColumnTypes, renderBlocks } from "better-supabase/sql";
+import { SPEC_PINS } from "better-supabase";
+//#region src/cli/powersync/streams.ts
+/** The blocks `gen.powersync` can sync. */
+const POWERSYNC_BLOCKS = ["notifications", "attachments"];
+const isPowerSyncBlock = (value) => POWERSYNC_BLOCKS.some((block) => block === value);
+const GENERATED = "@generated by better-supabase gen";
+const SAFE_IDENT = /^[a-z_][a-z0-9_]*$/;
+const ident = (name) => SAFE_IDENT.test(name) ? name : `"${name.replaceAll("\"", "\"\"")}"`;
+const qualifiedIdent = (qualified) => {
+	const dot = qualified.indexOf(".");
+	return `${ident(qualified.slice(0, dot))}.${ident(qualified.slice(dot + 1))}`;
+};
+const baseName = (qualified) => qualified.slice(qualified.indexOf(".") + 1);
+/** The PowerSync column type a Postgres type syncs as. */
+function powersyncColumnType(type) {
+	const base = type.replace(/\[\]$/, "").replace(/\(.*\)$/, "");
+	if (/^(?:smallint|integer|int|int2|int4|int8|bigint|boolean|bool|smallserial|serial|bigserial)$/.test(base) && !type.endsWith("[]")) return "integer";
+	if (/^(?:real|double precision|float4|float8|numeric|decimal)$/.test(base) && !type.endsWith("[]")) return "real";
+	return "text";
+}
+const CREATE_TABLE = /create table (?:if not exists )?("(?:[^"]|"")+"|[a-z_][a-z0-9_$]*)\./gi;
+const unquote = (name) => name.startsWith("\"") ? name.slice(1, -1).replaceAll("\"\"", "\"") : name;
+function tablesOf(input, key) {
+	const files = input.files.flatMap((file) => file.kind === "schema" && (file.instance ?? file.module) === key ? [{ text: file.contents }] : []);
+	const schemas = new Set(files.flatMap(({ text }) => [...text.matchAll(CREATE_TABLE)].map((match) => unquote(match[1]))));
+	return declaredColumnTypes(files, [...schemas]);
+}
+/** The table of `tables` that has every one of `columns`. */
+function tableWith(tables, columns, what) {
+	const found = [...tables].find(([, declared]) => columns.every((column) => declared.has(column)));
+	if (found === void 0) throw new Error(`gen.powersync: found no ${what} table`);
+	return found;
+}
+function notificationTables(input, instance) {
+	const tables = tablesOf(input, instance.key);
+	const [recipients, recipientColumns] = tableWith(tables, [
+		"event_id",
+		"user_id",
+		"read_at",
+		"dismissed_at"
+	], `${instance.key} recipients`);
+	const [events, eventColumns] = tableWith(tables, [
+		"type",
+		"idempotency_key",
+		"summary"
+	], `${instance.key} events`);
+	const mine = `${qualifiedIdent(recipients)} WHERE user_id = auth.user_id()`;
+	return [{
+		qualified: recipients,
+		name: baseName(recipients),
+		stream: `${instance.key}_recipients`,
+		query: `SELECT * FROM ${mine}`,
+		columns: recipientColumns
+	}, {
+		qualified: events,
+		name: baseName(events),
+		stream: `${instance.key}_events`,
+		query: `SELECT * FROM ${qualifiedIdent(events)} WHERE id IN (SELECT event_id FROM ${mine})`,
+		columns: eventColumns
+	}];
+}
+function attachmentTables(input, instance) {
+	const [attachments, columns] = tableWith(tablesOf(input, instance.key), [
+		"bucket",
+		"object_path",
+		"uploaded_by"
+	], `${instance.key} attachments`);
+	const memberships = [...tablesOf(input, "memberships")].find(([, declared]) => declared.has("user_id") && declared.has("role"));
+	if (memberships === void 0) throw new Error(`gen.powersync: ${instance.key} syncs the files of the user's organizations, which needs the memberships block`);
+	const [membershipTable, membershipColumns] = memberships;
+	const tenant = [...columns.keys()].find((column) => column.endsWith("_id") && column !== "user_id" && membershipColumns.has(column));
+	if (tenant === void 0) throw new Error(`gen.powersync: ${instance.key} and memberships share no organization column`);
+	return [{
+		qualified: attachments,
+		name: baseName(attachments),
+		stream: instance.key,
+		query: `SELECT * FROM ${qualifiedIdent(attachments)} WHERE ${ident(tenant)} IN (SELECT ${ident(tenant)} FROM ${qualifiedIdent(membershipTable)} WHERE user_id = auth.user_id())`,
+		columns
+	}];
+}
+function syncedTables(input, instance) {
+	switch (instance.block) {
+		case "notifications": return notificationTables(input, instance);
+		case "attachments": return attachmentTables(input, instance);
+		default: {
+			const unknown = instance.block;
+			throw new Error(`gen.powersync: ${String(unknown)} can't sync`);
+		}
+	}
+}
+const yamlString = (text) => JSON.stringify(text);
+function streamsYaml(tables) {
+	const streams = tables.flatMap((table) => [
+		`  ${table.stream}:`,
+		"    auto_subscribe: true",
+		`    query: ${yamlString(table.query)}`
+	]);
+	return [
+		`# ${GENERATED}. Do not edit; run \`better-supabase gen\` instead.`,
+		"config:",
+		`  edition: ${SPEC_PINS.powersyncSyncStreams}`,
+		"",
+		"streams:",
+		...streams,
+		""
+	].join("\n");
+}
+function publicationSql(tables) {
+	const names = tables.map((table) => `('${table.qualified.replaceAll("'", "''")}')`).join(", ");
+	return `-- ${GENERATED}: the block tables PowerSync replicates.
+do $$
+declare
+  t record;
+begin
+  if not exists (select 1 from pg_publication where pubname = 'powersync') then
+    create publication powersync;
+  end if;
+
+  for t in
+    select n.nspname as schema_name, c.relname as table_name
+    from (values ${names}) as wanted (name)
+    join pg_class c on c.oid = wanted.name::regclass
+    join pg_namespace n on n.oid = c.relnamespace
+    where not exists (
+      select 1 from pg_publication_tables p
+      where p.pubname = 'powersync' and p.schemaname = n.nspname and p.tablename = c.relname
+    )
+  loop
+    execute format('alter publication powersync add table %I.%I', t.schema_name, t.table_name);
+  end loop;
+end;
+$$;
+`;
+}
+const propertyName = (name) => /^[A-Za-z_$][\w$]*$/.test(name) ? name : JSON.stringify(name);
+function schemaModule(tables, importFrom) {
+	const definitions = tables.map((table) => {
+		const columns = [...table.columns].filter(([column]) => column !== "id").map(([column, type]) => `  ${propertyName(column)}: column.${powersyncColumnType(type)},`);
+		return [
+			`export const ${table.name} = new Table({`,
+			...columns,
+			"});"
+		].join("\n");
+	});
+	return [
+		`// ${GENERATED}. Do not edit; run \`better-supabase gen\` instead.`,
+		"",
+		`import { column, Table } from ${JSON.stringify(importFrom)};`,
+		"",
+		...definitions.flatMap((definition) => [definition, ""]),
+		"/** The block tables, to spread into the app's `new Schema({ ... })`. */",
+		`export const blockTables = { ${tables.map((table) => table.name).join(", ")} };`,
+		""
+	].join("\n");
+}
+/** The sync streams, publication and PowerSync schema for `input.instances`. */
+function powersyncOutput(input) {
+	const byInstance = input.instances.map((instance) => [instance.key, syncedTables(input, instance)]);
+	const tables = byInstance.flatMap(([, synced]) => synced);
+	return {
+		streams: streamsYaml(tables),
+		publication: publicationSql(tables),
+		schema: schemaModule(tables, input.importFrom),
+		tables: Object.fromEntries(byInstance.map(([key, synced]) => [key, synced.map(({ name }) => name)]))
+	};
+}
+//#endregion
+//#region src/cli/commands/powersync.ts
+const ARGS = {
+	instance: {
+		type: "string",
+		description: "Block instances to sync, comma separated. Defaults to gen.powersync.instances",
+		valueHint: "keys"
+	},
+	out: {
+		type: "string",
+		description: "Folder for sync-streams.yaml and schema.ts. Defaults to gen.powersync.out, then powersync",
+		valueHint: "dir"
+	},
+	...PLAN_ARGS
+};
+const PUBLICATION_SUFFIX = "_powersync_publication.sql";
+const REGENERATE = "better-supabase powersync streams";
+function instancesOf(config, keys) {
+	const instances = [];
+	for (const key of keys) {
+		const block = config.instances[key]?.block;
+		if (block === void 0) return `${key} is not a block in the config.`;
+		if (!isPowerSyncBlock(block)) return `${key} installs ${block}, which can't sync yet. PowerSync syncs ${POWERSYNC_BLOCKS.join(" and ")}.`;
+		instances.push({
+			key,
+			block
+		});
+	}
+	return instances;
+}
+/**
+* The publication migration, unless the newest one already adds these tables: a
+* pushed migration is never rewritten, so a change gets a new one.
+*/
+async function publicationMigration(config, sql, now) {
+	const dir = resolve(config.root, migrationsDir(config));
+	const names = existsSync(dir) ? (await readdir(dir)).toSorted() : [];
+	const latest = names.findLast((name) => name.endsWith(PUBLICATION_SUFFIX));
+	if (latest !== void 0 && await readFile(join(dir, latest), "utf-8") === sql) return;
+	return {
+		path: join(dir, `${stampAfter(names, now())}${PUBLICATION_SUFFIX}`),
+		contents: sql,
+		policy: "create",
+		note: "adds the tables to the powersync publication"
+	};
+}
+/**
+* Writes `sync-streams.yaml` and `schema.ts` for the synced block instances,
+* and a migration that adds their tables to the `powersync` publication.
+*/
+async function runPowerSync(config, args, now = () => /* @__PURE__ */ new Date()) {
+	const settings = config.gen.powersync;
+	const keys = args.instance === void 0 ? settings?.instances ?? [] : args.instance.split(",").map((key) => key.trim()).filter(Boolean);
+	if (keys.length === 0) return {
+		code: 1,
+		errorCode: "config_invalid",
+		error: "Name the block instances to sync: set gen.powersync.instances, or pass --instance notifications."
+	};
+	const instances = instancesOf(config, keys);
+	if (typeof instances === "string") return {
+		code: 1,
+		errorCode: "config_invalid",
+		error: instances
+	};
+	const layout = await layoutFor(config, {}, config.blockNames);
+	let output;
+	try {
+		output = powersyncOutput({
+			files: renderBlocks(config.blockNames, layout),
+			instances,
+			importFrom: settings?.import ?? "@powersync/common"
+		});
+	} catch (cause) {
+		return {
+			code: 1,
+			errorCode: "config_invalid",
+			error: cause instanceof Error ? cause.message : String(cause)
+		};
+	}
+	const out = resolve(config.root, args.out ?? settings?.out ?? "powersync");
+	const migration = await publicationMigration(config, output.publication, now);
+	const plan = {
+		root: config.root,
+		regenerate: REGENERATE,
+		files: [
+			{
+				path: join(out, "sync-streams.yaml"),
+				contents: output.streams
+			},
+			{
+				path: join(out, "schema.ts"),
+				contents: output.schema
+			},
+			...migration === void 0 ? [] : [migration]
+		]
+	};
+	const applied = await applyPlan(plan, args);
+	return planResult(plan, applied, { data: {
+		instances: keys,
+		tables: output.tables
+	} });
+}
+const powersyncStreamsCommand = defineCliCommand({
+	meta: commandMeta("powersync streams"),
+	args: ARGS,
+	run: (args, { config }) => runPowerSync(config, args)
+});
+//#endregion
+export { runPowerSync as n, powersyncStreamsCommand as t };

package/dist/cli/powersync-DXVsKkAu.js

@@ -0,0 +1 @@
+export { t as powersyncStreamsCommand } from "./powersync-D-0yV_L_.js";

package/dist/cli/{print-Dh8iuPK3.js → print-CRon4lXf.js}

@@ -1,5 +1,6 @@
 import { n as CliError } from "./errors-BTe6A15O.js";
-import { g as layout, o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-mKhX88V_.js";
+import { s as layout } from "./migrations-BoIyGczt.js";
+import { o as migrationModules, r as latestMigration, u as writesMigrations } from "./module-migration-DXvo0EqU.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { SQL_MODULES, contractSignature, customContracts, moduleBody, moduleFilePaths } from "better-supabase/sql";

package/dist/cli/{remove-DfFXVBRr.js → remove-D89s99ha.js}

@@ -1,16 +1,16 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-BWEEXmtz.js";
 import { i as plain } from "./style-Bm2X5JrN.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { r as readIfExists, t as display } from "./io-DH1kcmmP.js";
-import { _ as layoutFor } from "./module-migration-mKhX88V_.js";
+import { c as layoutFor } from "./migrations-BoIyGczt.js";
 import { i as changeLines, n as PLAN_ARGS, r as applyPlan, t as HAND_EDITED, u as planResult } from "./files-CX71yBm8.js";
-import { a as sqlPlan } from "./sql-layout-26LSoifK.js";
-import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-DMcrsWjC.js";
+import { a as sqlPlan } from "./sql-layout-D8QrNvt4.js";
+import { g as templateContextFor, i as blocksWiringPath, n as blockClients } from "./add-B1S3yK4L.js";
 import { t as detectProject } from "./detect-D9JaAX20.js";
 import { _ as wiringBlocks, a as configObject, c as mask, i as closingIndex, l as properties } from "./config-edit-CrWfk8s3.js";
-import { n as guardedRemoval } from "./sync-CHGMZCJ5.js";
+import { n as guardedRemoval } from "./sync-s1iKFIos.js";
 import { t as SQL_ARGS } from "./args-UEwg0l-N.js";
-import { t as blockNames } from "./blocks-DSgTifw0.js";
+import { t as blockNames } from "./blocks-DDm1Zc2S.js";
 import { i as tidyInline, t as cutRange } from "./config-group-C8tjut39.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/cli/{render-ChIwdIOJ.js → render-BJF9ytUi.js}

@@ -1,10 +1,10 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
 import { n as importPath } from "./io-DH1kcmmP.js";
-import { i as cachedTypesModule, n as cachedDatabaseTypes, s as typesModuleKey } from "./cache-oU0yHKf0.js";
+import { i as cachedTypesModule, n as cachedDatabaseTypes, s as typesModuleKey } from "./cache-DE2IH1-C.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { f as generateDatabaseTypes, h as restrictSchemas, p as oxfmtInstalled, v as tsTypeOf } from "./snapshot-C6vh_n3t.js";
+import { f as generateDatabaseTypes, h as restrictSchemas, p as oxfmtInstalled, v as tsTypeOf } from "./snapshot-BXmU3IXN.js";
 import { t as isRecord$1 } from "./guards-CUlDNYZs.js";
-import { a as toCatalog } from "./source-BZbEK5if.js";
+import { a as toCatalog } from "./source-irttnsEb.js";
 import { basename, dirname, isAbsolute, join, posix, relative, resolve } from "node:path";
 import { entityNames } from "better-supabase/blocks";
 import { DEFAULT_CLAIMS, blockEntities, blockEntityRenames, blockSubjectTypes, tenantClaimPaths, tenantNameOf } from "better-supabase/config";
@@ -1727,13 +1727,14 @@ function renamedBlockLines(entries) {
 * `defineBlocks(blockConfig, blocks)`. A renamed instance uses its renamed
 * constant; the others import their block.
 */
-function instanceMapLines(entries, renamed) {
+function instanceMapLines(entries, renamed, synced) {
 	const imported = /* @__PURE__ */ new Map();
 	const members = [];
 	for (const [instance, entry] of Object.entries(entries)) {
 		const manifest = MANIFESTS.get(entry.block ?? instance);
 		const client = manifest?.client;
 		if (manifest === void 0 || client === void 0 || client === null) continue;
+		if (synced !== void 0 && !synced.has(instance)) members.push("  /** Needs the network on native. */");
 		const constant = renamed.get(instance);
 		if (constant !== void 0) {
 			members.push(`  ${prop(instance)}: ${constant},`);
@@ -1760,6 +1761,7 @@ function instanceMapLines(entries, renamed) {
 			" * Every installed block instance with a client, under its key, for",
 			" * `defineBlocks(blockConfig, { ...blocks, ... })`. Override an entry to give",
 			" * a block its ports (`notifications: notificationsBlock.using(...)`).",
+			...synced === void 0 ? [] : [" * Instances outside `gen.powersync.instances` call the Data API, so", " * their hooks need the network on native."],
 			" * @public",
 			" */",
 			"export const blocks = {",
@@ -1813,7 +1815,8 @@ function emitBlockConfig(config, options = {}) {
 	const runtime = options.runtimeImport ?? "better-supabase";
 	const renamed = renamedBlockLines(entries);
 	const constants = nameConstantLines(config, entries);
-	const instances = instanceMapLines(entries, renamed.constants);
+	const synced = config.gen.powersync?.instances;
+	const instances = instanceMapLines(entries, renamed.constants, synced === void 0 ? void 0 : new Set(synced));
 	const specifiers = [
 		...events.length === 0 ? [] : [
 			"type AppTableEventData",

package/dist/cli/{run-BXx6D1aR.js → run-DmOTMa44.js}

@@ -1,9 +1,9 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-BWEEXmtz.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { t as PROCESS_ENV } from "./env-DMgjB_4y.js";
 import { n as spawnInherited } from "./exec--Q1ZEWUW.js";
 import { i as staleVariables } from "./stack-env-6hS-WEmh.js";
-import { i as readStackEnv } from "./env-BBl5L8Bf.js";
+import { i as readStackEnv } from "./env-BCgVZkcb.js";
 //#region src/cli/commands/run.ts
 const ARGS = {
 	prefix: {

package/dist/cli/{run-CLSHSVYo.js → run-jeplMBOK.js}

@@ -1,17 +1,19 @@
 import { r as errorText } from "./errors-BTe6A15O.js";
 import { a as sameText, t as display } from "./io-DH1kcmmP.js";
-import { c as writeAtomic, o as storeTypesModule, s as typesModuleKey, t as CACHE_DIR } from "./cache-oU0yHKf0.js";
+import { c as writeAtomic, o as storeTypesModule, s as typesModuleKey, t as CACHE_DIR } from "./cache-DE2IH1-C.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { _ as stabilizeMetadata, b as typegenVersionNotice, p as oxfmtInstalled, t as loadSnapshot, y as typegenVersion } from "./snapshot-C6vh_n3t.js";
-import { n as render } from "./render-ChIwdIOJ.js";
-import { C as entitlementsMode, E as unsafeKey, S as entitlementRequirements, T as providerLabel, b as accessProviderMode, c as sameModuleMigration, l as writeLatestMigration, n as READ_SETS_SUFFIX, r as latestMigration, u as writesMigrations, w as moduleKeyProblems, x as accessRequirements, y as compiledReadSets } from "./module-migration-mKhX88V_.js";
-import { s as schemaStampPath } from "./content-mapper-DLbXilBz.js";
+import { _ as stabilizeMetadata, b as typegenVersionNotice, p as oxfmtInstalled, t as loadSnapshot, y as typegenVersion } from "./snapshot-BXmU3IXN.js";
+import { n as render } from "./render-BJF9ytUi.js";
+import { _ as unsafeKey, d as accessProviderMode, f as accessRequirements, g as providerLabel, h as moduleKeyProblems, m as entitlementsMode, p as entitlementRequirements, u as compiledReadSets } from "./migrations-BoIyGczt.js";
+import { s as schemaStampPath } from "./content-mapper-CaygHH_k.js";
 import { a as changedFiles, d as fileDiff, i as changeLines, r as applyPlan, s as hasConflicts } from "./files-CX71yBm8.js";
-import { n as migrationsDir, o as writtenByBlocks } from "./sql-layout-26LSoifK.js";
-import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-D0XBFSlz.js";
+import { n as migrationsDir, o as writtenByBlocks } from "./sql-layout-D8QrNvt4.js";
+import { l as tableObject, n as exposed, o as policyObject, s as qualified, t as catalogOf } from "./shared-B38Chjgd.js";
+import { c as sameModuleMigration, l as writeLatestMigration, n as READ_SETS_SUFFIX, r as latestMigration, u as writesMigrations } from "./module-migration-DXvo0EqU.js";
 import { existsSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { readFile } from "node:fs/promises";
+import { DEFAULT_ACTIVE_TENANT } from "better-supabase/config";
 import { SQL_MODULES, adoptedTables, declaredTables, moduleHidingColumns, moduleLayout, modulePermissionKeys, renderBlocks, resolveBlocks, sameBlockFile } from "better-supabase/sql";
 //#region src/cli/doctor/advisor-rules.ts
 /**
@@ -654,6 +656,11 @@ const TEMPLATE_EFFECT = {
 	isPlatformFor: "their checks of another user's platform permissions (platform_can) answer false or are skipped",
 	canAssignFor: "better_supabase.can_assign_as is not written and the inviter's right to assign the role is not checked again when the invitation is accepted"
 };
+function activeTenantLabel(source) {
+	if (source === "claim") return "the app_metadata claim";
+	if (source === "resolver") return "the request (the tenant resolver)";
+	return `the profile column ${source.profileColumn}`;
+}
 /** The optional templates installed modules call that the provider doesn't set. */
 function missingTemplates(context, provider) {
 	const installed = new Set(context.config.blockNames);
@@ -935,7 +942,7 @@ const AUTHORIZATION_RULES = [
 		code: "BS409",
 		severity: "warning",
 		title: "The authorization provider and the better-supabase config disagree",
-		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `auth.organization.claim` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `auth.claims.scope` is neither `tenant` nor the provider's tenant scope, notes when the provider sets `suspension` or `roleSources` but `blocks.permissions.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
+		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `auth.organization.claim` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `auth.claims.scope` is neither `tenant` nor the provider's tenant scope, warns when the provider's `tokenHook.activeOrganizationFrom` differs from `blocks.permissions.activeTenant` (where `switch_organization` writes the active organization), notes when the provider sets `suspension` or `roleSources` but `blocks.permissions.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
 		check: (context) => {
 			const provider = context.config.authorization;
 			if (!provider) return [];
@@ -949,6 +956,12 @@ const AUTHORIZATION_RULES = [
 				message: `The hook of ${label} writes the active tenant to "${tenantClaim}", but auth.organization.claim is "${context.config.claims.tenant}". Set auth.organization.claim to "${tenantClaim}", or change the provider's tenant claim.`,
 				target: "claims.tenant"
 			});
+			const readsFrom = provider.tokenHook?.activeOrganizationFrom;
+			const writesTo = context.config.blocks.permissions?.activeTenant ?? DEFAULT_ACTIVE_TENANT;
+			if (readsFrom !== void 0 && activeTenantLabel(readsFrom) !== activeTenantLabel(writesTo)) findings.push({
+				message: `The hook of ${label} reads the active organization from ${activeTenantLabel(readsFrom)}, but switch_organization writes it to ${activeTenantLabel(writesTo)} (blocks.permissions.activeTenant), so switching never changes the token. Set blocks.permissions.activeTenant to match the provider.`,
+				target: "blocks.permissions.activeTenant"
+			});
 			const scope = context.config.claims.scope;
 			if (scope !== "tenant" && scope !== provider.tenantScope) findings.push({
 				severity: "info",
@@ -969,7 +982,7 @@ const AUTHORIZATION_RULES = [
 		code: "BS411",
 		severity: "error",
 		title: "The provider access model can't use the authorization provider",
-		description: "With `blocks.permissions.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `blocks.permissions.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter).",
+		description: "With `blocks.permissions.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `blocks.permissions.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter). It also warns when `blocks.memberships.options.roles.many` is on and none of the provider's `memberships` names a `rolesTable`, since the provider then sees one role per member.",
 		check: (context) => {
 			const mode = accessModule(context);
 			if (mode.kind === "off") return [];
@@ -992,6 +1005,12 @@ const AUTHORIZATION_RULES = [
 				message: `Neither blocks.permissions.functions.canAssign nor ${providerLabel(provider)} sets canAssign, so under the provider model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes. Use a provider that sets authorization.functions.canAssign, or set blocks.permissions.functions.canAssign.`,
 				target: "blocks.permissions.functions.canAssign"
 			});
+			const roles = context.config.blocks["memberships"]?.options?.["roles"];
+			if (typeof roles === "object" && roles !== null && "many" in roles && roles.many === true && (provider.memberships ?? []).length > 0 && !(provider.memberships ?? []).some((membership) => membership.rolesTable !== void 0)) findings.push({
+				severity: "warning",
+				message: `blocks.memberships.options.roles.many keeps several roles per member in better_supabase.membership_roles, but ${providerLabel(provider)} reads one role per membership: none of its authorization.memberships sets rolesTable. A member's extra roles then grant nothing through the provider. Use a provider that reads the role set, or turn roles.many off.`,
+				target: "blocks.memberships.options.roles"
+			});
 			findings.push(...missingTemplates(context, provider));
 			return findings;
 		}
@@ -1140,7 +1159,7 @@ function templateCalls(template) {
 	return [...withoutStrings(template).matchAll(TEMPLATE_CALL)].map((match) => `${match[1]}.${match[2]}`.replaceAll("\"", "").toLowerCase());
 }
 const CONTRACT_CALL = /\bbetter_supabase"?\s*\.\s*"?(can|tenant_ids_with)"?\s*\(/gi;
-const ROLE_HELPER_CALL = /\bbetter_supabase"?\s*\.\s*"?(member_organization_ids|has_organization_role|organization_member_role)"?\s*\(/gi;
+const ROLE_HELPER_CALL = /\bbetter_supabase"?\s*\.\s*"?(member_organization_ids|has_organization_role|organization_member_roles?)"?\s*\(/gi;
 /** The tenant role helpers `text` calls, outside string literals. */
 function roleHelperCalls(text) {
 	const names = /* @__PURE__ */ new Set();

package/dist/cli/{run-D48ZEU58.js → run-x9ZY4Tm0.js}

@@ -1,10 +1,10 @@
-import { c as COMMANDS, d as GROUPS, f as RESERVED_NAMES, h as runCommand, i as joinRepeated, m as parseArgs$2, o as listArgs, s as runsWithInvalidConfig, t as GLOBAL_ARGS, u as DOCS_ORIGIN } from "./command-CQ61x6gN.js";
+import { c as COMMANDS, d as GROUPS, f as RESERVED_NAMES, h as runCommand, i as joinRepeated, m as parseArgs$2, o as listArgs, s as runsWithInvalidConfig, t as GLOBAL_ARGS, u as DOCS_ORIGIN } from "./command-BWEEXmtz.js";
 import { n as highlight, r as painter } from "./style-Bm2X5JrN.js";
-import { t as VERSION } from "./version-T507a49w.js";
+import { t as VERSION } from "./version-TgFM8sOd.js";
 import { n as CliError, o as toCliError } from "./errors-BTe6A15O.js";
 import { a as missingInputNext, o as resolveAgent, t as checkConsent } from "./agent-CbuPvI2x.js";
-import { a as globalFlags, c as resolveCommand, i as commandTree, n as closestName, o as isVariadic, r as commandArgs, t as checkArgs } from "./parse-B9Iv_-Pf.js";
-import { n as movedCommand, r as movedFlag } from "./moved-CsfDQcyk.js";
+import { a as globalFlags, c as resolveCommand, i as commandTree, n as closestName, o as isVariadic, r as commandArgs, t as checkArgs } from "./parse-B079x40m.js";
+import { n as movedCommand, r as movedFlag } from "./moved-DVwgE8lV.js";
 import { n as HTTP_CHANNEL, t as EXEC_CHANNEL } from "./trace-VbdO6bcN.js";
 import { stripVTControlCharacters } from "node:util";
 import { subscribe, unsubscribe } from "node:diagnostics_channel";
@@ -16,37 +16,38 @@ import { resolve } from "node:path";
 * loads on demand, so `--version` and `--help` import no command.
 */
 const LOADERS = [
-	["init", () => import("./init-DrQlf9RL.js").then((m) => m.initCommand)],
-	["add", () => import("./add-z-3pXI6C.js").then((m) => m.addCommand)],
-	["remove", () => import("./remove-DfFXVBRr.js").then((m) => m.removeCommand)],
-	["upgrade", () => import("./upgrade-GB9rqUGT.js").then((m) => m.upgradeCommand)],
-	["gen", () => import("./gen-CeG6lbka.js").then((m) => m.genCommand)],
-	["doctor", () => import("./doctor-CKt5Yyl4.js").then((m) => m.doctorCommand)],
-	["db query", () => import("./db-Bwrr3GHM.js").then((m) => m.dbQueryCommand)],
-	["db diff", () => import("./db-Bwrr3GHM.js").then((m) => m.dbDiffCommand)],
-	["db seed", () => import("./seed-CUxW5Dks.js").then((m) => m.seedCommand)],
-	["db backfill", () => import("./backfill-DxBB62Zr.js").then((m) => m.dbBackfillCommand)],
-	["dev env", () => import("./env-CAU1nknN.js").then((m) => m.envCommand)],
-	["dev run", () => import("./run-BXx6D1aR.js").then((m) => m.runCommand)],
-	["dev keys", () => import("./keys-DGEpMbeB.js").then((m) => m.keysCommand)],
-	["dev stack ls", () => import("./stack-CWEHdO0b.js").then((m) => m.stackLsCommand)],
-	["dev stack prune", () => import("./stack-CWEHdO0b.js").then((m) => m.stackPruneCommand)],
-	["blocks list", () => import("./blocks-rxOS-Mzz.js").then((m) => m.blocksListCommand)],
-	["blocks view", () => import("./blocks-rxOS-Mzz.js").then((m) => m.blocksViewCommand)],
-	["blocks search", () => import("./blocks-rxOS-Mzz.js").then((m) => m.blocksSearchCommand)],
-	["spec emit", () => import("./spec-C-dhdKwa.js").then((m) => m.specEmitCommand)],
-	["spec validate", () => import("./spec-C-dhdKwa.js").then((m) => m.specValidateCommand)],
-	["mcp", () => import("./mcp-BrOnGB15.js").then((m) => m.mcpCommand)],
-	["skills list", () => import("./skills-toUan_OV.js").then((m) => m.skillsListCommand)],
-	["skills install", () => import("./skills-toUan_OV.js").then((m) => m.skillsInstallCommand)],
-	["codemod 0.4", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.4"))],
-	["codemod 0.5", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.5"))],
-	["codemod 0.6", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.6"))],
-	["codemod 0.9", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.9"))],
-	["codemod 0.11", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.11"))],
-	["codemod 0.15", () => import("./codemod-Dsrv_3gQ.js").then((m) => m.codemodCommand("0.15"))],
-	["completion", () => import("./completion-BwI0_Ap5.js").then((m) => m.completionCommand)],
-	["config", () => import("./config-CPux9Wa7.js").then((m) => m.configCommand)]
+	["init", () => import("./init-ch-HWJyp.js").then((m) => m.initCommand)],
+	["add", () => import("./add-BQPJnapO.js").then((m) => m.addCommand)],
+	["remove", () => import("./remove-D89s99ha.js").then((m) => m.removeCommand)],
+	["upgrade", () => import("./upgrade-CluxP3JJ.js").then((m) => m.upgradeCommand)],
+	["gen", () => import("./gen-D7gMEwvg.js").then((m) => m.genCommand)],
+	["doctor", () => import("./doctor-D_nrsd9E.js").then((m) => m.doctorCommand)],
+	["db query", () => import("./db-DYU5hUcd.js").then((m) => m.dbQueryCommand)],
+	["db diff", () => import("./db-DYU5hUcd.js").then((m) => m.dbDiffCommand)],
+	["db seed", () => import("./seed-EPO6AvLG.js").then((m) => m.seedCommand)],
+	["db backfill", () => import("./backfill-BwkyNhlC.js").then((m) => m.dbBackfillCommand)],
+	["dev env", () => import("./env-xhwXk5Ri.js").then((m) => m.envCommand)],
+	["dev run", () => import("./run-DmOTMa44.js").then((m) => m.runCommand)],
+	["dev keys", () => import("./keys-CbaL0lnw.js").then((m) => m.keysCommand)],
+	["dev stack ls", () => import("./stack-DgASZP0K.js").then((m) => m.stackLsCommand)],
+	["dev stack prune", () => import("./stack-DgASZP0K.js").then((m) => m.stackPruneCommand)],
+	["blocks list", () => import("./blocks-CBqENu3C.js").then((m) => m.blocksListCommand)],
+	["blocks view", () => import("./blocks-CBqENu3C.js").then((m) => m.blocksViewCommand)],
+	["blocks search", () => import("./blocks-CBqENu3C.js").then((m) => m.blocksSearchCommand)],
+	["powersync streams", () => import("./powersync-DXVsKkAu.js").then((m) => m.powersyncStreamsCommand)],
+	["spec emit", () => import("./spec-DzD5wMVF.js").then((m) => m.specEmitCommand)],
+	["spec validate", () => import("./spec-DzD5wMVF.js").then((m) => m.specValidateCommand)],
+	["mcp", () => import("./mcp-P9RP2SJ3.js").then((m) => m.mcpCommand)],
+	["skills list", () => import("./skills-FXAVPLzp.js").then((m) => m.skillsListCommand)],
+	["skills install", () => import("./skills-FXAVPLzp.js").then((m) => m.skillsInstallCommand)],
+	["codemod 0.4", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.4"))],
+	["codemod 0.5", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.5"))],
+	["codemod 0.6", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.6"))],
+	["codemod 0.9", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.9"))],
+	["codemod 0.11", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.11"))],
+	["codemod 0.15", () => import("./codemod-OHKhVV-v.js").then((m) => m.codemodCommand("0.15"))],
+	["completion", () => import("./completion-BfnKI4QZ.js").then((m) => m.completionCommand)],
+	["config", () => import("./config-WKDixoGK.js").then((m) => m.configCommand)]
 ];
 /** The built-in commands, for `createCli`. */
 function builtinCommands() {
@@ -465,7 +466,7 @@ function cliFromTree(init, extra = {}) {
 		};
 		if (argv[0] === "__complete") {
 			const words = argv[1] === "--" ? argv.slice(2) : argv.slice(1);
-			const lines = await import("./completion-Dlu5AdUW.js").then(async ({ complete, completionLines }) => completionLines(await complete(tree, words))).catch(() => "");
+			const lines = await import("./completion-8EDK21xj.js").then(async ({ complete, completionLines }) => completionLines(await complete(tree, words))).catch(() => "");
 			if (lines !== "") out(lines);
 			return {
 				code: 0,
@@ -594,7 +595,7 @@ function cliFromTree(init, extra = {}) {
 		try {
 			const [loaded, { defaultConfig, discoverConfig, loadConfig }, { configEnvironment, isCi, parseEnv }] = await Promise.all([
 				node.load(),
-				import("./config-C6XylzKz.js"),
+				import("./config-BlfVh0IP.js"),
 				import("./env-C-Bl6Awn.js")
 			]);
 			command = loaded;

package/dist/cli/{seed-CG-pA-5N.js → seed-D9mt8bnW.js}

@@ -1,11 +1,11 @@
-import { p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { p as commandMeta, r as defineCliCommand } from "./command-BWEEXmtz.js";
 import { i as isLocalDatabaseUrl, r as databaseHost } from "./agent-CbuPvI2x.js";
 import { t as display } from "./io-DH1kcmmP.js";
-import { l as stdinDatabaseUrl, n as databaseUrl, o as importExport } from "./config-2rwFHbwj.js";
+import { l as stdinDatabaseUrl, n as databaseUrl, o as importExport } from "./config-BJSqMi04.js";
 import { m as supabaseDir } from "./supabase-toml-CncmQbO0.js";
 import { t as connect } from "./db-CQCLx7cx.js";
 import { c as insideRoot, i as changeLines, n as PLAN_ARGS, r as applyPlan, s as hasConflicts, u as planResult } from "./files-CX71yBm8.js";
-import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-MTLYpifA.js";
+import { r as STACK_ARG, t as DB_URL_STDIN_ARG } from "./source-args-DlckPVje.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/cli/seed-EPO6AvLG.js

@@ -0,0 +1 @@
+export { n as seedCommand } from "./seed-D9mt8bnW.js";

package/dist/cli/{shared-D0XBFSlz.js → shared-B38Chjgd.js}

@@ -1,4 +1,4 @@
-import { a as toCatalog } from "./source-BZbEK5if.js";
+import { a as toCatalog } from "./source-irttnsEb.js";
 import { h as tomlGet, p as sqlWorkflow, r as detectWorkflow } from "./supabase-toml-CncmQbO0.js";
 //#region src/cli/doctor/shared.ts
 const catalogs = /* @__PURE__ */ new WeakMap();

package/dist/cli/{skills-toUan_OV.js → skills-FXAVPLzp.js}

@@ -1,4 +1,4 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CQ61x6gN.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-BWEEXmtz.js";
 import { n as CliError } from "./errors-BTe6A15O.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { n as PLAN_ARGS, r as applyPlan, u as planResult } from "./files-CX71yBm8.js";

package/dist/cli/{snapshot-C6vh_n3t.js → snapshot-BXmU3IXN.js}

@@ -1,8 +1,8 @@
 import { n as CliError, r as errorText } from "./errors-BTe6A15O.js";
-import { d as readExtras, l as TYPEGEN_VERSION, r as cachedIntrospect } from "./cache-oU0yHKf0.js";
+import { d as readExtras, l as TYPEGEN_VERSION, r as cachedIntrospect } from "./cache-DE2IH1-C.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { n as managementSource, r as pgSource } from "./source-BZbEK5if.js";
-import { n as databaseUrl, u as accessToken } from "./config-2rwFHbwj.js";
+import { n as managementSource, r as pgSource } from "./source-irttnsEb.js";
+import { n as databaseUrl, u as accessToken } from "./config-BJSqMi04.js";
 import { d as readSupabaseToml, f as schemaPaths, h as tomlGet, u as pgFunctionHooks } from "./supabase-toml-CncmQbO0.js";
 import { t as connect } from "./db-CQCLx7cx.js";
 import { existsSync } from "node:fs";