better-supabase 0.3.0 → 0.5.0

package/dist/cli/gen-C2osRcr5.js

@@ -0,0 +1,2204 @@
+import { r as defineCliCommand } from "./command-CK14fP91.js";
+import { n as CliError } from "./errors-4v4DTtda.js";
+import { n as importPath, r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
+import { r as painter } from "./style-C0NFdJRL.js";
+import { t as VERSION } from "./version-BDJuO0UR.js";
+import { d as pgFunctionHooks, f as readSupabaseToml, m as tomlGet, s as stdinDatabaseUrl, t as databaseUrl } from "./config-CPVpXP5I.js";
+import { t as fileDiff } from "./diff-SjkO5rNr.js";
+import { a as parseHookMarker, i as parseGrantsMarker, n as entitlementRequirements, r as entitlementsMode, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { n as withSpinner } from "./prompts-BNcNfAve.js";
+import { t as connect } from "./db-DOBPt660.js";
+import { basename, dirname, resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { setTimeout } from "node:timers/promises";
+import { PERMDOCK_SCHEMA, kitLayout, permdockKeyStatus, permdockKeys, renderKit, sameKitFile } from "better-supabase/sql";
+import { DEFAULT_CLAIMS, tenantClaimPaths } from "better-supabase/config";
+import { toCamel, toSnake } from "better-supabase";
+import { generateTypescript, pgTypeToTsType, sortGeneratorMetadata } from "@supabase/postgrest-typegen/generation";
+import { createHash } from "node:crypto";
+//#region src/cli/introspect/catalog.ts
+const byName = (a, b) => a.schema === b.schema ? a.name < b.name ? -1 : a.name > b.name ? 1 : 0 : a.schema < b.schema ? -1 : 1;
+function toColumn(column) {
+	const isArray = column.data_type === "ARRAY";
+	const udt = isArray ? column.format.replace(/^_/, "") : column.format;
+	const defaultValue = column.default_value === null || column.default_value === void 0 ? null : String(column.default_value);
+	return {
+		name: column.name,
+		udt,
+		format: column.format,
+		typeSchema: column.type_schema,
+		isArray,
+		isEnum: column.enums.length > 0,
+		nullable: column.is_nullable,
+		hasDefault: defaultValue !== null || column.identity_generation !== null || column.is_generated,
+		default: defaultValue,
+		identity: column.identity_generation === "ALWAYS" ? "always" : column.identity_generation === "BY DEFAULT" ? "by default" : null,
+		generated: column.is_generated,
+		updatable: column.is_updatable,
+		comment: column.comment
+	};
+}
+function toFunction(fn, typeName, relationName) {
+	const args = [];
+	const table = [];
+	fn.args.forEach((arg, index) => {
+		const raw = typeName(arg.type_id) ?? "unknown";
+		const name = arg.name || `arg${index + 1}`;
+		if (arg.mode === "in" || arg.mode === "inout" || arg.mode === "variadic") {
+			const isArray = raw.startsWith("_");
+			args.push({
+				name,
+				udt: isArray ? raw.slice(1) : raw,
+				isArray,
+				hasDefault: arg.has_default === true
+			});
+		}
+		if (arg.mode === "table" || arg.mode === "out" || arg.mode === "inout") table.push({
+			name,
+			udt: raw
+		});
+	});
+	const searchPath = fn.config_params?.["search_path"];
+	return {
+		schema: fn.schema,
+		name: fn.name,
+		signature: fn.identity_argument_types,
+		args,
+		returnsTable: fn.args.some((arg) => arg.mode === "table") ? table : null,
+		returns: typeName(fn.return_type_id) ?? fn.return_type,
+		returnsRelation: relationName(fn.return_type_relation_id),
+		returnsSet: fn.is_set_returning_function,
+		volatility: fn.behavior.toLowerCase(),
+		securityDefiner: fn.security_definer,
+		language: fn.language,
+		searchPath: searchPath === void 0 ? null : searchPath.replace(/^""$/, "")
+	};
+}
+/** Joins the typegen metadata and the extras into one record per object. */
+function toCatalog(snapshot) {
+	const meta = snapshot.generator;
+	const extras = new Map(snapshot.extras.tables.map((table) => [table.id, table]));
+	const columns = /* @__PURE__ */ new Map();
+	for (const column of meta.columns) {
+		const list = columns.get(column.table_id);
+		if (list) list.push(column);
+		else columns.set(column.table_id, [column]);
+	}
+	const primaryKeys = /* @__PURE__ */ new Map();
+	for (const key of meta.primaryKeys) {
+		const list = primaryKeys.get(key.table_id);
+		if (list) list.push(key.name);
+		else primaryKeys.set(key.table_id, [key.name]);
+	}
+	const relationNames = /* @__PURE__ */ new Map();
+	for (const list of [
+		meta.tables,
+		meta.foreignTables,
+		meta.views,
+		meta.materializedViews
+	]) for (const entry of list) relationNames.set(entry.id, `${entry.schema}.${entry.name}`);
+	const foreignKeysOf = (schema, name, extra) => {
+		const actions = new Map((extra?.foreignKeys ?? []).map((fk) => [fk.name, fk]));
+		return meta.relationships.filter((rel) => rel.schema === schema && rel.relation === name && actions.has(rel.foreign_key_name)).map((rel) => {
+			const action = actions.get(rel.foreign_key_name);
+			return {
+				name: rel.foreign_key_name,
+				columns: rel.columns,
+				refSchema: rel.referenced_schema,
+				refTable: rel.referenced_relation,
+				refColumns: rel.referenced_columns,
+				oneToOne: rel.is_one_to_one,
+				onDelete: action?.onDelete ?? "no action",
+				onUpdate: action?.onUpdate ?? "no action"
+			};
+		}).sort((a, b) => byCodePoint(a.name, b.name));
+	};
+	const build = (entry, flags) => {
+		const extra = extras.get(entry.id);
+		const own = [...columns.get(entry.id) ?? []].sort((a, b) => a.ordinal_position - b.ordinal_position);
+		return {
+			id: entry.id,
+			schema: entry.schema,
+			name: entry.name,
+			comment: entry.comment,
+			...flags,
+			columns: own.map(toColumn),
+			primaryKey: extra && extra.primaryKey.length > 0 ? extra.primaryKey : primaryKeys.get(entry.id) ?? [],
+			uniques: extra?.uniques ?? [],
+			foreignKeys: foreignKeysOf(entry.schema, entry.name, extra),
+			checks: extra?.checks ?? [],
+			indexes: extra?.indexes ?? [],
+			policies: extra?.policies ?? [],
+			triggers: extra?.triggers ?? [],
+			grants: extra?.grants ?? [],
+			...extra?.columnGrants ? { columnGrants: extra.columnGrants } : {}
+		};
+	};
+	const tables = [
+		...meta.tables.map((table) => build(table, {
+			kind: "table",
+			rls: table.rls_enabled,
+			forceRls: table.rls_forced,
+			replicaIdentity: table.replica_identity,
+			insertable: true,
+			updatable: true
+		})),
+		...meta.foreignTables.map((table) => build(table, {
+			kind: "table",
+			rls: false,
+			forceRls: false,
+			replicaIdentity: null,
+			insertable: true,
+			updatable: true
+		})),
+		...meta.views.map((view) => build(view, {
+			kind: "view",
+			rls: false,
+			forceRls: false,
+			replicaIdentity: null,
+			insertable: view.is_insert_enabled ?? view.is_updatable,
+			updatable: view.is_update_enabled ?? view.is_updatable
+		})),
+		...meta.materializedViews.map((view) => build(view, {
+			kind: "view",
+			rls: false,
+			forceRls: false,
+			replicaIdentity: null,
+			insertable: false,
+			updatable: false
+		}))
+	].sort(byName);
+	const included = new Set(snapshot.schemas);
+	const enums = meta.types.filter((type) => type.enums.length > 0 && included.has(type.schema)).map((type) => ({
+		schema: type.schema,
+		name: type.name,
+		values: type.enums
+	})).sort(byName);
+	const typeNames = new Map(meta.types.map((type) => [type.id, type.name]));
+	const functions = meta.functions.map((fn) => toFunction(fn, (id) => typeNames.get(id), (id) => id === null ? null : relationNames.get(id) ?? null)).sort((a, b) => byName(a, b) || byCodePoint(a.signature, b.signature));
+	return {
+		schemas: snapshot.schemas,
+		tables,
+		enums,
+		functions,
+		buckets: snapshot.extras.buckets,
+		realtime: snapshot.extras.realtime
+	};
+}
+//#endregion
+//#region src/cli/doctor/shared.ts
+const catalogs = /* @__PURE__ */ new WeakMap();
+/** The snapshot joined per table and function, computed once per snapshot. */
+function catalogOf(context) {
+	let catalog = catalogs.get(context.snapshot);
+	if (!catalog) {
+		catalog = toCatalog(context.snapshot);
+		catalogs.set(context.snapshot, catalog);
+	}
+	return catalog;
+}
+/** `[api] schemas` from `config.toml`, the schemas PostgREST serves, or `config.schemas` without one. */
+function exposedSchemas(context) {
+	const listed = context.configToml ? tomlGet(context.configToml.document, ["api", "schemas"]) : void 0;
+	return Array.isArray(listed) && listed.every((entry) => typeof entry === "string") ? listed : context.config.schemas;
+}
+const exposed = (context) => {
+	const schemas = exposedSchemas(context);
+	return catalogOf(context).tables.filter((table) => schemas.includes(table.schema));
+};
+const qualified = (table) => `${table.schema}.${table.name}`;
+const tableObject = (table) => ({
+	kind: "table",
+	schema: table.schema,
+	name: table.name
+});
+const policyObject = (table, policy) => ({
+	kind: "policy",
+	schema: table.schema,
+	name: policy.name
+});
+const splitTexts = /* @__PURE__ */ new Map();
+const SPLIT_CACHE_SIZE = 64;
+/** `text` split into lines; doctor locates many objects in the same SQL files. */
+function linesOf(text) {
+	let lines = splitTexts.get(text);
+	if (!lines) {
+		if (splitTexts.size >= SPLIT_CACHE_SIZE) splitTexts.clear();
+		lines = text.split("\n");
+		splitTexts.set(text, lines);
+	}
+	return lines;
+}
+/** Line number (1-based) of the first line matching `pattern`. */
+function lineOf(text, pattern) {
+	const index = linesOf(text).findIndex((line) => pattern.test(line));
+	return index === -1 ? void 0 : index + 1;
+}
+//#endregion
+//#region src/cli/doctor/permdock.ts
+/** Tables whose policies PermDock's helpers can't row-check (PermDock's PD037 scans the same ones). */
+const HELPER_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
+const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
+/** A helper call: optional schema, `permitted_<scope>_ids` or `permdock_has`, and the key, positional or named. */
+const HELPER_CALL = /(?:(?:"((?:[^"]|"")+)"|([a-z_][\w$]*))\s*\.\s*)?"?(?:permitted_(\w+?)_ids|(permdock_has))"?\s*\(\s*(?:\w+\s*=>\s*)?'((?:[^']|'')*)'/gi;
+const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
+/**
+* Policies better-supabase generates (`bs_` names) on `storage.objects` and
+* `realtime.messages` that call PermDock's helpers, with the keys they pass.
+* The first file that declares a policy wins, matching the `sqlFiles` order
+* (declarative schemas, then the newest migration).
+*/
+function helperPolicies(files) {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	for (const file of files) for (const match of file.text.matchAll(POLICY)) {
+		const name = unquote(match[1]);
+		const table = match[2].split(".").map((part) => unquote(part.trim())).join(".");
+		if (!HELPER_TABLES.has(table) || !name.startsWith("bs_")) continue;
+		const id = `${table}.${name}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const calls = [...match[3].matchAll(HELPER_CALL)].map((call) => {
+			const schema = call[1]?.replaceAll("\"\"", "\"") ?? call[2];
+			return {
+				key: call[5].replaceAll("''", "'"),
+				scope: call[4] ? "global" : call[3],
+				...schema ? { schema } : {}
+			};
+		});
+		if (calls.length === 0) continue;
+		found.push({
+			name,
+			table,
+			keys: [...new Set(calls.map((call) => call.key))],
+			calls,
+			file: file.path,
+			line: file.text.slice(0, match.index).split("\n").length
+		});
+	}
+	return found;
+}
+/** `buckets` entries with a PermDock policy, the keys they name, their scope and helper schema. */
+function configuredPermdockKeys(context) {
+	return Object.entries(context.config.buckets).flatMap(([bucket, config]) => config.policy !== void 0 && typeof config.policy !== "string" && "permdock" in config.policy ? [{
+		bucket,
+		keys: permdockKeys(config.policy),
+		scope: config.policy.scope,
+		schema: config.policy.schema ?? PERMDOCK_SCHEMA
+	}] : []);
+}
+/** A scope name or PermDock's alias for it (`tenant` is the first scope, `team` the second), resolved against the manifest. */
+function resolveManifestScope(manifest, name) {
+	const scopes = manifest?.rls?.scopes;
+	if (!scopes) return void 0;
+	if (scopes.some((scope) => scope.name === name)) return name;
+	if (name === "tenant") return scopes[0]?.name;
+	if (name === "team") return scopes[1]?.name;
+}
+/**
+* Why a policy's helper schema or scope can't work with PermDock's
+* manifest and catalog: a schema other than `rls.schema`, a scope the
+* manifest doesn't declare, or a key the catalog declares at another scope.
+*/
+function placementProblems(project, catalog, call, where) {
+	const rls = project.manifest?.rls;
+	const problems = [];
+	if (rls && call.schema !== void 0 && call.schema !== rls.schema) problems.push(`${where} calls PermDock's helpers in schema ${call.schema}, but ${project.manifestPath} puts them in ${rls.schema}. Set schema: '${rls.schema}' on the policy.`);
+	if (call.scope === "global") return problems;
+	if (rls && !rls.scopes.some((scope) => scope.name === call.scope)) {
+		const resolved = resolveManifestScope(project.manifest, call.scope);
+		problems.push(`${where} uses scope "${call.scope}", which ${project.manifestPath} doesn't declare, so permitted_${call.scope}_ids doesn't exist. ${resolved ? `Use "${resolved}", the scope "${call.scope}" stands for.` : `Use one of ${rls.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`}`);
+		return problems;
+	}
+	const declared = catalog.permissions.find((permission) => permission.key === call.key)?.scope;
+	if (declared === void 0) return problems;
+	const resolved = resolveManifestScope(project.manifest, declared) ?? declared;
+	if (resolved !== call.scope) problems.push(`${where} checks "${call.key}" at scope "${call.scope}", but ${project.catalogPath} declares it at "${resolved}", so PermDock's helpers never grant it there. Use scope "${resolved}".`);
+	return problems;
+}
+const ROW_CONDITIONS_FIX = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
+const REGENERATE_FIX = "Regenerate it with a current `permdock catalog`, which writes rowConditions for every permission.";
+/**
+* Why the SQL helpers can't be trusted with `key`, or `undefined` when the
+* catalog marks it `rowConditions: false`. An entry without the flag and a
+* key the catalog doesn't list are unknown, so they count as unsafe.
+*/
+function unsafeKey(catalog, key, catalogPath) {
+	const status = permdockKeyStatus(catalog, key);
+	switch (status) {
+		case "scope-only": return;
+		case "row-conditions": return {
+			reason: `has row conditions in ${catalogPath}`,
+			fix: ROW_CONDITIONS_FIX
+		};
+		case "no-flag": return {
+			reason: `has no rowConditions flag in ${catalogPath}, so whether it has row conditions is unknown`,
+			fix: REGENERATE_FIX
+		};
+		case "missing": return {
+			reason: `is not in ${catalogPath}`,
+			fix: REGENERATE_FIX
+		};
+		default: return status;
+	}
+}
+/** PermDock's helpers for the `entitlements` kit module, when the manifest allows PermDock mode. */
+function entitlementsKit(context) {
+	const mode = entitlementsMode(context.config, context.permdock);
+	return mode.kind === "permdock" ? mode.permdock : void 0;
+}
+const PERMDOCK_RULES = [
+	{
+		code: "BS214",
+		severity: "error",
+		title: "PermDock permission with row conditions in a Storage or Realtime policy",
+		description: "PermDock's SQL helpers (`permitted_<scope>_ids`, `permdock_has`) check role and scope, not row conditions. A bucket or topic policy that names a permission whose catalog entry has `rowConditions: true` grants every object or topic in the scope. Use PermDock's generated policies for those permissions. A key whose entry has no boolean `rowConditions` (an older `permdock catalog`) or that the catalog doesn't list is unknown and reported the same way, and so are all of them when the catalog is missing or unreadable. With the manifest, a helper schema other than `rls.schema`, a scope the manifest doesn't declare and a key checked at another scope than its catalog entry's are reported too.",
+		check: (context) => {
+			const project = context.permdock;
+			if (!project) return [];
+			const fromConfig = configuredPermdockKeys(context);
+			const fromSql = helperPolicies(context.sqlFiles ?? []);
+			const uses = fromConfig.length > 0 || fromSql.length > 0;
+			const findings = project.problems.filter((problem) => problem.startsWith(project.catalogPath)).map((problem) => ({
+				...uses ? {} : { severity: "info" },
+				message: `Could not read PermDock's catalog: ${problem}`,
+				target: project.catalogPath
+			}));
+			const catalog = project.catalog;
+			if (!catalog) {
+				if (findings.length === 0 && uses) findings.push({
+					message: `Storage or Realtime policies call PermDock's helpers, but there is no ${project.catalogPath}, so whether their permissions have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`,
+					target: project.catalogPath
+				});
+				return findings;
+			}
+			for (const { bucket, keys, scope, schema } of fromConfig) for (const key of keys) {
+				for (const message of placementProblems(project, catalog, {
+					key,
+					scope,
+					schema
+				}, `buckets.${bucket} ("${key}")`)) findings.push({
+					message,
+					target: `buckets.${bucket}:${key}`
+				});
+				const problem = unsafeKey(catalog, key, project.catalogPath);
+				if (!problem) continue;
+				findings.push({
+					message: `buckets.${bucket} uses PermDock permission "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
+					target: `buckets.${bucket}:${key}`
+				});
+			}
+			for (const policy of fromSql) {
+				const seen = /* @__PURE__ */ new Set();
+				for (const call of policy.calls) for (const message of placementProblems(project, catalog, call, `Policy "${policy.name}" on ${policy.table}`)) {
+					if (seen.has(message)) continue;
+					seen.add(message);
+					findings.push({
+						message,
+						target: `${policy.table}.${policy.name}:${call.key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+				for (const key of policy.keys) {
+					const problem = unsafeKey(catalog, key, project.catalogPath);
+					if (!problem) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to PermDock's helpers, but it ${problem.reason}. ${problem.fix}`,
+						target: `${policy.table}.${policy.name}:${key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS408",
+		severity: "warning",
+		title: "PermDock helpers the entitlements module calls are missing",
+		description: "With a PermDock manifest, the `entitlements` kit module reads memberships from PermDock's `member_<scope>_ids()` (in `has_entitlement`, as `authenticated`) and `member_<scope>_ids_for(uuid)` (in `feature_claims`, which PermDock's hook calls as `supabase_auth_admin`). Doctor warns when a PermDock project has no readable manifest or no `rls` block, when the scope is not one of the manifest's scopes or can't be chosen, when the scope's id type is missing or not `uuid`, `text`, `bigint` or `integer`, when the manifest has no `claims.features` claim filled by `better_supabase.feature_claims`, when no membership source covers the scope, when the manifest's `rls.helpers` lacks one of those helpers or doesn't grant it to that role (naming the `permdock.config.ts` setting that adds it), or when the snapshot lacks it (apply the migration `permdock rls generate` wrote).",
+		check: (context) => {
+			if (!context.config.sql.kit.includes("entitlements")) return [];
+			const mode = entitlementsMode(context.config, context.permdock);
+			if (mode.kind === "tenant") return [];
+			const manifest = context.config.permdock.manifest;
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "entitlements.permdock"
+			}];
+			const listed = new Map((context.permdock?.manifest?.rls?.helpers ?? []).map((helper) => [`${mode.permdock.schema}.${helper.name}`, helper]));
+			const read = context.snapshot.schemas.includes(mode.permdock.schema);
+			const present = new Set(catalogOf(context).functions.map((fn) => `${fn.schema}.${fn.name}`));
+			const regenerate = `then run \`permdock rls generate\`, \`permdock supabase hook generate\` and \`permdock supabase inspect --out\`.`;
+			const findings = [];
+			const project = context.permdock;
+			const features = context.config.claims.features;
+			const claims = project?.manifest?.claims ?? [];
+			const featureClaim = claims.find((claim) => claim.name === features);
+			if (featureClaim?.source !== "better_supabase.feature_claims") {
+				const registered = claims.find((claim) => claim.source === "better_supabase.feature_claims");
+				findings.push({
+					message: registered ? `${manifest} registers better_supabase.feature_claims as the "${registered.name}" claim, but claims.features is "${features}", so hasEntitlement() never finds the plan features. Set claims.features to "${registered.name}", or rename the claim in permdock.config.ts (supabase.hook.claims).` : featureClaim ? `${manifest} fills the "${features}" claim from ${featureClaim.source}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point supabase.hook.claims.${features} in permdock.config.ts at 'better_supabase.feature_claims', ${regenerate}` : `${manifest} has no "${features}" claim, so PermDock's hook never writes the plan features hasEntitlement() reads. Add \`supabase.hook.claims: { ${features}: 'better_supabase.feature_claims' }\` to permdock.config.ts, ${regenerate}`,
+					target: `claims.${features}`
+				});
+			}
+			const scope = mode.permdock.scope;
+			if (!mode.permdock.memberships.some((source) => !("value" in source.scope) || source.scope.value === scope)) findings.push({
+				message: `No membership source in ${manifest} covers scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a source for "${scope}" (\`supabase.hook.memberships\` in permdock.config.ts), ${regenerate}`,
+				target: `entitlements.permdock.${scope}`
+			});
+			return findings.concat(entitlementRequirements(mode.permdock).flatMap((requirement) => {
+				const { helper, caller, role } = requirement;
+				const entry = listed.get(helper);
+				if (!entry) return [{
+					message: requirement.kind === "member" ? `${manifest} lists no ${helper}, but ${caller} calls it. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.` : `${manifest} lists no ${helper}, but ${caller} calls it. PermDock writes it only for a scope with a membership source: add one for "${mode.permdock.scope}" (\`supabase.hook.memberships\`, \`rls.membershipSources\` or a mapped \`rls.memberships\` table in permdock.config.ts), ${regenerate}`,
+					target: helper
+				}];
+				if (!entry.execute.includes(role)) {
+					const message = requirement.kind === "member" ? `${manifest} says ${role} may not execute ${helper}, but ${caller} calls it as ${role}. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.` : `${manifest} says ${role} may not execute ${helper}. feature_claims runs as its owner, so this only matters when something else calls it as ${role}; PermDock grants it when the hook has claims (\`supabase.hook.claims\` in permdock.config.ts), ${regenerate}`;
+					return [{
+						...requirement.kind === "member-for" ? { severity: "info" } : {},
+						message,
+						target: helper
+					}];
+				}
+				if (read && !present.has(helper)) return [{
+					message: `${helper} is in ${manifest} but not in the database. Apply the migration \`permdock rls generate\` wrote before the entitlements module.`,
+					target: helper
+				}];
+				return [];
+			}));
+		}
+	},
+	{
+		code: "BS409",
+		severity: "warning",
+		title: "PermDock's manifest and the better-supabase config disagree",
+		description: "PermDock's hook and helpers read the active tenant from the manifest's `rls.tenantClaim`, and its generated files start with a `-- permdock:hook v1` or `-- permdock:grants v1` marker. Doctor warns when `claims.tenant` names another claim (the tenant plugin, guards and RLS would read a claim PermDock never writes), reports an error for a marker version this release can't read, and notes when `claims.scope` resolves to another scope than the manifest's root scope.",
+		check: (context) => {
+			const project = context.permdock;
+			if (!project) return [];
+			const findings = [];
+			const manifest = project.manifest;
+			const tenantClaim = manifest?.rls?.tenantClaim ?? manifest?.tenantClaim;
+			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
+				message: `${project.manifestPath} says PermDock writes the active tenant to "${tenantClaim}", but claims.tenant is "${context.config.claims.tenant}". Set claims.tenant to "${tenantClaim}", or change rls.tenantClaim in permdock.config.ts.`,
+				target: "claims.tenant"
+			});
+			for (const file of context.sqlFiles ?? []) {
+				const markers = [["hook", parseHookMarker(file.text)?.version], ["grants", parseGrantsMarker(file.text)?.version]];
+				for (const [kind, version] of markers) {
+					if (version === void 0 || version === 1) continue;
+					findings.push({
+						severity: "error",
+						message: `${file.path} has a \`-- permdock:${kind} v${String(version)}\` marker, but this release reads only v1, so doctor can't trust what it says about PermDock's ${kind === "hook" ? "hook" : "grants"}. Upgrade better-supabase, or regenerate the file with the PermDock version that matches it.`,
+						target: file.path,
+						location: {
+							file: file.path,
+							line: 1
+						}
+					});
+				}
+			}
+			const root = manifest?.rls?.scopes.find((scope) => scope.within === void 0)?.name;
+			const scope = context.config.claims.scope;
+			const resolved = resolveManifestScope(manifest, scope);
+			if (root !== void 0 && resolved !== root) findings.push({
+				severity: "info",
+				message: `claims.scope is "${scope}", which ${resolved ? `stands for "${resolved}"` : "is not a scope"} in ${project.manifestPath}, whose root scope is "${root}". The tenant module's membership claims then use another scope than PermDock's. Set claims.scope to "${root}" (or "tenant").`,
+				target: "claims.scope"
+			});
+			return findings;
+		}
+	}
+];
+//#endregion
+//#region src/cli/gen/shared.ts
+const q = (value) => JSON.stringify(value);
+/** A property key: bare when it is a valid identifier, quoted otherwise. */
+function prop(name) {
+	return /^[A-Za-z_$][\w$]*$/.test(name) ? name : q(name);
+}
+function nullable(type, isNullable) {
+	return isNullable ? `${type} | null` : type;
+}
+/** `T[]`, parenthesized when `T` is a union or other compound type. */
+function arrayOf(type) {
+	return /^[\w.$]+$/.test(type) ? `${type}[]` : `(${type})[]`;
+}
+function indent(lines, depth) {
+	const pad = "  ".repeat(depth);
+	return lines.flatMap((line) => line.split("\n")).map((line) => line === "" ? line : pad + line);
+}
+/** `name: {` + indented children + `};`, or an inline empty type. */
+function block(name, children, empty = "{ [_ in never]: never }") {
+	if (children.length === 0) return [`${name}: ${empty};`];
+	return [
+		`${name}: {`,
+		...indent(children, 1),
+		"};"
+	];
+}
+function sameColumns(left, right) {
+	return left.length === right.length && left.every((column) => right.includes(column));
+}
+function singular(name) {
+	if (name.endsWith("ies")) return `${name.slice(0, -3)}y`;
+	if (name.endsWith("sses")) return name.slice(0, -2);
+	if (name.endsWith("s") && !name.endsWith("ss")) return name.slice(0, -1);
+	return name;
+}
+function pascal(name) {
+	return name.replaceAll(/(^|[_-]+)([a-z0-9])/g, (_, __, char) => char.toUpperCase()).replace(/^[a-z]/, (char) => char.toUpperCase());
+}
+function isJsonUdt(udt) {
+	return udt === "json" || udt === "jsonb";
+}
+const CHECK_ANY = /^CHECK \(\(\(?"?(\w+)"?\)?(?:::\w+)? = ANY \(\(?ARRAY\[(.+)\]\)?(?:::\w+\[\])?\)\)\)$/;
+const CHECK_OR = /^CHECK \(\((.+)\)\)$/;
+const OR_TERM = /^\(?"?(\w+)"?\)?(?:::\w+)? = '((?:[^']|'')*)'(?:::\w+)?\)?$/;
+const LITERAL = /'((?:[^']|'')*)'(?:::[\w ]+)?/g;
+/**
+* Extracts `column in ('a', 'b')` CHECK constraints, which Postgres stores as
+* `CHECK ((col = ANY (ARRAY['a'::text, 'b'::text])))` or an OR chain.
+*/
+function parseCheckUnion(definition) {
+	const any = CHECK_ANY.exec(definition);
+	if (any?.[1] && any[2]) {
+		const values = [...any[2].matchAll(LITERAL)].map((match) => (match[1] ?? "").replaceAll("''", "'"));
+		return values.length > 0 ? {
+			column: any[1],
+			values
+		} : void 0;
+	}
+	const chain = CHECK_OR.exec(definition);
+	if (chain?.[1]) {
+		const terms = chain[1].split(/\) OR \(|\s+OR\s+/);
+		let column;
+		const values = [];
+		for (const term of terms) {
+			const match = OR_TERM.exec(term.trim());
+			if (!match?.[1]) return void 0;
+			if (column && column !== match[1]) return void 0;
+			column = match[1];
+			values.push((match[2] ?? "").replaceAll("''", "'"));
+		}
+		return column && values.length > 1 ? {
+			column,
+			values
+		} : void 0;
+	}
+}
+//#endregion
+//#region src/cli/gen/emit.ts
+const GENERATED_HEADER = "// @generated by better-supabase gen. Do not edit; run `better-supabase gen` instead.";
+function rowEntries(columns, name) {
+	return columns.map((column) => `${prop(column[name])}: ${nullable(column.tsType, column.nullable)};`);
+}
+function insertEntries(columns, name) {
+	return columns.map((column) => {
+		if (!column.insertable) return `${prop(column[name])}?: never;`;
+		const optional = column.optional ? "?" : "";
+		return `${prop(column[name])}${optional}: ${nullable(column.tsType, column.nullable)};`;
+	});
+}
+function updateEntries(columns, name) {
+	return columns.map((column) => {
+		if (!column.updatable) return `${prop(column[name])}?: never;`;
+		return `${prop(column[name])}?: ${nullable(column.tsType, column.nullable)};`;
+	});
+}
+function argEntries(fn) {
+	return fn.args.map((arg) => `${prop(arg.name)}${arg.optional ? "?" : ""}: ${arg.tsType};`);
+}
+function enrichedDatabase(model) {
+	const schemas = model.config.schemas.flatMap((schema) => {
+		const tables = model.tables.filter((t) => t.snapshot.schema === schema).flatMap((table) => {
+			const overrides = table.columns.filter((column) => column.values !== void 0 && !column.snapshot.isEnum || column.json && column.tsType !== "Json" || column.storage !== void 0).map((column) => `${prop(column.db)}: ${column.tsType};`);
+			return overrides.length > 0 ? block(prop(table.snapshot.name), overrides) : [];
+		});
+		return tables.length > 0 ? block(prop(schema), tables) : [];
+	});
+	if (schemas.length === 0) return ["export type Database = SupabaseDatabase;"];
+	return [
+		"export type Database = EnrichDatabase<",
+		"  SupabaseDatabase,",
+		"  {",
+		...indent(schemas, 2),
+		"  }",
+		">;"
+	];
+}
+function modelsType(model) {
+	return [
+		"export type Models = {",
+		...indent(model.tables.flatMap((table) => {
+			const relations = table.relations.map((relation) => `${prop(relation.name)}: { table: ${q(relation.meta.table)}; kind: ${q(relation.meta.kind)}; nullable: ${String(relation.meta.nullable)} };`);
+			const pk = table.meta.primaryKey;
+			const uniques = Object.entries(table.meta.uniqueKeys).map(([name, columns]) => `${prop(name)}: readonly [${columns.map(q).join(", ")}];`);
+			const flags = [];
+			const tableFlags = table.meta.flags;
+			if (tableFlags.softDelete) flags.push(`softDelete: ${q(tableFlags.softDelete)};`);
+			if (tableFlags.timestamps) flags.push("timestamps: true;");
+			if (tableFlags.tenant) flags.push(`tenant: ${q(tableFlags.tenant)};`);
+			if (tableFlags.actor) flags.push("actor: true;");
+			const none = "Record<never, never>";
+			const union = (names) => names.length === 0 ? "never" : names.map(q).join(" | ");
+			return block(prop(table.key), [
+				...block("Row", rowEntries(table.columns, "app"), none),
+				...table.snapshot.insertable ? block("Insert", insertEntries(table.columns, "app"), none) : ["Insert: never;"],
+				...table.snapshot.updatable ? block("Update", updateEntries(table.columns, "app"), none) : ["Update: never;"],
+				...block("Relations", relations, none),
+				`PrimaryKey: ${union(pk)};`,
+				...block("UniqueKeys", uniques, none),
+				`Checks: ${union(table.snapshot.checks.map((check) => check.name))};`,
+				`ForeignKeys: ${union(table.snapshot.foreignKeys.map((fk) => fk.name))};`,
+				...block("Flags", flags, none)
+			]);
+		}), 1),
+		"};"
+	];
+}
+function functionsType(model) {
+	if (model.functions.length === 0) return ["export type Functions = Record<never, never>;"];
+	return [
+		"export type Functions = {",
+		...indent(model.functions.flatMap((fn) => block(prop(fn.key), [...block("Args", argEntries(fn), "Record<never, never>"), `Returns: ${fn.returns};`])), 1),
+		"};"
+	];
+}
+/** The metadata module next to `generated.ts`: `generated.meta.js` and its `.d.ts`. */
+function metaPaths(output) {
+	const base = output.replace(/\.[cm]?[jt]sx?$/, "");
+	return {
+		js: `${base}.meta.js`,
+		dts: `${base}.meta.d.ts`
+	};
+}
+/**
+* The schema metadata as plain JavaScript plus a one-line declaration, so
+* TypeScript reads `SchemaMeta` instead of checking thousands of lines of
+* object literal in every program that imports the generated module.
+*/
+function emitMeta(model, options = {}) {
+	const runtime = options.runtimeImport ?? "better-supabase";
+	return {
+		js: [
+			GENERATED_HEADER,
+			`// @ts-self-types="${options.types ?? "./generated.meta.d.ts"}"`,
+			"/* oxlint-disable */",
+			"/* eslint-disable */",
+			"",
+			`export default ${JSON.stringify(model.meta, null, 2)};`,
+			""
+		].join("\n"),
+		dts: [
+			GENERATED_HEADER,
+			"/* oxlint-disable */",
+			"/* eslint-disable */",
+			"",
+			`import type { SchemaMeta } from ${q(runtime)};`,
+			"",
+			"declare const meta: SchemaMeta;",
+			"export default meta;",
+			""
+		].join("\n")
+	};
+}
+/** Renders the generated module. */
+function emitModule(model, options) {
+	const runtime = options.runtimeImport ?? "better-supabase";
+	const lines = [
+		GENERATED_HEADER,
+		"/* oxlint-disable */",
+		"/* eslint-disable */",
+		"",
+		`import { defineSchema, type Schema } from ${q(runtime)};`
+	];
+	const storagePaths = model.tables.some((table) => table.columns.some((column) => column.storage !== void 0));
+	lines.push(`import type { EnrichDatabase${storagePaths ? ", StoragePath" : ""} } from ${q(runtime)};`, `import type { Database as SupabaseDatabase } from ${q(options.databaseTypesImport ?? "./database.types.ts")};`);
+	const byFile = /* @__PURE__ */ new Map();
+	for (const entry of model.jsonImports) {
+		const list = byFile.get(entry.from) ?? [];
+		list.push(entry.name);
+		byFile.set(entry.from, list);
+	}
+	for (const [from, names] of [...byFile.entries()].sort(([a], [b]) => byCodePoint(a, b))) lines.push(`import type { ${names.sort().join(", ")} } from ${q(options.importPathFor(from))};`);
+	lines.push(`import meta from ${q(options.metaImport ?? "./generated.meta.js")};`, "", "export type Json = string | number | boolean | null | { [key: string]: Json | undefined } | Json[];", "", ...enrichedDatabase(model), "");
+	for (const entry of model.enums) lines.push(`export const ${entry.constant} = [${entry.values.map(q).join(", ")}] as const;`, `export type ${pascal(entry.name)} = (typeof ${entry.constant})[number];`);
+	for (const table of model.tables) for (const column of table.columns) if (column.values && !column.snapshot.isEnum) {
+		const constant = `${table.key}${pascal(column.app)}Values`.replace(/^[A-Z]/, (c) => c.toLowerCase());
+		lines.push(`export const ${constant} = [${column.values.map(q).join(", ")}] as const;`, `export type ${pascal(table.key)}${pascal(column.app)} = (typeof ${constant})[number];`);
+	}
+	if (model.enums.length > 0) lines.push("");
+	lines.push(...modelsType(model), "", ...functionsType(model), "", "export type TableName = keyof Models;", "/** Constraint names for `isConflict`, `isCheck` and `isForeignKey`. */", "export type UniqueConstraint = { [T in TableName]: Extract<keyof Models[T]['UniqueKeys'], string> }[TableName];", "export type CheckConstraint = Models[TableName]['Checks'];", "export type ForeignKeyConstraint = Models[TableName]['ForeignKeys'];", "export type RowOf<T extends TableName> = Models[T]['Row'];", "export type InsertOf<T extends TableName> = Models[T]['Insert'];", "export type UpdateOf<T extends TableName> = Models[T]['Update'];", "");
+	if (model.meta.buckets) lines.push("/** Bucket configs for `defineBucket` from `better-supabase/storage`. */", `export const buckets = ${JSON.stringify(model.meta.buckets, null, 2)} as const;`, "");
+	if (model.meta.topics) lines.push("/** Topic templates for `defineTopic` from `better-supabase/realtime`. */", `export const topics = ${JSON.stringify(model.meta.topics, null, 2)} as const;`, "");
+	lines.push("export const schema: Schema<Models, Database, Functions> = defineSchema(meta);", "");
+	return lines.join("\n");
+}
+//#endregion
+//#region src/cli/introspect/typegen.ts
+/**
+* The package root and `/introspection` build their arktype schemas on
+* import (about 90 ms), so they load when a command reads or validates
+* metadata, not for `--help`.
+*/
+const metadataModule = () => import("@supabase/postgrest-typegen");
+const introspectionModule = () => import("@supabase/postgrest-typegen/introspection");
+/** Introspects `schemas`, keeping only the types they reference. */
+async function readGeneratorMetadata(db, schemas) {
+	const { introspect } = await introspectionModule();
+	return pruneTypes(await introspect(db, { includedSchemas: [...schemas] }), schemas);
+}
+/** Postgres assigns oids below this to built-in objects; those are stable. */
+const FIRST_NORMAL_OID = 16384;
+/**
+* Replaces the oids of user objects with ids derived from their names and
+* zeroes size estimates, so a snapshot of the same schema is byte-identical
+* after `supabase db reset` or on another machine. Returns the id mapping
+* for data keyed by the old oids.
+*/
+function stabilizeMetadata(metadata) {
+	const ids = /* @__PURE__ */ new Map();
+	const assign = (base, entries) => {
+		[...entries].sort((a, b) => byCodePoint(a.key, b.key)).forEach((entry, index) => {
+			if (entry.id >= FIRST_NORMAL_OID) ids.set(entry.id, base + index);
+		});
+	};
+	assign(1e6, [
+		...metadata.tables,
+		...metadata.foreignTables,
+		...metadata.views,
+		...metadata.materializedViews
+	].map((entry) => ({
+		id: entry.id,
+		key: `${entry.schema}.${entry.name}`
+	})));
+	assign(2e6, metadata.types.map((entry) => ({
+		id: entry.id,
+		key: `${entry.schema}.${entry.name}`
+	})));
+	assign(3e6, metadata.functions.map((entry) => ({
+		id: entry.id,
+		key: `${entry.schema}.${entry.name}(${entry.identity_argument_types})`
+	})));
+	assign(4e6, metadata.schemas.map((entry) => ({
+		id: entry.id,
+		key: entry.name
+	})));
+	const map = (id) => ids.get(id) ?? id;
+	const mapNullable = (id) => id === null ? null : map(id);
+	const stable = {
+		...metadata,
+		schemas: metadata.schemas.map((entry) => ({
+			...entry,
+			id: map(entry.id)
+		})),
+		tables: metadata.tables.map((entry) => ({
+			...entry,
+			id: map(entry.id),
+			bytes: 0,
+			size: "0 bytes",
+			live_rows_estimate: 0,
+			dead_rows_estimate: 0
+		})),
+		foreignTables: metadata.foreignTables.map((entry) => ({
+			...entry,
+			id: map(entry.id)
+		})),
+		views: metadata.views.map((entry) => ({
+			...entry,
+			id: map(entry.id)
+		})),
+		materializedViews: metadata.materializedViews.map((entry) => ({
+			...entry,
+			id: map(entry.id)
+		})),
+		columns: metadata.columns.map((entry) => ({
+			...entry,
+			table_id: map(entry.table_id),
+			id: `${map(entry.table_id)}.${entry.ordinal_position}`
+		})),
+		primaryKeys: metadata.primaryKeys.map((entry) => ({
+			...entry,
+			table_id: map(entry.table_id)
+		})),
+		functions: metadata.functions.map((entry) => ({
+			...entry,
+			id: map(entry.id),
+			return_type_id: map(entry.return_type_id),
+			return_type_relation_id: mapNullable(entry.return_type_relation_id),
+			args: entry.args.map((arg) => ({
+				...arg,
+				type_id: map(arg.type_id)
+			}))
+		})),
+		types: metadata.types.map((entry) => ({
+			...entry,
+			id: map(entry.id),
+			type_relation_id: mapNullable(entry.type_relation_id),
+			attributes: entry.attributes.map((attribute) => ({
+				...attribute,
+				type_id: map(attribute.type_id)
+			}))
+		}))
+	};
+	return {
+		metadata: sortGeneratorMetadata(stable),
+		ids
+	};
+}
+/** Validates metadata loaded from a snapshot file. */
+async function validateGeneratorMetadata(data) {
+	const { parseGeneratorMetadata } = await metadataModule();
+	return parseGeneratorMetadata(data);
+}
+/** The JSON document out-of-process generators read. */
+async function serializeGenerator(metadata) {
+	const { serializeGeneratorMetadata } = await metadataModule();
+	return serializeGeneratorMetadata(sortGeneratorMetadata(metadata));
+}
+/**
+* Keeps only what belongs to `schemas`, so the Database type matches
+* `supabase gen types --schema ...` for exactly those schemas.
+*/
+function restrictSchemas(metadata, schemas) {
+	const keep = new Set(schemas);
+	return {
+		...metadata,
+		schemas: metadata.schemas.filter((schema) => keep.has(schema.name)),
+		tables: metadata.tables.filter((table) => keep.has(table.schema)),
+		foreignTables: metadata.foreignTables.filter((table) => keep.has(table.schema)),
+		views: metadata.views.filter((view) => keep.has(view.schema)),
+		materializedViews: metadata.materializedViews.filter((view) => keep.has(view.schema)),
+		columns: metadata.columns.filter((column) => keep.has(column.schema)),
+		primaryKeys: metadata.primaryKeys.filter((key) => keep.has(key.schema)),
+		relationships: metadata.relationships.filter((relationship) => keep.has(relationship.schema)),
+		functions: metadata.functions.filter((fn) => keep.has(fn.schema))
+	};
+}
+let oxfmt;
+/** oxfmt is an optional peer, loaded on demand; `undefined` when it is not installed. */
+function loadOxfmt() {
+	oxfmt ??= import("oxfmt").catch(() => void 0);
+	return oxfmt;
+}
+/** Whether `database.types.ts` comes out formatted. */
+async function oxfmtInstalled() {
+	return await loadOxfmt() !== void 0;
+}
+/** Formats like `supabase gen types`, or returns `code` as it is without oxfmt. */
+async function formatTypes(code) {
+	const formatter = await loadOxfmt();
+	if (!formatter) return code;
+	const { code: formatted, errors } = await formatter.format("output.ts", code, {
+		semi: false,
+		printWidth: 80
+	});
+	if (errors.length > 0) throw new Error(`oxfmt failed to format database.types.ts: ${errors.map((error) => error.message).join("; ")}`);
+	return formatted;
+}
+/**
+* Renders `database.types.ts`, byte for byte what `supabase gen types` prints
+* when oxfmt is installed.
+*/
+function generateDatabaseTypes(metadata, options) {
+	return generateTypescript(sortGeneratorMetadata(restrictSchemas(metadata, options.schemas)), {
+		postgrestVersion: options.postgrestVersion,
+		detectOneToOneRelationships: true,
+		format: formatTypes
+	});
+}
+/**
+* TypeScript type for a column or argument, resolved exactly like the
+* `Database` type does (domains, composites, enums in other schemas).
+*/
+function tsTypeOf(metadata, schema, format, typeSchema) {
+	const owner = metadata.schemas.find((entry) => entry.name === schema) ?? {
+		id: 0,
+		name: schema,
+		owner: ""
+	};
+	return pgTypeToTsType(owner, format, {
+		types: metadata.types,
+		schemas: metadata.schemas,
+		tables: metadata.tables,
+		views: metadata.views,
+		foreignTables: metadata.foreignTables,
+		materializedViews: metadata.materializedViews
+	}, typeSchema);
+}
+/**
+* `introspect()` returns every type in the database (hundreds of built-ins).
+* Keep the ones in the read schemas and those referenced by columns,
+* functions and composite attributes; built-in scalars resolve by name.
+*/
+function pruneTypes(metadata, schemas) {
+	const byId = new Map(metadata.types.map((type) => [type.id, type]));
+	const byName = new Map(metadata.types.map((type) => [`${type.schema}.${type.name}`, type]));
+	const keep = /* @__PURE__ */ new Set();
+	const visit = (id) => {
+		if (id === null || id === void 0 || keep.has(id)) return;
+		const type = byId.get(id);
+		if (!type) return;
+		keep.add(id);
+		for (const attribute of type.attributes) visit(attribute.type_id);
+	};
+	for (const type of metadata.types) if (schemas.includes(type.schema)) visit(type.id);
+	for (const column of metadata.columns) {
+		visit(byName.get(`${column.type_schema}.${column.format}`)?.id);
+		visit(byName.get(`${column.type_schema}.${column.format.replace(/^_/, "")}`)?.id);
+	}
+	for (const fn of metadata.functions) {
+		visit(fn.return_type_id);
+		for (const arg of fn.args) visit(arg.type_id);
+	}
+	return {
+		...metadata,
+		types: metadata.types.filter((type) => keep.has(type.id))
+	};
+}
+//#endregion
+//#region src/cli/gen/model.ts
+const SOFT_DELETE_UDTS = /* @__PURE__ */ new Set(["timestamptz", "timestamp"]);
+const applyCasing = (name, casing) => casing === "camel" ? toCamel(name) : name;
+function tableKey(table, casing, schemas) {
+	const base = applyCasing(table.name, casing);
+	if (schemas.length === 1 || table.schema === "public") return base;
+	return applyCasing(`${table.schema}_${table.name}`, casing);
+}
+const CODEC_TYPE = {
+	instant: "Temporal.Instant",
+	plainDateTime: "Temporal.PlainDateTime",
+	bigint: "bigint",
+	string: "string"
+};
+function codecFor(udt, config) {
+	const { codecs } = config;
+	if (codecs.timestamptz === "instant") {
+		if (udt === "timestamptz") return "instant";
+		if (udt === "timestamp") return "plainDateTime";
+	}
+	if (udt === "int8" && codecs.int8 !== "number") return codecs.int8;
+	if (udt === "numeric" && codecs.numeric === "string") return "string";
+}
+const TEXT_UDTS = /* @__PURE__ */ new Set([
+	"text",
+	"varchar",
+	"bpchar"
+]);
+/** `config.storagePaths` resolved to bucket ids, with a check that every key is used. */
+function storagePathsOf(config) {
+	const bucketId = (name) => {
+		const bucket = config.buckets[name];
+		if (!bucket) return name;
+		return bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
+	};
+	const unused = new Set(Object.keys(config.storagePaths));
+	return {
+		lookup(schema, table, column, udt) {
+			const key = [`${schema}.${table}.${column}`, `${table}.${column}`].find((candidate) => candidate in config.storagePaths);
+			if (key === void 0) return;
+			unused.delete(key);
+			if (!TEXT_UDTS.has(udt)) throw new TypeError(`storagePaths["${key}"]: ${schema}.${table}.${column} is ${udt}, not a text column`);
+			return bucketId(config.storagePaths[key]);
+		},
+		assertUsed() {
+			const [first] = unused;
+			if (first !== void 0) throw new TypeError(`storagePaths["${first}"]: no such column. Use \`table.column\` or \`schema.table.column\` (database names) in \`schemas\`.`);
+		}
+	};
+}
+function enumType(values) {
+	return values.map((value) => JSON.stringify(value)).join(" | ");
+}
+/** Builds the codegen model from a snapshot and config. */
+function buildModel(snapshot, config) {
+	const catalog = toCatalog(snapshot);
+	const introspection = restrictSchemas(snapshot.generator, config.schemas);
+	const tsType = (schema, format, typeSchema) => tsTypeOf(introspection, schema, format, typeSchema).replaceAll(/\(([\w.$]+)\)\[\]/g, "$1[]");
+	const enumsByName = /* @__PURE__ */ new Map();
+	for (const entry of catalog.enums) enumsByName.set(`${entry.schema}.${entry.name}`, entry.values);
+	const jsonImports = /* @__PURE__ */ new Map();
+	const jsonTypeFor = (table, column) => {
+		const override = config.json[`${table}.${column}`];
+		if (!override) return void 0;
+		if ("type" in override) return override.type;
+		const [from, name] = override.import.split("#");
+		if (!from || !name) throw new TypeError(`json["${table}.${column}"].import must look like "./path.ts#TypeName"`);
+		jsonImports.set(name, {
+			name,
+			from
+		});
+		return name;
+	};
+	const storagePaths = storagePathsOf(config);
+	const included = catalog.tables.filter((table) => config.schemas.includes(table.schema) && !config.tables[table.name]?.exclude);
+	const keyOf = /* @__PURE__ */ new Map();
+	for (const table of included) keyOf.set(`${table.schema}.${table.name}`, tableKey(table, config.casing, config.schemas));
+	const tables = included.map((table) => {
+		const casing = config.tables[table.name]?.casing ?? config.casing;
+		const checks = /* @__PURE__ */ new Map();
+		for (const check of table.checks) {
+			const union = parseCheckUnion(check.definition);
+			if (union) checks.set(union.column, union.values);
+		}
+		return {
+			table,
+			casing,
+			columns: table.columns.map((column) => {
+				const values = (column.isEnum ? enumsByName.get(`${column.typeSchema}.${column.udt}`) : void 0) ?? checks.get(column.name);
+				const json = isJsonUdt(column.udt);
+				const override = json ? jsonTypeFor(table.name, column.name) : void 0;
+				const storage = storagePaths.lookup(table.schema, table.name, column.name, column.udt);
+				const codec = override || values || storage ? void 0 : codecFor(column.udt, config);
+				const base = override ?? (values ? enumType(values) : storage ? `StoragePath<${JSON.stringify(storage)}>` : codec ? CODEC_TYPE[codec] : void 0);
+				const columnType = base === void 0 ? tsType(table.schema, column.format, column.typeSchema) : column.isArray ? arrayOf(base) : base;
+				const readonly = column.generated || column.identity === "always";
+				const insertable = !readonly && table.insertable;
+				const updatable = !readonly && table.updatable && column.updatable;
+				return {
+					app: applyCasing(column.name, casing),
+					db: column.name,
+					snapshot: column,
+					tsType: columnType,
+					nullable: column.nullable,
+					optional: column.nullable || column.hasDefault || readonly,
+					readonly,
+					values,
+					json,
+					codec,
+					storage,
+					insertable,
+					updatable
+				};
+			})
+		};
+	});
+	storagePaths.assertUsed();
+	const byKey = /* @__PURE__ */ new Map();
+	for (const entry of tables) byKey.set(`${entry.table.schema}.${entry.table.name}`, entry);
+	const appName = (schema, table, column) => {
+		return byKey.get(`${schema}.${table}`)?.columns.find((col) => col.db === column)?.app ?? column;
+	};
+	const relations = /* @__PURE__ */ new Map();
+	const push = (tableId, relation) => {
+		const list = relations.get(tableId);
+		if (list) list.push(relation);
+		else relations.set(tableId, [relation]);
+	};
+	for (const { table, casing, columns } of tables) {
+		const sourceId = `${table.schema}.${table.name}`;
+		for (const fk of table.foreignKeys) {
+			const targetId = `${fk.refSchema}.${fk.refTable}`;
+			const target = byKey.get(targetId);
+			if (!target) continue;
+			const targetKey = keyOf.get(targetId) ?? fk.refTable;
+			const sourceColumns = fk.columns.map((column) => appName(table.schema, table.name, column));
+			const targetColumns = fk.refColumns.map((column) => appName(fk.refSchema, fk.refTable, column));
+			const nullable = fk.columns.some((column) => columns.find((col) => col.db === column)?.nullable ?? true);
+			const onDelete = fk.onDelete === "cascade" || fk.onDelete === "set null" || fk.onDelete === "set default" ? { onDelete: fk.onDelete } : {};
+			const naming = namingColumns(fk.columns, fk.refColumns);
+			const [only] = naming;
+			const forwardBase = naming.length === 1 && only?.endsWith("_id") ? only.slice(0, -3) : singular(fk.refTable);
+			push(sourceId, {
+				name: applyCasing(forwardBase, casing),
+				meta: {
+					table: targetKey,
+					kind: "one",
+					nullable,
+					foreignKey: fk.name,
+					columns: sourceColumns,
+					references: targetColumns,
+					direction: "forward",
+					...onDelete
+				}
+			});
+			const unique = fk.oneToOne || sameColumns(table.primaryKey, fk.columns) || table.uniques.some((key) => sameColumns(key.columns, fk.columns));
+			push(targetId, {
+				name: applyCasing(unique ? singular(table.name) : table.name, target.casing),
+				meta: {
+					table: keyOf.get(sourceId) ?? table.name,
+					kind: unique ? "one" : "many",
+					nullable: true,
+					foreignKey: fk.name,
+					columns: targetColumns,
+					references: sourceColumns,
+					direction: "reverse",
+					...onDelete
+				}
+			});
+		}
+	}
+	const flagsConfig = config.plugins;
+	const tableModels = tables.map(({ table, casing, columns }) => {
+		const id = `${table.schema}.${table.name}`;
+		const renames = config.tables[table.name]?.relations ?? {};
+		const columnNames = new Set(columns.map((column) => column.app));
+		const list = dedupeRelations(relations.get(id) ?? [], columnNames, casing).map((relation) => ({
+			...relation,
+			name: renames[relation.name] ?? relation.name
+		}));
+		const has = (db) => columns.find((col) => col.db === db)?.app;
+		const flags = {};
+		if (flagsConfig.softDelete) {
+			const db = flagsConfig.softDelete.column;
+			const column = columns.find((col) => col.db === db);
+			if (column) {
+				const udt = column.snapshot.udt;
+				if (column.snapshot.isArray || !SOFT_DELETE_UDTS.has(udt)) throw new TypeError(`plugins.softDelete.column: ${table.schema}.${table.name}.${db} is ${udt}, but softDelete() writes a timestamp. Use timestamptz or timestamp.`);
+				flags.softDelete = column.app;
+			}
+		}
+		if (flagsConfig.timestamps) {
+			const createdAt = has(flagsConfig.timestamps.createdAt);
+			const updatedAt = has(flagsConfig.timestamps.updatedAt);
+			if (createdAt || updatedAt) flags.timestamps = {
+				...createdAt ? { createdAt } : {},
+				...updatedAt ? { updatedAt } : {}
+			};
+		}
+		if (flagsConfig.tenant) {
+			const column = has(flagsConfig.tenant.column);
+			if (column) flags.tenant = column;
+		}
+		if (flagsConfig.actor) {
+			const createdBy = has(flagsConfig.actor.createdBy);
+			const updatedBy = has(flagsConfig.actor.updatedBy);
+			const impersonatedBy = has(flagsConfig.actor.impersonatedBy);
+			if (createdBy || updatedBy || impersonatedBy) flags.actor = {
+				...createdBy ? { createdBy } : {},
+				...updatedBy ? { updatedBy } : {},
+				...impersonatedBy ? { impersonatedBy } : {}
+			};
+		}
+		const key = keyOf.get(id) ?? table.name;
+		const columnMeta = {};
+		for (const column of columns) {
+			const meta = {
+				db: column.db,
+				type: column.snapshot.udt,
+				nullable: column.nullable,
+				hasDefault: column.snapshot.hasDefault
+			};
+			if (column.readonly) meta.generated = true;
+			if (column.snapshot.identity) meta.identity = column.snapshot.identity;
+			if (!column.readonly && !column.insertable) meta.insertable = false;
+			if (!column.readonly && !column.updatable) meta.updatable = false;
+			if (column.snapshot.isArray) meta.array = true;
+			if (column.json) meta.json = true;
+			if (column.values) meta.enum = column.values;
+			if (column.codec) meta.codec = column.codec;
+			if (column.storage) meta.storage = column.storage;
+			if (config.sensitive.includes(`${table.name}.${column.db}`) || config.sensitive.includes(`${table.schema}.${table.name}.${column.db}`)) meta.sensitive = true;
+			columnMeta[column.app] = meta;
+		}
+		const app = (db) => columns.find((col) => col.db === db)?.app ?? db;
+		const uniqueKeys = {};
+		for (const unique of table.uniques) uniqueKeys[unique.name] = unique.columns.map(app);
+		const relationMeta = {};
+		for (const relation of list) relationMeta[relation.name] = relation.meta;
+		return {
+			key,
+			snapshot: table,
+			casing,
+			columns,
+			relations: list,
+			meta: {
+				key,
+				name: table.name,
+				schema: table.schema,
+				kind: table.kind,
+				columns: columnMeta,
+				primaryKey: table.primaryKey.map(app),
+				uniqueKeys,
+				relations: relationMeta,
+				flags
+			}
+		};
+	});
+	const enums = catalog.enums.filter((entry) => config.schemas.includes(entry.schema)).map((entry) => ({
+		schema: entry.schema,
+		name: entry.name,
+		constant: `${toCamel(entry.name)}Values`,
+		values: entry.values
+	}));
+	const seen = /* @__PURE__ */ new Set();
+	const functions = catalog.functions.filter((fn) => config.schemas.includes(fn.schema)).filter((fn) => fn.returns !== "trigger" && fn.returns !== "event_trigger").filter((fn) => !fn.args.some((arg) => arg.udt === "internal")).filter((fn) => {
+		if (seen.has(fn.name)) return false;
+		seen.add(fn.name);
+		return true;
+	}).map((fn) => {
+		const typeOf = (format) => {
+			const isArray = format.startsWith("_");
+			const values = enumsByName.get(`${fn.schema}.${isArray ? format.slice(1) : format}`);
+			if (values) return isArray ? arrayOf(enumType(values)) : enumType(values);
+			return tsType(fn.schema, format);
+		};
+		let returns;
+		if (fn.returnsTable) returns = `{ ${fn.returnsTable.map((column) => `${JSON.stringify(column.name)}: ${typeOf(column.udt)}`).join("; ")} }[]`;
+		else {
+			returns = typeOf(fn.returns);
+			if (fn.returnsSet) returns = arrayOf(returns);
+		}
+		return {
+			key: fn.name,
+			meta: {
+				name: fn.name,
+				schema: fn.schema,
+				args: fn.args.map((arg) => ({
+					name: arg.name,
+					type: arg.udt
+				})),
+				returns: fn.returns,
+				returnsSet: fn.returnsSet,
+				volatility: fn.volatility
+			},
+			args: fn.args.map((arg) => ({
+				name: arg.name,
+				tsType: typeOf(arg.isArray ? `_${arg.udt}` : arg.udt),
+				optional: arg.hasDefault
+			})),
+			returns
+		};
+	});
+	const tablesMeta = {};
+	for (const table of tableModels) tablesMeta[table.key] = table.meta;
+	const enumsMeta = {};
+	for (const entry of enums) enumsMeta[entry.name] = entry.values;
+	const functionsMeta = {};
+	for (const fn of functions) functionsMeta[fn.key] = fn.meta;
+	const claimOverrides = {};
+	for (const key of Object.keys(DEFAULT_CLAIMS)) if (config.claims[key] !== DEFAULT_CLAIMS[key]) claimOverrides[key] = config.claims[key];
+	const tenantClaim = config.claims.tenant === DEFAULT_CLAIMS.tenant ? void 0 : tenantClaimPaths(config.claims.tenant);
+	const meta = {
+		version: 1,
+		casing: config.casing,
+		tables: tablesMeta,
+		enums: enumsMeta,
+		functions: functionsMeta,
+		...Object.keys(config.buckets).length > 0 ? { buckets: Object.fromEntries(Object.entries(config.buckets).map(([name, bucket]) => [name, {
+			id: bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`),
+			public: bucket.public ?? false,
+			path: bucket.path,
+			...bucket.policy ? { policy: bucket.policy } : {},
+			...bucket.policy === "tenant" && tenantClaim ? { tenant: { claim: tenantClaim } } : {},
+			...bucket.fileSizeLimit ? { fileSizeLimit: bucket.fileSizeLimit } : {},
+			...bucket.allowedMimeTypes ? { allowedMimeTypes: bucket.allowedMimeTypes } : {}
+		}])) } : {},
+		...Object.keys(config.topics).length > 0 ? { topics: config.topics } : {},
+		...config.realtime.tables.length > 0 ? { realtime: realtimeMeta(config.realtime.tables, tableModels) } : {},
+		...Object.keys(claimOverrides).length > 0 ? { claims: claimOverrides } : {}
+	};
+	return {
+		tables: tableModels,
+		enums,
+		functions,
+		jsonImports: [...jsonImports.values()],
+		meta,
+		config,
+		catalog,
+		introspection
+	};
+}
+/**
+* The columns that name a relation. A composite key that repeats a column on
+* both sides, such as `(customer_id, organization_id)` referencing
+* `(id, organization_id)` to keep rows in one tenant, is named by the rest.
+*/
+function namingColumns(columns, references) {
+	const own = columns.filter((column, index) => column !== references[index]);
+	return own.length > 0 ? own : columns;
+}
+/**
+* Makes relation names unique per table and distinct from column names:
+* two FKs to the same table become `customersByPrimaryContact`-style names.
+*/
+function dedupeRelations(list, columns, casing) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const relation of list) counts.set(relation.name, (counts.get(relation.name) ?? 0) + 1);
+	const used = /* @__PURE__ */ new Set();
+	return list.map((relation) => {
+		let name = relation.name;
+		if ((counts.get(name) ?? 0) > 1 || columns.has(name)) {
+			const { columns: from, references: to } = relation.meta;
+			const suffix = (relation.meta.direction === "forward" ? namingColumns(from, to) : namingColumns(to, from)).map((column) => column.replace(/_?[iI]d$/, "")).join("_");
+			name = applyCasing(`${casing === "camel" ? toSnake(name) : name}_by_${casing === "camel" ? toSnake(suffix) : suffix}`, casing);
+		}
+		while (used.has(name) || columns.has(name)) name = `${name}_`;
+		used.add(name);
+		return {
+			...relation,
+			name
+		};
+	});
+}
+function realtimeMeta(names, tables) {
+	const out = {};
+	for (const name of names) {
+		const table = tables.find((candidate) => candidate.meta.name === name || `${candidate.meta.schema}.${candidate.meta.name}` === name);
+		if (!table) throw new Error(`realtime.tables: unknown table "${name}". Check the name and \`schemas\`.`);
+		const tenant = table.meta.flags.tenant;
+		out[table.key] = tenant ? { tenant } : {};
+	}
+	return out;
+}
+//#endregion
+//#region src/cli/introspect/extras.ts
+/**
+* Catalog details `@supabase/postgrest-typegen` leaves out: named unique and
+* CHECK constraints, foreign key actions, ordered primary keys, indexes,
+* policies, triggers, grants, buckets and the realtime publication.
+*
+* The SQL takes no bind parameters because the Management API endpoint only
+* accepts a query string; schema names are inlined as escaped literals.
+*/
+const literalArray = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
+/** Row estimate from which a table counts as large in the snapshot. */
+const LARGE_TABLE_ROWS = 1e4;
+const RELATIONS = (schemas) => `
+select c.oid::int8 as id, n.nspname as schema, c.relname as name,
+  c.reltuples >= ${LARGE_TABLE_ROWS} as large
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
+  and not c.relispartition
+order by 2, 3`;
+const CONSTRAINTS = (schemas) => `
+select con.conrelid::int8 as table_id, con.conname as name, con.contype as type,
+  array(select a.attname from unnest(con.conkey) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum order by k.ord)::text[] as columns,
+  con.confdeltype as on_delete, con.confupdtype as on_update,
+  pg_get_constraintdef(con.oid) as definition
+from pg_constraint con
+join pg_class c on c.oid = con.conrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas}) and con.contype in ('p', 'u', 'f', 'c')
+order by 1, 2`;
+const INDEXES = (schemas) => `
+select ix.indrelid::int8 as table_id, i.relname as name,
+  ix.indisunique as unique, ix.indisprimary as primary,
+  (ix.indpred is not null or 0 = any(ix.indkey::int2[])) as partial,
+  am.amname as method, pg_get_expr(ix.indpred, ix.indrelid) as predicate,
+  array(select a.attname from unnest(ix.indkey::int2[]) with ordinality k(attnum, ord)
+    join pg_attribute a on a.attrelid = ix.indrelid and a.attnum = k.attnum order by k.ord)::text[] as columns
+from pg_index ix
+join pg_class i on i.oid = ix.indexrelid
+join pg_am am on am.oid = i.relam
+join pg_class c on c.oid = ix.indrelid
+join pg_namespace n on n.oid = c.relnamespace
+where n.nspname = any(${schemas})
+order by 1, 2`;
+const POLICIES = (schemas) => `
+select c.oid::int8 as table_id, p.policyname as name,
+  (p.permissive = 'PERMISSIVE') as permissive, p.roles::text[] as roles, lower(p.cmd) as command,
+  p.qual as using_expr, p.with_check as check_expr,
+  array(
+    select distinct fn.nspname || '.' || pr.proname
+    from pg_policy pol
+    join pg_depend d on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+      and d.refclassid = 'pg_proc'::regclass
+    join pg_proc pr on pr.oid = d.refobjid
+    join pg_namespace fn on fn.oid = pr.pronamespace
+    where pol.polrelid = c.oid and pol.polname = p.policyname
+    order by 1
+  )::text[] as functions
+from pg_policies p
+join pg_namespace n on n.nspname = p.schemaname
+join pg_class c on c.relnamespace = n.oid and c.relname = p.tablename
+where p.schemaname = any(${schemas})
+order by 1, 2`;
+const FUNCTIONS = (schemas) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(
+    select r from unnest(array['anon', 'authenticated']) r
+    where has_function_privilege(r, p.oid, 'EXECUTE')
+  ) as execute
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where p.oid in (
+    select d.refobjid
+    from pg_depend d
+    join pg_policy pol on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
+    join pg_class c on c.oid = pol.polrelid
+    join pg_namespace cn on cn.oid = c.relnamespace
+    where d.refclassid = 'pg_proc'::regclass and cn.nspname = any(${schemas})
+  )
+  or (n.nspname = any(${schemas}) and ((p.prosecdef
+    and p.prorettype not in ('trigger'::regtype, 'event_trigger'::regtype)) or exists (
+    select 1 from unnest(p.proconfig) setting where setting not like 'search_path=%'
+  )))
+order by 1, 2, 3`;
+/** Roles the hook checks care about: the one Auth calls it as, and the API roles. */
+const HOOK_ROLES = literalArray([
+	"supabase_auth_admin",
+	"authenticated",
+	"anon"
+]);
+const HOOKS = (names) => `
+select n.nspname as schema, p.proname as name,
+  pg_get_function_identity_arguments(p.oid) as signature,
+  l.lanname as language, p.provolatile as volatility,
+  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_function_privilege(r.oid, p.oid, 'execute')
+    order by 1) as execute,
+  exists(select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
+    where a.grantee = 0 and a.privilege_type = 'EXECUTE') as public_execute,
+  array(select r.rolname::text from pg_roles r
+    where r.rolname = any(${HOOK_ROLES}) and has_schema_privilege(r.oid, n.oid, 'usage')
+    order by 1) as schema_usage,
+  p.prosrc as source
+from pg_proc p
+join pg_namespace n on n.oid = p.pronamespace
+join pg_language l on l.oid = p.prolang
+where n.nspname || '.' || p.proname = any(${names})
+order by 1, 2, 3`;
+const TRIGGERS = (schemas) => `
+select t.tgrelid::int8 as table_id, t.tgname as name,
+  pn.nspname || '.' || p.proname as function,
+  case when t.tgtype & 2 = 2 then 'before' when t.tgtype & 64 = 64 then 'instead of' else 'after' end as timing,
+  array_remove(array[
+    case when t.tgtype & 4 = 4 then 'insert' end,
+    case when t.tgtype & 16 = 16 then 'update' end,
+    case when t.tgtype & 8 = 8 then 'delete' end,
+    case when t.tgtype & 32 = 32 then 'truncate' end
+  ], null)::text[] as events,
+  case when t.tgtype & 1 = 1 then 'row' else 'statement' end as level
+from pg_trigger t
+join pg_class c on c.oid = t.tgrelid
+join pg_namespace n on n.oid = c.relnamespace
+join pg_proc p on p.oid = t.tgfoid
+join pg_namespace pn on pn.oid = p.pronamespace
+where not t.tgisinternal and n.nspname = any(${schemas})
+order by 1, 2`;
+const GRANTS = (schemas) => `
+select c.oid::int8 as table_id, g.grantee as role,
+  array_agg(g.privilege_type::text order by g.privilege_type)::text[] as privileges
+from information_schema.role_table_grants g
+join pg_namespace n on n.nspname = g.table_schema
+join pg_class c on c.relnamespace = n.oid and c.relname = g.table_name
+where g.table_schema = any(${schemas}) and g.grantee in ('anon', 'authenticated', 'service_role')
+group by 1, 2
+order by 1, 2`;
+const COLUMN_GRANTS = (schemas) => `
+select c.oid::int8 as table_id, a.attname as column, r.rolname as role,
+  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
+from pg_class c
+join pg_namespace n on n.oid = c.relnamespace
+join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped and a.attacl is not null
+cross join lateral aclexplode(a.attacl) acl
+join pg_roles r on r.oid = acl.grantee
+where n.nspname = any(${schemas}) and r.rolname in ('anon', 'authenticated')
+  and acl.privilege_type in ('INSERT', 'UPDATE')
+group by 1, 2, 3
+order by 1, 2, 3`;
+const BUCKETS = `
+select id, public, file_size_limit, allowed_mime_types
+from storage.buckets
+order by id`;
+const REALTIME = `
+select schemaname || '.' || tablename as name
+from pg_publication_tables
+where pubname = 'supabase_realtime'
+order by 1`;
+const ROLE_SETTINGS = `
+select r.rolname as role, s.setconfig as config
+from pg_catalog.pg_db_role_setting s
+join pg_catalog.pg_roles r on r.oid = s.setrole
+where r.rolname in ('authenticator', 'anon', 'authenticated')
+  and s.setdatabase in (0, (select oid from pg_catalog.pg_database where datname = current_database()))
+order by s.setdatabase`;
+const HAS_TABLE = (qualified) => `select to_regclass('${qualified}') is not null as present`;
+const ACTIONS = {
+	a: "no action",
+	r: "restrict",
+	c: "cascade",
+	n: "set null",
+	d: "set default"
+};
+const VOLATILITY = {
+	i: "immutable",
+	s: "stable",
+	v: "volatile"
+};
+/** `['statement_timeout=5s']` as `{ statement_timeout: '5s' }`. */
+function settingsOf(config) {
+	const settings = {};
+	for (const entry of config ?? []) {
+		const at = entry.indexOf("=");
+		if (at > 0) settings[entry.slice(0, at)] = entry.slice(at + 1);
+	}
+	return settings;
+}
+const functionOf = (row) => ({
+	schema: row.schema,
+	name: row.name,
+	signature: row.signature,
+	language: row.language,
+	volatility: VOLATILITY[row.volatility],
+	securityDefiner: row.security_definer,
+	settings: settingsOf(row.config)
+});
+/** The functions behind Auth hooks, in any schema, with their ACLs. */
+async function readHooks(db, targets) {
+	if (targets.length === 0) return [];
+	const found = await rows(db, HOOKS(literalArray(targets.map((t) => `${t.schema}.${t.name}`))));
+	return targets.map((target) => ({
+		hook: target.hook,
+		schema: target.schema,
+		name: target.name,
+		functions: found.filter((row) => row.schema === target.schema && row.name === target.name).map((row) => ({
+			...functionOf(row),
+			execute: row.execute,
+			publicExecute: row.public_execute,
+			schemaUsage: row.schema_usage,
+			...row.source === null ? {} : { source: row.source }
+		}))
+	}));
+}
+async function rows(db, sql) {
+	return (await db.query(sql)).rows;
+}
+/** Rows from a table owned by another Supabase service, if it exists. */
+async function serviceRows(db, qualified, sql) {
+	const [probe] = await rows(db, HAS_TABLE(qualified));
+	return probe?.present ? rows(db, sql) : [];
+}
+function groupById(list) {
+	const map = /* @__PURE__ */ new Map();
+	for (const row of list) {
+		const id = Number(row.table_id);
+		const entry = map.get(id);
+		if (entry) entry.push(row);
+		else map.set(id, [row]);
+	}
+	return map;
+}
+/** Reads the extras for `schemas`, with the catalog queries in flight together. */
+async function readExtras(db, schemas, hooks = []) {
+	const list = literalArray(schemas);
+	const [relations, constraintRows, indexRows, policyRows, triggerRows, grantRows, columnGrantRows, buckets, realtime, functions, roleRows, hookRows] = await Promise.all([
+		rows(db, RELATIONS(list)),
+		rows(db, CONSTRAINTS(list)),
+		rows(db, INDEXES(list)),
+		rows(db, POLICIES(list)),
+		rows(db, TRIGGERS(list)),
+		rows(db, GRANTS(list)),
+		rows(db, COLUMN_GRANTS(list)),
+		serviceRows(db, "storage.buckets", BUCKETS),
+		rows(db, REALTIME),
+		rows(db, FUNCTIONS(list)),
+		rows(db, ROLE_SETTINGS),
+		hooks.length > 0 ? readHooks(db, hooks) : void 0
+	]);
+	const constraints = groupById(constraintRows);
+	const indexes = groupById(indexRows);
+	const policies = groupById(policyRows);
+	const triggers = groupById(triggerRows);
+	const grants = groupById(grantRows);
+	const columnGrants = groupById(columnGrantRows);
+	const roleSettings = {};
+	for (const row of roleRows) Object.assign(roleSettings[row.role] ??= {}, settingsOf(row.config));
+	return {
+		tables: relations.map((relation) => {
+			const id = Number(relation.id);
+			const own = constraints.get(id) ?? [];
+			const ownIndexes = indexes.get(id) ?? [];
+			const uniques = own.filter((con) => con.type === "u").map((con) => ({
+				name: con.name,
+				columns: con.columns
+			}));
+			const constraintNames = new Set(own.map((con) => con.name));
+			for (const index of ownIndexes) if (index.unique && !index.primary && !index.partial && !constraintNames.has(index.name)) uniques.push({
+				name: index.name,
+				columns: index.columns
+			});
+			return {
+				id,
+				schema: relation.schema,
+				name: relation.name,
+				primaryKey: own.find((con) => con.type === "p")?.columns ?? [],
+				uniques,
+				foreignKeys: own.filter((con) => con.type === "f").map((con) => ({
+					name: con.name,
+					onDelete: ACTIONS[con.on_delete] ?? "no action",
+					onUpdate: ACTIONS[con.on_update] ?? "no action"
+				})),
+				checks: own.filter((con) => con.type === "c").map((con) => ({
+					name: con.name,
+					definition: con.definition
+				})),
+				indexes: ownIndexes.map((index) => ({
+					name: index.name,
+					columns: index.columns,
+					unique: index.unique,
+					primary: index.primary,
+					partial: index.partial,
+					method: index.method,
+					predicate: index.predicate
+				})),
+				policies: (policies.get(id) ?? []).map((policy) => ({
+					name: policy.name,
+					command: policy.command,
+					roles: policy.roles,
+					permissive: policy.permissive,
+					using: policy.using_expr,
+					check: policy.check_expr,
+					functions: policy.functions ?? []
+				})),
+				triggers: (triggers.get(id) ?? []).map((trigger) => ({
+					name: trigger.name,
+					timing: trigger.timing,
+					events: trigger.events,
+					level: trigger.level,
+					function: trigger.function
+				})),
+				grants: (grants.get(id) ?? []).map((grant) => ({
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				columnGrants: (columnGrants.get(id) ?? []).map((grant) => ({
+					column: grant.column,
+					role: grant.role,
+					privileges: grant.privileges
+				})),
+				...relation.large ? { large: true } : {}
+			};
+		}),
+		buckets: buckets.map((row) => ({
+			id: row.id,
+			public: row.public,
+			fileSizeLimit: row.file_size_limit === null ? null : Number(row.file_size_limit),
+			allowedMimeTypes: row.allowed_mime_types
+		})),
+		realtime: realtime.map((row) => row.name),
+		roleSettings,
+		functions: functions.map((row) => ({
+			...functionOf(row),
+			execute: row.execute
+		})),
+		...hookRows ? { hooks: hookRows } : {}
+	};
+}
+//#endregion
+//#region src/cli/introspect/fingerprint.ts
+/** Catalogs whose rows only change with DDL, grants, comments or settings. */
+const CATALOGS = [
+	"pg_namespace",
+	"pg_attribute",
+	"pg_attrdef",
+	"pg_constraint",
+	"pg_index",
+	"pg_inherits",
+	"pg_rewrite",
+	"pg_policy",
+	"pg_trigger",
+	"pg_proc",
+	"pg_type",
+	"pg_enum",
+	"pg_description",
+	"pg_db_role_setting",
+	"pg_publication",
+	"pg_publication_rel",
+	"pg_extension"
+];
+const digest = (from) => `(select md5(coalesce(string_agg(x::text, ',' order by x::text), '')) from ${from} x)`;
+/**
+* One cheap query whose result changes whenever introspection could. pg_class
+* leaves out the planner statistics that VACUUM and ANALYZE rewrite, except
+* the row-count threshold the snapshot records. Bucket rows are data, so they
+* are hashed when `storage.buckets` exists.
+*/
+const FINGERPRINT_SQL = `select md5(concat_ws('|',
+  ${digest(`(select oid, relname, relnamespace, relkind, relacl, reloptions, relrowsecurity, relforcerowsecurity, relreplident, relispartition, reltuples >= ${LARGE_TABLE_ROWS} as large from pg_catalog.pg_class)`)},
+  ${CATALOGS.map((name) => digest(`pg_catalog.${name}`)).join(",\n  ")},
+  (select md5(coalesce(string_agg(rolname, ',' order by rolname), '')) from pg_catalog.pg_roles),
+  case when to_regclass('storage.buckets') is not null
+    then md5(query_to_xml('select id, public, file_size_limit, allowed_mime_types from storage.buckets order by id', false, false, '')::text)
+  end
+)) as fingerprint`;
+/** A hash of the catalog; equal values mean introspection would return the same snapshot. */
+async function catalogFingerprint(db) {
+	const [row] = (await db.query(FINGERPRINT_SQL)).rows;
+	const value = row && typeof row === "object" && "fingerprint" in row ? row.fingerprint : void 0;
+	if (typeof value !== "string") throw new TypeError("The catalog fingerprint query returned no row.");
+	return value;
+}
+//#endregion
+//#region src/cli/introspect/cache.ts
+/** Shared with the splinter download cache. */
+const CACHE_DIR = "node_modules/.cache/better-supabase";
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+function isEntry(value) {
+	return typeof value === "object" && value !== null && "key" in value && typeof value.key === "string" && "snapshot" in value && typeof value.snapshot === "object";
+}
+/**
+* Calls `read`, or returns the snapshot cached under `root` when the catalog
+* fingerprint, the `inputs` (schemas and hooks) and the CLI version all
+* match. One file per source keeps the cache from growing. A source that
+* cannot report a fingerprint is read every time.
+*/
+async function cachedIntrospect(root, source, inputs, read) {
+	const fingerprint = await catalogFingerprint(source.queryable).catch(() => void 0);
+	if (fingerprint === void 0) return read();
+	const key = sha256(JSON.stringify([
+		VERSION,
+		source.describe,
+		inputs,
+		fingerprint
+	]));
+	const file = resolve(root, CACHE_DIR, `snapshot-${sha256(source.describe).slice(0, 16)}.json`);
+	const cached = await readFile(file, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (isEntry(cached) && cached.key === key) return cached.snapshot;
+	const snapshot = await read();
+	const entry = {
+		key,
+		snapshot
+	};
+	await mkdir(dirname(file), { recursive: true }).then(() => writeFile(file, JSON.stringify(entry))).catch(() => void 0);
+	return snapshot;
+}
+//#endregion
+//#region src/cli/introspect/source.ts
+const POOL_SIZE = 4;
+const STATEMENT_TIMEOUT_MS = 12e4;
+/**
+* A small `pg` pool, since introspection issues its queries concurrently. A
+* `connect` that returns a single client gets its queries queued, because one
+* `pg.Client` runs them one at a time.
+*/
+async function pgSource(url, open = connect, signal) {
+	const { client, pooled, close, describe } = await open(url, void 0, {
+		pool: POOL_SIZE,
+		statementTimeout: STATEMENT_TIMEOUT_MS,
+		...signal ? { signal } : {}
+	});
+	if (pooled) return {
+		queryable: client,
+		close,
+		describe
+	};
+	let queue = Promise.resolve();
+	return {
+		queryable: { query(sql) {
+			const next = queue.then(() => client.query(sql));
+			queue = next.catch(() => void 0);
+			return next;
+		} },
+		close,
+		describe
+	};
+}
+/**
+* Runs introspection SQL through the Supabase Management API as the
+* read-only database user, so hosted projects need no database password.
+*/
+function managementSource(options) {
+	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
+	const doFetch = options.fetch ?? fetch;
+	const endpoint = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/database/query/read-only`;
+	return {
+		queryable: { async query(sql) {
+			const response = await doFetch(endpoint, {
+				method: "POST",
+				headers: {
+					authorization: `Bearer ${options.accessToken}`,
+					"content-type": "application/json"
+				},
+				body: JSON.stringify({ query: sql }),
+				...options.signal ? { signal: options.signal } : {}
+			});
+			const text = await response.text();
+			if (!response.ok) throw new Error(`Management API query failed (${response.status}) for project ${options.projectRef}: ${text.slice(0, 500)}`);
+			const rows = JSON.parse(text);
+			if (!Array.isArray(rows)) throw new TypeError(`Management API returned an unexpected body for project ${options.projectRef}.`);
+			return { rows };
+		} },
+		describe: `project ${options.projectRef} (Management API)`,
+		close: () => Promise.resolve()
+	};
+}
+//#endregion
+//#region src/cli/introspect/index.ts
+/** Reads a v2 snapshot: typegen metadata plus the extras. */
+async function introspect(db, schemas, options = {}) {
+	const unique = [...new Set(schemas)].sort();
+	const [metadata, extras] = await Promise.all([readGeneratorMetadata(db, unique), readExtras(db, unique, options.hooks)]);
+	const { metadata: generator, ids } = stabilizeMetadata(metadata);
+	return {
+		version: 2,
+		schemas: unique,
+		generator,
+		extras: {
+			...extras,
+			tables: extras.tables.map((table) => ({
+				...table,
+				id: ids.get(table.id) ?? table.id
+			}))
+		}
+	};
+}
+//#endregion
+//#region src/cli/commands/snapshot.ts
+const SNAPSHOT_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/snapshot-v2.json";
+/** Schemas that are always read, for doctor checks on helper functions. */
+const EXTRA_SCHEMAS = ["better_supabase"];
+/** The hosted project to read through the Management API, if any. */
+function managementTarget(config, env, source) {
+	if (source.dbUrl) return void 0;
+	const projectRef = source.projectRef ?? (config.source.dbUrl ? void 0 : config.source.projectRef);
+	if (!projectRef) return void 0;
+	const accessToken = config.source.accessToken ?? env.SUPABASE_ACCESS_TOKEN;
+	if (!accessToken) throw new CliError("missing_value", `Reading project ${projectRef} needs a Supabase access token. Set SUPABASE_ACCESS_TOKEN to a token scoped to this project (https://supabase.com/dashboard/account/tokens), or read the database with $DATABASE_URL or --db-url-stdin.`, { flag: "SUPABASE_ACCESS_TOKEN" });
+	return {
+		projectRef,
+		accessToken,
+		...env.SUPABASE_API_URL ? { apiUrl: env.SUPABASE_API_URL } : {}
+	};
+}
+/**
+* Where to read the schema from: `--db-url-stdin`, `--project-ref`, then the
+* config's `source.dbUrl` / `source.projectRef`, `$DATABASE_URL`, and finally
+* the local stack.
+*/
+async function openSource(config, env, source, open = connect) {
+	if (source.dbUrl) return pgSource(source.dbUrl, open, source.signal);
+	const target = managementTarget(config, env, source);
+	if (target) return managementSource({
+		...target,
+		...source.signal ? { signal: source.signal } : {}
+	});
+	return pgSource(await databaseUrl(config, env), open, source.signal);
+}
+/** Whether `loadSnapshot` reads a saved file rather than a database. */
+function snapshotFile(config, source) {
+	return source.snapshotPath ?? (source.live || source.dbUrl || source.projectRef ? void 0 : config.source.snapshot);
+}
+/**
+* Loads a saved snapshot or introspects the database. With `shared`, it
+* introspects over that source and leaves closing it to the caller, so later
+* queries reuse the connection.
+*/
+async function loadSnapshot(config, env, source, open = connect, shared) {
+	const path = snapshotFile(config, source);
+	if (path) return readSnapshotFile(resolve(config.root, path), path);
+	const [toml, db] = await Promise.all([readSupabaseToml(config.root), shared ? shared() : openSource(config, env, source, open)]);
+	const hooks = toml ? pgFunctionHooks(toml.document) : [];
+	const schemas = [...config.schemas, ...EXTRA_SCHEMAS];
+	try {
+		const read = () => introspect(db.queryable, schemas, { hooks });
+		return await (source.cache ? cachedIntrospect(config.root, db, [schemas, hooks], read) : read());
+	} finally {
+		if (!shared) await db.close();
+	}
+}
+async function readSnapshotFile(absolute, label = absolute) {
+	if (!existsSync(absolute)) throw new Error(`Snapshot not found: ${label}`);
+	return parseSnapshot(JSON.parse(await readFile(absolute, "utf8")), label);
+}
+/** Validates a parsed snapshot document. */
+async function parseSnapshot(data, label = "snapshot") {
+	const doc = data;
+	if (!doc || typeof doc !== "object" || doc.version !== 2) throw new Error(`${label} is not a version 2 snapshot. Run \`better-supabase introspect\` to refresh it.`);
+	if (!Array.isArray(doc.schemas) || !doc.extras || !Array.isArray(doc.extras.tables)) throw new Error(`${label} is missing "schemas" or "extras".`);
+	let generator;
+	try {
+		generator = await validateGeneratorMetadata(doc.generator);
+	} catch (cause) {
+		throw new Error(`${label} has invalid "generator" metadata: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+	}
+	return {
+		version: 2,
+		schemas: doc.schemas,
+		generator,
+		extras: {
+			tables: doc.extras.tables,
+			buckets: doc.extras.buckets ?? [],
+			realtime: doc.extras.realtime ?? [],
+			...doc.extras.roleSettings ? { roleSettings: doc.extras.roleSettings } : {},
+			...doc.extras.functions ? { functions: doc.extras.functions } : {},
+			...doc.extras.hooks ? { hooks: doc.extras.hooks } : {}
+		}
+	};
+}
+function serializeSnapshot(snapshot) {
+	const { $schema: _ignored, ...rest } = snapshot;
+	return `${JSON.stringify({
+		$schema: SNAPSHOT_SCHEMA_URL,
+		...rest
+	}, null, 2)}\n`;
+}
+//#endregion
+//#region src/cli/commands/gen.ts
+/**
+* Renders every generated file for a snapshot, without touching disk:
+* `database.types.ts` (what `supabase gen types` prints), the main module,
+* then each configured generator's files.
+*/
+async function renderFiles(config, snapshot) {
+	const model = buildModel(snapshot, config);
+	const output = resolve(config.root, config.output);
+	const databaseTypes = await generateDatabaseTypes(snapshot.generator, {
+		schemas: config.schemas,
+		postgrestVersion: config.postgrestVersion
+	});
+	const metaFiles = metaPaths(config.output);
+	const main = emitModule(model, {
+		databaseTypesImport: importPath(output, resolve(config.root, config.databaseTypesOutput)),
+		importPathFor: (from) => importPath(output, resolve(config.root, from)),
+		metaImport: `./${basename(metaFiles.js)}`
+	});
+	const meta = emitMeta(model, { types: `./${basename(metaFiles.dts)}` });
+	const files = [
+		{
+			path: config.databaseTypesOutput,
+			contents: databaseTypes
+		},
+		{
+			path: config.output,
+			contents: main
+		},
+		{
+			path: metaFiles.js,
+			contents: meta.js
+		},
+		{
+			path: metaFiles.dts,
+			contents: meta.dts
+		}
+	];
+	for (const generator of config.generators) {
+		const extra = await generator.generate({
+			meta: model.meta,
+			introspection: model.introspection,
+			extras: snapshot.extras,
+			config,
+			output,
+			importPath: (from, to) => importPath(resolve(config.root, from), resolve(config.root, to))
+		});
+		files.push(...extra);
+	}
+	return files;
+}
+/** The `read-sets` SQL kit file for `config.readSets`, if any are configured. */
+async function readSetFile(config) {
+	if (config.readSets.length === 0) return void 0;
+	const readSets = await compiledReadSets(config);
+	return renderKit(["read-sets"], kitLayout(config, config.sql.testsDir, readSets))[0];
+}
+/**
+* `buckets` keys the catalog doesn't mark `rowConditions: false`, as error
+* lines. Without a readable catalog every PermDock bucket is refused, since
+* whether its keys have row conditions is unknown.
+*/
+async function rowConditionedBuckets(config) {
+	const configured = configuredPermdockKeys({ config });
+	if (configured.length === 0) return [];
+	const project = await readPermdock(config.root, config.permdock);
+	const catalog = project?.catalog;
+	if (!catalog) {
+		const path = project?.catalogPath ?? config.permdock.catalog;
+		const problem = project?.problems.find((entry) => entry.startsWith(path));
+		return [`  ${configured.map(({ bucket }) => `buckets.${bucket}`).join(", ")}: ${problem ? `could not read PermDock's catalog (${problem})` : `there is no ${path}`}, so whether the keys have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`];
+	}
+	return configured.flatMap(({ bucket, keys }) => keys.flatMap((key) => {
+		const problem = unsafeKey(catalog, key, project.catalogPath);
+		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
+	}));
+}
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install the version @supabase/postgrest-typegen pins: pnpm add -D oxfmt@0.66.0. To use a newer oxfmt, allow it in pnpm-workspace.yaml under peerDependencyRules.allowedVersions, keyed \"@supabase/postgrest-typegen>oxfmt\".";
+async function runGen(options) {
+	const { config } = options;
+	const refused = await rowConditionedBuckets(config);
+	if (refused.length > 0) return {
+		code: 1,
+		error: `PermDock's SQL helpers don't check row conditions, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
+	};
+	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
+	const files = await renderFiles(config, snapshot);
+	const notice = await oxfmtInstalled() ? "" : `\n${UNFORMATTED}`;
+	if (options.check) {
+		const stale = [];
+		const diffs = [];
+		const compare = (file, current) => {
+			const shown = display(config.root, file.path);
+			stale.push(shown);
+			diffs.push(fileDiff(shown, current, file.contents, options.paint));
+		};
+		for (const file of files) {
+			const path = resolve(config.root, file.path);
+			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
+			if (current !== file.contents) compare(file, current);
+		}
+		const readSets = await readSetFile(config);
+		if (readSets) {
+			const path = resolve(config.root, readSets.path);
+			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
+			if (!sameKitFile(current, readSets.contents)) compare(readSets, current);
+		}
+		if (stale.length > 0) return {
+			code: 1,
+			output: diffs.join("\n\n"),
+			error: `Generated files are out of date:\n${stale.map((path) => `  ${path}`).join("\n")}\nRun \`better-supabase gen\`.`,
+			data: {
+				upToDate: false,
+				stale
+			}
+		};
+		return {
+			code: 0,
+			output: `Generated files are up to date (${files.length + (readSets ? 1 : 0)}).${notice}`,
+			data: {
+				upToDate: true,
+				stale: []
+			}
+		};
+	}
+	const written = [];
+	for (const file of files) if (await writeIfChanged(resolve(config.root, file.path), file.contents)) written.push(display(config.root, file.path));
+	const readSets = await readSetFile(config);
+	if (readSets && await writeIfChanged(resolve(config.root, readSets.path), readSets.contents)) written.push(display(config.root, readSets.path));
+	const tables = snapshot.extras.tables.filter((table) => config.schemas.includes(table.schema)).length;
+	return {
+		code: 0,
+		output: written.length === 0 ? `No changes (${tables} tables).` : `Generated ${tables} tables:\n${written.map((path) => `  ${path}`).join("\n")}${notice}`,
+		data: {
+			tables,
+			written
+		}
+	};
+}
+/** Where to read the schema from, shared by gen, introspect and doctor. */
+const SOURCE_ARGS = {
+	snapshot: {
+		type: "string",
+		description: "Read a saved snapshot instead of the database",
+		valueHint: "file"
+	},
+	"db-url-stdin": {
+		type: "boolean",
+		description: "Read the connection string from stdin instead of $DATABASE_URL or the config"
+	},
+	"project-ref": {
+		type: "string",
+		description: "Read a hosted project through the Management API",
+		valueHint: "ref"
+	}
+};
+async function sourceArgs(args, io) {
+	const snapshotPath = args.snapshot;
+	const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+	const projectRef = args["project-ref"];
+	return {
+		...snapshotPath ? { snapshotPath } : {},
+		...dbUrl ? { dbUrl } : {},
+		...projectRef ? { projectRef } : {}
+	};
+}
+const ARGS = {
+	check: {
+		type: "boolean",
+		description: "Fail when a generated file is out of date"
+	},
+	watch: {
+		type: "boolean",
+		description: "Regenerate whenever the schema changes"
+	},
+	interval: {
+		type: "string",
+		description: "Milliseconds between checks in --watch. Defaults to 2000",
+		valueHint: "ms"
+	},
+	...SOURCE_ARGS
+};
+const sleep = (ms, signal) => setTimeout(ms, void 0, signal ? { signal } : {}).catch(() => void 0);
+/**
+* Regenerates whenever the schema changes. A database source keeps one
+* connection open and polls the catalog fingerprint, so an unchanged schema
+* costs one small query per interval; a source without a fingerprint is
+* introspected each time and compared.
+*/
+/**
+* Reads the schema when it may have changed. Returns the new change marker (the
+* catalog fingerprint, or the snapshot itself when the source has none) and
+* the snapshot, or no snapshot when the fingerprint still matches `last`.
+*/
+async function poll(options, db, last) {
+	const fingerprint = db ? await catalogFingerprint(db.queryable).catch(() => void 0) : void 0;
+	if (fingerprint !== void 0 && fingerprint === last) return { marker: last };
+	const snapshot = await loadSnapshot(options.config, options.env, options, void 0, db ? () => Promise.resolve(db) : void 0);
+	const marker = fingerprint ?? JSON.stringify(snapshot);
+	return marker === last ? { marker } : {
+		marker,
+		snapshot
+	};
+}
+/**
+* Regenerates whenever the schema changes. A database source keeps one
+* connection open and polls the catalog fingerprint, so an unchanged schema
+* costs one small query per interval.
+*/
+async function watch(options, interval, { io, signal }) {
+	let last = "";
+	let db;
+	const aborted = () => signal?.aborted ?? false;
+	const fromFile = snapshotFile(options.config, options) !== void 0;
+	try {
+		while (!aborted()) {
+			try {
+				db ??= fromFile ? void 0 : await openSource(options.config, options.env, options);
+				const { marker, snapshot } = await poll(options, db, last);
+				last = marker;
+				const result = snapshot ? await runGen({
+					...options,
+					snapshot
+				}) : void 0;
+				if (result?.output) io.stdout(`${result.output}\n`);
+				if (result?.error) io.stderr(`${result.error}\n`);
+			} catch (cause) {
+				io.stderr(`${cause instanceof Error ? cause.message : String(cause)}\n`);
+				await db?.close().catch(() => void 0);
+				db = void 0;
+			}
+			await sleep(interval, signal);
+		}
+	} finally {
+		await db?.close().catch(() => void 0);
+	}
+	return { code: 0 };
+}
+const genCommand = defineCliCommand({
+	meta: {
+		name: "gen",
+		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
+	},
+	args: ARGS,
+	run: async (args, context) => {
+		const options = {
+			config: context.config,
+			env: context.env,
+			check: args.check === true,
+			paint: painter(context.io.color),
+			...await sourceArgs(args, context.io),
+			...context.signal ? { signal: context.signal } : {},
+			cache: true
+		};
+		return args.watch === true ? watch(options, Number(args.interval ?? 2e3), context) : withSpinner(context.io.prompts, "Generating from the schema", () => runGen(options));
+	}
+});
+//#endregion
+export { toCatalog as A, catalogOf as C, policyObject as D, lineOf as E, qualified as O, entitlementsKit as S, exposedSchemas as T, restrictSchemas as _, sourceArgs as a, emitModule as b, openSource as c, snapshotFile as d, introspect as f, buildModel as g, CACHE_DIR as h, runGen as i, tableObject as k, parseSnapshot as l, pgSource as m, genCommand as n, loadSnapshot as o, managementSource as p, renderFiles as r, managementTarget as s, SOURCE_ARGS as t, serializeSnapshot as u, serializeGenerator as v, exposed as w, PERMDOCK_RULES as x, GENERATED_HEADER as y };