better-supabase 0.4.0 → 0.5.0

package/dist/cli/read-sets-BfMQcKy8.js

@@ -0,0 +1,289 @@
+import { i as importModule } from "./config-CPVpXP5I.js";
+import { resolve } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { KIT_ID_TYPES, compileReadSets, kitIdType } from "better-supabase/sql";
+import { isReadSet } from "better-supabase";
+//#region src/cli/permdock.ts
+const PERMDOCK_CONFIGS = [
+	"permdock.config.ts",
+	"permdock.config.mts",
+	"permdock.config.js",
+	"permdock.config.mjs"
+];
+/** The PermDock config file in `root`, if there is one. */
+function permdockConfig(root) {
+	return PERMDOCK_CONFIGS.find((file) => existsSync(resolve(root, file)));
+}
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const isString = (value) => typeof value === "string";
+const strings = (value) => Array.isArray(value) ? value.filter(isString) : [];
+const column = (value) => isRecord(value) && isString(value["column"]) ? { column: value["column"] } : void 0;
+function manifestValue(value, accept) {
+	if (!isRecord(value)) return void 0;
+	if (isString(value["column"])) return { column: value["column"] };
+	return accept(value["value"]) ? { value: value["value"] } : void 0;
+}
+const roleValue = (value) => isString(value) || Array.isArray(value) && value.every(isString);
+function membership(value) {
+	if (!isRecord(value) || !isString(value["table"])) return void 0;
+	const user = column(value["user"]);
+	const id = column(value["id"]);
+	const scope = manifestValue(value["scope"], isString);
+	if (!user || !id || !scope) return void 0;
+	const role = manifestValue(value["role"], roleValue);
+	const expiresAt = column(value["expiresAt"]);
+	return {
+		table: value["table"],
+		user,
+		scope,
+		id,
+		...role ? { role } : {},
+		...expiresAt ? { expiresAt } : {},
+		columns: strings(value["columns"])
+	};
+}
+/** Reads a parsed manifest; throws with the reason when it isn't version 1. */
+function parseManifest(json) {
+	if (!isRecord(json)) throw new TypeError("not a JSON object");
+	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
+	const hook = json["hook"];
+	const rls = json["rls"];
+	if (isRecord(rls) && rls["mode"] !== "jwt" && rls["mode"] !== "database") throw new TypeError(`rls.mode ${JSON.stringify(rls["mode"])} is not supported (this release reads "jwt" and "database")`);
+	const budget = isRecord(json["budget"]) ? json["budget"]["bytes"] : void 0;
+	return {
+		version: 1,
+		...typeof budget === "number" ? { budget } : {},
+		...isRecord(hook) && isString(hook["schema"]) && isString(hook["function"]) ? { hook: {
+			schema: hook["schema"],
+			function: hook["function"]
+		} } : {},
+		...isString(json["tenantClaim"]) ? { tenantClaim: json["tenantClaim"] } : {},
+		claims: (Array.isArray(json["claims"]) ? json["claims"] : []).flatMap((claim) => isRecord(claim) && isString(claim["name"]) && isString(claim["source"]) ? [{
+			name: claim["name"],
+			source: claim["source"]
+		}] : []),
+		memberships: (Array.isArray(json["memberships"]) ? json["memberships"] : []).flatMap((entry) => {
+			const parsed = membership(entry);
+			return parsed ? [parsed] : [];
+		}),
+		...isRecord(rls) && isString(rls["schema"]) ? { rls: {
+			schema: rls["schema"],
+			mode: rls["mode"] === "jwt" ? "jwt" : "database",
+			...isString(rls["tenantClaim"]) ? { tenantClaim: rls["tenantClaim"] } : {},
+			scopes: (Array.isArray(rls["scopes"]) ? rls["scopes"] : []).flatMap((scope) => isRecord(scope) && isString(scope["name"]) ? [{
+				name: scope["name"],
+				...isString(scope["type"]) ? { type: scope["type"] } : {},
+				...isString(scope["within"]) ? { within: scope["within"] } : {}
+			}] : []),
+			helpers: (Array.isArray(rls["helpers"]) ? rls["helpers"] : []).flatMap((helper) => isRecord(helper) && isString(helper["name"]) && isString(helper["args"]) && isString(helper["returns"]) ? [{
+				name: helper["name"],
+				args: helper["args"],
+				returns: helper["returns"],
+				execute: strings(helper["execute"])
+			}] : [])
+		} } : {},
+		decidingColumns: strings(json["decidingColumns"])
+	};
+}
+/**
+* The keys of a parsed `permissions.catalog.json`, each with its scope and
+* its `rowConditions` flag when it is a boolean. A non-boolean flag is
+* dropped, so `permdockKeyStatus` reads the key as unknown. Throws unless
+* the catalog is version 1.
+*/
+function parseCatalog(json) {
+	if (!isRecord(json) || !Array.isArray(json["permissions"])) throw new TypeError("has no permissions array");
+	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
+	return { permissions: json["permissions"].flatMap((permission) => {
+		if (!isRecord(permission) || !isString(permission["key"])) return [];
+		const flag = permission["rowConditions"];
+		const scope = permission["scope"];
+		return [{
+			key: permission["key"],
+			...typeof flag === "boolean" ? { rowConditions: flag } : {},
+			...isString(scope) ? { scope } : {}
+		}];
+	}) };
+}
+async function readJson(root, path) {
+	const absolute = resolve(root, path);
+	if (!existsSync(absolute)) return { missing: true };
+	try {
+		return { json: JSON.parse(await readFile(absolute, "utf8")) };
+	} catch (cause) {
+		return { problem: `${path}: ${cause instanceof Error ? cause.message : String(cause)}` };
+	}
+}
+/**
+* Reads PermDock's JSON outputs: the manifest `permdock supabase inspect
+* --out` writes and the catalog `permdock catalog` writes. Nothing is
+* imported from PermDock. Returns `undefined` when the project has neither a
+* PermDock config nor a manifest.
+*/
+async function readPermdock(root, paths) {
+	const config = permdockConfig(root);
+	const problems = [];
+	const manifestFile = await readJson(root, paths.manifest);
+	let manifest;
+	if ("json" in manifestFile) try {
+		manifest = parseManifest(manifestFile.json);
+	} catch (cause) {
+		problems.push(`${paths.manifest}: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	else if ("problem" in manifestFile) problems.push(manifestFile.problem);
+	if (!config && !manifest && "missing" in manifestFile) return void 0;
+	const catalogFile = await readJson(root, paths.catalog);
+	let catalog;
+	if ("json" in catalogFile) try {
+		catalog = parseCatalog(catalogFile.json);
+	} catch (cause) {
+		problems.push(`${paths.catalog}: ${cause instanceof Error ? cause.message : String(cause)}`);
+	}
+	else if ("problem" in catalogFile) problems.push(catalogFile.problem);
+	return {
+		...config ? { config } : {},
+		manifestPath: paths.manifest,
+		...manifest ? { manifest } : {},
+		catalogPath: paths.catalog,
+		...catalog ? { catalog } : {},
+		problems
+	};
+}
+/** How findings name the PermDock project: its config file or its manifest. */
+const permdockSource = (project) => project.config ?? project.manifestPath;
+const HOOK_MARKER = /^--\s*permdock:hook\s+v(\d+)([^\n]*)$/m;
+const GRANTS_MARKER = /^--\s*permdock:grants\s+v(\d+)([^\n]*)$/m;
+function markerFields(rest) {
+	const fields = /* @__PURE__ */ new Map();
+	for (const match of rest.matchAll(/(\w+)=(\S*)/g)) fields.set(match[1], match[2]);
+	return fields;
+}
+/** The `-- permdock:hook v1 schema=... tenant=... budget=... claims=...` line PermDock's hook file starts with. */
+function parseHookMarker(sql) {
+	const match = HOOK_MARKER.exec(sql);
+	if (!match) return void 0;
+	const fields = markerFields(match[2]);
+	const budget = Number(fields.get("budget"));
+	const schema = fields.get("schema");
+	const tenantClaim = fields.get("tenant");
+	return {
+		version: Number(match[1]),
+		...schema ? { schema } : {},
+		...tenantClaim ? { tenantClaim } : {},
+		...Number.isFinite(budget) && fields.has("budget") ? { budget } : {},
+		claims: (fields.get("claims") ?? "").split(",").filter(Boolean)
+	};
+}
+/** The `-- permdock:grants v1 schema=...` line of the migration `--grants-out` writes. */
+function parseGrantsMarker(sql) {
+	const match = GRANTS_MARKER.exec(sql);
+	if (!match) return void 0;
+	const schema = markerFields(match[2]).get("schema");
+	return {
+		version: Number(match[1]),
+		...schema ? { schema } : {}
+	};
+}
+/**
+* PermDock mode, when the project uses PermDock and `entitlements.permdock`
+* is not `false`. The scope is `entitlements.permdock.scope`, which must be
+* one of the manifest's `rls.scopes`, else the one scope without `within`.
+* No root scope, or more than one, is invalid rather than a guess. A
+* PermDock project without a readable manifest or without its `rls` block
+* is invalid too, so the module never falls back to `tenant` on its own.
+*/
+function entitlementsMode(config, project) {
+	const setting = config.entitlements.permdock;
+	if (setting === false || !project) return { kind: "tenant" };
+	const optOut = "or set entitlements.permdock: false to keep the tenant module's memberships.";
+	if (!project.manifest) {
+		const problem = project.problems.find((entry) => entry.startsWith(project.manifestPath));
+		return {
+			kind: "invalid",
+			problem: problem ? `Could not read PermDock's manifest: ${problem}. Run \`permdock supabase inspect --out\` with a current PermDock, ${optOut}` : `${permdockSource(project)} is a PermDock project, but there is no ${project.manifestPath}. Run \`permdock supabase inspect --out\`, ${optOut}`
+		};
+	}
+	const rls = project.manifest.rls;
+	if (!rls) return {
+		kind: "invalid",
+		problem: `${project.manifestPath} has no rls block, so the entitlements module can't find PermDock's membership helpers. Run \`permdock rls generate\`, then \`permdock supabase inspect --out\`, ${optOut}`
+	};
+	const names = rls.scopes.map((scope) => scope.name).join(", ") || "none";
+	let scope;
+	if (setting.scope === void 0) {
+		const roots = rls.scopes.filter((entry) => entry.within === void 0);
+		if (roots.length !== 1) return {
+			kind: "invalid",
+			problem: `${project.manifestPath} has no single root scope (${roots.map((entry) => entry.name).join(", ") || "none"}), so the entitlements module can't tell which scope tenants are. Set entitlements.permdock: { scope } to one of ${names}.`
+		};
+		scope = roots[0].name;
+	} else {
+		scope = setting.scope;
+		if (!rls.scopes.some((entry) => entry.name === scope)) return {
+			kind: "invalid",
+			problem: `entitlements.permdock.scope is "${scope}", but ${project.manifestPath} has the scopes ${names}. Set entitlements.permdock: { scope } to one of them, or remove it to use the root scope.`
+		};
+	}
+	const declared = rls.scopes.find((entry) => entry.name === scope)?.type;
+	if (declared === void 0) return {
+		kind: "invalid",
+		problem: `${project.manifestPath} gives scope "${scope}" no type, so the entitlements module can't tell its id type. Run \`permdock supabase inspect --out\` with a current PermDock.`
+	};
+	const type = kitIdType(declared);
+	if (type === void 0) return {
+		kind: "invalid",
+		problem: `${project.manifestPath} gives scope "${scope}" the type ${declared}, but the entitlements module renders only ${KIT_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
+	};
+	return {
+		kind: "permdock",
+		permdock: {
+			schema: rls.schema,
+			scope,
+			idType: type,
+			memberships: project.manifest.memberships.map((source) => ({
+				table: source.table,
+				userColumn: source.user.column,
+				scope: source.scope,
+				idColumn: source.id.column
+			}))
+		}
+	};
+}
+/**
+* The helpers the `entitlements` module calls for the chosen scope:
+* `member_<scope>_ids` from `has_entitlement` as `authenticated`, and
+* `member_<scope>_ids_for` from `feature_claims`, which PermDock's hook runs
+* as `supabase_auth_admin`.
+*/
+const entitlementRequirements = (permdock) => [{
+	kind: "member",
+	helper: `${permdock.schema}.member_${permdock.scope}_ids`,
+	caller: "has_entitlement",
+	role: "authenticated"
+}, {
+	kind: "member-for",
+	helper: `${permdock.schema}.member_${permdock.scope}_ids_for`,
+	caller: "feature_claims",
+	role: "supabase_auth_admin"
+}];
+//#endregion
+//#region src/cli/read-sets.ts
+/** Every read set exported by the modules in `config.readSets`. */
+async function loadReadSets(config) {
+	const sets = [];
+	for (const entry of config.readSets) {
+		const loaded = await importModule(resolve(config.root, entry));
+		const found = Object.values(loaded).filter(isReadSet);
+		if (found.length === 0) throw new Error(`${entry} exports no read set (defineReadSet)`);
+		for (const set of found) if (!sets.includes(set)) sets.push(set);
+	}
+	return sets;
+}
+/** The compiled functions for `config.readSets`; empty when none are configured. */
+async function compiledReadSets(config) {
+	if (config.readSets.length === 0) return [];
+	return compileReadSets(await loadReadSets(config));
+}
+//#endregion
+export { parseHookMarker as a, parseGrantsMarker as i, entitlementRequirements as n, permdockSource as o, entitlementsMode as r, readPermdock as s, compiledReadSets as t };

package/dist/cli/{run-CP20LKk_.js → run-BKR2W_79.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-5mW_8sY1.js";
+import { t as VERSION } from "./version-BDJuO0UR.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -134,11 +134,11 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-ClnxRYBF.js").then((m) => m.initCommand),
+		load: () => import("./init-Saf5-R9T.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-ClnxRYBF.js").then((m) => m.addCommand),
+		load: () => import("./init-Saf5-R9T.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
@@ -154,28 +154,32 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-D5cLCULx.js").then((m) => m.genCommand),
+		load: () => import("./gen-BJc9vdyu.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect-DxqfkVIv.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect--H7oGmcd.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
-		load: () => import("./openapi-8WHjxiTJ.js").then((m) => m.openapiCommand),
+		load: () => import("./openapi-Cp5Fyta-.js").then((m) => m.openapiCommand),
 		description: "Writes the document your createOpenApi() module exports, so CI can check it for drift"
 	}],
 	["seed", {
-		load: () => import("./seed-5J6eu_Xg.js").then((m) => m.seedCommand),
+		load: () => import("./seed-CUlqWh-8.js").then((m) => m.seedCommand),
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-BOym3mbL.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-L7Z8mYTx.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {
-		load: () => import("./sql-D4VbqmXi.js").then((m) => m.sqlCommand),
-		description: "Lists, adds, syncs and prints SQL kit modules"
+		load: () => import("./sql-DzPbfngx.js").then((m) => m.sqlCommand),
+		description: "Lists, adds, syncs, upgrades and prints SQL kit modules"
+	}],
+	["codemod", {
+		load: () => import("./codemod-DqV7612m.js").then((m) => m.codemodCommand),
+		description: "Rewrites imports and calls for renamed better-supabase APIs"
 	}]
 ]);
 function registerCommand(name, command, help) {
@@ -308,8 +312,8 @@ async function run(argv, options = {}) {
 	try {
 		const [loaded, { loadConfig }, { parseEnv }] = await Promise.all([
 			load(),
-			import("./config-SSKSTUl2.js"),
-			import("./env-BZ0uy8XK.js")
+			import("./config-dtoekM0v.js"),
+			import("./env-DmKv_G4A.js")
 		]);
 		command = loaded;
 		const globals = parseArgs$2(rest, GLOBAL_ARGS);

package/dist/cli/{seed-5J6eu_Xg.js → seed-CUlqWh-8.js}

@@ -1,6 +1,6 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { r as importExport, s as stdinDatabaseUrl, t as databaseUrl } from "./config-D9R0o1LH.js";
+import { r as importExport, s as stdinDatabaseUrl, t as databaseUrl } from "./config-CPVpXP5I.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
 import { resolve } from "node:path";