better-supabase 0.5.0 → 0.6.0

package/dist/cli/read-sets-BfMQcKy8.js

@@ -1,289 +0,0 @@
-import { i as importModule } from "./config-CPVpXP5I.js";
-import { resolve } from "node:path";
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { KIT_ID_TYPES, compileReadSets, kitIdType } from "better-supabase/sql";
-import { isReadSet } from "better-supabase";
-//#region src/cli/permdock.ts
-const PERMDOCK_CONFIGS = [
-	"permdock.config.ts",
-	"permdock.config.mts",
-	"permdock.config.js",
-	"permdock.config.mjs"
-];
-/** The PermDock config file in `root`, if there is one. */
-function permdockConfig(root) {
-	return PERMDOCK_CONFIGS.find((file) => existsSync(resolve(root, file)));
-}
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const isString = (value) => typeof value === "string";
-const strings = (value) => Array.isArray(value) ? value.filter(isString) : [];
-const column = (value) => isRecord(value) && isString(value["column"]) ? { column: value["column"] } : void 0;
-function manifestValue(value, accept) {
-	if (!isRecord(value)) return void 0;
-	if (isString(value["column"])) return { column: value["column"] };
-	return accept(value["value"]) ? { value: value["value"] } : void 0;
-}
-const roleValue = (value) => isString(value) || Array.isArray(value) && value.every(isString);
-function membership(value) {
-	if (!isRecord(value) || !isString(value["table"])) return void 0;
-	const user = column(value["user"]);
-	const id = column(value["id"]);
-	const scope = manifestValue(value["scope"], isString);
-	if (!user || !id || !scope) return void 0;
-	const role = manifestValue(value["role"], roleValue);
-	const expiresAt = column(value["expiresAt"]);
-	return {
-		table: value["table"],
-		user,
-		scope,
-		id,
-		...role ? { role } : {},
-		...expiresAt ? { expiresAt } : {},
-		columns: strings(value["columns"])
-	};
-}
-/** Reads a parsed manifest; throws with the reason when it isn't version 1. */
-function parseManifest(json) {
-	if (!isRecord(json)) throw new TypeError("not a JSON object");
-	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
-	const hook = json["hook"];
-	const rls = json["rls"];
-	if (isRecord(rls) && rls["mode"] !== "jwt" && rls["mode"] !== "database") throw new TypeError(`rls.mode ${JSON.stringify(rls["mode"])} is not supported (this release reads "jwt" and "database")`);
-	const budget = isRecord(json["budget"]) ? json["budget"]["bytes"] : void 0;
-	return {
-		version: 1,
-		...typeof budget === "number" ? { budget } : {},
-		...isRecord(hook) && isString(hook["schema"]) && isString(hook["function"]) ? { hook: {
-			schema: hook["schema"],
-			function: hook["function"]
-		} } : {},
-		...isString(json["tenantClaim"]) ? { tenantClaim: json["tenantClaim"] } : {},
-		claims: (Array.isArray(json["claims"]) ? json["claims"] : []).flatMap((claim) => isRecord(claim) && isString(claim["name"]) && isString(claim["source"]) ? [{
-			name: claim["name"],
-			source: claim["source"]
-		}] : []),
-		memberships: (Array.isArray(json["memberships"]) ? json["memberships"] : []).flatMap((entry) => {
-			const parsed = membership(entry);
-			return parsed ? [parsed] : [];
-		}),
-		...isRecord(rls) && isString(rls["schema"]) ? { rls: {
-			schema: rls["schema"],
-			mode: rls["mode"] === "jwt" ? "jwt" : "database",
-			...isString(rls["tenantClaim"]) ? { tenantClaim: rls["tenantClaim"] } : {},
-			scopes: (Array.isArray(rls["scopes"]) ? rls["scopes"] : []).flatMap((scope) => isRecord(scope) && isString(scope["name"]) ? [{
-				name: scope["name"],
-				...isString(scope["type"]) ? { type: scope["type"] } : {},
-				...isString(scope["within"]) ? { within: scope["within"] } : {}
-			}] : []),
-			helpers: (Array.isArray(rls["helpers"]) ? rls["helpers"] : []).flatMap((helper) => isRecord(helper) && isString(helper["name"]) && isString(helper["args"]) && isString(helper["returns"]) ? [{
-				name: helper["name"],
-				args: helper["args"],
-				returns: helper["returns"],
-				execute: strings(helper["execute"])
-			}] : [])
-		} } : {},
-		decidingColumns: strings(json["decidingColumns"])
-	};
-}
-/**
-* The keys of a parsed `permissions.catalog.json`, each with its scope and
-* its `rowConditions` flag when it is a boolean. A non-boolean flag is
-* dropped, so `permdockKeyStatus` reads the key as unknown. Throws unless
-* the catalog is version 1.
-*/
-function parseCatalog(json) {
-	if (!isRecord(json) || !Array.isArray(json["permissions"])) throw new TypeError("has no permissions array");
-	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
-	return { permissions: json["permissions"].flatMap((permission) => {
-		if (!isRecord(permission) || !isString(permission["key"])) return [];
-		const flag = permission["rowConditions"];
-		const scope = permission["scope"];
-		return [{
-			key: permission["key"],
-			...typeof flag === "boolean" ? { rowConditions: flag } : {},
-			...isString(scope) ? { scope } : {}
-		}];
-	}) };
-}
-async function readJson(root, path) {
-	const absolute = resolve(root, path);
-	if (!existsSync(absolute)) return { missing: true };
-	try {
-		return { json: JSON.parse(await readFile(absolute, "utf8")) };
-	} catch (cause) {
-		return { problem: `${path}: ${cause instanceof Error ? cause.message : String(cause)}` };
-	}
-}
-/**
-* Reads PermDock's JSON outputs: the manifest `permdock supabase inspect
-* --out` writes and the catalog `permdock catalog` writes. Nothing is
-* imported from PermDock. Returns `undefined` when the project has neither a
-* PermDock config nor a manifest.
-*/
-async function readPermdock(root, paths) {
-	const config = permdockConfig(root);
-	const problems = [];
-	const manifestFile = await readJson(root, paths.manifest);
-	let manifest;
-	if ("json" in manifestFile) try {
-		manifest = parseManifest(manifestFile.json);
-	} catch (cause) {
-		problems.push(`${paths.manifest}: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	else if ("problem" in manifestFile) problems.push(manifestFile.problem);
-	if (!config && !manifest && "missing" in manifestFile) return void 0;
-	const catalogFile = await readJson(root, paths.catalog);
-	let catalog;
-	if ("json" in catalogFile) try {
-		catalog = parseCatalog(catalogFile.json);
-	} catch (cause) {
-		problems.push(`${paths.catalog}: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	else if ("problem" in catalogFile) problems.push(catalogFile.problem);
-	return {
-		...config ? { config } : {},
-		manifestPath: paths.manifest,
-		...manifest ? { manifest } : {},
-		catalogPath: paths.catalog,
-		...catalog ? { catalog } : {},
-		problems
-	};
-}
-/** How findings name the PermDock project: its config file or its manifest. */
-const permdockSource = (project) => project.config ?? project.manifestPath;
-const HOOK_MARKER = /^--\s*permdock:hook\s+v(\d+)([^\n]*)$/m;
-const GRANTS_MARKER = /^--\s*permdock:grants\s+v(\d+)([^\n]*)$/m;
-function markerFields(rest) {
-	const fields = /* @__PURE__ */ new Map();
-	for (const match of rest.matchAll(/(\w+)=(\S*)/g)) fields.set(match[1], match[2]);
-	return fields;
-}
-/** The `-- permdock:hook v1 schema=... tenant=... budget=... claims=...` line PermDock's hook file starts with. */
-function parseHookMarker(sql) {
-	const match = HOOK_MARKER.exec(sql);
-	if (!match) return void 0;
-	const fields = markerFields(match[2]);
-	const budget = Number(fields.get("budget"));
-	const schema = fields.get("schema");
-	const tenantClaim = fields.get("tenant");
-	return {
-		version: Number(match[1]),
-		...schema ? { schema } : {},
-		...tenantClaim ? { tenantClaim } : {},
-		...Number.isFinite(budget) && fields.has("budget") ? { budget } : {},
-		claims: (fields.get("claims") ?? "").split(",").filter(Boolean)
-	};
-}
-/** The `-- permdock:grants v1 schema=...` line of the migration `--grants-out` writes. */
-function parseGrantsMarker(sql) {
-	const match = GRANTS_MARKER.exec(sql);
-	if (!match) return void 0;
-	const schema = markerFields(match[2]).get("schema");
-	return {
-		version: Number(match[1]),
-		...schema ? { schema } : {}
-	};
-}
-/**
-* PermDock mode, when the project uses PermDock and `entitlements.permdock`
-* is not `false`. The scope is `entitlements.permdock.scope`, which must be
-* one of the manifest's `rls.scopes`, else the one scope without `within`.
-* No root scope, or more than one, is invalid rather than a guess. A
-* PermDock project without a readable manifest or without its `rls` block
-* is invalid too, so the module never falls back to `tenant` on its own.
-*/
-function entitlementsMode(config, project) {
-	const setting = config.entitlements.permdock;
-	if (setting === false || !project) return { kind: "tenant" };
-	const optOut = "or set entitlements.permdock: false to keep the tenant module's memberships.";
-	if (!project.manifest) {
-		const problem = project.problems.find((entry) => entry.startsWith(project.manifestPath));
-		return {
-			kind: "invalid",
-			problem: problem ? `Could not read PermDock's manifest: ${problem}. Run \`permdock supabase inspect --out\` with a current PermDock, ${optOut}` : `${permdockSource(project)} is a PermDock project, but there is no ${project.manifestPath}. Run \`permdock supabase inspect --out\`, ${optOut}`
-		};
-	}
-	const rls = project.manifest.rls;
-	if (!rls) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} has no rls block, so the entitlements module can't find PermDock's membership helpers. Run \`permdock rls generate\`, then \`permdock supabase inspect --out\`, ${optOut}`
-	};
-	const names = rls.scopes.map((scope) => scope.name).join(", ") || "none";
-	let scope;
-	if (setting.scope === void 0) {
-		const roots = rls.scopes.filter((entry) => entry.within === void 0);
-		if (roots.length !== 1) return {
-			kind: "invalid",
-			problem: `${project.manifestPath} has no single root scope (${roots.map((entry) => entry.name).join(", ") || "none"}), so the entitlements module can't tell which scope tenants are. Set entitlements.permdock: { scope } to one of ${names}.`
-		};
-		scope = roots[0].name;
-	} else {
-		scope = setting.scope;
-		if (!rls.scopes.some((entry) => entry.name === scope)) return {
-			kind: "invalid",
-			problem: `entitlements.permdock.scope is "${scope}", but ${project.manifestPath} has the scopes ${names}. Set entitlements.permdock: { scope } to one of them, or remove it to use the root scope.`
-		};
-	}
-	const declared = rls.scopes.find((entry) => entry.name === scope)?.type;
-	if (declared === void 0) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" no type, so the entitlements module can't tell its id type. Run \`permdock supabase inspect --out\` with a current PermDock.`
-	};
-	const type = kitIdType(declared);
-	if (type === void 0) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" the type ${declared}, but the entitlements module renders only ${KIT_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
-	};
-	return {
-		kind: "permdock",
-		permdock: {
-			schema: rls.schema,
-			scope,
-			idType: type,
-			memberships: project.manifest.memberships.map((source) => ({
-				table: source.table,
-				userColumn: source.user.column,
-				scope: source.scope,
-				idColumn: source.id.column
-			}))
-		}
-	};
-}
-/**
-* The helpers the `entitlements` module calls for the chosen scope:
-* `member_<scope>_ids` from `has_entitlement` as `authenticated`, and
-* `member_<scope>_ids_for` from `feature_claims`, which PermDock's hook runs
-* as `supabase_auth_admin`.
-*/
-const entitlementRequirements = (permdock) => [{
-	kind: "member",
-	helper: `${permdock.schema}.member_${permdock.scope}_ids`,
-	caller: "has_entitlement",
-	role: "authenticated"
-}, {
-	kind: "member-for",
-	helper: `${permdock.schema}.member_${permdock.scope}_ids_for`,
-	caller: "feature_claims",
-	role: "supabase_auth_admin"
-}];
-//#endregion
-//#region src/cli/read-sets.ts
-/** Every read set exported by the modules in `config.readSets`. */
-async function loadReadSets(config) {
-	const sets = [];
-	for (const entry of config.readSets) {
-		const loaded = await importModule(resolve(config.root, entry));
-		const found = Object.values(loaded).filter(isReadSet);
-		if (found.length === 0) throw new Error(`${entry} exports no read set (defineReadSet)`);
-		for (const set of found) if (!sets.includes(set)) sets.push(set);
-	}
-	return sets;
-}
-/** The compiled functions for `config.readSets`; empty when none are configured. */
-async function compiledReadSets(config) {
-	if (config.readSets.length === 0) return [];
-	return compileReadSets(await loadReadSets(config));
-}
-//#endregion
-export { parseHookMarker as a, parseGrantsMarker as i, entitlementRequirements as n, permdockSource as o, entitlementsMode as r, readPermdock as s, compiledReadSets as t };

package/dist/cli/sql-DzPbfngx.js

@@ -1,348 +0,0 @@
-import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { f as readSupabaseToml, p as schemaPaths, u as migrationCommand } from "./config-CPVpXP5I.js";
-import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { o as permdockSource, r as entitlementsMode, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
-import { dirname, join, relative, resolve, sep } from "node:path";
-import { existsSync } from "node:fs";
-import { readFile, readdir } from "node:fs/promises";
-import { SQL_MODULES, contractSignature, customContracts, kitFileVersion, kitLayout, moduleBody, renderKit, resolveModules, sameKitFile, upgradePlan } from "better-supabase/sql";
-//#region src/cli/commands/sql.ts
-const SQL_ARGS = {
-	action: {
-		type: "positional",
-		required: false,
-		description: "list (modules and whether they are installed), add <module...>, sync, upgrade, data (a migration with the rows a schema diff skips) or print <module>"
-	},
-	check: {
-		type: "boolean",
-		description: "With sync: fail when a file is stale. With upgrade: fail when a module is behind"
-	},
-	"tests-dir": {
-		type: "string",
-		description: "Where the pgtap module goes. Defaults to sql.testsDir",
-		valueHint: "dir"
-	},
-	"dry-run": {
-		type: "boolean",
-		description: "Show what would be written"
-	},
-	force: {
-		type: "boolean",
-		description: "Write tenant even though a permdock.config.ts is present"
-	}
-};
-const USAGE = "Run `better-supabase sql --help` for the actions.";
-/** Modules that fill a claim PermDock's hook also writes (`memberships`). */
-const PERMDOCK_OWNED = /* @__PURE__ */ new Set(["tenant"]);
-/**
-* PermDock's helpers for the `entitlements` module. When `names` resolve to
-* that module, an invalid PermDock mode (no manifest, a scope it lacks, an
-* unknown id type) throws instead of falling back to the tenant module.
-* Without `names` (`sql list`) it only describes the modules, so it doesn't.
-*/
-async function permdockFor(config, names) {
-	const mode = entitlementsMode(config, await readPermdock(config.root, config.permdock));
-	switch (mode.kind) {
-		case "tenant": return;
-		case "permdock": return mode.permdock;
-		case "invalid":
-			if (names === void 0 || !resolveModules(names, {}).some((module) => module.name === "entitlements")) return void 0;
-			throw new TypeError(mode.problem);
-		default: return mode;
-	}
-}
-async function layout(config, args, names) {
-	return kitLayout(config, args["tests-dir"], [], await permdockFor(config, names));
-}
-/** The layout, with `config.readSets` compiled when `names` includes `read-sets`. */
-async function layoutFor(config, args, names) {
-	const permdock = await permdockFor(config, names);
-	const needsReadSets = resolveModules(names, { ...permdock ? { permdock } : {} }).some((module) => module.name === "read-sets");
-	return kitLayout(config, args["tests-dir"], needsReadSets ? await compiledReadSets(config) : [], permdock);
-}
-/**
-* The migrations folder next to the `config.toml` found walking up from
-* `sql.dir`, relative to the root; `supabase/migrations` without one. The
-* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
-* project (a shared stack in a monorepo) finds that stack's folder.
-*/
-function migrationsDir(config) {
-	const root = resolve(config.root);
-	let dir = resolve(root, config.sql.dir);
-	let stop = root;
-	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
-	for (;;) {
-		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
-		if (dir === stop || dirname(dir) === dir) break;
-		dir = dirname(dir);
-	}
-	return "supabase/migrations";
-}
-/** `YYYYMMDDHHMMSS` in UTC, the Supabase CLI's migration prefix. */
-const migrationStamp = (now) => now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
-/**
-* A stamp for `now`, or one second after the newest migration when that one
-* has the same stamp or a later one: the Supabase CLI keys migrations by
-* stamp, and the data has to run after the schema.
-*/
-function stampAfter(migrations, now) {
-	const newest = migrations.map((name) => /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})_/.exec(name)).filter((match) => match !== null).map((match) => Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]), Number(match[4]), Number(match[5]), Number(match[6]))).reduce((max, time) => Math.max(max, time), Number.NEGATIVE_INFINITY);
-	const at = Math.floor(now.getTime() / 1e3) * 1e3;
-	return migrationStamp(new Date(Math.max(at, newest + 1e3)));
-}
-async function write(config, args, names, kit) {
-	const lines = [];
-	const dryRun = args["dry-run"] === true;
-	let data = false;
-	for (const file of renderKit(names, kit)) {
-		const path = resolve(config.root, file.path);
-		const shown = display(config.root, file.path);
-		if (dryRun) {
-			lines.push(`Would write ${shown} (${file.module})`);
-			continue;
-		}
-		const wrote = await writeIfChanged(path, file.contents);
-		if (wrote && file.kind === "data") data = true;
-		lines.push(`${wrote ? "Wrote" : "Unchanged"} ${shown} (${file.module})`);
-	}
-	if (data) lines.push("", DATA_NEXT);
-	return lines;
-}
-const DATA_NEXT = "The better-supabase-data files hold rows and settings a schema diff skips: after the schema migration, run `better-supabase sql data`.";
-const DATA_SUFFIX = "_better_supabase_kit_data.sql";
-/**
-* Writes the data files of `sql.kit` into one migration, meant to run after
-* the schema migration that creates their tables. Every statement is
-* idempotent, so the migration carries all of them, not only the changes.
-*/
-async function dataMigration(config, args) {
-	if (config.sql.kit.length === 0) return {
-		code: 0,
-		output: "sql.kit is empty; nothing to write."
-	};
-	const files = renderKit(config.sql.kit, await layoutFor(config, args, config.sql.kit)).filter((file) => file.kind === "data");
-	const contents = `-- better-supabase sql data: the rows and settings of ${files.map((file) => file.module).join(", ")}, which a schema diff skips.\n\n${files.map((file) => file.contents.trim()).join("\n\n")}\n`;
-	const dir = migrationsDir(config);
-	const existing = await readdir(resolve(config.root, dir)).catch(() => []);
-	const latest = existing.toSorted().findLast((name) => name.endsWith(DATA_SUFFIX));
-	if (latest !== void 0 && await readFile(resolve(config.root, dir, latest), "utf8") === contents) return {
-		code: 0,
-		output: `${dir}/${latest} already has these rows; nothing to write.`
-	};
-	const path = `${dir}/${stampAfter(existing, /* @__PURE__ */ new Date())}${DATA_SUFFIX}`;
-	if (args["dry-run"] === true) return {
-		code: 0,
-		output: `Would write ${path}`
-	};
-	await writeIfChanged(resolve(config.root, path), contents);
-	return {
-		code: 0,
-		output: `Wrote ${path}`
-	};
-}
-/** A note when migra's `schema_paths` is set and misses kit files, which `supabase db diff` would then skip. */
-async function unlistedKitFiles(config, names, kit) {
-	const order = await schemaPaths(config.root, await readSupabaseToml(config.root));
-	if (!order.configured) return [];
-	const unlisted = new Set(order.unlisted);
-	const listed = new Set(order.files.filter((path) => !unlisted.has(path)));
-	const dir = `${config.sql.dir.replace(/\/$/, "")}/`;
-	const missing = renderKit(names, kit).filter((file) => file.kind !== "data").map((file) => file.path).filter((path) => path.startsWith(dir) && !listed.has(path));
-	if (missing.length === 0) return [];
-	return [
-		"",
-		"supabase/config.toml sets [db.migrations] schema_paths, and no entry matches these files, so `supabase db diff` skips them.",
-		"Add them before the schemas that call their functions:",
-		...missing.map((path) => `  "./${path.startsWith("supabase/") ? path.slice(9) : path}",`)
-	];
-}
-/**
-* Rewrites the kit files of modules behind the current version, and writes
-* their upgrade steps (renames, backfills) as a migration that runs before
-* the one the schema diff creates.
-*/
-async function upgrade(config, args, paint) {
-	if (config.sql.kit.length === 0) return {
-		code: 0,
-		output: "sql.kit is empty; nothing to upgrade."
-	};
-	const kit = await layoutFor(config, args, config.sql.kit);
-	const files = renderKit(config.sql.kit, kit);
-	const installed = [];
-	const stale = [];
-	const diffs = [];
-	for (const file of files) {
-		if (file.kind === "data") continue;
-		const current = await readFile(resolve(config.root, file.path), "utf8").catch(() => void 0);
-		if (current === void 0) continue;
-		installed.push({
-			module: file.module,
-			version: kitFileVersion(current)?.version ?? 1
-		});
-		if (!sameKitFile(current, file.contents)) {
-			stale.push(file);
-			diffs.push(fileDiff(display(config.root, file.path), current, file.contents, paint));
-		}
-	}
-	const plan = upgradePlan(installed, kit);
-	const behind = plan.map((entry) => `${entry.module} is at version ${String(entry.from)}; the current version is ${String(entry.to)}`);
-	if (args.check === true) {
-		if (plan.length === 0 && stale.length === 0) return {
-			code: 0,
-			output: "SQL kit modules are at their current versions."
-		};
-		return {
-			code: 1,
-			output: diffs.join("\n\n"),
-			error: [
-				...behind,
-				...stale.length > 0 ? [`Out of date: ${stale.map((file) => display(config.root, file.path)).join(", ")}.`] : [],
-				"Run `better-supabase sql upgrade`."
-			].join("\n")
-		};
-	}
-	if (plan.length === 0 && stale.length === 0) return {
-		code: 0,
-		output: "SQL kit modules are at their current versions."
-	};
-	const lines = [];
-	const steps = plan.flatMap((entry) => entry.steps.filter((step) => step.sql !== "").map((step) => `-- ${entry.module}: version ${String(step.from)} to ${String(step.from + 1)}. ${step.description}\n${step.sql}`));
-	const dryRun = args["dry-run"] === true;
-	if (steps.length > 0) {
-		const path = `${migrationsDir(config)}/${migrationStamp(/* @__PURE__ */ new Date())}_better_supabase_kit_upgrade.sql`;
-		const contents = `-- better-supabase sql upgrade: steps that run before the schema diff.\n\n${steps.join("\n\n")}\n`;
-		if (dryRun) lines.push(`Would write ${path}`);
-		else {
-			await writeIfChanged(resolve(config.root, path), contents);
-			lines.push(`Wrote ${path}`);
-		}
-	}
-	for (const entry of plan) lines.push(`${entry.module}: version ${String(entry.from)} to ${String(entry.to)}`, ...entry.steps.map((step) => `  ${step.description}`));
-	lines.push(...await write(config, args, config.sql.kit, kit), "", `Then create a migration: ${migrationCommand(await readSupabaseToml(config.root), "better_supabase_kit")}`);
-	return {
-		code: 0,
-		output: lines.join("\n")
-	};
-}
-async function runSql(config, args, paint = plain) {
-	const [action, ...names] = args._;
-	switch (action) {
-		case "list": {
-			const kit = await layout(config, args);
-			const files = new Map(renderKit(Object.keys(SQL_MODULES), kit).filter((file) => file.kind !== "data").map((file) => [file.module, file.path]));
-			return {
-				code: 0,
-				output: `${Object.values(SQL_MODULES).map((module) => {
-					const path = files.get(module.name);
-					const installed = path !== void 0 && existsSync(resolve(config.root, path));
-					const tracked = config.sql.kit.includes(module.name);
-					const mark = path === void 0 ? "◇" : installed ? tracked ? "●" : "○" : " ";
-					const requires = kit.permdock && module.permdockRequires ? module.permdockRequires : module.requires;
-					const needs = requires.length > 0 ? ` (needs ${requires.join(", ")})` : "";
-					return `${mark} ${module.name.padEnd(15)} ${module.description}${needs}`;
-				}).join("\n")}\n\n● installed and in sql.kit   ○ installed, not in sql.kit   ◇ custom mode (the app implements it)`
-			};
-		}
-		case "add": {
-			if (names.length === 0) return {
-				code: 2,
-				error: `Name at least one module.\n${USAGE}`
-			};
-			const unknown = names.filter((name) => !(name in SQL_MODULES));
-			if (unknown.length > 0) return {
-				code: 2,
-				error: `Unknown module ${unknown.join(", ")}. Available: ${Object.keys(SQL_MODULES).join(", ")}`
-			};
-			const project = await readPermdock(config.root, config.permdock);
-			const permdock = project ? permdockSource(project) : void 0;
-			const hookModules = names.filter((name) => PERMDOCK_OWNED.has(name));
-			if (permdock && hookModules.length > 0 && args.force !== true) return {
-				code: 1,
-				error: [
-					`${permdock} is present, so PermDock owns the access token hook and the memberships claim.`,
-					`${hookModules.join(" and ")} would add a second source for them. Use \`permdock supabase hook generate\` instead,`,
-					"or pass --force to write the modules anyway."
-				].join("\n")
-			};
-			const kit = await layoutFor(config, args, names);
-			const lines = await write(config, args, names, kit);
-			const pulledIn = resolveModules(names, kit).map((module) => module.name).filter((name) => PERMDOCK_OWNED.has(name) && !names.includes(name));
-			if (permdock && pulledIn.length > 0) lines.push("", `${pulledIn.join(" and ")} came along as a dependency: its memberships table backs has_org_role() and has_entitlement().`, `PermDock's hook still owns the memberships claim, so don't call better_supabase.membership_claims from a hook.`, "List better_supabase.memberships as a PermDock membership source if both should agree.");
-			const untracked = resolveModules(names, kit).map((module) => module.name).filter((name) => !config.sql.kit.includes(name));
-			if (untracked.length > 0) lines.push("", `Add them to your config so \`sql sync --check\` keeps them current:`, `  sql: { kit: [${[...config.sql.kit, ...untracked].map((name) => `'${name}'`).join(", ")}] }`);
-			if (args["dry-run"] !== true) lines.push(...await unlistedKitFiles(config, names, kit));
-			lines.push("", `Then create a migration: ${migrationCommand(await readSupabaseToml(config.root), "better_supabase_kit")}`);
-			return {
-				code: 0,
-				output: lines.join("\n")
-			};
-		}
-		case "sync": {
-			if (config.sql.kit.length === 0) return {
-				code: 0,
-				output: "sql.kit is empty; nothing to sync."
-			};
-			if (args.check !== true) return {
-				code: 0,
-				output: (await write(config, args, config.sql.kit, await layoutFor(config, args, config.sql.kit))).join("\n")
-			};
-			const stale = [];
-			const diffs = [];
-			for (const file of renderKit(config.sql.kit, await layoutFor(config, args, config.sql.kit))) {
-				const current = await readFile(resolve(config.root, file.path), "utf8").catch(() => void 0);
-				if (!sameKitFile(current, file.contents)) {
-					const shown = display(config.root, file.path);
-					stale.push(shown);
-					diffs.push(fileDiff(shown, current, file.contents, paint));
-				}
-			}
-			return stale.length === 0 ? {
-				code: 0,
-				output: "SQL kit files are up to date."
-			} : {
-				code: 1,
-				output: diffs.join("\n\n"),
-				error: `Out of date: ${stale.join(", ")}. Run \`better-supabase sql sync\`.`
-			};
-		}
-		case "upgrade": return upgrade(config, args, paint);
-		case "data": return dataMigration(config, args);
-		case "print": {
-			const [name] = names;
-			const module = name ? SQL_MODULES[name] : void 0;
-			if (!module) return {
-				code: 2,
-				error: `Name one module: ${Object.keys(SQL_MODULES).join(", ")}`
-			};
-			const body = moduleBody(module.name, await layout(config, args, [module.name]));
-			if (body === void 0) return {
-				code: 0,
-				output: `-- kits.${module.name} is in custom mode: the app writes these functions.\n${customContracts([module.name], await layout(config, args, [module.name])).flatMap((contract) => contract.functions.map((fn) => `-- ${contract.schema}.${fn.name}(${contractSignature(fn, contract.idType)}) returns ${fn.returns.replaceAll("{id}", contract.idType)}`)).join("\n")}`
-			};
-			return {
-				code: 0,
-				output: body
-			};
-		}
-		case void 0: return {
-			code: 2,
-			error: `Name an action.\n${USAGE}`
-		};
-		default: return {
-			code: 2,
-			error: `Unknown sql action "${action}".\n${USAGE}`
-		};
-	}
-}
-const sqlCommand = defineCliCommand({
-	meta: {
-		name: "sql",
-		description: "Lists, adds, syncs, upgrades and prints SQL kit modules, and writes their data migration"
-	},
-	args: SQL_ARGS,
-	run: (args, { config, io }) => runSql(config, args, painter(io.color))
-});
-//#endregion
-export { sqlCommand };

package/dist/entitlements-CTEBm7IB.js

@@ -1,20 +0,0 @@
-//#region src/auth/entitlements.ts
-/**
-* Whether the session's plan-features claim grants `key` in `tenantId`.
-* `claim` is `config.claims.features` (default `features`), the claim
-* `better_supabase.feature_claims()` fills. The claim is as fresh as the
-* token: enforce it in RLS with `better_supabase.has_entitlement()`, and
-* refresh the session after checkout.
-*/
-function hasEntitlement(session, tenantId, key, claim = "features") {
-	if (session.kind !== "user") return false;
-	const claims = session.claims;
-	if (!isRecord(claims)) return false;
-	const features = claims[claim];
-	if (!isRecord(features) || !Object.hasOwn(features, tenantId)) return false;
-	const keys = features[tenantId];
-	return Array.isArray(keys) && keys.includes(key);
-}
-const isRecord = (value) => typeof value === "object" && value !== null;
-//#endregion
-export { hasEntitlement as t };