better-supabase 0.6.0 → 0.7.0

package/dist/cli/{doctor-B4JOm_ox.js → doctor-CVdnLahA.js}

@@ -2,14 +2,15 @@ import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-Bp4fyubI.js";
 import { s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl } from "./config-NiPxAmUF.js";
-import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, n as declarativeSchemasDir, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-BGLb_zou.js";
+import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-AIf4MREI.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
+import { n as moduleLayoutFor } from "./sql-layout-D6cphHT3.js";
 import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
@@ -955,6 +956,8 @@ const EXTRAS_RULES = /* @__PURE__ */ new Set([
 	"BS112",
 	"BS113",
 	"BS114",
+	"BS115",
+	"BS116",
 	"BS204",
 	"BS205",
 	"BS206",
@@ -1031,7 +1034,7 @@ from (
 /** `rate-limit` in `sql.modules` without PostgREST's pre-request hook reaching `check_request()`. */
 async function rateLimitHook(context) {
 	const db = context.database;
-	if (!context.config.sql.moduleNames.includes("rate-limit") || !db || "skipped" in db) return [];
+	if (!context.config.sql.moduleNames.includes("rate-limit") || context.config.sql.modules["rate-limit"]?.options?.["preRequest"] === false || !db || "skipped" in db) return [];
 	let rows;
 	try {
 		rows = await db.query(PRE_REQUEST_HOOK);
@@ -1749,7 +1752,7 @@ function notInlinable(fn) {
 	const settings = Object.keys(fn.settings);
 	if (settings.length > 0) return `a function with \`set ${settings.join(", ")}\``;
 }
-const rlsTables = (context) => exposed(context).filter((table) => table.rls);
+const rlsTables$1 = (context) => exposed(context).filter((table) => table.rls);
 const COMMANDS$1 = [
 	"select",
 	"insert",
@@ -1922,7 +1925,7 @@ const RLS_RULES = [
 		description: "A policy passes a column of the row to a function Postgres cannot inline: plpgsql, volatile, security definer, or with a `set` option such as `search_path`. It runs once for every row the query reads.",
 		check: (context) => {
 			const functions = functionsByName(context);
-			return rlsTables(context).flatMap((table) => table.policies.flatMap((policy) => {
+			return rlsTables$1(context).flatMap((table) => table.policies.flatMap((policy) => {
 				for (const name of policy.functions ?? []) {
 					const slow = functions.get(name)?.find((fn) => notInlinable(fn) !== void 0);
 					if (!slow) continue;
@@ -1948,7 +1951,7 @@ const RLS_RULES = [
 			const limit = context.config.doctor.policyHelperLimit;
 			const functions = functionsByName(context);
 			const uses = /* @__PURE__ */ new Map();
-			for (const table of rlsTables(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
+			for (const table of rlsTables$1(context)) for (const policy of table.policies) for (const name of policy.functions ?? []) {
 				const list = uses.get(name) ?? [];
 				list.push(`${qualified(table)}.${policy.name}`);
 				uses.set(name, list);
@@ -1974,7 +1977,7 @@ const RLS_RULES = [
 		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. When the performance advisor (BS200) runs, splinter's `multiple_permissive_policies` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
 		check: async (context) => {
 			const splinter = await splinterTables(context, "multiple_permissive_policies");
-			return rlsTables(context).flatMap((table) => {
+			return rlsTables$1(context).flatMap((table) => {
 				if (splinter?.has(qualified(table))) return [];
 				const overlaps = permissiveOverlaps(table);
 				if (overlaps.length === 0) return [];
@@ -2234,6 +2237,50 @@ const POLICY_RULES = [
 			}];
 		})
 	},
+	{
+		code: "BS115",
+		severity: "warning",
+		title: "Table without a policy still granted to the Data API",
+		description: "A table with RLS on and no permissive policy for `anon` or `authenticated` answers every Data API request with no rows or a denied write, yet a grant lists it in the API schema. Under `sql.modules.grants.options.fromPolicies`, `better-supabase sql sync` revokes these grants and keeps `service_role`; until the migration is applied, doctor reports the live grants. Tables in `expose` are skipped.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table" || !table.rls) return [];
+			const options = configFor(context.config.tables, table.schema, table.name);
+			if (options?.exclude || options?.serviceRole) return [];
+			if (context.config.expose[qualified(table)] ?? context.config.expose[table.name]) return [];
+			const roles = ["anon", "authenticated"].filter((role) => table.grants.some((grant) => (grant.role === role || grant.role === "PUBLIC") && grant.privileges.length > 0));
+			if (roles.length === 0) return [];
+			if (table.policies.some((policy) => policy.permissive && roles.some((role) => appliesTo(policy, role)))) return [];
+			return [{
+				message: `${qualified(table)} has RLS on and no permissive policy for ${roles.join(" or ")}, but ${roles.join(" and ")} still hold grants on it. Run \`revoke all on table ${qualified(table)} from public, anon, authenticated;\`, or set \`sql.modules.grants.options.fromPolicies\` and run \`better-supabase sql sync\` so the migration revokes it.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS116",
+		severity: "warning",
+		title: "Security definer function open to the API roles without being exposed",
+		description: "Postgres grants `execute` on a new function to `public`, so a `security definer` function in an exposed schema is callable at `/rpc` by `anon` and `authenticated` unless it is revoked. When no `expose` entry lists it and no policy calls it, nothing in the project says the API roles should reach it. Doctor never revokes it; list it in `expose` with the roles that call it, or revoke `execute` from `public`, `anon` and `authenticated` and grant it back to those roles.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			const listed = new Set(Object.keys(context.config.exposeFunctions).map((signature) => {
+				const name = signature.slice(0, signature.indexOf("(")).trim();
+				return name.includes(".") ? name : `public.${name}`;
+			}));
+			const inPolicies = new Set(catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? [])));
+			return (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+				const name = `${fn.schema}.${fn.name}`;
+				const callers = fn.execute ?? [];
+				if (!fn.securityDefiner || !schemas.includes(fn.schema) || callers.length === 0 || listed.has(name) || inPolicies.has(name)) return [];
+				return [{
+					message: `${name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and no \`expose\` entry or policy uses it. Run \`revoke all on function ${name}(${fn.signature}) from public, anon, authenticated;\`, then \`grant execute on function ${name}(${fn.signature}) to <the roles that call it>;\`, or list it in \`expose\`.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
 	{
 		code: "BS215",
 		severity: "warning",
@@ -2452,10 +2499,14 @@ async function moduleFiles(context) {
 	const skipped = readSets !== void 0 && "skipped" in readSets;
 	let rendered;
 	try {
-		rendered = renderModules(context.config.sql.moduleNames, {
-			...moduleLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsModule(context), access.kind === "provider" ? access.access : void 0, permissionCatalogKeys(context)),
-			schemasDir: declarativeSchemasDir(context.configToml)
-		});
+		rendered = renderModules(context.config.sql.moduleNames, await moduleLayoutFor(context.config, {
+			names: context.config.sql.moduleNames,
+			testsDir: context.config.sql.testsDir,
+			readSets: skipped ? [] : readSets,
+			entitlementsProvider: entitlementsModule(context),
+			accessProvider: access.kind === "provider" ? access.access : void 0,
+			permissionCatalog: permissionCatalogKeys(context)
+		}));
 	} catch {
 		return [];
 	}
@@ -2572,7 +2623,7 @@ const RULES = [
 			code: "BS106",
 			severity: "error",
 			title: "Table not granted to the Data API",
-			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated. Tables marked `serviceRole` in `tables` must have no grants for either role.",
+			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with no permissive policy under `sql.modules.grants.options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
 			check: (context) => {
 				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
 				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
@@ -2593,9 +2644,10 @@ const RULES = [
 							}];
 						});
 					}
+					const serviceOnly = context.config.sql.moduleNames.includes("grants") && context.config.sql.modules["grants"]?.options?.["fromPolicies"] === true && table.rls && !table.policies.some((policy) => policy.permissive && (appliesTo(policy, "anon") || appliesTo(policy, "authenticated")));
 					const wanted = context.config.expose[qualified(table)] ?? context.config.expose[table.name] ?? {
 						anon: [],
-						authenticated: ["select"]
+						authenticated: serviceOnly ? [] : ["select"]
 					};
 					return ["anon", "authenticated"].flatMap((role) => {
 						const have = granted(role);

package/dist/cli/{gen-BGLb_zou.js → gen-AIf4MREI.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { i as writeIfChanged, n as importPath, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-Bp4fyubI.js";
 import { a as entitlementsMode, c as unsafeKey, i as entitlementRequirements, n as accessProviderMode, o as moduleKeyProblems, r as accessRequirements, s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
 import { s as stdinDatabaseUrl, t as databaseUrl } from "./config-NiPxAmUF.js";
 import { l as pgFunctionHooks, p as tomlGet, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";

package/dist/cli/gen-DSrahEdX.js

@@ -0,0 +1,2 @@
+import { n as genCommand } from "./gen-AIf4MREI.js";
+export { genCommand };

package/dist/cli/index.d.ts

@@ -527,6 +527,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.7.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, CliArgs, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliProblem, CliProblemExtensions, Command, CommandContext, CommandResult, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, ParsedArgs, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-4v4DTtda.js";
-import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-DNWxHynX.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-BO052mki.js";
+import { t as VERSION } from "./version-Bp4fyubI.js";
 import { a as loadConfig } from "./config-NiPxAmUF.js";
-import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-BGLb_zou.js";
+import { L as toCatalog, a as renderFiles, b as emitModule, c as loadSnapshot, d as parseSnapshot, f as serializeSnapshot, g as pgSource, h as managementSource, m as introspect, o as runGen, x as buildModel, y as GENERATED_HEADER } from "./gen-AIf4MREI.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-BIIwclPg.js → init-Cr6arjXU.js}

@@ -1,6 +1,6 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-Bp4fyubI.js";
 import { a as loadConfig, r as findConfig } from "./config-NiPxAmUF.js";
 import { a as findSupabaseRoot, p as tomlGet, r as diffEngine, t as PGDELTA_TABLE, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as TYPEGEN_VERSION } from "./typegen-version-DeFbtzYI.js";

package/dist/cli/{introspect-DNUTuNvb.js → introspect-Bzuv1HHj.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { i as writeIfChanged, r as sameText, t as display } from "./io-DI1mTdSA.js";
 import { r as painter } from "./style-C0NFdJRL.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-BGLb_zou.js";
+import { T as serializeGenerator, c as loadSnapshot, f as serializeSnapshot, s as sourceArgs, t as SOURCE_ARGS, w as restrictSchemas } from "./gen-AIf4MREI.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/cli/{run-DNWxHynX.js → run-BO052mki.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-hr88OZG0.js";
+import { t as VERSION } from "./version-Bp4fyubI.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -134,11 +134,11 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-BIIwclPg.js").then((m) => m.initCommand),
+		load: () => import("./init-Cr6arjXU.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-BIIwclPg.js").then((m) => m.addCommand),
+		load: () => import("./init-Cr6arjXU.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
@@ -154,11 +154,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-DAH8FM2W.js").then((m) => m.genCommand),
+		load: () => import("./gen-DSrahEdX.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect-DNUTuNvb.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect-Bzuv1HHj.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
@@ -170,11 +170,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-B4JOm_ox.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-CVdnLahA.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {
-		load: () => import("./sql-D0GUtUPp.js").then((m) => m.sqlCommand),
+		load: () => import("./sql-B8csQPyn.js").then((m) => m.sqlCommand),
 		description: "Lists, adds, syncs, upgrades and prints SQL modules"
 	}],
 	["config", {

package/dist/cli/{sql-D0GUtUPp.js → sql-B8csQPyn.js}

@@ -5,10 +5,11 @@ import { a as entitlementsMode, n as accessProviderMode, o as moduleKeyProblems,
 import { t as importFresh } from "./fresh-import-BeYf9I3x.js";
 import { c as migrationCommand, d as schemaPaths, n as declarativeSchemasDir, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { dirname, join, relative, resolve, sep } from "node:path";
+import { n as moduleLayoutFor, t as migrationsDir } from "./sql-layout-D6cphHT3.js";
+import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, readdir, rm } from "node:fs/promises";
-import { SQL_MODULES, adoptedColumnProblems, auditRegistrations, contractSignature, customContracts, declaredTables, extensionSchema, moduleBody, moduleFilePaths, moduleFileVersion, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, policyGrants, renderModules, resolveModules, sameModuleFile, upgradePlan } from "better-supabase/sql";
+import { SQL_MODULES, contractSignature, customContracts, moduleBody, moduleFilePaths, moduleFileVersion, moduleLayout, modulePermissionKeys, moduleSchemaExtensions, moduleTopics, renderModules, resolveModules, sameModuleFile, upgradePlan } from "better-supabase/sql";
 //#region src/cli/topic-policies.ts
 const isTopic = (value) => typeof value === "object" && value !== null && "template" in value && typeof value.template === "string" && "sql" in value && typeof value.sql === "function" && "triggerSql" in value;
 const literalParts = (template) => template.replaceAll(/\{[^}]+\}/g, "{}");
@@ -124,46 +125,22 @@ async function layout(config, args, names) {
 		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root))
 	};
 }
-/** The declarative schema files, then the migrations oldest first. */
-async function schemaTexts(config) {
-	const toml = await readSupabaseToml(config.root);
-	const migrations = resolve(config.root, migrationsDir(config));
-	const paths = [...(await schemaPaths(config.root, toml)).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
-	return Promise.all(paths.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
-}
-async function declarativeTexts(config) {
-	const { files } = await schemaPaths(config.root, await readSupabaseToml(config.root));
-	if (files.length === 0) return schemaTexts(config);
-	return Promise.all(files.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
-}
-/**
-* The `better_supabase.audit(...)` calls in the declarative schemas, then
-* the migrations oldest first, so a later call or `unaudit` wins.
-*/
-async function auditedTables(config) {
-	return auditRegistrations(await schemaTexts(config));
-}
 /**
 * The layout, with `config.readSets` compiled when `names` includes
-* `read-sets` and the audited tables when it includes `audit`.
+* `read-sets`.
 */
 async function layoutFor(config, args, names) {
 	const entitlementsProvider = entitlementsProviderFor(config, names);
 	const resolved = new Set(resolveModules(names, { ...entitlementsProvider ? { entitlementsProvider } : {} }).map((module) => module.name));
-	const adopted = adoptedColumnProblems(config.sql.modules, await declarativeTexts(config), config.schemas);
-	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
-	return {
-		...moduleLayout(config, args["tests-dir"], resolved.has("read-sets") ? await compiledReadSets(config) : [], entitlementsProvider, accessProviderFor(config, names), permissionKeysFor(config)),
-		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root)),
-		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
-		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
-		...resolved.has("grants") && config.sql.modules["grants"]?.options?.["fromPolicies"] === true ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
-		...resolved.has("sessions") && config.sql.modules["sessions"]?.options?.["policies"] === true ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {}
-	};
-}
-function vectorSchemaOf(sources) {
-	const schema = extensionSchema(sources, "vector");
-	return schema === void 0 ? {} : { vectorSchema: schema };
+	const accessProvider = accessProviderFor(config, names);
+	return moduleLayoutFor(config, {
+		names,
+		testsDir: args["tests-dir"],
+		readSets: resolved.has("read-sets") ? await compiledReadSets(config) : [],
+		...entitlementsProvider ? { entitlementsProvider } : {},
+		...accessProvider ? { accessProvider } : {},
+		permissionCatalog: permissionKeysFor(config)
+	});
 }
 const MODULE_TEST_MARKER = /^-- @bs-module-test ([a-z0-9-]+)$/m;
 /**
@@ -185,24 +162,6 @@ async function staleModuleTests(config, names, sqlLayout, files) {
 	}
 	return stale;
 }
-/**
-* The migrations folder next to the `config.toml` found walking up from
-* `sql.dir`, relative to the root; `supabase/migrations` without one. The
-* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
-* project (a shared stack in a monorepo) finds that stack's folder.
-*/
-function migrationsDir(config) {
-	const root = resolve(config.root);
-	let dir = resolve(root, config.sql.dir);
-	let stop = root;
-	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
-	for (;;) {
-		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
-		if (dir === stop || dirname(dir) === dir) break;
-		dir = dirname(dir);
-	}
-	return "supabase/migrations";
-}
 /** `YYYYMMDDHHMMSS` in UTC, the Supabase CLI's migration prefix. */
 const migrationStamp = (now) => now.toISOString().replaceAll(/[-:T]/g, "").slice(0, 14);
 /**

package/dist/cli/sql-layout-D6cphHT3.js

@@ -0,0 +1,69 @@
+import { d as schemaPaths, n as declarativeSchemasDir, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
+import { dirname, join, relative, resolve, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, readdir } from "node:fs/promises";
+import { adoptedColumnProblems, auditRegistrations, declaredTables, extensionSchema, moduleLayout, policyGrants, resolveModules, rlsTables } from "better-supabase/sql";
+//#region src/cli/sql-layout.ts
+/** The declarative schema files, then the migrations oldest first. */
+async function schemaTexts(config) {
+	const toml = await readSupabaseToml(config.root);
+	const migrations = resolve(config.root, migrationsDir(config));
+	const paths = [...(await schemaPaths(config.root, toml)).files, ...existsSync(migrations) ? (await readdir(migrations)).filter((name) => name.endsWith(".sql")).toSorted().map((name) => join(migrations, name)) : []];
+	return Promise.all(paths.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+async function declarativeTexts(config) {
+	const { files } = await schemaPaths(config.root, await readSupabaseToml(config.root));
+	if (files.length === 0) return schemaTexts(config);
+	return Promise.all(files.map(async (path) => ({ text: await readFile(resolve(config.root, path), "utf8") })));
+}
+/**
+* The `better_supabase.audit(...)` calls in the declarative schemas, then
+* the migrations oldest first, so a later call or `unaudit` wins.
+*/
+async function auditedTables(config) {
+	return auditRegistrations(await schemaTexts(config));
+}
+/**
+* The layout `sql sync` and doctor render the module files with, so both
+* see the same grants, session policies, audit triggers and vector schema.
+*/
+async function moduleLayoutFor(config, input) {
+	const resolved = new Set(resolveModules(input.names, { ...input.entitlementsProvider ? { entitlementsProvider: input.entitlementsProvider } : {} }).map((module) => module.name));
+	const adopted = adoptedColumnProblems(config.sql.modules, await declarativeTexts(config), config.schemas);
+	if (adopted.length > 0) throw new TypeError(adopted.join("\n"));
+	const fromPolicies = resolved.has("grants") && config.sql.modules["grants"]?.options?.["fromPolicies"] === true;
+	const sessionPolicies = resolved.has("sessions") && config.sql.modules["sessions"]?.options?.["policies"] === true;
+	return {
+		...moduleLayout(config, input.testsDir, input.readSets ?? [], input.entitlementsProvider, input.accessProvider, input.permissionCatalog),
+		schemasDir: declarativeSchemasDir(await readSupabaseToml(config.root)),
+		...resolved.has("audit") ? { auditedTables: await auditedTables(config) } : {},
+		...resolved.has("vector-search") ? vectorSchemaOf(await schemaTexts(config)) : {},
+		...fromPolicies ? { policyGrants: policyGrants(await declarativeTexts(config), config.schemas) } : {},
+		...fromPolicies ? { rlsTables: rlsTables(await declarativeTexts(config), config.schemas) } : {},
+		...fromPolicies || sessionPolicies ? { declaredTables: declaredTables(await declarativeTexts(config), config.schemas) } : {}
+	};
+}
+function vectorSchemaOf(sources) {
+	const schema = extensionSchema(sources, "vector");
+	return schema === void 0 ? {} : { vectorSchema: schema };
+}
+/**
+* The migrations folder next to the `config.toml` found walking up from
+* `sql.dir`, relative to the root; `supabase/migrations` without one. The
+* walk stops where `sql.dir` and the root meet, so a `sql.dir` outside the
+* project (a shared stack in a monorepo) finds that stack's folder.
+*/
+function migrationsDir(config) {
+	const root = resolve(config.root);
+	let dir = resolve(root, config.sql.dir);
+	let stop = root;
+	while (dir !== stop && !dir.startsWith(stop + sep) && dirname(stop) !== stop) stop = dirname(stop);
+	for (;;) {
+		if (existsSync(join(dir, "config.toml"))) return relative(root, join(dir, "migrations")).replaceAll("\\", "/");
+		if (dir === stop || dirname(dir) === dir) break;
+		dir = dirname(dir);
+	}
+	return "supabase/migrations";
+}
+//#endregion
+export { moduleLayoutFor as n, migrationsDir as t };

package/dist/cli/{version-hr88OZG0.js → version-Bp4fyubI.js}

@@ -1,4 +1,4 @@
 //#region src/cli/version.ts
-const VERSION = "0.6.0";
+const VERSION = "0.7.0";
 //#endregion
 export { VERSION as t };

package/dist/{composite-DhE66P5u.js → composite-C6I8ZyaF.js}

@@ -1,5 +1,5 @@
 import { a as problemResponse } from "./problem-BreOl8b8.js";
-import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-Bc1o3zyy.js";
+import { C as serverCore, S as withServerContext, _ as withSession, g as withSupport, h as withTenant, s as createServer } from "./adapter-B-tL8hqg.js";
 import { s as withPrimaryPin } from "./replicas-CwrYp5Zj.js";
 import { r as guard, t as defaultExpose } from "./respond-BUgsXNgk.js";
 import { a as withAuthMode, i as withAuth, o as withJwtClaims, s as withUserClaims } from "./claims-DDBQT6BK.js";

package/dist/{composite-Bt1YK3Ke.d.ts → composite-CpHLEo-G.d.ts}

@@ -1,10 +1,10 @@
 import { a as AnyModels, i as AnyFunctions } from "./types-6BdhkmZe.js";
 import { a as EventHub } from "./events-DWDhx77e.js";
 import { i as CookieScope, s as SessionEncoding } from "./session-ChiXDZdZ.js";
-import { r as AuthState, t as AuthResolution } from "./resolve-KW8nCeL6.js";
+import { r as AuthState, t as AuthResolution } from "./resolve-ChTYeTEl.js";
 import { b as Db, t as BetterSupabase } from "./define-CJJkkr1-.js";
-import { b as ActiveSupport, g as ReplicaState, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "./server-CeVeeXwz.js";
-import { d as RefreshPolicy, r as GuardOptions } from "./respond-DoBijysA.js";
+import { C as ActiveSupport, i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer, y as ReplicaState } from "./server-ZSJ9rCcV.js";
+import { d as RefreshPolicy, r as GuardOptions } from "./respond-DprrgyXX.js";
 import { SupabaseClient } from "@supabase/supabase-js";
 import { Entry, SingleKeyEntry } from "@supabase/middleware";
 import { AuthMode, JWTClaims, UserClaims } from "@supabase/server";

package/dist/{connectors-hkLCwyEz.d.ts → connectors-CrpknU0P.d.ts}

@@ -1,7 +1,7 @@
 /// <reference lib="esnext.temporal" />
 import { t as AsyncResult, w as ErrorMapper } from "./result-D7y2fT87.js";
 import { t as BlockTransport } from "./block-transport-DvaoPuZ9.js";
-import { i as CredentialRef, r as CredentialProvider } from "./provider-BH5UWZJ6.js";
+import { i as CredentialRef, r as CredentialProvider } from "./provider-D-UEMvSD.js";
 import { r as BlockTemporalOptions } from "./block-helpers-CKtbFcRv.js";
 //#region src/blocks/connectors/connectors.d.ts
 type ConnectorTransport = "http" | "sse";

package/dist/credentials/index.d.ts

@@ -1,7 +1,7 @@
 import { t as AsyncResult } from "../result-D7y2fT87.js";
 import { i as sqlTransport, r as rpcTransport, t as BlockTransport } from "../block-transport-DvaoPuZ9.js";
-import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-BH5UWZJ6.js";
-import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-CSO7ss5C.js";
+import { a as CredentialSubject, c as SetCredentialOptions, d as foreignCredentialRef, f as subjectFor, i as CredentialRef, l as StartAuthorizationOptions, n as CredentialCapabilities, o as CredentialToken, p as tenantCredentialRef, r as CredentialProvider, s as GetTokenOptions, t as CompleteAuthorizationOptions, u as credentialRefInTenant } from "../provider-D-UEMvSD.js";
+import { a as vaultCredentials, i as VaultInboundScheme, n as VaultCredentials, r as VaultCredentialsOptions, t as VaultCredentialRef } from "../vault-wlbBhqm7.js";
 //#region src/credentials/compose.d.ts
 /**
  * One provider over several: each call goes to the provider whose `name`

package/dist/{csv-CPAzEmB6.js → csv-DCK-PT1n.js}

@@ -22,4 +22,4 @@ function toCsv(rows, options = {}) {
 	return `${[columns.map((column) => cell(column, false)).join(","), ...rows.map((row) => columns.map((column) => cell(row[column], escape)).join(","))].join("\r\n")}\r\n`;
 }
 //#endregion
-export { toCsv as t };
+export { toCsv as n, csvColumns as t };

package/dist/edge/index.d.ts

@@ -1,11 +1,11 @@
 import { L as TableKey, a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
-import { t as AuthSession } from "../view-DbxLNu8L.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
-import { s as BlockRequireOptions } from "../kit-B5tid-q5.js";
+import { i as ServerContext, o as ServerOptions, t as BetterServer } from "../server-ZSJ9rCcV.js";
+import { t as AuthSession } from "../view-CF7ihnkg.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
+import { s as BlockRequireOptions } from "../kit-CkNzZUqv.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
-import { a as ResourceRouteOptions } from "../resource-D6Uc7Sk7.js";
+import { a as ResourceRouteOptions } from "../resource-IPS5xi9q.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { WithCorsConfig } from "@supabase/middleware/cors";
 //#region src/bridges/edge.d.ts

package/dist/edge/index.js

@@ -1,12 +1,12 @@
 import { n as dbError } from "../errors-B11Duf73.js";
 import { r as err } from "../result-DzUbqgdW.js";
 import { a as problemResponse } from "../problem-BreOl8b8.js";
-import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-Bc1o3zyy.js";
+import { a as unexpectedResponse, c as extendServer, l as withExtra, n as flushEvents, s as createServer } from "../adapter-B-tL8hqg.js";
 import { a as respond, t as defaultExpose } from "../respond-BUgsXNgk.js";
-import { t as withBetterSupabase } from "../composite-DhE66P5u.js";
+import { t as withBetterSupabase } from "../composite-C6I8ZyaF.js";
 import { t as defineResource } from "../resource-BsvzCMlX.js";
 import { i as requireCaller } from "../kit-Fm-Fv7q5.js";
-import { t as EVERY_CALLER } from "../framework-CONDyPYx.js";
+import { t as EVERY_CALLER } from "../framework-BDCpJI7o.js";
 import { bufferRequest, pipeline, seedContext } from "@supabase/middleware";
 import { withCors } from "@supabase/middleware/cors";
 //#region src/bridges/edge.ts

package/dist/elysia/index.d.ts

@@ -1,4 +1,4 @@
-import { n as RouteGuardOptions } from "../refusal-D1rgbzNq.js";
+import { n as RouteGuardOptions } from "../refusal-DhSU2Vvr.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 //#region src/bridges/elysia.d.ts

package/dist/{ended-jLfvw8h-.d.ts → ended-XjeGQ5XW.d.ts}

@@ -30,6 +30,8 @@ type RefreshOutcome = {
   /** `rejected`: the refresh token is dead, sign the user out. `network`: keep the session and retry later. */
   readonly reason: "rejected" | "network";
   readonly status?: number;
+  /** The Auth server's `error_code`, such as `user_banned` or `refresh_token_not_found`. */
+  readonly code?: string;
   readonly message: string;
 };
 /**
@@ -40,7 +42,8 @@ type RefreshOutcome = {
 declare function refreshSession(refreshToken: string, options: RefreshOptions): Promise<RefreshOutcome>;
 //#endregion
 //#region src/auth/ended.d.ts
-type SessionStatus = "active" | "ended" | "unknown";
+/** `banned`: Auth rejected the token with `error_code: "user_banned"`. */
+type SessionStatus = "active" | "ended" | "banned" | "unknown";
 interface SessionStatusOptions {
   readonly url: string;
   readonly publishableKey: string;

package/dist/{entitlements-DHrY2UDZ.d.ts → entitlements-BKSVGtrG.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-DbxLNu8L.js";
+import { t as AuthSession } from "./view-CF7ihnkg.js";
 //#region src/auth/entitlements.d.ts
 /**
  * One entry of the `memberships` claim when a hook writes it as a list.

package/dist/eve/index.d.ts

@@ -1,5 +1,5 @@
-import { a as ResolveAuthOptions, r as AuthState } from "../resolve-KW8nCeL6.js";
-import { i as CredentialRef, r as CredentialProvider } from "../provider-BH5UWZJ6.js";
+import { a as ResolveAuthOptions, r as AuthState } from "../resolve-ChTYeTEl.js";
+import { i as CredentialRef, r as CredentialProvider } from "../provider-D-UEMvSD.js";
 import { i as AiChat } from "../ai-chat-7amvXjmQ.js";
 import { a as Inbox } from "../inbox-i7E1ppo6.js";
 import { a as EveMemoryToolsContext, c as MemoryDocumentConflictError, d as supabaseDocumentBackend, f as supabaseMemory, i as EveMemoryTool, l as SupabaseDocumentBackendOptions, m as EveSessionContext, n as EveMemoryContext, o as EveRecallMessage, p as EveSessionAuth, r as EveMemoryProvider, s as EveRecallResult, t as EveDocumentBackend, u as SupabaseMemoryOptions } from "../eve-gT2Fpjut.js";

package/dist/eve/index.js

@@ -1,6 +1,6 @@
 import { t as DbException } from "../db-exception-CnWcYPxL.js";
 import { a as tenantClaimPaths, n as claimAt, t as DEFAULT_CLAIMS } from "../claims-PqzCxaTD.js";
-import { i as resolveAuth } from "../resolve-D_IcnvFd.js";
+import { i as resolveAuth } from "../resolve-tJZY3FEa.js";
 import { t as isAnonymousUser } from "../view-BeFcRV6G.js";
 import { d as isRecord } from "../block-helpers-DWHxHsEQ.js";
 //#region src/eve/ids.ts

package/dist/{executor-D14tGopJ.d.ts → executor-BVBFM86G.d.ts}

@@ -1,4 +1,4 @@
-import { T as WorkflowGraph } from "./types-BI-0Sl2v.js";
+import { T as WorkflowGraph } from "./types-AYOvcyep.js";
 //#region src/blocks/workflow-builder/executor.d.ts
 /** What a step node passes to the engine's step: plain data, so it serializes. */
 interface GraphStepCall {

package/dist/expo/index.d.ts

@@ -1,7 +1,7 @@
 import { a as AnyModels, i as AnyFunctions } from "../types-6BdhkmZe.js";
 import { t as BetterSupabase } from "../define-CJJkkr1-.js";
-import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-CeVeeXwz.js";
-import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DoBijysA.js";
+import { i as ServerContext, n as ContextOptions, o as ServerOptions, t as BetterServer } from "../server-ZSJ9rCcV.js";
+import { i as MiddlewareOptions, r as GuardOptions } from "../respond-DprrgyXX.js";
 import { t as Validated } from "../shared-DDSjEGDR.js";
 import { AnyEntry, Contributions } from "@supabase/middleware";
 import { ImmutableRequest, MiddlewareFunction } from "expo-server";