better-supabase 0.7.0 → 0.8.0

package/dist/cli/run-DuN1MX-7.js

@@ -0,0 +1,705 @@
+import { r as errorText } from "./errors-CqTLXe2M.js";
+import { a as writeIfChanged, i as sameText, n as importPath, t as display } from "./io-CFzJVJ68.js";
+import { i as writeAtomic, n as cachedDatabaseTypes, t as CACHE_DIR } from "./cache-CIfA-jBV.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { d as typegenVersion, f as typegenVersionNotice, i as oxfmtInstalled, l as stabilizeMetadata, r as generateDatabaseTypes } from "./typegen-Demi5-VQ.js";
+import { a as buildModel, c as toCatalog, i as metaPaths, n as emitMeta, o as generatorModel, r as emitModule } from "./emit-BHHfwUoT.js";
+import { a as entitlementsMode, c as unsafeKey, i as entitlementRequirements, n as accessProviderMode, o as moduleKeyProblems, r as accessRequirements, s as providerLabel, t as compiledReadSets } from "./read-sets-DjJrm8Wj.js";
+import { p as tomlGet } from "./supabase-toml-B-bIukQF.js";
+import { t as loadSnapshot } from "./snapshot-Bstk6ulj.js";
+import { t as fileDiff } from "./diff-D1jGdb3Y.js";
+import { basename, isAbsolute, relative, resolve, sep } from "node:path";
+import { existsSync } from "node:fs";
+import { readFile, rm } from "node:fs/promises";
+import { SQL_MODULES, moduleLayout, modulePermissionKeys, renderModules, resolveModules, sameModuleFile } from "better-supabase/sql";
+//#region src/cli/gen/render.ts
+/**
+* Renders every generated file for a snapshot, without touching disk:
+* `database.types.ts` (what `supabase gen types` prints), the main module,
+* then each configured generator's files.
+*/
+async function renderFiles(config, snapshot, options = {}) {
+	return (await render(config, snapshot, options)).files;
+}
+async function render(config, snapshot, options = {}) {
+	const model = buildModel(snapshot, config);
+	const runtime = options.runtimeImport ? { runtimeImport: options.runtimeImport } : {};
+	const output = resolve(config.root, config.output);
+	const typegenOptions = {
+		schemas: config.schemas,
+		postgrestVersion: config.postgrestVersion
+	};
+	const databaseTypes = await cachedDatabaseTypes(config.root, [
+		typegenOptions,
+		await oxfmtInstalled(),
+		snapshot.generator
+	], () => generateDatabaseTypes(snapshot.generator, typegenOptions));
+	const metaFiles = metaPaths(config.output);
+	const main = emitModule(model, {
+		databaseTypesImport: importPath(output, resolve(config.root, config.databaseTypesOutput)),
+		importPathFor: (from) => importPath(output, resolve(config.root, from)),
+		metaImport: `./${basename(metaFiles.js)}`,
+		...options.inlineMeta ? { inlineMeta: true } : {},
+		...runtime
+	});
+	const meta = emitMeta(model, {
+		types: `./${basename(metaFiles.dts)}`,
+		...runtime
+	});
+	const files = [
+		{
+			path: config.databaseTypesOutput,
+			contents: databaseTypes
+		},
+		{
+			path: config.output,
+			contents: main
+		},
+		{
+			path: metaFiles.js,
+			contents: meta.js
+		},
+		{
+			path: metaFiles.dts,
+			contents: meta.dts
+		}
+	];
+	const owners = new Map(files.map((file) => [resolve(config.root, file.path), "gen"]));
+	let view;
+	for (const generator of config.generators) {
+		let extra;
+		try {
+			extra = await generator.generate({
+				meta: model.meta,
+				introspection: model.introspection,
+				extras: snapshot.extras,
+				config,
+				output,
+				importPath: (from, to) => importPath(resolve(config.root, from), resolve(config.root, to)),
+				model: view ??= generatorModel(model),
+				...runtime
+			});
+		} catch (cause) {
+			throw new Error(`generator "${generator.name}" failed: ${errorText(cause)}`, { cause });
+		}
+		for (const file of extra) {
+			const path = resolve(config.root, file.path);
+			const inside = relative(config.root, path);
+			if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`generator "${generator.name}" wrote ${file.path}, which is outside the project root`);
+			const owner = owners.get(path);
+			if (owner !== void 0) throw new Error(`generator "${generator.name}" wrote ${file.path}, which ${owner === "gen" ? "better-supabase gen writes" : `generator "${owner}" also writes`}`);
+			owners.set(path, generator.name);
+			files.push(file);
+		}
+	}
+	return {
+		files,
+		warnings: model.warnings
+	};
+}
+//#endregion
+//#region src/cli/doctor/shared.ts
+const catalogs = /* @__PURE__ */ new WeakMap();
+/** The snapshot joined per table and function, computed once per snapshot. */
+function catalogOf(context) {
+	let catalog = catalogs.get(context.snapshot);
+	if (!catalog) {
+		catalog = toCatalog(context.snapshot);
+		catalogs.set(context.snapshot, catalog);
+	}
+	return catalog;
+}
+/** `[api] schemas` from `config.toml`, the schemas PostgREST serves, or `config.schemas` without one. */
+function exposedSchemas(context) {
+	const listed = context.configToml ? tomlGet(context.configToml.document, ["api", "schemas"]) : void 0;
+	return Array.isArray(listed) && listed.every((entry) => typeof entry === "string") ? listed : context.config.schemas;
+}
+const exposed = (context) => {
+	const schemas = exposedSchemas(context);
+	return catalogOf(context).tables.filter((table) => schemas.includes(table.schema));
+};
+const qualified = (table) => `${table.schema}.${table.name}`;
+const tableObject = (table) => ({
+	kind: "table",
+	schema: table.schema,
+	name: table.name
+});
+const policyObject = (table, policy) => ({
+	kind: "policy",
+	schema: table.schema,
+	name: policy.name,
+	table: table.name
+});
+const splitTexts = /* @__PURE__ */ new Map();
+const SPLIT_CACHE_SIZE = 64;
+/** `text` split into lines; doctor locates many objects in the same SQL files. */
+function linesOf(text) {
+	let lines = splitTexts.get(text);
+	if (!lines) {
+		if (splitTexts.size >= SPLIT_CACHE_SIZE) splitTexts.clear();
+		lines = text.split("\n");
+		splitTexts.set(text, lines);
+	}
+	return lines;
+}
+/** Line number (1-based) of the first line matching `pattern`. */
+function lineOf(text, pattern) {
+	const index = linesOf(text).findIndex((line) => pattern.test(line));
+	return index === -1 ? void 0 : index + 1;
+}
+/** The keys of `authorization.permissions`, for `api-keys` scopes `"catalog"`. */
+const permissionCatalogKeys = (context) => context.config.authorization?.permissions?.map((entry) => entry.key);
+//#endregion
+//#region src/cli/doctor/authorization.ts
+const TEMPLATE_EFFECT = {
+	memberIds: "their membership checks read the tenant module's memberships table instead of the provider",
+	idsWithFor: "their checks of another user's tenant permissions (can_user, member_can) raise 0A000 (ACCESS_CALLER_ONLY) or are skipped",
+	isPlatformFor: "their checks of another user's platform permissions (platform_can) answer false or are skipped",
+	canAssignFor: "better_supabase.can_assign_as is not written and the inviter's right to assign the role is not checked again when the invitation is accepted"
+};
+/** The optional templates installed modules call that the provider doesn't set. */
+function missingTemplates(context, provider) {
+	const installed = new Set(context.config.sql.moduleNames);
+	const callers = /* @__PURE__ */ new Map();
+	for (const module of Object.values(SQL_MODULES)) {
+		if (!installed.has(module.name)) continue;
+		for (const name of module.providerFunctions ?? []) {
+			if (provider.functions[name] !== void 0) continue;
+			if (name === "canAssignFor" && context.config.sql.modules.access?.functions?.canAssignFor) continue;
+			callers.set(name, [...callers.get(name) ?? [], module.name]);
+		}
+	}
+	return [...callers].map(([name, modules]) => ({
+		severity: "warning",
+		message: `The ${modules.join(", ")} ${modules.length > 1 ? "modules call" : "module calls"} authorization.functions.${name}, which ${providerLabel(provider)} doesn't set, so under the provider model ${TEMPLATE_EFFECT[name] ?? "those calls fail"}. Use a provider that sets ${name}${name === "canAssignFor" ? ", or set sql.modules.access.functions.canAssignFor" : ""}.`,
+		target: `authorization.functions.${name}`
+	}));
+}
+/** Tables whose generated policies call the provider's functions by role and scope only. */
+const POLICY_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
+const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
+const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
+const escapeRegExp = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
+/**
+* A pattern for a filled template: `{permission}` captures the key literal
+* (optionally passed by name), `{scope}` captures the scope name, and
+* whitespace may differ.
+*/
+function templatePattern(template) {
+	const source = template.split(/(\{\w+\})/).map((part) => {
+		if (part === "{permission}") return String.raw`(?:\w+\s*=>\s*)?'((?:[^']|'')*)'`;
+		if (part === "{scope}") return "([a-z][a-z0-9_]*)";
+		if (/^\{\w+\}$/.test(part)) return String.raw`[\s\S]*?`;
+		return escapeRegExp(part.trim()).replaceAll(/\s+/g, String.raw`\s*`);
+	}).filter((part) => part !== "").join(String.raw`\s*`);
+	return new RegExp(source, "gi");
+}
+/** The keys and scopes a policy body passes to the provider's `idsWith` and `isPlatform`. */
+function providerCalls(provider, body) {
+	const calls = [];
+	const { idsWith, isPlatform } = provider.functions;
+	const groups = (template) => [...template.matchAll(/\{(permission|scope)\}/g)].map((match) => match[1]);
+	const idsGroups = groups(idsWith);
+	for (const match of body.matchAll(templatePattern(idsWith))) {
+		const key = match[idsGroups.indexOf("permission") + 1];
+		if (key === void 0) continue;
+		const scopeIndex = idsGroups.indexOf("scope");
+		calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: scopeIndex === -1 ? provider.tenantScope : match[scopeIndex + 1]
+		});
+	}
+	const platformGroups = groups(isPlatform);
+	for (const match of body.matchAll(templatePattern(isPlatform))) {
+		const key = match[platformGroups.indexOf("permission") + 1];
+		if (key !== void 0) calls.push({
+			key: key.replaceAll("''", "'"),
+			scope: "platform"
+		});
+	}
+	return calls;
+}
+/**
+* Policies better-supabase generates (`bs_` names) on `storage.objects` and
+* `realtime.messages` that call the provider's templates, with the keys
+* they pass. The first file that declares a policy wins, matching the
+* `sqlFiles` order (declarative schemas, then the newest migration).
+*/
+function providerPolicies(provider, files) {
+	const seen = /* @__PURE__ */ new Set();
+	const found = [];
+	for (const file of files) for (const match of file.text.matchAll(POLICY)) {
+		const name = unquote(match[1]);
+		const table = match[2].split(".").map((part) => unquote(part.trim())).join(".");
+		if (!POLICY_TABLES.has(table) || !name.startsWith("bs_")) continue;
+		const id = `${table}.${name}`;
+		if (seen.has(id)) continue;
+		seen.add(id);
+		const calls = providerCalls(provider, match[3]);
+		if (calls.length === 0) continue;
+		found.push({
+			name,
+			table,
+			calls,
+			file: file.path,
+			line: file.text.slice(0, match.index).split("\n").length
+		});
+	}
+	return found;
+}
+/**
+* `buckets` entries whose access policy reaches the provider's functions:
+* through `sql` templates, or through the access contract under the
+* `provider` model. Their keys and scope (the tenant scope for `tenant`).
+*/
+function providerBucketKeys(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	const providerModel = config.sql.modules.access?.model === "provider";
+	return Object.entries(config.buckets).flatMap(([bucket, entry]) => {
+		const policy = entry.policy;
+		if (policy === void 0 || typeof policy === "string") return [];
+		if (policy.sql === void 0 && !providerModel) return [];
+		const scope = policy.scope ?? "tenant";
+		return [{
+			bucket,
+			keys: [...new Set(Object.values(policy.access).filter((key) => typeof key === "string"))],
+			scope: scope === "tenant" ? provider.tenantScope : scope
+		}];
+	});
+}
+/**
+* Why a policy's scope can't work with the provider: a scope it doesn't
+* declare, or a key it grants only at other scopes.
+*/
+function placementProblems(provider, call, where) {
+	if (call.scope === "platform") return [];
+	const label = providerLabel(provider);
+	if (!provider.scopes.some((scope) => scope.name === call.scope)) return [`${where} uses scope "${call.scope}", which ${label} doesn't declare. Use one of ${provider.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`];
+	const declared = provider.permissions?.find((permission) => permission.key === call.key)?.scopes;
+	if (!declared || declared.length === 0 || declared.includes(call.scope)) return [];
+	return [`${where} checks "${call.key}" at scope "${call.scope}", but ${label} grants it at ${declared.map((scope) => `"${scope}"`).join(", ")}, so its SQL functions never grant it there. Use scope "${declared[0]}".`];
+}
+/** The provider's memberships for the `entitlements` SQL module, when that mode is valid. */
+function entitlementsModule(context) {
+	const mode = entitlementsMode(context.config);
+	return mode.kind === "provider" ? mode.provider : void 0;
+}
+/** The provider for the `provider` access model, when `sql.modules` installs `access`. */
+function accessModule(context) {
+	if (!resolveModules(context.config.sql.moduleNames, {}).some((module) => module.name === "access")) return { kind: "off" };
+	return accessProviderMode(context.config);
+}
+/**
+* Checks a function a template calls against `authorization.requires` and
+* the database: listed, executable by `role`, and present when the
+* snapshot read its schema. `undefined` when it passes.
+*/
+function requirementProblem(context, provider, requirement, caller) {
+	const label = providerLabel(provider);
+	const listed = (provider.requires ?? []).filter((entry) => entry.function === requirement.function);
+	if (provider.requires !== void 0 && listed.length === 0) return { message: `${caller} calls ${requirement.function}, but ${label} doesn't list it in authorization.requires. Use a provider version that lists every function its templates call.` };
+	if (listed.length > 0 && !listed.some((entry) => entry.role === requirement.role)) return { message: `${label} says only ${listed.map((entry) => entry.role).join(", ")} may execute ${requirement.function}, but ${caller} calls it as ${requirement.role}. Grant it execute to ${requirement.role} through the provider.` };
+	const schema = requirement.function.slice(0, requirement.function.indexOf("."));
+	if (!context.snapshot.schemas.includes(schema)) return void 0;
+	return catalogOf(context).functions.some((fn) => `${fn.schema}.${fn.name}` === requirement.function) ? void 0 : { message: `${requirement.function} is not in the database, but ${caller} calls it. Apply the provider's migration before the SQL modules.` };
+}
+const AUTHORIZATION_RULES = [
+	{
+		code: "BS214",
+		severity: "error",
+		title: "Permission the provider's SQL functions don't fully answer in a Storage or Realtime policy",
+		description: "An access policy on a bucket or topic that reaches the authorization provider's functions (through `sql` templates, or through the access contract under the `provider` model) decides by role and scope only. A permission whose `authorization.permissions` entry isn't `sqlComplete: true` would grant every object or topic in the scope, so it is reported, and so is a key the provider doesn't list or every key when it lists no permissions. A scope the provider doesn't declare, and a key checked at another scope than its entry's `scopes`, are reported too. Doctor reads the keys from `buckets` in the config and from the generated `bs_` policies on `storage.objects` and `realtime.messages`. It also warns when a bucket's `sql` templates differ from the provider's `idsWith` and `isPlatform`, since a copy goes stale when the provider changes; `sql: \"provider\"` renders them at `gen` time instead.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const findings = [];
+			for (const { bucket, keys, scope } of providerBucketKeys(context.config)) for (const key of keys) {
+				for (const message of placementProblems(provider, {
+					key,
+					scope
+				}, `buckets.${bucket} ("${key}")`)) findings.push({
+					message,
+					target: `buckets.${bucket}:${key}`
+				});
+				const problem = unsafeKey(provider, key);
+				if (!problem) continue;
+				findings.push({
+					message: `buckets.${bucket} uses "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
+					target: `buckets.${bucket}:${key}`
+				});
+			}
+			for (const [bucket, entry] of Object.entries(context.config.buckets)) {
+				const sql = typeof entry.policy === "object" ? entry.policy.sql : void 0;
+				if (typeof sql !== "object") continue;
+				const stale = ["idsWith", "isPlatform"].filter((name) => sql[name] !== provider.functions[name]);
+				if (stale.length === 0) continue;
+				findings.push({
+					severity: "warning",
+					message: `buckets.${bucket} copies sql templates that differ from ${providerLabel(provider)}'s ${stale.join(" and ")}. Set sql: "provider" so gen renders the provider's templates.`,
+					target: `buckets.${bucket}.policy.sql`
+				});
+			}
+			for (const policy of providerPolicies(provider, context.sqlFiles ?? [])) {
+				const seen = /* @__PURE__ */ new Set();
+				for (const call of policy.calls) for (const message of placementProblems(provider, call, `Policy "${policy.name}" on ${policy.table}`)) {
+					if (seen.has(message)) continue;
+					seen.add(message);
+					findings.push({
+						message,
+						target: `${policy.table}.${policy.name}:${call.key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+				for (const key of new Set(policy.calls.map((call) => call.key))) {
+					const problem = unsafeKey(provider, key);
+					if (!problem) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to the provider's SQL functions, but it ${problem.reason}. ${problem.fix}`,
+						target: `${policy.table}.${policy.name}:${key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS408",
+		severity: "warning",
+		title: "The entitlements module can't read the provider's memberships",
+		description: "With `entitlements.memberships: 'provider'` (the default with `authorization`), the `entitlements` SQL module reads memberships through the provider's `memberIds` template (in `has_entitlement`, as `authenticated`) and `memberIdsFor` (in `feature_claims`, which the provider's hook calls as `supabase_auth_admin`). Doctor warns when the provider can't back that mode (no tenant scope, an id type the module doesn't render, no `memberIds` or `memberIdsFor`), when its hook doesn't fill `claims.features` from `better_supabase.feature_claims` (unless `entitlements.claim` is `false`), when no membership table covers the tenant scope, and when a function those templates call is missing from `authorization.requires`, not executable by that role, or not in the database.",
+		check: (context) => {
+			if (!context.config.sql.moduleNames.includes("entitlements")) return [];
+			const mode = entitlementsMode(context.config);
+			if (mode.kind === "tenant") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "entitlements.memberships"
+			}];
+			const provider = context.config.authorization;
+			const label = providerLabel(provider);
+			const findings = [];
+			const features = context.config.claims.features;
+			const hook = provider.tokenHook;
+			if (hook && context.config.entitlements.claim !== false) {
+				const claims = hook.registeredClaims ?? [];
+				const featureClaim = claims.find((claim) => claim.name === features);
+				if (featureClaim?.function !== "better_supabase.feature_claims") {
+					const registered = claims.find((claim) => claim.function === "better_supabase.feature_claims");
+					findings.push({
+						message: registered ? `The hook of ${label} fills the "${registered.name}" claim from better_supabase.feature_claims, but claims.features is "${features}", so hasEntitlement() never finds the plan features. Set claims.features to "${registered.name}".` : featureClaim ? `The hook of ${label} fills the "${features}" claim from ${featureClaim.function}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point the provider's "${features}" claim at better_supabase.feature_claims.` : `The hook of ${label} has no "${features}" claim, so it never writes the plan features hasEntitlement() reads. Have it fill "${features}" from better_supabase.feature_claims, or set \`entitlements.claim: false\` to keep the features out of the token and check them in SQL with has_entitlement.`,
+						target: `claims.${features}`
+					});
+				}
+			}
+			const scope = mode.provider.scope;
+			if (provider.memberships === void 0) findings.push({
+				severity: "info",
+				message: `${label} lists no authorization.memberships, so entitlement_members() can't tell which tables hold "${scope}" memberships and plan changes never invalidate sessions.`,
+				target: "authorization.memberships"
+			});
+			else if (mode.provider.memberships.length === 0) findings.push({
+				message: `${label} maps no membership table to scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a membership table for "${scope}" to the provider.`,
+				target: "authorization.memberships"
+			});
+			for (const requirement of entitlementRequirements(mode.provider)) {
+				const problem = requirementProblem(context, provider, requirement, requirement.caller);
+				if (!problem) continue;
+				findings.push({
+					...requirement.kind === "member-for" && problem.message.includes("may execute") ? { severity: "info" } : {},
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS409",
+		severity: "warning",
+		title: "The authorization provider and the better-supabase config disagree",
+		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `claims.tenant` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `claims.scope` is neither `tenant` nor the provider's tenant scope, notes when the provider sets `suspension` or `roleSources` but `sql.modules.access.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			if (!provider) return [];
+			const label = providerLabel(provider);
+			const findings = (provider.problems ?? []).map((problem) => ({
+				message: `${label}: ${problem}`,
+				target: "authorization"
+			}));
+			const tenantClaim = provider.tokenHook?.tenantClaim;
+			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
+				message: `The hook of ${label} writes the active tenant to "${tenantClaim}", but claims.tenant is "${context.config.claims.tenant}". Set claims.tenant to "${tenantClaim}", or change the provider's tenant claim.`,
+				target: "claims.tenant"
+			});
+			const scope = context.config.claims.scope;
+			if (scope !== "tenant" && scope !== provider.tenantScope) findings.push({
+				severity: "info",
+				message: `claims.scope is "${scope}", but the tenant scope of ${label} is "${provider.tenantScope}". The tenant module's membership claims then use another scope than the provider's. Set claims.scope to "${provider.tenantScope}" (or "tenant").`,
+				target: "claims.scope"
+			});
+			const model = context.config.sql.modules.access?.model ?? "roles";
+			const unread = [...provider.suspension ? ["suspension"] : [], ...provider.roleSources && provider.roleSources.length > 0 ? ["roleSources"] : []];
+			if (model !== "provider" && unread.length > 0) findings.push({
+				severity: "info",
+				message: `${label} sets ${unread.join(" and ")}, but sql.modules.access.model is "${model}", so the SQL modules ignore ${unread.length > 1 ? "them" : "it"}. Set sql.modules.access.model to "provider" to use them, or set sql.modules.access.disabled yourself.`,
+				target: `authorization.${unread[0]}`
+			});
+			return findings;
+		}
+	},
+	{
+		code: "BS411",
+		severity: "error",
+		title: "The provider access model can't use the authorization provider",
+		description: "With `sql.modules.access.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `sql.modules.access.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter).",
+		check: (context) => {
+			const mode = accessModule(context);
+			if (mode.kind === "off") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "authorization"
+			}];
+			const provider = context.config.authorization;
+			const findings = [];
+			for (const requirement of accessRequirements(mode.access)) {
+				const problem = requirementProblem(context, provider, requirement, "the provider access model (can() and the SQL modules)");
+				if (problem) findings.push({
+					message: problem.message,
+					target: requirement.function
+				});
+			}
+			findings.push(...moduleKeyProblems(provider, modulePermissionKeys(context.config.sql.modules, context.config.sql.moduleNames)));
+			if ((context.config.sql.modules.access?.functions?.canAssign ?? provider.functions.canAssign) === void 0) findings.push({
+				severity: "warning",
+				message: `Neither sql.modules.access.functions.canAssign nor ${providerLabel(provider)} sets canAssign, so under the provider model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes. Use a provider that sets authorization.functions.canAssign, or set sql.modules.access.functions.canAssign.`,
+				target: "sql.modules.access.functions.canAssign"
+			});
+			findings.push(...missingTemplates(context, provider));
+			return findings;
+		}
+	}
+];
+//#endregion
+//#region src/cli/gen/manifest.ts
+/** The files the last `gen` wrote, so the next one can remove those it no longer writes. */
+const MANIFEST = `${CACHE_DIR}/gen-manifest.json`;
+const manifestPath = (root, path) => relative(root, resolve(root, path)).split(sep).join("/");
+async function readManifest(root) {
+	const parsed = await readFile(resolve(root, MANIFEST), "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
+	if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1 || !("files" in parsed) || !Array.isArray(parsed.files)) return [];
+	return parsed.files.filter((path) => typeof path === "string");
+}
+/** Files in the last manifest that this run doesn't generate and that still exist inside the root. */
+async function leftoverFiles(root, generated) {
+	const current = new Set(generated);
+	return (await readManifest(root)).filter((path) => {
+		const inside = relative(root, resolve(root, path));
+		return !current.has(path) && inside !== "" && !inside.startsWith("..") && !isAbsolute(inside) && existsSync(resolve(root, path));
+	});
+}
+const writeManifest = (root, files) => writeAtomic(resolve(root, MANIFEST), `${JSON.stringify({
+	version: 1,
+	files: [...files].sort()
+}, null, 2)}\n`).catch(() => void 0);
+//#endregion
+//#region src/cli/introspect/from-metadata.ts
+/** What the extras query set reads that a `GeneratorMetadata` document leaves out. */
+const METADATA_GAPS = [
+	"multi-column unique keys and checks",
+	"foreign key actions",
+	"indexes",
+	"triggers",
+	"policies",
+	"grants",
+	"storage buckets",
+	"the realtime publication"
+];
+/** `METADATA_GAPS` as one phrase for notices. */
+const METADATA_GAPS_TEXT = `${METADATA_GAPS.slice(0, -1).join(", ")} or ${METADATA_GAPS.at(-1) ?? ""}`;
+/**
+* Builds a snapshot from a `GeneratorMetadata` document alone, for
+* `gen --metadata`. Relations come from `relationships`, single-column unique
+* keys from `is_unique` and single-column checks from `check`, named as
+* Postgres names them by default (`<table>_<column>_key`, `<table>_<column>_check`).
+* Everything else the extras carry is empty, and `extras.fromMetadata` says so.
+*/
+function fromMetadata(document) {
+	const { metadata } = stabilizeMetadata(document);
+	const tableIds = new Set(metadata.tables.map((table) => table.id));
+	const tables = [
+		...metadata.tables,
+		...metadata.foreignTables,
+		...metadata.views,
+		...metadata.materializedViews
+	].map((relation) => {
+		const columns = metadata.columns.filter((column) => column.table_id === relation.id).sort((a, b) => a.ordinal_position - b.ordinal_position);
+		const own = tableIds.has(relation.id);
+		return {
+			id: relation.id,
+			schema: relation.schema,
+			name: relation.name,
+			primaryKey: [],
+			uniques: own ? columns.filter((column) => column.is_unique).map((column) => ({
+				name: `${relation.name}_${column.name}_key`,
+				columns: [column.name]
+			})) : [],
+			foreignKeys: own ? metadata.relationships.filter((fk) => fk.schema === relation.schema && fk.relation === relation.name).map((fk) => ({
+				name: fk.foreign_key_name,
+				onDelete: "no action",
+				onUpdate: "no action"
+			})).sort((a, b) => byCodePoint(a.name, b.name)) : [],
+			checks: own ? columns.flatMap((column) => column.check === null ? [] : [{
+				name: `${relation.name}_${column.name}_check`,
+				definition: `CHECK ((${column.check}))`
+			}]) : [],
+			indexes: [],
+			policies: [],
+			triggers: [],
+			grants: []
+		};
+	});
+	return {
+		version: 2,
+		schemas: [...new Set(metadata.schemas.map((schema) => schema.name))].sort(byCodePoint),
+		generator: metadata,
+		extras: {
+			tables,
+			buckets: [],
+			realtime: [],
+			fromMetadata: true
+		}
+	};
+}
+//#endregion
+//#region src/cli/gen/notices.ts
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt. @supabase/postgrest-typegen pins oxfmt 0.66.0 as its peer; to allow a newer one, add it to peerDependencyRules.allowedVersions in pnpm-workspace.yaml, keyed \"@supabase/postgrest-typegen>oxfmt\".";
+const METADATA_ONLY = `Notice: the schema came from a GeneratorMetadata document, which has no ${METADATA_GAPS_TEXT}. Unique keys and checks cover single columns, relations have no onDelete, and columns a before-insert trigger fills stay required on insert. Run \`better-supabase gen\` against the database for the full model.`;
+/** The formatter, typegen version and metadata-only notices and the config warnings, one line each. */
+async function generationNotices(snapshot, warnings) {
+	const typegen = typegenVersionNotice(await typegenVersion());
+	return [
+		...await oxfmtInstalled() ? [] : [UNFORMATTED],
+		...typegen ? [typegen] : [],
+		...snapshot.extras.fromMetadata ? [METADATA_ONLY] : [],
+		...warnings.map((warning) => `Warning: ${warning}`)
+	];
+}
+//#endregion
+//#region src/cli/gen/run.ts
+/** The `read-sets` SQL module file for `config.readSets`, if any are configured. */
+async function readSetFile(config) {
+	if (config.readSets.length === 0) return void 0;
+	const readSets = await compiledReadSets(config);
+	return renderModules(["read-sets"], moduleLayout(config, config.sql.testsDir, readSets))[0];
+}
+/**
+* `buckets` keys that reach the authorization provider's functions but
+* aren't marked `sqlComplete: true` in `authorization.permissions`, as
+* error lines.
+*/
+function rowConditionedBuckets(config) {
+	const provider = config.authorization;
+	if (!provider) return [];
+	return providerBucketKeys(config).flatMap(({ bucket, keys }) => keys.flatMap((key) => {
+		const problem = unsafeKey(provider, key);
+		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
+	}));
+}
+/** The exit `gen` stops with when bucket keys aren't fully answered by the provider's SQL functions. */
+function refuseRowConditionedBuckets(config) {
+	const refused = rowConditionedBuckets(config);
+	return refused.length === 0 || !config.authorization ? void 0 : {
+		code: 1,
+		error: `The SQL functions of ${providerLabel(config.authorization)} decide by role and scope only, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
+	};
+}
+async function runGen(options) {
+	const { config } = options;
+	const refused = refuseRowConditionedBuckets(config);
+	if (refused) return refused;
+	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
+	const { files, warnings } = await render(config, snapshot);
+	const pathsOf = (readSets) => [...files, ...readSets ? [readSets] : []].map((file) => manifestPath(config.root, file.path));
+	const notice = (await generationNotices(snapshot, warnings)).map((line) => `\n${line}`).join("");
+	const readSetsOf = () => options.isolated ? Promise.resolve(void 0) : readSetFile(config);
+	const leftoversOf = (generated) => options.isolated ? Promise.resolve([]) : leftoverFiles(config.root, generated);
+	if (options.check) {
+		const readSets = await readSetsOf();
+		const generated = pathsOf(readSets);
+		const leftovers = await leftoversOf(generated);
+		const stale = [];
+		const diffs = [];
+		const compare = (file, current) => {
+			const shown = display(config.root, file.path);
+			stale.push(shown);
+			diffs.push(fileDiff(shown, current, file.contents, options.paint));
+		};
+		for (const file of files) {
+			const path = resolve(config.root, file.path);
+			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
+			if (!sameText(current, file.contents)) compare(file, current);
+		}
+		if (readSets) {
+			const path = resolve(config.root, readSets.path);
+			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
+			if (!sameModuleFile(current, readSets.contents)) compare(readSets, current);
+		}
+		if (stale.length > 0 || leftovers.length > 0) {
+			const lines = [...stale.map((path) => `  ${path}`), ...leftovers.map((path) => `  ${path} (no longer generated)`)];
+			return {
+				code: 1,
+				output: `${diffs.join("\n\n")}${notice}`,
+				error: `Generated files are out of date:\n${lines.join("\n")}\nRun \`better-supabase gen\`.`,
+				data: {
+					upToDate: false,
+					stale,
+					leftovers,
+					warnings
+				}
+			};
+		}
+		return {
+			code: 0,
+			output: `Generated files are up to date (${generated.length}).${notice}`,
+			data: {
+				upToDate: true,
+				stale: [],
+				leftovers: [],
+				warnings
+			}
+		};
+	}
+	const written = [];
+	for (const file of files) if (await writeIfChanged(resolve(config.root, file.path), file.contents)) written.push(display(config.root, file.path));
+	const readSets = await readSetsOf();
+	if (readSets && await writeIfChanged(resolve(config.root, readSets.path), readSets.contents)) written.push(display(config.root, readSets.path));
+	const generated = pathsOf(readSets);
+	const removed = [];
+	for (const path of await leftoversOf(generated)) {
+		await rm(resolve(config.root, path), { force: true });
+		removed.push(path);
+	}
+	if (!options.isolated) await writeManifest(config.root, generated);
+	const tables = snapshot.extras.tables.filter((table) => config.schemas.includes(table.schema)).length;
+	const changes = [...written.map((path) => `  ${path}`), ...removed.map((path) => `  ${path} (removed, no longer generated)`)];
+	return {
+		code: 0,
+		output: `${changes.length === 0 ? `No changes (${tables} tables).` : `Generated ${tables} tables:\n${changes.join("\n")}`}${notice}`,
+		data: {
+			tables,
+			written,
+			removed,
+			warnings
+		}
+	};
+}
+//#endregion
+export { tableObject as _, METADATA_GAPS_TEXT as a, accessModule as c, exposed as d, exposedSchemas as f, qualified as g, policyObject as h, generationNotices as i, entitlementsModule as l, permissionCatalogKeys as m, runGen as n, fromMetadata as o, lineOf as p, UNFORMATTED as r, AUTHORIZATION_RULES as s, refuseRowConditionedBuckets as t, catalogOf as u, render as v, renderFiles as y };