better-supabase 0.7.1 → 0.9.0

package/dist/cli/gen-CCMc39Dx.js

@@ -1,3100 +0,0 @@
-import { r as defineCliCommand } from "./command-CK14fP91.js";
-import { n as CliError } from "./errors-4v4DTtda.js";
-import { i as writeIfChanged, n as importPath, r as sameText, t as display } from "./io-DI1mTdSA.js";
-import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-59gcepIG.js";
-import { a as entitlementsMode, c as unsafeKey, i as entitlementRequirements, n as accessProviderMode, o as moduleKeyProblems, r as accessRequirements, s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
-import { s as stdinDatabaseUrl, t as databaseUrl } from "./config-NiPxAmUF.js";
-import { l as pgFunctionHooks, p as tomlGet, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
-import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { t as TYPEGEN_VERSION } from "./typegen-version-DeFbtzYI.js";
-import { n as withSpinner } from "./prompts-BNcNfAve.js";
-import { t as connect } from "./db-DOBPt660.js";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { existsSync } from "node:fs";
-import { mkdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
-import { setTimeout } from "node:timers/promises";
-import { DEFAULT_CLAIMS, jsonSchema, tenantClaimPaths, valibot, zod } from "better-supabase/config";
-import { SQL_MODULES, moduleLayout, modulePermissionKeys, renderModules, resolveModules, resolveProviderSql, sameModuleFile } from "better-supabase/sql";
-import { toCamel } from "better-supabase";
-import { createHash } from "node:crypto";
-//#region src/cli/introspect/catalog.ts
-const byName = (a, b) => a.schema === b.schema ? a.name < b.name ? -1 : a.name > b.name ? 1 : 0 : a.schema < b.schema ? -1 : 1;
-function toColumn(column) {
-	const isArray = column.data_type === "ARRAY";
-	const udt = isArray ? column.format.replace(/^_/, "") : column.format;
-	const defaultValue = column.default_value === null || column.default_value === void 0 ? null : String(column.default_value);
-	return {
-		name: column.name,
-		udt,
-		format: column.format,
-		typeSchema: column.type_schema,
-		isArray,
-		isEnum: column.enums.length > 0,
-		nullable: column.is_nullable,
-		hasDefault: defaultValue !== null || column.identity_generation !== null || column.is_generated,
-		default: defaultValue,
-		identity: column.identity_generation === "ALWAYS" ? "always" : column.identity_generation === "BY DEFAULT" ? "by default" : null,
-		generated: column.is_generated,
-		updatable: column.is_updatable,
-		comment: column.comment
-	};
-}
-function toFunction(fn, typeOf, relationName) {
-	const args = [];
-	const table = [];
-	fn.args.forEach((arg, index) => {
-		const type = typeOf(arg.type_id);
-		const raw = type?.name ?? "unknown";
-		const typeSchema = type ? { typeSchema: type.schema } : {};
-		const name = arg.name || `arg${index + 1}`;
-		if (arg.mode === "in" || arg.mode === "inout" || arg.mode === "variadic") {
-			const isArray = raw.startsWith("_");
-			args.push({
-				name,
-				udt: isArray ? raw.slice(1) : raw,
-				...typeSchema,
-				isArray,
-				hasDefault: arg.has_default === true
-			});
-		}
-		if (arg.mode === "table" || arg.mode === "out" || arg.mode === "inout") table.push({
-			name,
-			udt: raw,
-			...typeSchema
-		});
-	});
-	const returnType = typeOf(fn.return_type_id);
-	const searchPath = fn.config_params?.["search_path"];
-	return {
-		schema: fn.schema,
-		name: fn.name,
-		signature: fn.identity_argument_types,
-		args,
-		returnsTable: fn.args.some((arg) => arg.mode === "table") ? table : null,
-		returns: returnType?.name ?? fn.return_type,
-		...returnType ? { returnsSchema: returnType.schema } : {},
-		returnsRelation: relationName(fn.return_type_relation_id),
-		returnsSet: fn.is_set_returning_function,
-		volatility: fn.behavior.toLowerCase(),
-		securityDefiner: fn.security_definer,
-		language: fn.language,
-		searchPath: searchPath === void 0 ? null : searchPath.replace(/^""$/, "")
-	};
-}
-/** Joins the typegen metadata and the extras into one record per object. */
-function toCatalog(snapshot) {
-	const meta = snapshot.generator;
-	const extras = new Map(snapshot.extras.tables.map((table) => [table.id, table]));
-	const columns = /* @__PURE__ */ new Map();
-	for (const column of meta.columns) {
-		const list = columns.get(column.table_id);
-		if (list) list.push(column);
-		else columns.set(column.table_id, [column]);
-	}
-	const primaryKeys = /* @__PURE__ */ new Map();
-	for (const key of meta.primaryKeys) {
-		const list = primaryKeys.get(key.table_id);
-		if (list) list.push(key.name);
-		else primaryKeys.set(key.table_id, [key.name]);
-	}
-	const relationNames = /* @__PURE__ */ new Map();
-	for (const list of [
-		meta.tables,
-		meta.foreignTables,
-		meta.views,
-		meta.materializedViews
-	]) for (const entry of list) relationNames.set(entry.id, `${entry.schema}.${entry.name}`);
-	const viewNames = new Set([...meta.views, ...meta.materializedViews].map((view) => `${view.schema}.${view.name}`));
-	const foreignKeysOf = (schema, name, extra) => {
-		const actions = new Map((extra?.foreignKeys ?? []).map((fk) => [fk.name, fk]));
-		return meta.relationships.filter((rel) => rel.schema === schema && rel.relation === name && actions.has(rel.foreign_key_name) && !viewNames.has(`${rel.referenced_schema}.${rel.referenced_relation}`)).map((rel) => {
-			const action = actions.get(rel.foreign_key_name);
-			return {
-				name: rel.foreign_key_name,
-				columns: rel.columns,
-				refSchema: rel.referenced_schema,
-				refTable: rel.referenced_relation,
-				refColumns: rel.referenced_columns,
-				oneToOne: rel.is_one_to_one,
-				onDelete: action?.onDelete ?? "no action",
-				onUpdate: action?.onUpdate ?? "no action"
-			};
-		}).sort((a, b) => byCodePoint(a.name, b.name));
-	};
-	const build = (entry, flags) => {
-		const extra = extras.get(entry.id);
-		const own = [...columns.get(entry.id) ?? []].sort((a, b) => a.ordinal_position - b.ordinal_position);
-		return {
-			id: entry.id,
-			schema: entry.schema,
-			name: entry.name,
-			comment: entry.comment,
-			...flags,
-			columns: own.map(toColumn),
-			primaryKey: extra && extra.primaryKey.length > 0 ? extra.primaryKey : primaryKeys.get(entry.id) ?? [],
-			uniques: extra?.uniques ?? [],
-			foreignKeys: foreignKeysOf(entry.schema, entry.name, extra),
-			checks: extra?.checks ?? [],
-			indexes: extra?.indexes ?? [],
-			policies: extra?.policies ?? [],
-			triggers: extra?.triggers ?? [],
-			grants: extra?.grants ?? [],
-			...extra?.columnGrants ? { columnGrants: extra.columnGrants } : {}
-		};
-	};
-	const tables = [
-		...meta.tables.map((table) => build(table, {
-			kind: "table",
-			rls: table.rls_enabled,
-			forceRls: table.rls_forced,
-			replicaIdentity: table.replica_identity,
-			insertable: true,
-			updatable: true
-		})),
-		...meta.foreignTables.map((table) => build(table, {
-			kind: "table",
-			rls: false,
-			forceRls: false,
-			replicaIdentity: null,
-			insertable: true,
-			updatable: true
-		})),
-		...meta.views.map((view) => build(view, {
-			kind: "view",
-			rls: false,
-			forceRls: false,
-			replicaIdentity: null,
-			insertable: view.is_insert_enabled ?? view.is_updatable,
-			updatable: view.is_update_enabled ?? view.is_updatable
-		})),
-		...meta.materializedViews.map((view) => build(view, {
-			kind: "view",
-			rls: false,
-			forceRls: false,
-			replicaIdentity: null,
-			insertable: false,
-			updatable: false
-		}))
-	].sort(byName);
-	const included = new Set(snapshot.schemas);
-	const enums = meta.types.filter((type) => type.enums.length > 0 && included.has(type.schema)).map((type) => ({
-		schema: type.schema,
-		name: type.name,
-		values: type.enums
-	})).sort(byName);
-	const types = new Map(meta.types.map((type) => [type.id, type]));
-	const functions = meta.functions.map((fn) => toFunction(fn, (id) => types.get(id), (id) => id === null ? null : relationNames.get(id) ?? null)).sort((a, b) => byName(a, b) || byCodePoint(a.signature, b.signature));
-	return {
-		schemas: snapshot.schemas,
-		tables,
-		enums,
-		functions,
-		buckets: snapshot.extras.buckets,
-		realtime: snapshot.extras.realtime
-	};
-}
-//#endregion
-//#region src/cli/doctor/shared.ts
-const catalogs = /* @__PURE__ */ new WeakMap();
-/** The snapshot joined per table and function, computed once per snapshot. */
-function catalogOf(context) {
-	let catalog = catalogs.get(context.snapshot);
-	if (!catalog) {
-		catalog = toCatalog(context.snapshot);
-		catalogs.set(context.snapshot, catalog);
-	}
-	return catalog;
-}
-/** `[api] schemas` from `config.toml`, the schemas PostgREST serves, or `config.schemas` without one. */
-function exposedSchemas(context) {
-	const listed = context.configToml ? tomlGet(context.configToml.document, ["api", "schemas"]) : void 0;
-	return Array.isArray(listed) && listed.every((entry) => typeof entry === "string") ? listed : context.config.schemas;
-}
-const exposed = (context) => {
-	const schemas = exposedSchemas(context);
-	return catalogOf(context).tables.filter((table) => schemas.includes(table.schema));
-};
-const qualified = (table) => `${table.schema}.${table.name}`;
-const tableObject = (table) => ({
-	kind: "table",
-	schema: table.schema,
-	name: table.name
-});
-const policyObject = (table, policy) => ({
-	kind: "policy",
-	schema: table.schema,
-	name: policy.name,
-	table: table.name
-});
-const splitTexts = /* @__PURE__ */ new Map();
-const SPLIT_CACHE_SIZE = 64;
-/** `text` split into lines; doctor locates many objects in the same SQL files. */
-function linesOf(text) {
-	let lines = splitTexts.get(text);
-	if (!lines) {
-		if (splitTexts.size >= SPLIT_CACHE_SIZE) splitTexts.clear();
-		lines = text.split("\n");
-		splitTexts.set(text, lines);
-	}
-	return lines;
-}
-/** Line number (1-based) of the first line matching `pattern`. */
-function lineOf(text, pattern) {
-	const index = linesOf(text).findIndex((line) => pattern.test(line));
-	return index === -1 ? void 0 : index + 1;
-}
-/** The keys of `authorization.permissions`, for `api-keys` scopes `"catalog"`. */
-const permissionCatalogKeys = (context) => context.config.authorization?.permissions?.map((entry) => entry.key);
-//#endregion
-//#region src/cli/doctor/authorization.ts
-const TEMPLATE_EFFECT = {
-	memberIds: "their membership checks read the tenant module's memberships table instead of the provider",
-	idsWithFor: "their checks of another user's tenant permissions (can_user, member_can) raise 0A000 (ACCESS_CALLER_ONLY) or are skipped",
-	isPlatformFor: "their checks of another user's platform permissions (platform_can) answer false or are skipped",
-	canAssignFor: "better_supabase.can_assign_as is not written and the inviter's right to assign the role is not checked again when the invitation is accepted"
-};
-/** The optional templates installed modules call that the provider doesn't set. */
-function missingTemplates(context, provider) {
-	const installed = new Set(context.config.sql.moduleNames);
-	const callers = /* @__PURE__ */ new Map();
-	for (const module of Object.values(SQL_MODULES)) {
-		if (!installed.has(module.name)) continue;
-		for (const name of module.providerFunctions ?? []) {
-			if (provider.functions[name] !== void 0) continue;
-			if (name === "canAssignFor" && context.config.sql.modules.access?.functions?.canAssignFor) continue;
-			callers.set(name, [...callers.get(name) ?? [], module.name]);
-		}
-	}
-	return [...callers].map(([name, modules]) => ({
-		severity: "warning",
-		message: `The ${modules.join(", ")} ${modules.length > 1 ? "modules call" : "module calls"} authorization.functions.${name}, which ${providerLabel(provider)} doesn't set, so under the provider model ${TEMPLATE_EFFECT[name] ?? "those calls fail"}. Use a provider that sets ${name}${name === "canAssignFor" ? ", or set sql.modules.access.functions.canAssignFor" : ""}.`,
-		target: `authorization.functions.${name}`
-	}));
-}
-/** Tables whose generated policies call the provider's functions by role and scope only. */
-const POLICY_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
-const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
-const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
-const escapeRegExp = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`);
-/**
-* A pattern for a filled template: `{permission}` captures the key literal
-* (optionally passed by name), `{scope}` captures the scope name, and
-* whitespace may differ.
-*/
-function templatePattern(template) {
-	const source = template.split(/(\{\w+\})/).map((part) => {
-		if (part === "{permission}") return String.raw`(?:\w+\s*=>\s*)?'((?:[^']|'')*)'`;
-		if (part === "{scope}") return "([a-z][a-z0-9_]*)";
-		if (/^\{\w+\}$/.test(part)) return String.raw`[\s\S]*?`;
-		return escapeRegExp(part.trim()).replaceAll(/\s+/g, String.raw`\s*`);
-	}).filter((part) => part !== "").join(String.raw`\s*`);
-	return new RegExp(source, "gi");
-}
-/** The keys and scopes a policy body passes to the provider's `idsWith` and `isPlatform`. */
-function providerCalls(provider, body) {
-	const calls = [];
-	const { idsWith, isPlatform } = provider.functions;
-	const groups = (template) => [...template.matchAll(/\{(permission|scope)\}/g)].map((match) => match[1]);
-	const idsGroups = groups(idsWith);
-	for (const match of body.matchAll(templatePattern(idsWith))) {
-		const key = match[idsGroups.indexOf("permission") + 1];
-		if (key === void 0) continue;
-		const scopeIndex = idsGroups.indexOf("scope");
-		calls.push({
-			key: key.replaceAll("''", "'"),
-			scope: scopeIndex === -1 ? provider.tenantScope : match[scopeIndex + 1]
-		});
-	}
-	const platformGroups = groups(isPlatform);
-	for (const match of body.matchAll(templatePattern(isPlatform))) {
-		const key = match[platformGroups.indexOf("permission") + 1];
-		if (key !== void 0) calls.push({
-			key: key.replaceAll("''", "'"),
-			scope: "platform"
-		});
-	}
-	return calls;
-}
-/**
-* Policies better-supabase generates (`bs_` names) on `storage.objects` and
-* `realtime.messages` that call the provider's templates, with the keys
-* they pass. The first file that declares a policy wins, matching the
-* `sqlFiles` order (declarative schemas, then the newest migration).
-*/
-function providerPolicies(provider, files) {
-	const seen = /* @__PURE__ */ new Set();
-	const found = [];
-	for (const file of files) for (const match of file.text.matchAll(POLICY)) {
-		const name = unquote(match[1]);
-		const table = match[2].split(".").map((part) => unquote(part.trim())).join(".");
-		if (!POLICY_TABLES.has(table) || !name.startsWith("bs_")) continue;
-		const id = `${table}.${name}`;
-		if (seen.has(id)) continue;
-		seen.add(id);
-		const calls = providerCalls(provider, match[3]);
-		if (calls.length === 0) continue;
-		found.push({
-			name,
-			table,
-			calls,
-			file: file.path,
-			line: file.text.slice(0, match.index).split("\n").length
-		});
-	}
-	return found;
-}
-/**
-* `buckets` entries whose access policy reaches the provider's functions:
-* through `sql` templates, or through the access contract under the
-* `provider` model. Their keys and scope (the tenant scope for `tenant`).
-*/
-function providerBucketKeys(config) {
-	const provider = config.authorization;
-	if (!provider) return [];
-	const providerModel = config.sql.modules.access?.model === "provider";
-	return Object.entries(config.buckets).flatMap(([bucket, entry]) => {
-		const policy = entry.policy;
-		if (policy === void 0 || typeof policy === "string") return [];
-		if (policy.sql === void 0 && !providerModel) return [];
-		const scope = policy.scope ?? "tenant";
-		return [{
-			bucket,
-			keys: [...new Set(Object.values(policy.access).filter((key) => typeof key === "string"))],
-			scope: scope === "tenant" ? provider.tenantScope : scope
-		}];
-	});
-}
-/**
-* Why a policy's scope can't work with the provider: a scope it doesn't
-* declare, or a key it grants only at other scopes.
-*/
-function placementProblems(provider, call, where) {
-	if (call.scope === "platform") return [];
-	const label = providerLabel(provider);
-	if (!provider.scopes.some((scope) => scope.name === call.scope)) return [`${where} uses scope "${call.scope}", which ${label} doesn't declare. Use one of ${provider.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`];
-	const declared = provider.permissions?.find((permission) => permission.key === call.key)?.scopes;
-	if (!declared || declared.length === 0 || declared.includes(call.scope)) return [];
-	return [`${where} checks "${call.key}" at scope "${call.scope}", but ${label} grants it at ${declared.map((scope) => `"${scope}"`).join(", ")}, so its SQL functions never grant it there. Use scope "${declared[0]}".`];
-}
-/** The provider's memberships for the `entitlements` SQL module, when that mode is valid. */
-function entitlementsModule(context) {
-	const mode = entitlementsMode(context.config);
-	return mode.kind === "provider" ? mode.provider : void 0;
-}
-/** The provider for the `provider` access model, when `sql.modules` installs `access`. */
-function accessModule(context) {
-	if (!resolveModules(context.config.sql.moduleNames, {}).some((module) => module.name === "access")) return { kind: "off" };
-	return accessProviderMode(context.config);
-}
-/**
-* Checks a function a template calls against `authorization.requires` and
-* the database: listed, executable by `role`, and present when the
-* snapshot read its schema. `undefined` when it passes.
-*/
-function requirementProblem(context, provider, requirement, caller) {
-	const label = providerLabel(provider);
-	const listed = (provider.requires ?? []).filter((entry) => entry.function === requirement.function);
-	if (provider.requires !== void 0 && listed.length === 0) return { message: `${caller} calls ${requirement.function}, but ${label} doesn't list it in authorization.requires. Use a provider version that lists every function its templates call.` };
-	if (listed.length > 0 && !listed.some((entry) => entry.role === requirement.role)) return { message: `${label} says only ${listed.map((entry) => entry.role).join(", ")} may execute ${requirement.function}, but ${caller} calls it as ${requirement.role}. Grant it execute to ${requirement.role} through the provider.` };
-	const schema = requirement.function.slice(0, requirement.function.indexOf("."));
-	if (!context.snapshot.schemas.includes(schema)) return void 0;
-	return catalogOf(context).functions.some((fn) => `${fn.schema}.${fn.name}` === requirement.function) ? void 0 : { message: `${requirement.function} is not in the database, but ${caller} calls it. Apply the provider's migration before the SQL modules.` };
-}
-const AUTHORIZATION_RULES = [
-	{
-		code: "BS214",
-		severity: "error",
-		title: "Permission the provider's SQL functions don't fully answer in a Storage or Realtime policy",
-		description: "An access policy on a bucket or topic that reaches the authorization provider's functions (through `sql` templates, or through the access contract under the `provider` model) decides by role and scope only. A permission whose `authorization.permissions` entry isn't `sqlComplete: true` would grant every object or topic in the scope, so it is reported, and so is a key the provider doesn't list or every key when it lists no permissions. A scope the provider doesn't declare, and a key checked at another scope than its entry's `scopes`, are reported too. Doctor reads the keys from `buckets` in the config and from the generated `bs_` policies on `storage.objects` and `realtime.messages`. It also warns when a bucket's `sql` templates differ from the provider's `idsWith` and `isPlatform`, since a copy goes stale when the provider changes; `sql: \"provider\"` renders them at `gen` time instead.",
-		check: (context) => {
-			const provider = context.config.authorization;
-			if (!provider) return [];
-			const findings = [];
-			for (const { bucket, keys, scope } of providerBucketKeys(context.config)) for (const key of keys) {
-				for (const message of placementProblems(provider, {
-					key,
-					scope
-				}, `buckets.${bucket} ("${key}")`)) findings.push({
-					message,
-					target: `buckets.${bucket}:${key}`
-				});
-				const problem = unsafeKey(provider, key);
-				if (!problem) continue;
-				findings.push({
-					message: `buckets.${bucket} uses "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
-					target: `buckets.${bucket}:${key}`
-				});
-			}
-			for (const [bucket, entry] of Object.entries(context.config.buckets)) {
-				const sql = typeof entry.policy === "object" ? entry.policy.sql : void 0;
-				if (typeof sql !== "object") continue;
-				const stale = ["idsWith", "isPlatform"].filter((name) => sql[name] !== provider.functions[name]);
-				if (stale.length === 0) continue;
-				findings.push({
-					severity: "warning",
-					message: `buckets.${bucket} copies sql templates that differ from ${providerLabel(provider)}'s ${stale.join(" and ")}. Set sql: "provider" so gen renders the provider's templates.`,
-					target: `buckets.${bucket}.policy.sql`
-				});
-			}
-			for (const policy of providerPolicies(provider, context.sqlFiles ?? [])) {
-				const seen = /* @__PURE__ */ new Set();
-				for (const call of policy.calls) for (const message of placementProblems(provider, call, `Policy "${policy.name}" on ${policy.table}`)) {
-					if (seen.has(message)) continue;
-					seen.add(message);
-					findings.push({
-						message,
-						target: `${policy.table}.${policy.name}:${call.key}`,
-						location: {
-							file: policy.file,
-							line: policy.line
-						}
-					});
-				}
-				for (const key of new Set(policy.calls.map((call) => call.key))) {
-					const problem = unsafeKey(provider, key);
-					if (!problem) continue;
-					findings.push({
-						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to the provider's SQL functions, but it ${problem.reason}. ${problem.fix}`,
-						target: `${policy.table}.${policy.name}:${key}`,
-						location: {
-							file: policy.file,
-							line: policy.line
-						}
-					});
-				}
-			}
-			return findings;
-		}
-	},
-	{
-		code: "BS408",
-		severity: "warning",
-		title: "The entitlements module can't read the provider's memberships",
-		description: "With `entitlements.memberships: 'provider'` (the default with `authorization`), the `entitlements` SQL module reads memberships through the provider's `memberIds` template (in `has_entitlement`, as `authenticated`) and `memberIdsFor` (in `feature_claims`, which the provider's hook calls as `supabase_auth_admin`). Doctor warns when the provider can't back that mode (no tenant scope, an id type the module doesn't render, no `memberIds` or `memberIdsFor`), when its hook doesn't fill `claims.features` from `better_supabase.feature_claims` (unless `entitlements.claim` is `false`), when no membership table covers the tenant scope, and when a function those templates call is missing from `authorization.requires`, not executable by that role, or not in the database.",
-		check: (context) => {
-			if (!context.config.sql.moduleNames.includes("entitlements")) return [];
-			const mode = entitlementsMode(context.config);
-			if (mode.kind === "tenant") return [];
-			if (mode.kind === "invalid") return [{
-				message: mode.problem,
-				target: "entitlements.memberships"
-			}];
-			const provider = context.config.authorization;
-			const label = providerLabel(provider);
-			const findings = [];
-			const features = context.config.claims.features;
-			const hook = provider.tokenHook;
-			if (hook && context.config.entitlements.claim !== false) {
-				const claims = hook.registeredClaims ?? [];
-				const featureClaim = claims.find((claim) => claim.name === features);
-				if (featureClaim?.function !== "better_supabase.feature_claims") {
-					const registered = claims.find((claim) => claim.function === "better_supabase.feature_claims");
-					findings.push({
-						message: registered ? `The hook of ${label} fills the "${registered.name}" claim from better_supabase.feature_claims, but claims.features is "${features}", so hasEntitlement() never finds the plan features. Set claims.features to "${registered.name}".` : featureClaim ? `The hook of ${label} fills the "${features}" claim from ${featureClaim.function}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point the provider's "${features}" claim at better_supabase.feature_claims.` : `The hook of ${label} has no "${features}" claim, so it never writes the plan features hasEntitlement() reads. Have it fill "${features}" from better_supabase.feature_claims, or set \`entitlements.claim: false\` to keep the features out of the token and check them in SQL with has_entitlement.`,
-						target: `claims.${features}`
-					});
-				}
-			}
-			const scope = mode.provider.scope;
-			if (provider.memberships === void 0) findings.push({
-				severity: "info",
-				message: `${label} lists no authorization.memberships, so entitlement_members() can't tell which tables hold "${scope}" memberships and plan changes never invalidate sessions.`,
-				target: "authorization.memberships"
-			});
-			else if (mode.provider.memberships.length === 0) findings.push({
-				message: `${label} maps no membership table to scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a membership table for "${scope}" to the provider.`,
-				target: "authorization.memberships"
-			});
-			for (const requirement of entitlementRequirements(mode.provider)) {
-				const problem = requirementProblem(context, provider, requirement, requirement.caller);
-				if (!problem) continue;
-				findings.push({
-					...requirement.kind === "member-for" && problem.message.includes("may execute") ? { severity: "info" } : {},
-					message: problem.message,
-					target: requirement.function
-				});
-			}
-			return findings;
-		}
-	},
-	{
-		code: "BS409",
-		severity: "warning",
-		title: "The authorization provider and the better-supabase config disagree",
-		description: "The provider's hook writes the active tenant to `tokenHook.tenantClaim`, and its tenant scope is `tenantScope`. Doctor warns when `claims.tenant` names another claim (the tenant plugin, guards and RLS would read a claim the hook never writes), notes when `claims.scope` is neither `tenant` nor the provider's tenant scope, notes when the provider sets `suspension` or `roleSources` but `sql.modules.access.model` is not `provider` (only that model reads them), and reports the `problems` the provider found while it was built.",
-		check: (context) => {
-			const provider = context.config.authorization;
-			if (!provider) return [];
-			const label = providerLabel(provider);
-			const findings = (provider.problems ?? []).map((problem) => ({
-				message: `${label}: ${problem}`,
-				target: "authorization"
-			}));
-			const tenantClaim = provider.tokenHook?.tenantClaim;
-			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
-				message: `The hook of ${label} writes the active tenant to "${tenantClaim}", but claims.tenant is "${context.config.claims.tenant}". Set claims.tenant to "${tenantClaim}", or change the provider's tenant claim.`,
-				target: "claims.tenant"
-			});
-			const scope = context.config.claims.scope;
-			if (scope !== "tenant" && scope !== provider.tenantScope) findings.push({
-				severity: "info",
-				message: `claims.scope is "${scope}", but the tenant scope of ${label} is "${provider.tenantScope}". The tenant module's membership claims then use another scope than the provider's. Set claims.scope to "${provider.tenantScope}" (or "tenant").`,
-				target: "claims.scope"
-			});
-			const model = context.config.sql.modules.access?.model ?? "roles";
-			const unread = [...provider.suspension ? ["suspension"] : [], ...provider.roleSources && provider.roleSources.length > 0 ? ["roleSources"] : []];
-			if (model !== "provider" && unread.length > 0) findings.push({
-				severity: "info",
-				message: `${label} sets ${unread.join(" and ")}, but sql.modules.access.model is "${model}", so the SQL modules ignore ${unread.length > 1 ? "them" : "it"}. Set sql.modules.access.model to "provider" to use them, or set sql.modules.access.disabled yourself.`,
-				target: `authorization.${unread[0]}`
-			});
-			return findings;
-		}
-	},
-	{
-		code: "BS411",
-		severity: "error",
-		title: "The provider access model can't use the authorization provider",
-		description: "With `sql.modules.access.model: 'provider'`, the `access` module fills the provider's `idsWith` template for tenant checks and `isPlatform` for platform checks, at its tenant scope. Doctor reports a config without `authorization`, a tenant scope or id type the module can't render, a function those templates call that `authorization.requires` doesn't list, doesn't let `authenticated` execute or the database lacks, and every module permission key (from `modulePermissionKeys`) the provider doesn't mark `sqlComplete: true`, since its functions are trusted with role and scope only. It warns when neither `sql.modules.access.functions.canAssign` nor the provider's `canAssign` is set, because only the service role then assigns roles, and when an installed module calls a template the provider doesn't set (`idsWithFor` and `isPlatformFor` to check another user, `canAssignFor` to recheck an inviter).",
-		check: (context) => {
-			const mode = accessModule(context);
-			if (mode.kind === "off") return [];
-			if (mode.kind === "invalid") return [{
-				message: mode.problem,
-				target: "authorization"
-			}];
-			const provider = context.config.authorization;
-			const findings = [];
-			for (const requirement of accessRequirements(mode.access)) {
-				const problem = requirementProblem(context, provider, requirement, "the provider access model (can() and the SQL modules)");
-				if (problem) findings.push({
-					message: problem.message,
-					target: requirement.function
-				});
-			}
-			findings.push(...moduleKeyProblems(provider, modulePermissionKeys(context.config.sql.modules, context.config.sql.moduleNames)));
-			if ((context.config.sql.modules.access?.functions?.canAssign ?? provider.functions.canAssign) === void 0) findings.push({
-				severity: "warning",
-				message: `Neither sql.modules.access.functions.canAssign nor ${providerLabel(provider)} sets canAssign, so under the provider model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes. Use a provider that sets authorization.functions.canAssign, or set sql.modules.access.functions.canAssign.`,
-				target: "sql.modules.access.functions.canAssign"
-			});
-			findings.push(...missingTemplates(context, provider));
-			return findings;
-		}
-	}
-];
-//#endregion
-//#region src/cli/introspect/typegen.ts
-const TYPEGEN = "@supabase/postgrest-typegen";
-/** Why a command that reads or generates schema types stops without the peer. */
-const TYPEGEN_MISSING = `better-supabase needs the "${TYPEGEN}" package to read your schema and generate types. Install it: pnpm add -D ${TYPEGEN}@${TYPEGEN_VERSION}`;
-/** Thrown by every function here when the optional peer is not installed. */
-var TypegenMissingError = class extends Error {
-	constructor() {
-		super(TYPEGEN_MISSING);
-		this.name = "TypegenMissingError";
-	}
-};
-const missing = () => {
-	throw new TypegenMissingError();
-};
-/**
-* `/generation` is light and its functions are synchronous (`buildModel`
-* calls `tsTypeOf`), so it loads with this module, which the commands that
-* need it import on demand. The package root and `/introspection` build
-* their arktype schemas on import (about 90 ms), so they load when a command
-* reads or validates metadata, not for `--help`.
-*/
-const generation = await import("@supabase/postgrest-typegen/generation").catch(() => void 0);
-const loadGeneration = () => generation ?? missing();
-const metadataModule = () => import("@supabase/postgrest-typegen").catch(missing);
-const introspectionModule = () => import("@supabase/postgrest-typegen/introspection").catch(missing);
-/** Introspects `schemas`, keeping only the types they reference. */
-async function readGeneratorMetadata(db, schemas) {
-	const [metadata, positions] = await Promise.all([introspectionModule().then(({ introspect }) => introspect(db, { includedSchemas: [...schemas] })), db.query(argumentPositionsSql(schemas))]);
-	return pruneTypes(orderArgsByPosition(metadata, positions.rows), schemas);
-}
-const sqlLiteral = (value) => `'${value.replaceAll("'", "''")}'`;
-/**
-* The argument order postgrest-typegen loses: its catalog query aggregates
-* the arguments without an order, so two unnamed arguments (pgvector's
-* operators, citext casts) swap places between database resets.
-*/
-function argumentPositionsSql(schemas) {
-	return `select p.oid::int8 as id,
-  coalesce(p.proallargtypes, p.proargtypes::oid[])::int8[] as types,
-  p.proargnames as names
-from pg_catalog.pg_proc p
-join pg_catalog.pg_namespace n on n.oid = p.pronamespace
-where p.prokind = 'f'
-  and n.nspname = any (array[${schemas.map(sqlLiteral).join(", ") || "''"}]::text[])`;
-}
-/**
-* Puts every function's arguments back in declaration order, so the sort by
-* name that follows (stable) keeps unnamed arguments by position.
-*/
-function orderArgsByPosition(metadata, rows) {
-	const byId = new Map(rows.map((row) => [Number(row.id), row]));
-	return {
-		...metadata,
-		functions: metadata.functions.map((fn) => {
-			const row = byId.get(fn.id);
-			if (!row?.types || fn.args.length < 2) return fn;
-			const pending = [...fn.args];
-			const ordered = [];
-			row.types.forEach((type, index) => {
-				const name = row.names?.[index] ?? "";
-				const at = pending.findIndex((arg) => arg.type_id === Number(type) && arg.name === name);
-				if (at >= 0) ordered.push(...pending.splice(at, 1));
-			});
-			return {
-				...fn,
-				args: [...ordered, ...pending]
-			};
-		})
-	};
-}
-/** Postgres assigns oids below this to built-in objects; those are stable. */
-const FIRST_NORMAL_OID = 16384;
-/**
-* Replaces the oids of user objects with ids derived from their names and
-* zeroes size estimates, so a snapshot of the same schema is byte-identical
-* after `supabase db reset` or on another machine. Returns the id mapping
-* for data keyed by the old oids.
-*/
-function stabilizeMetadata(metadata) {
-	const ids = /* @__PURE__ */ new Map();
-	const assign = (base, entries) => {
-		[...entries].sort((a, b) => byCodePoint(a.key, b.key)).forEach((entry, index) => {
-			if (entry.id >= FIRST_NORMAL_OID) ids.set(entry.id, base + index);
-		});
-	};
-	assign(1e6, [
-		...metadata.tables,
-		...metadata.foreignTables,
-		...metadata.views,
-		...metadata.materializedViews
-	].map((entry) => ({
-		id: entry.id,
-		key: `${entry.schema}.${entry.name}`
-	})));
-	assign(2e6, metadata.types.map((entry) => ({
-		id: entry.id,
-		key: `${entry.schema}.${entry.name}`
-	})));
-	assign(3e6, metadata.functions.map((entry) => ({
-		id: entry.id,
-		key: `${entry.schema}.${entry.name}(${entry.identity_argument_types})`
-	})));
-	assign(4e6, metadata.schemas.map((entry) => ({
-		id: entry.id,
-		key: entry.name
-	})));
-	const map = (id) => ids.get(id) ?? id;
-	const mapNullable = (id) => id === null ? null : map(id);
-	const stable = {
-		...metadata,
-		schemas: metadata.schemas.map((entry) => ({
-			...entry,
-			id: map(entry.id)
-		})),
-		tables: metadata.tables.map((entry) => ({
-			...entry,
-			id: map(entry.id),
-			bytes: 0,
-			size: "0 bytes",
-			live_rows_estimate: 0,
-			dead_rows_estimate: 0
-		})),
-		foreignTables: metadata.foreignTables.map((entry) => ({
-			...entry,
-			id: map(entry.id)
-		})),
-		views: metadata.views.map((entry) => ({
-			...entry,
-			id: map(entry.id)
-		})),
-		materializedViews: metadata.materializedViews.map((entry) => ({
-			...entry,
-			id: map(entry.id)
-		})),
-		columns: metadata.columns.map((entry) => ({
-			...entry,
-			table_id: map(entry.table_id),
-			id: `${map(entry.table_id)}.${entry.ordinal_position}`
-		})),
-		primaryKeys: metadata.primaryKeys.map((entry) => ({
-			...entry,
-			table_id: map(entry.table_id)
-		})),
-		functions: metadata.functions.map((entry) => ({
-			...entry,
-			id: map(entry.id),
-			return_type_id: map(entry.return_type_id),
-			return_type_relation_id: mapNullable(entry.return_type_relation_id),
-			args: entry.args.map((arg) => ({
-				...arg,
-				type_id: map(arg.type_id)
-			}))
-		})),
-		types: metadata.types.map((entry) => ({
-			...entry,
-			id: map(entry.id),
-			type_relation_id: mapNullable(entry.type_relation_id),
-			attributes: entry.attributes.map((attribute) => ({
-				...attribute,
-				type_id: map(attribute.type_id)
-			}))
-		}))
-	};
-	return {
-		metadata: loadGeneration().sortGeneratorMetadata(stable),
-		ids
-	};
-}
-/** Validates metadata loaded from a snapshot file. */
-async function validateGeneratorMetadata(data) {
-	const { parseGeneratorMetadata } = await metadataModule();
-	return parseGeneratorMetadata(data);
-}
-/**
-* A `GeneratorMetadata` document `gen --metadata` refuses: not JSON, another
-* `GENERATOR_METADATA_VERSION`, or a shape the schema rejects. `gen` exits 65
-* for it, the code `@supabase/typegen` maps to `MetadataRejectedError`.
-*/
-var MetadataRejectedError = class extends Error {
-	/** The document's `version`, when it had one. */
-	version;
-	constructor(message, version) {
-		super(message);
-		this.name = "MetadataRejectedError";
-		this.version = version;
-	}
-};
-/**
-* Parses the JSON document an out-of-process generator reads on stdin,
-* checking its `version` against the `GENERATOR_METADATA_VERSION` this
-* release of `@supabase/postgrest-typegen` writes.
-*/
-async function parseMetadataDocument(text) {
-	const { GENERATOR_METADATA_VERSION, parseGeneratorMetadata } = await metadataModule();
-	let data;
-	try {
-		data = JSON.parse(text);
-	} catch (cause) {
-		throw new MetadataRejectedError(text.trim() === "" ? "The GeneratorMetadata document is empty." : `The GeneratorMetadata document is not JSON: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	const version = typeof data === "object" && data !== null && "version" in data ? data.version : void 0;
-	if (version !== GENERATOR_METADATA_VERSION) throw new MetadataRejectedError(version === void 0 ? `The document has no "version", so it is not GeneratorMetadata. better-supabase reads version ${GENERATOR_METADATA_VERSION}.` : `The document is GeneratorMetadata version ${JSON.stringify(version)}, and better-supabase reads version ${GENERATOR_METADATA_VERSION} (${TYPEGEN}@${TYPEGEN_VERSION}). Update better-supabase or the tool that wrote the document so both agree.`, version);
-	try {
-		return parseGeneratorMetadata(data);
-	} catch (cause) {
-		throw new MetadataRejectedError(cause instanceof Error ? cause.message : String(cause), version);
-	}
-}
-/** The JSON document out-of-process generators read. */
-async function serializeGenerator(metadata) {
-	const { serializeGeneratorMetadata } = await metadataModule();
-	return serializeGeneratorMetadata(loadGeneration().sortGeneratorMetadata(metadata));
-}
-/**
-* Keeps only what belongs to `schemas`, so the Database type matches
-* `supabase gen types --schema ...` for exactly those schemas.
-*/
-function restrictSchemas(metadata, schemas) {
-	const keep = new Set(schemas);
-	return {
-		...metadata,
-		schemas: metadata.schemas.filter((schema) => keep.has(schema.name)),
-		tables: metadata.tables.filter((table) => keep.has(table.schema)),
-		foreignTables: metadata.foreignTables.filter((table) => keep.has(table.schema)),
-		views: metadata.views.filter((view) => keep.has(view.schema)),
-		materializedViews: metadata.materializedViews.filter((view) => keep.has(view.schema)),
-		columns: metadata.columns.filter((column) => keep.has(column.schema)),
-		primaryKeys: metadata.primaryKeys.filter((key) => keep.has(key.schema)),
-		relationships: metadata.relationships.filter((relationship) => keep.has(relationship.schema)),
-		functions: metadata.functions.filter((fn) => keep.has(fn.schema))
-	};
-}
-let oxfmt;
-/** oxfmt is an optional peer, loaded on demand; `undefined` when it is not installed. */
-function loadOxfmt() {
-	oxfmt ??= import("oxfmt").catch(() => void 0);
-	return oxfmt;
-}
-/** Whether `database.types.ts` comes out formatted. */
-async function oxfmtInstalled() {
-	return await loadOxfmt() !== void 0;
-}
-/** Formats like `supabase gen types`, or returns `code` as it is without oxfmt. */
-async function formatTypes(code) {
-	const formatter = await loadOxfmt();
-	if (!formatter) return code;
-	const { code: formatted, errors } = await formatter.format("output.ts", code, {
-		semi: false,
-		printWidth: 80
-	});
-	if (errors.length > 0) throw new Error(`oxfmt failed to format database.types.ts: ${errors.map((error) => error.message).join("; ")}`);
-	return formatted;
-}
-/**
-* Renders `database.types.ts` as `supabase gen types` prints it when oxfmt is
-* installed, plus the `ComputedFields` keys Supabase CLI 2.119 doesn't write.
-*/
-function generateDatabaseTypes(metadata, options) {
-	const { generateTypescript, sortGeneratorMetadata } = loadGeneration();
-	return generateTypescript(sortGeneratorMetadata(restrictSchemas(metadata, options.schemas)), {
-		postgrestVersion: options.postgrestVersion,
-		detectOneToOneRelationships: true,
-		format: formatTypes
-	});
-}
-/**
-* TypeScript type for a column or argument, resolved exactly like the
-* `Database` type does (domains, composites, enums in other schemas).
-*/
-function tsTypeOf(metadata, schema, format, typeSchema) {
-	const owner = metadata.schemas.find((entry) => entry.name === schema) ?? {
-		id: 0,
-		name: schema,
-		owner: ""
-	};
-	return loadGeneration().pgTypeToTsType(owner, format, {
-		types: metadata.types,
-		schemas: metadata.schemas,
-		tables: metadata.tables,
-		views: metadata.views,
-		foreignTables: metadata.foreignTables,
-		materializedViews: metadata.materializedViews
-	}, typeSchema);
-}
-/**
-* `introspect()` returns every type in the database (hundreds of built-ins).
-* Keep the ones in the read schemas and those referenced by columns,
-* functions and composite attributes; built-in scalars resolve by name.
-*/
-function pruneTypes(metadata, schemas) {
-	const byId = new Map(metadata.types.map((type) => [type.id, type]));
-	const byName = new Map(metadata.types.map((type) => [`${type.schema}.${type.name}`, type]));
-	const keep = /* @__PURE__ */ new Set();
-	const visit = (id) => {
-		if (id === null || id === void 0 || keep.has(id)) return;
-		const type = byId.get(id);
-		if (!type) return;
-		keep.add(id);
-		for (const attribute of type.attributes) visit(attribute.type_id);
-	};
-	for (const type of metadata.types) if (schemas.includes(type.schema)) visit(type.id);
-	for (const column of metadata.columns) {
-		visit(byName.get(`${column.type_schema}.${column.format}`)?.id);
-		visit(byName.get(`${column.type_schema}.${column.format.replace(/^_/, "")}`)?.id);
-	}
-	for (const fn of metadata.functions) {
-		visit(fn.return_type_id);
-		for (const arg of fn.args) visit(arg.type_id);
-	}
-	return {
-		...metadata,
-		types: metadata.types.filter((type) => keep.has(type.id))
-	};
-}
-//#endregion
-//#region src/cli/gen/shared.ts
-const q = (value) => JSON.stringify(value);
-/** A property key: bare when it is a valid identifier, quoted otherwise. */
-function prop(name) {
-	return /^[A-Za-z_$][\w$]*$/.test(name) ? name : q(name);
-}
-function nullable(type, isNullable) {
-	return isNullable ? `${type} | null` : type;
-}
-/** `T[]`, parenthesized when `T` is a union or other compound type. */
-function arrayOf(type) {
-	return /^[\w.$]+$/.test(type) ? `${type}[]` : `(${type})[]`;
-}
-function indent(lines, depth) {
-	const pad = "  ".repeat(depth);
-	return lines.flatMap((line) => line.split("\n")).map((line) => line === "" ? line : pad + line);
-}
-/** `name: {` + indented children + `};`, or an inline empty type. */
-function block(name, children, empty = "{ [_ in never]: never }") {
-	if (children.length === 0) return [`${name}: ${empty};`];
-	return [
-		`${name}: {`,
-		...indent(children, 1),
-		"};"
-	];
-}
-function sameColumns(left, right) {
-	return left.length === right.length && left.every((column) => right.includes(column));
-}
-function singular(name) {
-	if (name.endsWith("ies")) return `${name.slice(0, -3)}y`;
-	if (name.endsWith("sses")) return name.slice(0, -2);
-	if (name.endsWith("s") && !name.endsWith("ss")) return name.slice(0, -1);
-	return name;
-}
-function pascal(name) {
-	return name.replaceAll(/(^|[_-]+)([a-z0-9])/g, (_, __, char) => char.toUpperCase()).replace(/^[a-z]/, (char) => char.toUpperCase());
-}
-/** A valid TypeScript identifier: other characters become `_`, a leading digit gets one. */
-function identifier(name) {
-	const safe = name.replaceAll(/[^\w$]/g, "_");
-	return /^\d/.test(safe) ? `_${safe}` : safe;
-}
-/**
-* The config entry for a database object, keyed `schema.name` or `name`.
-* The qualified key wins.
-*/
-function configFor(entries, schema, name) {
-	return entries[`${schema}.${name}`] ?? entries[name];
-}
-function isJsonUdt(udt) {
-	return udt === "json" || udt === "jsonb";
-}
-const CHECK_ANY = /^CHECK \(\(\(?"?(\w+)"?\)?(?:::\w+)? = ANY \(\(?ARRAY\[(.+)\]\)?(?:::\w+\[\])?\)\)\)$/;
-const CHECK_OR = /^CHECK \(\((.+)\)\)$/;
-const OR_TERM = /^\(?"?(\w+)"?\)?(?:::\w+)? = '((?:[^']|'')*)'(?:::\w+)?\)?$/;
-const LITERAL = /'((?:[^']|'')*)'(?:::[\w ]+)?/g;
-/**
-* Extracts `column in ('a', 'b')` CHECK constraints, which Postgres stores as
-* `CHECK ((col = ANY (ARRAY['a'::text, 'b'::text])))` or an OR chain.
-*/
-function parseCheckUnion(definition) {
-	const any = CHECK_ANY.exec(definition);
-	if (any?.[1] && any[2]) {
-		const values = [...any[2].matchAll(LITERAL)].map((match) => (match[1] ?? "").replaceAll("''", "'"));
-		return values.length > 0 ? {
-			column: any[1],
-			values
-		} : void 0;
-	}
-	const chain = CHECK_OR.exec(definition);
-	if (chain?.[1]) {
-		const terms = chain[1].split(/\) OR \(|\s+OR\s+/);
-		let column;
-		const values = [];
-		for (const term of terms) {
-			const match = OR_TERM.exec(term.trim());
-			if (!match?.[1]) return void 0;
-			if (column && column !== match[1]) return void 0;
-			column = match[1];
-			values.push((match[2] ?? "").replaceAll("''", "'"));
-		}
-		return column && values.length > 1 ? {
-			column,
-			values
-		} : void 0;
-	}
-}
-/** The text inside one pair of parentheses that wraps all of `text`, if any. */
-function unwrap(text) {
-	let current = text.trim();
-	while (current.startsWith("(") && current.endsWith(")")) {
-		let depth = 0;
-		let wraps = true;
-		for (let index = 0; index < current.length; index++) {
-			const char = current[index];
-			if (char === "(") depth++;
-			else if (char === ")") depth--;
-			if (depth === 0 && index < current.length - 1) {
-				wraps = false;
-				break;
-			}
-		}
-		if (!wraps) break;
-		current = current.slice(1, -1).trim();
-	}
-	return current;
-}
-/** Splits `text` on a keyword outside parentheses and quotes. */
-function splitTopLevel(text, keyword) {
-	const parts = [];
-	let depth = 0;
-	let quote;
-	let start = 0;
-	const separator = ` ${keyword} `;
-	for (let index = 0; index < text.length; index++) {
-		const char = text[index];
-		if (quote) {
-			if (char === quote) quote = void 0;
-			continue;
-		}
-		if (char === "'" || char === "\"") quote = char;
-		else if (char === "(") depth++;
-		else if (char === ")") depth--;
-		else if (depth === 0 && text.slice(index, index + separator.length).toUpperCase() === separator) {
-			parts.push(text.slice(start, index));
-			start = index + separator.length;
-			index += separator.length - 1;
-		}
-	}
-	parts.push(text.slice(start));
-	return parts.map((part) => part.trim());
-}
-const IS_NOT_NULL = /^(?:"((?:[^"]|"")+)"|([\w$]+)) IS NOT NULL$/i;
-/**
-* Columns a CHECK constraint makes not null: `CHECK ((slug IS NOT NULL))` and
-* the `IS NOT NULL` terms of a top-level `AND`. A term under `OR`, `NOT` or
-* any other expression narrows nothing, and neither does a `NOT VALID` one.
-*/
-function parseCheckNotNull(definition) {
-	const text = definition.trim();
-	if (/\bNOT VALID$/i.test(text)) return [];
-	const body = /^CHECK\s*(.*)$/is.exec(text)?.[1];
-	if (!body) return [];
-	const expression = unwrap(body);
-	if (splitTopLevel(expression, "OR").length > 1) return [];
-	return splitTopLevel(expression, "AND").flatMap((term) => {
-		const match = IS_NOT_NULL.exec(unwrap(term));
-		if (!match) return [];
-		return [match[1]?.replaceAll("\"\"", "\"") ?? match[2] ?? ""];
-	});
-}
-//#endregion
-//#region src/cli/gen/model.ts
-const SOFT_DELETE_UDTS = /* @__PURE__ */ new Set(["timestamptz", "timestamp"]);
-const applyCasing = (name, casing) => casing === "camel" ? toCamel(name) : name;
-/** The overloads of each function name, in model order. */
-function functionGroups(functions) {
-	const groups = /* @__PURE__ */ new Map();
-	for (const fn of functions) {
-		const group = groups.get(fn.key);
-		if (group) group.push(fn);
-		else groups.set(fn.key, [fn]);
-	}
-	return groups;
-}
-function signatureOf(fn) {
-	const { name: _name, schema: _schema, ...signature } = fn.meta;
-	return {
-		...signature,
-		args: signature.args.map((arg, index) => fn.args[index]?.optional ? {
-			...arg,
-			optional: true
-		} : arg)
-	};
-}
-function tableKey(table, casing, schemas) {
-	const base = applyCasing(table.name, casing);
-	if (schemas.length === 1 || table.schema === "public") return base;
-	return applyCasing(`${table.schema}_${table.name}`, casing);
-}
-const CODEC_TYPE = {
-	instant: "Temporal.Instant",
-	plainDateTime: "Temporal.PlainDateTime",
-	bigint: "bigint",
-	string: "string"
-};
-function codecFor(udt, config) {
-	const { codecs } = config;
-	if (codecs.timestamptz === "instant") {
-		if (udt === "timestamptz") return "instant";
-		if (udt === "timestamp") return "plainDateTime";
-	}
-	if (udt === "int8" && codecs.int8 !== "number") return codecs.int8;
-	if (udt === "numeric" && codecs.numeric === "string") return "string";
-}
-const TEXT_UDTS = /* @__PURE__ */ new Set([
-	"text",
-	"varchar",
-	"bpchar"
-]);
-/** `config.storagePaths` resolved to bucket ids, with a check that every key is used. */
-function storagePathsOf(config) {
-	const bucketId = (name) => {
-		const bucket = config.buckets[name];
-		if (!bucket) return name;
-		return bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
-	};
-	const unused = new Set(Object.keys(config.storagePaths));
-	return {
-		lookup(schema, table, column, udt) {
-			const key = [`${schema}.${table}.${column}`, `${table}.${column}`].find((candidate) => candidate in config.storagePaths);
-			if (key === void 0) return;
-			unused.delete(key);
-			if (!TEXT_UDTS.has(udt)) throw new TypeError(`storagePaths["${key}"]: ${schema}.${table}.${column} is ${udt}, not a text column`);
-			return bucketId(config.storagePaths[key]);
-		},
-		assertUsed() {
-			const [first] = unused;
-			if (first !== void 0) throw new TypeError(`storagePaths["${first}"]: no such column. Use \`table.column\` or \`schema.table.column\` (database names) in \`schemas\`.`);
-		}
-	};
-}
-function enumType(values) {
-	return values.map((value) => JSON.stringify(value)).join(" | ");
-}
-/** Builds the codegen model from a snapshot and config. */
-function buildModel(snapshot, config) {
-	const catalog = toCatalog(snapshot);
-	const introspection = restrictSchemas(snapshot.generator, config.schemas);
-	const tsType = (schema, format, typeSchema) => tsTypeOf(introspection, schema, format, typeSchema).replaceAll(/\(([\w.$]+)\)\[\]/g, "$1[]");
-	const enumsByName = /* @__PURE__ */ new Map();
-	for (const entry of catalog.enums) enumsByName.set(`${entry.schema}.${entry.name}`, entry.values);
-	const jsonImports = /* @__PURE__ */ new Map();
-	const unusedJson = new Set(Object.keys(config.json));
-	const jsonTypeFor = (schema, table, column) => {
-		const key = [`${schema}.${table}.${column}`, `${table}.${column}`].find((candidate) => candidate in config.json);
-		const override = key === void 0 ? void 0 : config.json[key];
-		if (key === void 0 || !override) return void 0;
-		unusedJson.delete(key);
-		if ("type" in override) return override.type;
-		const [from, name] = override.import.split("#");
-		if (!from || !name) throw new TypeError(`json["${key}"].import must look like "./path.ts#TypeName"`);
-		jsonImports.set(name, {
-			name,
-			from
-		});
-		return name;
-	};
-	const optionsOf = (table) => configFor(config.tables, table.schema, table.name);
-	const storagePaths = storagePathsOf(config);
-	const included = catalog.tables.filter((table) => config.schemas.includes(table.schema) && !optionsOf(table)?.exclude);
-	const keyOf = /* @__PURE__ */ new Map();
-	const ownerOf = /* @__PURE__ */ new Map();
-	for (const table of included) {
-		const id = `${table.schema}.${table.name}`;
-		const key = tableKey(table, config.casing, config.schemas);
-		const other = ownerOf.get(key);
-		if (other !== void 0) throw new TypeError(`${other} and ${id} both generate the model key "${key}". Exclude one with \`tables["${id}"].exclude\`, or rename one of the tables.`);
-		ownerOf.set(key, id);
-		keyOf.set(id, key);
-	}
-	const tables = included.map((table) => {
-		const casing = optionsOf(table)?.casing ?? config.casing;
-		const checks = /* @__PURE__ */ new Map();
-		const checkedNotNull = /* @__PURE__ */ new Set();
-		for (const check of table.checks) {
-			const union = parseCheckUnion(check.definition);
-			if (union) checks.set(union.column, union.values);
-			for (const column of parseCheckNotNull(check.definition)) checkedNotNull.add(column);
-		}
-		const beforeInsert = table.triggers.some((trigger) => trigger.timing === "before" && trigger.level === "row" && trigger.events.includes("insert"));
-		const insertOptional = new Set(optionsOf(table)?.insertOptional ?? []);
-		for (const name of insertOptional) if (!table.columns.some((column) => column.name === name)) throw new TypeError(`tables.${table.name}.insertOptional: "${name}" is not a column of ${table.schema}.${table.name}`);
-		const columns = table.columns.map((column) => {
-			const values = (column.isEnum ? enumsByName.get(`${column.typeSchema}.${column.udt}`) : void 0) ?? checks.get(column.name);
-			const json = isJsonUdt(column.udt);
-			const override = json ? jsonTypeFor(table.schema, table.name, column.name) : void 0;
-			const storage = storagePaths.lookup(table.schema, table.name, column.name, column.udt);
-			const codec = override || values || storage ? void 0 : codecFor(column.udt, config);
-			const base = override ?? (values ? enumType(values) : storage ? `StoragePath<${JSON.stringify(storage)}>` : codec ? CODEC_TYPE[codec] : void 0);
-			const columnType = base === void 0 ? tsType(table.schema, column.format, column.typeSchema) : column.isArray ? arrayOf(base) : base;
-			const readonly = column.generated || column.identity === "always";
-			const narrowed = column.nullable && checkedNotNull.has(column.name);
-			const nullable = column.nullable && !narrowed;
-			const filled = column.hasDefault || insertOptional.has(column.name) || narrowed && beforeInsert;
-			const insertable = !readonly && table.insertable && (table.kind !== "view" || column.updatable);
-			const updatable = !readonly && table.updatable && column.updatable;
-			return {
-				app: applyCasing(column.name, casing),
-				db: column.name,
-				snapshot: column,
-				tsType: columnType,
-				nullable,
-				filled,
-				optional: nullable || filled || readonly,
-				readonly,
-				values,
-				json,
-				codec,
-				storage,
-				insertable,
-				updatable
-			};
-		});
-		const byApp = /* @__PURE__ */ new Map();
-		for (const column of columns) {
-			const other = byApp.get(column.app);
-			if (other !== void 0) throw new TypeError(`${table.schema}.${table.name}: columns "${other}" and "${column.db}" both become "${column.app}". Rename one, or set \`tables["${table.schema}.${table.name}"].casing: "snake"\`.`);
-			byApp.set(column.app, column.db);
-		}
-		return {
-			table,
-			casing,
-			columns,
-			byDb: new Map(columns.map((column) => [column.db, column]))
-		};
-	});
-	storagePaths.assertUsed();
-	const schemasOf = /* @__PURE__ */ new Map();
-	for (const table of catalog.tables) {
-		if (!config.schemas.includes(table.schema)) continue;
-		schemasOf.set(table.name, [...schemasOf.get(table.name) ?? [], table.schema]);
-	}
-	const known = (key) => {
-		const dot = key.indexOf(".");
-		if (dot === -1) return schemasOf.has(key);
-		return schemasOf.get(key.slice(dot + 1))?.includes(key.slice(0, dot)) ?? false;
-	};
-	const warnings = [
-		...Object.keys(config.tables).filter((name) => !known(name)).map((name) => `tables["${name}"]: no table by that name in ${config.schemas.join(", ")}, so the entry does nothing.`),
-		...Object.keys(config.tables).flatMap((name) => {
-			const shared = (schemasOf.get(name) ?? []).filter((schema) => !(`${schema}.${name}` in config.tables)).map((schema) => `${schema}.${name}`);
-			return shared.length > 1 ? [`tables["${name}"]: ${shared.join(" and ")} share the name, so the entry applies to each. Key it \`schema.table\` to pick one.`] : [];
-		}),
-		...[...unusedJson].map((key) => `json["${key}"]: no json or jsonb column by that name, so the type is not used. Keys are \`table.column\` or \`schema.table.column\` with database names.`)
-	];
-	const byKey = /* @__PURE__ */ new Map();
-	for (const entry of tables) byKey.set(`${entry.table.schema}.${entry.table.name}`, entry);
-	const appName = (schema, table, column) => {
-		return byKey.get(`${schema}.${table}`)?.byDb.get(column)?.app ?? column;
-	};
-	const relations = /* @__PURE__ */ new Map();
-	const push = (tableId, relation) => {
-		const list = relations.get(tableId);
-		if (list) list.push(relation);
-		else relations.set(tableId, [relation]);
-	};
-	for (const { table, casing, byDb: own } of tables) {
-		const sourceId = `${table.schema}.${table.name}`;
-		for (const fk of table.foreignKeys) {
-			const targetId = `${fk.refSchema}.${fk.refTable}`;
-			const target = byKey.get(targetId);
-			if (!target) continue;
-			const targetKey = keyOf.get(targetId) ?? fk.refTable;
-			const sourceColumns = fk.columns.map((column) => appName(table.schema, table.name, column));
-			const targetColumns = fk.refColumns.map((column) => appName(fk.refSchema, fk.refTable, column));
-			const nullable = config.relations.nullableUnderRls && target.table.rls || fk.columns.some((column) => own.get(column)?.nullable ?? true);
-			const onDelete = fk.onDelete === "cascade" || fk.onDelete === "set null" || fk.onDelete === "set default" ? { onDelete: fk.onDelete } : {};
-			const naming = namingColumns(fk.columns, fk.refColumns);
-			const [only] = naming;
-			const forwardBase = naming.length === 1 && only?.endsWith("_id") ? only.slice(0, -3) : singular(fk.refTable);
-			push(sourceId, {
-				name: applyCasing(forwardBase, casing),
-				base: forwardBase,
-				fkColumns: fk.columns,
-				refColumns: fk.refColumns,
-				meta: {
-					table: targetKey,
-					kind: "one",
-					nullable,
-					foreignKey: fk.name,
-					columns: sourceColumns,
-					references: targetColumns,
-					direction: "forward",
-					...onDelete
-				}
-			});
-			const unique = fk.oneToOne || sameColumns(table.primaryKey, fk.columns) || table.uniques.some((key) => sameColumns(key.columns, fk.columns));
-			const reverseBase = unique ? singular(table.name) : table.name;
-			push(targetId, {
-				name: applyCasing(reverseBase, target.casing),
-				base: reverseBase,
-				fkColumns: fk.columns,
-				refColumns: fk.refColumns,
-				meta: {
-					table: keyOf.get(sourceId) ?? table.name,
-					kind: unique ? "one" : "many",
-					nullable: true,
-					foreignKey: fk.name,
-					columns: targetColumns,
-					references: sourceColumns,
-					direction: "reverse",
-					...onDelete
-				}
-			});
-		}
-	}
-	const flagsConfig = config.plugins;
-	const tableModels = tables.map(({ table, casing, columns, byDb }) => {
-		const id = `${table.schema}.${table.name}`;
-		const renames = optionsOf(table)?.relations ?? {};
-		const columnNames = new Set(columns.map((column) => column.app));
-		const list = dedupeRelations(relations.get(id) ?? [], columnNames, casing).map((relation) => ({
-			...relation,
-			name: renames[relation.name] ?? relation.name
-		}));
-		const has = (db) => byDb.get(db)?.app;
-		const flags = {};
-		if (flagsConfig.softDelete) {
-			const db = flagsConfig.softDelete.column;
-			const column = byDb.get(db);
-			if (column) {
-				const udt = column.snapshot.udt;
-				if (column.snapshot.isArray || !SOFT_DELETE_UDTS.has(udt)) throw new TypeError(`plugins.softDelete.column: ${table.schema}.${table.name}.${db} is ${udt}, but softDelete() writes a timestamp. Use timestamptz or timestamp.`);
-				flags.softDelete = column.app;
-			}
-		}
-		if (flagsConfig.timestamps) {
-			const createdAt = has(flagsConfig.timestamps.createdAt);
-			const updatedAt = has(flagsConfig.timestamps.updatedAt);
-			if (createdAt || updatedAt) flags.timestamps = {
-				...createdAt ? { createdAt } : {},
-				...updatedAt ? { updatedAt } : {}
-			};
-		}
-		if (flagsConfig.tenant) {
-			const column = has(flagsConfig.tenant.column);
-			if (column) flags.tenant = column;
-		}
-		if (flagsConfig.actor) {
-			const createdBy = has(flagsConfig.actor.createdBy);
-			const updatedBy = has(flagsConfig.actor.updatedBy);
-			const impersonatedBy = has(flagsConfig.actor.impersonatedBy);
-			if (createdBy || updatedBy || impersonatedBy) flags.actor = {
-				...createdBy ? { createdBy } : {},
-				...updatedBy ? { updatedBy } : {},
-				...impersonatedBy ? { impersonatedBy } : {}
-			};
-		}
-		const key = keyOf.get(id) ?? table.name;
-		const columnMeta = {};
-		for (const column of columns) {
-			const meta = {
-				db: column.db,
-				type: column.snapshot.udt,
-				nullable: column.nullable,
-				hasDefault: column.filled
-			};
-			if (column.readonly) meta.generated = true;
-			if (column.snapshot.identity) meta.identity = column.snapshot.identity;
-			if (!column.readonly && !column.insertable) meta.insertable = false;
-			if (!column.readonly && !column.updatable) meta.updatable = false;
-			if (column.snapshot.isArray) meta.array = true;
-			if (column.json) meta.json = true;
-			if (column.values) meta.enum = column.values;
-			if (column.codec) meta.codec = column.codec;
-			if (column.storage) meta.storage = column.storage;
-			if (config.sensitive.includes(`${table.name}.${column.db}`) || config.sensitive.includes(`${table.schema}.${table.name}.${column.db}`)) meta.sensitive = true;
-			columnMeta[column.app] = meta;
-		}
-		const app = (db) => byDb.get(db)?.app ?? db;
-		const uniqueKeys = {};
-		for (const unique of table.uniques) uniqueKeys[unique.name] = unique.columns.map(app);
-		const relationMeta = {};
-		for (const relation of list) relationMeta[relation.name] = relation.meta;
-		return {
-			key,
-			snapshot: table,
-			casing,
-			columns,
-			relations: list,
-			meta: {
-				key,
-				name: table.name,
-				schema: table.schema,
-				kind: table.kind,
-				columns: columnMeta,
-				primaryKey: table.primaryKey.map(app),
-				uniqueKeys,
-				relations: relationMeta,
-				flags
-			}
-		};
-	});
-	const includedEnums = catalog.enums.filter((entry) => config.schemas.includes(entry.schema));
-	const enumNameCount = /* @__PURE__ */ new Map();
-	for (const entry of includedEnums) enumNameCount.set(entry.name, (enumNameCount.get(entry.name) ?? 0) + 1);
-	const enums = includedEnums.map((entry) => {
-		const key = entry.schema !== "public" && (enumNameCount.get(entry.name) ?? 0) > 1 ? `${entry.schema}_${entry.name}` : entry.name;
-		return {
-			schema: entry.schema,
-			name: entry.name,
-			key,
-			constant: identifier(`${toCamel(key)}Values`),
-			typeName: identifier(pascal(key)),
-			values: entry.values
-		};
-	});
-	const tablesByName = new Map(tableModels.map((table) => [`${table.snapshot.schema}.${table.snapshot.name}`, table]));
-	const callable = catalog.functions.filter((fn) => config.schemas.includes(fn.schema)).filter((fn) => fn.returns !== "trigger" && fn.returns !== "event_trigger").filter((fn) => !fn.args.some((arg) => arg.udt === "internal"));
-	const ownerSchema = /* @__PURE__ */ new Map();
-	for (const schema of config.schemas) for (const fn of callable) if (fn.schema === schema && !ownerSchema.has(fn.name)) ownerSchema.set(fn.name, schema);
-	const shadowed = /* @__PURE__ */ new Set();
-	const functions = callable.filter((fn) => {
-		if (ownerSchema.get(fn.name) === fn.schema) return true;
-		shadowed.add(`${fn.schema}.${fn.name}`);
-		return false;
-	}).map((fn) => {
-		const typeOf = (format, typeSchema) => {
-			const isArray = format.startsWith("_");
-			const values = enumsByName.get(`${typeSchema ?? fn.schema}.${isArray ? format.slice(1) : format}`);
-			if (values) return isArray ? arrayOf(enumType(values)) : enumType(values);
-			return tsType(fn.schema, format, typeSchema);
-		};
-		const notNull = configFor(config.functions, fn.schema, fn.name)?.notNull;
-		const notNullColumns = new Set(Array.isArray(notNull) ? notNull : []);
-		if (Array.isArray(notNull)) {
-			for (const name of notNullColumns) if (!fn.returnsTable?.some((column) => column.name === name)) throw new TypeError(`functions.${fn.name}.notNull: "${name}" is not a column the function returns`);
-		}
-		const orNull = (type, column) => notNull === true || column !== void 0 && notNullColumns.has(column) || type === "undefined" || type === "Json" || type === "unknown" ? type : `${type} | null`;
-		let returns;
-		let result;
-		const rowTable = fn.returnsRelation ? tablesByName.get(fn.returnsRelation) : void 0;
-		if (fn.returnsTable) {
-			const columns = fn.returnsTable.map((column) => {
-				const codec = codecFor(column.udt, config);
-				return {
-					db: column.name,
-					app: applyCasing(column.name, config.casing),
-					codec,
-					tsType: codec ? CODEC_TYPE[codec] : typeOf(column.udt, column.typeSchema)
-				};
-			});
-			returns = `{ ${columns.map((column) => `${JSON.stringify(column.app)}: ${orNull(column.tsType, column.db)}`).join("; ")} }[]`;
-			if (columns.some((column) => column.codec !== void 0 || column.app !== column.db)) result = { columns: columns.map(({ db, app, codec }) => ({
-				db,
-				...app === db ? {} : { name: app },
-				...codec ? { codec } : {}
-			})) };
-		} else if (rowTable) {
-			returns = `Models[${JSON.stringify(rowTable.key)}]['Row']`;
-			returns = fn.returnsSet ? arrayOf(returns) : orNull(returns);
-			if (rowTable.columns.some((column) => column.codec !== void 0 || column.app !== column.db)) result = { table: rowTable.key };
-		} else {
-			returns = orNull(typeOf(fn.returns, fn.returnsSchema));
-			if (fn.returnsSet) returns = arrayOf(returns);
-		}
-		return {
-			key: fn.name,
-			meta: {
-				name: fn.name,
-				schema: fn.schema,
-				args: fn.args.map((arg) => ({
-					name: arg.name,
-					type: arg.udt
-				})),
-				returns: fn.returns,
-				returnsSet: fn.returnsSet,
-				volatility: fn.volatility,
-				...result ? { result } : {}
-			},
-			args: fn.args.map((arg) => ({
-				name: arg.name,
-				tsType: typeOf(arg.isArray ? `_${arg.udt}` : arg.udt, arg.typeSchema),
-				optional: arg.hasDefault
-			})),
-			returns
-		};
-	});
-	for (const name of Object.keys(config.functions)) if (!functions.some((fn) => fn.key === name || `${fn.meta.schema}.${fn.key}` === name)) throw new TypeError(`functions.${name}: no function "${name}" in ${config.schemas.join(", ")}`);
-	for (const id of shadowed) {
-		const name = id.slice(id.indexOf(".") + 1);
-		warnings.push(`${id}: ${ownerSchema.get(name) ?? ""}.${name} has the same name and comes first in \`schemas\`, so ${id} gets no \`$rpc\` types.`);
-	}
-	const tablesMeta = {};
-	for (const table of tableModels) tablesMeta[table.key] = table.meta;
-	const enumsMeta = {};
-	for (const entry of enums) enumsMeta[entry.key] = entry.values;
-	const functionsMeta = {};
-	for (const [key, group] of functionGroups(functions)) {
-		const [first] = group;
-		if (!first) continue;
-		functionsMeta[key] = group.length === 1 ? first.meta : {
-			...first.meta,
-			overloads: group.map(signatureOf)
-		};
-	}
-	const claimOverrides = {};
-	for (const key of Object.keys(DEFAULT_CLAIMS)) if (config.claims[key] !== DEFAULT_CLAIMS[key]) claimOverrides[key] = config.claims[key];
-	const tenantClaim = config.claims.tenant === DEFAULT_CLAIMS.tenant ? void 0 : tenantClaimPaths(config.claims.tenant);
-	const meta = {
-		version: 1,
-		casing: config.casing,
-		tables: tablesMeta,
-		enums: enumsMeta,
-		functions: functionsMeta,
-		...Object.keys(config.buckets).length > 0 ? { buckets: Object.fromEntries(Object.entries(config.buckets).map(([name, bucket]) => [name, {
-			id: bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`),
-			public: bucket.public ?? false,
-			path: bucket.path,
-			...bucket.policy ? { policy: typeof bucket.policy === "string" ? bucket.policy : resolveProviderSql(`buckets.${name}`, bucket.policy, config.authorization?.functions) } : {},
-			...bucket.policy === "tenant" && tenantClaim ? { tenant: { claim: tenantClaim } } : {},
-			...bucket.fileSizeLimit ? { fileSizeLimit: bucket.fileSizeLimit } : {},
-			...bucket.allowedMimeTypes ? { allowedMimeTypes: bucket.allowedMimeTypes } : {},
-			...bucket.versioning ? { versioning: true } : {},
-			...bucket.lifecycle ? { lifecycle: bucket.lifecycle } : {}
-		}])) } : {},
-		...Object.keys(config.topics).length > 0 ? { topics: config.topics } : {},
-		...config.realtime.tables.length > 0 ? { realtime: realtimeMeta(config.realtime.tables, config.realtime.users, tableModels) } : {},
-		...Object.keys(claimOverrides).length > 0 ? { claims: claimOverrides } : {}
-	};
-	return {
-		tables: tableModels,
-		enums,
-		functions,
-		jsonImports: [...jsonImports.values()],
-		meta,
-		config,
-		catalog,
-		introspection,
-		warnings
-	};
-}
-function deepFreeze(value) {
-	if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
-		Object.freeze(value);
-		for (const entry of Object.values(value)) deepFreeze(entry);
-	}
-	return value;
-}
-/** The public, frozen view of the model that generators receive. */
-function generatorModel(model) {
-	return deepFreeze({
-		tables: model.tables.map((table) => ({
-			key: table.key,
-			schema: table.snapshot.schema,
-			name: table.snapshot.name,
-			casing: table.casing,
-			columns: table.columns.map((column) => ({
-				app: column.app,
-				db: column.db,
-				tsType: column.tsType,
-				nullable: column.nullable,
-				optional: column.optional,
-				readonly: column.readonly,
-				values: column.values === void 0 ? void 0 : [...column.values],
-				json: column.json
-			}))
-		})),
-		enums: model.enums.map((entry) => ({
-			schema: entry.schema,
-			name: entry.name,
-			values: [...entry.values]
-		}))
-	});
-}
-/**
-* The columns that name a relation. A composite key that repeats a column on
-* both sides, such as `(customer_id, organization_id)` referencing
-* `(id, organization_id)` to keep rows in one tenant, is named by the rest.
-*/
-function namingColumns(columns, references) {
-	const own = columns.filter((column, index) => column !== references[index]);
-	return own.length > 0 ? own : columns;
-}
-/**
-* Makes relation names unique per table and distinct from column names:
-* two FKs to the same table become `customersByPrimaryContact`-style names.
-* When those still collide, the names use every column of the key
-* (`locationsByCustomerOrganization`), then the constraint name, and only
-* then a trailing `_`.
-*/
-function dedupeRelations(list, columns, casing) {
-	const suffixed = (relation, suffix) => applyCasing(`${relation.base}_by_${suffix}`, casing);
-	const keyColumns = (relation, all) => (all ? relation.fkColumns : namingColumns(relation.fkColumns, relation.refColumns)).map((column) => column.replace(/_?[iI]d$/, "")).join("_");
-	const repeated = (names) => {
-		const seen = /* @__PURE__ */ new Set();
-		const twice = /* @__PURE__ */ new Set();
-		for (const name of names) (seen.has(name) ? twice : seen).add(name);
-		return twice;
-	};
-	const plain = repeated(list.map((relation) => relation.name));
-	const names = [(relation) => suffixed(relation, keyColumns(relation, true)), (relation) => suffixed(relation, relation.meta.foreignKey)].reduce((current, step) => {
-		const clash = repeated(current);
-		return list.map((relation, index) => {
-			const name = current[index] ?? relation.name;
-			return clash.has(name) || columns.has(name) ? step(relation) : name;
-		});
-	}, list.map((relation) => plain.has(relation.name) || columns.has(relation.name) ? suffixed(relation, keyColumns(relation, false)) : relation.name));
-	const used = /* @__PURE__ */ new Set();
-	return list.map((relation, index) => {
-		let name = names[index] ?? relation.name;
-		while (used.has(name) || columns.has(name)) name = `${name}_`;
-		used.add(name);
-		return {
-			...relation,
-			name
-		};
-	});
-}
-function realtimeMeta(names, users, tables) {
-	const out = {};
-	for (const name of names) {
-		const table = tables.find((candidate) => candidate.meta.name === name || `${candidate.meta.schema}.${candidate.meta.name}` === name);
-		if (!table) throw new Error(`realtime.tables: unknown table "${name}". Check the name and \`schemas\`.`);
-		const owner = users[name];
-		if (owner !== void 0) {
-			const user = Object.entries(table.meta.columns).find(([, column]) => column.db === owner)?.[0];
-			if (user === void 0) throw new Error(`realtime.users: "${name}" has no column "${owner}".`);
-			out[table.key] = { user };
-			continue;
-		}
-		const tenant = table.meta.flags.tenant;
-		out[table.key] = tenant ? { tenant } : {};
-	}
-	return out;
-}
-//#endregion
-//#region src/cli/gen/emit.ts
-const GENERATED_HEADER = "// @generated by better-supabase gen. Do not edit; run `better-supabase gen` instead.";
-function rowEntries(columns, name) {
-	return columns.map((column) => `${prop(column[name])}: ${nullable(column.tsType, column.nullable)};`);
-}
-function insertEntries(columns, name) {
-	return columns.map((column) => {
-		if (!column.insertable) return `${prop(column[name])}?: never;`;
-		const optional = column.optional ? "?" : "";
-		return `${prop(column[name])}${optional}: ${nullable(column.tsType, column.nullable)};`;
-	});
-}
-function updateEntries(columns, name) {
-	return columns.map((column) => {
-		if (!column.updatable) return `${prop(column[name])}?: never;`;
-		return `${prop(column[name])}?: ${nullable(column.tsType, column.nullable)};`;
-	});
-}
-/** Postgres passes `null` to any argument, so every argument accepts it. */
-function argEntries(fn) {
-	return fn.args.map((arg) => `${prop(arg.name)}${arg.optional ? "?" : ""}: ${nullable(arg.tsType, true)};`);
-}
-function enrichedDatabase(model) {
-	const schemas = model.config.schemas.flatMap((schema) => {
-		const tables = model.tables.filter((t) => t.snapshot.schema === schema).flatMap((table) => {
-			const overrides = table.columns.filter((column) => column.values !== void 0 && !column.snapshot.isEnum || column.json && column.tsType !== "Json" || column.storage !== void 0).map((column) => `${prop(column.db)}: ${column.tsType};`);
-			return overrides.length > 0 ? block(prop(table.snapshot.name), overrides) : [];
-		});
-		return tables.length > 0 ? block(prop(schema), tables) : [];
-	});
-	if (schemas.length === 0) return ["export type Database = SupabaseDatabase;"];
-	return [
-		"export type Database = EnrichDatabase<",
-		"  SupabaseDatabase,",
-		"  {",
-		...indent(schemas, 2),
-		"  }",
-		">;"
-	];
-}
-function modelsType(model) {
-	return [
-		"export type Models = {",
-		...indent(model.tables.flatMap((table) => {
-			const relations = table.relations.map((relation) => `${prop(relation.name)}: { table: ${q(relation.meta.table)}; kind: ${q(relation.meta.kind)}; nullable: ${String(relation.meta.nullable)} };`);
-			const pk = table.meta.primaryKey;
-			const uniques = Object.entries(table.meta.uniqueKeys).map(([name, columns]) => `${prop(name)}: readonly [${columns.map(q).join(", ")}];`);
-			const flags = [];
-			const tableFlags = table.meta.flags;
-			if (tableFlags.softDelete) flags.push(`softDelete: ${q(tableFlags.softDelete)};`);
-			if (tableFlags.timestamps) flags.push("timestamps: true;");
-			if (tableFlags.tenant) flags.push(`tenant: ${q(tableFlags.tenant)};`);
-			if (tableFlags.actor) flags.push("actor: true;");
-			const none = "Record<never, never>";
-			const union = (names) => names.length === 0 ? "never" : names.map(q).join(" | ");
-			return block(prop(table.key), [
-				...block("Row", rowEntries(table.columns, "app"), none),
-				...table.snapshot.insertable ? block("Insert", insertEntries(table.columns, "app"), none) : ["Insert: never;"],
-				...table.snapshot.updatable ? block("Update", updateEntries(table.columns, "app"), none) : ["Update: never;"],
-				...block("Relations", relations, none),
-				`PrimaryKey: ${union(pk)};`,
-				...block("UniqueKeys", uniques, none),
-				`Checks: ${union(table.snapshot.checks.map((check) => check.name))};`,
-				`ForeignKeys: ${union(table.snapshot.foreignKeys.map((fk) => fk.name))};`,
-				...block("Flags", flags, none)
-			]);
-		}), 1),
-		"};"
-	];
-}
-function functionsType(model) {
-	if (model.functions.length === 0) return ["export type Functions = Record<never, never>;"];
-	return [
-		"export type Functions = {",
-		...indent([...functionGroups(model.functions)].flatMap(([key, group]) => {
-			const [first] = group;
-			if (group.length === 1 && first) return block(prop(key), [...block("Args", argEntries(first), "Record<never, never>"), `Returns: ${first.returns};`]);
-			return [`${prop(key)}:`, ...indent(group.flatMap((fn, index) => {
-				const lines = [...block("Args", argEntries(fn), "Record<PropertyKey, never>"), `Returns: ${fn.returns};`];
-				const end = index === group.length - 1 ? "};" : "}";
-				return [
-					"| {",
-					...indent(lines, 1),
-					end
-				];
-			}), 1)];
-		}), 1),
-		"};"
-	];
-}
-/** The metadata module next to `generated.ts`: `generated.meta.js` and its `.d.ts`. */
-function metaPaths(output) {
-	const base = output.replace(/\.[cm]?[jt]sx?$/, "");
-	return {
-		js: `${base}.meta.js`,
-		dts: `${base}.meta.d.ts`
-	};
-}
-/**
-* JSON with one line per table, function and other named entry, so the
-* module stays small to load and a schema change still diffs per entry.
-*/
-function compactJson(meta) {
-	return `{\n${Object.entries(meta).map(([key, value]) => {
-		const name = JSON.stringify(key);
-		if (typeof value !== "object" || value === null || Array.isArray(value)) return `  ${name}: ${JSON.stringify(value)}`;
-		const inner = Object.entries(value).map(([entry, item]) => `    ${JSON.stringify(entry)}: ${JSON.stringify(item)}`);
-		return inner.length === 0 ? `  ${name}: {}` : `  ${name}: {\n${inner.join(",\n")}\n  }`;
-	}).join(",\n")}\n}`;
-}
-/**
-* The schema metadata as plain JavaScript plus a one-line declaration, so
-* TypeScript reads `SchemaMeta` instead of checking thousands of lines of
-* object literal in every program that imports the generated module.
-*/
-function emitMeta(model, options = {}) {
-	const runtime = options.runtimeImport ?? "better-supabase";
-	return {
-		js: [
-			GENERATED_HEADER,
-			`// @ts-self-types="${options.types ?? "./generated.meta.d.ts"}"`,
-			"/* oxlint-disable */",
-			"/* eslint-disable */",
-			"",
-			`export default ${compactJson({ ...model.meta })};`,
-			""
-		].join("\n"),
-		dts: [
-			GENERATED_HEADER,
-			"/* oxlint-disable */",
-			"/* eslint-disable */",
-			"",
-			`import type { SchemaMeta } from ${q(runtime)};`,
-			"",
-			"declare const meta: SchemaMeta;",
-			"export default meta;",
-			""
-		].join("\n")
-	};
-}
-/** Names the generated module declares or imports itself. */
-const RESERVED_EXPORTS = [
-	"defineSchema",
-	"Schema",
-	"SchemaMeta",
-	"EnrichDatabase",
-	"MutableWhere",
-	"OrderByArg",
-	"OrderByInput",
-	"StoragePath",
-	"SupabaseDatabase",
-	"meta",
-	"Json",
-	"Database",
-	"Models",
-	"Functions",
-	"TableName",
-	"UniqueConstraint",
-	"CheckConstraint",
-	"ForeignKeyConstraint",
-	"RowOf",
-	"InsertOf",
-	"UpdateOf",
-	"WhereOf",
-	"OrderByOf",
-	"OrderTermOf",
-	"buckets",
-	"topics",
-	"schema"
-];
-/** Renders the generated module. */
-function emitModule(model, options) {
-	const runtime = options.runtimeImport ?? "better-supabase";
-	const lines = [
-		GENERATED_HEADER,
-		"/* oxlint-disable */",
-		"/* eslint-disable */",
-		"",
-		`import { defineSchema, type Schema${options.inlineMeta ? ", type SchemaMeta" : ""} } from ${q(runtime)};`
-	];
-	const storagePaths = model.tables.some((table) => table.columns.some((column) => column.storage !== void 0));
-	lines.push(`import type { EnrichDatabase, MutableWhere, OrderByArg, OrderByInput${storagePaths ? ", StoragePath" : ""} } from ${q(runtime)};`, `import type { Database as SupabaseDatabase } from ${q(options.databaseTypesImport ?? "./database.types.ts")};`);
-	const byFile = /* @__PURE__ */ new Map();
-	for (const entry of model.jsonImports) {
-		const list = byFile.get(entry.from) ?? [];
-		list.push(entry.name);
-		byFile.set(entry.from, list);
-	}
-	for (const [from, names] of [...byFile.entries()].sort(([a], [b]) => byCodePoint(a, b))) lines.push(`import type { ${names.sort().join(", ")} } from ${q(options.importPathFor(from))};`);
-	lines.push(options.inlineMeta ? `\nconst meta: SchemaMeta = ${compactJson({ ...model.meta })};` : `import meta from ${q(options.metaImport ?? "./generated.meta.js")};`, "", "export type Json = string | number | boolean | null | { [key: string]: Json | undefined } | Json[];", "", ...enrichedDatabase(model), "");
-	const exported = new Map([...RESERVED_EXPORTS, ...model.jsonImports.map((entry) => entry.name)].map((name) => [name, "the generated module"]));
-	const claim = (name, source) => {
-		const other = exported.get(name);
-		if (other !== void 0) throw new TypeError(`${source} and ${other} both export "${name}" from the generated module. Rename one of them in the database.`);
-		exported.set(name, source);
-		return name;
-	};
-	for (const entry of model.enums) {
-		const source = `enum ${entry.schema}.${entry.name}`;
-		lines.push(`export const ${claim(entry.constant, source)} = [${entry.values.map(q).join(", ")}] as const;`, `export type ${claim(entry.typeName, source)} = (typeof ${entry.constant})[number];`);
-	}
-	for (const table of model.tables) for (const column of table.columns) if (column.values && !column.snapshot.isEnum) {
-		const source = `the CHECK on ${table.snapshot.schema}.${table.snapshot.name}.${column.db}`;
-		const constant = identifier(`${table.key}${pascal(column.app)}Values`.replace(/^[A-Z]/, (c) => c.toLowerCase()));
-		const typeName = identifier(`${pascal(table.key)}${pascal(column.app)}`);
-		lines.push(`export const ${claim(constant, source)} = [${column.values.map(q).join(", ")}] as const;`, `export type ${claim(typeName, source)} = (typeof ${constant})[number];`);
-	}
-	if (model.enums.length > 0) lines.push("");
-	lines.push(...modelsType(model), "", ...functionsType(model), "", "export type TableName = keyof Models;", "/** Constraint names for `isConflict`, `isCheck` and `isForeignKey`. */", "export type UniqueConstraint = { [T in TableName]: Extract<keyof Models[T]['UniqueKeys'], string> }[TableName];", "export type CheckConstraint = Models[TableName]['Checks'];", "export type ForeignKeyConstraint = Models[TableName]['ForeignKeys'];", "export type RowOf<T extends TableName> = Models[T]['Row'];", "export type InsertOf<T extends TableName> = Models[T]['Insert'];", "export type UpdateOf<T extends TableName> = Models[T]['Update'];", "/** A `where` for `T` you can assign to one key at a time. */", "export type WhereOf<T extends TableName> = MutableWhere<Models, T>;", "/** An `orderBy` for `T`: one sort or a list, by column or to-one relation. */", "export type OrderByOf<T extends TableName> = OrderByArg<Models, T>;", "/** One sort term of `T`'s `orderBy`, by column or to-one relation. */", "export type OrderTermOf<T extends TableName> = OrderByInput<Models, T>;", "");
-	if (model.meta.buckets) lines.push("/** Bucket configs for `defineBucket` from `better-supabase/storage`. */", `export const buckets = ${JSON.stringify(model.meta.buckets, null, 2)} as const;`, "");
-	if (model.meta.topics) lines.push("/** Topic templates for `defineTopic` from `better-supabase/realtime`. */", `export const topics = ${JSON.stringify(model.meta.topics, null, 2)} as const;`, "");
-	lines.push("export const schema: Schema<Models, Database, Functions> = defineSchema(meta);", "");
-	return lines.join("\n");
-}
-//#endregion
-//#region src/cli/introspect/extras.ts
-/**
-* Catalog details `@supabase/postgrest-typegen` leaves out: named unique and
-* CHECK constraints, foreign key actions, ordered primary keys, indexes,
-* policies, triggers, grants, buckets and the realtime publication.
-*
-* The SQL takes no bind parameters because the Management API endpoint only
-* accepts a query string; schema names are inlined as escaped literals.
-*/
-const literalArray = (values) => `array[${values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ")}]::text[]`;
-/** Row estimate from which a table counts as large in the snapshot. */
-const LARGE_TABLE_ROWS = 1e4;
-const RELATIONS = (schemas) => `
-select c.oid::int8 as id, n.nspname as schema, c.relname as name,
-  c.reltuples >= ${LARGE_TABLE_ROWS} as large
-from pg_class c
-join pg_namespace n on n.oid = c.relnamespace
-where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
-order by 2, 3`;
-const CONSTRAINTS = (schemas) => `
-select con.conrelid::int8 as table_id, con.conname as name, con.contype as type,
-  array(select a.attname from unnest(con.conkey) with ordinality k(attnum, ord)
-    join pg_attribute a on a.attrelid = con.conrelid and a.attnum = k.attnum order by k.ord)::text[] as columns,
-  con.confdeltype as on_delete, con.confupdtype as on_update,
-  pg_get_constraintdef(con.oid) as definition
-from pg_constraint con
-join pg_class c on c.oid = con.conrelid
-join pg_namespace n on n.oid = c.relnamespace
-where n.nspname = any(${schemas}) and con.contype in ('p', 'u', 'f', 'c')
-order by 1, 2`;
-const INDEXES = (schemas) => `
-select ix.indrelid::int8 as table_id, i.relname as name,
-  ix.indisunique as unique, ix.indisprimary as primary,
-  (ix.indpred is not null or 0 = any(ix.indkey::int2[])) as partial,
-  am.amname as method, pg_get_expr(ix.indpred, ix.indrelid) as predicate,
-  array(select a.attname from unnest((ix.indkey::int2[])[0:ix.indnkeyatts - 1]) with ordinality k(attnum, ord)
-    join pg_attribute a on a.attrelid = ix.indrelid and a.attnum = k.attnum order by k.ord)::text[] as columns
-from pg_index ix
-join pg_class i on i.oid = ix.indexrelid
-join pg_am am on am.oid = i.relam
-join pg_class c on c.oid = ix.indrelid
-join pg_namespace n on n.oid = c.relnamespace
-where n.nspname = any(${schemas}) and ix.indisvalid
-order by 1, 2`;
-const POLICIES = (schemas) => `
-select c.oid::int8 as table_id, p.policyname as name,
-  (p.permissive = 'PERMISSIVE') as permissive, p.roles::text[] as roles, lower(p.cmd) as command,
-  p.qual as using_expr, p.with_check as check_expr,
-  array(
-    select distinct fn.nspname || '.' || pr.proname
-    from pg_policy pol
-    join pg_depend d on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
-      and d.refclassid = 'pg_proc'::regclass
-    join pg_proc pr on pr.oid = d.refobjid
-    join pg_namespace fn on fn.oid = pr.pronamespace
-    where pol.polrelid = c.oid and pol.polname = p.policyname
-    order by 1
-  )::text[] as functions
-from pg_policies p
-join pg_namespace n on n.nspname = p.schemaname
-join pg_class c on c.relnamespace = n.oid and c.relname = p.tablename
-where p.schemaname = any(${schemas})
-order by 1, 2`;
-const FUNCTIONS = (schemas) => `
-select n.nspname as schema, p.proname as name,
-  pg_get_function_identity_arguments(p.oid) as signature,
-  l.lanname as language, p.provolatile as volatility,
-  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
-  array(
-    select r from unnest(array['anon', 'authenticated']) r
-    where has_function_privilege(r, p.oid, 'EXECUTE')
-  ) as execute
-from pg_proc p
-join pg_namespace n on n.oid = p.pronamespace
-join pg_language l on l.oid = p.prolang
-where p.oid in (
-    select d.refobjid
-    from pg_depend d
-    join pg_policy pol on d.classid = 'pg_policy'::regclass and d.objid = pol.oid
-    join pg_class c on c.oid = pol.polrelid
-    join pg_namespace cn on cn.oid = c.relnamespace
-    where d.refclassid = 'pg_proc'::regclass and cn.nspname = any(${schemas})
-  )
-  or (n.nspname = any(${schemas}) and ((p.prosecdef
-    and p.prorettype not in ('trigger'::regtype, 'event_trigger'::regtype)) or exists (
-    select 1 from unnest(p.proconfig) setting where setting not like 'search_path=%'
-  )))
-order by 1, 2, 3`;
-/** Roles the hook checks care about: the one Auth calls it as, and the API roles. */
-const HOOK_ROLES = literalArray([
-	"supabase_auth_admin",
-	"authenticated",
-	"anon"
-]);
-const HOOKS = (names) => `
-select n.nspname as schema, p.proname as name,
-  pg_get_function_identity_arguments(p.oid) as signature,
-  l.lanname as language, p.provolatile as volatility,
-  p.prosecdef as security_definer, coalesce(p.proconfig, '{}')::text[] as config,
-  array(select r.rolname::text from pg_roles r
-    where r.rolname = any(${HOOK_ROLES}) and has_function_privilege(r.oid, p.oid, 'execute')
-    order by 1) as execute,
-  exists(select 1 from aclexplode(coalesce(p.proacl, acldefault('f', p.proowner))) a
-    where a.grantee = 0 and a.privilege_type = 'EXECUTE') as public_execute,
-  array(select r.rolname::text from pg_roles r
-    where r.rolname = any(${HOOK_ROLES}) and has_schema_privilege(r.oid, n.oid, 'usage')
-    order by 1) as schema_usage,
-  p.prosrc as source
-from pg_proc p
-join pg_namespace n on n.oid = p.pronamespace
-join pg_language l on l.oid = p.prolang
-where n.nspname || '.' || p.proname = any(${names})
-order by 1, 2, 3`;
-const TRIGGERS = (schemas) => `
-select t.tgrelid::int8 as table_id, t.tgname as name,
-  pn.nspname || '.' || p.proname as function,
-  case when t.tgtype & 2 = 2 then 'before' when t.tgtype & 64 = 64 then 'instead of' else 'after' end as timing,
-  array_remove(array[
-    case when t.tgtype & 4 = 4 then 'insert' end,
-    case when t.tgtype & 16 = 16 then 'update' end,
-    case when t.tgtype & 8 = 8 then 'delete' end,
-    case when t.tgtype & 32 = 32 then 'truncate' end
-  ], null)::text[] as events,
-  case when t.tgtype & 1 = 1 then 'row' else 'statement' end as level
-from pg_trigger t
-join pg_class c on c.oid = t.tgrelid
-join pg_namespace n on n.oid = c.relnamespace
-join pg_proc p on p.oid = t.tgfoid
-join pg_namespace pn on pn.oid = p.pronamespace
-where not t.tgisinternal and n.nspname = any(${schemas})
-order by 1, 2`;
-const GRANTS = (schemas) => `
-select c.oid::int8 as table_id, coalesce(r.rolname, 'PUBLIC') as role,
-  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
-from pg_class c
-join pg_namespace n on n.oid = c.relnamespace
-cross join lateral aclexplode(coalesce(c.relacl, acldefault('r', c.relowner))) acl
-left join pg_roles r on r.oid = acl.grantee
-where n.nspname = any(${schemas}) and c.relkind in ('r', 'p', 'v', 'm', 'f')
-  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated', 'service_role'))
-  and acl.privilege_type <> 'MAINTAIN'
-group by 1, 2
-order by 1, 2`;
-const COLUMN_GRANTS = (schemas) => `
-select c.oid::int8 as table_id, a.attname as column, coalesce(r.rolname, 'PUBLIC') as role,
-  array_agg(distinct acl.privilege_type order by acl.privilege_type)::text[] as privileges
-from pg_class c
-join pg_namespace n on n.oid = c.relnamespace
-join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped and a.attacl is not null
-cross join lateral aclexplode(a.attacl) acl
-left join pg_roles r on r.oid = acl.grantee
-where n.nspname = any(${schemas})
-  and (acl.grantee = 0 or r.rolname in ('anon', 'authenticated'))
-  and acl.privilege_type in ('INSERT', 'UPDATE')
-group by 1, 2, 3
-order by 1, 2, 3`;
-const BUCKETS = `
-select id, public, file_size_limit, allowed_mime_types,
-  to_jsonb(b) ? 'versioning_status' as has_versioning,
-  to_jsonb(b) -> 'versioning_status' as versioning_status,
-  to_jsonb(b) ? 'lifecycle_configuration' as has_lifecycle,
-  to_jsonb(b) -> 'lifecycle_configuration' as lifecycle_configuration
-from storage.buckets b
-order by id`;
-const REALTIME = `
-select schemaname || '.' || tablename as name
-from pg_publication_tables
-where pubname = 'supabase_realtime'
-order by 1`;
-const ROLE_SETTINGS = `
-select r.rolname as role, s.setconfig as config
-from pg_catalog.pg_db_role_setting s
-join pg_catalog.pg_roles r on r.oid = s.setrole
-where r.rolname in ('authenticator', 'anon', 'authenticated')
-  and s.setdatabase in (0, (select oid from pg_catalog.pg_database where datname = current_database()))
-order by s.setdatabase`;
-const HAS_TABLE = (qualified) => `select to_regclass('${qualified}') is not null as present`;
-const ACTIONS = {
-	a: "no action",
-	r: "restrict",
-	c: "cascade",
-	n: "set null",
-	d: "set default"
-};
-const VOLATILITY = {
-	i: "immutable",
-	s: "stable",
-	v: "volatile"
-};
-/** `['statement_timeout=5s']` as `{ statement_timeout: '5s' }`. */
-function settingsOf(config) {
-	const settings = {};
-	for (const entry of config ?? []) {
-		const at = entry.indexOf("=");
-		if (at > 0) settings[entry.slice(0, at)] = entry.slice(at + 1);
-	}
-	return settings;
-}
-const functionOf = (row) => ({
-	schema: row.schema,
-	name: row.name,
-	signature: row.signature,
-	language: row.language,
-	volatility: VOLATILITY[row.volatility],
-	securityDefiner: row.security_definer,
-	settings: settingsOf(row.config)
-});
-/** The functions behind Auth hooks, in any schema, with their ACLs. */
-async function readHooks(db, targets) {
-	if (targets.length === 0) return [];
-	const found = await rows(db, HOOKS(literalArray(targets.map((t) => `${t.schema}.${t.name}`))));
-	return targets.map((target) => ({
-		hook: target.hook,
-		schema: target.schema,
-		name: target.name,
-		functions: found.filter((row) => row.schema === target.schema && row.name === target.name).map((row) => ({
-			...functionOf(row),
-			execute: row.execute,
-			publicExecute: row.public_execute,
-			schemaUsage: row.schema_usage,
-			...row.source === null ? {} : { source: row.source }
-		}))
-	}));
-}
-async function rows(db, sql) {
-	return (await db.query(sql)).rows;
-}
-/** Rows from a table owned by another Supabase service, if it exists. */
-async function serviceRows(db, qualified, sql) {
-	const [probe] = await rows(db, HAS_TABLE(qualified));
-	return probe?.present ? rows(db, sql) : [];
-}
-function groupById(list) {
-	const map = /* @__PURE__ */ new Map();
-	for (const row of list) {
-		const id = Number(row.table_id);
-		const entry = map.get(id);
-		if (entry) entry.push(row);
-		else map.set(id, [row]);
-	}
-	return map;
-}
-/** Reads the extras for `schemas`, with the catalog queries in flight together. */
-async function readExtras(db, schemas, hooks = []) {
-	const list = literalArray(schemas);
-	const [relations, constraintRows, indexRows, policyRows, triggerRows, grantRows, columnGrantRows, buckets, realtime, functions, roleRows, hookRows] = await Promise.all([
-		rows(db, RELATIONS(list)),
-		rows(db, CONSTRAINTS(list)),
-		rows(db, INDEXES(list)),
-		rows(db, POLICIES(list)),
-		rows(db, TRIGGERS(list)),
-		rows(db, GRANTS(list)),
-		rows(db, COLUMN_GRANTS(list)),
-		serviceRows(db, "storage.buckets", BUCKETS),
-		rows(db, REALTIME),
-		rows(db, FUNCTIONS(list)),
-		rows(db, ROLE_SETTINGS),
-		hooks.length > 0 ? readHooks(db, hooks) : void 0
-	]);
-	const constraints = groupById(constraintRows);
-	const indexes = groupById(indexRows);
-	const policies = groupById(policyRows);
-	const triggers = groupById(triggerRows);
-	const grants = groupById(grantRows);
-	const columnGrants = groupById(columnGrantRows);
-	const roleSettings = {};
-	for (const row of roleRows) Object.assign(roleSettings[row.role] ??= {}, settingsOf(row.config));
-	return {
-		tables: relations.map((relation) => {
-			const id = Number(relation.id);
-			const own = constraints.get(id) ?? [];
-			const ownIndexes = indexes.get(id) ?? [];
-			const uniques = own.filter((con) => con.type === "u").map((con) => ({
-				name: con.name,
-				columns: con.columns
-			}));
-			const constraintNames = new Set(own.map((con) => con.name));
-			for (const index of ownIndexes) if (index.unique && !index.primary && !index.partial && !constraintNames.has(index.name)) uniques.push({
-				name: index.name,
-				columns: index.columns
-			});
-			return {
-				id,
-				schema: relation.schema,
-				name: relation.name,
-				primaryKey: own.find((con) => con.type === "p")?.columns ?? [],
-				uniques,
-				foreignKeys: own.filter((con) => con.type === "f").map((con) => ({
-					name: con.name,
-					onDelete: ACTIONS[con.on_delete] ?? "no action",
-					onUpdate: ACTIONS[con.on_update] ?? "no action"
-				})),
-				checks: own.filter((con) => con.type === "c").map((con) => ({
-					name: con.name,
-					definition: con.definition
-				})),
-				indexes: ownIndexes.map((index) => ({
-					name: index.name,
-					columns: index.columns,
-					unique: index.unique,
-					primary: index.primary,
-					partial: index.partial,
-					method: index.method,
-					predicate: index.predicate
-				})),
-				policies: (policies.get(id) ?? []).map((policy) => ({
-					name: policy.name,
-					command: policy.command,
-					roles: policy.roles,
-					permissive: policy.permissive,
-					using: policy.using_expr,
-					check: policy.check_expr,
-					functions: policy.functions ?? []
-				})),
-				triggers: (triggers.get(id) ?? []).map((trigger) => ({
-					name: trigger.name,
-					timing: trigger.timing,
-					events: trigger.events,
-					level: trigger.level,
-					function: trigger.function
-				})),
-				grants: (grants.get(id) ?? []).map((grant) => ({
-					role: grant.role,
-					privileges: grant.privileges
-				})),
-				columnGrants: (columnGrants.get(id) ?? []).map((grant) => ({
-					column: grant.column,
-					role: grant.role,
-					privileges: grant.privileges
-				})),
-				...relation.large ? { large: true } : {}
-			};
-		}),
-		buckets: buckets.map((row) => ({
-			id: row.id,
-			public: row.public,
-			fileSizeLimit: row.file_size_limit === null ? null : Number(row.file_size_limit),
-			allowedMimeTypes: row.allowed_mime_types,
-			...row.has_versioning ? { versioning: row.versioning_status } : {},
-			...row.has_lifecycle ? { lifecycle: row.lifecycle_configuration } : {}
-		})),
-		realtime: realtime.map((row) => row.name),
-		roleSettings,
-		functions: functions.map((row) => ({
-			...functionOf(row),
-			execute: row.execute
-		})),
-		...hookRows ? { hooks: hookRows } : {}
-	};
-}
-//#endregion
-//#region src/cli/introspect/fingerprint.ts
-/**
-* Catalogs whose rows only change with DDL, grants, comments or settings,
-* with the column that ties a row to a relation or namespace, if any.
-*/
-const CATALOGS = [
-	["pg_namespace", "oid"],
-	["pg_attribute", "attrelid"],
-	["pg_attrdef", "adrelid"],
-	["pg_constraint", "conrelid"],
-	["pg_index", "indrelid"],
-	["pg_inherits"],
-	["pg_rewrite"],
-	["pg_policy"],
-	["pg_trigger", "tgrelid"],
-	["pg_proc"],
-	["pg_type", "typnamespace"],
-	["pg_enum"],
-	["pg_description"],
-	["pg_db_role_setting"],
-	["pg_publication"],
-	["pg_publication_rel"],
-	["pg_extension"]
-];
-const TEMP_NAMESPACES = String.raw`(select oid from pg_catalog.pg_namespace where nspname like 'pg\_temp\_%' or nspname like 'pg\_toast\_temp\_%')`;
-const TEMP_RELATIONS = `(select oid from pg_catalog.pg_class where relnamespace in ${TEMP_NAMESPACES})`;
-const catalogRows = ([name, column]) => {
-	if (column === void 0) return `pg_catalog.${name}`;
-	return `(select * from pg_catalog.${name} where ${column} not in ${column === "oid" || column === "typnamespace" ? TEMP_NAMESPACES : TEMP_RELATIONS})`;
-};
-const digest = (from) => `(select md5(coalesce(string_agg(x::text, ',' order by x::text), '')) from ${from} x)`;
-/**
-* One cheap query whose result changes whenever introspection could. pg_class
-* leaves out the planner statistics that VACUUM and ANALYZE rewrite, except
-* the row-count threshold the snapshot records. pg_depend is limited to the
-* policies' rows, which name the tables and functions each policy uses.
-* pg_auth_members decides which privileges a role inherits, so the execute
-* lists change with it. Bucket rows are data, so they are hashed when
-* `storage.buckets` exists.
-*/
-const FINGERPRINT_SQL = `select md5(concat_ws('|',
-  ${digest(`(select oid, relname, relnamespace, relkind, relacl, reloptions, relrowsecurity, relforcerowsecurity, relreplident, relispartition, reltuples >= ${LARGE_TABLE_ROWS} as large from pg_catalog.pg_class where relnamespace not in ${TEMP_NAMESPACES})`)},
-  ${CATALOGS.map((entry) => digest(catalogRows(entry))).join(",\n  ")},
-  ${digest(`(select objid, refclassid, refobjid, refobjsubid, deptype from pg_catalog.pg_depend where classid = 'pg_catalog.pg_policy'::regclass)`)},
-  (select md5(coalesce(string_agg(rolname, ',' order by rolname), '')) from pg_catalog.pg_roles),
-  ${digest("pg_catalog.pg_auth_members")},
-  case when to_regclass('storage.buckets') is not null
-    then md5(query_to_xml('select id, public, file_size_limit, allowed_mime_types, to_jsonb(b) -> ''versioning_status'' as versioning, to_jsonb(b) -> ''lifecycle_configuration'' as lifecycle from storage.buckets b order by id', false, false, '')::text)
-  end
-)) as fingerprint`;
-/** A hash of the catalog; equal values mean introspection would return the same snapshot. */
-async function catalogFingerprint(db) {
-	const [row] = (await db.query(FINGERPRINT_SQL)).rows;
-	const value = row && typeof row === "object" && "fingerprint" in row ? row.fingerprint : void 0;
-	if (typeof value !== "string") throw new TypeError("The catalog fingerprint query returned no row.");
-	return value;
-}
-//#endregion
-//#region src/cli/introspect/cache.ts
-/** Shared with the splinter download cache. */
-const CACHE_DIR = "node_modules/.cache/better-supabase";
-const sha256 = (text) => createHash("sha256").update(text).digest("hex");
-function isEntry(value) {
-	return typeof value === "object" && value !== null && "key" in value && typeof value.key === "string" && "snapshot" in value && typeof value.snapshot === "object";
-}
-/**
-* Calls `read`, or returns the snapshot cached under `root` when the catalog
-* fingerprint, the `inputs` (schemas and hooks), the CLI version and the
-* typegen version all match. One file per source keeps the cache from growing. A source that
-* cannot report a fingerprint is read every time.
-*/
-async function cachedIntrospect(root, source, inputs, read) {
-	const fingerprint = await catalogFingerprint(source.queryable).catch(() => void 0);
-	if (fingerprint === void 0) return read();
-	const key = sha256(JSON.stringify([
-		VERSION,
-		TYPEGEN_VERSION,
-		source.describe,
-		inputs,
-		fingerprint
-	]));
-	const file = resolve(root, CACHE_DIR, `snapshot-${sha256(source.describe).slice(0, 16)}.json`);
-	const cached = await readFile(file, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
-	if (isEntry(cached) && cached.key === key) return cached.snapshot;
-	const snapshot = await read();
-	await writeAtomic(file, JSON.stringify({
-		key,
-		snapshot
-	})).catch(() => void 0);
-	return snapshot;
-}
-/**
-* Calls `produce`, or returns the `database.types.ts` cached under `root`
-* for the same `inputs`, CLI version and typegen version. Typegen and oxfmt
-* are most of a `gen` run on a large schema, and their output only depends
-* on the inputs.
-*/
-async function cachedDatabaseTypes(root, inputs, produce) {
-	const key = sha256(JSON.stringify([
-		VERSION,
-		TYPEGEN_VERSION,
-		inputs
-	]));
-	const file = resolve(root, CACHE_DIR, "database-types.json");
-	const cached = await readFile(file, "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
-	if (typeof cached === "object" && cached !== null && "key" in cached && cached.key === key && "contents" in cached && typeof cached.contents === "string") return cached.contents;
-	const contents = await produce();
-	await writeAtomic(file, JSON.stringify({
-		key,
-		contents
-	})).catch(() => void 0);
-	return contents;
-}
-/** Writes through a temporary file, so a concurrent reader never sees half a file. */
-async function writeAtomic(file, contents) {
-	await mkdir(dirname(file), { recursive: true });
-	const temporary = `${file}.${process.pid}-${crypto.randomUUID()}.tmp`;
-	try {
-		await writeFile(temporary, contents);
-		await rename(temporary, file);
-	} catch (cause) {
-		await rm(temporary, { force: true });
-		throw cause;
-	}
-}
-//#endregion
-//#region src/cli/introspect/from-metadata.ts
-/** What the extras query set reads that a `GeneratorMetadata` document leaves out. */
-const METADATA_GAPS = [
-	"multi-column unique keys and checks",
-	"foreign key actions",
-	"indexes",
-	"triggers",
-	"policies",
-	"grants",
-	"storage buckets",
-	"the realtime publication"
-];
-/** `METADATA_GAPS` as one phrase for notices. */
-const METADATA_GAPS_TEXT = `${METADATA_GAPS.slice(0, -1).join(", ")} or ${METADATA_GAPS.at(-1) ?? ""}`;
-/**
-* Builds a snapshot from a `GeneratorMetadata` document alone, for
-* `gen --metadata`. Relations come from `relationships`, single-column unique
-* keys from `is_unique` and single-column checks from `check`, named as
-* Postgres names them by default (`<table>_<column>_key`, `<table>_<column>_check`).
-* Everything else the extras carry is empty, and `extras.fromMetadata` says so.
-*/
-function fromMetadata(document) {
-	const { metadata } = stabilizeMetadata(document);
-	const tableIds = new Set(metadata.tables.map((table) => table.id));
-	const tables = [
-		...metadata.tables,
-		...metadata.foreignTables,
-		...metadata.views,
-		...metadata.materializedViews
-	].map((relation) => {
-		const columns = metadata.columns.filter((column) => column.table_id === relation.id).sort((a, b) => a.ordinal_position - b.ordinal_position);
-		const own = tableIds.has(relation.id);
-		return {
-			id: relation.id,
-			schema: relation.schema,
-			name: relation.name,
-			primaryKey: [],
-			uniques: own ? columns.filter((column) => column.is_unique).map((column) => ({
-				name: `${relation.name}_${column.name}_key`,
-				columns: [column.name]
-			})) : [],
-			foreignKeys: own ? metadata.relationships.filter((fk) => fk.schema === relation.schema && fk.relation === relation.name).map((fk) => ({
-				name: fk.foreign_key_name,
-				onDelete: "no action",
-				onUpdate: "no action"
-			})).sort((a, b) => byCodePoint(a.name, b.name)) : [],
-			checks: own ? columns.flatMap((column) => column.check === null ? [] : [{
-				name: `${relation.name}_${column.name}_check`,
-				definition: `CHECK ((${column.check}))`
-			}]) : [],
-			indexes: [],
-			policies: [],
-			triggers: [],
-			grants: []
-		};
-	});
-	return {
-		version: 2,
-		schemas: [...new Set(metadata.schemas.map((schema) => schema.name))].sort(byCodePoint),
-		generator: metadata,
-		extras: {
-			tables,
-			buckets: [],
-			realtime: [],
-			fromMetadata: true
-		}
-	};
-}
-//#endregion
-//#region src/cli/introspect/source.ts
-const POOL_SIZE = 4;
-const STATEMENT_TIMEOUT_MS = 12e4;
-/**
-* A small `pg` pool, since introspection issues its queries concurrently. A
-* `connect` that returns a single client gets its queries queued, because one
-* `pg.Client` runs them one at a time.
-*/
-async function pgSource(url, open = connect, signal) {
-	const { client, pooled, close, describe } = await open(url, void 0, {
-		pool: POOL_SIZE,
-		statementTimeout: STATEMENT_TIMEOUT_MS,
-		...signal ? { signal } : {}
-	});
-	if (pooled) return {
-		queryable: client,
-		close,
-		describe
-	};
-	let queue = Promise.resolve();
-	return {
-		queryable: { query(sql) {
-			const next = queue.then(() => client.query(sql));
-			queue = next.catch(() => void 0);
-			return next;
-		} },
-		close,
-		describe
-	};
-}
-/**
-* Runs introspection SQL through the Supabase Management API as the
-* read-only database user, so hosted projects need no database password.
-*/
-function managementSource(options) {
-	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
-	const doFetch = options.fetch ?? fetch;
-	const endpoint = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/database/query/read-only`;
-	return {
-		queryable: { async query(sql) {
-			const response = await doFetch(endpoint, {
-				method: "POST",
-				headers: {
-					authorization: `Bearer ${options.accessToken}`,
-					"content-type": "application/json"
-				},
-				body: JSON.stringify({ query: sql }),
-				...options.signal ? { signal: options.signal } : {}
-			});
-			const text = await response.text();
-			if (!response.ok) throw new Error(`Management API query failed (${response.status}) for project ${options.projectRef}: ${text.slice(0, 500)}`);
-			const rows = JSON.parse(text);
-			if (!Array.isArray(rows)) throw new TypeError(`Management API returned an unexpected body for project ${options.projectRef}.`);
-			return { rows };
-		} },
-		describe: `project ${options.projectRef} (Management API)`,
-		close: () => Promise.resolve()
-	};
-}
-//#endregion
-//#region src/cli/introspect/index.ts
-/** Reads a v2 snapshot: typegen metadata plus the extras. */
-async function introspect(db, schemas, options = {}) {
-	const unique = [...new Set(schemas)].sort();
-	const [metadata, extras] = await Promise.all([readGeneratorMetadata(db, unique), readExtras(db, unique, options.hooks)]);
-	const { metadata: generator, ids } = stabilizeMetadata(metadata);
-	return {
-		version: 2,
-		schemas: unique,
-		generator,
-		extras: {
-			...extras,
-			tables: extras.tables.map((table) => ({
-				...table,
-				id: ids.get(table.id) ?? table.id
-			}))
-		}
-	};
-}
-//#endregion
-//#region src/cli/commands/snapshot.ts
-const SNAPSHOT_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/snapshot-v2.json";
-/** Schemas that are always read, for doctor checks on helper functions. */
-const EXTRA_SCHEMAS = ["better_supabase"];
-/** The hosted project to read through the Management API, if any. */
-function managementTarget(config, env, source) {
-	if (source.dbUrl) return void 0;
-	const projectRef = source.projectRef ?? (config.source.dbUrl ? void 0 : config.source.projectRef);
-	if (!projectRef) return void 0;
-	const accessToken = config.source.accessToken ?? env.SUPABASE_ACCESS_TOKEN;
-	if (!accessToken) throw new CliError("missing_value", `Reading project ${projectRef} needs a Supabase access token. Set SUPABASE_ACCESS_TOKEN to a token scoped to this project (https://supabase.com/dashboard/account/tokens), or read the database with $DATABASE_URL or --db-url-stdin.`, { flag: "SUPABASE_ACCESS_TOKEN" });
-	return {
-		projectRef,
-		accessToken,
-		...env.SUPABASE_API_URL ? { apiUrl: env.SUPABASE_API_URL } : {}
-	};
-}
-/**
-* Where to read the schema from: `--db-url-stdin`, `--project-ref`, then the
-* config's `source.dbUrl` / `source.projectRef`, `$DATABASE_URL`, and finally
-* the local stack.
-*/
-async function openSource(config, env, source, open = connect) {
-	if (source.dbUrl) return pgSource(source.dbUrl, open, source.signal);
-	const target = managementTarget(config, env, source);
-	if (target) return managementSource({
-		...target,
-		...source.signal ? { signal: source.signal } : {}
-	});
-	return pgSource(await databaseUrl(config, env), open, source.signal);
-}
-/** Whether `loadSnapshot` reads a saved file rather than a database. */
-function snapshotFile(config, source) {
-	return source.snapshotPath ?? (source.live || source.dbUrl || source.projectRef ? void 0 : config.source.snapshot);
-}
-/**
-* Loads a saved snapshot or introspects the database. With `shared`, it
-* introspects over that source and leaves closing it to the caller, so later
-* queries reuse the connection.
-*/
-async function loadSnapshot(config, env, source, open = connect, shared) {
-	const path = snapshotFile(config, source);
-	if (path) return readSnapshotFile(resolve(config.root, path), path);
-	const [tomlRead, opened] = await Promise.allSettled([readSupabaseToml(config.root), shared ? shared() : openSource(config, env, source, open)]);
-	if (tomlRead.status === "rejected") {
-		if (opened.status === "fulfilled" && !shared) await opened.value.close().catch(() => void 0);
-		throw tomlRead.reason;
-	}
-	if (opened.status === "rejected") throw opened.reason;
-	const toml = tomlRead.value;
-	const db = opened.value;
-	const hooks = toml ? pgFunctionHooks(toml.document) : [];
-	const schemas = [...config.schemas, ...EXTRA_SCHEMAS];
-	try {
-		const read = () => introspect(db.queryable, schemas, { hooks });
-		return await (source.cache ? cachedIntrospect(config.root, db, [schemas, hooks], read) : read());
-	} finally {
-		if (!shared) await db.close();
-	}
-}
-async function readSnapshotFile(absolute, label = absolute) {
-	if (!existsSync(absolute)) throw new Error(`Snapshot not found: ${label}`);
-	return parseSnapshot(JSON.parse(await readFile(absolute, "utf8")), label);
-}
-/** Validates a parsed snapshot document. */
-async function parseSnapshot(data, label = "snapshot") {
-	const doc = data;
-	if (!doc || typeof doc !== "object" || doc.version !== 2) throw new Error(`${label} is not a version 2 snapshot. Run \`better-supabase introspect\` to refresh it.`);
-	if (!Array.isArray(doc.schemas) || !doc.extras || !Array.isArray(doc.extras.tables)) throw new Error(`${label} is missing "schemas" or "extras".`);
-	let generator;
-	try {
-		generator = await validateGeneratorMetadata(doc.generator);
-	} catch (cause) {
-		if (cause instanceof TypegenMissingError) throw cause;
-		throw new Error(`${label} has invalid "generator" metadata: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-	}
-	return {
-		version: 2,
-		schemas: doc.schemas,
-		generator,
-		extras: {
-			tables: doc.extras.tables,
-			buckets: doc.extras.buckets ?? [],
-			realtime: doc.extras.realtime ?? [],
-			...doc.extras.roleSettings ? { roleSettings: doc.extras.roleSettings } : {},
-			...doc.extras.functions ? { functions: doc.extras.functions } : {},
-			...doc.extras.hooks ? { hooks: doc.extras.hooks } : {}
-		}
-	};
-}
-function serializeSnapshot(snapshot) {
-	const { $schema: _ignored, ...rest } = snapshot;
-	return `${JSON.stringify({
-		$schema: SNAPSHOT_SCHEMA_URL,
-		...rest
-	}, null, 2)}\n`;
-}
-//#endregion
-//#region src/cli/commands/gen.ts
-/**
-* Renders every generated file for a snapshot, without touching disk:
-* `database.types.ts` (what `supabase gen types` prints), the main module,
-* then each configured generator's files.
-*/
-async function renderFiles(config, snapshot, options = {}) {
-	return (await render(config, snapshot, options)).files;
-}
-async function render(config, snapshot, options = {}) {
-	const model = buildModel(snapshot, config);
-	const runtime = options.runtimeImport ? { runtimeImport: options.runtimeImport } : {};
-	const output = resolve(config.root, config.output);
-	const typegenOptions = {
-		schemas: config.schemas,
-		postgrestVersion: config.postgrestVersion
-	};
-	const databaseTypes = await cachedDatabaseTypes(config.root, [
-		typegenOptions,
-		await oxfmtInstalled(),
-		snapshot.generator
-	], () => generateDatabaseTypes(snapshot.generator, typegenOptions));
-	const metaFiles = metaPaths(config.output);
-	const main = emitModule(model, {
-		databaseTypesImport: importPath(output, resolve(config.root, config.databaseTypesOutput)),
-		importPathFor: (from) => importPath(output, resolve(config.root, from)),
-		metaImport: `./${basename(metaFiles.js)}`,
-		...options.inlineMeta ? { inlineMeta: true } : {},
-		...runtime
-	});
-	const meta = emitMeta(model, {
-		types: `./${basename(metaFiles.dts)}`,
-		...runtime
-	});
-	const files = [
-		{
-			path: config.databaseTypesOutput,
-			contents: databaseTypes
-		},
-		{
-			path: config.output,
-			contents: main
-		},
-		{
-			path: metaFiles.js,
-			contents: meta.js
-		},
-		{
-			path: metaFiles.dts,
-			contents: meta.dts
-		}
-	];
-	const owners = new Map(files.map((file) => [resolve(config.root, file.path), "gen"]));
-	let view;
-	for (const generator of config.generators) {
-		let extra;
-		try {
-			extra = await generator.generate({
-				meta: model.meta,
-				introspection: model.introspection,
-				extras: snapshot.extras,
-				config,
-				output,
-				importPath: (from, to) => importPath(resolve(config.root, from), resolve(config.root, to)),
-				model: view ??= generatorModel(model)
-			});
-		} catch (cause) {
-			throw new Error(`generator "${generator.name}" failed: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
-		}
-		for (const file of extra) {
-			const path = resolve(config.root, file.path);
-			const inside = relative(config.root, path);
-			if (inside === "" || inside.startsWith("..") || isAbsolute(inside)) throw new Error(`generator "${generator.name}" wrote ${file.path}, which is outside the project root`);
-			const owner = owners.get(path);
-			if (owner !== void 0) throw new Error(`generator "${generator.name}" wrote ${file.path}, which ${owner === "gen" ? "better-supabase gen writes" : `generator "${owner}" also writes`}`);
-			owners.set(path, generator.name);
-			files.push(file);
-		}
-	}
-	return {
-		files,
-		warnings: model.warnings
-	};
-}
-/** The `read-sets` SQL module file for `config.readSets`, if any are configured. */
-async function readSetFile(config) {
-	if (config.readSets.length === 0) return void 0;
-	const readSets = await compiledReadSets(config);
-	return renderModules(["read-sets"], moduleLayout(config, config.sql.testsDir, readSets))[0];
-}
-/**
-* `buckets` keys that reach the authorization provider's functions but
-* aren't marked `sqlComplete: true` in `authorization.permissions`, as
-* error lines.
-*/
-function rowConditionedBuckets(config) {
-	const provider = config.authorization;
-	if (!provider) return [];
-	return providerBucketKeys(config).flatMap(({ bucket, keys }) => keys.flatMap((key) => {
-		const problem = unsafeKey(provider, key);
-		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
-	}));
-}
-/** The exit `gen` stops with when bucket keys aren't fully answered by the provider's SQL functions. */
-function refuseRowConditionedBuckets(config) {
-	const refused = rowConditionedBuckets(config);
-	return refused.length === 0 || !config.authorization ? void 0 : {
-		code: 1,
-		error: `The SQL functions of ${providerLabel(config.authorization)} decide by role and scope only, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
-	};
-}
-/** The files the last `gen` wrote, so the next one can remove those it no longer writes. */
-const MANIFEST = `${CACHE_DIR}/gen-manifest.json`;
-const manifestPath = (root, path) => relative(root, resolve(root, path)).split(sep).join("/");
-async function readManifest(root) {
-	const parsed = await readFile(resolve(root, MANIFEST), "utf8").then((text) => JSON.parse(text)).catch(() => void 0);
-	if (typeof parsed !== "object" || parsed === null || !("version" in parsed) || parsed.version !== 1 || !("files" in parsed) || !Array.isArray(parsed.files)) return [];
-	return parsed.files.filter((path) => typeof path === "string");
-}
-/** Files in the last manifest that this run doesn't generate and that still exist inside the root. */
-async function leftoverFiles(root, generated) {
-	const current = new Set(generated);
-	return (await readManifest(root)).filter((path) => {
-		const inside = relative(root, resolve(root, path));
-		return !current.has(path) && inside !== "" && !inside.startsWith("..") && !isAbsolute(inside) && existsSync(resolve(root, path));
-	});
-}
-const writeManifest = (root, files) => writeAtomic(resolve(root, MANIFEST), `${JSON.stringify({
-	version: 1,
-	files: [...files].sort()
-}, null, 2)}\n`).catch(() => void 0);
-const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt. @supabase/postgrest-typegen pins oxfmt 0.66.0 as its peer; to allow a newer one, add it to peerDependencyRules.allowedVersions in pnpm-workspace.yaml, keyed \"@supabase/postgrest-typegen>oxfmt\".";
-const METADATA_ONLY = `Notice: the schema came from a GeneratorMetadata document, which has no ${METADATA_GAPS_TEXT}. Unique keys and checks cover single columns, relations have no onDelete, and columns a before-insert trigger fills stay required on insert. Run \`better-supabase gen\` against the database for the full model.`;
-/** The formatter notice, the metadata-only notice and the config warnings, one line each. */
-async function generationNotices(snapshot, warnings) {
-	return [
-		...await oxfmtInstalled() ? [] : [UNFORMATTED],
-		...snapshot.extras.fromMetadata ? [METADATA_ONLY] : [],
-		...warnings.map((warning) => `Warning: ${warning}`)
-	];
-}
-async function runGen(options) {
-	const { config } = options;
-	const refused = refuseRowConditionedBuckets(config);
-	if (refused) return refused;
-	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
-	const { files, warnings } = await render(config, snapshot);
-	const pathsOf = (readSets) => [...files, ...readSets ? [readSets] : []].map((file) => manifestPath(config.root, file.path));
-	const notice = (await generationNotices(snapshot, warnings)).map((line) => `\n${line}`).join("");
-	const readSetsOf = () => options.isolated ? Promise.resolve(void 0) : readSetFile(config);
-	const leftoversOf = (generated) => options.isolated ? Promise.resolve([]) : leftoverFiles(config.root, generated);
-	if (options.check) {
-		const readSets = await readSetsOf();
-		const generated = pathsOf(readSets);
-		const leftovers = await leftoversOf(generated);
-		const stale = [];
-		const diffs = [];
-		const compare = (file, current) => {
-			const shown = display(config.root, file.path);
-			stale.push(shown);
-			diffs.push(fileDiff(shown, current, file.contents, options.paint));
-		};
-		for (const file of files) {
-			const path = resolve(config.root, file.path);
-			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
-			if (!sameText(current, file.contents)) compare(file, current);
-		}
-		if (readSets) {
-			const path = resolve(config.root, readSets.path);
-			const current = existsSync(path) ? await readFile(path, "utf8") : void 0;
-			if (!sameModuleFile(current, readSets.contents)) compare(readSets, current);
-		}
-		if (stale.length > 0 || leftovers.length > 0) {
-			const lines = [...stale.map((path) => `  ${path}`), ...leftovers.map((path) => `  ${path} (no longer generated)`)];
-			return {
-				code: 1,
-				output: `${diffs.join("\n\n")}${notice}`,
-				error: `Generated files are out of date:\n${lines.join("\n")}\nRun \`better-supabase gen\`.`,
-				data: {
-					upToDate: false,
-					stale,
-					leftovers,
-					warnings
-				}
-			};
-		}
-		return {
-			code: 0,
-			output: `Generated files are up to date (${generated.length}).${notice}`,
-			data: {
-				upToDate: true,
-				stale: [],
-				leftovers: [],
-				warnings
-			}
-		};
-	}
-	const written = [];
-	for (const file of files) if (await writeIfChanged(resolve(config.root, file.path), file.contents)) written.push(display(config.root, file.path));
-	const readSets = await readSetsOf();
-	if (readSets && await writeIfChanged(resolve(config.root, readSets.path), readSets.contents)) written.push(display(config.root, readSets.path));
-	const generated = pathsOf(readSets);
-	const removed = [];
-	for (const path of await leftoversOf(generated)) {
-		await rm(resolve(config.root, path), { force: true });
-		removed.push(path);
-	}
-	if (!options.isolated) await writeManifest(config.root, generated);
-	const tables = snapshot.extras.tables.filter((table) => config.schemas.includes(table.schema)).length;
-	const changes = [...written.map((path) => `  ${path}`), ...removed.map((path) => `  ${path} (removed, no longer generated)`)];
-	return {
-		code: 0,
-		output: `${changes.length === 0 ? `No changes (${tables} tables).` : `Generated ${tables} tables:\n${changes.join("\n")}`}${notice}`,
-		data: {
-			tables,
-			written,
-			removed,
-			warnings
-		}
-	};
-}
-/** Where to read the schema from, shared by gen, introspect and doctor. */
-const SOURCE_ARGS = {
-	snapshot: {
-		type: "string",
-		description: "Read a saved snapshot instead of the database",
-		valueHint: "file"
-	},
-	"db-url-stdin": {
-		type: "boolean",
-		description: "Read the connection string from stdin instead of $DATABASE_URL or the config"
-	},
-	"project-ref": {
-		type: "string",
-		description: "Read a hosted project through the Management API",
-		valueHint: "ref"
-	}
-};
-async function sourceArgs(args, io) {
-	const snapshotPath = args.snapshot;
-	const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
-	const projectRef = args["project-ref"];
-	return {
-		...snapshotPath ? { snapshotPath } : {},
-		...dbUrl ? { dbUrl } : {},
-		...projectRef ? { projectRef } : {}
-	};
-}
-/** The files `gen --metadata` can write to stdout. */
-const EMITS = [
-	"schema",
-	"types",
-	"zod",
-	"valibot",
-	"json-schema"
-];
-const isEmit = (value) => EMITS.some((emit) => emit === value);
-/** The configured generator for an `--emit` target, or one with its defaults. */
-function emitGenerator(config, emit) {
-	const configured = config.generators.find((generator) => generator.name === emit);
-	switch (emit) {
-		case "schema":
-		case "types": return;
-		case "zod": return configured ?? zod();
-		case "valibot": return configured ?? valibot();
-		case "json-schema": return configured ?? jsonSchema();
-		default: throw new Error(`unknown --emit ${String(emit)}`);
-	}
-}
-/**
-* The one file `gen --metadata` prints: the `defineSchema` module with its
-* metadata inlined, `database.types.ts`, or one generator's output.
-*/
-async function renderEmit(config, snapshot, emit) {
-	const generator = emitGenerator(config, emit);
-	const { files, warnings } = await render({
-		...config,
-		generators: generator ? [generator] : []
-	}, snapshot, { inlineMeta: emit === "schema" });
-	const path = emit === "schema" ? config.output : emit === "types" ? config.databaseTypesOutput : void 0;
-	const own = /* @__PURE__ */ new Set([
-		config.databaseTypesOutput,
-		config.output,
-		...Object.values(metaPaths(config.output))
-	]);
-	const picked = path === void 0 ? files.filter((file) => !own.has(file.path)) : files.filter((file) => file.path === path);
-	const [file] = picked;
-	if (!file || picked.length > 1) throw new Error(`--emit ${emit} expects one file, and the generator wrote ${picked.length}. Pass --out <dir> to write them all.`);
-	return {
-		files: picked,
-		warnings,
-		contents: file.contents
-	};
-}
-/**
-* Reads `--metadata <path|->` (a file relative to `cwd`, or stdin for `-`)
-* into a snapshot. Throws `MetadataRejectedError` for a document that can't
-* be read or that `parseMetadataDocument` refuses.
-*/
-async function readMetadataSnapshot(source, cwd, io) {
-	let text;
-	try {
-		if (source !== "-") text = await readFile(resolve(cwd, source), "utf8");
-		else if (io.stdin) text = await io.stdin();
-		else throw new Error("there is no stdin to read");
-	} catch (cause) {
-		throw new MetadataRejectedError(`Could not read ${source === "-" ? "stdin" : source}: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	return fromMetadata(await parseMetadataDocument(text));
-}
-/**
-* `gen --metadata`: the out-of-process generator contract of
-* `@supabase/typegen`. Without `--out` it prints one file on stdout and
-* everything else on stderr; with `--out` it writes the usual files there.
-*/
-async function runMetadataGen(options) {
-	const { config, io } = options;
-	const emit = options.emit ?? "schema";
-	if (!isEmit(emit)) return {
-		code: 2,
-		error: `--emit must be one of ${EMITS.join(", ")}, got "${emit}"`
-	};
-	if (options.out !== void 0 && options.emit !== void 0) return {
-		code: 2,
-		error: "--emit picks the one file gen prints; --out writes them all. Pass one of them."
-	};
-	if (options.out === void 0 && options.check) return {
-		code: 2,
-		error: "--check with --metadata needs --out <dir>"
-	};
-	if (options.out === void 0 && options.json) return {
-		code: 2,
-		error: "--metadata prints the generated code on stdout, so --json has nothing to print. Pass --out <dir> for the JSON summary."
-	};
-	let snapshot;
-	try {
-		snapshot = await readMetadataSnapshot(options.metadata, options.cwd, io);
-	} catch (cause) {
-		if (cause instanceof MetadataRejectedError) return {
-			code: 65,
-			error: cause.message
-		};
-		throw cause;
-	}
-	if (options.out !== void 0) {
-		const dir = relative(config.root, resolve(options.cwd, options.out));
-		const into = (path) => join(dir, basename(path)).split(sep).join("/");
-		return runGen({
-			config: {
-				...config,
-				output: into(config.output),
-				databaseTypesOutput: into(config.databaseTypesOutput)
-			},
-			env: options.env,
-			check: options.check,
-			snapshot,
-			isolated: true,
-			...options.paint ? { paint: options.paint } : {}
-		});
-	}
-	const refused = refuseRowConditionedBuckets(config);
-	if (refused) return refused;
-	const { contents, warnings } = await renderEmit(config, snapshot, emit);
-	io.stdout(contents);
-	const notices = await generationNotices(snapshot, warnings);
-	const shown = emit === "types" ? notices : notices.filter((line) => line !== UNFORMATTED);
-	for (const line of shown) io.stderr(`${line}\n`);
-	return { code: 0 };
-}
-const ARGS = {
-	metadata: {
-		type: "string",
-		description: "Read a GeneratorMetadata document (- for stdin) and print one file on stdout",
-		valueHint: "path|-"
-	},
-	emit: {
-		type: "string",
-		description: `With --metadata, the file to print: ${EMITS.join(", ")}. Defaults to schema`,
-		valueHint: "file"
-	},
-	out: {
-		type: "string",
-		description: "With --metadata, write every generated file into this directory instead of printing one",
-		valueHint: "dir"
-	},
-	check: {
-		type: "boolean",
-		description: "Fail when a generated file is out of date"
-	},
-	watch: {
-		type: "boolean",
-		description: "Regenerate whenever the schema or the config file changes"
-	},
-	interval: {
-		type: "string",
-		description: "Milliseconds between checks in --watch. Defaults to 2000",
-		valueHint: "ms"
-	},
-	...SOURCE_ARGS
-};
-const sleep = (ms, signal) => setTimeout(ms, void 0, signal ? { signal } : {}).catch(() => void 0);
-/**
-* Reads the schema when it may have changed. Returns the new change marker (the
-* catalog fingerprint, or the snapshot itself when the source has none) and
-* the snapshot, or no snapshot when the fingerprint still matches `last`.
-*/
-async function poll(options, db, last) {
-	const fingerprint = db ? await catalogFingerprint(db.queryable).catch(() => void 0) : void 0;
-	if (fingerprint !== void 0 && fingerprint === last) return { marker: last };
-	const snapshot = await loadSnapshot(options.config, options.env, options, void 0, db ? () => Promise.resolve(db) : void 0);
-	const marker = fingerprint ?? JSON.stringify(snapshot);
-	return marker === last ? { marker } : {
-		marker,
-		snapshot
-	};
-}
-const regenerate = (options, snapshot) => runGen({
-	...options,
-	snapshot
-}).catch((cause) => ({
-	code: 1,
-	error: cause instanceof Error ? cause.message : String(cause)
-}));
-const modified = (file) => file ? stat(file).then((stats) => stats.mtimeMs, () => void 0) : Promise.resolve(void 0);
-/**
-* Regenerates whenever the schema or the config file changes. A database
-* source keeps one connection open and polls the catalog fingerprint, so an
-* unchanged schema costs one small query per interval; a source without a
-* fingerprint is introspected each time and compared. A changed config file
-* is loaded again and forces a run. A failed run is retried every interval
-* until it succeeds, and the same error is printed once.
-*/
-async function watch(initial, interval, { io, signal, configFile, reloadConfig }) {
-	let options = initial;
-	let last = "";
-	let reported = "";
-	let stamp = await modified(configFile);
-	let db;
-	const aborted = () => signal?.aborted ?? false;
-	const report = (message) => {
-		if (message !== reported) io.stderr(`${message}\n`);
-		reported = message;
-	};
-	const closeDb = async () => {
-		await db?.close().catch(() => void 0);
-		db = void 0;
-	};
-	try {
-		while (!aborted()) {
-			const changed = await modified(configFile);
-			if (reloadConfig && changed !== stamp) try {
-				options = {
-					...options,
-					config: await reloadConfig()
-				};
-				stamp = changed;
-				last = "";
-				await closeDb();
-			} catch (cause) {
-				report(cause instanceof Error ? cause.message : String(cause));
-				await sleep(interval, signal);
-				continue;
-			}
-			let polled;
-			try {
-				db ??= snapshotFile(options.config, options) === void 0 ? await openSource(options.config, options.env, options) : void 0;
-				polled = await poll(options, db, last);
-			} catch (cause) {
-				report(cause instanceof Error ? cause.message : String(cause));
-				await closeDb();
-			}
-			const result = polled?.snapshot ? await regenerate(options, polled.snapshot) : void 0;
-			if (result && result.code !== 0) report(result.error ?? `gen exited with code ${result.code}`);
-			else if (polled) {
-				if (result?.output) io.stdout(`${result.output}\n`);
-				last = polled.marker;
-				reported = "";
-			}
-			await sleep(interval, signal);
-		}
-	} finally {
-		await closeDb();
-	}
-	return { code: 0 };
-}
-const genCommand = defineCliCommand({
-	meta: {
-		name: "gen",
-		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
-	},
-	args: ARGS,
-	run: async (args, context) => {
-		if (args.metadata !== void 0) {
-			const conflicting = [
-				...args.watch === true ? ["--watch"] : [],
-				...args.snapshot === void 0 ? [] : ["--snapshot"],
-				...args["db-url-stdin"] === true ? ["--db-url-stdin"] : [],
-				...args["project-ref"] === void 0 ? [] : ["--project-ref"]
-			];
-			if (conflicting.length > 0) return {
-				code: 2,
-				error: `--metadata reads the schema from the document, so it can't be combined with ${conflicting.join(", ")}`
-			};
-			return runMetadataGen({
-				config: context.config,
-				env: context.env,
-				cwd: context.cwd,
-				io: context.io,
-				metadata: args.metadata,
-				check: args.check === true,
-				json: context.json,
-				paint: painter(context.io.color),
-				...args.emit === void 0 ? {} : { emit: args.emit },
-				...args.out === void 0 ? {} : { out: args.out }
-			});
-		}
-		if (args.emit !== void 0 || args.out !== void 0) return {
-			code: 2,
-			error: `${args.emit === void 0 ? "--out" : "--emit"} only applies with --metadata`
-		};
-		const options = {
-			config: context.config,
-			env: context.env,
-			check: args.check === true,
-			paint: painter(context.io.color),
-			...await sourceArgs(args, context.io),
-			...context.signal ? { signal: context.signal } : {},
-			cache: true
-		};
-		const interval = Number(args.interval ?? 2e3);
-		if (!Number.isFinite(interval) || interval <= 0) return {
-			code: 2,
-			error: `--interval must be a positive number of milliseconds, got "${args.interval}"`
-		};
-		return args.watch === true ? watch(options, interval, context) : withSpinner(context.io.prompts, "Generating from the schema", () => runGen(options));
-	}
-});
-//#endregion
-export { exposed as A, MetadataRejectedError as C, accessModule as D, AUTHORIZATION_RULES as E, qualified as F, tableObject as I, toCatalog as L, lineOf as M, permissionCatalogKeys as N, entitlementsModule as O, policyObject as P, configFor as S, serializeGenerator as T, METADATA_GAPS_TEXT as _, renderFiles as a, emitModule as b, loadSnapshot as c, parseSnapshot as d, serializeSnapshot as f, pgSource as g, managementSource as h, render as i, exposedSchemas as j, catalogOf as k, managementTarget as l, introspect as m, genCommand as n, runGen as o, snapshotFile as p, readMetadataSnapshot as r, sourceArgs as s, SOURCE_ARGS as t, openSource as u, CACHE_DIR as v, restrictSchemas as w, buildModel as x, GENERATED_HEADER as y };