better-supabase 0.8.0 → 0.9.0

package/dist/cli/doctor-SGw36h1D.js

@@ -0,0 +1,3806 @@
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { i as plain } from "./style-2JfIPVMQ.js";
+import { t as VERSION } from "./version-DNRW4DAP.js";
+import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
+import { a as sameText, t as display } from "./io-BiPX-_J1.js";
+import { t as CACHE_DIR } from "./cache-Cx6qlRDR.js";
+import { t as byCodePoint } from "./compare-BmIWVEui.js";
+import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
+import { c as configFor, s as notNullTag } from "./emit-ZAYeh4Yn.js";
+import { A as renderFiles, C as policyObject, D as advisorRule, E as workflowOf, O as splinterTables, S as permissionCatalogKeys, T as tableObject, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as exposedSchemas, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as catalogOf, w as qualified, x as lineOf, y as exposed } from "./run-DaHfUUO9.js";
+import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-YFFdWC5X.js";
+import { l as stdinDatabaseUrl } from "./config-CLHpTk9Y.js";
+import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-DjLgBYEo.js";
+import { t as connect } from "./db-DT1bGB02.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { n as applyPlan, o as insideRoot, r as changeLines } from "./files-DDvAwTko.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { i as sourceFlags, n as SOURCE_ARGS } from "./source-args-0I9zylYy.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-CxBZo4KM.js";
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createHash } from "node:crypto";
+import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
+import { SECRET_COLUMNS, SQL_MODULES, adoptedTables, contractSignature, customContracts, dataExportPlan, excludedColumns, expiredFlagsQuery, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, moduleVersion, renderModules, sameModuleFile, sameTenantColumn, sameTenantTrigger, sharedRolesProblems, subjectColumns } from "better-supabase/sql";
+import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
+import { defineBucket, parseSize } from "better-supabase/storage";
+//#region src/cli/doctor/adoption.ts
+const tagText = (notNull) => notNull === true ? "@notNull" : `@notNull(${notNull.join(", ")})`;
+const sameNotNull = (a, b) => a === true || b === true ? a === b : a !== void 0 && a.length === b.length && a.every((name) => b.includes(name));
+/** Checks for adopted schemas: config the SQL could carry, and references and exports the modules leave open. */
+const ADOPTION_RULES = [
+	{
+		code: "BS338",
+		severity: "info",
+		title: "functions.notNull entry a comment tag could replace",
+		description: "`gen` reads `@notNull` and `@notNull(a, b)` from a function's comment. A `functions.<name>.notNull` entry for a function in the read schemas can move to the comment, next to the SQL it describes. A config entry wins over the tag.",
+		check: (context) => {
+			const { config } = context;
+			return catalogOf(context).functions.flatMap((fn) => {
+				const notNull = configFor(config.functions, fn.schema, fn.name)?.notNull;
+				if (notNull === void 0 || !config.schemas.includes(fn.schema)) return [];
+				const name = `${fn.schema}.${fn.name}`;
+				const tag = notNullTag(fn.comment);
+				const wanted = tagText(notNull);
+				let message;
+				if (sameNotNull(tag, notNull)) message = `functions.${fn.name}.notNull matches the ${wanted} tag on ${name}(${fn.signature}). Remove the config entry.`;
+				else if (tag === void 0) message = `functions.${fn.name}.notNull can move to the function: add \`${wanted}\` to the comment on ${name}(${fn.signature}) (\`comment on function ${name}(${fn.signature}) is '${wanted}';\`), then remove the config entry.`;
+				else message = `functions.${fn.name}.notNull (${wanted}) differs from the ${tagText(tag)} tag on ${name}(${fn.signature}), and the config entry wins. Make them agree, then remove the config entry.`;
+				return [{
+					message,
+					target: `${name}(${fn.signature})`
+				}];
+			});
+		}
+	},
+	{
+		code: "BS339",
+		severity: "warning",
+		title: "expose excludes a column the table doesn't have",
+		description: "`sql sync` turns `select(*, -col)` in `expose` into the table's declared columns minus the excluded ones. An excluded column the table no longer has excludes nothing, and a renamed secret column is then granted under its new name. Remove the exclusion, or exclude the new name.",
+		check: (context) => {
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			return Object.entries(context.config.expose).flatMap(([key, roles]) => {
+				const table = tables.get(key.includes(".") ? key : `public.${key}`);
+				if (table === void 0) return [];
+				const columns = new Set(table.columns.map((column) => column.name));
+				return [...new Set([
+					...roles.anon,
+					...roles.authenticated,
+					...roles.serviceRole
+				].flatMap((privilege) => excludedColumns(privilege)).filter((column) => !columns.has(column)))].map((column) => ({
+					message: `expose.${key} excludes "${column}", which ${qualified(table)} doesn't have, so it excludes nothing. Remove "-${column}", or exclude the column's new name.`,
+					target: `${qualified(table)}.${column}`
+				}));
+			});
+		}
+	},
+	{
+		code: "BS340",
+		severity: "info",
+		title: "Tenant foreign key without a same-tenant trigger",
+		description: "A foreign key checks that the referenced row exists, not that it belongs to the row's tenant. Doctor lists each single-column key between two tables that both have the tenant column, when the key doesn't include that column and the table has no `bs_same_tenant_<column>` trigger. List the reference in `blocks.tenant.options.sameTenant`, or set `sameTenant: { auto: true }` to derive every one from the schema files.",
+		check: (context) => {
+			if (!context.config.blockNames.includes("tenant")) return [];
+			const tenant = sameTenantColumn(moduleLayout(context.config));
+			const { tables } = catalogOf(context);
+			const tenantTables = new Set(tables.filter((table) => table.columns.some((column) => column.name === tenant)).map(qualified));
+			return tables.filter((table) => context.config.schemas.includes(table.schema) && tenantTables.has(qualified(table))).flatMap((table) => {
+				const triggers = new Set(table.triggers.map((trigger) => trigger.name));
+				return table.foreignKeys.flatMap((key) => {
+					const [column] = key.columns;
+					if (column === void 0 || key.columns.length !== 1 || column === tenant || !tenantTables.has(`${key.refSchema}.${key.refTable}`) || triggers.has(sameTenantTrigger(column))) return [];
+					return [{
+						message: `${qualified(table)}.${column} references ${key.refSchema}.${key.refTable}, and both have ${tenant}, but no trigger checks that the referenced row has the same ${tenant}. Add it to blocks.tenant.options.sameTenant, or set sameTenant: { auto: true }.`,
+						target: `${qualified(table)}.${column}`
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS341",
+		severity: "warning",
+		title: "Data export includes a column that looks like a secret",
+		description: "A data export writes every column of each table it reads, except the ones in `omit`. Doctor reports columns of the exported tables, including the ones `autoTables` finds, whose name matches `token`, `secret`, `_hash`, `password`, `api_key` or `license_key` and that no `omit` and no `omitPattern` leaves out. Add the column to the table's `omit`, keep the table out of exports with `export: false` or `autoTables.exclude`, or set `blocks.data-lifecycle.options.omitPattern`.",
+		check: (context) => {
+			const plan = dataExportPlan(moduleLayout(context.config), context.config.blockNames);
+			if (plan === void 0) return [];
+			const secret = new RegExp(SECRET_COLUMNS, "i");
+			const omitted = patternOf(plan.omitPattern);
+			const tables = catalogOf(context).tables;
+			const byName = new Map(tables.map((table) => [qualified(table), table]));
+			const exported = [...plan.tables.map((entry) => ({
+				table: byName.get(entry.name),
+				omit: entry.omit
+			})), ...autoExported(plan, tables)];
+			const findings = /* @__PURE__ */ new Map();
+			for (const { table, omit } of exported) {
+				if (table === void 0) continue;
+				for (const column of table.columns) {
+					const target = `${qualified(table)}.${column.name}`;
+					if (!secret.test(column.name) || omit.includes(column.name) || omitted?.test(column.name) === true || findings.has(target)) continue;
+					findings.set(target, {
+						message: `Data exports of ${qualified(table)} include ${column.name}, which looks like a secret. Add it to the table's omit, keep the table out of exports, or set blocks.data-lifecycle.options.omitPattern.`,
+						target
+					});
+				}
+			}
+			return [...findings.values()];
+		}
+	}
+];
+const NO_OMIT = [];
+/** The tables `autoTables` adds to exports, which omit nothing. */
+function autoExported(plan, tables) {
+	const { auto } = plan;
+	if (auto === void 0) return [];
+	return tables.filter((table) => auto.schemas.includes(table.schema) && !auto.excluded(qualified(table)) && table.columns.some((column) => auto.columns.includes(column.name))).map((table) => ({
+		table,
+		omit: NO_OMIT
+	}));
+}
+/** `omitPattern` as a JavaScript regex; undefined when off or not valid there. */
+function patternOf(pattern) {
+	if (pattern === void 0) return;
+	try {
+		return new RegExp(pattern, "i");
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/cli/doctor/cookies.ts
+const TOKENS_ONLY = /\bencode\s*:\s*["'`]tokens-only["'`]/;
+/** Imports that create the browser client, which writes the session cookie in the browser. */
+const BROWSER_SIDE = /from\s+["']better-supabase\/client["']|\bcreateBrowserClient\s*\(/;
+/** Imports that read or refresh the session cookie on the server. */
+const SERVER_SIDE = /from\s+["']better-supabase\/(?:server|next|ssr|hono|orpc|edge|expo)["']|\bcreateServerClient\s*\(/;
+function cookieSide(file) {
+	const browser = BROWSER_SIDE.test(file.text);
+	if (browser === SERVER_SIDE.test(file.text)) return;
+	return browser ? "browser" : "server";
+}
+/**
+* Files on one side of the session cookie that set `encode: 'tokens-only'`
+* while files on the other side don't (BS412).
+*/
+function encodingDrift(context) {
+	const sides = context.sources.flatMap((file) => {
+		const side = cookieSide(file);
+		return side ? [{
+			file,
+			side,
+			tokensOnly: TOKENS_ONLY.test(file.text)
+		}] : [];
+	});
+	const tokensOnly = sides.filter((entry) => entry.tokensOnly);
+	if (tokensOnly.length === 0) return [];
+	const findings = [];
+	for (const side of ["browser", "server"]) {
+		const set = tokensOnly.find((entry) => entry.side === side);
+		if (!set) continue;
+		const other = side === "browser" ? "server" : "browser";
+		const unset = sides.filter((entry) => entry.side === other && !entry.tokensOnly);
+		if (unset.length === 0) continue;
+		const line = lineOf(set.file.text, TOKENS_ONLY) ?? 1;
+		findings.push({
+			message: `${set.file.path} writes the session cookie with \`encode: 'tokens-only'\`, but the ${other} side (${unset.map((entry) => entry.file.path).join(", ")}) uses the default \`user-and-tokens\`. Set the same \`encode\` on both sides.`,
+			target: `${set.file.path}:encode`,
+			location: {
+				file: set.file.path,
+				line
+			}
+		});
+	}
+	return findings;
+}
+const COOKIE_RULES = [{
+	code: "BS412",
+	severity: "info",
+	title: "Session cookie encoding differs between server and browser",
+	description: "`@supabase/ssr` needs the same `cookies.encode` on the server and in the browser client. With `tokens-only` on one side only, the other side writes the user object back into the cookie, or reads a session without one and `session.user` throws.",
+	check: encodingDrift
+}];
+//#endregion
+//#region src/cli/doctor/dependencies.ts
+const DEPENDENCY_RULES = [{
+	code: "BS601",
+	severity: "warning",
+	title: "Peer outside its range",
+	description: "An optional peer of better-supabase is installed at a version outside the range better-supabase declares. With strict peer checks the install fails, and the subpath that needs the peer can break at runtime.",
+	check: (context) => (context.peers ?? []).flatMap((peer) => peer.installed !== void 0 && satisfies(peer.installed, peer.range) === false ? [{
+		message: `${peer.name}@${peer.installed} is installed, but better-supabase needs ${peer.range}. Install a version in that range, or remove ${peer.name} if nothing imports it.`,
+		target: peer.name
+	}] : [])
+}];
+//#endregion
+//#region src/cli/doctor/flags.ts
+/** Flags past their `expires_at` extra column that aren't archived. */
+async function expiredFlags(context) {
+	const db = context.database;
+	if (!db || "skipped" in db) return [];
+	let query;
+	try {
+		query = expiredFlagsQuery(moduleLayout(context.config), context.config.blockNames);
+	} catch {
+		return [];
+	}
+	if (!query) return [];
+	let rows;
+	try {
+		rows = await db.query(query);
+	} catch {
+		return [];
+	}
+	return rows.map((row) => ({
+		message: `Flag "${row.key}" expired on ${row.expires_at}${row.owner ? ` (owner: ${row.owner})` : ""}. Remove its checks from the code, then archive it with \`flags.save("${row.key}", { archived: true })\`, or move \`expires_at\` when it stays.`,
+		target: `flags:${row.key}`
+	}));
+}
+const FLAG_RULES = [{
+	code: "BS336",
+	severity: "warning",
+	title: "Flag past its expiry",
+	description: "The flags table has an `expires_at` column (`blocks.flags.options.extraColumns`), and a flag on the live database that isn't archived has an `expires_at` in the past. A release flag that outlives its rollout keeps a dead branch in the code. The finding names the `owner` column when the table has one.",
+	check: expiredFlags
+}];
+//#endregion
+//#region src/cli/doctor/reserved-roles.ts
+/**
+* supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
+* drop or change the memberships of these.
+*/
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_functions_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer"
+]);
+/** Reserved roles whose settings (`alter role ... set`) supautils allows changing. */
+const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"authenticated",
+	"anon",
+	"service_role"
+]);
+/**
+* Roles that Supabase's own services log in as. Their statements (PostgREST's
+* schema cache query, Auth and Storage migrations) aren't the app's.
+*/
+const PLATFORM_ROLES = /* @__PURE__ */ new Set([...RESERVED_ROLES, "authenticator"]);
+/** Comments and string literals blanked, newlines kept so offsets map to lines. */
+const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
+const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
+/** Why a statement changes a reserved role, or undefined when it doesn't. */
+function reservedRoleChange(statement) {
+	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
+	if (alter) {
+		const role = roleNames(alter[2])[0];
+		const verb = alter[1].toLowerCase();
+		const next = alter[3].toLowerCase();
+		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
+		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
+		return;
+	}
+	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
+	if (!membership) return;
+	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
+	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
+}
+/** Where a statement ends, including statements inside `do` blocks and function bodies. */
+const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
+/** Statements in schema files and migrations that supautils rejects on Supabase. */
+function reservedRoles(context) {
+	return (context.sqlFiles ?? []).flatMap((file) => {
+		const code = sqlCode(file.text);
+		const findings = [];
+		let start = 0;
+		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
+			const until = end?.index ?? code.length;
+			const statement = code.slice(start, until);
+			const reason = reservedRoleChange(statement);
+			if (reason !== void 0) {
+				const at = start + statement.search(/\S/);
+				const line = code.slice(0, at).split("\n").length;
+				findings.push({
+					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
+					target: `${file.path}:${String(line)}`,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			start = until + (end?.[0].length ?? 0);
+		}
+		return findings;
+	});
+}
+//#endregion
+//#region src/cli/doctor/live.ts
+/** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
+const SLOW_MEAN_MS = 50;
+const SLOW_CALLS = 1e3;
+/** Rows `--explain` reads, like a `findMany()` under Supabase's default `max_rows`. */
+const EXPLAIN_LIMIT = 1e3;
+const escape$1 = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const ident$1 = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
+const literal$1 = (text) => `'${text.replaceAll("'", "''")}'`;
+const oneLine = (query, max = 160) => {
+	const flat = query.replaceAll(/\s+/g, " ").trim();
+	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
+};
+const plural$1 = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
+/** The schema `pg_stat_statements` lives in, when the extension is installed. */
+async function statementsView(db) {
+	const [row] = await db.query(`select n.nspname as schema from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'`);
+	return row ? `${ident$1(row.schema)}.pg_stat_statements` : void 0;
+}
+/** The first exposed table a statement names, to locate it in the SQL files. */
+function tableIn(query, tables) {
+	return tables.find((table) => {
+		const schema = escape$1(table.schema);
+		const name = escape$1(table.name);
+		return new RegExp(`(?:"${schema}"|\\b${schema})\\.(?:"${name}"|${name}\\b)`).test(query);
+	});
+}
+const live = (context) => context.database;
+/**
+* Function calls and self time so far in this transaction. The view can
+* still hold unflushed counts from earlier transactions, so callers diff two
+* readings.
+*/
+async function functionTimes(db) {
+	const rows = await db.query(`select schemaname || '.' || funcname as name, calls, self_time from pg_stat_xact_user_functions`);
+	return new Map(rows.map((row) => [row.name, {
+		calls: Number(row.calls),
+		selfTime: Number(row.self_time)
+	}]));
+}
+/** Node types, timings and loops of an `EXPLAIN (ANALYZE, FORMAT JSON)` plan; never rows. */
+function summarizePlan(output) {
+	const nodes = [];
+	const perRowSubPlans = [];
+	let initPlans = 0;
+	const walk = (node) => {
+		const loops = node["Actual Loops"] ?? 1;
+		const ms = (node["Actual Total Time"] ?? 0).toFixed(2);
+		const on = node["Relation Name"] ? ` on ${node["Relation Name"]}` : "";
+		const sub = node["Subplan Name"] ? `${node["Subplan Name"]}: ` : "";
+		nodes.push(`${sub}${node["Node Type"]}${on} ${ms} ms ×${loops}`);
+		if (node["Parent Relationship"] === "InitPlan") initPlans += 1;
+		if (node["Parent Relationship"] === "SubPlan" && loops > 1) perRowSubPlans.push(`${sub}${node["Node Type"]}${on} ×${loops}`);
+		for (const child of node.Plans ?? []) walk(child);
+	};
+	walk(output.Plan);
+	return {
+		nodes,
+		initPlans,
+		perRowSubPlans,
+		executionMs: output["Execution Time"] ?? 0
+	};
+}
+const ROLE = /^[a-z_][a-z0-9_]*$/;
+async function explainTable(db, table, claims) {
+	const role = typeof claims["role"] === "string" ? claims["role"] : "anon";
+	if (!ROLE.test(role)) throw new Error(`Invalid role "${role}" in the claims`);
+	await db.query("begin");
+	try {
+		await db.query(`set local statement_timeout = '30s'`);
+		let tracked = true;
+		await db.query("savepoint bs_track");
+		try {
+			await db.query(`set local track_functions = 'all'`);
+			await db.query("release savepoint bs_track");
+		} catch {
+			tracked = false;
+			await db.query("rollback to savepoint bs_track");
+		}
+		await db.query(`select set_config('request.jwt.claims', ${literal$1(JSON.stringify(claims))}, true)`);
+		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
+		await db.query(`set local role ${ident$1(role)}`);
+		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident$1(table.schema)}.${ident$1(table.name)} limit ${EXPLAIN_LIMIT}`);
+		const raw = row?.["QUERY PLAN"];
+		const plan = typeof raw === "string" ? JSON.parse(raw) : raw;
+		if (!plan?.[0]) throw new Error("EXPLAIN returned no plan");
+		const functions = tracked ? [...await functionTimes(db)].map(([name, after]) => {
+			const start = before.get(name);
+			return {
+				name,
+				calls: after.calls - (start?.calls ?? 0),
+				selfTime: after.selfTime - (start?.selfTime ?? 0)
+			};
+		}).filter((fn) => fn.calls > 0).sort((a, b) => b.selfTime - a.selfTime) : void 0;
+		return {
+			summary: summarizePlan(plan[0]),
+			functions
+		};
+	} finally {
+		await db.query("rollback");
+	}
+}
+function resolveTable(context, name) {
+	return name.includes(".") ? catalogOf(context).tables.find((table) => qualified(table) === name) : exposed(context).find((table) => table.name === name);
+}
+const LIVE_RULES = [
+	{
+		code: "BS208",
+		severity: "warning",
+		title: "Queries spill to temporary files",
+		description: "Sorts and hashes that exceed `work_mem` write temporary files, which is slow. Reads `pg_stat_database` and, when installed, the top statements from `pg_stat_statements`. When every statement that spilled ran as a Supabase service role (PostgREST's schema cache query as `authenticator`, Auth or Storage) or came from better-supabase's own catalog reads (`introspect`, `gen`, `doctor`), there is no finding.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			try {
+				const [stats] = await db.query(`select temp_files, temp_bytes, current_setting('work_mem') as work_mem from pg_stat_database where datname = current_database()`);
+				const files = Number(stats?.temp_files ?? 0);
+				if (files === 0) return [];
+				let top = "";
+				const view = await statementsView(db);
+				if (view) {
+					const spilled = await db.query(`select s.query, s.temp_blks_written, r.rolname as role from ${view} s left join pg_roles r on r.oid = s.userid where s.temp_blks_written > 0 order by s.temp_blks_written desc limit 50`).catch(() => []);
+					const statements = spilled.filter((statement) => !statement.query.startsWith("/* better-supabase */") && (statement.role === null || !PLATFORM_ROLES.has(statement.role))).slice(0, 5);
+					if (spilled.length > 0 && statements.length === 0) return [];
+					if (statements.length > 0) top = ` Top statements by temporary blocks written: ${statements.map((statement) => `${oneLine(statement.query, 100)} (${statement.temp_blks_written} blocks)`).join("; ")}.`;
+				}
+				return [{
+					message: `${files} temporary files (${megabytes(Number(stats?.temp_bytes ?? 0))}) since the statistics were reset; work_mem is ${stats?.work_mem}. Add indexes so large sorts go away, or raise work_mem for the role that runs them.${top}`,
+					target: "pg_stat_database:temp_files"
+				}];
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_database (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS209",
+		severity: "warning",
+		title: "Slow frequent statements",
+		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
+		async check(context) {
+			if (!context.stats) return [];
+			const db = live(context);
+			if (!db) return [];
+			if ("skipped" in db) return [{
+				severity: "info",
+				message: `Skipped --stats: ${db.skipped}`
+			}];
+			try {
+				const view = await statementsView(db);
+				if (!view) return [{
+					severity: "info",
+					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
+				}];
+				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
+				const tables = exposed(context);
+				return statements.map((statement) => {
+					const table = tableIn(statement.query, tables);
+					return {
+						message: `${Number(statement.mean_exec_time).toFixed(1)} ms mean over ${statement.calls} calls: ${oneLine(statement.query)}`,
+						target: `pg_stat_statements:${statement.queryid}`,
+						...table ? { object: tableObject(table) } : {}
+					};
+				});
+			} catch (cause) {
+				return [{
+					severity: "info",
+					message: `Could not read pg_stat_statements (${db.describe}): ${errorText(cause)}`
+				}];
+			}
+		}
+	},
+	{
+		code: "BS225",
+		severity: "info",
+		title: "pg_stat_statements is not installed",
+		description: "`pg_stat_statements` records the time and calls of each statement, which `--stats` (BS209), BS208 and the Supabase query performance report read. Without it there is no record of which queries are slow. Needs a database; saved snapshots skip it.",
+		async check(context) {
+			const db = live(context);
+			if (!db || "skipped" in db) return [];
+			if (context.stats && context.codes?.includes("BS209")) return [];
+			try {
+				if (await statementsView(db)) return [];
+			} catch {
+				return [];
+			}
+			return [{
+				message: `pg_stat_statements is not installed on the ${db.describe}, so nothing records which statements are slow. Run \`create extension if not exists pg_stat_statements with schema extensions;\` in a migration.`,
+				target: "extension:pg_stat_statements"
+			}];
+		}
+	},
+	{
+		code: "BS212",
+		severity: "info",
+		title: "RLS plan for a table",
+		description: `\`--explain <tables>\` runs \`EXPLAIN (ANALYZE, BUFFERS)\` on \`select * from <table> limit ${EXPLAIN_LIMIT}\` as the given claims, in a transaction that is rolled back. It reports node types, timings and loops, never rows, and warns when a policy SubPlan runs once per row.`,
+		async check(context) {
+			const request = context.explain;
+			if (!request) return [];
+			const db = live(context);
+			if (!db || "skipped" in db || !db.session) return [{
+				severity: "warning",
+				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
+			}];
+			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
+			const findings = [];
+			for (const name of request.tables) {
+				const table = resolveTable(context, name);
+				if (!table) {
+					findings.push({
+						severity: "warning",
+						message: `--explain: no table "${name}" in the exposed schemas; qualify tables in other schemas, like better_supabase.memberships.`
+					});
+					continue;
+				}
+				try {
+					const { summary, functions } = await explainTable(db, table, request.claims);
+					const helpers = functions ? functions.length > 0 ? ` Function time: ${functions.map((fn) => {
+						const self = fn.selfTime;
+						const share = summary.executionMs > 0 ? Math.round(self / summary.executionMs * 100) : 0;
+						return `${fn.name} ${self.toFixed(2)} ms over ${plural$1(fn.calls, "call")} (${share}%)`;
+					}).join(", ")}.` : " No tracked function ran; inlined SQL functions are part of the plan." : " Function times need `track_functions`, which this role may not set; showing the plan only.";
+					const perRow = summary.perRowSubPlans.length > 0 ? ` Per-row SubPlans: ${summary.perRowSubPlans.join(", ")}; wrap the policy's function calls in \`(select ...)\` so they run once as an InitPlan.` : "";
+					findings.push({
+						...summary.perRowSubPlans.length > 0 ? { severity: "warning" } : {},
+						message: `${qualified(table)} as ${who}: ${summary.executionMs.toFixed(2)} ms, ${plural$1(summary.initPlans, "InitPlan")}. Plan: ${summary.nodes.join(" > ")}.${perRow}${helpers}`,
+						target: `${qualified(table)}:explain`,
+						object: tableObject(table)
+					});
+				} catch (cause) {
+					findings.push({
+						severity: "warning",
+						message: `--explain ${qualified(table)} failed: ${errorText(cause)}`,
+						target: `${qualified(table)}:explain`
+					});
+				}
+			}
+			return findings;
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/hooks.ts
+/** Claims past this size make every request carry a large cookie and header. */
+const HOOK_CLAIMS_LIMIT = 2048;
+/**
+* The BS405 limits. With a provider hook budget, `doctor.claimsLimit` (else
+* the budget's bytes) limits its claims and the whole token keeps 2048;
+* without one, `doctor.claimsLimit` limits the whole token.
+*/
+function claimsLimits(context) {
+	const configured = context.config.doctor.claimsLimit;
+	const budget = providerHook(context)?.budget;
+	return budget ? {
+		token: HOOK_CLAIMS_LIMIT,
+		budget: {
+			bytes: configured ?? budget.bytes,
+			claims: budget.claims,
+			...budget.truncatedClaim ? { truncatedClaim: budget.truncatedClaim } : {}
+		}
+	} : { token: configured ?? HOOK_CLAIMS_LIMIT };
+}
+/** The module function that fills the `memberships` claim. */
+const MODULE_MEMBERSHIPS = /better_supabase\s*\.\s*membership_claims\b/i;
+const providerHook = (context) => context.config.authorization?.tokenHook;
+const splitName = (qualified) => {
+	const dot = qualified.indexOf(".");
+	return {
+		schema: qualified.slice(0, dot),
+		name: qualified.slice(dot + 1)
+	};
+};
+const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+* The claims the provider's hook writes that a second writer would
+* contradict, with the tenant claim it writes to.
+*/
+function ownedClaims(hook) {
+	return [.../* @__PURE__ */ new Set([...hook.ownedClaims, ...hook.tenantClaim ? [hook.tenantClaim] : []])];
+}
+const quotedName = (schema, name) => `(?:"?${escapeRegExp$1(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$1(name)}"?`;
+const createsFunction = (fn) => new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${quotedName(fn.schema, fn.name)}\\s*\\(`, "i");
+/** The SQL file that has the provider's hook marker and creates `fn`. */
+function markerFileFor(context, fn) {
+	const marker = providerHook(context)?.markers?.hook;
+	if (marker === void 0) return;
+	const creates = createsFunction(fn);
+	return (context.sqlFiles ?? []).find((file) => file.text.includes(marker) && creates.test(file.text));
+}
+/** Whether `fn` is the provider's hook: by its name or its marker file. */
+function isProviderHook(context, fn) {
+	const hook = providerHook(context);
+	if (!hook) return false;
+	if (hook.function === `${fn.schema}.${fn.name}`) return true;
+	return markerFileFor(context, fn) !== void 0;
+}
+/** Whether the hook body calls the provider's hook (a wrapper around it). */
+function wrapsProviderHook(hook, source) {
+	const { schema, name } = splitName(hook.function);
+	return new RegExp(`${quotedName(schema, name)}\\s*\\(`, "i").test(source);
+}
+/** Which of `claims` the hook body writes through `jsonb_set` or `jsonb_build_object`. */
+function writtenClaims(source, claims) {
+	return claims.filter((claim) => {
+		const name = escapeRegExp$1(claim);
+		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
+	});
+}
+const API_ROLES$1 = ["authenticated", "anon"];
+/** Hooks enabled in `config.toml`, matched with their introspected functions. */
+function configuredHooks(context) {
+	if (!context.configToml) return [];
+	const introspected = context.snapshot.extras.hooks ?? [];
+	return pgFunctionHooks(context.configToml.document).map((config) => ({
+		config,
+		extras: introspected.find((hook) => hook.hook === config.hook && hook.schema === config.schema && hook.name === config.name)
+	}));
+}
+function hookLocation(context, hook) {
+	if (!context.configToml) return;
+	const line = lineOf(context.configToml.text, new RegExp(`^\\s*\\[auth\\.hook\\.${hook}\\]`));
+	return line ? {
+		file: context.configToml.path,
+		line
+	} : void 0;
+}
+const signatureOf = (fn) => `${fn.schema}.${fn.name}(${fn.signature})`;
+/** What is wrong with who may call a hook function, and the SQL that fixes it. */
+function grantProblems(fn) {
+	const problems = [];
+	const fix = [];
+	if (!fn.schemaUsage.includes("supabase_auth_admin")) {
+		problems.push(`supabase_auth_admin has no usage on schema ${fn.schema}`);
+		fix.push(`grant usage on schema ${fn.schema} to supabase_auth_admin;`);
+	}
+	if (!fn.execute.includes("supabase_auth_admin")) {
+		problems.push("supabase_auth_admin may not execute it");
+		fix.push(`grant execute on function ${signatureOf(fn)} to supabase_auth_admin;`);
+	}
+	const exposedTo = API_ROLES$1.filter((role) => fn.execute.includes(role));
+	if (exposedTo.length > 0 || fn.publicExecute) {
+		const roles = [...exposedTo, ...fn.publicExecute ? ["public"] : []];
+		problems.push(`${roles.join(", ")} may execute it, so any client can call it through the API`);
+		fix.push(`revoke execute on function ${signatureOf(fn)} from authenticated, anon, public;`);
+	}
+	return {
+		problems,
+		fix
+	};
+}
+const MIGRATIONS = /(?:^|\/)supabase\/migrations\//;
+/**
+* The file that grants `fn` to `supabase_auth_admin`: a migration with the
+* provider's grants marker; under pg-delta, which carries grants, the
+* declarative schema file that defines `fn`; and without declarative schemas,
+* the migration that defines it. `supabase db diff` drops grants, so migra
+* only counts the marked migration.
+*/
+function grantsSourceFor(context, fn, workflow) {
+	const grants = new RegExp(`grant\\s+execute\\s+on\\s+function\\s+${quotedName(fn.schema, fn.name)}\\s*\\([^)]*\\)\\s*to\\s+[^;]*\\bsupabase_auth_admin\\b`, "i");
+	const creates = createsFunction(fn);
+	const marker = providerHook(context)?.markers?.grants;
+	return (context.sqlFiles ?? []).find((file) => grants.test(file.text) && (marker !== void 0 && file.text.includes(marker) || workflow === "pg-delta" && !MIGRATIONS.test(file.path) && creates.test(file.text) || workflow === "migrations" && MIGRATIONS.test(file.path) && creates.test(file.text)))?.path;
+}
+/** Configured hook functions whose grants are wrong (BS404, `doctor --fix-grants`). */
+function hookGrantProblems(context) {
+	const workflow = workflowOf(context);
+	return configuredHooks(context).flatMap(({ config, extras }) => (extras?.functions ?? []).flatMap((fn) => {
+		const { problems, fix } = grantProblems(fn);
+		if (problems.length === 0) return [];
+		const file = grantsSourceFor(context, fn, workflow);
+		const provider = context.config.authorization;
+		const command = provider?.tokenHook?.grantsCommand;
+		return [{
+			hook: config.hook,
+			fn,
+			problems,
+			fix: file ? {
+				kind: "migration",
+				file
+			} : provider && isProviderHook(context, fn) ? {
+				kind: "provider",
+				name: providerLabel(provider),
+				...command ? { command } : {}
+			} : {
+				kind: "sql",
+				sql: fix
+			}
+		}];
+	}));
+}
+/** The sentence that tells the reader how to apply `fix`. */
+function grantFixText(fix, workflow) {
+	switch (fix.kind) {
+		case "sql": return `${grantFixPlace(workflow)} (\`doctor --fix-grants\` prints every block):\n${fix.sql.join("\n")}`;
+		case "provider": return fix.command ? `It is the hook of ${fix.name}, so let the provider write the grants: \`${fix.command}\`.` : `It is the hook of ${fix.name}, so let the provider write the grants.`;
+		case "migration": return workflow === "pg-delta" ? `${fix.file} grants it, so the database is behind: run \`supabase db schema declarative sync\`, then apply the migrations (\`supabase migration up\`).` : `${fix.file} grants it, so the database is behind the migrations: apply them (\`supabase migration up\`).`;
+		default: return fix;
+	}
+}
+/** Where the grants go under `workflow`. */
+function grantFixPlace(workflow) {
+	switch (workflow) {
+		case "pg-delta": return "Add to the schema file that defines the function, then run `supabase db schema declarative sync`";
+		case "migra": return "Append to the migration `supabase db diff` wrote";
+		case "migrations": return "Add to a new migration (`supabase migration new auth_hook_grants`), then apply it (`supabase migration up`)";
+		default: return workflow;
+	}
+}
+/** `doctor --fix-grants`: the SQL block for every BS404 problem, as one migration snippet. */
+function hookGrantBlock(problems, workflow = "pg-delta") {
+	if (problems.length === 0) return "-- Every configured Auth hook function has its grants.";
+	const lines = ["-- Auth hook grants (better-supabase doctor --fix-grants).", workflow === "migra" ? "-- `supabase db diff` does not carry function grants; append this to its migration." : `-- ${grantFixPlace(workflow)}.`];
+	for (const { fn, hook, fix } of problems) {
+		const name = `${signatureOf(fn)} ([auth.hook.${hook}])`;
+		switch (fix.kind) {
+			case "sql":
+				lines.push("", `-- ${name}`, ...fix.sql);
+				break;
+			case "provider":
+				lines.push("", `-- ${name} is the hook of ${fix.name}${fix.command ? `: ${fix.command}` : ""}`);
+				break;
+			case "migration":
+				lines.push("", workflow === "pg-delta" ? `-- ${name}: ${fix.file} grants it; run \`supabase db schema declarative sync\`, then \`supabase migration up\`.` : `-- ${name}: ${fix.file} grants it; run \`supabase migration up\`.`);
+				break;
+			default: return fix;
+		}
+	}
+	return lines.join("\n");
+}
+const emptySearchPath = (fn) => {
+	const value = fn.settings["search_path"];
+	return value === "" || value === "\"\"" || value === "''";
+};
+/** Auth's issuer shape (`{url}/auth/v1`); doctor has no project URL to put in it. */
+const DOCTOR_ISSUER = "https://doctor.invalid/auth/v1";
+/**
+* Runs the hook as Auth does for `userId` (as `supabase_auth_admin` when the
+* connecting role may switch to it), in a transaction that is rolled back.
+* Undefined when `auth.users` has no such user.
+*/
+async function withHookEvent(db, userId, run) {
+	await db.query("begin");
+	try {
+		await db.query(`set local statement_timeout = '10s'`);
+		const [user] = await db.query(`select set_config('better_supabase.hook_event', jsonb_build_object(
+        'user_id', u.id,
+        'authentication_method', 'password',
+        'claims', jsonb_build_object(
+          'aud', 'authenticated', 'role', 'authenticated', 'sub', u.id,
+          'email', coalesce(u.email, ''), 'phone', coalesce(u.phone, ''),
+          'app_metadata', coalesce(u.raw_app_meta_data, '{}'::jsonb),
+          'user_metadata', coalesce(u.raw_user_meta_data, '{}'::jsonb),
+          'aal', 'aal1', 'session_id', gen_random_uuid(),
+          'is_anonymous', coalesce(u.is_anonymous, false),
+          'amr', jsonb_build_array(jsonb_build_object(
+            'method', 'password', 'timestamp', extract(epoch from now())::int8
+          )),
+          'iss', ${literal$1(DOCTOR_ISSUER)},
+          'iat', extract(epoch from now())::int8,
+          'exp', extract(epoch from now())::int8 + 3600
+        )
+      )::text, true) as event
+      from auth.users u where u.id = ${literal$1(userId)}::uuid`);
+		if (!user?.event) return;
+		const [role] = await db.query(`select case when exists(select 1 from pg_roles where rolname = 'supabase_auth_admin')
+        then pg_has_role('supabase_auth_admin', 'member') else false end as member`);
+		if (role?.member) await db.query("set local role supabase_auth_admin");
+		return await run();
+	} finally {
+		await db.query("rollback");
+	}
+}
+const hookCall = (fn) => `${ident$1(fn.schema)}.${ident$1(fn.name)}(current_setting('better_supabase.hook_event')::jsonb) -> 'claims'`;
+/** The claims the hook returns for `userId`, or undefined without that user. */
+async function hookClaims(db, fn, userId) {
+	return withHookEvent(db, userId, async () => {
+		const [row] = await db.query(`select ${hookCall(fn)} as claims`);
+		const claims = typeof row?.claims === "string" ? JSON.parse(row.claims) : row?.claims;
+		return isRecord(claims) ? claims : {};
+	});
+}
+async function hookClaimsSize(db, fn, userId, budget) {
+	const budgetSql = budget && budget.claims.length > 0 ? budget.claims.map((claim) => `coalesce(octet_length((c -> ${literal$1(claim)})::text), 0)`).join(" + ") : "0";
+	const truncatedSql = budget?.truncatedClaim ? `c ->> ${literal$1(budget.truncatedClaim)} = 'true'` : "false";
+	return withHookEvent(db, userId, async () => {
+		const [row] = await db.query(`select octet_length(c::text) as bytes,
+        octet_length((c -> 'memberships')::text) as memberships,
+        ${budgetSql} as budget,
+        ${truncatedSql} as truncated
+      from (select ${hookCall(fn)} as c) h`);
+		return {
+			bytes: Number(row?.bytes ?? 0),
+			memberships: Number(row?.memberships ?? 0),
+			budget: Number(row?.budget ?? 0),
+			truncated: row?.truncated === true
+		};
+	});
+}
+const LOCAL_HOSTS = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"[::1]",
+	"host.docker.internal"
+]);
+/** The `secrets = ...` line of `[auth.hook.<hook>]` reads an `env()` value. */
+function secretsFromEnv(text, hook) {
+	const start = text.search(new RegExp(`^\\s*\\[auth\\.hook\\.${hook}\\]`, "m"));
+	if (start < 0) return false;
+	const rest = text.slice(start).split("\n").slice(1);
+	const end = rest.findIndex((line) => /^\s*\[/.test(line));
+	const section = (end === -1 ? rest : rest.slice(0, end)).join("\n");
+	return /^\s*secrets\s*=\s*["']env\(/m.test(section);
+}
+/**
+* What is wrong with one Standard Webhooks secret (`v1,whsec_<base64>`), the
+* format Auth signs HTTP hook requests with. Never quotes the secret.
+*/
+function secretProblem(secret) {
+	const match = /^v1,whsec_([A-Za-z0-9+/]+={0,2})$/.exec(secret.trim());
+	if (!match) return "is not in the `v1,whsec_<base64>` format";
+	const bytes = atob(match[1]).length;
+	return bytes < 24 || bytes > 64 ? `decodes to ${bytes} bytes; Standard Webhooks secrets are 24 to 64` : void 0;
+}
+const HOOK_RULES = [
+	{
+		code: "BS404",
+		severity: "error",
+		title: "Auth hook function grants",
+		description: "Auth calls Postgres hook functions as `supabase_auth_admin`, which needs usage on the schema and execute on the function. Nobody else should be able to call them: a client calling the custom access token hook through the API sees what it adds for any user id.",
+		check: (context) => [...configuredHooks(context).flatMap(({ config, extras }) => {
+			if (!extras || extras.functions.length > 0) return [];
+			const location = hookLocation(context, config.hook);
+			return [{
+				message: `[auth.hook.${config.hook}] calls ${config.schema}.${config.name}, which does not exist. Sign-ins fail until it does.`,
+				target: `[auth.hook.${config.hook}]`,
+				...location ? { location } : {}
+			}];
+		}), ...hookGrantProblems(context).map(({ hook, fn, problems, fix }) => ({
+			message: `${signatureOf(fn)} ([auth.hook.${hook}]): ${problems.join("; ")}. ${grantFixText(fix, workflowOf(context))}`,
+			target: signatureOf(fn),
+			object: {
+				kind: "function",
+				schema: fn.schema,
+				name: fn.name
+			}
+		}))]
+	},
+	{
+		code: "BS405",
+		severity: "warning",
+		title: "Custom access token hook shape",
+		description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back. It warns when the whole token's claims pass ${HOOK_CLAIMS_LIMIT} bytes (\`doctor.claimsLimit\` without a provider budget). When the authorization provider's hook has a \`budget\`, it also warns when the budget's claims pass its bytes (or \`doctor.claimsLimit\`), measured with \`octet_length\` of each claim.`,
+		async check(context) {
+			const findings = [];
+			const limits = claimsLimits(context);
+			for (const { config, extras } of configuredHooks(context)) {
+				if (config.hook !== "custom_access_token" || !extras) continue;
+				for (const fn of extras.functions) {
+					const object = {
+						kind: "function",
+						schema: fn.schema,
+						name: fn.name
+					};
+					const problems = [];
+					if (fn.volatility !== "stable") problems.push(`it is ${fn.volatility}; declare it \`stable\``);
+					if (!emptySearchPath(fn)) problems.push("it has no `set search_path = ''`; add it and qualify every table");
+					if (problems.length > 0) findings.push({
+						message: `${signatureOf(fn)}: ${problems.join("; ")}.`,
+						target: signatureOf(fn),
+						object
+					});
+					if (!context.hookUser) continue;
+					const db = context.database;
+					if (!db || "skipped" in db || !db.session) {
+						findings.push({
+							severity: "info",
+							message: `Measuring the hook's claims needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
+							target: `${signatureOf(fn)}:claims`
+						});
+						continue;
+					}
+					try {
+						const size = await hookClaimsSize(db, fn, context.hookUser, limits.budget);
+						if (size === void 0) {
+							findings.push({
+								severity: "info",
+								message: `--as ${context.hookUser}: no such user in auth.users, so the hook was not called.`,
+								target: `${signatureOf(fn)}:claims`
+							});
+							continue;
+						}
+						if (limits.budget !== void 0 && size.budget > limits.budget.bytes) findings.push({
+							message: `${signatureOf(fn)} returns ${size.budget} bytes of ${limits.budget.claims.join(" and ")} for ${context.hookUser}, over the hook's budget of ${limits.budget.bytes}. Raise the provider's budget and \`doctor.claimsLimit\` together, or move claims out of the token.`,
+							target: `${signatureOf(fn)}:budget`,
+							object
+						});
+						if (size.bytes > limits.token) findings.push({
+							message: `${signatureOf(fn)} returns ${size.bytes} bytes of claims for ${context.hookUser} (limit ${limits.token}, memberships ${size.memberships}). Every request carries them twice (cookie and header); keep ids and roles in the token and look up the rest.`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+						if (size.truncated) findings.push({
+							severity: "info",
+							message: `${signatureOf(fn)} sets ${limits.budget?.truncatedClaim ?? "its truncated claim"} for ${context.hookUser}: the token lists only some entries (memberships ${size.memberships} bytes). Server checks for this user need a database lookup.`,
+							target: `${signatureOf(fn)}:truncated`,
+							object
+						});
+					} catch (cause) {
+						findings.push({
+							message: `Calling ${signatureOf(fn)} for ${context.hookUser} failed: ${errorText(cause)}`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+					}
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS407",
+		severity: "error",
+		title: "Two authorization hooks",
+		description: "When the authorization provider's hook (`authorization.tokenHook`) owns claims such as `memberships`, `roles` or the tenant claim, a custom access token hook that also calls `better_supabase.membership_claims`, or writes one of those claims itself, gives them a second source that drifts from the provider's. Use the provider's hook and drop the extra writes. Claims the provider's hook fills from other functions (`registeredClaims`, such as `features` from `better_supabase.feature_claims`) are not reported; a hook that wraps the provider's and writes one of those claims again is.",
+		check: (context) => {
+			const provider = context.config.authorization;
+			const hook = provider?.tokenHook;
+			if (!provider || !hook) return [];
+			const label = providerLabel(provider);
+			const registered = new Map((hook.registeredClaims ?? []).map((claim) => [claim.name, claim.function]));
+			const owned = ownedClaims(hook);
+			const findings = [];
+			for (const { config, extras } of configuredHooks(context)) {
+				if (config.hook !== "custom_access_token" || !extras) continue;
+				for (const fn of extras.functions) {
+					if (fn.source === void 0 || isProviderHook(context, fn)) continue;
+					const module = owned.includes("memberships") && MODULE_MEMBERSHIPS.test(fn.source);
+					const wrapper = wrapsProviderHook(hook, fn.source);
+					const written = writtenClaims(fn.source, [...owned, ...wrapper ? registered.keys() : []]);
+					if (!module && written.length === 0) continue;
+					const location = hookLocation(context, config.hook);
+					const what = [...module ? ["calls better_supabase.membership_claims"] : [], ...written.length > 0 ? [`writes ${written.join(", ")}`] : []].join(" and ");
+					const extra = written.filter((claim) => registered.has(claim));
+					const sources = extra.map((claim) => `${claim} from ${registered.get(claim)}`).join(", ");
+					findings.push({
+						message: `${signatureOf(fn)} ${what}, but the hook of ${label} (${hook.function}) owns those claims${extra.length > 0 ? ` (it already writes ${sources})` : ""}. Keep one source: use the provider's hook and remove these writes from yours.`,
+						target: signatureOf(fn),
+						object: {
+							kind: "function",
+							schema: fn.schema,
+							name: fn.name
+						},
+						...location ? { location } : {}
+					});
+				}
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS410",
+		severity: "warning",
+		title: "HTTP auth hooks",
+		description: "Auth calls an `http://` or `https://` hook with a request signed by the Standard Webhooks secret in `secrets` (`v1,whsec_<base64>`, several joined with `|`). Doctor can't read the endpoint's code, so it reports each HTTP hook and checks what it can: the secret's format, that it comes from `env()` rather than the committed file, and that a non-local endpoint uses https. Verify the request in the endpoint with `authHook` from `better-supabase/blocks/webhooks`.",
+		check: (context) => {
+			const toml = context.configToml;
+			if (!toml) return [];
+			return httpHooks(toml.document).flatMap(({ hook, uri, secrets }) => {
+				const location = hookLocation(context, hook);
+				const at = location ? { location } : {};
+				const target = `[auth.hook.${hook}]`;
+				const findings = [{
+					severity: "info",
+					message: `${target} calls ${uri.origin}${uri.pathname} over HTTP. Doctor can't check its code; verify the signature there with authHook from better-supabase/blocks/webhooks.`,
+					target,
+					...at
+				}];
+				if (uri.protocol === "http:" && !LOCAL_HOSTS.has(uri.hostname)) findings.push({
+					message: `${target} sends claims and its signature to ${uri.host} over plain http. Use https.`,
+					target,
+					...at
+				});
+				const fromEnv = secretsFromEnv(toml.text, hook);
+				if (secrets === void 0 || secrets.trim() === "") {
+					findings.push({
+						severity: "error",
+						message: `${target} has no \`secrets\`, so Auth can't sign its requests. Set \`secrets = "env(AUTH_HOOK_SECRET)"\` with a \`v1,whsec_<base64>\` value.`,
+						target,
+						...at
+					});
+					return findings;
+				}
+				if (!fromEnv) findings.push({
+					message: `${target} has its secret written in ${toml.path}, which is committed. Move it to an env file and read it with \`secrets = "env(AUTH_HOOK_SECRET)"\`.`,
+					target,
+					...at
+				});
+				if (fromEnv && secrets.trim().startsWith("env(")) return findings;
+				const problems = secrets.split("|").flatMap((secret, index) => {
+					const problem = secretProblem(secret);
+					return problem ? [`secret ${index + 1} ${problem}`] : [];
+				});
+				if (problems.length > 0) findings.push({
+					severity: "error",
+					message: `${target}: ${problems.join("; ")}. Auth rejects the config; generate one with \`openssl rand -base64 32\` and prefix it with \`v1,whsec_\`.`,
+					target,
+					...at
+				});
+				return findings;
+			});
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/lite.ts
+const RPC_CALL = /(?:\.|\$)rpc\s*\(|\brpcTransport\s*\(/;
+const MISSING_FEATURES = [{
+	feature: "Realtime",
+	pattern: /from\s+["']better-supabase\/realtime["']|\.channel\s*\(|\.removeChannel\s*\(/
+}, {
+	feature: "Edge Functions",
+	pattern: /\.functions\.invoke\s*\(|\bfunctions\(\)\.invoke\s*\(/
+}];
+/** The `[db] driver` of a Supabase Lite project, or `undefined` for any other project. */
+function liteDriver(context) {
+	try {
+		return liteDriverOf(context.configToml);
+	} catch {
+		return;
+	}
+}
+function rpcOnSqlite(context) {
+	const driver = liteDriver(context);
+	if (driver === void 0 || !isSqliteLiteDriver(driver)) return [];
+	return context.sources.flatMap((file) => {
+		const line = lineOf(file.text, RPC_CALL);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} calls a Postgres function, but Supabase Lite's ${driver} driver has no rpc(), so the call returns an unsupported error. Switch [db] driver to "pglite" or "postgres" in supabase/config.toml, or replace the function with table queries.`,
+			target: `${file.path}:rpc`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	});
+}
+function missingLiteFeature(context) {
+	if (liteDriver(context) === void 0) return [];
+	return context.sources.flatMap((file) => MISSING_FEATURES.flatMap(({ feature, pattern }) => {
+		const line = lineOf(file.text, pattern);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} uses ${feature}, which Supabase Lite does not implement on any driver. Run the full Supabase stack for this feature, or move the project off Lite with \`supabase lite upgrade\`.`,
+			target: `${file.path}:${feature}`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	}));
+}
+const LITE_RULES = [{
+	code: "BS328",
+	severity: "warning",
+	title: "rpc() on a Supabase Lite SQLite driver",
+	description: "`[db] driver` in `config.toml` is `sqlite-postgres` or `sqlite`, which have no `rpc()`, but the app calls a Postgres function. Those calls return an `unsupported` error.",
+	check: rpcOnSqlite
+}, {
+	code: "BS329",
+	severity: "warning",
+	title: "Feature Supabase Lite does not implement",
+	description: "`config.toml` sets `[db] driver`, so the project runs on Supabase Lite, but the app uses Realtime or Edge Functions, which Lite does not implement.",
+	check: missingLiteFeature
+}];
+//#endregion
+//#region src/cli/doctor/metadata.ts
+/**
+* Rules that read what a `GeneratorMetadata` document leaves out (policies,
+* grants, indexes, triggers, buckets, the realtime publication, foreign key
+* actions, multi-column constraints, role settings, hook functions). On a
+* snapshot built from such a document they would report what is missing
+* from the document, not from the database, so they skip with an info finding.
+*/
+const EXTRAS_RULES = /* @__PURE__ */ new Set([
+	"BS103",
+	"BS106",
+	"BS107",
+	"BS108",
+	"BS109",
+	"BS110",
+	"BS111",
+	"BS112",
+	"BS113",
+	"BS114",
+	"BS115",
+	"BS116",
+	"BS117",
+	"BS204",
+	"BS205",
+	"BS206",
+	"BS207",
+	"BS210",
+	"BS211",
+	"BS224",
+	"BS213",
+	"BS215",
+	"BS216",
+	"BS217",
+	"BS218",
+	"BS219",
+	"BS301",
+	"BS302",
+	"BS303",
+	"BS305",
+	"BS306",
+	"BS337",
+	"BS338",
+	"BS340",
+	"BS310",
+	"BS315",
+	"BS404",
+	"BS405",
+	"BS406",
+	"BS407"
+]);
+/** The info finding for a rule in `EXTRAS_RULES` that did not run, or `undefined` when it can. */
+function skippedForMetadata(snapshot, rule, help) {
+	if (!snapshot.extras.fromMetadata || !EXTRAS_RULES.has(rule.code)) return;
+	return {
+		code: rule.code,
+		severity: "info",
+		title: rule.title,
+		help,
+		message: `Skipped: the schema came from a GeneratorMetadata document (--metadata), which has no ${METADATA_GAPS_TEXT}. Run doctor against the database to run this check.`
+	};
+}
+//#endregion
+//#region src/cli/doctor/module-files.ts
+/** The `blocks` files as this release renders them, next to what is on disk. */
+async function moduleFiles(context) {
+	if (context.config.blockNames.length === 0 && Object.keys(context.config.appTables).length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind === "invalid") return [];
+	const readSets = context.readSets;
+	const skipped = readSets !== void 0 && "skipped" in readSets;
+	let rendered;
+	try {
+		rendered = renderModules(context.config.blockNames, await moduleLayoutFor(context.config, {
+			names: context.config.blockNames,
+			testsDir: context.config.sql.testsDir,
+			readSets: skipped ? [] : readSets,
+			entitlementsProvider: entitlementsModule(context),
+			accessProvider: access.kind === "provider" ? access.access : void 0,
+			permissionCatalog: permissionCatalogKeys(context)
+		}));
+	} catch {
+		return [];
+	}
+	const files = rendered.filter((file) => !(skipped && file.module === "read-sets"));
+	if (workflowOf(context) === "migrations") {
+		const latest = await latestMigration(context.config, MODULES_SUFFIX);
+		const versions = migrationModules(latest?.text ?? "");
+		const path = latest?.path ?? `${migrationsDir(context.config)}/<stamp>_better_supabase_modules.sql`;
+		return Promise.all(files.map(async (file) => {
+			if (file.kind === "test") return fileState(context, file);
+			const installed = versions.get(file.module);
+			return {
+				file,
+				path,
+				installed,
+				current: latest === void 0 ? void 0 : migrationHolds(latest.text, file.contents) ? file.contents : latest.text,
+				behind: file.kind === "schema" && installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+			};
+		}));
+	}
+	return Promise.all(files.map((file) => fileState(context, file)));
+}
+async function fileState(context, file) {
+	const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
+	const installed = current === void 0 ? void 0 : moduleFileVersion(current)?.version ?? 1;
+	return {
+		file,
+		path: file.path,
+		current,
+		installed,
+		behind: installed !== void 0 && installed < (moduleFileVersion(file.contents)?.version ?? 1)
+	};
+}
+//#endregion
+//#region src/cli/doctor/modules.ts
+/** The non-empty string at a dotted path, as the tenant() plugin reads it. */
+function claimAt(claims, path) {
+	let value = claims;
+	for (const segment of path.split(".")) value = isRecord(value) ? value[segment] : void 0;
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function contractChecks(context) {
+	return customContracts(context.config.blockNames, moduleLayout(context.config, context.config.sql.testsDir, [], void 0, void 0, permissionCatalogKeys(context))).flatMap((contract) => contract.functions.map((fn) => ({
+		module: contract.module,
+		schema: contract.schema,
+		name: fn.name,
+		args: contractSignature(fn, contract.idType),
+		returns: fn.returns.replaceAll("{id}", contract.idType)
+	})));
+}
+const escapeRegExp = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const ident = (name) => `"?${escapeRegExp(name)}"?`;
+/** Whether a `create function schema.name(` appears in the SQL files. */
+function declared(context, check) {
+	const pattern = new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${ident(check.schema)}\\.${ident(check.name)}\\s*\\(`, "i");
+	return (context.sqlFiles ?? []).some((file) => pattern.test(file.text));
+}
+const normalize$1 = (types) => types.replaceAll(/\s+/g, " ").replaceAll(/\s*,\s*/g, ", ").trim();
+const PRE_REQUEST_HOOK = `select h.hook,
+  coalesce(pg_catalog.strpos(pg_catalog.pg_get_functiondef(pg_catalog.to_regproc(h.hook)), 'better_supabase.check_request') > 0, false) as calls
+from (
+  select (
+    select pg_catalog.split_part(setting, '=', 2)
+    from pg_catalog.pg_db_role_setting s
+    join pg_catalog.pg_roles r on r.oid = s.setrole
+    cross join lateral pg_catalog.unnest(s.setconfig) setting
+    where r.rolname = 'authenticator' and s.setdatabase = 0
+      and setting like 'pgrst.db_pre_request=%'
+    limit 1
+  ) as hook
+) h`;
+/** `rate-limit` in `blocks` without PostgREST's pre-request hook reaching `check_request()`. */
+async function rateLimitHook(context) {
+	const db = context.database;
+	if (!context.config.blockNames.includes("rate-limit") || context.config.blocks["rate-limit"]?.options?.["preRequest"] === false || !db || "skipped" in db) return [];
+	let rows;
+	try {
+		rows = await db.query(PRE_REQUEST_HOOK);
+	} catch {
+		return [];
+	}
+	const [row] = rows;
+	if (!row || row.hook === "better_supabase.check_request" || row.calls) return [];
+	return [{
+		message: row.hook === null ? "pgrst.db_pre_request isn't set for authenticator, so better_supabase.check_request() never runs. Apply the migration `better-supabase sql data` writes, which sets it." : `pgrst.db_pre_request is ${row.hook}, which doesn't call better_supabase.check_request(), so rate limits never apply. Call it from ${row.hook}.`,
+		target: "authenticator pgrst.db_pre_request"
+	}];
+}
+const DANGLING_AUDIT = `select a.target::oid::text as oid
+from better_supabase.audited_tables a
+where pg_catalog.to_regclass('better_supabase.audited_tables') is not null
+  and not exists (select 1 from pg_catalog.pg_class c where c.oid = a.target::oid)
+order by 1`;
+/** `better_supabase.audited_tables` rows whose table no longer exists. */
+async function danglingAuditRegistrations(context) {
+	const db = context.database;
+	if (!context.config.blockNames.includes("audit") || !db || "skipped" in db) return [];
+	let rows;
+	try {
+		rows = await db.query(DANGLING_AUDIT);
+	} catch {
+		return [];
+	}
+	return rows.map((row) => ({
+		message: `better_supabase.audited_tables registers the table with oid ${row.oid}, which no longer exists. It was dropped before the audit module's sql_drop event trigger was installed. Run \`better-supabase sql sync\` and apply the migration \`better-supabase sql data\` writes, which deletes such rows, or run \`delete from better_supabase.audited_tables where not exists (select 1 from pg_catalog.pg_class c where c.oid = target::oid)\`.`,
+		target: `better_supabase.audited_tables ${row.oid}`
+	}));
+}
+/** Tables and columns adopt-mode modules use that the live database lacks. */
+async function missingAdoptedColumns(context) {
+	const db = context.database;
+	if (!db || "skipped" in db) return [];
+	const tables = adoptedTables(context.config.blocks);
+	if (tables.length === 0) return [];
+	const names = tables.map((table) => `(${literal$1(table.schema)}, ${literal$1(table.table)})`).join(", ");
+	let rows;
+	try {
+		rows = await db.query(`select table_schema as schema, table_name as name, column_name as column
+      from information_schema.columns
+      where (table_schema, table_name) in (${names})`);
+	} catch {
+		return [];
+	}
+	return tables.flatMap((table) => {
+		const target = `${table.schema}.${table.table}`;
+		const object = {
+			kind: "table",
+			schema: table.schema,
+			name: table.table
+		};
+		const present = new Set(rows.filter((row) => row.schema === table.schema && row.name === table.table).map((row) => row.column));
+		if (present.size === 0) return [{
+			message: `blocks.${table.module} is in adopt mode and maps its ${table.logical} table to ${target}, which the database does not have. Create it, or point blocks.${table.module}.tables.${table.logical} at the existing table.`,
+			target,
+			object
+		}];
+		return Object.entries(table.columns).filter(([, column]) => !present.has(column)).map(([logical, column]) => ({
+			message: `blocks.${table.module} is in adopt mode and uses ${target}.${column} (${table.logical}.${logical}), but the table has no such column. Map blocks.${table.module}.columns.${table.logical}.${logical} to the column that holds it, or to null when the module allows that.`,
+			target: `${target}.${column}`,
+			object
+		}));
+	});
+}
+const EVENT_TRIGGER_FIX = "Event triggers belong to no schema, so a schema diff limited to some schemas (`supabase db schema declarative sync -s ...`) leaves them out of the migration. Run `better-supabase sql sync`, then `better-supabase sql data`: the module's data migration creates it.";
+/** Event triggers the `blocks` create that the database, or every migration, lacks. */
+async function missingEventTriggers(context) {
+	const expected = moduleEventTriggers(context.config.blockNames);
+	if (expected.length === 0) return [];
+	const db = context.database;
+	if (db && !("skipped" in db)) {
+		let rows;
+		try {
+			rows = await db.query("select evtname as name from pg_catalog.pg_event_trigger");
+		} catch {
+			return [];
+		}
+		const present = new Set(rows.map((row) => row.name));
+		return expected.filter((trigger) => !present.has(trigger.name)).map((trigger) => ({
+			message: `The database has no event trigger ${trigger.name}, which the ${trigger.module} module creates. ${EVENT_TRIGGER_FIX}`,
+			target: trigger.name
+		}));
+	}
+	const toml = context.configToml;
+	if (toml === void 0) return [];
+	const migrations = (context.sqlFiles ?? []).filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	return expected.filter((trigger) => {
+		const pattern = new RegExp(`create\\s+event\\s+trigger\\s+${ident(trigger.name)}\\s`, "i");
+		return !migrations.some((file) => pattern.test(file.text));
+	}).map((trigger) => ({
+		message: `No migration creates the event trigger ${trigger.name}, which the ${trigger.module} module creates, so a database built from the migrations lacks it. ${EVENT_TRIGGER_FIX}`,
+		target: trigger.name
+	}));
+}
+/** Custom-mode modules whose contract functions the database or SQL files don't have. */
+async function missingContracts(context) {
+	const checks = contractChecks(context);
+	if (checks.length === 0) return [];
+	const db = context.database;
+	const live = db && !("skipped" in db) ? db : void 0;
+	if (!live) return checks.filter((check) => !declared(context, check)).map((check) => ({
+		message: `blocks.${check.module} is in custom mode, but no SQL file declares ${check.schema}.${check.name}(${check.args}). Write it, or switch the module to adopt or managed.`,
+		target: `${check.schema}.${check.name}`,
+		object: {
+			kind: "function",
+			schema: check.schema,
+			name: check.name
+		}
+	}));
+	const names = checks.map((check) => `(${literal$1(check.schema)}, ${literal$1(check.name)})`).join(", ");
+	let rows;
+	try {
+		rows = await live.query(`select n.nspname as schema, p.proname as name,
+        oidvectortypes(p.proargtypes) as args,
+        format_type(p.prorettype, null) as returns
+      from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+      where (n.nspname, p.proname) in (${names})`);
+	} catch (cause) {
+		return [{
+			severity: "info",
+			message: `Reading the custom module contract functions failed: ${errorText(cause)}`,
+			target: "modules"
+		}];
+	}
+	return checks.flatMap((check) => {
+		const found = rows.filter((row) => row.schema === check.schema && row.name === check.name);
+		const target = `${check.schema}.${check.name}`;
+		const object = {
+			kind: "function",
+			schema: check.schema,
+			name: check.name
+		};
+		if (found.length === 0) return [{
+			message: `blocks.${check.module} is in custom mode, but ${target}(${check.args}) doesn't exist. Write it, or switch the module to adopt or managed.`,
+			target,
+			object
+		}];
+		const match = found.find((row) => normalize$1(row.args) === normalize$1(check.args));
+		if (!match) return [{
+			message: `${target} takes (${found.map((row) => row.args).join(" | ")}); the ${check.module} contract calls it with (${check.args}).`,
+			target,
+			object
+		}];
+		if (normalize$1(match.returns) !== normalize$1(check.returns)) return [{
+			message: `${target}(${check.args}) returns ${match.returns}; the ${check.module} contract expects ${check.returns}.`,
+			target,
+			object
+		}];
+		return [];
+	});
+}
+/** With the tenant claim as the active tenant, the hook must put it in the token. */
+async function missingTenantClaim(context) {
+	if (!context.config.blockNames.includes("tenant")) return [];
+	if ((context.config.blocks.access?.activeTenant ?? DEFAULT_ACTIVE_TENANT) !== "claim") return [];
+	const userId = context.hookUser;
+	const db = context.database;
+	if (!userId || !db || "skipped" in db || !db.session) return [];
+	const claim = context.config.claims.tenant;
+	const findings = [];
+	for (const { config, extras } of configuredHooks(context)) {
+		if (config.hook !== "custom_access_token" || !extras) continue;
+		for (const fn of extras.functions) {
+			const target = `${signatureOf(fn)}:${claim}`;
+			let claims;
+			try {
+				claims = await hookClaims(db, fn, userId);
+			} catch {
+				continue;
+			}
+			if (claims === void 0) continue;
+			if (tenantClaimPaths(claim).some((path) => claimAt(claims, path) !== void 0)) continue;
+			findings.push({
+				message: `${signatureOf(fn)} returns no \`${claim}\` claim for ${userId} (top level or app_metadata), and blocks.access.activeTenant is 'claim', so current_tenant_id() is null and the tenant() plugin rejects their requests. Write the claim in the hook, or set blocks.access.activeTenant to 'resolver' (with ServerOptions.tenant) or a profile column.`,
+				target,
+				object: {
+					kind: "function",
+					schema: fn.schema,
+					name: fn.name
+				}
+			});
+		}
+	}
+	return findings;
+}
+/** Where a deprecated symbol is used: a call, a qualified name or a claim lookup. */
+function deprecationPattern(entry) {
+	const [first = "", second] = entry.symbol.split(".");
+	const qualified = second === void 0 ? ident(first) : `${ident(first)}\\.${ident(second)}`;
+	switch (entry.kind) {
+		case "function": return new RegExp(`${qualified}\\s*\\(`, "i");
+		case "table":
+		case "column": return new RegExp(`(?<![\\w."])${qualified}(?![\\w"])`, "i");
+		case "claim": {
+			const name = escapeRegExp(entry.symbol);
+			return new RegExp(`->>?\\s*'${name}'|#>>?\\s*'\\{[^}]*\\b${name}\\b[^}]*\\}'`, "i");
+		}
+		default: {
+			const never = entry.kind;
+			throw new TypeError(`Unknown deprecation kind ${String(never)}`);
+		}
+	}
+}
+const bareWord = (name) => new RegExp(`(?<![\\w"])${ident(name)}(?![\\w"])`, "i");
+/**
+* The line where `text` uses a deprecated symbol. A column also counts
+* unqualified (`m.org_id`) in a statement that names its table, or in a
+* policy on that table.
+*/
+function lineOfUse(entry, text, policyTable) {
+	const direct = lineOf(text, deprecationPattern(entry));
+	if (direct !== void 0 || entry.kind !== "column") return direct;
+	const [table = "", column = ""] = entry.symbol.split(".");
+	let offset = 0;
+	for (const statement of text.split(";")) {
+		const named = policyTable === table || bareWord(table).test(statement);
+		const at = statement.search(bareWord(column));
+		if (named && at !== -1) return text.slice(0, offset + at).split("\n").length;
+		offset += statement.length + 1;
+	}
+}
+/** SQL files and policies that still use a symbol a SQL module deprecated or removed. */
+function deprecatedSymbols(context) {
+	const configured = new Set(Object.values(context.config.claims));
+	const entries = moduleDeprecations().filter((entry) => context.config.blockNames.includes(entry.module) && !(entry.kind === "claim" && configured.has(entry.symbol)) && !((entry.kind === "table" || entry.kind === "column") && (context.config.blocks[entry.module]?.mode ?? "managed") !== "managed"));
+	if (entries.length === 0) return [];
+	const files = (context.sqlFiles ?? []).filter((file) => !/(^|\/)supabase\/migrations\//.test(file.path) && moduleFileVersion(file.text) === void 0);
+	const findings = [];
+	for (const entry of entries) {
+		const status = entry.removed === void 0 ? `deprecated since ${entry.since}` : `removed in ${entry.removed}`;
+		const advice = `the ${entry.module} module's ${entry.kind} ${entry.symbol}, ${status}. Use ${entry.use}.`;
+		for (const file of files) {
+			const line = lineOfUse(entry, file.text);
+			if (line === void 0) continue;
+			findings.push({
+				message: `${file.path} uses ${advice}`,
+				target: `${file.path}:${entry.symbol}`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+		}
+		for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+			if (lineOfUse(entry, `${policy.using ?? ""}\n${policy.check ?? ""}`, table.name) === void 0) continue;
+			findings.push({
+				message: `Policy "${policy.name}" on ${qualified(table)} uses ${advice}`,
+				target: `${qualified(table)}.${policy.name}:${entry.symbol}`,
+				object: policyObject(table, policy)
+			});
+		}
+	}
+	return findings;
+}
+/** Module triggers and the equivalent triggers they replace. */
+const EQUIVALENT_TRIGGERS = [{
+	trigger: "bs_updated_at",
+	call: "track_updated_at",
+	pattern: /updated_at|moddatetime|touch/i
+}, {
+	trigger: "bs_audit",
+	call: "audit",
+	pattern: /audit/i
+}];
+/** Tables where a module trigger and an older trigger do the same work. */
+function duplicateTriggers(context) {
+	return catalogOf(context).tables.flatMap((table) => EQUIVALENT_TRIGGERS.flatMap(({ trigger, call, pattern }) => {
+		if (!table.triggers.some((entry) => entry.name === trigger)) return [];
+		return table.triggers.filter((entry) => entry.name !== trigger && pattern.test(entry.function.split(".").at(-1) ?? "")).map((entry) => ({
+			message: `${qualified(table)} has ${trigger} and ${entry.name} (${entry.function}), so both run on every write. Drop ${entry.name}, or run \`select better_supabase.${call}('${qualified(table)}', replace_trigger => true)\` in a migration.`,
+			target: `${qualified(table)}.${entry.name}`,
+			object: tableObject(table)
+		}));
+	}));
+}
+/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
+const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp).join(".*")}$`, "i"));
+/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
+function moduleOwned(context) {
+	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const module of Object.values(context.config.blocks)) {
+		if (module?.schema !== void 0) schemas.add(module.schema);
+		for (const table of Object.values(module?.tables ?? {})) {
+			if (table === null) continue;
+			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
+		}
+	}
+	return {
+		schemas,
+		tables
+	};
+}
+/** Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is in `blocks`. */
+function unauditedTables(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const exempt = globs(context.config.blocks["audit"]?.options?.["exempt"]);
+	const owned = moduleOwned(context);
+	return catalogOf(context).tables.filter((table) => table.kind === "table" && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name === "bs_audit" || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
+		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+}
+/** RLS tables in `config.schemas` without a restrictive `session_active()` policy, when `sessions` is in `blocks`. */
+function sessionlessTables(context) {
+	if (!context.config.blockNames.includes("sessions")) return [];
+	const exclude = globs(context.config.blocks["sessions"]?.options?.["exclude"]);
+	const owned = moduleOwned(context);
+	return catalogOf(context).tables.filter((table) => table.kind === "table" && table.rls && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exclude.some((pattern) => pattern.test(qualified(table))) && !table.policies.some((policy) => !policy.permissive && `${policy.using ?? ""} ${policy.check ?? ""}`.includes("session_active()"))).map((table) => ({
+		message: `${qualified(table)} has no restrictive session_active() policy, so a signed-out or revoked session keeps its access until the token expires. Set blocks.sessions.options.policies to true and run \`better-supabase sql sync\`, add the policy by hand, or list the table in blocks.sessions.options.exclude.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+}
+/** `better_supabase` and every `blocks.*.schema` that `[api] schemas` serves through the Data API. */
+function exposedModuleSchemas(context) {
+	if (context.config.blockNames.length === 0) return [];
+	const moduleSchemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	for (const module of Object.values(context.config.blocks)) if (module?.schema !== void 0) moduleSchemas.add(module.schema);
+	return exposedSchemas(context).filter((schema) => moduleSchemas.has(schema)).map((schema) => ({
+		message: `The Data API serves the module schema ${schema}, so its tables and internal helpers are reachable over REST and RPC. Remove it from [api] schemas in supabase/config.toml (and the dashboard's exposed schemas), set blocks.<module>.api to an exposed schema such as "api" so \`better-supabase add\` writes security invoker entry points there, and call them with rpcTransport(supabase, { schema: "api" }).`,
+		target: schema
+	}));
+}
+function migrationOptions(context) {
+	const module = new Set(context.config.blockNames);
+	return migrationOptionUses(context.config.blocks).filter((use) => module.has(use.module)).map((use) => ({
+		message: `${use.message} It exists to adopt an existing schema; remove it once your data matches the managed default.`,
+		target: `blocks.${use.module}.options.${use.option}`
+	}));
+}
+/** A roles table shared by tenant and platform roles without `where` on both sides. */
+function sharedRoleTables(context) {
+	if (context.config.blockNames.length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind !== "provider") return [];
+	let problems;
+	try {
+		problems = sharedRolesProblems(context.config.blockNames, moduleLayout(context.config, context.config.sql.testsDir, [], entitlementsModule(context), access.access, permissionCatalogKeys(context)));
+	} catch {
+		return [];
+	}
+	return problems.map(({ setting, message }) => ({
+		message: `${message} Without it, ${setting.startsWith("blocks.tenant.") ? "an organization invitation, accept or role change can resolve a platform role" : "a platform invitation can resolve a tenant role"}.`,
+		target: setting
+	}));
+}
+const MODULE_RULES = [
+	{
+		code: "BS307",
+		severity: "error",
+		title: "Custom SQL module without its contract",
+		description: "A module in `blocks` uses `mode: 'custom'`, so the app writes its contract functions. One is missing or has another signature, and the modules and TypeScript APIs that call it fail at run time.",
+		check: missingContracts
+	},
+	{
+		code: "BS308",
+		severity: "warning",
+		title: "Tenant claim the hook does not write",
+		description: "With the `tenant` module and `blocks.access.activeTenant: 'claim'`, `current_tenant_id()` and the `tenant()` plugin read the tenant from the `claims.tenant` claim, at the top level or in `app_metadata`. With `--as <user id>` doctor calls the custom access token hook for that user and warns when the claims it returns have neither. The default source, `'resolver'`, takes the tenant from the request instead.",
+		check: missingTenantClaim
+	},
+	{
+		code: "BS309",
+		severity: "warning",
+		title: "Deprecated SQL module symbol",
+		description: "A schema file or policy uses a function, table, column or claim that a SQL module deprecated or removed. Deprecated symbols keep a wrapper for at least one minor release; removed ones fail at run time.",
+		check: deprecatedSymbols
+	},
+	{
+		code: "BS310",
+		severity: "warning",
+		title: "Duplicate module trigger",
+		description: "A table has a module trigger (`bs_updated_at`, `bs_audit`) and another trigger that does the same work, so both run on every write.",
+		check: duplicateTriggers
+	},
+	{
+		code: "BS313",
+		severity: "warning",
+		title: "Rate limits not wired to PostgREST",
+		description: "The `rate-limit` module is in `blocks`, but on the live database `pgrst.db_pre_request` for the `authenticator` role is unset or names a function that doesn't call `better_supabase.check_request()`, so Data API requests are never counted.",
+		check: rateLimitHook
+	},
+	{
+		code: "BS312",
+		severity: "error",
+		title: "Module schema exposed through the Data API",
+		description: "`[api] schemas` in `config.toml` lists `better_supabase` or a `blocks.*.schema`. The module schemas hold internal tables and helpers that are granted to `authenticated` for policies, so exposing them makes those callable over REST and RPC.",
+		check: exposedModuleSchemas
+	},
+	{
+		code: "BS314",
+		severity: "warning",
+		title: "Migration-only module option",
+		description: "A module in adopt mode sets an option that only exists to match an existing schema: plain invitation tokens, webhook secrets or credentials in a column, non-text webhook ids, a custom outbox source, or audit values mapped to an adopted log's. Remove it once the data matches the managed default.",
+		check: migrationOptions
+	},
+	{
+		code: "BS315",
+		severity: "warning",
+		title: "Table without an audit trigger",
+		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `schema.table` globs such as `public.*_archive`.",
+		check: unauditedTables
+	},
+	{
+		code: "BS319",
+		severity: "error",
+		title: "SQL alters a reserved role",
+		description: "A schema file, SQL module or migration alters, drops or changes the memberships of a role supautils reserves on Supabase (`supabase_admin`, `supabase_auth_admin`, `supabase_storage_admin`, `pgbouncer` and the other platform roles). The statement fails on a hosted project. `authenticator`, `authenticated`, `anon` and `service_role` accept `alter role ... set` (for example `pgrst.db_pre_request` or `statement_timeout`) and nothing else.",
+		check: reservedRoles
+	},
+	{
+		code: "BS320",
+		severity: "warning",
+		title: "Table without the session policy",
+		description: "The `sessions` module is in `blocks`, and a table with RLS in `schemas` has no restrictive policy that calls `better_supabase.session_active()`, so a token whose session was signed out, or whose user was banned or deleted, keeps reaching it until it expires. `blocks.sessions.options.policies` writes the policy on every table; `options.exclude` lists the tables to skip, as `schema.table` globs.",
+		check: sessionlessTables
+	},
+	{
+		code: "BS322",
+		severity: "warning",
+		title: "Audit registration of a dropped table",
+		description: "The `audit` module is in `blocks`, and `better_supabase.audited_tables` on the live database has a row whose table no longer exists. A table dropped before the module's `sql_drop` event trigger was installed keeps its row; the module's data migration deletes such rows.",
+		check: danglingAuditRegistrations
+	},
+	{
+		code: "BS323",
+		severity: "warning",
+		title: "Module event trigger missing",
+		description: "A module in `blocks` creates an event trigger (`bs_audit_forget_dropped` for `audit`, `bs_ensure_rls` for `ensure-rls`) that the live database lacks, or, without a database, that no migration creates. Event triggers belong to no schema, so a schema diff limited to some schemas leaves them out; the module's data migration creates them.",
+		check: missingEventTriggers
+	},
+	{
+		code: "BS324",
+		severity: "error",
+		title: "Shared roles table without a role condition",
+		description: "Under the `provider` model, the tenant module's `roleThrough` and the invitations module's `platformRoles.through` name the same roles table, and one of them has no `where` condition on `{row}`. That side then resolves a role id or key of the other kind: an organization invitation, accept or `update_member_role` can grant a platform role, or a platform invitation a tenant role. `sql sync` refuses the config; set `where` on both, such as `{row}.scope = 'organization'` and `{row}.scope = 'system'`.",
+		check: sharedRoleTables
+	},
+	{
+		code: "BS325",
+		severity: "warning",
+		title: "Audit log readable only as the service role",
+		description: "The `audit` module defaults `eventRoles` to `service_role` and `readPolicy` to false, so `audit.list()` under a user session is 403. Set `options.readPolicy: true` and include `authenticated` in `options.eventRoles` when the app lists the log as the signed-in user.",
+		check: auditUserSession
+	},
+	{
+		code: "BS326",
+		severity: "warning",
+		title: "Admin Auth call without a secret key in env files",
+		description: "`deleteAccount` and `bs.admin()` need `SUPABASE_SECRET_KEY`. The env files doctor reads do not set it, so those calls fail at run time.",
+		check: missingSecretKey
+	},
+	{
+		code: "BS327",
+		severity: "warning",
+		title: "aal2 required without MFA enabled",
+		description: "The app calls `requireAal('aal2')` (or otherwise requires aal2), but `[auth.mfa.totp]` in `config.toml` does not enable enroll and verify, so no user can satisfy the check.",
+		check: aal2WithoutMfa
+	},
+	{
+		code: "BS330",
+		severity: "error",
+		title: "Adopted table without a mapped column",
+		description: "A module in adopt mode maps a table or column that the live database lacks, so its functions fail when they run. The check reads every column the module's SQL names (`blocks.<name>.tables` and `columns`, with the defaults for unmapped ones); columns mapped to `null` are skipped.",
+		check: missingAdoptedColumns
+	},
+	{
+		code: "BS331",
+		severity: "error",
+		title: "Subject registry names a missing table or column",
+		description: "An entry in `config.subjects` names a table, or a column of it (`id`, `tenant`, `title`, `deletedAt`, the `url` placeholders, `rank` and `search`), that the snapshot lacks. `subject_title`, `subject_url`, `can_subject` and every module that falls back to the registry then fail when they run.",
+		check: missingSubjectColumns
+	},
+	{
+		code: "BS332",
+		severity: "warning",
+		title: "Subject table without RLS",
+		description: "A table in `config.subjects` has row level security disabled. `can_subject` treats a row the caller can read as visible, so without RLS every signed-in user passes the visibility half of the check for every row.",
+		check: subjectsWithoutRls
+	},
+	{
+		code: "BS335",
+		severity: "warning",
+		title: "Partitioned table created unpartitioned",
+		description: "A block's `options.partitioned` is on (`audit`, `outbox`, `usage` with `history`, `webhooks` or `notifications`), but its table was created before it: the primary key is `id` alone, so the table isn't partitioned by month and its purge deletes row by row. The tables are `better_supabase.audit_events`, `outbox_events`, `usage_history`, `webhook_deliveries` and `notification_delivery_events`. Postgres can't convert a table in place. Create a partitioned table, copy the rows over and swap the names in a maintenance window, or turn the option off.",
+		check: unpartitionedTables
+	}
+];
+/** The table each block's `options.partitioned` partitions, and the option it also needs. */
+const PARTITIONED_TABLES = [
+	{
+		block: "audit",
+		table: "audit_events"
+	},
+	{
+		block: "outbox",
+		table: "outbox_events"
+	},
+	{
+		block: "usage",
+		table: "usage_history",
+		requires: "history"
+	},
+	{
+		block: "webhooks",
+		table: "webhook_deliveries"
+	},
+	{
+		block: "notifications",
+		table: "notification_delivery_events"
+	}
+];
+function unpartitionedTables(context) {
+	const { tables } = catalogOf(context);
+	return PARTITIONED_TABLES.flatMap(({ block, table, requires }) => {
+		const options = context.config.blocks[block]?.options ?? {};
+		if (!context.config.blockNames.includes(block) || options["partitioned"] !== true || requires !== void 0 && options[requires] !== true) return [];
+		if (tables.find((candidate) => candidate.schema === "better_supabase" && candidate.name === table)?.primaryKey.length !== 1) return [];
+		return [{
+			message: `better_supabase.${table} isn't partitioned, so blocks.${block}.options.partitioned has no effect on it. Postgres can't convert it in place: copy the rows into a partitioned table in a maintenance window, or turn the option off.`,
+			target: `better_supabase.${table}`
+		}];
+	});
+}
+function subjectTables(context) {
+	const catalog = catalogOf(context);
+	return Object.entries(context.config.subjects).flatMap(([type, entry]) => {
+		const [schema, name] = entry.table.includes(".") ? entry.table.split(".", 2) : ["public", entry.table];
+		if (schema === void 0 || name === void 0) return [];
+		if (!context.snapshot.schemas.includes(schema)) return [];
+		return [{
+			type,
+			entry,
+			schema,
+			name,
+			table: catalog.tables.find((candidate) => candidate.schema === schema && candidate.name === name)
+		}];
+	});
+}
+function missingSubjectColumns(context) {
+	return subjectTables(context).flatMap(({ type, entry, schema, name, table }) => {
+		const target = `${schema}.${name}`;
+		if (!table) return [{
+			message: `subjects.${type} names ${target}, which the database does not have. Create the table, or point subjects.${type}.table at the existing one.`,
+			target
+		}];
+		const present = new Set(table.columns.map((column) => column.name));
+		return subjectColumns(entry).filter(([, column]) => !present.has(column)).map(([path, column]) => ({
+			message: `subjects.${type}.${path} names ${target}.${column}, but the table has no such column. Map it to the column that holds the value, or add the column.`,
+			target: `${target}.${column}`,
+			object: tableObject(table)
+		}));
+	});
+}
+function subjectsWithoutRls(context) {
+	return subjectTables(context).flatMap(({ type, table }) => table?.kind === "table" && !table.rls ? [{
+		message: `subjects.${type} is ${table.schema}.${table.name}, which has row level security disabled, so can_subject treats every row as visible. Enable RLS and add the policies that scope it.`,
+		target: `${table.schema}.${table.name}`,
+		object: tableObject(table)
+	}] : []);
+}
+function auditUserSession(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const options = context.config.blocks["audit"]?.options ?? {};
+	const roles = Array.isArray(options["eventRoles"]) ? options["eventRoles"].filter((role) => typeof role === "string") : ["service_role"];
+	if (options["readPolicy"] === true && roles.includes("authenticated")) return [];
+	if (!context.sources.some((file) => /\baudit\.(list|listAll)\s*\(/.test(file.text))) return [];
+	return [{
+		message: "blocks.audit leaves the log readable only as the service role (`eventRoles` defaults to service_role, `readPolicy` defaults to false), but the app calls audit.list() or audit.listAll() as a user. Set options.readPolicy to true and include authenticated in options.eventRoles.",
+		target: "blocks.audit"
+	}];
+}
+function missingSecretKey(context) {
+	if (!context.sources.some((file) => /\bdeleteAccount\b|\.admin\s*\(|supabaseAdmin\b/.test(file.text))) return [];
+	if (context.envFiles.some((file) => /^\s*(?:SUPABASE_SECRET_KEY|SUPABASE_SERVICE_ROLE_KEY)\s*=/m.test(file.text))) return [];
+	return [{
+		message: "The app calls deleteAccount or bs.admin(), which need SUPABASE_SECRET_KEY, but no env file doctor reads sets it. Add it to .env.local (and the hosted environments), listed without a value in .env.example.",
+		target: "SUPABASE_SECRET_KEY"
+	}];
+}
+function aal2WithoutMfa(context) {
+	const toml = context.configToml;
+	if (!toml) return [];
+	if (!context.sources.some((file) => /requireAal\s*\(\s*['"]aal2['"]/.test(file.text))) return [];
+	const enroll = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"enroll_enabled"
+	]);
+	const verify = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"verify_enabled"
+	]);
+	if (enroll === true && verify === true) return [];
+	return [{
+		message: "The app requires aal2, but [auth.mfa.totp] in config.toml does not set enroll_enabled and verify_enabled to true, so no user can satisfy the check.",
+		target: toml.path,
+		location: {
+			file: toml.path,
+			line: lineOf(toml.text, /^\[auth\.mfa\.totp\]/) ?? 1
+		}
+	}];
+}
+//#endregion
+//#region src/cli/doctor/pgdelta.ts
+/** `config.toml` when the project runs the pg-delta workflow. */
+function pgdeltaToml(context) {
+	const toml = context.configToml;
+	return toml !== void 0 && workflowOf(context) === "pg-delta" ? toml : void 0;
+}
+/** Comments blanked out, so a commented-out statement never matches and line numbers stay. */
+function withoutComments(text) {
+	return text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, (comment) => " ".repeat(comment.length));
+}
+const lineAt = (text, index) => text.slice(0, index).split("\n").length;
+/**
+* The declarative schema files pg-delta loads, outside the SQL module files
+* better-supabase writes, when the project diffs with pg-delta.
+*/
+function pgdeltaSchemaFiles(context) {
+	const toml = pgdeltaToml(context);
+	if (toml === void 0) return [];
+	const schemas = `${declarativeSchemasDir(toml, "pg-delta")}/`;
+	return (context.sqlFiles ?? []).filter((file) => file.path.startsWith(schemas) && !/^-- @bs-module /m.test(file.text));
+}
+const BULK_GRANT = /\bgrant\b[^;]*?\bon\s+all\s+(tables|routines|functions|procedures|sequences)\s+in\s+schema\s+("?[\w$]+"?(?:\s*,\s*"?[\w$]+"?)*)\s+to\s+([^;]*)/gi;
+/** Grantees a bulk grant must not reach: the Data API roles and `public`. */
+const API_ROLES = /\b(anon|authenticated|public)\b/i;
+/** `do` blocks; group 2 is the body. */
+const DO_BLOCK = /\bdo\s+(\$[\w]*\$)([\s\S]*?)\1/gi;
+const CATALOG = /\b(information_schema\.\w+|(?:pg_catalog\.)?pg_(?:class|tables|views|proc|namespace|attribute|trigger|constraint|index|type|policies|matviews))\b/i;
+const EXECUTES = /\b(execute|perform)\b/i;
+function bulkGrants(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(BULK_GRANT)].filter((match) => API_ROLES.test(match[3])).map((match) => ({
+			message: `${file.path} grants on all ${match[1].toLowerCase()} in schema ${match[2]} at once. pg-delta gives a bulk grant no dependency position, so it can run after the per-object revokes and open functions and tables to anon and authenticated again. Grant each object by name next to its definition, or set Supabase default privileges (alter default privileges in schema ... grant ...) for objects created later.`,
+			target: file.path,
+			location: {
+				file: file.path,
+				line: lineAt(text, match.index)
+			}
+		}));
+	});
+}
+function catalogLoops(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(DO_BLOCK)].flatMap((match) => {
+			const body = match[2];
+			const catalog = CATALOG.exec(body);
+			if (!catalog || !EXECUTES.test(body)) return [];
+			return [{
+				message: `${file.path} has a do block that reads ${catalog[1]} to create objects. pg-delta runs a do block with no dependency position, before the tables it looks for exist, so it creates nothing and the diff never sees its objects. Write the statements it would generate (one trigger, grant or policy per table) as static SQL, or call a per-table function such as better_supabase.audit('<table>') or track_updated_at('<table>') once per table.`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt(text, match.index)
+				}
+			}];
+		});
+	});
+}
+const CREATE_EXTENSION = /\bcreate\s+extension\s+(?:if\s+not\s+exists\s+)?"?([\w-]+)"?/gi;
+/**
+* `text` without comments and with string literals blanked, keeping every
+* offset, so an error message that tells the reader to `create extension`
+* doesn't count as one.
+*/
+const statements = (text) => withoutComments(text).replaceAll(/'(?:[^']|'')*'/g, (literal) => literal.replaceAll(/[^\n]/g, " "));
+/**
+* Extensions a pg-delta schema file creates, SQL module files included, that
+* no migration creates. pg-delta can leave an extension that owns its own
+* schema (`pgmq`) out of the generated migration.
+*/
+function missingExtensions(context) {
+	const toml = pgdeltaToml(context);
+	if (toml === void 0) return [];
+	const schemas = `${declarativeSchemasDir(toml, "pg-delta")}/`;
+	const files = context.sqlFiles ?? [];
+	const migrations = files.filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	const created = new Set(migrations.flatMap((file) => [...statements(file.text).matchAll(CREATE_EXTENSION)].map((match) => match[1].toLowerCase())));
+	const seen = /* @__PURE__ */ new Set();
+	return files.filter((file) => file.path.startsWith(schemas)).flatMap((file) => {
+		const text = statements(file.text);
+		return [...text.matchAll(CREATE_EXTENSION)].flatMap((match) => {
+			const name = match[1].toLowerCase();
+			if (created.has(name) || seen.has(name)) return [];
+			seen.add(name);
+			const module = /^-- @bs-module /m.test(file.text);
+			return [{
+				message: `${file.path} creates the extension ${name}, but no migration creates it. pg-delta can leave an extension that owns its own schema out of the generated migration, and a database built from the migrations then lacks it. ${module ? "Run `better-supabase sql sync`: it writes the extension into a migration that runs before the schema migration." : `Add \`create extension if not exists ${name};\` to a migration that runs before the one that uses it.`}`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt(text, match.index)
+				}
+			}];
+		});
+	});
+}
+/** Statements in declarative schema files that pg-delta can't order. */
+const PGDELTA_RULES = [
+	{
+		code: "BS317",
+		severity: "warning",
+		title: "Bulk grant in a pg-delta schema file",
+		description: "A `grant ... on all tables|routines|sequences in schema ... to anon|authenticated|public` statement in `supabase/schemas` under pg-delta. pg-delta can't place it after the objects it covers or before the revokes that narrow them, so it can re-open functions and tables to `anon` and `authenticated`.",
+		check: bulkGrants
+	},
+	{
+		code: "BS318",
+		severity: "warning",
+		title: "Catalog loop in a pg-delta schema file",
+		description: "A `do` block in `supabase/schemas` under pg-delta that reads the catalog (`information_schema`, `pg_class`, ...) to create objects. pg-delta runs it before the tables exist, so it creates nothing.",
+		check: catalogLoops
+	},
+	{
+		code: "BS321",
+		severity: "warning",
+		title: "Extension missing from the migrations under pg-delta",
+		description: "A `create extension` in `supabase/schemas` (a SQL module's file included) under pg-delta that no migration repeats. pg-delta can leave an extension that owns its own schema, such as `pgmq`, out of the generated migration.",
+		check: missingExtensions
+	}
+];
+//#endregion
+//#region src/cli/doctor/policies.ts
+const AUTH_ROLE = /\bauth"?\s*\.\s*"?role"?\s*\(\s*\)/i;
+/** A check of who is calling: the JWT, the user id, or the session role. */
+const CALLER_CHECK = /\bauth"?\s*\.\s*"?(?:uid|jwt)"?\s*\(|request\.jwt|\b(?:current_user|session_user|current_role)\b|has_organization_role|member_organization_ids/i;
+const USER_METADATA = /\buser_metadata\b/i;
+/** Privileges an API role never needs on a table. */
+const NEEDLESS = [
+	"TRUNCATE",
+	"REFERENCES",
+	"TRIGGER"
+];
+const policyText = (policy) => withoutStrings(`${policy.using ?? ""} ${policy.check ?? ""}`);
+/** A permissive policy lets `role` run `command` on the table. */
+const allows = (table, command, role) => table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+/** Policy commands on `storage.objects` the SQL files create, by policy name. */
+function storagePolicies(context) {
+	const commands = /* @__PURE__ */ new Map();
+	const pattern = /create\s+policy\s+("(?:[^"]|"")+"|\S+)\s+on\s+"?storage"?\s*\.\s*"?objects"?\b([^;]*)/gi;
+	for (const file of context.sqlFiles ?? []) for (const match of withoutStrings(file.text).matchAll(pattern)) {
+		const name = match[1];
+		if (commands.has(name)) continue;
+		const command = /\bfor\s+(select|insert|update|delete|all)\b/i.exec(match[2])?.[1];
+		commands.set(name, command?.toLowerCase() ?? "all");
+	}
+	return commands;
+}
+const POLICY_RULES = [
+	{
+		code: "BS109",
+		severity: "warning",
+		title: "auth.role() in a policy or function",
+		description: "Supabase deprecated `auth.role()`. Scope the policy with `to authenticated`, or read the claim with `(select auth.jwt() ->> 'role')`.",
+		check: (context) => {
+			const findings = [];
+			for (const table of catalogOf(context).tables) for (const policy of table.policies) {
+				if (!AUTH_ROLE.test(policyText(policy))) continue;
+				findings.push({
+					message: `Policy "${policy.name}" on ${qualified(table)} calls auth.role(), which Supabase deprecated. Use \`to authenticated\` on the policy, or \`(select auth.jwt() ->> 'role')\`.`,
+					target: `${qualified(table)}.${policy.name}`,
+					object: policyObject(table, policy)
+				});
+			}
+			const bodies = new Map(policyHelpers(context));
+			for (const fn of context.snapshot.generator.functions) {
+				if (!context.config.schemas.includes(fn.schema) || !fn.definition) continue;
+				bodies.set(`${fn.schema}.${fn.name}`, withoutStrings(fn.definition));
+			}
+			for (const [name, body] of bodies) {
+				if (!AUTH_ROLE.test(body)) continue;
+				const dot = name.indexOf(".");
+				findings.push({
+					message: `${name} calls auth.role(), which Supabase deprecated. Read \`auth.jwt() ->> 'role'\` instead.`,
+					target: name,
+					object: {
+						kind: "function",
+						schema: name.slice(0, dot),
+						name: name.slice(dot + 1)
+					}
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS110",
+		severity: "warning",
+		title: "Update policy without a select policy or with check",
+		description: "An update has to find the rows first, so without a select policy for the same role it matches no rows and reports success. Without `with check`, Postgres checks the new row against `using`, which hides whether moving a row to another owner or tenant is allowed.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (!table.rls) return [];
+			return table.policies.flatMap((policy) => {
+				if (!policy.permissive || policy.command !== "update") return [];
+				const blind = (policy.roles.length === 0 || policy.roles.includes("public") ? ["anon", "authenticated"] : policy.roles).filter((role) => !allows(table, "select", role));
+				const target = `${qualified(table)}.${policy.name}`;
+				if (blind.length > 0) return [{
+					message: `Policy "${policy.name}" on ${qualified(table)} allows update for ${blind.join(", ")}, but no select policy does, so updates match no rows without an error. Add a select policy for ${blind.join(", ")}.`,
+					target,
+					object: policyObject(table, policy)
+				}];
+				if (policy.check !== null) return [];
+				return [{
+					severity: "info",
+					message: `Policy "${policy.name}" on ${qualified(table)} has no \`with check\`, so Postgres checks updated rows against \`using\`. State the rule for the new row with \`with check (...)\`.`,
+					target,
+					object: policyObject(table, policy)
+				}];
+			});
+		})
+	},
+	{
+		code: "BS111",
+		severity: "warning",
+		title: "API roles hold privileges they don't use",
+		description: "`anon` and `authenticated` never need `truncate`, `references` or `trigger`, and `truncate` skips RLS. A grant to `anon` on a table no policy opens to it does nothing except list the table in the Data API schema.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const findings = [];
+			for (const role of ["anon", "authenticated"]) {
+				const privileges = new Set(table.grants.filter((grant) => grant.role === role).flatMap((grant) => grant.privileges));
+				const needless = NEEDLESS.filter((privilege) => privileges.has(privilege));
+				if (needless.length > 0) findings.push({
+					message: `${role} has ${needless.join(", ").toLowerCase()} on ${qualified(table)}. \`truncate\` bypasses RLS. Run \`revoke ${needless.join(", ").toLowerCase()} on table ${qualified(table)} from ${role};\`.`,
+					target: `${qualified(table)}:${role}`,
+					object: tableObject(table)
+				});
+				if (role !== "anon" || !table.rls) continue;
+				const unused = COMMANDS$1.filter((command) => privileges.has(command.toUpperCase()) && !allows(table, command, role));
+				if (unused.length > 0) findings.push({
+					severity: "info",
+					message: `anon has ${unused.join(", ")} on ${qualified(table)}, but no policy allows it for anon, so the grant only lists the table in the Data API schema. Run \`revoke ${unused.join(", ")} on table ${qualified(table)} from anon;\`.`,
+					target: `${qualified(table)}:anon:unused`,
+					object: tableObject(table)
+				});
+			}
+			return findings;
+		})
+	},
+	{
+		code: "BS112",
+		severity: "warning",
+		title: "Exposed security definer function that doesn't check the caller",
+		description: "A `security definer` function in an exposed schema runs as its owner, past RLS, and the Data API serves it at `/rpc`. When anon or authenticated may execute it and its body never reads `auth.uid()` or `auth.jwt()`, any caller gets the owner's access. Check the caller, revoke `execute`, or move it to a schema the API doesn't expose.",
+		check: (context) => (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+			if (!fn.securityDefiner || !context.config.schemas.includes(fn.schema)) return [];
+			const callers = fn.execute ?? [];
+			if (callers.length === 0) return [];
+			const body = functionBody(context, fn.schema, fn.name);
+			if (body === void 0 || CALLER_CHECK.test(body)) return [];
+			return [{
+				message: `${fn.schema}.${fn.name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and it never checks auth.uid() or auth.jwt(). Check the caller, run \`revoke execute on function ${fn.schema}.${fn.name}(${fn.signature}) from ${callers.join(", ")};\`, or move it to a private schema.`,
+				target: `${fn.schema}.${fn.name}`,
+				object: functionObject(fn)
+			}];
+		})
+	},
+	{
+		code: "BS113",
+		severity: "info",
+		title: "Storage upload policy without the upsert policies",
+		description: "An upload with `upsert: true` (`x-upsert`) needs `select` and `update` policies on `storage.objects` besides `insert`; without them, replacing an existing file fails with a 403. Doctor reads the policies in `supabase/schemas` and the migrations.",
+		check: (context) => {
+			const commands = new Set(storagePolicies(context).values());
+			if (!commands.has("insert") || commands.has("all")) return [];
+			const missing = ["select", "update"].filter((command) => !commands.has(command));
+			if (missing.length === 0) return [];
+			return [{
+				message: `storage.objects has an insert policy but no ${missing.join(" or ")} policy, so uploads with \`upsert: true\` fail with 403 when the file exists. Add ${missing.join(" and ")} policies with the same bucket and path check.`,
+				target: "storage.objects"
+			}];
+		}
+	},
+	{
+		code: "BS114",
+		severity: "error",
+		title: "Policy helper reads user_metadata",
+		description: "Users can change their own `raw_user_meta_data` with `auth.updateUser()`, so a helper that reads `user_metadata` to decide access lets them grant themselves rights. Read `app_metadata`, which only the service role can write. Splinter's `rls_references_user_metadata` covers the policy text; this covers the functions policies call.",
+		check: (context) => [...policyHelpers(context).keys()].flatMap((name) => {
+			const dot = name.indexOf(".");
+			const body = functionBody(context, name.slice(0, dot), name.slice(dot + 1));
+			if (!body || !USER_METADATA.test(body)) return [];
+			return [{
+				message: `${name} reads user_metadata, which users can write themselves, and policies call it. Read \`auth.jwt() -> 'app_metadata'\` instead.`,
+				target: name,
+				object: {
+					kind: "function",
+					schema: name.slice(0, dot),
+					name: name.slice(dot + 1)
+				}
+			}];
+		})
+	},
+	{
+		code: "BS115",
+		severity: "warning",
+		title: "Table without a policy still granted to the Data API",
+		description: "A table with RLS on and no permissive policy for `anon` or `authenticated` answers every Data API request with no rows or a denied write, yet a grant lists it in the API schema. Under `blocks.grants.options.fromPolicies`, `better-supabase sql sync` revokes these grants and keeps `service_role`; until the migration is applied, doctor reports the live grants. Tables in `expose` are skipped.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table" || !table.rls) return [];
+			const options = configFor(context.config.tables, table.schema, table.name);
+			if (options?.exclude || options?.serviceRole) return [];
+			if (context.config.expose[qualified(table)] ?? context.config.expose[table.name]) return [];
+			const roles = ["anon", "authenticated"].filter((role) => table.grants.some((grant) => (grant.role === role || grant.role === "PUBLIC") && grant.privileges.length > 0));
+			if (roles.length === 0) return [];
+			if (table.policies.some((policy) => policy.permissive && roles.some((role) => appliesTo(policy, role)))) return [];
+			return [{
+				message: `${qualified(table)} has RLS on and no permissive policy for ${roles.join(" or ")}, but ${roles.join(" and ")} still hold grants on it. Run \`revoke all on table ${qualified(table)} from public, anon, authenticated;\`, or set \`blocks.grants.options.fromPolicies\` and run \`better-supabase sql sync\` so the migration revokes it.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS116",
+		severity: "warning",
+		title: "Security definer function open to the API roles without being exposed",
+		description: "Postgres grants `execute` on a new function to `public`, so a `security definer` function in an exposed schema is callable at `/rpc` by `anon` and `authenticated` unless it is revoked. When no `expose` entry lists it and no policy calls it, nothing in the project says the API roles should reach it. Doctor never revokes it; list it in `expose` with the roles that call it, or revoke `execute` from `public`, `anon` and `authenticated` and grant it back to those roles.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			const listed = new Set(Object.keys(context.config.exposeFunctions).map((signature) => {
+				const name = signature.slice(0, signature.indexOf("(")).trim();
+				return name.includes(".") ? name : `public.${name}`;
+			}));
+			const inPolicies = new Set(catalogOf(context).tables.flatMap((table) => table.policies.flatMap((policy) => policy.functions ?? [])));
+			return (context.snapshot.extras.functions ?? []).flatMap((fn) => {
+				const name = `${fn.schema}.${fn.name}`;
+				const callers = fn.execute ?? [];
+				if (!fn.securityDefiner || !schemas.includes(fn.schema) || callers.length === 0 || listed.has(name) || inPolicies.has(name)) return [];
+				return [{
+					message: `${name}(${fn.signature}) is security definer, ${callers.join(" and ")} may execute it through /rpc, and no \`expose\` entry or policy uses it. Run \`revoke all on function ${name}(${fn.signature}) from public, anon, authenticated;\`, then \`grant execute on function ${name}(${fn.signature}) to <the roles that call it>;\`, or list it in \`expose\`.`,
+					target: name,
+					object: functionObject(fn)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS117",
+		severity: "warning",
+		title: "Policy without a role",
+		description: "A policy without `to`, or with `to public`, applies to `public`, which is every role, `anon` included. Postgres then evaluates it for requests it was never meant for, and a later change to its expression can open the table to signed-out users. Name the roles with `to authenticated` (or `to anon, authenticated`). Restrictive policies only narrow access, so they are skipped.",
+		check: (context) => catalogOf(context).tables.flatMap((table) => table.policies.filter((policy) => policy.permissive && (policy.roles.length === 0 || policy.roles.includes("public"))).map((policy) => ({
+			message: `Policy "${policy.name}" on ${qualified(table)} applies to public (no \`to\` role, or \`to public\`), which is every role, anon included. Recreate it with \`to authenticated\`, or list the roles that need it.`,
+			target: `${qualified(table)}.${policy.name}`,
+			object: policyObject(table, policy)
+		})))
+	},
+	{
+		code: "BS215",
+		severity: "warning",
+		title: "Policy calls a helper per row that could run once",
+		description: "A call such as `current_tenant_id()` takes no column of the row, so its result is the same for every row. Wrapped as `(select current_tenant_id())`, Postgres runs it once per statement as an InitPlan. Splinter's `auth_rls_initplan` covers `auth.*` calls; this covers your own helpers.",
+		check: (context) => {
+			const volatility = new Map((context.snapshot.extras.functions ?? []).map((fn) => [`${fn.schema}.${fn.name}`, fn.volatility]));
+			return exposed(context).flatMap((table) => {
+				if (!table.rls) return [];
+				return table.policies.flatMap((policy) => {
+					const text = policyText(policy);
+					const bare = (policy.functions ?? []).filter((name) => {
+						const dot = name.indexOf(".");
+						const schema = name.slice(0, dot);
+						if (schema === "auth" || volatility.get(name) === "immutable") return false;
+						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$2(schema)}"?\\.)?"?${escape$2(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
+					});
+					if (bare.length === 0) return [];
+					return [{
+						message: `Policy "${policy.name}" on ${qualified(table)} calls ${bare.map((name) => `${name}()`).join(", ")} without \`(select ...)\`, so it runs once per row. Write \`(select ${bare[0]}())\`.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}];
+				});
+			});
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/realtime.ts
+/** The comment `topic.trigger(..., { payload: "row" })` puts on its function. */
+const ROW_PAYLOAD_MARKER = "better-supabase: payload row";
+const BROADCAST_ROW = /realtime\.broadcast_changes\s*\([^;]*\b(?:new|old)\b|'old_record'/i;
+/** Whether a trigger function body sends `new` or `old` whole. */
+function sendsWholeRow(source) {
+	return BROADCAST_ROW.test(source.replaceAll(/--[^\n]*/g, ""));
+}
+/** Realtime checks that read the trigger functions in the snapshot. */
+const REALTIME_RULES = [{
+	code: "BS337",
+	severity: "warning",
+	title: "Broadcast trigger sends whole rows",
+	description: "A trigger function sends the whole row to Realtime with `realtime.broadcast_changes(..., new, old)` or `old_record` and `record`, and has no `payload: \"row\"` marker. Subscribers then see every column, including ones their column grants hide.",
+	check: (context) => catalogOf(context).tables.flatMap((table) => table.triggers.filter((trigger) => trigger.source !== void 0 && trigger.comment !== ROW_PAYLOAD_MARKER && sendsWholeRow(trigger.source)).map((trigger) => ({
+		message: `${trigger.name} on ${qualified(table)} calls ${trigger.function}(), which broadcasts whole rows. Regenerate it with \`topic.trigger()\`, whose default payload sends the primary key and the topic values, or pass \`payload: "row"\` to keep whole rows on purpose.`,
+		target: `${qualified(table)}.${trigger.name}`,
+		object: tableObject(table)
+	})))
+}];
+//#endregion
+//#region src/cli/doctor/schema-design.ts
+/** The `format` the database reports for each app column type. */
+const APP_COLUMN_FORMAT = {
+	text: "text",
+	uuid: "uuid",
+	integer: "int4",
+	bigint: "int8",
+	numeric: "numeric",
+	boolean: "bool",
+	timestamptz: "timestamptz",
+	date: "date",
+	jsonb: "jsonb",
+	"text[]": "_text"
+};
+/**
+* Whether a partial index's predicate only skips rows where a key column is
+* null, like `(customer_id IS NOT NULL)`: those rows reference nothing, so the
+* index still serves the key.
+*/
+const skipsNullKeys = (predicate, columns) => {
+	if (!predicate) return false;
+	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$2(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
+};
+/** Whether the first `columns.length` columns of an index are exactly `columns`, in any order, and it holds every row that references something. */
+const covers = (index, columns) => (!index.partial || skipsNullKeys(index.predicate, columns)) && index.columns.length >= columns.length && index.columns.slice(0, columns.length).every((column) => columns.includes(column));
+/** Foreign keys of `table` that no index starts with. */
+const unindexedForeignKeys = (table) => table.foreignKeys.filter((key) => !table.indexes.some((index) => covers(index, key.columns)));
+const SOFT_DELETE = /^(?:deleted|archived)_at$/;
+/** Operators that need a GIN index on jsonb or array columns. */
+const CONTAINS = String.raw`(?:@>|<@|\?\||\?&|\?|&&)`;
+/** `.contains("tags"`, `.containedBy('meta'`, `.overlaps("labels"`, supabase-js filters. */
+const CLIENT_CONTAINS = /\.(?:contains|containedBy|overlaps)\(\s*["'`]([A-Za-z_]\w*)["'`]/g;
+/** Column types Postgres' wiki and the Supabase skills advise against. */
+const AVOID = {
+	timestamp: "timestamptz",
+	varchar: "text with a check constraint",
+	bpchar: "text",
+	money: "numeric",
+	json: "jsonb"
+};
+/** A Supabase direct (`db.<ref>.supabase.co`) or session-pooler (`:5432`) connection string. */
+const DIRECT_URL = /postgres(?:ql)?:\/\/[^\s"'`]*@(?:db\.[a-z0-9]+\.supabase\.co(?::5432)?|[\w.-]+\.pooler\.supabase\.com:5432)\b/i;
+/** Files that show the app runs on serverless or edge functions. */
+const SERVERLESS = /\bexport\s+(?:const\s+runtime|async\s+function\s+(?:GET|POST|PUT|PATCH|DELETE)|default\s+\{\s*(?:async\s+)?fetch)\b|\bDeno\.serve\(/;
+/** A connection string through Supavisor's transaction pooler (port 6543). */
+const TRANSACTION_POOLER = /postgres(?:ql)?:\/\/[^\s"'`]*:6543\b/i;
+/** `import postgres from "postgres"` or `require("postgres")`: postgres.js. */
+const POSTGRES_JS = /\bfrom\s+["']postgres["']|\brequire\(\s*["']postgres["']\s*\)/;
+const PREPARE_OFF = /\bprepare\s*:\s*false\b/;
+const PRISMA = /["']@prisma\/client["']|\bnew\s+PrismaClient\b/;
+const OFFSET_PAGINATION = /\bpagination\s*:\s*["'`]offset["'`]/;
+const EXACT_COUNT = /\bcount\s*:\s*["'`]exact["'`]/;
+/** `format_type` names of scalar results that a JSON number can't hold exactly. */
+const WIDE_RESULT = /^(?:bigint|numeric)(?:\[\])?$/;
+function lines(file) {
+	return file.text.split("\n").map((text, index) => ({
+		line: index + 1,
+		text
+	}));
+}
+const SCHEMA_DESIGN_RULES = [
+	{
+		code: "BS216",
+		severity: "info",
+		title: "Foreign key without an index",
+		description: "Deletes and updates on the referenced table scan the referencing table for each row, and joins on the key can't use an index. Add an index that starts with the key's columns; a partial index counts when its `where` only skips rows whose key is null (`where customer_id is not null`). When the performance advisor (BS200) runs, splinter's `unindexed_foreign_keys` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "unindexed_foreign_keys");
+			return exposed(context).flatMap((table) => {
+				if (table.kind !== "table" || splinter?.has(qualified(table))) return [];
+				return unindexedForeignKeys(table).map((key) => ({
+					message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) has no index that starts with its columns, so deletes on ${key.refSchema}.${key.refTable} scan ${qualified(table)}. Run \`create index on ${qualified(table)} (${key.columns.join(", ")});\`.`,
+					target: `${qualified(table)}.${key.name}`,
+					object: tableObject(table)
+				}));
+			});
+		}
+	},
+	{
+		code: "BS217",
+		severity: "warning",
+		title: "Tenant foreign key that can cross tenants",
+		description: "When a tenant table references another tenant table by `id` alone, a row can point at a parent in another organization; RLS checks each row, not the pair. Reference `(id, organization_id)` with a composite foreign key, backed by `unique (id, organization_id)` on the parent.",
+		check: (context) => {
+			const column = context.config.plugins.tenant?.column;
+			if (!column) return [];
+			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
+			const hasTenant = (table) => table?.columns.some((entry) => entry.name === column) ?? false;
+			return exposed(context).flatMap((table) => {
+				if (table.kind !== "table" || !hasTenant(table)) return [];
+				return table.foreignKeys.flatMap((key) => {
+					if (key.columns.includes(column)) return [];
+					const parent = tables.get(`${key.refSchema}.${key.refTable}`);
+					if (!hasTenant(parent) || parent === table) return [];
+					return [{
+						message: `${qualified(table)}.${key.name} references ${key.refSchema}.${key.refTable} (${key.refColumns.join(", ")}) without ${column}, so a row can point at another tenant's ${key.refTable}. Add \`unique (${[...key.refColumns, column].join(", ")})\` to ${key.refTable} and reference \`(${[...key.columns, column].join(", ")})\`.`,
+						target: `${qualified(table)}.${key.name}`,
+						object: tableObject(table)
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS218",
+		severity: "info",
+		title: "Soft-delete table without a partial index",
+		description: "Queries on a table with `deleted_at` or `archived_at` read the live rows (`where deleted_at is null`). A partial index with that predicate stays small and matches those queries.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const column = table.columns.find((entry) => SOFT_DELETE.test(entry.name) && entry.nullable);
+			if (!column) return [];
+			const isNull = new RegExp(`"?${escape$2(column.name)}"?\\s+IS\\s+NULL`, "i");
+			if (table.indexes.some((index) => index.partial && (index.predicate === void 0 || index.predicate !== null && isNull.test(index.predicate)))) return [];
+			return [{
+				message: `${qualified(table)} soft-deletes with ${column.name}, but no index has \`where ${column.name} is null\`. Index the live rows you list, for example \`create index on ${qualified(table)} (created_at desc) where ${column.name} is null;\`.`,
+				target: `${qualified(table)}.${column.name}`,
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS219",
+		severity: "warning",
+		title: "Containment filter on a column without a GIN index",
+		description: "`@>`, `<@`, `?` and `&&` on jsonb and array columns, and the `.contains()`, `.containedBy()` and `.overlaps()` filters, can only use a GIN index. Without one, every query reads the whole table. Doctor looks in policies, exposed functions and `doctor.sources`.",
+		check: (context) => {
+			const tables = exposed(context).filter((table) => table.kind === "table");
+			const policyText = (table) => withoutStrings(table.policies.map((policy) => `${policy.using ?? ""} ${policy.check ?? ""}`).join(" "));
+			const functions = context.snapshot.generator.functions.filter((fn) => context.config.schemas.includes(fn.schema) && fn.definition).map((fn) => withoutStrings(fn.definition)).join("\n");
+			const filtered = /* @__PURE__ */ new Set();
+			for (const file of context.sources) for (const match of file.text.matchAll(CLIENT_CONTAINS)) filtered.add(match[1]);
+			return tables.flatMap((table) => {
+				const own = policyText(table);
+				return table.columns.filter((column) => {
+					if (!column.isArray && column.udt !== "jsonb") return false;
+					if (table.indexes.some((index) => index.columns[0] === column.name && (index.method === void 0 || index.method === "gin"))) return false;
+					const used = new RegExp(`"?${escape$2(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$2(column.name)}\\b`);
+					return filtered.has(column.name) || used.test(own) || functions.includes(table.name) && used.test(functions);
+				}).map((column) => ({
+					message: `${qualified(table)}.${column.name} is filtered by containment but has no GIN index, so each query scans the table. Run \`create index on ${qualified(table)} using gin (${column.name}${column.udt === "jsonb" ? " jsonb_path_ops" : ""});\`${column.udt === "jsonb" ? " (`jsonb_path_ops` supports `@>` only; drop it for `?`)" : ""}.`,
+					target: `${qualified(table)}.${column.name}`,
+					object: tableObject(table)
+				}));
+			});
+		}
+	},
+	{
+		code: "BS220",
+		severity: "info",
+		title: "Column type to avoid",
+		description: "`timestamp` drops the time zone, `varchar(n)` and `char(n)` only add a length check `text` does with a constraint, `money` rounds by locale and `json` reparses on every read. Use `timestamptz`, `text`, `numeric` and `jsonb`.",
+		check: (context) => exposed(context).flatMap((table) => {
+			if (table.kind !== "table") return [];
+			const columns = table.columns.filter((column) => column.typeSchema === "pg_catalog" && column.udt in AVOID);
+			if (columns.length === 0) return [];
+			return [{
+				message: `${qualified(table)}: ${columns.map((column) => `${column.name} is ${column.udt}, use ${AVOID[column.udt]}`).join("; ")}.`,
+				target: qualified(table),
+				object: tableObject(table)
+			}];
+		})
+	},
+	{
+		code: "BS221",
+		severity: "warning",
+		title: "Direct database connection in a serverless app",
+		description: "Each serverless or edge invocation opens its own connection. Through the direct host or the session pooler on port 5432 they exhaust `max_connections`; the transaction pooler on port 6543 shares them. The direct host is also IPv6 only.",
+		check: (context) => {
+			if (!(context.sources.some((file) => SERVERLESS.test(file.text)) || context.envFiles.some((file) => /^\s*VERCEL\w*=/m.test(file.text)))) return [];
+			return context.envFiles.flatMap((file) => lines(file).flatMap(({ line, text }) => {
+				if (/^\s*#/.test(text) || !DIRECT_URL.test(text)) return [];
+				const key = /^\s*(?:export\s+)?(\w+)\s*=/.exec(text)?.[1];
+				return [{
+					message: `${file.path}${key ? `:${key}` : ""} connects through port 5432 or the direct host, but the app runs on serverless functions. Use the transaction pooler: \`postgres://postgres.<ref>:<password>@<region>.pooler.supabase.com:6543/postgres\`.`,
+					target: `${file.path}${key ? `:${key}` : ""}`,
+					location: {
+						file: file.path,
+						line
+					}
+				}];
+			}));
+		}
+	},
+	{
+		code: "BS222",
+		severity: "warning",
+		title: "Column that can exceed a JavaScript number",
+		description: "`int8` and `numeric` decode as `number` by default, which matches `supabase gen types` but loses precision past 2^53 (or 15 to 17 significant digits). An `int8` identity or sequence keeps growing toward that limit, and `numeric` usually holds exact amounts. Set `codecs.int8` to `bigint` or `string`, or `codecs.numeric` to `string`.",
+		check: (context) => {
+			const { int8, numeric } = context.config.codecs;
+			if (int8 !== "number" && numeric !== "number") return [];
+			return exposed(context).flatMap((table) => {
+				if (configFor(context.config.tables, table.schema, table.name)?.exclude) return [];
+				const columns = table.columns.filter((column) => column.udt === "int8" ? int8 === "number" && !column.isArray && (column.identity !== null || (column.default?.includes("nextval(") ?? false)) : column.udt === "numeric" && numeric === "number");
+				if (columns.length === 0) return [];
+				const codecs = [...columns.some((column) => column.udt === "int8") ? ["`int8: \"bigint\"`"] : [], ...columns.some((column) => column.udt === "numeric") ? ["`numeric: \"string\"`"] : []];
+				return [{
+					message: `${qualified(table)} ${columns.map((column) => `${column.name} (${column.udt})`).join(", ")} decode as number and lose precision past 2^53. Set ${codecs.join(" and ")} in \`codecs\`.`,
+					target: qualified(table),
+					object: tableObject(table)
+				}];
+			});
+		}
+	},
+	{
+		code: "BS223",
+		severity: "info",
+		title: "Function returns an int8 or numeric scalar",
+		description: "PostgREST sends a scalar `int8` or `numeric` function result as a JSON number, which loses precision past 2^53 (or 15 to 17 significant digits) before any codec sees it. `$rpc` casts codec columns of table and record results to text, but a scalar has no column to cast. Return it as `text` when it can be that large.",
+		check: (context) => {
+			const schemas = exposedSchemas(context);
+			return context.snapshot.generator.functions.filter((fn) => schemas.includes(fn.schema) && WIDE_RESULT.test(fn.return_type)).map((fn) => ({
+				message: `${fn.schema}.${fn.name}(${fn.identity_argument_types}) returns ${fn.is_set_returning_function ? "setof " : ""}${fn.return_type}, which PostgREST sends as a JSON number and \`$rpc\` can't cast. Return it as text (\`returns ${fn.return_type.replace("bigint", "text").replace("numeric", "text")}\`, \`select total::text\`) when it can pass 2^53, or add BS223 to \`doctor.ignore\` when it stays small.`,
+				target: `${fn.schema}.${fn.name}`,
+				object: {
+					kind: "function",
+					schema: fn.schema,
+					name: fn.name
+				}
+			}));
+		}
+	},
+	{
+		code: "BS226",
+		severity: "warning",
+		title: "Prepared statements through the transaction pooler",
+		description: "The transaction pooler on port 6543 hands each transaction to any server connection, so a named prepared statement from one transaction is missing in the next and the query fails with `prepared statement does not exist`. postgres.js prepares statements unless `prepare: false`, and Prisma does unless the URL has `pgbouncer=true`. `pg` (and `better-supabase/postgres`) sends unnamed statements, which are safe. Doctor looks for a `:6543` URL in the env files and `doctor.sources`.",
+		check: (context) => {
+			const urls = [...context.envFiles, ...context.sources].flatMap((file) => lines(file).filter(({ text }) => !/^\s*(?:#|\/\/)/.test(text) && TRANSACTION_POOLER.test(text)).map(({ line, text }) => ({
+				file,
+				line,
+				text
+			})));
+			if (urls.length === 0) return [];
+			const findings = [];
+			for (const file of context.sources) {
+				if (!POSTGRES_JS.test(file.text) || PREPARE_OFF.test(file.text)) continue;
+				findings.push({
+					message: `${file.path} creates a postgres.js client without \`prepare: false\`, and the project connects through the transaction pooler on port 6543, so its prepared statements fail on the next transaction. Pass \`postgres(url, { prepare: false })\`.`,
+					target: `${file.path}:postgres`,
+					location: {
+						file: file.path,
+						line: lineOf(file.text, POSTGRES_JS) ?? 1
+					}
+				});
+			}
+			if (!context.sources.some((file) => PRISMA.test(file.text))) return findings;
+			for (const { file, line, text } of urls) {
+				if (/[?&]pgbouncer=true\b/.test(text)) continue;
+				const key = /^\s*(?:export\s+)?(\w+)\s*=/.exec(text)?.[1];
+				const target = `${file.path}${key ? `:${key}` : `:${line}`}`;
+				findings.push({
+					message: `${target} connects Prisma through the transaction pooler on port 6543 without \`pgbouncer=true\`, so Prisma's prepared statements fail on the next transaction. Add \`?pgbouncer=true\` to the URL, and use the session pooler or direct URL as \`directUrl\` for migrations.`,
+					target,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			return findings;
+		}
+	},
+	{
+		code: "BS227",
+		severity: "info",
+		title: "Offset pagination or exact counts",
+		description: "`pagination: \"offset\"` on a resource or list reads and discards every row before the page, so late pages get slower as the table grows, and rows written between requests shift the pages. `count: \"exact\"` counts every matching row on each request. Use `pagination: \"cursor\"`, and `count: \"planned\"` or `\"estimated\"` on large tables. Doctor looks in `doctor.sources`.",
+		check: (context) => context.sources.flatMap((file) => lines(file).flatMap(({ line, text }) => {
+			if (/^\s*(?:\/\/|\*)/.test(text)) return [];
+			const found = [];
+			if (OFFSET_PAGINATION.test(text)) found.push({
+				message: `${file.path}:${line} uses \`pagination: "offset"\`, so each page reads and skips every earlier row. Use \`pagination: "cursor"\` unless the UI needs page numbers, and keep \`[api] max_rows\` set so no request reads the whole table.`,
+				target: `${file.path}:${line}:pagination`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+			if (EXACT_COUNT.test(text)) found.push({
+				message: `${file.path}:${line} uses \`count: "exact"\`, which counts every matching row on each request. Use \`count: "planned"\` or \`"estimated"\` when the table can grow large.`,
+				target: `${file.path}:${line}:count`,
+				location: {
+					file: file.path,
+					line
+				}
+			});
+			return found;
+		}))
+	},
+	{
+		code: "BS228",
+		severity: "warning",
+		title: "App table column drifted from appTables",
+		description: "A column of an app table has a different type or nullability in the database than `appTables` gives it, usually after an edit by hand or a migration that wasn't regenerated. `gen` types the column from `appTables`, so the app reads values the database doesn't hold. A table or column the database doesn't have yet is left out: that is a migration not applied.",
+		check: (context) => {
+			const columns = new Map(context.snapshot.generator.columns.filter((column) => column.schema === "public").map((column) => [`${column.table}.${column.name}`, column]));
+			return Object.entries(context.config.appTables).flatMap(([table, config]) => Object.entries(config.columns ?? {}).flatMap(([name, column]) => {
+				const found = columns.get(`${table}.${name}`);
+				if (found === void 0) return [];
+				const format = APP_COLUMN_FORMAT[column.type];
+				const nullable = column.nullable !== false;
+				const drift = [...found.format === format ? [] : [`is ${found.format} in the database and ${column.type} in appTables`], ...found.is_nullable === nullable ? [] : [nullable ? "is not null in the database and nullable in appTables" : "is nullable in the database and required in appTables"]];
+				return drift.length === 0 ? [] : [{
+					message: `public.${table}.${name} ${drift.join(", and ")}. Change appTables to match the database, or regenerate the migration with \`better-supabase sql sync\` and apply it. Follow the expand-and-contract steps from \`better-supabase apply\` when rows depend on the old shape.`,
+					target: `public.${table}.${name}`,
+					object: {
+						kind: "table",
+						schema: "public",
+						name: table
+					}
+				}];
+			}));
+		}
+	}
+];
+//#endregion
+//#region src/cli/doctor/workflow-builder.ts
+const BUILDER_EXECUTOR = /\b(?:GraphStepCall|executeGraph|nodeRunReporter)\b/;
+const ADMIN_CALL = /\badmin\s*\(/;
+function adminInBuilderExecutor(context) {
+	return context.sources.flatMap((file) => {
+		if (!BUILDER_EXECUTOR.test(file.text)) return [];
+		const line = lineOf(file.text, ADMIN_CALL);
+		if (line === void 0) return [];
+		return [{
+			message: `${file.path} runs workflow-builder steps and calls admin(), which bypasses RLS for every step. Resolve the publisher's claims with builder.versions.runAs(call.version) in each step and query as them, so a demoted publisher's workflow stops.`,
+			target: `${file.path}:admin`,
+			location: {
+				file: file.path,
+				line
+			}
+		}];
+	});
+}
+const WORKFLOW_BUILDER_RULES = [{
+	code: "BS333",
+	severity: "warning",
+	title: "admin() inside a workflow-builder executor",
+	description: "A file that runs workflow-builder steps calls `admin()`. Steps run with the service role's rights instead of the publisher's, so a published workflow keeps running after its publisher loses a permission.",
+	check: adminInBuilderExecutor
+}];
+//#endregion
+//#region src/cli/doctor/rules.ts
+const DOCS_URL = "https://bettersupabase.com/docs/cli/doctor";
+const writes = (policy) => policy.command === "all" || policy.command === "insert" || policy.command === "update" || policy.command === "delete";
+const publicRoles = (policy) => policy.roles.length === 0 || policy.roles.some((role) => role === "public" || role === "anon");
+const isTrue = (expression) => expression !== null && /^\(*\s*true\s*\)*$/i.test(expression.trim());
+async function moduleVersionsBehind(context) {
+	const findings = [];
+	const upgrade = "Run `better-supabase sql upgrade`";
+	for (const { file, path, installed, behind } of await moduleFiles(context)) {
+		if (!behind || installed === void 0) continue;
+		findings.push({
+			message: `${path} has ${file.module} version ${String(installed)}; this release ships version ${String(moduleFileVersion(file.contents)?.version ?? 1)}. ${upgrade}, then \`${migrationCommand(workflowOf(context))}\`.`,
+			target: path,
+			location: {
+				file: path,
+				line: 1
+			}
+		});
+	}
+	const db = context.database;
+	if (!db || "skipped" in db || context.config.blockNames.length === 0) return findings;
+	let rows;
+	try {
+		rows = await db.query("select name, version from better_supabase.modules");
+	} catch {
+		return findings;
+	}
+	for (const row of rows) {
+		const module = SQL_MODULES[row.name];
+		if (!module || !context.config.blockNames.includes(row.name)) continue;
+		const version = moduleVersion(module);
+		if (row.version >= version) continue;
+		findings.push({
+			message: `The database has ${row.name} version ${String(row.version)}; this release ships version ${String(version)}. ${upgrade} and apply the migrations it prints.`,
+			target: `better_supabase.modules.${row.name}`
+		});
+	}
+	return findings;
+}
+function authSetting(context, key) {
+	return context.configToml ? tomlGet(context.configToml.document, ["auth", key]) : void 0;
+}
+function tomlLocation(context, key) {
+	if (!context.configToml) return;
+	const line = lineOf(context.configToml.text, new RegExp(`^\\s*${key}\\s*=`)) ?? lineOf(context.configToml.text, /^\[auth\]/);
+	return line ? {
+		file: context.configToml.path,
+		line
+	} : void 0;
+}
+const PUBLIC_PREFIXES = [
+	"NEXT_PUBLIC_",
+	"VITE_",
+	"PUBLIC_",
+	"EXPO_PUBLIC_",
+	"NUXT_PUBLIC_"
+];
+function envEntries(file) {
+	return file.text.split("\n").flatMap((raw, index) => {
+		const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(raw);
+		if (!match) return [];
+		const value = match[2].trim().replace(/^(['"])(.*)\1$/, "$2");
+		return [{
+			key: match[1],
+			value,
+			line: index + 1
+		}];
+	});
+}
+/**
+* `db.x.aggregate(`, an `_sum:`/`_avg:`/`_min:`/`_max:` include or a list
+* with `facetCounts: true`.
+*/
+const AGGREGATE_USE = /\.aggregate\(|\b_(?:sum|avg|min|max)\s*:\s*\{|\bfacetCounts\s*:\s*true\b/;
+/**
+* A policy that reads memberships or the tenant claim: `is_member(...)`,
+* `current_tenant_id()`, `memberships`. The authorization provider's
+* functions (`authorization.requires`) count too.
+*/
+const TENANT_HELPER = /member|tenant|current_org|org_id/i;
+/** A foreign key to the tenant table itself, whose own policies are usually read-only. */
+const TENANT_COLUMN = /^(?:organization|organization|tenant|team|workspace|account)_id$/;
+const COMMANDS = [
+	"select",
+	"insert",
+	"update",
+	"delete"
+];
+const MFA_FACTORS = /\bauth\.\s*"?mfa_factors\b/i;
+const RULES = [
+	...[
+		advisorRule("BS100", "security", "Supabase security advisor", "Findings from the Security Advisor (splinter): RLS disabled in exposed schemas, RLS without policies, mutable search_path, security definer functions callable by anon, exposed auth.users and more. Hosted projects use the Management API; local stacks and direct connections run the pinned splinter.sql."),
+		{
+			code: "BS103",
+			severity: "error",
+			title: "Policy allows anonymous writes",
+			description: "A permissive policy with `true` for anon or public lets anyone insert, update or delete rows.",
+			check: (context) => exposed(context).flatMap((table) => table.policies.filter((policy) => policy.permissive && writes(policy) && publicRoles(policy) && (isTrue(policy.using) || isTrue(policy.check))).map((policy) => ({
+				message: `Policy "${policy.name}" on ${qualified(table)} allows ${policy.command} for ${policy.roles.join(", ") || "public"} with \`true\`.`,
+				target: `${qualified(table)}.${policy.name}`,
+				object: policyObject(table, policy)
+			})))
+		},
+		{
+			code: "BS106",
+			severity: "error",
+			title: "Table not granted to the Data API",
+			description: "Hosted projects grant new tables to anon and authenticated unless the project turns default privileges off (auto_expose_new_tables = false locally). Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated, except tables with RLS on and no permissive policy under `blocks.grants.options.fromPolicies`, which are service-only. Tables marked `serviceRole` in `tables` must have no grants for either role.",
+			check: (context) => {
+				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
+				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
+				return exposed(context).flatMap((table) => {
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude) return [];
+					const granted = (role) => new Set(table.grants.filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
+					if (options?.serviceRole) {
+						const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && grant.privileges.length > 0);
+						return ["anon", "authenticated"].flatMap((role) => {
+							const have = [...granted(role)];
+							if (have.length === 0) return [];
+							const from = fromPublic ? `${role}, public` : role;
+							return [{
+								message: `${qualified(table)} has \`serviceRole: true\` in \`tables\`, but ${role} has ${have.join(", ")} on it, so the Data API reaches it. Remove it from \`expose\` and run \`revoke all on table ${qualified(table)} from ${from};\`.`,
+								target: `${qualified(table)}:${role}`,
+								object: tableObject(table)
+							}];
+						});
+					}
+					const serviceOnly = context.config.blockNames.includes("grants") && context.config.blocks["grants"]?.options?.["fromPolicies"] === true && table.rls && !table.policies.some((policy) => policy.permissive && (appliesTo(policy, "anon") || appliesTo(policy, "authenticated")));
+					const wanted = context.config.expose[qualified(table)] ?? context.config.expose[table.name] ?? {
+						anon: [],
+						authenticated: serviceOnly ? [] : ["select"]
+					};
+					return ["anon", "authenticated"].flatMap((role) => {
+						const have = granted(role);
+						const missing = wanted[role].filter((privilege) => !privilege.includes("(") && !have.has(privilege));
+						if (missing.length === 0) return [];
+						return [{
+							message: `${role} has no ${missing.join(", ")} on ${qualified(table)}, so the Data API answers 42501. Add it to \`expose\` and run \`better-supabase add grants\`, or run \`grant ${missing.join(", ")} on table ${qualified(table)} to ${role};\`.${note}`,
+							target: `${qualified(table)}:${role}`,
+							object: tableObject(table)
+						}];
+					});
+				});
+			}
+		},
+		{
+			code: "BS107",
+			severity: "warning",
+			title: "Tenant table without a policy for every command",
+			description: "A tenant-scoped table with policies for some commands but not all four denies the rest silently: an update or delete then affects 0 rows without an error. Add the missing policies, or a restrictive one, so the intent is explicit, and test it with `expectTenantIsolation`.",
+			check: (context) => {
+				const column = context.config.plugins.tenant?.column;
+				const providerFunctions = [...new Set((context.config.authorization?.requires ?? []).flatMap((entry) => [entry.function, entry.function.slice(entry.function.indexOf(".") + 1)]))];
+				const tables = exposed(context);
+				const roots = new Set(tables.flatMap((table) => table.foreignKeys.filter((key) => key.columns.length === 1 && (column === void 0 ? TENANT_COLUMN.test(key.columns[0]) : key.columns[0] === column)).map((key) => `${key.refSchema}.${key.refTable}`)));
+				return tables.flatMap((table) => {
+					if (table.kind !== "table" || !table.rls) return [];
+					if (roots.has(qualified(table))) return [];
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude || options?.serviceRole) return [];
+					const forAuthenticated = (policy) => policy.roles.some((role) => ["authenticated", "public"].includes(role));
+					const granting = table.policies.filter((policy) => policy.permissive && forAuthenticated(policy));
+					if (granting.length === 0) return [];
+					if (!(column !== void 0 && table.columns.some((entry) => entry.name === column) || granting.some((policy) => {
+						const text = [
+							policy.using ?? "",
+							policy.check ?? "",
+							...policy.functions ?? []
+						].join(" ");
+						return TENANT_HELPER.test(text) || providerFunctions.some((fn) => text.includes(fn));
+					}))) return [];
+					const denying = table.policies.filter((policy) => !policy.permissive && forAuthenticated(policy) && /^\s*false\s*$/i.test(policy.using ?? ""));
+					const covered = new Set([...granting, ...denying].flatMap((policy) => policy.command === "all" ? COMMANDS : [policy.command]));
+					const missing = COMMANDS.filter((command) => !covered.has(command));
+					if (missing.length === 0) return [];
+					return [{
+						message: `${qualified(table)} is tenant-scoped but has no ${missing.join(", ")} policy for authenticated, so ${missing.join(" and ")} silently match no rows. Add the policies, or state the intent with a restrictive \`using (false)\` policy.`,
+						target: qualified(table),
+						object: tableObject(table)
+					}];
+				});
+			}
+		},
+		{
+			code: "BS108",
+			severity: "error",
+			title: "Policy reads auth.mfa_factors directly",
+			description: "`authenticated` has no access to `auth.mfa_factors`, so a policy that reads it fails every request with 42501. Check the factor in a `security definer` function such as `better_supabase.mfa_satisfied()` from the `mfa` SQL module.",
+			check: (context) => exposed(context).flatMap((table) => table.policies.filter((policy) => MFA_FACTORS.test(`${policy.using ?? ""} ${policy.check ?? ""}`)).map((policy) => ({
+				message: `Policy "${policy.name}" on ${qualified(table)} reads auth.mfa_factors, which authenticated can't select, so every request fails with 42501. Use \`(select better_supabase.mfa_satisfied())\` from \`better-supabase add mfa\` instead.`,
+				target: `${qualified(table)}.${policy.name}`,
+				object: policyObject(table, policy)
+			})))
+		},
+		advisorRule("BS200", "performance", "Supabase performance advisor", "Findings from the Performance Advisor (splinter): unindexed foreign keys, auth calls re-evaluated per row in policies, multiple permissive policies, unused and duplicate indexes and more."),
+		{
+			code: "BS204",
+			severity: "warning",
+			title: "Tenant column without an index",
+			description: "The tenant plugin and tenant policies filter every query on this column. A view is left out: a query on it uses the indexes of its tables.",
+			check: (context) => {
+				const tenant = context.config.plugins.tenant;
+				if (!tenant) return [];
+				return exposed(context).filter((table) => table.kind === "table" && table.columns.some((column) => column.name === tenant.column) && !table.indexes.some((index) => !index.partial && index.columns[0] === tenant.column)).map((table) => ({
+					message: `${qualified(table)}.${tenant.column} has no index starting with it.`,
+					target: `${qualified(table)}.${tenant.column}`,
+					object: tableObject(table)
+				}));
+			}
+		},
+		{
+			code: "BS210",
+			severity: "warning",
+			title: "Aggregates used while PostgREST disables them",
+			description: "PostgREST rejects `count()`, `sum()` and the other aggregates with PGRST123 unless `pgrst.db_aggregates_enabled` is on for the authenticator role. `aggregate()`, `_sum`/`_avg`/`_min`/`_max` includes and list `facetCounts` need it; `better-supabase/postgres` does not.",
+			check: (context) => {
+				const settings = context.snapshot.extras.roleSettings;
+				if (!settings) return [];
+				const enabled = settings["authenticator"]?.["pgrst.db_aggregates_enabled"];
+				if (enabled === "true" || enabled === "on") return [];
+				for (const file of context.sources) {
+					const line = lineOf(file.text, AGGREGATE_USE);
+					if (line === void 0) continue;
+					return [{
+						message: `${file.path} uses aggregates, but PostgREST has them off, so these requests fail with PGRST123. Run \`alter role authenticator set pgrst.db_aggregates_enabled = 'true'; notify pgrst, 'reload config';\` in a migration.`,
+						target: "authenticator:pgrst.db_aggregates_enabled",
+						location: {
+							file: file.path,
+							line
+						}
+					}];
+				}
+				return [];
+			}
+		},
+		{
+			code: "BS301",
+			severity: "warning",
+			title: "Soft delete hidden by a select policy",
+			description: "PostgREST re-reads updated rows through the select policy. If it hides deleted rows, soft-deleting fails with an RLS error unless the update returns nothing.",
+			check: (context) => {
+				const softDelete = context.config.plugins.softDelete;
+				if (!softDelete) return [];
+				return exposed(context).flatMap((table) => {
+					if (!table.columns.some((column) => column.name === softDelete.column)) return [];
+					return table.policies.filter((policy) => (policy.command === "select" || policy.command === "all") && new RegExp(`\\b${softDelete.column}\\b\\s+IS\\s+NULL`, "i").test(policy.using ?? "")).map((policy) => ({
+						message: `Policy "${policy.name}" on ${qualified(table)} hides rows where ${softDelete.column} is set, so \`softDelete()\` can't read the row back. Filter deleted rows in queries (the plugin does) instead of in the policy.`,
+						target: `${qualified(table)}.${policy.name}`,
+						object: policyObject(table, policy)
+					}));
+				});
+			}
+		},
+		{
+			code: "BS302",
+			severity: "warning",
+			title: "Bucket differs from the config",
+			description: "A bucket in `buckets` is missing or has different settings in the database.",
+			check: (context) => Object.entries(context.config.buckets).flatMap(([name, bucket]) => {
+				const id = bucket.id ?? name.replaceAll(/[A-Z]/g, (char) => `-${char.toLowerCase()}`);
+				const defined = defineBucket({
+					id,
+					path: bucket.path,
+					...bucket.public === void 0 ? {} : { public: bucket.public },
+					...bucket.fileSizeLimit === void 0 ? {} : { fileSizeLimit: bucket.fileSizeLimit },
+					...bucket.allowedMimeTypes === void 0 ? {} : { allowedMimeTypes: bucket.allowedMimeTypes },
+					...bucket.versioning === void 0 ? {} : { versioning: bucket.versioning },
+					...bucket.lifecycle === void 0 ? {} : { lifecycle: bucket.lifecycle }
+				});
+				const actual = catalogOf(context).buckets.find((entry) => entry.id === id);
+				const inDatabase = defined.drift(actual).map((drift) => ({
+					message: `Bucket ${id}: ${drift.message}`,
+					target: `storage.buckets.${id}`
+				}));
+				const toml = context.configToml;
+				const declared = toml ? tomlGet(toml.document, [
+					"storage",
+					"buckets",
+					id
+				]) : void 0;
+				if (!toml || !declared || typeof declared !== "object" || Array.isArray(declared)) return inDatabase;
+				const entry = declared;
+				const size = entry["file_size_limit"];
+				const mimes = entry["allowed_mime_types"];
+				const line = lineOf(toml.text, new RegExp(`^\\[storage\\.buckets\\.${id.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\]`));
+				const inToml = defined.drift({
+					public: entry["public"] === true,
+					fileSizeLimit: typeof size === "string" || typeof size === "number" ? parseSize(size) : null,
+					allowedMimeTypes: Array.isArray(mimes) ? mimes.map(String) : null
+				}).map((drift) => ({
+					message: `${toml.path} [storage.buckets.${id}]: ${drift.message.replace(`Bucket "${id}" `, "")}`,
+					target: `[storage.buckets.${id}]`,
+					...line ? { location: {
+						file: toml.path,
+						line
+					} } : {}
+				}));
+				return [...inDatabase, ...inToml];
+			})
+		},
+		{
+			code: "BS303",
+			severity: "error",
+			title: "Generated code is out of date",
+			description: "The generated module no longer matches the database, so types and metadata are wrong. Same check as `gen --check`.",
+			check: async (context) => {
+				const stale = [];
+				for (const file of await renderFiles(context.config, context.snapshot)) {
+					const current = await readFile(resolve(context.config.root, file.path), "utf-8").catch(() => void 0);
+					if (!sameText(current, file.contents)) stale.push({
+						message: `${file.path} is ${current === void 0 ? "missing" : "out of date"}. Run \`better-supabase gen\`.`,
+						target: file.path,
+						...current === void 0 ? {} : { location: {
+							file: file.path,
+							line: 1
+						} }
+					});
+				}
+				return stale;
+			}
+		},
+		{
+			code: "BS304",
+			severity: "warning",
+			title: "SQL module files are out of date",
+			description: "A module listed in `blocks` differs from the version in this release. Same check as `sql sync --check`.",
+			check: async (context) => {
+				const stale = [];
+				const workflow = workflowOf(context);
+				for (const { file, path, current, behind } of await moduleFiles(context)) {
+					if (behind || sameModuleFile(current, file.contents)) continue;
+					const migrated = workflow === "migrations" && file.kind !== "test";
+					const edited = current === void 0 || migrated ? "" : ` If you edited it, move the change to \`blocks.${file.module}\` in better-supabase.config.ts or to the module's SQL hooks: sync overwrites the file.`;
+					const next = file.kind === "data" && !migrated ? "Run `better-supabase sql sync`, which also writes the rows into a migration, since a schema diff skips them." : `Run \`better-supabase sql sync\`, then \`${migrationCommand(workflow)}\`.`;
+					const subject = migrated ? `${file.module} in ${path} is ${current === void 0 ? "missing" : "out of date"}` : `${path} (${file.module}) is ${current === void 0 ? "missing" : "out of date"}`;
+					if (stale.some((finding) => finding.message === `${subject}. ${next}${edited}`)) continue;
+					stale.push({
+						message: `${subject}. ${next}${edited}`,
+						target: path,
+						...current === void 0 ? {} : { location: {
+							file: path,
+							line: 1
+						} }
+					});
+				}
+				return stale;
+			}
+		},
+		{
+			code: "BS316",
+			severity: "warning",
+			title: "Legacy migra diff engine",
+			description: "`supabase/config.toml` has no `[experimental.pgdelta] enabled = true`, so the Supabase CLI diffs `supabase/schemas` with migra, which drops grants, comments and security-invoker views and needs the stack stopped. New projects from `supabase init` use pg-delta. Setting `sql.workflow` to `migra` or `migrations` silences it.",
+			check: (context) => {
+				const toml = context.configToml;
+				if (toml === void 0 || diffEngine(toml) === "pg-delta") return [];
+				if (context.config.sql.workflow !== void 0 && context.config.sql.workflow !== "pg-delta") return [];
+				const schemas = `${toml.dir}/schemas/`;
+				if (!(context.config.blockNames.length > 0 || (context.sqlFiles ?? []).some((file) => file.path.startsWith(schemas)))) return [];
+				const keep = context.config.sql.workflow === void 0 ? " To stay on migra, set `sql.workflow: \"migra\"` in better-supabase.config.ts." : "";
+				return [{
+					message: `${toml.path} uses the legacy migra engine. Add \`[experimental.pgdelta]\` with \`enabled = true\`, remove \`[db.migrations] schema_paths\`, and create migrations with \`supabase db schema declarative sync\` instead of \`supabase db diff\`.${keep}`,
+					target: toml.path,
+					location: {
+						file: toml.path,
+						line: 1
+					}
+				}];
+			}
+		},
+		{
+			code: "BS305",
+			severity: "warning",
+			title: "Live query table without change broadcasts",
+			description: "A table in `realtime.tables` has no `bs_realtime` trigger, so live queries never hear about its changes.",
+			check: (context) => {
+				const tables = catalogOf(context).tables;
+				return context.config.realtime.tables.flatMap((name) => {
+					const table = tables.find((entry) => entry.name === name || qualified(entry) === name);
+					if (!table) return [{
+						message: `realtime.tables lists "${name}", which doesn't exist.`,
+						target: name
+					}];
+					if (table.triggers.some((trigger) => trigger.name.startsWith("bs_realtime"))) return [];
+					return [{
+						message: `${qualified(table)} is in realtime.tables but has no broadcast trigger. Run \`better-supabase add realtime-tables\`, then \`${migrationCommand(workflowOf(context))}\`.`,
+						target: qualified(table),
+						object: tableObject(table)
+					}];
+				});
+			}
+		},
+		{
+			code: "BS306",
+			severity: "warning",
+			title: "Realtime delete events without keys",
+			description: "Tables in the `supabase_realtime` publication send the replica identity of deleted rows. With `nothing`, or `default` without a primary key, delete events carry no keys and clients cannot tell which row went away.",
+			check: (context) => {
+				const published = new Set(catalogOf(context).realtime);
+				return catalogOf(context).tables.filter((table) => published.has(qualified(table)) && (table.replicaIdentity === "NOTHING" || table.replicaIdentity === "DEFAULT" && table.primaryKey.length === 0)).map((table) => ({
+					message: `${qualified(table)} is published to Realtime with replica identity ${table.replicaIdentity?.toLowerCase() ?? "unknown"}${table.primaryKey.length === 0 ? " and no primary key" : ""}. Add a primary key or run \`alter table ${qualified(table)} replica identity full\`.`,
+					target: qualified(table),
+					object: tableObject(table)
+				}));
+			}
+		},
+		{
+			code: "BS311",
+			severity: "warning",
+			title: "SQL module behind its current version",
+			description: "A module file or `better_supabase.modules` records an older module version than this release ships. Same check as `sql upgrade --check`.",
+			check: moduleVersionsBehind
+		},
+		{
+			code: "BS401",
+			severity: "warning",
+			title: "Refresh token reuse interval is 0",
+			description: "Server instances refreshing the same session at once need a reuse interval, or all but one of them sign the user out.",
+			check: (context) => {
+				if (!context.configToml) return [];
+				const rotation = authSetting(context, "enable_refresh_token_rotation");
+				const interval = authSetting(context, "refresh_token_reuse_interval");
+				if (rotation === false || rotation === "false" || interval === void 0 || Number(interval) > 0) return [];
+				const location = tomlLocation(context, "refresh_token_reuse_interval");
+				return [{
+					message: "refresh_token_reuse_interval = 0 with refresh token rotation. Use 10 (the Supabase default) so concurrent refreshes succeed.",
+					target: "[auth] refresh_token_reuse_interval",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS402",
+			severity: "info",
+			title: "Long access token lifetime",
+			description: "Tokens are verified locally without an auth call, so a revoked session stays valid until the token expires.",
+			check: (context) => {
+				if (!context.configToml) return [];
+				const expiry = Number(authSetting(context, "jwt_expiry") ?? 3600);
+				if (expiry <= 3600) return [];
+				const location = tomlLocation(context, "jwt_expiry");
+				return [{
+					message: `jwt_expiry is ${expiry}s. Keep it at 3600 or less; sessions refresh in the proxy.`,
+					target: "[auth] jwt_expiry",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS403",
+			severity: "info",
+			title: "Local stack signs tokens with a shared secret",
+			description: "Hosted projects sign with asymmetric keys. Using the same locally means local tokens verify through JWKS just like production.",
+			check: (context) => {
+				if (!context.configToml || authSetting(context, "signing_keys_path") || tomlGet(context.configToml.document, ["db", "driver"]) !== void 0) return [];
+				const location = tomlLocation(context, "signing_keys_path");
+				return [{
+					message: "No [auth] signing_keys_path. Run `better-supabase keys` to sign local tokens with ES256.",
+					target: "[auth] signing_keys_path",
+					...location ? { location } : {}
+				}];
+			}
+		},
+		{
+			code: "BS406",
+			severity: "warning",
+			title: "Foreign key to auth.users blocks account deletion",
+			description: "A foreign key to `auth.users` with `no action` or `restrict` makes `auth.admin.deleteUser` (and `deleteAccount`) fail with \"Database error deleting user\" while the user has rows. Use `on delete cascade` for data the user owns, or `on delete set null` for records that outlive them.",
+			check: (context) => catalogOf(context).tables.flatMap((table) => table.schema === "auth" ? [] : table.foreignKeys.filter((key) => key.refSchema === "auth" && key.refTable === "users" && (key.onDelete === "no action" || key.onDelete === "restrict")).map((key) => ({
+				message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) references auth.users with on delete ${key.onDelete}. Deleting the user fails while rows point at it; use on delete cascade or set null.`,
+				target: `${qualified(table)}.${key.name}`,
+				object: tableObject(table)
+			})))
+		},
+		{
+			code: "BS501",
+			severity: "error",
+			title: "Secret in a browser variable",
+			description: "Variables with a public prefix are bundled into client code. A secret key there gives every visitor full access.",
+			check: (context) => context.envFiles.flatMap((file) => envEntries(file).filter((entry) => PUBLIC_PREFIXES.some((prefix) => entry.key.startsWith(prefix)) && (entry.value.startsWith("sb_secret_") || /SECRET|SERVICE_ROLE/.test(entry.key))).map((entry) => ({
+				message: `${entry.key} in ${file.path} is exposed to the browser but holds a secret. Rename it without the public prefix and rotate the key.`,
+				target: `${file.path}:${entry.key}`,
+				location: {
+					file: file.path,
+					line: entry.line
+				}
+			})))
+		},
+		{
+			code: "BS502",
+			severity: "warning",
+			title: "Env file with secrets is not ignored by git",
+			description: "Env files holding a secret key or database password should never be committed.",
+			check: (context) => {
+				const patterns = context.gitignore.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+				const ignored = (path) => patterns.some((pattern) => {
+					const source = pattern.replace(/^\//, "").replaceAll(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("*", ".*");
+					return new RegExp(`^${source}$`).test(path) || new RegExp(`(^|/)${source}$`).test(path);
+				});
+				return context.envFiles.flatMap((file) => {
+					const secret = envEntries(file).find((entry) => entry.value.startsWith("sb_secret_") || /SECRET_KEY|SERVICE_ROLE|DB_URL|DATABASE_URL/.test(entry.key));
+					if (!secret || ignored(file.path) || file.path.endsWith(".example")) return [];
+					return [{
+						message: `${file.path} contains ${secret.key} but isn't in .gitignore.`,
+						target: file.path,
+						location: {
+							file: file.path,
+							line: secret.line
+						}
+					}];
+				});
+			}
+		}
+	],
+	...RLS_RULES,
+	...POLICY_RULES,
+	...SCHEMA_DESIGN_RULES,
+	...HOOK_RULES,
+	...COOKIE_RULES,
+	...AUTHORIZATION_RULES,
+	...LIVE_RULES,
+	...MODULE_RULES,
+	...PGDELTA_RULES,
+	...LITE_RULES,
+	...DEPENDENCY_RULES,
+	...WORKFLOW_BUILDER_RULES,
+	...FLAG_RULES,
+	...REALTIME_RULES,
+	...ADOPTION_RULES
+].sort((a, b) => byCodePoint(a.code, b.code));
+const RULE_CODES = RULES.map((rule) => rule.code);
+async function runRules(context, rules = RULES) {
+	const findings = [];
+	const scoped = {
+		...context,
+		codes: rules.map((rule) => rule.code)
+	};
+	for (const rule of rules) {
+		const help = `${DOCS_URL}#${rule.code.toLowerCase()}`;
+		const skipped = skippedForMetadata(context.snapshot, rule, help);
+		if (skipped) {
+			findings.push(skipped);
+			continue;
+		}
+		for (const input of await rule.check(scoped)) findings.push({
+			code: rule.code,
+			severity: rule.severity,
+			title: rule.title,
+			help,
+			...input
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor/format.ts
+const DOCTOR_FORMATS = [
+	"text",
+	"json",
+	"sarif",
+	"github"
+];
+const DOCTOR_REPORT_SCHEMA_URL = "https://unpkg.com/better-supabase/schemas/doctor-report-v1.json";
+const SARIF_SCHEMA_URL = "https://docs.oasis-open.org/sarif/sarif/v2.1.0/errata01/os/schemas/sarif-schema-2.1.0.json";
+function summarize(findings) {
+	return {
+		errors: findings.filter((finding) => finding.severity === "error").length,
+		warnings: findings.filter((finding) => finding.severity === "warning").length,
+		infos: findings.filter((finding) => finding.severity === "info").length
+	};
+}
+const plural = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
+const SEVERITY_FORMAT = {
+	error: "red",
+	warning: "yellow",
+	info: "cyan"
+};
+function text(findings, paint) {
+	if (findings.length === 0) return "No problems found.";
+	const order = [
+		"error",
+		"warning",
+		"info"
+	];
+	const lines = [...findings].sort((a, b) => order.indexOf(a.severity) - order.indexOf(b.severity) || byCodePoint(a.code, b.code)).flatMap((finding) => [
+		`${paint(SEVERITY_FORMAT[finding.severity], finding.severity.padEnd(7))} ${paint("bold", finding.code)} ${finding.title}${finding.location ? `  ${finding.location.file}:${finding.location.line}` : ""}`,
+		`        ${finding.message}`,
+		`        ${finding.help}`
+	]);
+	const summary = summarize(findings);
+	lines.push("", `${plural(summary.errors, "error")}, ${plural(summary.warnings, "warning")}, ${plural(summary.infos, "note")}.`);
+	return lines.join("\n");
+}
+function sarifLevel(severity) {
+	switch (severity) {
+		case "error": return "error";
+		case "warning": return "warning";
+		case "info": return "note";
+		default: return severity;
+	}
+}
+function sarif(findings, rules, version, fallback) {
+	return {
+		$schema: SARIF_SCHEMA_URL,
+		version: "2.1.0",
+		runs: [{
+			tool: { driver: {
+				name: "better-supabase doctor",
+				version,
+				informationUri: DOCS_URL,
+				rules: rules.map((rule) => ({
+					id: rule.code,
+					name: rule.title.replaceAll(/[^A-Za-z0-9]+(.)?/g, (_, char) => (char ?? "").toUpperCase()),
+					shortDescription: { text: rule.title },
+					fullDescription: { text: rule.description },
+					helpUri: `${DOCS_URL}#${rule.code.toLowerCase()}`,
+					defaultConfiguration: { level: sarifLevel(rule.severity) }
+				}))
+			} },
+			results: findings.map((finding) => ({
+				ruleId: finding.code,
+				ruleIndex: rules.findIndex((rule) => rule.code === finding.code),
+				level: sarifLevel(finding.severity),
+				message: { text: finding.message },
+				locations: [{ physicalLocation: {
+					artifactLocation: { uri: finding.location?.file ?? fallback },
+					region: { startLine: finding.location?.line ?? 1 }
+				} }],
+				partialFingerprints: { target: `${finding.code}:${finding.target ?? finding.message}` }
+			}))
+		}]
+	};
+}
+const escapeData = (value) => value.replaceAll("%", "%25").replaceAll("\r", "%0D").replaceAll("\n", "%0A");
+const escapeProperty = (value) => escapeData(value).replaceAll(":", "%3A").replaceAll(",", "%2C");
+function github(findings) {
+	return findings.map((finding) => {
+		return `::${finding.severity === "info" ? "notice" : finding.severity} ${[...finding.location ? [`file=${escapeProperty(finding.location.file)}`, `line=${finding.location.line}`] : [], `title=${escapeProperty(`${finding.code} ${finding.title}`)}`].join(",")}::${escapeData(`${finding.message} (${finding.help})`)}`;
+	}).join("\n");
+}
+function jsonReport(findings, version) {
+	return {
+		$schema: DOCTOR_REPORT_SCHEMA_URL,
+		version: 1,
+		tool: {
+			name: "better-supabase",
+			version
+		},
+		summary: summarize(findings),
+		findings
+	};
+}
+function formatReport(findings, options) {
+	switch (options.format) {
+		case "text": return text(findings, options.paint ?? plain);
+		case "json": return JSON.stringify(jsonReport(findings, options.version), null, 2);
+		case "sarif": return JSON.stringify(sarif(findings, options.rules, options.version, options.fallbackFile), null, 2);
+		case "github": return github(findings);
+		default: return options.format;
+	}
+}
+//#endregion
+//#region src/cli/doctor/inputs.ts
+const ENV_FILES = [
+	".env",
+	".env.local",
+	".env.example",
+	".env.development",
+	".env.development.local",
+	".env.production",
+	".env.production.local"
+];
+async function readText(root, path) {
+	const absolute = resolve(root, path);
+	return existsSync(absolute) ? {
+		path,
+		text: await readFile(absolute, "utf-8")
+	} : void 0;
+}
+/** The declarative schemas in the diff engine's order, then the migrations newest first. */
+async function sqlFiles(root, toml, workflow) {
+	const read = async (path) => ({
+		path,
+		text: await readFile(resolve(root, path), "utf-8")
+	});
+	const schemas = await Promise.all((await schemaPaths(root, toml, workflow)).files.map(read));
+	const migrationsPath = `${toml?.dir ?? "supabase"}/migrations`;
+	const migrationsDir = resolve(root, migrationsPath);
+	const migrations = existsSync(migrationsDir) ? (await readdir(migrationsDir)).filter((name) => name.endsWith(".sql")).sort().reverse().map((name) => `${migrationsPath}/${name}`) : [];
+	return [...schemas, ...await Promise.all(migrations.map(read))];
+}
+/** Files matching `doctor.sources`, skipping dependencies and build output. */
+async function sourceFiles(config) {
+	const files = [];
+	for await (const path of glob([...config.doctor.sources], {
+		cwd: config.root,
+		exclude: (name) => name === "node_modules" || name === ".next"
+	})) files.push({
+		path,
+		text: await readFile(resolve(config.root, path), "utf-8")
+	});
+	return files.sort((a, b) => byCodePoint(a.path, b.path));
+}
+//#endregion
+//#region src/cli/doctor/advisors.ts
+/**
+* splinter (https://github.com/supabase/splinter), the linter behind the
+* dashboard's Security and Performance Advisors. It has no license, so it is
+* downloaded at this commit and checked against the hash instead of bundled.
+*/
+const SPLINTER_COMMIT = "e74a9e36cb12258cb67d1464bc1cb196e9cd8446";
+const SPLINTER_SHA256 = "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349";
+const SPLINTER_URL = `https://raw.githubusercontent.com/supabase/splinter/${SPLINTER_COMMIT}/splinter.sql`;
+function isLint(value) {
+	const lint = value;
+	return typeof lint === "object" && lint !== null && typeof lint.name === "string" && typeof lint.level === "string" && Array.isArray(lint.categories);
+}
+/** The hosted project's advisors (`GET /v1/projects/{ref}/advisors/{category}`). */
+function managementAdvisors(options) {
+	const base = (options.apiUrl ?? "https://api.supabase.com").replace(/\/$/, "");
+	return {
+		describe: `project ${options.projectRef} advisors (Management API)`,
+		async lints(category) {
+			const url = `${base}/v1/projects/${encodeURIComponent(options.projectRef)}/advisors/${category}`;
+			const text = await request(url, {
+				what: `Management API ${category} advisors`,
+				headers: { authorization: `Bearer ${options.accessToken}` },
+				...options.fetch ? { fetch: options.fetch } : {}
+			});
+			const body = JSON.parse(text);
+			if (!Array.isArray(body.lints)) throw new CliError("request_failed", `Management API ${category} advisors returned no "lints".`);
+			return body.lints.filter(isLint);
+		}
+	};
+}
+/** The `[api] schemas` list of a `config.toml`, when it names any. */
+function apiSchemas(document) {
+	const value = document ? tomlGet(document, ["api", "schemas"]) : void 0;
+	if (!Array.isArray(value)) return [];
+	return value.filter((schema) => typeof schema === "string" && schema.trim() !== "");
+}
+const literal = (value) => `'${value.replaceAll("'", "''")}'`;
+/** The read-only transaction splinter runs in, with `pgrst.db_schemas` set first. */
+function splinterScript(sql, schemas = []) {
+	return `begin read only;\n${schemas.length > 0 ? `set local pgrst.db_schemas = ${literal(schemas.join(","))};\n` : ""}${sql}\n;\nrollback;`;
+}
+const sha256 = (text) => createHash("sha256").update(text).digest("hex");
+/** Downloads (once) and verifies the pinned `splinter.sql`. */
+async function splinterSql(options) {
+	const file = resolve(options.cacheDir, `splinter-${SPLINTER_COMMIT}.sql`);
+	if (existsSync(file)) {
+		const cached = await readFile(file, "utf-8");
+		if (sha256(cached) === SPLINTER_SHA256) return cached;
+	}
+	const text = await request(SPLINTER_URL, {
+		what: `Downloading splinter.sql from ${SPLINTER_URL}`,
+		...options.fetch ? { fetch: options.fetch } : {}
+	});
+	if (sha256(text) !== SPLINTER_SHA256) throw new CliError("integrity_failed", `splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
+	await mkdir(dirname(file), { recursive: true });
+	await writeFile(file, text);
+	return text;
+}
+/** `pg` returns one result per statement for a multi-statement query. */
+function lintRows(result) {
+	const results = Array.isArray(result) ? result : [result];
+	return results.find((entry) => entry.fields?.some((field) => field.name === "cache_key"))?.rows ?? results.at(-1)?.rows ?? [];
+}
+/**
+* Runs splinter against a database (local stack, `$DATABASE_URL` or `--db-url-stdin`) in a
+* read-only transaction that is rolled back.
+*/
+function splinterAdvisors(queryable, describe, options) {
+	let all;
+	const run = async () => {
+		const sql = await splinterSql(options);
+		return lintRows(await queryable.query(splinterScript(sql, options.schemas))).filter(isLint);
+	};
+	return {
+		describe: `${describe} (splinter ${SPLINTER_COMMIT.slice(0, 7)})`,
+		async lints(category) {
+			all ??= run();
+			const wanted = category.toUpperCase();
+			return (await all).filter((lint) => lint.categories.includes(wanted));
+		}
+	};
+}
+//#endregion
+//#region src/cli/doctor/live-source.ts
+/** Checks that read the database itself rather than the snapshot. */
+const LIVE_CODES = /* @__PURE__ */ new Set([
+	"BS100",
+	"BS200",
+	"BS208",
+	"BS209",
+	"BS212",
+	"BS225"
+]);
+/**
+* The database doctor reads, for advisors and live checks: the Management
+* API for hosted projects, one lazily opened connection otherwise (splinter
+* runs over it). Saved snapshots skip both.
+*/
+function openLive(config, env, source, pg) {
+	const none = { close: () => Promise.resolve() };
+	const file = snapshotFile(config, source);
+	if (file) {
+		const skipped = `reading the saved snapshot ${file}; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+		return {
+			...none,
+			advisors: { skipped },
+			database: { skipped }
+		};
+	}
+	let opened;
+	const open = () => opened ??= openSource(config, env, source, pg);
+	const target = managementTarget(config, env, source);
+	const database = {
+		describe: target ? `project ${target.projectRef} (Management API)` : "database",
+		session: !target,
+		async query(sql) {
+			return (await (await open()).queryable.query(sql)).rows;
+		}
+	};
+	const close = async () => {
+		if (opened) await (await opened).close();
+	};
+	if (target) return {
+		advisors: managementAdvisors(target),
+		database,
+		open,
+		close
+	};
+	let splinter;
+	const cacheDir = resolve(config.root, CACHE_DIR);
+	return {
+		advisors: {
+			describe: "database (splinter)",
+			async lints(category) {
+				splinter ??= Promise.all([open(), readSupabaseToml(config.root).catch(() => void 0)]).then(([db, toml]) => splinterAdvisors(db.queryable, db.describe, {
+					cacheDir,
+					schemas: apiSchemas(toml?.document)
+				}));
+				return (await splinter).lints(category);
+			}
+		},
+		database,
+		open,
+		close
+	};
+}
+//#endregion
+//#region src/cli/doctor/locate.ts
+const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Where a table, function or policy is declared: declarative schemas first, then the newest migration. */
+function locate(files, object) {
+	const name = `"?${escape(object.name)}"?`;
+	const qualifiedName = `(?:"?${escape(object.schema)}"?\\.)?${name}`;
+	if (object.kind === "policy" && object.table !== void 0) {
+		const onTable = new RegExp(`create\\s+policy\\s+${name}\\s+on\\s+(?:only\\s+)?(?:"?${escape(object.schema)}"?\\.)?"?${escape(object.table)}"?(?:\\s|;|$)`, "i");
+		for (const file of files) {
+			const match = onTable.exec(file.text);
+			if (match) return {
+				file: file.path,
+				line: file.text.slice(0, match.index).split("\n").length
+			};
+		}
+		return;
+	}
+	const pattern = object.kind === "table" ? new RegExp(`create\\s+(?:unlogged\\s+)?table\\s+(?:if\\s+not\\s+exists\\s+)?${qualifiedName}(?:\\s|\\(|$)`, "i") : object.kind === "function" ? new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${qualifiedName}\\s*\\(`, "i") : new RegExp(`create\\s+policy\\s+${name}`, "i");
+	for (const file of files) {
+		const line = lineOf(file.text, pattern);
+		if (line) return {
+			file: file.path,
+			line
+		};
+	}
+}
+//#endregion
+//#region src/cli/doctor/options.ts
+/** The formats `--format` takes; `--json` picks the JSON one. */
+const FLAG_FORMATS = DOCTOR_FORMATS.filter((format) => format !== "json");
+/** `--json` picks the JSON report; `--format`, then `doctor.format`, picks between the others. */
+function reportFormat(args, configured) {
+	if (args.format === "json") throw new CliError("usage", "--format json is now the global --json flag");
+	if (args.json === true) {
+		if (args.format !== void 0) throw new CliError("usage", "Pass --json or --format, not both");
+		return "json";
+	}
+	if (args.format === void 0) return configured;
+	const format = FLAG_FORMATS.find((candidate) => candidate === args.format);
+	if (!format) throw new CliError("invalid_value", `--format must be one of ${FLAG_FORMATS.join(", ")}`);
+	return format;
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** `--as <uuid>` or `--claims <json>` as `request.jwt.claims`. */
+function explainClaims(args) {
+	const as = args.as;
+	const claims = args.claims;
+	if (as && claims) return { error: "Pass --as or --claims, not both" };
+	if (as) {
+		if (!UUID.test(as)) return { error: `--as takes a user id (uuid), got "${as}"` };
+		return {
+			sub: as,
+			role: "authenticated"
+		};
+	}
+	if (!claims) return { role: "anon" };
+	try {
+		const parsed = JSON.parse(claims);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return { error: "--claims takes a JSON object" };
+		return {
+			role: "anon",
+			...parsed
+		};
+	} catch (cause) {
+		return { error: `--claims is not valid JSON: ${errorText(cause)}` };
+	}
+}
+//#endregion
+//#region src/cli/commands/doctor.ts
+const ARGS = {
+	format: {
+		type: "string",
+		description: "text, sarif (code scanning) or github (workflow annotations); also doctor.format, default text. --json for the JSON report",
+		valueHint: "format"
+	},
+	out: {
+		type: "string",
+		description: "Write the report to a file; also doctor.output",
+		valueHint: "file"
+	},
+	only: {
+		type: "string",
+		description: "Run only these checks, e.g. --only BS100,BS304; also doctor.only",
+		valueHint: "codes"
+	},
+	ignore: {
+		type: "string",
+		description: "Skip checks; also doctor.ignore in the config",
+		valueHint: "codes"
+	},
+	"fail-on": {
+		type: "string",
+		description: "Exit 1 on findings at this level: error (the default), warning (the default with doctor.strict) or never",
+		valueHint: "level"
+	},
+	metadata: {
+		type: "string",
+		description: "Check a GeneratorMetadata document (- for stdin); checks it lacks data for are skipped",
+		valueHint: "path|-"
+	},
+	stats: {
+		type: "boolean",
+		description: "Report slow frequent statements from pg_stat_statements (BS209)"
+	},
+	explain: {
+		type: "string",
+		description: "EXPLAIN ANALYZE these tables under RLS, rolled back (BS212)",
+		valueHint: "tables"
+	},
+	as: {
+		type: "string",
+		description: "Plan as this authenticated user, and measure the claims the custom access token hook returns for them (BS405)",
+		valueHint: "uuid"
+	},
+	claims: {
+		type: "string",
+		description: "Plan with these JWT claims ({\"role\":\"authenticated\",...})",
+		valueHint: "json"
+	},
+	"fix-grants": {
+		type: "boolean",
+		description: "Print the grant and revoke SQL BS404 asks for, to add to your schema or migration"
+	}
+};
+async function runDoctor(config, args, env, options = {}) {
+	const format = reportFormat(args, config.doctor.format);
+	const only = args.only === void 0 ? [...config.doctor.only] : list(args.only);
+	const ignore = /* @__PURE__ */ new Set([...config.doctor.ignore, ...list(args.ignore)]);
+	const unknown = [...only, ...ignore].filter((code) => !RULE_CODES.includes(code));
+	if (unknown.length > 0) throw new CliError("usage", `Unknown check ${unknown.join(", ")}. Checks: ${RULE_CODES.join(", ")}`);
+	const explainTables = list(args.explain);
+	const stats = args.stats === true;
+	const claims = explainClaims(args);
+	if ("error" in claims) throw new CliError("usage", String(claims.error));
+	if (args.claims !== void 0 && explainTables.length === 0) throw new CliError("usage", "--claims plans a query, so it needs --explain <table>.");
+	const hookUser = args.as;
+	const asked = /* @__PURE__ */ new Set([
+		...stats ? ["BS209"] : [],
+		...explainTables.length > 0 ? ["BS212"] : [],
+		...hookUser ? ["BS405"] : []
+	]);
+	const fixGrants = args["fix-grants"] === true;
+	const rules = fixGrants ? RULES.filter((rule) => rule.code === "BS404") : RULES.filter((rule) => (only.length === 0 || only.includes(rule.code) || asked.has(rule.code)) && !ignore.has(rule.code));
+	const snapshotPath = args.snapshot;
+	const dbUrl = options.dbUrl;
+	const projectRef = args["project-ref"];
+	const source = {
+		...stats || explainTables.length > 0 || hookUser ? { live: true } : {},
+		...snapshotPath ? { snapshotPath } : {},
+		...dbUrl ? { dbUrl } : {},
+		...projectRef ? { projectRef } : {},
+		...options.signal ? { signal: options.signal } : {}
+	};
+	const pg = options.connect ?? connect;
+	const wantsLive = hookUser !== void 0 || rules.some((rule) => LIVE_CODES.has(rule.code));
+	const opened = options.snapshot || !wantsLive ? {
+		advisors: options.advisors,
+		database: options.database,
+		close: () => Promise.resolve()
+	} : {
+		...openLive(config, env, source, pg),
+		...options.advisors === void 0 ? {} : { advisors: options.advisors },
+		...options.database === void 0 ? {} : { database: options.database }
+	};
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets, peers] = await Promise.all([
+		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
+		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
+		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml, sqlWorkflow(config, toml))]),
+		readText(config.root, ".gitignore"),
+		sourceFiles(config),
+		compiledReadSets(config).catch((cause) => ({ skipped: errorText(cause) })),
+		options.peers ?? peerVersions(config.root).catch(() => [])
+	]).catch(async (cause) => {
+		await opened.close();
+		throw cause;
+	});
+	const replay = opened.open ? (await opened.open()).replay : void 0;
+	const live = replay ? {
+		advisors: options.advisors ?? { skipped: replay },
+		database: options.database ?? { skipped: replay }
+	} : opened;
+	const context = {
+		config,
+		snapshot,
+		sqlFiles: sql,
+		configToml,
+		envFiles,
+		gitignore: gitignore?.text ?? "",
+		sources,
+		readSets,
+		peers,
+		...live.advisors ? { advisors: live.advisors } : {},
+		...live.database ? { database: live.database } : {},
+		...stats ? { stats } : {},
+		...hookUser ? { hookUser } : {},
+		...explainTables.length > 0 ? { explain: {
+			tables: explainTables,
+			claims
+		} } : {}
+	};
+	if (fixGrants) {
+		await opened.close();
+		return {
+			code: 0,
+			output: hookGrantBlock(hookGrantProblems(context), workflowOf(context))
+		};
+	}
+	let ran;
+	try {
+		ran = await runRules(context, rules);
+	} finally {
+		await opened.close();
+	}
+	const findings = ran.map((finding) => {
+		if (finding.location || !finding.object) return finding;
+		const location = locate(sql, finding.object);
+		return location ? {
+			...finding,
+			location
+		} : finding;
+	});
+	const out = args.out ?? (format === config.doctor.format ? config.doctor.output : void 0);
+	const fromRepo = format === "sarif" || format === "github";
+	const repoRoot = findRepoRoot(config.root);
+	const repoPath = (file) => display(repoRoot, resolve(config.root, file));
+	const report = formatReport(fromRepo ? findings.map((finding) => finding.location ? {
+		...finding,
+		location: {
+			...finding.location,
+			file: repoPath(finding.location.file)
+		}
+	} : finding) : findings, {
+		format,
+		rules,
+		version: VERSION,
+		fallbackFile: repoPath(context.configToml?.path ?? "package.json"),
+		...options.paint && !out ? { paint: options.paint } : {}
+	});
+	const errors = findings.filter((finding) => finding.severity === "error").length;
+	const warnings = findings.filter((finding) => finding.severity === "warning").length;
+	const failOn = args["fail-on"] ?? (config.doctor.strict ? "warning" : "error");
+	if (failOn !== "error" && failOn !== "warning" && failOn !== "never") throw new CliError("usage", `--fail-on takes error, warning or never, got "${failOn}".`);
+	const code = failOn !== "never" && (errors > 0 || failOn === "warning" && warnings > 0) ? 1 : 0;
+	const failure = code === 0 ? {} : {
+		errorCode: "findings",
+		error: `Doctor found ${errors} errors and ${warnings} warnings${failOn === "warning" ? " (--fail-on warning)" : ""}.`
+	};
+	if (out) {
+		const applied = await applyPlan({
+			root: config.root,
+			regenerate: "better-supabase doctor",
+			files: [{
+				path: insideRoot(config.root, out, "--out"),
+				contents: `${report}\n`,
+				note: `${errors} errors, ${warnings} warnings`
+			}]
+		}, {});
+		return {
+			code,
+			output: changeLines(applied).join("\n"),
+			data: {
+				out,
+				errors,
+				warnings
+			},
+			...failure
+		};
+	}
+	return format === "json" ? {
+		code,
+		data: jsonReport(findings, VERSION),
+		...failure
+	} : {
+		code,
+		output: report,
+		...failure
+	};
+}
+const ruleCodes = () => [.../* @__PURE__ */ new Set([...RULE_CODES, ...LIVE_CODES])];
+const doctorCommand = defineCliCommand({
+	meta: commandMeta("doctor"),
+	args: {
+		...SOURCE_ARGS,
+		...ARGS
+	},
+	lists: [
+		"only",
+		"ignore",
+		"explain"
+	],
+	completions: {
+		format: () => FLAG_FORMATS,
+		only: ruleCodes,
+		ignore: ruleCodes
+	},
+	run: async (args, { config, cwd, env, io, log, paint, signal }) => {
+		if (args.metadata !== void 0) {
+			refuseWithMetadata([
+				...sourceFlags(args),
+				...args.stats === true ? ["--stats"] : [],
+				...args.explain === void 0 ? [] : ["--explain"],
+				...args.as === void 0 ? [] : ["--as"]
+			]);
+			let snapshot;
+			try {
+				snapshot = await readMetadataSnapshot(args.metadata, cwd, io);
+			} catch (cause) {
+				if (cause instanceof MetadataRejectedError) return {
+					code: 65,
+					errorCode: "invalid_input",
+					error: cause.message
+				};
+				throw cause;
+			}
+			const skipped = `reading a GeneratorMetadata document; set $DATABASE_URL or $SUPABASE_DB_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+			return runDoctor(config, args, env, {
+				snapshot,
+				advisors: { skipped },
+				database: { skipped },
+				paint
+			});
+		}
+		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
+		const check = () => runDoctor(config, args, env, {
+			paint,
+			...dbUrl ? { dbUrl } : {},
+			...signal ? { signal } : {}
+		});
+		return args.snapshot === void 0 ? log.progress("Checking the database", check) : check();
+	}
+});
+//#endregion
+export { doctorCommand };