better-supabase 0.9.0 → 0.11.0

package/dist/cli/{doctor-SGw36h1D.js → doctor-D47sFjh9.js}

@@ -1,22 +1,25 @@
-import { a as list, p as commandMeta, r as defineCliCommand } from "./command-CK9Cn8HV.js";
+import { a as list, p as commandMeta, r as defineCliCommand } from "./command-DLCZeHdo.js";
 import { i as plain } from "./style-2JfIPVMQ.js";
-import { t as VERSION } from "./version-DNRW4DAP.js";
+import { t as VERSION } from "./version-CUKjFbNd.js";
 import { n as CliError, r as errorText } from "./errors-Caiz_0so.js";
 import { a as sameText, t as display } from "./io-BiPX-_J1.js";
-import { t as CACHE_DIR } from "./cache-Cx6qlRDR.js";
+import { t as CACHE_DIR } from "./cache-CVJmPGpd.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { h as satisfies, m as peerVersions, t as MetadataRejectedError } from "./typegen--TfvOPLh.js";
-import { c as configFor, s as notNullTag } from "./emit-ZAYeh4Yn.js";
-import { A as renderFiles, C as policyObject, D as advisorRule, E as workflowOf, O as splinterTables, S as permissionCatalogKeys, T as tableObject, _ as withoutStrings, a as METADATA_GAPS_TEXT, b as exposedSchemas, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$2, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as catalogOf, w as qualified, x as lineOf, y as exposed } from "./run-DaHfUUO9.js";
-import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-YFFdWC5X.js";
-import { l as stdinDatabaseUrl } from "./config-CLHpTk9Y.js";
-import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-DjLgBYEo.js";
+import { t as isRecord } from "./guards-CUlDNYZs.js";
+import { c as configFor, s as notNullTag } from "./emit-56LAG_Px.js";
+import { _ as withoutStrings, a as METADATA_GAPS_TEXT, c as accessModule, d as RLS_RULES, f as appliesTo, g as policyHelpers, h as functionObject, l as entitlementsModule, m as functionBody, p as escape$1, s as AUTHORIZATION_RULES, u as COMMANDS$1, v as advisorRule, x as renderFiles, y as splinterTables } from "./run-Bb8Nn8Ax.js";
+import { D as providerLabel, a as migrationModules, i as migrationHolds, r as latestMigration, t as MODULES_SUFFIX, v as migrationsDir, x as compiledReadSets, y as moduleLayoutFor } from "./module-migration-CPhuiY8C.js";
+import { l as stdinDatabaseUrl } from "./config-C4e_RrmL.js";
+import { a as findRepoRoot, c as httpHooks, d as readSupabaseToml, f as schemaPaths, h as tomlGet, i as diffEngine, l as migrationCommand, n as declarativeSchemasDir, p as sqlWorkflow, u as pgFunctionHooks } from "./supabase-toml-BC5sNVKU.js";
 import { t as connect } from "./db-DT1bGB02.js";
-import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-DAxLi4hO.js";
+import { c as isSqliteLiteDriver, n as managementTarget, o as snapshotFile, p as request, r as openSource, s as liteDriverOf, t as loadSnapshot } from "./snapshot-ClgWGd-b.js";
 import { n as applyPlan, o as insideRoot, r as changeLines } from "./files-DDvAwTko.js";
-import { t as isRecord } from "./guards-CUlDNYZs.js";
-import { i as sourceFlags, n as SOURCE_ARGS } from "./source-args-0I9zylYy.js";
-import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-CxBZo4KM.js";
+import { a as permissionCatalogKeys, i as lineOf, l as tableObject, n as exposed, o as policyObject, r as exposedSchemas, s as qualified, t as catalogOf, u as workflowOf } from "./shared-DKLuA1Tp.js";
+import { t as MIGRATION_SAFETY_RULES } from "./migration-safety-DjVpz2D6.js";
+import { a as sourceFlags, n as SOURCE_ARGS } from "./source-args-BDiUhsH8.js";
+import { i as reservedRoles, n as ident$1, r as literal$1, t as LIVE_RULES } from "./live-CLxJNC0r.js";
+import { i as refuseWithMetadata, r as readMetadataSnapshot } from "./metadata-BRywyPvv.js";
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -98,6 +101,45 @@ const ADOPTION_RULES = [
 			});
 		}
 	},
+	{
+		code: "BS342",
+		severity: "error",
+		title: "Adopted enum column the module writes as text",
+		description: "A module in adopt mode writes a text parameter or computed text value into a column the snapshot declares as an enum; string literals are fine. Postgres has no implicit cast from text to an enum, so the module's functions fail when they run. Columns the module casts to their declared type, such as the tags `kind` and the number-sequences `entity`, may be enums.",
+		check: (context) => {
+			const { tables } = catalogOf(context);
+			return adoptedTables(context.config.blocks).flatMap((adopted) => {
+				const table = tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+				if (table === void 0) return [];
+				return adopted.textColumns.flatMap((logical) => {
+					const name = adopted.columns[logical];
+					const column = table.columns.find((entry) => entry.name === name);
+					if (column?.isEnum !== true || column.isArray) return [];
+					const target = `${qualified(table)}.${column.name}`;
+					return [{
+						message: `blocks.${adopted.module} is in adopt mode and writes text into ${target} (${adopted.logical}.${logical}), which is the enum ${column.typeSchema}.${column.udt}. Postgres does not cast text to an enum, so the module's functions fail. Change the column to text with a check constraint on its values.`,
+						target
+					}];
+				});
+			});
+		}
+	},
+	{
+		code: "BS344",
+		severity: "warning",
+		title: "Adopted webhook endpoints without a format",
+		description: "An adopted `webhooks-out` endpoints table that maps no `format` column sends every endpoint in `blocks.webhooks-out.options.defaultFormat`. Its default changed from the 0.8 body (`standard`) to `cloudevents` in 0.9, so receivers built for the old body break without any change to the config. `sql sync` refuses this config; doctor reports it for configs it loads without that check. Set `defaultFormat` explicitly, or add a format column and map it in `columns.endpoints.format`.",
+		check: (context) => {
+			const block = context.config.blocks["webhooks-out"];
+			if (block?.mode !== "adopt" || block.options?.["defaultFormat"] !== void 0 || typeof block.columns?.["endpoints"]?.["format"] === "string") return [];
+			const adopted = adoptedTables(context.config.blocks).find((entry) => entry.module === "webhooks-out" && entry.logical === "endpoints");
+			const table = adopted === void 0 ? void 0 : catalogOf(context).tables.find((entry) => entry.schema === adopted.schema && entry.name === adopted.table);
+			return [{
+				message: `${adopted === void 0 ? "The adopted endpoints table" : `${adopted.schema}.${adopted.table}`} ${table?.columns.some((column) => column.name === "format") ? "has a format column the config doesn't map" : "has no format column"}, so every endpoint gets blocks.webhooks-out.options.defaultFormat, which defaults to "cloudevents" since 0.9 ("standard" before). Set defaultFormat to the body your receivers expect, or map columns.endpoints.format.`,
+				target: "blocks.webhooks-out.options.defaultFormat"
+			}];
+		}
+	},
 	{
 		code: "BS341",
 		severity: "warning",
@@ -246,331 +288,6 @@ const FLAG_RULES = [{
 	check: expiredFlags
 }];
 //#endregion
-//#region src/cli/doctor/reserved-roles.ts
-/**
-* supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
-* drop or change the memberships of these.
-*/
-const RESERVED_ROLES = /* @__PURE__ */ new Set([
-	"supabase_admin",
-	"supabase_auth_admin",
-	"supabase_storage_admin",
-	"supabase_functions_admin",
-	"supabase_read_only_user",
-	"supabase_realtime_admin",
-	"supabase_replication_admin",
-	"supabase_etl_admin",
-	"dashboard_user",
-	"pgbouncer"
-]);
-/** Reserved roles whose settings (`alter role ... set`) supautils allows changing. */
-const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
-	"authenticator",
-	"authenticated",
-	"anon",
-	"service_role"
-]);
-/**
-* Roles that Supabase's own services log in as. Their statements (PostgREST's
-* schema cache query, Auth and Storage migrations) aren't the app's.
-*/
-const PLATFORM_ROLES = /* @__PURE__ */ new Set([...RESERVED_ROLES, "authenticator"]);
-/** Comments and string literals blanked, newlines kept so offsets map to lines. */
-const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
-const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
-/** Why a statement changes a reserved role, or undefined when it doesn't. */
-function reservedRoleChange(statement) {
-	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
-	if (alter) {
-		const role = roleNames(alter[2])[0];
-		const verb = alter[1].toLowerCase();
-		const next = alter[3].toLowerCase();
-		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
-		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
-		return;
-	}
-	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
-	if (!membership) return;
-	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
-	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
-}
-/** Where a statement ends, including statements inside `do` blocks and function bodies. */
-const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
-/** Statements in schema files and migrations that supautils rejects on Supabase. */
-function reservedRoles(context) {
-	return (context.sqlFiles ?? []).flatMap((file) => {
-		const code = sqlCode(file.text);
-		const findings = [];
-		let start = 0;
-		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
-			const until = end?.index ?? code.length;
-			const statement = code.slice(start, until);
-			const reason = reservedRoleChange(statement);
-			if (reason !== void 0) {
-				const at = start + statement.search(/\S/);
-				const line = code.slice(0, at).split("\n").length;
-				findings.push({
-					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
-					target: `${file.path}:${String(line)}`,
-					location: {
-						file: file.path,
-						line
-					}
-				});
-			}
-			start = until + (end?.[0].length ?? 0);
-		}
-		return findings;
-	});
-}
-//#endregion
-//#region src/cli/doctor/live.ts
-/** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
-const SLOW_MEAN_MS = 50;
-const SLOW_CALLS = 1e3;
-/** Rows `--explain` reads, like a `findMany()` under Supabase's default `max_rows`. */
-const EXPLAIN_LIMIT = 1e3;
-const escape$1 = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
-const ident$1 = (name) => `"${name.replaceAll("\"", "\"\"")}"`;
-const literal$1 = (text) => `'${text.replaceAll("'", "''")}'`;
-const oneLine = (query, max = 160) => {
-	const flat = query.replaceAll(/\s+/g, " ").trim();
-	return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;
-};
-const plural$1 = (count, word) => `${count} ${word}${count === 1 ? "" : "s"}`;
-const megabytes = (bytes) => `${(bytes / 1024 / 1024).toFixed(1)} MB`;
-/** The schema `pg_stat_statements` lives in, when the extension is installed. */
-async function statementsView(db) {
-	const [row] = await db.query(`select n.nspname as schema from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_stat_statements'`);
-	return row ? `${ident$1(row.schema)}.pg_stat_statements` : void 0;
-}
-/** The first exposed table a statement names, to locate it in the SQL files. */
-function tableIn(query, tables) {
-	return tables.find((table) => {
-		const schema = escape$1(table.schema);
-		const name = escape$1(table.name);
-		return new RegExp(`(?:"${schema}"|\\b${schema})\\.(?:"${name}"|${name}\\b)`).test(query);
-	});
-}
-const live = (context) => context.database;
-/**
-* Function calls and self time so far in this transaction. The view can
-* still hold unflushed counts from earlier transactions, so callers diff two
-* readings.
-*/
-async function functionTimes(db) {
-	const rows = await db.query(`select schemaname || '.' || funcname as name, calls, self_time from pg_stat_xact_user_functions`);
-	return new Map(rows.map((row) => [row.name, {
-		calls: Number(row.calls),
-		selfTime: Number(row.self_time)
-	}]));
-}
-/** Node types, timings and loops of an `EXPLAIN (ANALYZE, FORMAT JSON)` plan; never rows. */
-function summarizePlan(output) {
-	const nodes = [];
-	const perRowSubPlans = [];
-	let initPlans = 0;
-	const walk = (node) => {
-		const loops = node["Actual Loops"] ?? 1;
-		const ms = (node["Actual Total Time"] ?? 0).toFixed(2);
-		const on = node["Relation Name"] ? ` on ${node["Relation Name"]}` : "";
-		const sub = node["Subplan Name"] ? `${node["Subplan Name"]}: ` : "";
-		nodes.push(`${sub}${node["Node Type"]}${on} ${ms} ms ×${loops}`);
-		if (node["Parent Relationship"] === "InitPlan") initPlans += 1;
-		if (node["Parent Relationship"] === "SubPlan" && loops > 1) perRowSubPlans.push(`${sub}${node["Node Type"]}${on} ×${loops}`);
-		for (const child of node.Plans ?? []) walk(child);
-	};
-	walk(output.Plan);
-	return {
-		nodes,
-		initPlans,
-		perRowSubPlans,
-		executionMs: output["Execution Time"] ?? 0
-	};
-}
-const ROLE = /^[a-z_][a-z0-9_]*$/;
-async function explainTable(db, table, claims) {
-	const role = typeof claims["role"] === "string" ? claims["role"] : "anon";
-	if (!ROLE.test(role)) throw new Error(`Invalid role "${role}" in the claims`);
-	await db.query("begin");
-	try {
-		await db.query(`set local statement_timeout = '30s'`);
-		let tracked = true;
-		await db.query("savepoint bs_track");
-		try {
-			await db.query(`set local track_functions = 'all'`);
-			await db.query("release savepoint bs_track");
-		} catch {
-			tracked = false;
-			await db.query("rollback to savepoint bs_track");
-		}
-		await db.query(`select set_config('request.jwt.claims', ${literal$1(JSON.stringify(claims))}, true)`);
-		const before = tracked ? await functionTimes(db) : /* @__PURE__ */ new Map();
-		await db.query(`set local role ${ident$1(role)}`);
-		const [row] = await db.query(`explain (analyze, buffers, format json) select * from ${ident$1(table.schema)}.${ident$1(table.name)} limit ${EXPLAIN_LIMIT}`);
-		const raw = row?.["QUERY PLAN"];
-		const plan = typeof raw === "string" ? JSON.parse(raw) : raw;
-		if (!plan?.[0]) throw new Error("EXPLAIN returned no plan");
-		const functions = tracked ? [...await functionTimes(db)].map(([name, after]) => {
-			const start = before.get(name);
-			return {
-				name,
-				calls: after.calls - (start?.calls ?? 0),
-				selfTime: after.selfTime - (start?.selfTime ?? 0)
-			};
-		}).filter((fn) => fn.calls > 0).sort((a, b) => b.selfTime - a.selfTime) : void 0;
-		return {
-			summary: summarizePlan(plan[0]),
-			functions
-		};
-	} finally {
-		await db.query("rollback");
-	}
-}
-function resolveTable(context, name) {
-	return name.includes(".") ? catalogOf(context).tables.find((table) => qualified(table) === name) : exposed(context).find((table) => table.name === name);
-}
-const LIVE_RULES = [
-	{
-		code: "BS208",
-		severity: "warning",
-		title: "Queries spill to temporary files",
-		description: "Sorts and hashes that exceed `work_mem` write temporary files, which is slow. Reads `pg_stat_database` and, when installed, the top statements from `pg_stat_statements`. When every statement that spilled ran as a Supabase service role (PostgREST's schema cache query as `authenticator`, Auth or Storage) or came from better-supabase's own catalog reads (`introspect`, `gen`, `doctor`), there is no finding.",
-		async check(context) {
-			const db = live(context);
-			if (!db || "skipped" in db) return [];
-			try {
-				const [stats] = await db.query(`select temp_files, temp_bytes, current_setting('work_mem') as work_mem from pg_stat_database where datname = current_database()`);
-				const files = Number(stats?.temp_files ?? 0);
-				if (files === 0) return [];
-				let top = "";
-				const view = await statementsView(db);
-				if (view) {
-					const spilled = await db.query(`select s.query, s.temp_blks_written, r.rolname as role from ${view} s left join pg_roles r on r.oid = s.userid where s.temp_blks_written > 0 order by s.temp_blks_written desc limit 50`).catch(() => []);
-					const statements = spilled.filter((statement) => !statement.query.startsWith("/* better-supabase */") && (statement.role === null || !PLATFORM_ROLES.has(statement.role))).slice(0, 5);
-					if (spilled.length > 0 && statements.length === 0) return [];
-					if (statements.length > 0) top = ` Top statements by temporary blocks written: ${statements.map((statement) => `${oneLine(statement.query, 100)} (${statement.temp_blks_written} blocks)`).join("; ")}.`;
-				}
-				return [{
-					message: `${files} temporary files (${megabytes(Number(stats?.temp_bytes ?? 0))}) since the statistics were reset; work_mem is ${stats?.work_mem}. Add indexes so large sorts go away, or raise work_mem for the role that runs them.${top}`,
-					target: "pg_stat_database:temp_files"
-				}];
-			} catch (cause) {
-				return [{
-					severity: "info",
-					message: `Could not read pg_stat_database (${db.describe}): ${errorText(cause)}`
-				}];
-			}
-		}
-	},
-	{
-		code: "BS209",
-		severity: "warning",
-		title: "Slow frequent statements",
-		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
-		async check(context) {
-			if (!context.stats) return [];
-			const db = live(context);
-			if (!db) return [];
-			if ("skipped" in db) return [{
-				severity: "info",
-				message: `Skipped --stats: ${db.skipped}`
-			}];
-			try {
-				const view = await statementsView(db);
-				if (!view) return [{
-					severity: "info",
-					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
-				}];
-				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
-				const tables = exposed(context);
-				return statements.map((statement) => {
-					const table = tableIn(statement.query, tables);
-					return {
-						message: `${Number(statement.mean_exec_time).toFixed(1)} ms mean over ${statement.calls} calls: ${oneLine(statement.query)}`,
-						target: `pg_stat_statements:${statement.queryid}`,
-						...table ? { object: tableObject(table) } : {}
-					};
-				});
-			} catch (cause) {
-				return [{
-					severity: "info",
-					message: `Could not read pg_stat_statements (${db.describe}): ${errorText(cause)}`
-				}];
-			}
-		}
-	},
-	{
-		code: "BS225",
-		severity: "info",
-		title: "pg_stat_statements is not installed",
-		description: "`pg_stat_statements` records the time and calls of each statement, which `--stats` (BS209), BS208 and the Supabase query performance report read. Without it there is no record of which queries are slow. Needs a database; saved snapshots skip it.",
-		async check(context) {
-			const db = live(context);
-			if (!db || "skipped" in db) return [];
-			if (context.stats && context.codes?.includes("BS209")) return [];
-			try {
-				if (await statementsView(db)) return [];
-			} catch {
-				return [];
-			}
-			return [{
-				message: `pg_stat_statements is not installed on the ${db.describe}, so nothing records which statements are slow. Run \`create extension if not exists pg_stat_statements with schema extensions;\` in a migration.`,
-				target: "extension:pg_stat_statements"
-			}];
-		}
-	},
-	{
-		code: "BS212",
-		severity: "info",
-		title: "RLS plan for a table",
-		description: `\`--explain <tables>\` runs \`EXPLAIN (ANALYZE, BUFFERS)\` on \`select * from <table> limit ${EXPLAIN_LIMIT}\` as the given claims, in a transaction that is rolled back. It reports node types, timings and loops, never rows, and warns when a policy SubPlan runs once per row.`,
-		async check(context) {
-			const request = context.explain;
-			if (!request) return [];
-			const db = live(context);
-			if (!db || "skipped" in db || !db.session) return [{
-				severity: "warning",
-				message: `--explain needs a direct database connection (local stack, $DATABASE_URL, $SUPABASE_DB_URL or --db-url-stdin)${db && "skipped" in db ? `: ${db.skipped}` : "."}`
-			}];
-			const who = typeof request.claims["sub"] === "string" ? `${String(request.claims["role"] ?? "anon")} ${request.claims["sub"]}` : String(request.claims["role"] ?? "anon");
-			const findings = [];
-			for (const name of request.tables) {
-				const table = resolveTable(context, name);
-				if (!table) {
-					findings.push({
-						severity: "warning",
-						message: `--explain: no table "${name}" in the exposed schemas; qualify tables in other schemas, like better_supabase.memberships.`
-					});
-					continue;
-				}
-				try {
-					const { summary, functions } = await explainTable(db, table, request.claims);
-					const helpers = functions ? functions.length > 0 ? ` Function time: ${functions.map((fn) => {
-						const self = fn.selfTime;
-						const share = summary.executionMs > 0 ? Math.round(self / summary.executionMs * 100) : 0;
-						return `${fn.name} ${self.toFixed(2)} ms over ${plural$1(fn.calls, "call")} (${share}%)`;
-					}).join(", ")}.` : " No tracked function ran; inlined SQL functions are part of the plan." : " Function times need `track_functions`, which this role may not set; showing the plan only.";
-					const perRow = summary.perRowSubPlans.length > 0 ? ` Per-row SubPlans: ${summary.perRowSubPlans.join(", ")}; wrap the policy's function calls in \`(select ...)\` so they run once as an InitPlan.` : "";
-					findings.push({
-						...summary.perRowSubPlans.length > 0 ? { severity: "warning" } : {},
-						message: `${qualified(table)} as ${who}: ${summary.executionMs.toFixed(2)} ms, ${plural$1(summary.initPlans, "InitPlan")}. Plan: ${summary.nodes.join(" > ")}.${perRow}${helpers}`,
-						target: `${qualified(table)}:explain`,
-						object: tableObject(table)
-					});
-				} catch (cause) {
-					findings.push({
-						severity: "warning",
-						message: `--explain ${qualified(table)} failed: ${errorText(cause)}`,
-						target: `${qualified(table)}:explain`
-					});
-				}
-			}
-			return findings;
-		}
-	}
-];
-//#endregion
 //#region src/cli/doctor/hooks.ts
 /** Claims past this size make every request carry a large cookie and header. */
 const HOOK_CLAIMS_LIMIT = 2048;
@@ -601,7 +318,7 @@ const splitName = (qualified) => {
 		name: qualified.slice(dot + 1)
 	};
 };
-const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+const escapeRegExp$2 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /**
 * The claims the provider's hook writes that a second writer would
 * contradict, with the tenant claim it writes to.
@@ -609,7 +326,7 @@ const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 function ownedClaims(hook) {
 	return [.../* @__PURE__ */ new Set([...hook.ownedClaims, ...hook.tenantClaim ? [hook.tenantClaim] : []])];
 }
-const quotedName = (schema, name) => `(?:"?${escapeRegExp$1(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$1(name)}"?`;
+const quotedName = (schema, name) => `(?:"?${escapeRegExp$2(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$2(name)}"?`;
 const createsFunction = (fn) => new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${quotedName(fn.schema, fn.name)}\\s*\\(`, "i");
 /** The SQL file that has the provider's hook marker and creates `fn`. */
 function markerFileFor(context, fn) {
@@ -633,7 +350,7 @@ function wrapsProviderHook(hook, source) {
 /** Which of `claims` the hook body writes through `jsonb_set` or `jsonb_build_object`. */
 function writtenClaims(source, claims) {
 	return claims.filter((claim) => {
-		const name = escapeRegExp$1(claim);
+		const name = escapeRegExp$2(claim);
 		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
 	});
 }
@@ -1220,6 +937,187 @@ async function fileState(context, file) {
 	};
 }
 //#endregion
+//#region src/cli/doctor/attachment-subjects.ts
+/** The attachments subjects as the block resolves them, with the per-subject keys each one has. */
+function attachmentSubjects(context) {
+	const registry = context.config.subjects;
+	const raw = context.config.blocks["attachments"]?.options?.["subjects"];
+	return (raw === void 0 ? Object.keys(registry).map((type) => [type, {}]) : Array.isArray(raw) ? raw.filter((type) => typeof type === "string").map((type) => [type, {}]) : isRecord(raw) ? Object.entries(raw).flatMap(([type, entry]) => isRecord(entry) ? [[type, entry]] : []) : []).flatMap(([type, entry]) => {
+		const registered = registry[type];
+		const table = entry["table"] ?? registered?.table;
+		const tenant = entry["tenant"] ?? registered?.tenant ?? "organization_id";
+		if (typeof table !== "string" || typeof tenant !== "string") return [];
+		const own = isRecord(entry["permissions"]) ? Object.keys(entry["permissions"]) : [];
+		const fromRegistry = Object.keys(registered?.permissions ?? {}).filter((key) => key !== "read");
+		const subjectRead = typeof entry["permission"] === "string" || registered?.permissions?.["read"] !== void 0 ? ["read"] : [];
+		return [{
+			type,
+			table,
+			tenant,
+			keys: /* @__PURE__ */ new Set([
+				...own,
+				...fromRegistry,
+				...subjectRead
+			])
+		}];
+	});
+}
+/**
+* Whether `expression` only checks that the caller is a member of the row's
+* tenant: `current_tenant_id()`, a `*_ids_with` or `*member_*ids` function in
+* any schema (the provider's own helpers included), `can('tenant', ...)` or
+* `member_can`, joined by `and`, with a soft-delete `is null` allowed. A
+* permission call passes only with one of `keys`.
+*/
+function tenantOnly(expression, column, keys) {
+	const col = `(?:"?\\w+"?\\.)?"?${escape$1(column)}"?(?:::\\w+)?`;
+	const key = `'([^']*)'(?:::text)?`;
+	const atoms = [
+		`${col}\\s*=\\s*\\(?\\s*(?:select\\s+)?better_supabase\\.current_tenant_id\\(\\)(?:\\s+as\\s+\\w+)?`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*_ids_with\\(\\s*${key}\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`${col}\\s+in\\s+\\(\\s*select\\s+(?:\\w+\\.)?\\w*member_\\w*ids\\(\\s*\\)(?:\\s+as\\s+\\w+)?\\s*\\)`,
+		`better_supabase\\.can\\(\\s*'tenant'(?:::text)?\\s*,\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`better_supabase\\.member_can\\(\\s*${col}\\s*,\\s*${key}\\s*\\)`,
+		`(?:"?\\w+"?\\.)?"?\\w+"?\\s+is\\s+null`
+	];
+	const used = [];
+	let rest = expression;
+	for (const atom of atoms) rest = rest.replaceAll(new RegExp(atom, "gi"), (_match, key) => {
+		if (typeof key === "string") used.push(key);
+		return " ";
+	});
+	return used.every((key) => keys.has(key)) && rest.replaceAll(/\band\b|[()\s]/gi, "") === "";
+}
+/** The top-level `or` branches of `expression`, outer parentheses removed. */
+function branches(expression) {
+	let text = expression.trim();
+	while (text.startsWith("(") && closingParen(text) === text.length - 1) text = text.slice(1, -1).trim();
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (depth === 0 && /^\sor\s/i.test(text.slice(index, index + 4))) {
+			parts.push(text.slice(start, index));
+			start = index + 4;
+		}
+	}
+	parts.push(text.slice(start));
+	return parts;
+}
+/** The index of the parenthesis closing the one at the start of `text`. */
+function closingParen(text) {
+	let depth = 0;
+	for (let index = 0; index < text.length; index += 1) if (text[index] === "(") depth += 1;
+	else if (text[index] === ")") {
+		depth -= 1;
+		if (depth === 0) return index;
+	}
+	return -1;
+}
+/** Tenant membership alone lets the caller through: the whole check, or one `or` branch of it. */
+function tenantSuffices(expression, column, keys) {
+	return [expression, ...branches(expression)].some((part) => tenantOnly(part, column, keys));
+}
+function attachmentSubjectsOnDefaults(context) {
+	if (!context.config.blockNames.includes("attachments")) return [];
+	const { tables } = catalogOf(context);
+	const overrides = context.config.blocks["attachments"]?.permissions ?? {};
+	const actions = [{
+		action: "read",
+		commands: ["select"],
+		what: "reads"
+	}, {
+		action: "upload",
+		commands: ["insert", "update"],
+		what: "writes"
+	}];
+	return attachmentSubjects(context).flatMap(({ type, table: name, tenant, keys }) => {
+		const [schema, bare] = name.includes(".") ? name.split(".", 2) : ["public", name];
+		const table = tables.find((candidate) => candidate.schema === schema && candidate.name === bare);
+		if (table?.kind !== "table" || !table.rls) return [];
+		const stricter = actions.filter(({ action, commands }) => {
+			if (keys.has(action)) return false;
+			const blockKey = overrides[action] ?? `attachments.${action}`;
+			return commands.some((command) => {
+				const applying = table.policies.filter((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, "authenticated"));
+				if (command !== "select" && applying.length === 0) return false;
+				return !applying.some((policy) => {
+					const expression = command === "select" ? policy.using : policy.check ?? policy.using;
+					return expression !== null && tenantSuffices(expression, tenant, /* @__PURE__ */ new Set([blockKey]));
+				});
+			});
+		});
+		if (stricter.length === 0) return [];
+		const target = `${table.schema}.${table.name}`;
+		return [{
+			message: `Attachments on ${type} use the block-wide ${stricter.map(({ action }) => action).join(" and ")} key, but ${target} checks more than tenant membership for ${stricter.map(({ what: verb }) => verb).join(" and ")}, so any member of the tenant gets the files of a ${type} they can't open. Set ${stricter.map(({ action }) => action === "read" ? `blocks.attachments.options.subjects.${type}.permissions.read` : `subjects.${type}.permissions.upload`).join(" and ")} to the key the table checks.`,
+			target,
+			object: tableObject(table)
+		}];
+	});
+}
+//#endregion
+//#region src/cli/doctor/audit-coverage.ts
+const escapeRegExp$1 = (value) => value.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** `exempt` entries: a glob, or `{ table, reason }` where `table` is a glob. */
+function exemptions(value) {
+	return (Array.isArray(value) ? value : []).flatMap((entry) => {
+		if (typeof entry === "string") return [{
+			glob: entry,
+			reason: void 0
+		}];
+		if (typeof entry === "object" && entry !== null && "table" in entry && typeof entry.table === "string") {
+			const reason = "reason" in entry && typeof entry.reason === "string" ? entry.reason.trim() : "";
+			return [{
+				glob: entry.table,
+				reason: reason === "" ? void 0 : reason
+			}];
+		}
+		return [];
+	});
+}
+/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
+const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp$1).join(".*")}$`, "i"));
+/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
+function moduleOwned(context) {
+	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const module of Object.values(context.config.blocks)) {
+		if (module?.schema !== void 0) schemas.add(module.schema);
+		for (const table of Object.values(module?.tables ?? {})) {
+			if (table === null) continue;
+			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
+		}
+	}
+	return {
+		schemas,
+		tables
+	};
+}
+/**
+* Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is
+* in `blocks`, and exemptions that give no reason.
+*/
+function unauditedTables(context) {
+	if (!context.config.blockNames.includes("audit")) return [];
+	const entries = exemptions(context.config.blocks["audit"]?.options?.["exempt"]);
+	const exempt = globs(entries.map((entry) => entry.glob));
+	const owned = moduleOwned(context);
+	const unaudited = catalogOf(context).tables.filter((table) => table.kind === "table" && table.partitionOf === void 0 && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name.startsWith("bs_audit") || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
+		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt as \`{ table: '${qualified(table)}', reason: '...' }\`.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+	const unexplained = entries.filter((entry) => entry.reason === void 0).map((entry) => ({
+		message: `blocks.audit.options.exempt lists ${entry.glob} without a reason. Write it as { table: '${entry.glob}', reason: 'why its changes need no audit entry' } so a reviewer can tell an intended gap from a forgotten table.`,
+		target: `blocks.audit.options.exempt:${entry.glob}`
+	}));
+	return [...unaudited, ...unexplained];
+}
+//#endregion
 //#region src/cli/doctor/modules.ts
 /** The non-empty string at a dotted path, as the tenant() plugin reads it. */
 function claimAt(claims, path) {
@@ -1541,35 +1439,6 @@ function duplicateTriggers(context) {
 		}));
 	}));
 }
-/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
-const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp).join(".*")}$`, "i"));
-/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
-function moduleOwned(context) {
-	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
-	const tables = /* @__PURE__ */ new Set();
-	for (const module of Object.values(context.config.blocks)) {
-		if (module?.schema !== void 0) schemas.add(module.schema);
-		for (const table of Object.values(module?.tables ?? {})) {
-			if (table === null) continue;
-			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
-		}
-	}
-	return {
-		schemas,
-		tables
-	};
-}
-/** Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is in `blocks`. */
-function unauditedTables(context) {
-	if (!context.config.blockNames.includes("audit")) return [];
-	const exempt = globs(context.config.blocks["audit"]?.options?.["exempt"]);
-	const owned = moduleOwned(context);
-	return catalogOf(context).tables.filter((table) => table.kind === "table" && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name === "bs_audit" || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
-		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in blocks.audit.options.exempt.`,
-		target: qualified(table),
-		object: tableObject(table)
-	}));
-}
 /** RLS tables in `config.schemas` without a restrictive `session_active()` policy, when `sessions` is in `blocks`. */
 function sessionlessTables(context) {
 	if (!context.config.blockNames.includes("sessions")) return [];
@@ -1668,7 +1537,7 @@ const MODULE_RULES = [
 		code: "BS315",
 		severity: "warning",
 		title: "Table without an audit trigger",
-		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `schema.table` globs such as `public.*_archive`.",
+		description: "The `audit` module is in `blocks`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `blocks.audit.options.exempt` lists more, as `{ table, reason }` entries where `table` is a `schema.table` glob such as `public.*_archive`; a bare glob string still works but gets a finding that asks for the reason. Partitions are covered by their parent.",
 		check: unauditedTables
 	},
 	{
@@ -1748,6 +1617,13 @@ const MODULE_RULES = [
 		description: "A table in `config.subjects` has row level security disabled. `can_subject` treats a row the caller can read as visible, so without RLS every signed-in user passes the visibility half of the check for every row.",
 		check: subjectsWithoutRls
 	},
+	{
+		code: "BS345",
+		severity: "warning",
+		title: "Attachments subject on block-wide keys with stricter RLS",
+		description: "An `attachments` subject has no `read` or `upload` key of its own, so its files are checked with the block-wide `attachments.read` and `attachments.upload` keys, but the subject table's own policies check more than tenant membership: a permission key of their own, an owner or `auth.uid()` comparison, or another condition. Any member of the tenant then reads and uploads files of rows they can't open. Doctor recognizes `current_tenant_id()`, `tenant_ids_with`, `member_<tenant>_ids`, `can('tenant', ...)` and `member_can` with the block's key as tenant membership. Set `subjects.<type>.permissions.upload`, or `blocks.attachments.options.subjects.<type>.permissions` for `read`, to the keys the table checks.",
+		check: attachmentSubjectsOnDefaults
+	},
 	{
 		code: "BS335",
 		severity: "warning",
@@ -2239,7 +2115,7 @@ const POLICY_RULES = [
 						const dot = name.indexOf(".");
 						const schema = name.slice(0, dot);
 						if (schema === "auth" || volatility.get(name) === "immutable") return false;
-						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$2(schema)}"?\\.)?"?${escape$2(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
+						return new RegExp(`(?<!\\bselect\\s+)(?<![\\w."])(?:"?${escape$1(schema)}"?\\.)?"?${escape$1(name.slice(dot + 1))}"?\\s*\\(\\s*\\)`, "i").test(text);
 					});
 					if (bare.length === 0) return [];
 					return [{
@@ -2295,7 +2171,7 @@ const APP_COLUMN_FORMAT = {
 */
 const skipsNullKeys = (predicate, columns) => {
 	if (!predicate) return false;
-	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$2(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
+	return predicate.split(/\s+AND\s+/i).every((part) => columns.some((column) => new RegExp(`^\\(*\\s*"?${escape$1(column)}"?\\s+IS\\s+NOT\\s+NULL\\s*\\)*$`, "i").test(part.trim())));
 };
 /** Whether the first `columns.length` columns of an index are exactly `columns`, in any order, and it holds every row that references something. */
 const covers = (index, columns) => (!index.partial || skipsNullKeys(index.predicate, columns)) && index.columns.length >= columns.length && index.columns.slice(0, columns.length).every((column) => columns.includes(column));
@@ -2386,7 +2262,7 @@ const SCHEMA_DESIGN_RULES = [
 			if (table.kind !== "table") return [];
 			const column = table.columns.find((entry) => SOFT_DELETE.test(entry.name) && entry.nullable);
 			if (!column) return [];
-			const isNull = new RegExp(`"?${escape$2(column.name)}"?\\s+IS\\s+NULL`, "i");
+			const isNull = new RegExp(`"?${escape$1(column.name)}"?\\s+IS\\s+NULL`, "i");
 			if (table.indexes.some((index) => index.partial && (index.predicate === void 0 || index.predicate !== null && isNull.test(index.predicate)))) return [];
 			return [{
 				message: `${qualified(table)} soft-deletes with ${column.name}, but no index has \`where ${column.name} is null\`. Index the live rows you list, for example \`create index on ${qualified(table)} (created_at desc) where ${column.name} is null;\`.`,
@@ -2411,7 +2287,7 @@ const SCHEMA_DESIGN_RULES = [
 				return table.columns.filter((column) => {
 					if (!column.isArray && column.udt !== "jsonb") return false;
 					if (table.indexes.some((index) => index.columns[0] === column.name && (index.method === void 0 || index.method === "gin"))) return false;
-					const used = new RegExp(`"?${escape$2(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$2(column.name)}\\b`);
+					const used = new RegExp(`"?${escape$1(column.name)}"?\\s*${CONTAINS}|${CONTAINS}\\s*[\\w."]*\\b${escape$1(column.name)}\\b`);
 					return filtered.has(column.name) || used.test(own) || functions.includes(table.name) && used.test(functions);
 				}).map((column) => ({
 					message: `${qualified(table)}.${column.name} is filtered by containment but has no GIN index, so each query scans the table. Run \`create index on ${qualified(table)} using gin (${column.name}${column.udt === "jsonb" ? " jsonb_path_ops" : ""});\`${column.udt === "jsonb" ? " (`jsonb_path_ops` supports `@>` only; drop it for `?`)" : ""}.`,
@@ -2732,7 +2608,7 @@ const RULES = [
 				return exposed(context).flatMap((table) => {
 					const options = configFor(context.config.tables, table.schema, table.name);
 					if (options?.exclude) return [];
-					const granted = (role) => new Set(table.grants.filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
+					const granted = (role) => new Set([...table.grants, ...table.columnGrants ?? []].filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
 					if (options?.serviceRole) {
 						const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && grant.privileges.length > 0);
 						return ["anon", "authenticated"].flatMap((role) => {
@@ -3147,7 +3023,8 @@ const RULES = [
 	...WORKFLOW_BUILDER_RULES,
 	...FLAG_RULES,
 	...REALTIME_RULES,
-	...ADOPTION_RULES
+	...ADOPTION_RULES,
+	...MIGRATION_SAFETY_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {