better-supabase 0.1.0 → 0.2.0

package/dist/{cli-CoByWYja.js → cli-DrSgDOQC.js}

@@ -1,15 +1,17 @@
 import { i as ok } from "./result-DWXatkd6.js";
-import { a as hasPlaceholder, l as splitPlaceholders, o as isReadSet, s as placeholderOf } from "./read-set-DhX2d04c.js";
+import { a as hasPlaceholder, l as splitPlaceholders, o as isReadSet, s as placeholderOf } from "./read-set-4lI3W_gZ.js";
 import { n as toCamel, t as applyCasing } from "./casing-da0uRTqt.js";
-import { i as resolveJsonSchema, r as resolveConfig } from "./config-D-aR2ZoN.js";
-import { t as compileSql } from "./sql-M8l3fnS0.js";
-import { i as sqlString, r as sqlIdent } from "./template-BeOGnynM.js";
-import { i as parseSize, n as defineBucket } from "./storage-BWXVUXGk.js";
+import { i as tenantClaimPaths, t as DEFAULT_CLAIMS } from "./claims-CoTobNC-.js";
+import { t as isList } from "./guards-BnzDvFrz.js";
+import { i as resolveJsonSchema, r as resolveConfig } from "./config-ClDXmVtY.js";
+import { t as compileSql } from "./sql-DTjA1LPj.js";
+import { a as sqlString, i as sqlIdent } from "./permdock-sql-CghlHPuH.js";
+import { i as parseSize, n as defineBucket } from "./storage-DuGn38fr.js";
 import { t as VERSION } from "./version-Cqq1m3UY.js";
 import { n as isSeed } from "./seed-CzecODcJ.js";
+import { existsSync } from "node:fs";
 import { chmod, glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
 import { dirname, join, posix, relative, resolve, sep } from "node:path";
-import { existsSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { introspect, parseGeneratorMetadata, serializeGeneratorMetadata, sortGeneratorMetadata } from "@supabase/postgrest-typegen";
 import { generateTypescript, pgTypeToTsType } from "@supabase/postgrest-typegen/generation";
@@ -55,7 +57,7 @@ function parseArgs(argv) {
 			break;
 		}
 		if (token === "-h") {
-			flags.help = true;
+			flags["help"] = true;
 			continue;
 		}
 		if (token.startsWith("--")) {
@@ -86,7 +88,7 @@ function setFlag(flags, name, value) {
 	if (ARRAY_FLAGS.has(name)) {
 		const current = flags[name];
 		const pieces = value.split(",").map((item) => item.trim()).filter(Boolean);
-		flags[name] = Array.isArray(current) ? [...current, ...pieces] : pieces;
+		flags[name] = isList(current) ? [...current, ...pieces] : pieces;
 		return;
 	}
 	flags[name] = value;
@@ -100,7 +102,7 @@ function flagBool(flags, name) {
 }
 function flagList(flags, name) {
 	const value = flags[name];
-	if (Array.isArray(value)) return value;
+	if (isList(value)) return value;
 	if (typeof value === "string") return [value];
 	return [];
 }
@@ -112,6 +114,7 @@ function flagList(flags, name) {
 * downloaded at this commit and checked against the hash instead of bundled.
 */
 const SPLINTER_COMMIT = "e74a9e36cb12258cb67d1464bc1cb196e9cd8446";
+const SPLINTER_SHA256 = "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349";
 const SPLINTER_URL = `https://raw.githubusercontent.com/supabase/splinter/${SPLINTER_COMMIT}/splinter.sql`;
 function isLint(value) {
 	const lint = value;
@@ -140,12 +143,12 @@ async function splinterSql(options) {
 	const file = resolve(options.cacheDir, `splinter-${SPLINTER_COMMIT}.sql`);
 	if (existsSync(file)) {
 		const cached = await readFile(file, "utf8");
-		if (sha256(cached) === "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349") return cached;
+		if (sha256(cached) === SPLINTER_SHA256) return cached;
 	}
 	const response = await (options.fetch ?? fetch)(SPLINTER_URL);
 	if (!response.ok) throw new Error(`Downloading splinter.sql failed (${response.status}) from ${SPLINTER_URL}`);
 	const text = await response.text();
-	if (sha256(text) !== "d8d558baad3e03832e521c527907fa50a9a172fabd899dd0f5c2504a5a0e9349") throw new Error(`splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
+	if (sha256(text) !== SPLINTER_SHA256) throw new Error(`splinter.sql from ${SPLINTER_URL} does not match the pinned hash; refusing to run it.`);
 	await mkdir(dirname(file), { recursive: true });
 	await writeFile(file, text);
 	return text;
@@ -176,6 +179,9 @@ function splinterAdvisors(queryable, describe, options) {
 }
 //#endregion
 //#region src/sql/kit.ts
+function jwtClaim(name) {
+	return `coalesce(auth.jwt() ->> ${sqlString(name)}, auth.jwt() -> 'app_metadata' ->> ${sqlString(name)})`;
+}
 const SCHEMA = `create schema if not exists better_supabase;
 grant usage on schema better_supabase to anon, authenticated, service_role;`;
 const UPDATED_AT = {
@@ -396,13 +402,8 @@ begin
 end;
 $$;`
 };
-const TENANT = {
-	name: "tenant",
-	title: "Tenant memberships and permission helper",
-	description: "Memberships with roles and has_org_role() for RLS policies. A template: edit the roles to fit your app.",
-	requires: [],
-	target: "schema",
-	sql: `${SCHEMA}
+const tenantSql = (claims) => `${SCHEMA}
+grant usage on schema better_supabase to supabase_auth_admin;
 
 create table if not exists better_supabase.memberships (
   org_id uuid not null,
@@ -417,15 +418,16 @@ alter table better_supabase.memberships enable row level security;
 grant select on better_supabase.memberships to authenticated;
 grant all on better_supabase.memberships to service_role;
 
--- The org of the current request: a top-level \`org_id\` claim (custom access
--- token hook) or \`app_metadata.org_id\` (set through the Auth admin API).
-create or replace function better_supabase.current_org_id()
+-- The tenant of the current request: the top-level \`${claims.tenant}\` claim
+-- (custom access token hook) or \`app_metadata.${claims.tenant}\` (Auth admin API).
+-- Never user_metadata: users can write it.
+create or replace function better_supabase.current_tenant_id()
 returns uuid
 language sql
 stable
 set search_path = ''
 as $$
-  select nullif(coalesce(auth.jwt() ->> 'org_id', auth.jwt() -> 'app_metadata' ->> 'org_id'), '')::uuid
+  select nullif(${jwtClaim(claims.tenant)}, '')::uuid
 $$;
 
 -- using ((select better_supabase.has_org_role(organization_id, '{owner,admin}')))
@@ -448,7 +450,39 @@ $$;
 drop policy if exists bs_memberships_read on better_supabase.memberships;
 create policy bs_memberships_read on better_supabase.memberships
   for select to authenticated
-  using (user_id = (select auth.uid()) or (select better_supabase.has_org_role(org_id)));`
+  using (user_id = (select auth.uid()) or (select better_supabase.has_org_role(org_id)));
+
+-- The memberships claim in PermDock's shape: [{ scope, id, roles }]. With
+-- PermDock, \`permdock supabase hook generate\` writes the hook instead.
+-- Otherwise call it from your custom access token hook:
+--   return jsonb_set(event, '{claims,memberships}',
+--     better_supabase.membership_claims((event ->> 'user_id')::uuid));
+create or replace function better_supabase.membership_claims(user_id uuid)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(jsonb_agg(jsonb_build_object(
+      'scope', ${sqlString(claims.scope)},
+      'id', m.org_id,
+      'roles', jsonb_build_array(m.role)
+    ) order by m.created_at, m.org_id), '[]'::jsonb)
+  from better_supabase.memberships m
+  where m.user_id = membership_claims.user_id
+$$;
+
+revoke execute on function better_supabase.membership_claims(uuid) from public, anon, authenticated;
+grant execute on function better_supabase.membership_claims(uuid) to service_role, supabase_auth_admin;`;
+const TENANT = {
+	name: "tenant",
+	title: "Tenant memberships and permission helper",
+	description: "Memberships with roles, has_org_role() for RLS policies and membership_claims() for the access token hook. A template: edit the roles to fit your app.",
+	requires: [],
+	target: "schema",
+	sql: tenantSql(DEFAULT_CLAIMS),
+	render: tenantSql
 };
 const MFA = {
 	name: "mfa",
@@ -484,13 +518,7 @@ grant execute on function better_supabase.mfa_satisfied() to authenticated;
 --   using ((select better_supabase.mfa_satisfied()))
 --   with check ((select better_supabase.mfa_satisfied()));`
 };
-const ENTITLEMENTS = {
-	name: "entitlements",
-	title: "Stripe entitlements",
-	description: "Active Stripe entitlements per tenant from the Stripe Sync Engine, membership claims for the access token hook, and has_entitlement() for RLS.",
-	requires: ["tenant"],
-	target: "schema",
-	sql: `${SCHEMA}
+const entitlementsSql = (claims) => `${SCHEMA}
 grant usage on schema better_supabase to supabase_auth_admin;
 
 -- Lookup keys of the tenant's active entitlements, from the Stripe Sync
@@ -535,28 +563,35 @@ $$;
 revoke execute on function better_supabase.has_entitlement(uuid, text) from public, anon;
 grant execute on function better_supabase.has_entitlement(uuid, text) to authenticated, service_role;
 
--- The memberships claim: [{ tenant_id, roles, entitlements }]. Call it from
+-- The \`${claims.features}\` claim: { [tenant id]: lookup keys }, read by
+-- hasEntitlement(). Tenants without entitlements are left out. Call it from
 -- your custom access token hook:
---   return jsonb_set(event, '{claims,memberships}',
---     better_supabase.membership_claims((event ->> 'user_id')::uuid));
-create or replace function better_supabase.membership_claims(user_id uuid)
+--   return jsonb_set(event, '{claims,${claims.features}}',
+--     better_supabase.feature_claims((event ->> 'user_id')::uuid));
+create or replace function better_supabase.feature_claims(user_id uuid)
 returns jsonb
 language sql
 stable
 security definer
 set search_path = ''
 as $$
-  select coalesce(jsonb_agg(jsonb_build_object(
-      'tenant_id', m.org_id,
-      'roles', jsonb_build_array(m.role),
-      'entitlements', to_jsonb(better_supabase.tenant_entitlements(m.org_id))
-    ) order by m.created_at, m.org_id), '[]'::jsonb)
+  select coalesce(jsonb_object_agg(m.org_id::text, to_jsonb(e.keys)), '{}'::jsonb)
   from better_supabase.memberships m
-  where m.user_id = membership_claims.user_id
+  cross join lateral (select better_supabase.tenant_entitlements(m.org_id) as keys) e
+  where m.user_id = feature_claims.user_id
+    and cardinality(e.keys) > 0
 $$;
 
-revoke execute on function better_supabase.membership_claims(uuid) from public, anon, authenticated;
-grant execute on function better_supabase.membership_claims(uuid) to service_role, supabase_auth_admin;`
+revoke execute on function better_supabase.feature_claims(uuid) from public, anon, authenticated;
+grant execute on function better_supabase.feature_claims(uuid) to service_role, supabase_auth_admin;`;
+const ENTITLEMENTS = {
+	name: "entitlements",
+	title: "Stripe entitlements",
+	description: "Active Stripe entitlements per tenant from the Stripe Sync Engine, feature_claims() for the access token hook, and has_entitlement() for RLS.",
+	requires: ["tenant"],
+	target: "schema",
+	sql: entitlementsSql(DEFAULT_CLAIMS),
+	render: entitlementsSql
 };
 const INVITATIONS = {
 	name: "invitations",
@@ -1210,13 +1245,7 @@ begin
 end;
 $$;`
 };
-const REALTIME_TABLES = {
-	name: "realtime-tables",
-	title: "Realtime table changes",
-	description: "Broadcasts a change signal (no row data) once per statement on bs:t:<schema>.<table>[:<tenant>] for live queries.",
-	requires: [],
-	target: "schema",
-	sql: `${SCHEMA}
+const realtimeTablesSql = (claims) => `${SCHEMA}
 
 -- Clients refetch through RLS, so the payload carries no row data.
 create or replace function better_supabase.broadcast_changes()
@@ -1303,7 +1332,7 @@ $$;
 revoke execute on function better_supabase.track_realtime(regclass, text) from public, anon, authenticated;
 revoke execute on function better_supabase.untrack_realtime(regclass) from public, anon, authenticated;
 
--- Signed-in users receive unscoped topics, and tenant topics of their own org.
+-- Signed-in users receive unscoped topics, and topics of their active tenant.
 drop policy if exists bs_realtime_tables_receive on realtime.messages;
 create policy bs_realtime_tables_receive on realtime.messages for select to authenticated
   using (
@@ -1312,12 +1341,20 @@ create policy bs_realtime_tables_receive on realtime.messages for select to auth
     and (
       split_part((select realtime.topic()), ':', 4) = ''
       or split_part((select realtime.topic()), ':', 4) = coalesce(
-        (select auth.jwt()) ->> 'org_id',
-        (select auth.jwt()) -> 'app_metadata' ->> 'org_id',
+        (select auth.jwt()) ->> ${sqlString(claims.tenant)},
+        (select auth.jwt()) -> 'app_metadata' ->> ${sqlString(claims.tenant)},
         ''
       )
     )
-  );`
+  );`;
+const REALTIME_TABLES = {
+	name: "realtime-tables",
+	title: "Realtime table changes",
+	description: "Broadcasts a change signal (no row data) once per statement on bs:t:<schema>.<table>[:<tenant>] for live queries.",
+	requires: [],
+	target: "schema",
+	sql: realtimeTablesSql(DEFAULT_CLAIMS),
+	render: realtimeTablesSql
 };
 const JSONB_SCHEMAS = {
 	name: "jsonb-schemas",
@@ -1364,7 +1401,7 @@ begin
 end;
 $$;
 
--- Runs the rest of the transaction as this user, like PostgREST does. Extra claims (org_id, ...) go in the JWT.
+-- Runs the rest of the transaction as this user, like PostgREST does. Extra claims (tenant_id, ...) go in the JWT.
 create or replace function tests.authenticate_as(user_id uuid, claims jsonb default '{}')
 returns void
 language plpgsql
@@ -1708,7 +1745,7 @@ as $$
   select ${key} from ${target} t where ${column} = customer
 $$;
 
--- Users whose memberships claim carries the customer's entitlements, for
+-- Users whose features claim carries the customer's entitlements, for
 -- invalidating their sessions after entitlements.active_entitlement_summary.updated.
 create or replace function better_supabase.entitlement_members(customer text)
 returns setof uuid
@@ -1762,10 +1799,11 @@ function renderKit(names, layout = {}) {
 			"-- Managed by `better-supabase sql add`; re-running it overwrites this file."
 		].join("\n");
 		const extra = moduleExtras(module, layout);
+		const sql = module.render && layout.claims ? module.render(layout.claims) : module.sql;
 		return {
 			module: module.name,
 			path,
-			contents: `${header}\n\n${module.sql.trim()}\n${extra}`
+			contents: `${header}\n\n${sql.trim()}\n${extra}`
 		};
 	});
 }
@@ -1882,7 +1920,7 @@ function argEntries(fn) {
 function enrichedDatabase(model) {
 	const schemas = model.config.schemas.flatMap((schema) => {
 		const tables = model.tables.filter((t) => t.snapshot.schema === schema).flatMap((table) => {
-			const overrides = table.columns.filter((column) => column.values && !column.snapshot.isEnum || column.json && column.tsType !== "Json" || column.storage !== void 0).map((column) => `${prop(column.db)}: ${column.tsType};`);
+			const overrides = table.columns.filter((column) => column.values !== void 0 && !column.snapshot.isEnum || column.json && column.tsType !== "Json" || column.storage !== void 0).map((column) => `${prop(column.db)}: ${column.tsType};`);
 			return overrides.length > 0 ? block(prop(table.snapshot.name), overrides) : [];
 		});
 		return tables.length > 0 ? block(prop(schema), tables) : [];
@@ -2642,6 +2680,9 @@ function buildModel(snapshot, config) {
 	for (const entry of enums) enumsMeta[entry.name] = entry.values;
 	const functionsMeta = {};
 	for (const fn of functions) functionsMeta[fn.key] = fn.meta;
+	const claimOverrides = {};
+	for (const key of Object.keys(DEFAULT_CLAIMS)) if (config.claims[key] !== DEFAULT_CLAIMS[key]) claimOverrides[key] = config.claims[key];
+	const tenantClaim = config.claims.tenant === DEFAULT_CLAIMS.tenant ? void 0 : tenantClaimPaths(config.claims.tenant);
 	const meta = {
 		version: 1,
 		casing: config.casing,
@@ -2653,11 +2694,13 @@ function buildModel(snapshot, config) {
 			public: bucket.public ?? false,
 			path: bucket.path,
 			...bucket.policy ? { policy: bucket.policy } : {},
+			...bucket.policy === "tenant" && tenantClaim ? { tenant: { claim: tenantClaim } } : {},
 			...bucket.fileSizeLimit ? { fileSizeLimit: bucket.fileSizeLimit } : {},
 			...bucket.allowedMimeTypes ? { allowedMimeTypes: bucket.allowedMimeTypes } : {}
 		}])) } : {},
 		...Object.keys(config.topics).length > 0 ? { topics: config.topics } : {},
-		...config.realtime.tables.length > 0 ? { realtime: realtimeMeta(config.realtime.tables, tableModels) } : {}
+		...config.realtime.tables.length > 0 ? { realtime: realtimeMeta(config.realtime.tables, tableModels) } : {},
+		...Object.keys(claimOverrides).length > 0 ? { claims: claimOverrides } : {}
 	};
 	return {
 		tables: tableModels,
@@ -2870,7 +2913,7 @@ function parseTomlSubset(text) {
 			table = root;
 			for (const part of header[1].split(".").map((p) => p.trim().replace(/^"(.*)"$/, "$1"))) {
 				const next = table[part];
-				if (typeof next !== "object" || next === null || Array.isArray(next)) table[part] = {};
+				if (typeof next !== "object" || Array.isArray(next)) table[part] = {};
 				table = table[part];
 			}
 			continue;
@@ -2912,7 +2955,7 @@ async function readSupabaseToml(root) {
 function tomlGet(document, path) {
 	let value = document;
 	for (const key of path) {
-		if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+		if (typeof value !== "object" || Array.isArray(value)) return void 0;
 		value = value[key];
 	}
 	return value;
@@ -2933,9 +2976,9 @@ function parsePgFunctionUri(uri) {
 /** The enabled Auth hooks with a `pg-functions://` URI, by hook name. */
 function pgFunctionHooks(document) {
 	const hooks = tomlGet(document, ["auth", "hook"]);
-	if (typeof hooks !== "object" || hooks === null || Array.isArray(hooks)) return [];
+	if (typeof hooks !== "object" || Array.isArray(hooks)) return [];
 	return Object.entries(hooks).flatMap(([hook, table]) => {
-		if (typeof table !== "object" || table === null || Array.isArray(table)) return [];
+		if (typeof table !== "object" || Array.isArray(table)) return [];
 		const { enabled, uri } = table;
 		if (enabled !== true && enabled !== "true" || typeof uri !== "string") return [];
 		const target = parsePgFunctionUri(uri);
@@ -2997,7 +3040,7 @@ async function readSupabasePort(root, section) {
 async function databaseUrl(config, env, flag) {
 	if (flag) return flag;
 	if (config.source.dbUrl) return config.source.dbUrl;
-	if (env.DATABASE_URL) return env.DATABASE_URL;
+	if (env["DATABASE_URL"]) return env["DATABASE_URL"];
 	return `postgresql://postgres:postgres@127.0.0.1:${await readSupabasePort(config.root, "db") ?? 54322}/postgres`;
 }
 //#endregion
@@ -3119,7 +3162,8 @@ select n.nspname as schema, p.proname as name,
     where a.grantee = 0 and a.privilege_type = 'EXECUTE') as public_execute,
   array(select r.rolname::text from pg_roles r
     where r.rolname = any(${HOOK_ROLES}) and has_schema_privilege(r.oid, n.oid, 'usage')
-    order by 1) as schema_usage
+    order by 1) as schema_usage,
+  p.prosrc as source
 from pg_proc p
 join pg_namespace n on n.oid = p.pronamespace
 join pg_language l on l.oid = p.prolang
@@ -3211,7 +3255,8 @@ async function readHooks(db, targets) {
 			...functionOf(row),
 			execute: row.execute,
 			publicExecute: row.public_execute,
-			schemaUsage: row.schema_usage
+			schemaUsage: row.schema_usage,
+			...row.source === null ? {} : { source: row.source }
 		}))
 	}));
 }
@@ -3422,12 +3467,12 @@ function managementTarget(config, env, source) {
 	if (source.dbUrl) return void 0;
 	const projectRef = source.projectRef ?? (config.source.dbUrl ? void 0 : config.source.projectRef);
 	if (!projectRef) return void 0;
-	const accessToken = config.source.accessToken ?? env.SUPABASE_ACCESS_TOKEN ?? void 0;
+	const accessToken = config.source.accessToken ?? env["SUPABASE_ACCESS_TOKEN"] ?? void 0;
 	if (!accessToken) throw new Error(`Reading project ${projectRef} needs a Supabase access token. Set SUPABASE_ACCESS_TOKEN (https://supabase.com/dashboard/account/tokens) or pass --db-url.`);
 	return {
 		projectRef,
 		accessToken,
-		...env.SUPABASE_API_URL ? { apiUrl: env.SUPABASE_API_URL } : {}
+		...env["SUPABASE_API_URL"] ? { apiUrl: env["SUPABASE_API_URL"] } : {}
 	};
 }
 /**
@@ -3495,6 +3540,18 @@ function serializeSnapshot(snapshot) {
 	}, null, 2)}\n`;
 }
 //#endregion
+//#region src/cli/permdock.ts
+const PERMDOCK_CONFIGS = [
+	"permdock.config.ts",
+	"permdock.config.mts",
+	"permdock.config.js",
+	"permdock.config.mjs"
+];
+/** The PermDock config file in `root`, if there is one. */
+function permdockConfig(root) {
+	return PERMDOCK_CONFIGS.find((file) => existsSync(resolve(root, file)));
+}
+//#endregion
 //#region src/cli/commands/sql.ts
 const SQL_HELP = `Usage: better-supabase sql <list|add|sync|print> [modules...]
 
@@ -3505,7 +3562,10 @@ const SQL_HELP = `Usage: better-supabase sql <list|add|sync|print> [modules...]
 
 Options
   --tests-dir <dir>    Where the pgtap module goes. Defaults to sql.testsDir.
-  --dry-run            Show what would be written`;
+  --dry-run            Show what would be written
+  --force              Write tenant even though a permdock.config.ts is present`;
+/** Modules that fill a claim PermDock's hook also writes (`memberships`). */
+const PERMDOCK_OWNED = /* @__PURE__ */ new Set(["tenant"]);
 /** Where and how `sql add` writes kit files for this config. */
 function kitLayout(config, testsDir = config.sql.testsDir, readSets = []) {
 	return {
@@ -3516,6 +3576,7 @@ function kitLayout(config, testsDir = config.sql.testsDir, readSets = []) {
 		readSets,
 		realtimeTables: config.realtime.tables,
 		entitlements: config.entitlements,
+		claims: config.claims,
 		vectorSearch: config.vectorSearch,
 		grants: Object.entries(config.expose).flatMap(([table, roles]) => [{
 			table,
@@ -3588,7 +3649,19 @@ async function runSql(config, args) {
 				code: 2,
 				error: `Unknown module ${unknown.join(", ")}. Available: ${Object.keys(SQL_MODULES).join(", ")}`
 			};
+			const permdock = permdockConfig(config.root);
+			const hookModules = names.filter((name) => PERMDOCK_OWNED.has(name));
+			if (permdock && hookModules.length > 0 && !flagBool(args.flags, "force")) return {
+				code: 1,
+				error: [
+					`${permdock} is present, so PermDock owns the access token hook and the memberships claim.`,
+					`${hookModules.join(" and ")} would add a second source for them. Use \`permdock supabase hook generate\` instead,`,
+					"or pass --force to write the modules anyway."
+				].join("\n")
+			};
 			const lines = await write(config, args, names);
+			const pulledIn = resolveModules(names).map((module) => module.name).filter((name) => PERMDOCK_OWNED.has(name) && !names.includes(name));
+			if (permdock && pulledIn.length > 0) lines.push("", `${pulledIn.join(" and ")} came along as a dependency: its memberships table backs has_org_role() and has_entitlement().`, `PermDock's hook still owns the memberships claim, so don't call better_supabase.membership_claims from a hook.`, "List better_supabase.memberships as a PermDock membership source if both should agree.");
 			const untracked = resolveModules(names).map((module) => module.name).filter((name) => !config.sql.kit.includes(name));
 			if (untracked.length > 0) lines.push("", `Add them to your config so \`sql sync --check\` keeps them current:`, `  sql: { kit: [${[...config.sql.kit, ...untracked].map((name) => `'${name}'`).join(", ")}] }`);
 			lines.push("", "Then create a migration: supabase db diff -f better_supabase_kit");
@@ -3625,7 +3698,7 @@ async function runSql(config, args) {
 			};
 			return {
 				code: 0,
-				output: module.sql
+				output: module.render ? module.render(config.claims) : module.sql
 			};
 		}
 		case void 0: return {
@@ -3745,6 +3818,10 @@ function lineOf(text, pattern) {
 	const index = text.split("\n").findIndex((line) => pattern.test(line));
 	return index === -1 ? void 0 : index + 1;
 }
+//#endregion
+//#region src/cli/doctor/live.ts
+/** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
+const SLOW_MEAN_MS = 50;
 const SLOW_CALLS = 1e3;
 /** Rows `--explain` reads, like a `findMany()` under Supabase's default `max_rows`. */
 const EXPLAIN_LIMIT = 1e3;
@@ -3884,7 +3961,7 @@ const LIVE_RULES = [
 		code: "BS209",
 		severity: "warning",
 		title: "Slow frequent statements",
-		description: `Statements from \`pg_stat_statements\` with a mean time above 50 ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
+		description: `Statements from \`pg_stat_statements\` with a mean time above ${SLOW_MEAN_MS} ms and more than ${SLOW_CALLS} calls. Runs with \`--stats\`.`,
 		async check(context) {
 			if (!context.stats) return [];
 			const db = live(context);
@@ -3899,7 +3976,7 @@ const LIVE_RULES = [
 					severity: "info",
 					message: "pg_stat_statements is not installed, so --stats has nothing to read. Run `create extension pg_stat_statements with schema extensions;`."
 				}];
-				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > 50 order by total_exec_time desc limit 20`);
+				const statements = await db.query(`select queryid::text as queryid, query, calls, mean_exec_time from ${view} where calls > ${SLOW_CALLS} and mean_exec_time > ${SLOW_MEAN_MS} order by total_exec_time desc limit 20`);
 				const tables = exposed(context);
 				return statements.map((statement) => {
 					const table = tableIn(statement.query, tables);
@@ -3971,6 +4048,45 @@ const LIVE_RULES = [
 //#region src/cli/doctor/hooks.ts
 /** Claims past this size make every request carry a large cookie and header. */
 const HOOK_CLAIMS_LIMIT = 2048;
+/** PermDock's default `supabase.hook.budget`, over `memberships` plus `attrs`. */
+const PERMDOCK_CLAIMS_LIMIT = 1024;
+/**
+* The BS405 limits. With PermDock, `doctor.claimsLimit` is its budget for
+* `memberships` plus `attrs` and the whole token keeps 2048; without it,
+* `doctor.claimsLimit` limits the whole token.
+*/
+function claimsLimits(context) {
+	const configured = context.config.doctor.claimsLimit;
+	return context.permdock ? {
+		token: HOOK_CLAIMS_LIMIT,
+		budget: configured ?? PERMDOCK_CLAIMS_LIMIT
+	} : {
+		token: configured ?? HOOK_CLAIMS_LIMIT,
+		budget: void 0
+	};
+}
+/** The kit function that fills PermDock's `memberships` claim. */
+const KIT_MEMBERSHIPS = /better_supabase\s*\.\s*membership_claims\b/i;
+const PERMDOCK_CALL = /\bpermdock\w*\s*\(|permdock\s*\./i;
+/** Only PermDock's generated hook sets this claim, so it marks that hook's body. */
+const PERMDOCK_HOOK = /'\{\s*(?:claims\s*,\s*)?memberships_truncated\s*\}'/i;
+const escapeRegExp = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** The claims PermDock's hook writes that a second writer would contradict. */
+function ownedClaims(tenant) {
+	return [
+		"roles",
+		"user_role",
+		"memberships",
+		tenant
+	];
+}
+/** Which of `claims` the hook body writes through `jsonb_set` or `jsonb_build_object`. */
+function writtenClaims(source, claims) {
+	return claims.filter((claim) => {
+		const name = escapeRegExp(claim);
+		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
+	});
+}
 const API_ROLES = ["authenticated", "anon"];
 /** Hooks enabled in `config.toml`, matched with their introspected functions. */
 function configuredHooks(context) {
@@ -4017,11 +4133,7 @@ const emptySearchPath = (fn) => {
 	const value = fn.settings["search_path"];
 	return value === "" || value === "\"\"" || value === "''";
 };
-/**
-* Runs the hook as Auth does for `userId` (as `supabase_auth_admin` when the
-* connecting role may switch to it), in a transaction that is rolled back.
-*/
-async function hookClaimsBytes(db, fn, userId) {
+async function hookClaimsSize(db, fn, userId) {
 	const call = `${ident(fn.schema)}.${ident(fn.name)}`;
 	await db.query("begin");
 	try {
@@ -4045,97 +4157,154 @@ async function hookClaimsBytes(db, fn, userId) {
 		const [role] = await db.query(`select case when exists(select 1 from pg_roles where rolname = 'supabase_auth_admin')
         then pg_has_role('supabase_auth_admin', 'member') else false end as member`);
 		if (role?.member) await db.query("set local role supabase_auth_admin");
-		const [row] = await db.query(`select octet_length((${call}(current_setting('better_supabase.hook_event')::jsonb) -> 'claims')::text) as bytes`);
-		return row?.bytes === null || row?.bytes === void 0 ? 0 : Number(row.bytes);
+		const [row] = await db.query(`select octet_length(c::text) as bytes,
+        octet_length((c -> 'memberships')::text) as memberships,
+        octet_length((c -> 'attrs')::text) as attrs,
+        c ->> 'memberships_truncated' = 'true' as truncated
+      from (select ${call}(current_setting('better_supabase.hook_event')::jsonb) -> 'claims' as c) h`);
+		const memberships = Number(row?.memberships ?? 0);
+		return {
+			bytes: Number(row?.bytes ?? 0),
+			memberships,
+			budget: memberships + Number(row?.attrs ?? 0),
+			truncated: row?.truncated === true
+		};
 	} finally {
 		await db.query("rollback");
 	}
 }
-const HOOK_RULES = [{
-	code: "BS404",
-	severity: "error",
-	title: "Auth hook function grants",
-	description: "Auth calls Postgres hook functions as `supabase_auth_admin`, which needs usage on the schema and execute on the function. Nobody else should be able to call them: a client calling the custom access token hook through the API sees what it adds for any user id.",
-	check: (context) => configuredHooks(context).flatMap(({ config, extras }) => {
-		if (!extras) return [];
-		const location = hookLocation(context, config.hook);
-		const where = location ? { location } : {};
-		if (extras.functions.length === 0) return [{
-			message: `[auth.hook.${config.hook}] calls ${config.schema}.${config.name}, which does not exist. Sign-ins fail until it does.`,
-			target: `[auth.hook.${config.hook}]`,
-			...where
-		}];
-		return extras.functions.flatMap((fn) => {
-			const { problems, fix } = grantProblems(fn);
-			if (problems.length === 0) return [];
-			return [{
-				message: `${signatureOf(fn)} ([auth.hook.${config.hook}]): ${problems.join("; ")}. Run:\n${fix.join("\n")}`,
-				target: signatureOf(fn),
-				object: {
-					kind: "function",
-					schema: fn.schema,
-					name: fn.name
-				}
+const HOOK_RULES = [
+	{
+		code: "BS404",
+		severity: "error",
+		title: "Auth hook function grants",
+		description: "Auth calls Postgres hook functions as `supabase_auth_admin`, which needs usage on the schema and execute on the function. Nobody else should be able to call them: a client calling the custom access token hook through the API sees what it adds for any user id.",
+		check: (context) => configuredHooks(context).flatMap(({ config, extras }) => {
+			if (!extras) return [];
+			const location = hookLocation(context, config.hook);
+			const where = location ? { location } : {};
+			if (extras.functions.length === 0) return [{
+				message: `[auth.hook.${config.hook}] calls ${config.schema}.${config.name}, which does not exist. Sign-ins fail until it does.`,
+				target: `[auth.hook.${config.hook}]`,
+				...where
 			}];
-		});
-	})
-}, {
-	code: "BS405",
-	severity: "warning",
-	title: "Custom access token hook shape",
-	description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back and warns above ${HOOK_CLAIMS_LIMIT} bytes of claims.`,
-	async check(context) {
-		const findings = [];
-		for (const { config, extras } of configuredHooks(context)) {
-			if (config.hook !== "custom_access_token" || !extras) continue;
-			for (const fn of extras.functions) {
-				const object = {
-					kind: "function",
-					schema: fn.schema,
-					name: fn.name
-				};
-				const shape = [];
-				if (fn.volatility !== "stable") shape.push(`it is ${fn.volatility}; declare it \`stable\``);
-				if (!emptySearchPath(fn)) shape.push("it has no `set search_path = ''`; add it and qualify every table");
-				if (shape.length > 0) findings.push({
-					message: `${signatureOf(fn)}: ${shape.join("; ")}.`,
+			return extras.functions.flatMap((fn) => {
+				const { problems, fix } = grantProblems(fn);
+				if (problems.length === 0) return [];
+				return [{
+					message: `${signatureOf(fn)} ([auth.hook.${config.hook}]): ${problems.join("; ")}. Run:\n${fix.join("\n")}`,
 					target: signatureOf(fn),
-					object
-				});
-				if (!context.hookUser) continue;
-				const db = context.database;
-				if (!db || "skipped" in db || !db.session) {
-					findings.push({
-						severity: "info",
-						message: `Measuring the hook's claims needs a direct database connection (local stack or --db-url)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
-						target: `${signatureOf(fn)}:claims`
-					});
-					continue;
-				}
-				try {
-					const bytes = await hookClaimsBytes(db, fn, context.hookUser);
-					if (bytes === void 0) findings.push({
-						severity: "info",
-						message: `--as ${context.hookUser}: no such user in auth.users, so the hook was not called.`,
-						target: `${signatureOf(fn)}:claims`
-					});
-					else if (bytes > 2048) findings.push({
-						message: `${signatureOf(fn)} returns ${bytes} bytes of claims for ${context.hookUser} (limit ${HOOK_CLAIMS_LIMIT}). Every request carries them twice (cookie and header); keep ids and roles in the token and look up the rest.`,
-						target: `${signatureOf(fn)}:claims`,
-						object
-					});
-				} catch (cause) {
-					findings.push({
-						message: `Calling ${signatureOf(fn)} for ${context.hookUser} failed: ${errorText(cause)}`,
-						target: `${signatureOf(fn)}:claims`,
+					object: {
+						kind: "function",
+						schema: fn.schema,
+						name: fn.name
+					}
+				}];
+			});
+		})
+	},
+	{
+		code: "BS405",
+		severity: "warning",
+		title: "Custom access token hook shape",
+		description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back. It warns when the whole token's claims pass ${HOOK_CLAIMS_LIMIT} bytes (\`doctor.claimsLimit\` without PermDock). With a \`permdock.config.ts\` it also warns when \`memberships\` plus \`attrs\` pass PermDock's budget, ${PERMDOCK_CLAIMS_LIMIT} bytes or \`doctor.claimsLimit\`, measured with \`octet_length\` as PermDock's hook measures it.`,
+		async check(context) {
+			const findings = [];
+			const limits = claimsLimits(context);
+			for (const { config, extras } of configuredHooks(context)) {
+				if (config.hook !== "custom_access_token" || !extras) continue;
+				for (const fn of extras.functions) {
+					const object = {
+						kind: "function",
+						schema: fn.schema,
+						name: fn.name
+					};
+					const shape = [];
+					if (fn.volatility !== "stable") shape.push(`it is ${fn.volatility}; declare it \`stable\``);
+					if (!emptySearchPath(fn)) shape.push("it has no `set search_path = ''`; add it and qualify every table");
+					if (shape.length > 0) findings.push({
+						message: `${signatureOf(fn)}: ${shape.join("; ")}.`,
+						target: signatureOf(fn),
 						object
 					});
+					if (!context.hookUser) continue;
+					const db = context.database;
+					if (!db || "skipped" in db || !db.session) {
+						findings.push({
+							severity: "info",
+							message: `Measuring the hook's claims needs a direct database connection (local stack or --db-url)${db && "skipped" in db ? `: ${db.skipped}` : "."}`,
+							target: `${signatureOf(fn)}:claims`
+						});
+						continue;
+					}
+					try {
+						const size = await hookClaimsSize(db, fn, context.hookUser);
+						if (size === void 0) {
+							findings.push({
+								severity: "info",
+								message: `--as ${context.hookUser}: no such user in auth.users, so the hook was not called.`,
+								target: `${signatureOf(fn)}:claims`
+							});
+							continue;
+						}
+						if (limits.budget !== void 0 && size.budget > limits.budget) findings.push({
+							message: `${signatureOf(fn)} returns ${size.budget} bytes of memberships and attrs for ${context.hookUser}, over PermDock's budget of ${limits.budget} (memberships ${size.memberships}). Raise \`supabase.hook.budget\` and \`doctor.claimsLimit\` together, or move attrs out of the token.`,
+							target: `${signatureOf(fn)}:budget`,
+							object
+						});
+						if (size.bytes > limits.token) findings.push({
+							message: `${signatureOf(fn)} returns ${size.bytes} bytes of claims for ${context.hookUser} (limit ${limits.token}, memberships ${size.memberships}). Every request carries them twice (cookie and header); keep ids and roles in the token and look up the rest.`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+						if (size.truncated) findings.push({
+							severity: "info",
+							message: `${signatureOf(fn)} sets memberships_truncated for ${context.hookUser}: the token lists only some memberships (${size.memberships} bytes). Server checks for this user need a database lookup (PermDock's claimsFirst falls back to one).`,
+							target: `${signatureOf(fn)}:truncated`,
+							object
+						});
+					} catch (cause) {
+						findings.push({
+							message: `Calling ${signatureOf(fn)} for ${context.hookUser} failed: ${errorText(cause)}`,
+							target: `${signatureOf(fn)}:claims`,
+							object
+						});
+					}
 				}
 			}
+			return findings;
 		}
-		return findings;
+	},
+	{
+		code: "BS407",
+		severity: "error",
+		title: "Two authorization hooks",
+		description: "A `permdock.config.ts` (or a hook that calls PermDock's functions) means PermDock writes `user_role`, `roles`, `memberships` and the tenant claim (`claims.tenant`) into the token. A custom access token hook that also calls `better_supabase.membership_claims`, or writes one of those claims itself, gives them a second source that drifts from PermDock's. Generate the hook with `permdock supabase hook generate` and drop the extra writes. Other claims, such as the entitlements module's `features`, are not PermDock's and are not reported.",
+		check: (context) => configuredHooks(context).flatMap(({ config, extras }) => {
+			if (config.hook !== "custom_access_token" || !extras) return [];
+			return extras.functions.flatMap((fn) => {
+				if (fn.source === void 0) return [];
+				const kit = KIT_MEMBERSHIPS.test(fn.source);
+				const written = PERMDOCK_HOOK.test(fn.source) ? [] : writtenClaims(fn.source, ownedClaims(context.config.claims.tenant));
+				if (!kit && written.length === 0) return [];
+				const permdock = context.permdock ?? (PERMDOCK_CALL.test(fn.source) ? "the hook body" : void 0);
+				if (!permdock) return [];
+				const location = hookLocation(context, config.hook);
+				const what = [...kit ? ["calls better_supabase.membership_claims"] : [], ...written.length > 0 ? [`writes ${written.join(", ")}`] : []].join(" and ");
+				return [{
+					message: `${signatureOf(fn)} ${what}, and ${permdock} says PermDock owns those claims. Keep one source: run \`permdock supabase hook generate\` and remove these writes from your hook.`,
+					target: signatureOf(fn),
+					object: {
+						kind: "function",
+						schema: fn.schema,
+						name: fn.name
+					},
+					...location ? { location } : {}
+				}];
+			});
+		})
 	}
-}];
+];
 //#endregion
 //#region src/cli/doctor/rls.ts
 const escape$1 = (name) => name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4425,8 +4594,11 @@ function coveredByBS207(lint, context) {
 * with `facetCounts: true`.
 */
 const AGGREGATE_USE = /\.aggregate\(|\b_(?:sum|avg|min|max)\s*:\s*\{|\bfacetCounts\s*:\s*true\b/;
-/** A policy that reads memberships or the tenant claim: `is_member(...)`, `current_org_id()`, `memberships`. */
-const TENANT_HELPER = /member|tenant|current_org|org_id/i;
+/**
+* A policy that reads memberships or the tenant claim: `is_member(...)`,
+* `current_tenant_id()`, `memberships`, PermDock's `permitted_*_ids()`.
+*/
+const TENANT_HELPER = /member|tenant|current_org|org_id|permitted_\w+_ids/i;
 /** A foreign key to the tenant table itself, whose own policies are usually read-only. */
 const TENANT_COLUMN = /^(?:org|organization|tenant|team|workspace|account)_id$/;
 const COMMANDS$1 = [
@@ -5146,9 +5318,11 @@ async function runDoctor(config, args, env, options = {}) {
 		...options.database !== void 0 ? { database: options.database } : {}
 	};
 	const envFiles = (await Promise.all(ENV_FILES.map((path) => readText(config.root, path)))).filter((file) => file !== void 0);
+	const permdock = permdockConfig(config.root);
 	const context = {
 		config,
 		snapshot,
+		...permdock ? { permdock } : {},
 		configToml: await readSupabaseToml(config.root),
 		envFiles,
 		gitignore: (await readText(config.root, ".gitignore"))?.text ?? "",
@@ -5235,7 +5409,7 @@ function exec(command, args, cwd) {
 }
 /** Runs the Supabase CLI: `$SUPABASE_BIN`, then `supabase`, then `npx supabase`. */
 async function supabaseCli(args, cwd, env) {
-	const result = await exec(env.SUPABASE_BIN ?? "supabase", args, cwd);
+	const result = await exec(env["SUPABASE_BIN"] ?? "supabase", args, cwd);
 	if (result.code !== 127) return result;
 	return exec("npx", [
 		"--yes",
@@ -6069,7 +6243,7 @@ async function runSkills(config, args, env) {
 		error: action ? `Unknown skills action "${action}".\n\n${SKILLS_HELP}` : SKILLS_HELP
 	};
 	const global = flagBool(args.flags, "global");
-	const base = global ? env.HOME ?? homedir() : config.root;
+	const base = global ? env["HOME"] ?? homedir() : config.root;
 	const requested = flagList(args.flags, "agent");
 	const unknown = requested.filter((name) => !isAgent(name));
 	if (unknown.length > 0) return {