better-supabase 0.4.0 → 0.5.0

package/dist/cli/{env-BZ0uy8XK.js → env-DmKv_G4A.js}

@@ -1,5 +1,5 @@
 import { n as CliError } from "./errors-4v4DTtda.js";
-import { g as url, l as pipe, p as string, s as optional } from "./dist-Du7VnEUG.js";
+import { d as pipe, h as string, l as optional, v as url } from "./dist-xn4wlboc.js";
 //#region ../../node_modules/.pnpm/@t3-oss+env-core@0.13.11_arktype@2.2.3_typescript@7.0.2_valibot@1.5.0_typescript@7.0.2__zod@4.6.5/node_modules/@t3-oss/env-core/dist/standard.js
 function ensureSynchronous(value, message) {
 	if (value instanceof Promise) throw new Error(message);

package/dist/cli/gen-BJc9vdyu.js

@@ -0,0 +1,2 @@
+import { n as genCommand } from "./gen-C2osRcr5.js";
+export { genCommand };

package/dist/cli/{gen-Ccn_p90L.js → gen-C2osRcr5.js}

@@ -2,9 +2,10 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { n as importPath, r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-5mW_8sY1.js";
-import { d as readSupabaseToml, s as stdinDatabaseUrl, t as databaseUrl, u as pgFunctionHooks } from "./config-D9R0o1LH.js";
-import { c as readPermdock, l as fileDiff, n as entitlementHelpers, r as entitlementsMode, t as compiledReadSets } from "./read-sets-CMa29t9a.js";
+import { t as VERSION } from "./version-BDJuO0UR.js";
+import { d as pgFunctionHooks, f as readSupabaseToml, m as tomlGet, s as stdinDatabaseUrl, t as databaseUrl } from "./config-CPVpXP5I.js";
+import { t as fileDiff } from "./diff-SjkO5rNr.js";
+import { a as parseHookMarker, i as parseGrantsMarker, n as entitlementRequirements, r as entitlementsMode, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
@@ -12,7 +13,7 @@ import { basename, dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { setTimeout } from "node:timers/promises";
-import { kitLayout, permdockKeys, renderKit, sameKitFile } from "better-supabase/sql";
+import { PERMDOCK_SCHEMA, kitLayout, permdockKeyStatus, permdockKeys, renderKit, sameKitFile } from "better-supabase/sql";
 import { DEFAULT_CLAIMS, tenantClaimPaths } from "better-supabase/config";
 import { toCamel, toSnake } from "better-supabase";
 import { generateTypescript, pgTypeToTsType, sortGeneratorMetadata } from "@supabase/postgrest-typegen/generation";
@@ -198,7 +199,15 @@ function catalogOf(context) {
 	}
 	return catalog;
 }
-const exposed = (context) => catalogOf(context).tables.filter((table) => context.config.schemas.includes(table.schema));
+/** `[api] schemas` from `config.toml`, the schemas PostgREST serves, or `config.schemas` without one. */
+function exposedSchemas(context) {
+	const listed = context.configToml ? tomlGet(context.configToml.document, ["api", "schemas"]) : void 0;
+	return Array.isArray(listed) && listed.every((entry) => typeof entry === "string") ? listed : context.config.schemas;
+}
+const exposed = (context) => {
+	const schemas = exposedSchemas(context);
+	return catalogOf(context).tables.filter((table) => schemas.includes(table.schema));
+};
 const qualified = (table) => `${table.schema}.${table.name}`;
 const tableObject = (table) => ({
 	kind: "table",
@@ -232,7 +241,8 @@ function lineOf(text, pattern) {
 /** Tables whose policies PermDock's helpers can't row-check (PermDock's PD037 scans the same ones). */
 const HELPER_TABLES = /* @__PURE__ */ new Set(["storage.objects", "realtime.messages"]);
 const POLICY = /create\s+policy\s+("(?:[^"]|"")+"|[\w$]+)\s+on\s+((?:"[^"]+"|\w+)\s*\.\s*(?:"[^"]+"|\w+))([\s\S]*?);/gi;
-const HELPER_KEY = /\b(?:permitted_\w+_ids|permdock_has)"?\s*\(\s*'((?:[^']|'')*)'/g;
+/** A helper call: optional schema, `permitted_<scope>_ids` or `permdock_has`, and the key, positional or named. */
+const HELPER_CALL = /(?:(?:"((?:[^"]|"")+)"|([a-z_][\w$]*))\s*\.\s*)?"?(?:permitted_(\w+?)_ids|(permdock_has))"?\s*\(\s*(?:\w+\s*=>\s*)?'((?:[^']|'')*)'/gi;
 const unquote = (name) => name.replaceAll(/^"|"$/g, "").replaceAll("\"\"", "\"");
 /**
 * Policies better-supabase generates (`bs_` names) on `storage.objects` and
@@ -250,99 +260,266 @@ function helperPolicies(files) {
 		const id = `${table}.${name}`;
 		if (seen.has(id)) continue;
 		seen.add(id);
-		const keys = [...match[3].matchAll(HELPER_KEY)].map((key) => key[1].replaceAll("''", "'"));
-		if (keys.length === 0) continue;
+		const calls = [...match[3].matchAll(HELPER_CALL)].map((call) => {
+			const schema = call[1]?.replaceAll("\"\"", "\"") ?? call[2];
+			return {
+				key: call[5].replaceAll("''", "'"),
+				scope: call[4] ? "global" : call[3],
+				...schema ? { schema } : {}
+			};
+		});
+		if (calls.length === 0) continue;
 		found.push({
 			name,
 			table,
-			keys: [...new Set(keys)],
+			keys: [...new Set(calls.map((call) => call.key))],
+			calls,
 			file: file.path,
 			line: file.text.slice(0, match.index).split("\n").length
 		});
 	}
 	return found;
 }
-/** `buckets` entries with a PermDock policy, and the keys they name. */
+/** `buckets` entries with a PermDock policy, the keys they name, their scope and helper schema. */
 function configuredPermdockKeys(context) {
-	return Object.entries(context.config.buckets).flatMap(([bucket, config]) => config.policy !== void 0 && typeof config.policy !== "string" ? [{
+	return Object.entries(context.config.buckets).flatMap(([bucket, config]) => config.policy !== void 0 && typeof config.policy !== "string" && "permdock" in config.policy ? [{
 		bucket,
-		keys: permdockKeys(config.policy)
+		keys: permdockKeys(config.policy),
+		scope: config.policy.scope,
+		schema: config.policy.schema ?? PERMDOCK_SCHEMA
 	}] : []);
 }
+/** A scope name or PermDock's alias for it (`tenant` is the first scope, `team` the second), resolved against the manifest. */
+function resolveManifestScope(manifest, name) {
+	const scopes = manifest?.rls?.scopes;
+	if (!scopes) return void 0;
+	if (scopes.some((scope) => scope.name === name)) return name;
+	if (name === "tenant") return scopes[0]?.name;
+	if (name === "team") return scopes[1]?.name;
+}
+/**
+* Why a policy's helper schema or scope can't work with PermDock's
+* manifest and catalog: a schema other than `rls.schema`, a scope the
+* manifest doesn't declare, or a key the catalog declares at another scope.
+*/
+function placementProblems(project, catalog, call, where) {
+	const rls = project.manifest?.rls;
+	const problems = [];
+	if (rls && call.schema !== void 0 && call.schema !== rls.schema) problems.push(`${where} calls PermDock's helpers in schema ${call.schema}, but ${project.manifestPath} puts them in ${rls.schema}. Set schema: '${rls.schema}' on the policy.`);
+	if (call.scope === "global") return problems;
+	if (rls && !rls.scopes.some((scope) => scope.name === call.scope)) {
+		const resolved = resolveManifestScope(project.manifest, call.scope);
+		problems.push(`${where} uses scope "${call.scope}", which ${project.manifestPath} doesn't declare, so permitted_${call.scope}_ids doesn't exist. ${resolved ? `Use "${resolved}", the scope "${call.scope}" stands for.` : `Use one of ${rls.scopes.map((scope) => scope.name).join(", ") || "its scopes"}.`}`);
+		return problems;
+	}
+	const declared = catalog.permissions.find((permission) => permission.key === call.key)?.scope;
+	if (declared === void 0) return problems;
+	const resolved = resolveManifestScope(project.manifest, declared) ?? declared;
+	if (resolved !== call.scope) problems.push(`${where} checks "${call.key}" at scope "${call.scope}", but ${project.catalogPath} declares it at "${resolved}", so PermDock's helpers never grant it there. Use scope "${resolved}".`);
+	return problems;
+}
+const ROW_CONDITIONS_FIX = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
+const REGENERATE_FIX = "Regenerate it with a current `permdock catalog`, which writes rowConditions for every permission.";
+/**
+* Why the SQL helpers can't be trusted with `key`, or `undefined` when the
+* catalog marks it `rowConditions: false`. An entry without the flag and a
+* key the catalog doesn't list are unknown, so they count as unsafe.
+*/
+function unsafeKey(catalog, key, catalogPath) {
+	const status = permdockKeyStatus(catalog, key);
+	switch (status) {
+		case "scope-only": return;
+		case "row-conditions": return {
+			reason: `has row conditions in ${catalogPath}`,
+			fix: ROW_CONDITIONS_FIX
+		};
+		case "no-flag": return {
+			reason: `has no rowConditions flag in ${catalogPath}, so whether it has row conditions is unknown`,
+			fix: REGENERATE_FIX
+		};
+		case "missing": return {
+			reason: `is not in ${catalogPath}`,
+			fix: REGENERATE_FIX
+		};
+		default: return status;
+	}
+}
 /** PermDock's helpers for the `entitlements` kit module, when the manifest allows PermDock mode. */
 function entitlementsKit(context) {
 	const mode = entitlementsMode(context.config, context.permdock);
 	return mode.kind === "permdock" ? mode.permdock : void 0;
 }
-const PERMDOCK_RULES = [{
-	code: "BS214",
-	severity: "error",
-	title: "PermDock permission with row conditions in a Storage or Realtime policy",
-	description: "PermDock's SQL helpers (`permitted_<scope>_ids`, `permdock_has`) check role and scope, not row conditions. A bucket or topic policy that names a permission whose catalog entry has `rowConditions: true` grants every object or topic in the scope. Use PermDock's generated policies for those permissions.",
-	check: (context) => {
-		const project = context.permdock;
-		if (!project) return [];
-		const fromConfig = configuredPermdockKeys(context);
-		const fromSql = helperPolicies(context.sqlFiles ?? []);
-		const findings = project.problems.filter((problem) => problem.startsWith(project.catalogPath)).map((problem) => ({
-			severity: "info",
-			message: `Could not read PermDock's catalog: ${problem}`,
-			target: project.catalogPath
-		}));
-		const rowConditions = project.rowConditions;
-		if (!rowConditions) {
-			if (findings.length === 0 && (fromConfig.length > 0 || fromSql.length > 0)) findings.push({
-				severity: "info",
-				message: `Storage or Realtime policies call PermDock's helpers, but there is no ${project.catalogPath} to check their permissions against. Run \`permdock catalog\`, or set permdock.catalog in the config.`,
+const PERMDOCK_RULES = [
+	{
+		code: "BS214",
+		severity: "error",
+		title: "PermDock permission with row conditions in a Storage or Realtime policy",
+		description: "PermDock's SQL helpers (`permitted_<scope>_ids`, `permdock_has`) check role and scope, not row conditions. A bucket or topic policy that names a permission whose catalog entry has `rowConditions: true` grants every object or topic in the scope. Use PermDock's generated policies for those permissions. A key whose entry has no boolean `rowConditions` (an older `permdock catalog`) or that the catalog doesn't list is unknown and reported the same way, and so are all of them when the catalog is missing or unreadable. With the manifest, a helper schema other than `rls.schema`, a scope the manifest doesn't declare and a key checked at another scope than its catalog entry's are reported too.",
+		check: (context) => {
+			const project = context.permdock;
+			if (!project) return [];
+			const fromConfig = configuredPermdockKeys(context);
+			const fromSql = helperPolicies(context.sqlFiles ?? []);
+			const uses = fromConfig.length > 0 || fromSql.length > 0;
+			const findings = project.problems.filter((problem) => problem.startsWith(project.catalogPath)).map((problem) => ({
+				...uses ? {} : { severity: "info" },
+				message: `Could not read PermDock's catalog: ${problem}`,
 				target: project.catalogPath
-			});
+			}));
+			const catalog = project.catalog;
+			if (!catalog) {
+				if (findings.length === 0 && uses) findings.push({
+					message: `Storage or Realtime policies call PermDock's helpers, but there is no ${project.catalogPath}, so whether their permissions have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`,
+					target: project.catalogPath
+				});
+				return findings;
+			}
+			for (const { bucket, keys, scope, schema } of fromConfig) for (const key of keys) {
+				for (const message of placementProblems(project, catalog, {
+					key,
+					scope,
+					schema
+				}, `buckets.${bucket} ("${key}")`)) findings.push({
+					message,
+					target: `buckets.${bucket}:${key}`
+				});
+				const problem = unsafeKey(catalog, key, project.catalogPath);
+				if (!problem) continue;
+				findings.push({
+					message: `buckets.${bucket} uses PermDock permission "${key}", which ${problem.reason}. The bucket policy could grant every object in the scope. ${problem.fix}`,
+					target: `buckets.${bucket}:${key}`
+				});
+			}
+			for (const policy of fromSql) {
+				const seen = /* @__PURE__ */ new Set();
+				for (const call of policy.calls) for (const message of placementProblems(project, catalog, call, `Policy "${policy.name}" on ${policy.table}`)) {
+					if (seen.has(message)) continue;
+					seen.add(message);
+					findings.push({
+						message,
+						target: `${policy.table}.${policy.name}:${call.key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+				for (const key of policy.keys) {
+					const problem = unsafeKey(catalog, key, project.catalogPath);
+					if (!problem) continue;
+					findings.push({
+						message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to PermDock's helpers, but it ${problem.reason}. ${problem.fix}`,
+						target: `${policy.table}.${policy.name}:${key}`,
+						location: {
+							file: policy.file,
+							line: policy.line
+						}
+					});
+				}
+			}
 			return findings;
 		}
-		const fix = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
-		for (const { bucket, keys } of fromConfig) for (const key of keys.filter((candidate) => rowConditions.has(candidate))) findings.push({
-			message: `buckets.${bucket} uses PermDock permission "${key}", which has row conditions in ${project.catalogPath}. The bucket policy would grant every object in the scope. ${fix}`,
-			target: `buckets.${bucket}:${key}`
-		});
-		for (const policy of fromSql) for (const key of policy.keys.filter((candidate) => rowConditions.has(candidate))) findings.push({
-			message: `Policy "${policy.name}" on ${policy.table} passes "${key}" to PermDock's helpers, but it has row conditions in ${project.catalogPath}. ${fix}`,
-			target: `${policy.table}.${policy.name}:${key}`,
-			location: {
-				file: policy.file,
-				line: policy.line
-			}
-		});
-		return findings;
-	}
-}, {
-	code: "BS408",
-	severity: "warning",
-	title: "PermDock helpers the entitlements module calls are missing",
-	description: "With a PermDock manifest, the `entitlements` kit module reads memberships from PermDock's `member_<scope>_ids()` (in `has_entitlement`) and `member_<scope>_ids_for(uuid)` (in `feature_claims`). Doctor warns when `entitlements.permdock.scope` is not one of the manifest's scopes, when the manifest's `rls.helpers` lacks a helper (run `permdock rls generate` with a current PermDock), or when the snapshot lacks it (apply the migration it wrote).",
-	check: (context) => {
-		if (!context.config.sql.kit.includes("entitlements")) return [];
-		const mode = entitlementsMode(context.config, context.permdock);
-		if (mode.kind === "tenant") return [];
-		const manifest = context.config.permdock.manifest;
-		if (mode.kind === "invalid") return [{
-			message: mode.problem,
-			target: "entitlements.permdock"
-		}];
-		const listed = new Set((context.permdock?.manifest?.rls?.helpers ?? []).map((helper) => `${mode.permdock.schema}.${helper.name}`));
-		const read = context.snapshot.schemas.includes(mode.permdock.schema);
-		const present = new Set(catalogOf(context).functions.map((fn) => `${fn.schema}.${fn.name}`));
-		return entitlementHelpers(mode.permdock).flatMap((helper) => {
-			if (!listed.has(helper)) return [{
-				message: `${manifest} lists no ${helper}, which the entitlements module calls. Run \`permdock rls generate\` (PermDock writes member_<scope>_ids and member_<scope>_ids_for for every scope), then \`permdock supabase inspect --out\`.`,
-				target: helper
-			}];
-			if (read && !present.has(helper)) return [{
-				message: `${helper} is in ${manifest} but not in the database. Apply the migration \`permdock rls generate\` wrote before the entitlements module.`,
-				target: helper
+	},
+	{
+		code: "BS408",
+		severity: "warning",
+		title: "PermDock helpers the entitlements module calls are missing",
+		description: "With a PermDock manifest, the `entitlements` kit module reads memberships from PermDock's `member_<scope>_ids()` (in `has_entitlement`, as `authenticated`) and `member_<scope>_ids_for(uuid)` (in `feature_claims`, which PermDock's hook calls as `supabase_auth_admin`). Doctor warns when a PermDock project has no readable manifest or no `rls` block, when the scope is not one of the manifest's scopes or can't be chosen, when the scope's id type is missing or not `uuid`, `text`, `bigint` or `integer`, when the manifest has no `claims.features` claim filled by `better_supabase.feature_claims`, when no membership source covers the scope, when the manifest's `rls.helpers` lacks one of those helpers or doesn't grant it to that role (naming the `permdock.config.ts` setting that adds it), or when the snapshot lacks it (apply the migration `permdock rls generate` wrote).",
+		check: (context) => {
+			if (!context.config.sql.kit.includes("entitlements")) return [];
+			const mode = entitlementsMode(context.config, context.permdock);
+			if (mode.kind === "tenant") return [];
+			const manifest = context.config.permdock.manifest;
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "entitlements.permdock"
 			}];
-			return [];
-		});
+			const listed = new Map((context.permdock?.manifest?.rls?.helpers ?? []).map((helper) => [`${mode.permdock.schema}.${helper.name}`, helper]));
+			const read = context.snapshot.schemas.includes(mode.permdock.schema);
+			const present = new Set(catalogOf(context).functions.map((fn) => `${fn.schema}.${fn.name}`));
+			const regenerate = `then run \`permdock rls generate\`, \`permdock supabase hook generate\` and \`permdock supabase inspect --out\`.`;
+			const findings = [];
+			const project = context.permdock;
+			const features = context.config.claims.features;
+			const claims = project?.manifest?.claims ?? [];
+			const featureClaim = claims.find((claim) => claim.name === features);
+			if (featureClaim?.source !== "better_supabase.feature_claims") {
+				const registered = claims.find((claim) => claim.source === "better_supabase.feature_claims");
+				findings.push({
+					message: registered ? `${manifest} registers better_supabase.feature_claims as the "${registered.name}" claim, but claims.features is "${features}", so hasEntitlement() never finds the plan features. Set claims.features to "${registered.name}", or rename the claim in permdock.config.ts (supabase.hook.claims).` : featureClaim ? `${manifest} fills the "${features}" claim from ${featureClaim.source}, not better_supabase.feature_claims, so the claim doesn't carry the entitlements module's features. Point supabase.hook.claims.${features} in permdock.config.ts at 'better_supabase.feature_claims', ${regenerate}` : `${manifest} has no "${features}" claim, so PermDock's hook never writes the plan features hasEntitlement() reads. Add \`supabase.hook.claims: { ${features}: 'better_supabase.feature_claims' }\` to permdock.config.ts, ${regenerate}`,
+					target: `claims.${features}`
+				});
+			}
+			const scope = mode.permdock.scope;
+			if (!mode.permdock.memberships.some((source) => !("value" in source.scope) || source.scope.value === scope)) findings.push({
+				message: `No membership source in ${manifest} covers scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a source for "${scope}" (\`supabase.hook.memberships\` in permdock.config.ts), ${regenerate}`,
+				target: `entitlements.permdock.${scope}`
+			});
+			return findings.concat(entitlementRequirements(mode.permdock).flatMap((requirement) => {
+				const { helper, caller, role } = requirement;
+				const entry = listed.get(helper);
+				if (!entry) return [{
+					message: requirement.kind === "member" ? `${manifest} lists no ${helper}, but ${caller} calls it. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.` : `${manifest} lists no ${helper}, but ${caller} calls it. PermDock writes it only for a scope with a membership source: add one for "${mode.permdock.scope}" (\`supabase.hook.memberships\`, \`rls.membershipSources\` or a mapped \`rls.memberships\` table in permdock.config.ts), ${regenerate}`,
+					target: helper
+				}];
+				if (!entry.execute.includes(role)) {
+					const message = requirement.kind === "member" ? `${manifest} says ${role} may not execute ${helper}, but ${caller} calls it as ${role}. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.` : `${manifest} says ${role} may not execute ${helper}. feature_claims runs as its owner, so this only matters when something else calls it as ${role}; PermDock grants it when the hook has claims (\`supabase.hook.claims\` in permdock.config.ts), ${regenerate}`;
+					return [{
+						...requirement.kind === "member-for" ? { severity: "info" } : {},
+						message,
+						target: helper
+					}];
+				}
+				if (read && !present.has(helper)) return [{
+					message: `${helper} is in ${manifest} but not in the database. Apply the migration \`permdock rls generate\` wrote before the entitlements module.`,
+					target: helper
+				}];
+				return [];
+			}));
+		}
+	},
+	{
+		code: "BS409",
+		severity: "warning",
+		title: "PermDock's manifest and the better-supabase config disagree",
+		description: "PermDock's hook and helpers read the active tenant from the manifest's `rls.tenantClaim`, and its generated files start with a `-- permdock:hook v1` or `-- permdock:grants v1` marker. Doctor warns when `claims.tenant` names another claim (the tenant plugin, guards and RLS would read a claim PermDock never writes), reports an error for a marker version this release can't read, and notes when `claims.scope` resolves to another scope than the manifest's root scope.",
+		check: (context) => {
+			const project = context.permdock;
+			if (!project) return [];
+			const findings = [];
+			const manifest = project.manifest;
+			const tenantClaim = manifest?.rls?.tenantClaim ?? manifest?.tenantClaim;
+			if (tenantClaim !== void 0 && tenantClaim !== context.config.claims.tenant) findings.push({
+				message: `${project.manifestPath} says PermDock writes the active tenant to "${tenantClaim}", but claims.tenant is "${context.config.claims.tenant}". Set claims.tenant to "${tenantClaim}", or change rls.tenantClaim in permdock.config.ts.`,
+				target: "claims.tenant"
+			});
+			for (const file of context.sqlFiles ?? []) {
+				const markers = [["hook", parseHookMarker(file.text)?.version], ["grants", parseGrantsMarker(file.text)?.version]];
+				for (const [kind, version] of markers) {
+					if (version === void 0 || version === 1) continue;
+					findings.push({
+						severity: "error",
+						message: `${file.path} has a \`-- permdock:${kind} v${String(version)}\` marker, but this release reads only v1, so doctor can't trust what it says about PermDock's ${kind === "hook" ? "hook" : "grants"}. Upgrade better-supabase, or regenerate the file with the PermDock version that matches it.`,
+						target: file.path,
+						location: {
+							file: file.path,
+							line: 1
+						}
+					});
+				}
+			}
+			const root = manifest?.rls?.scopes.find((scope) => scope.within === void 0)?.name;
+			const scope = context.config.claims.scope;
+			const resolved = resolveManifestScope(manifest, scope);
+			if (root !== void 0 && resolved !== root) findings.push({
+				severity: "info",
+				message: `claims.scope is "${scope}", which ${resolved ? `stands for "${resolved}"` : "is not a scope"} in ${project.manifestPath}, whose root scope is "${root}". The tenant module's membership claims then use another scope than PermDock's. Set claims.scope to "${root}" (or "tenant").`,
+				target: "claims.scope"
+			});
+			return findings;
+		}
 	}
-}];
+];
 //#endregion
 //#region src/cli/gen/shared.ts
 const q = (value) => JSON.stringify(value);
@@ -792,6 +969,7 @@ function pruneTypes(metadata, schemas) {
 }
 //#endregion
 //#region src/cli/gen/model.ts
+const SOFT_DELETE_UDTS = /* @__PURE__ */ new Set(["timestamptz", "timestamp"]);
 const applyCasing = (name, casing) => casing === "camel" ? toCamel(name) : name;
 function tableKey(table, casing, schemas) {
 	const base = applyCasing(table.name, casing);
@@ -973,8 +1151,13 @@ function buildModel(snapshot, config) {
 		const has = (db) => columns.find((col) => col.db === db)?.app;
 		const flags = {};
 		if (flagsConfig.softDelete) {
-			const column = has(flagsConfig.softDelete.column);
-			if (column) flags.softDelete = column;
+			const db = flagsConfig.softDelete.column;
+			const column = columns.find((col) => col.db === db);
+			if (column) {
+				const udt = column.snapshot.udt;
+				if (column.snapshot.isArray || !SOFT_DELETE_UDTS.has(udt)) throw new TypeError(`plugins.softDelete.column: ${table.schema}.${table.name}.${db} is ${udt}, but softDelete() writes a timestamp. Use timestamptz or timestamp.`);
+				flags.softDelete = column.app;
+			}
 		}
 		if (flagsConfig.timestamps) {
 			const createdAt = has(flagsConfig.timestamps.createdAt);
@@ -991,9 +1174,11 @@ function buildModel(snapshot, config) {
 		if (flagsConfig.actor) {
 			const createdBy = has(flagsConfig.actor.createdBy);
 			const updatedBy = has(flagsConfig.actor.updatedBy);
-			if (createdBy || updatedBy) flags.actor = {
+			const impersonatedBy = has(flagsConfig.actor.impersonatedBy);
+			if (createdBy || updatedBy || impersonatedBy) flags.actor = {
 				...createdBy ? { createdBy } : {},
-				...updatedBy ? { updatedBy } : {}
+				...updatedBy ? { updatedBy } : {},
+				...impersonatedBy ? { impersonatedBy } : {}
 			};
 		}
 		const key = keyOf.get(id) ?? table.name;
@@ -1815,22 +2000,33 @@ async function readSetFile(config) {
 	const readSets = await compiledReadSets(config);
 	return renderKit(["read-sets"], kitLayout(config, config.sql.testsDir, readSets))[0];
 }
-/** `buckets` keys that PermDock's catalog marks with row conditions, as error lines. */
+/**
+* `buckets` keys the catalog doesn't mark `rowConditions: false`, as error
+* lines. Without a readable catalog every PermDock bucket is refused, since
+* whether its keys have row conditions is unknown.
+*/
 async function rowConditionedBuckets(config) {
 	const configured = configuredPermdockKeys({ config });
 	if (configured.length === 0) return [];
 	const project = await readPermdock(config.root, config.permdock);
-	const rowConditions = project?.rowConditions;
-	if (!rowConditions) return [];
-	return configured.flatMap(({ bucket, keys }) => keys.filter((key) => rowConditions.has(key)).map((key) => `  buckets.${bucket}: "${key}" has row conditions in ${project.catalogPath}`));
+	const catalog = project?.catalog;
+	if (!catalog) {
+		const path = project?.catalogPath ?? config.permdock.catalog;
+		const problem = project?.problems.find((entry) => entry.startsWith(path));
+		return [`  ${configured.map(({ bucket }) => `buckets.${bucket}`).join(", ")}: ${problem ? `could not read PermDock's catalog (${problem})` : `there is no ${path}`}, so whether the keys have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`];
+	}
+	return configured.flatMap(({ bucket, keys }) => keys.flatMap((key) => {
+		const problem = unsafeKey(catalog, key, project.catalogPath);
+		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
+	}));
 }
-const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt";
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install the version @supabase/postgrest-typegen pins: pnpm add -D oxfmt@0.66.0. To use a newer oxfmt, allow it in pnpm-workspace.yaml under peerDependencyRules.allowedVersions, keyed \"@supabase/postgrest-typegen>oxfmt\".";
 async function runGen(options) {
 	const { config } = options;
 	const refused = await rowConditionedBuckets(config);
 	if (refused.length > 0) return {
 		code: 1,
-		error: `PermDock's SQL helpers don't check row conditions, so these bucket policies would grant every object in the scope:\n${refused.join("\n")}\nUse the policies \`permdock rls generate\` writes for them (doctor BS214).`
+		error: `PermDock's SQL helpers don't check row conditions, so these bucket policies could grant every object in the scope:\n${refused.join("\n")}\nSee doctor BS214.`
 	};
 	const snapshot = options.snapshot ?? await loadSnapshot(config, options.env, options);
 	const files = await renderFiles(config, snapshot);
@@ -2005,4 +2201,4 @@ const genCommand = defineCliCommand({
 	}
 });
 //#endregion
-export { catalogOf as C, qualified as D, policyObject as E, tableObject as O, entitlementsKit as S, lineOf as T, restrictSchemas as _, sourceArgs as a, emitModule as b, openSource as c, snapshotFile as d, introspect as f, buildModel as g, CACHE_DIR as h, runGen as i, toCatalog as k, parseSnapshot as l, pgSource as m, genCommand as n, loadSnapshot as o, managementSource as p, renderFiles as r, managementTarget as s, SOURCE_ARGS as t, serializeSnapshot as u, serializeGenerator as v, exposed as w, PERMDOCK_RULES as x, GENERATED_HEADER as y };
+export { toCatalog as A, catalogOf as C, policyObject as D, lineOf as E, qualified as O, entitlementsKit as S, exposedSchemas as T, restrictSchemas as _, sourceArgs as a, emitModule as b, openSource as c, snapshotFile as d, introspect as f, buildModel as g, CACHE_DIR as h, runGen as i, tableObject as k, parseSnapshot as l, pgSource as m, genCommand as n, loadSnapshot as o, managementSource as p, renderFiles as r, managementTarget as s, SOURCE_ARGS as t, serializeSnapshot as u, serializeGenerator as v, exposed as w, PERMDOCK_RULES as x, GENERATED_HEADER as y };

package/dist/cli/index.d.ts

@@ -488,6 +488,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.4.0";
+export declare const VERSION = "0.5.0";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, CliArgs, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliProblem, CliProblemExtensions, Command, CommandContext, CommandResult, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, ParsedArgs, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-4v4DTtda.js";
-import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-CP20LKk_.js";
-import { t as VERSION } from "./version-5mW_8sY1.js";
-import { a as loadConfig } from "./config-D9R0o1LH.js";
-import { b as emitModule, f as introspect, g as buildModel, i as runGen, k as toCatalog, l as parseSnapshot, m as pgSource, o as loadSnapshot, p as managementSource, r as renderFiles, u as serializeSnapshot, y as GENERATED_HEADER } from "./gen-Ccn_p90L.js";
+import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-BKR2W_79.js";
+import { t as VERSION } from "./version-BDJuO0UR.js";
+import { a as loadConfig } from "./config-CPVpXP5I.js";
+import { A as toCatalog, b as emitModule, f as introspect, g as buildModel, i as runGen, l as parseSnapshot, m as pgSource, o as loadSnapshot, p as managementSource, r as renderFiles, u as serializeSnapshot, y as GENERATED_HEADER } from "./gen-C2osRcr5.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-ClnxRYBF.js → init-Saf5-R9T.js}

@@ -1,7 +1,7 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { t as VERSION } from "./version-5mW_8sY1.js";
-import { n as findConfig } from "./config-D9R0o1LH.js";
+import { t as VERSION } from "./version-BDJuO0UR.js";
+import { n as findConfig } from "./config-CPVpXP5I.js";
 import { n as installCommand, t as detectProject } from "./project-B_GeXyHh.js";
 import { posix, resolve } from "node:path";
 import { existsSync } from "node:fs";

package/dist/cli/{introspect-DxqfkVIv.js → introspect--H7oGmcd.js}

@@ -1,8 +1,8 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { l as fileDiff } from "./read-sets-CMa29t9a.js";
-import { _ as restrictSchemas, a as sourceArgs, o as loadSnapshot, t as SOURCE_ARGS, u as serializeSnapshot, v as serializeGenerator } from "./gen-Ccn_p90L.js";
+import { t as fileDiff } from "./diff-SjkO5rNr.js";
+import { _ as restrictSchemas, a as sourceArgs, o as loadSnapshot, t as SOURCE_ARGS, u as serializeSnapshot, v as serializeGenerator } from "./gen-C2osRcr5.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";

package/dist/cli/{openapi-8WHjxiTJ.js → openapi-Cp5Fyta-.js}

@@ -1,6 +1,6 @@
 import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { r as importExport } from "./config-D9R0o1LH.js";
+import { r as importExport } from "./config-CPVpXP5I.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";