better-supabase 0.5.0 → 0.5.1

package/README.md

@@ -1,12 +1,64 @@
 # better-supabase
 
-**A typed data layer, auth glue and CLI for Supabase apps, APIs, MCP servers and jobs.**
+**Typed repositories, auth glue and a CLI for Supabase apps, APIs, MCP servers and jobs.**
 
 [![npm](https://img.shields.io/npm/v/better-supabase)](https://www.npmjs.com/package/better-supabase)
 [![license](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE)
 ![TypeScript](https://img.shields.io/badge/TypeScript-6%20%7C%207-3178c6.svg)
 
-`better-supabase gen` extends `supabase gen types` with relation cardinality, unique keys, CHECK unions and typed jsonb. The generated `schema` gives every table a typed repository that compiles to one PostgREST request, returns a `Result` instead of throwing, and runs as the caller so RLS always applies.
+[Docs](https://bettersupabase.com/docs) · [Quickstart](https://bettersupabase.com/docs/getting-started) · [Examples](https://bettersupabase.com/docs/examples) · [Changelog](https://bettersupabase.com/changelog) · [GitHub](https://github.com/ScaleDockHQ/better-supabase)
+
+better-supabase sits on top of the supabase-js client you already use. You keep your database, your RLS policies, Supabase Auth and Storage. The CLI reads your schema and generates a typed repository for every table, so a query is a typed object instead of a string, a typo in a column name is a compile error, and the row type follows what you selected.
+
+It also writes the glue every Supabase app repeats: the session cookie and token refresh for Next.js, Hono, oRPC, Edge Functions and MCP servers, pagination, soft delete, timestamps, cache invalidation, background jobs and typed Storage and Realtime. It is built on [`@supabase/supabase-js`](https://github.com/supabase/supabase-js), [`@supabase/server`](https://github.com/supabase/server), [`@supabase/middleware`](https://github.com/supabase/middleware) and [`@supabase/ssr`](https://github.com/supabase/ssr). It is an independent open-source project, not made by Supabase.
+
+## Before and after
+
+With supabase-js, the query is a string and the error is a Postgres code:
+
+```ts
+const { data, error } = await supabase
+  .from("customers")
+  .select("id, name, organization(name), notes!inner(kind)")
+  .eq("status", "active")
+  .eq("notes.kind", "call")
+  .order("name")
+  .limit(20);
+if (error) throw error;
+
+const { error: insertError } = await supabase.from("tags").insert({ name });
+if (insertError?.code === "23505") return { message: "Tag already exists" };
+```
+
+With better-supabase, every column, relation and operator is typed, and errors are values with a `kind`:
+
+```ts
+const customers = await db.customers.findMany({
+  select: ["id", "name"],
+  where: { status: "active", notes: { some: { kind: "call" } } },
+  include: { organization: { select: ["name"] } },
+  orderBy: { name: "asc" },
+  limit: 20,
+});
+// customers.data: { id: string; name: string; organization: { name: string } }[]
+
+const tag = await db.tags.create({ organizationId, name });
+if (tag.error?.kind === "conflict") return { message: "Tag already exists" };
+```
+
+Each call is still one PostgREST request, and it runs as the signed-in user, so your RLS policies decide what it can read and write. The [supabase-js migration guide](https://bettersupabase.com/docs/migration/supabase-js) maps every supabase-js call to its repository equivalent, and the two work side by side while you move over.
+
+## What you get
+
+- **Stronger generated types.** [`better-supabase gen`](https://bettersupabase.com/docs/cli/gen) writes the same `database.types.ts` as `supabase gen types` and adds relationship cardinality, unique keys, CHECK-constraint unions, typed jsonb and camelCase column maps.
+- **A typed repository per table.** [`findMany`, `findUnique`, `create`, `upsert`, `paginate`, counts and aggregates](https://bettersupabase.com/docs/repository), with nested relation filters and includes, compiled to PostgREST or to SQL on a direct Postgres connection.
+- **Results instead of exceptions.** Every call returns a [`Result` with a plain, serializable `DbError`](https://bettersupabase.com/docs/concepts/results) that you can return from server actions and RPC handlers. `.orThrow()` is opt-in, and adapters turn errors into RFC 9457 Problem Details with the right status.
+- **Your casing.** Keep database names with `casing: 'snake'`, or get [camelCase rows](https://bettersupabase.com/docs/concepts/casing) renamed inside the PostgREST query.
+- **Auth without extra round trips.** Valid access tokens are [verified locally](https://bettersupabase.com/docs/auth) against the JWKS and never reach the Auth server. Refresh happens once, in the proxy. The service role is an explicit `bs.admin()` call.
+- **Cache tags that follow writes.** Mutations [invalidate the tables they change](https://bettersupabase.com/docs/concepts/caching), with read-your-writes in Next.js server actions and table-based invalidation in TanStack Query.
+- **Plugins.** [Timestamps, soft delete, tenant scoping, actor columns, validation and rules](https://bettersupabase.com/docs/plugins), each versioned and opt-in.
+- **Kits for the SQL every app repeats.** [Jobs on Supabase Queues](https://bettersupabase.com/docs/kits/jobs), webhook inboxes, idempotency keys, organizations and invitations, notifications, list pages, typed Storage paths and Realtime topics, vector search and Stripe entitlements. [`better-supabase sql add`](https://bettersupabase.com/docs/kits/sql) writes the tables, functions and policies into your declarative schema.
+- **Tests and CI checks.** [`asUser`](https://bettersupabase.com/docs/testing) runs RLS tests as any user against the local stack, `gen --check` fails on schema drift, and [`doctor`](https://bettersupabase.com/docs/cli/doctor) reports security and performance findings, with SARIF output for code scanning.
 
 ## Install
 
@@ -15,18 +67,21 @@ pnpm add better-supabase @supabase/supabase-js
 pnpm add -D pg
 ```
 
-ESM only. The package includes the `better-supabase` CLI, which needs Node 24 or later; the runtime entries run on every WinterTC runtime (Node, Deno, Bun, Workers, Supabase Edge Functions). TypeScript 6 and 7 are tested.
+Before installing, `npx better-supabase init` detects your frameworks and prints the install command for your package manager. The package is ESM only. The CLI needs Node 24 or later, and the runtime entries run on every WinterTC runtime. On runtimes without a native `Temporal` (Node 24, Safari), load [`temporal-polyfill`](https://bettersupabase.com/docs/concepts/temporal) once at startup. TypeScript 6 and 7 are tested.
 
 ## Quick start
 
-Or start with `npx better-supabase init`, which detects your frameworks and prints the install command.
+Generate the typed schema from your local stack:
 
 ```bash
 supabase start
 pnpm better-supabase init   # config, src/lib/supabase/index.ts and framework glue
+pnpm better-supabase env    # URL and keys into .env.local
 pnpm better-supabase gen    # database.types.ts and generated.ts
 ```
 
+Define the client once, then connect it per request with the current user's Supabase client:
+
 ```ts
 import { createClient } from "@supabase/supabase-js";
 import { defineSupabase } from "better-supabase";
@@ -37,16 +92,78 @@ export const betterSupabase = defineSupabase(schema);
 
 const db = betterSupabase.connect(createClient(url, publishableKey));
 
-const result = await db.customers.findMany({
-  select: ["id", "name"],
-  where: { status: "active", notes: { some: { kind: "call" } } },
-  include: { organization: { select: ["name"] } },
-  orderBy: { name: "asc" },
-  limit: 20,
-});
-if (!result.ok) return result; // DbError: kind, message, status, code
+const customers = await db.customers
+  .findMany({ select: ["id", "name"], where: { status: "active" } })
+  .orThrow();
+```
+
+`defineSupabase` holds no secrets and no connection. Because you connect with the client for the current user, every query runs under their RLS policies.
+
+## Use it where you run
+
+An adapter verifies the session, refreshes it where it should and gives each handler a `db` for the caller. In Next.js:
+
+```tsx
+// src/lib/supabase/server.ts
+export const bs = createNext(betterSupabase);
+
+// src/proxy.ts
+export const proxy = (request: NextRequest) => bs.proxy(request);
+
+// app/customers/page.tsx
+export default async function Customers() {
+  const { db } = await bs.context();
+  const customers = await db.customers
+    .findMany({ select: ["id", "name"] })
+    .orThrow();
+  return <CustomerList customers={customers} />;
+}
 ```
 
+| Where you run                      | What the adapter gives you                                              | Docs                                                       |
+| ---------------------------------- | ----------------------------------------------------------------------- | ---------------------------------------------------------- |
+| Next.js                            | Proxy, Server Components, route handlers, server actions and cache tags | [Next.js](https://bettersupabase.com/docs/frameworks/next) |
+| Hono                               | Middleware, Result-aware handlers and REST resources that match OpenAPI | [Hono](https://bettersupabase.com/docs/frameworks/hono)    |
+| oRPC                               | A middleware that adds the caller's repositories to the oRPC context    | [oRPC](https://bettersupabase.com/docs/frameworks/orpc)    |
+| Edge Functions, Deno, Bun, Workers | Fetch handlers with the caller's repositories                           | [Edge](https://bettersupabase.com/docs/frameworks/edge)    |
+| MCP servers                        | Tools from your tables and your own code, running as the signed-in user | [MCP](https://bettersupabase.com/docs/frameworks/mcp)      |
+| React and TanStack Query           | A browser client, typed hooks, query and mutation options, live queries | [Frontend](https://bettersupabase.com/docs/frontend/query) |
+
+## The CLI
+
+The `better-supabase` command ships in this package:
+
+```bash
+pnpm better-supabase init                   # config, client and framework glue
+pnpm better-supabase env                    # local URL and keys into .env.local
+pnpm better-supabase gen                    # database.types.ts and generated.ts
+pnpm better-supabase gen --check            # exit 1 in CI when the schema drifted
+pnpm better-supabase doctor                 # RLS, grants, indexes and Supabase advisors
+pnpm better-supabase doctor --format sarif  # the same findings for GitHub code scanning
+pnpm better-supabase sql add jobs           # a SQL kit module into supabase/schemas
+pnpm better-supabase skills install         # Agent Skills for your coding agent
+```
+
+See the [CLI reference](https://bettersupabase.com/docs/cli) for every command and flag.
+
+## Works with
+
+| Area       | Supported                                                                 |
+| ---------- | ------------------------------------------------------------------------- |
+| Frameworks | Next.js 16, Hono, oRPC, Supabase Edge Functions, MCP servers              |
+| Runtimes   | Node.js, Deno, Bun, Cloudflare Workers, Vercel Functions, Supabase Edge   |
+| Frontend   | React 19, TanStack Query 5, live queries over Realtime                    |
+| Validation | Zod, Valibot and any Standard Schema                                      |
+| Standards  | OpenAPI 3.1, RFC 9457, OpenTelemetry, CloudEvents, Standard Webhooks, MCP |
+| Testing    | Vitest, pgTAP, the Supabase local stack                                   |
+
+## Good to know
+
+- **It does not replace supabase-js.** Auth flows, Storage and Realtime stay on the supabase-js client, which is one property away as `db.$client`.
+- **It does not replace RLS.** Queries run as the caller and your policies decide. Bypassing them takes an explicit `bs.admin()`.
+- **A direct Postgres connection is optional.** Queries go through PostgREST by default. [`better-supabase/postgres`](https://bettersupabase.com/docs/auth/postgres) runs the same repository API over SQL for jobs, scripts and transactions.
+- **PostgREST's limits still apply.** There are no transactions across requests, and a few filters only work on reads. The [limitations page](https://bettersupabase.com/docs/guides/limitations) lists each one and what to use instead.
+
 ## Subpaths
 
 | Import                                                     | What it gives you                                                        |
@@ -77,7 +194,7 @@ if (!result.ok) return result; // DbError: kind, message, status, code
 
 ## For AI agents
 
-The package ships [Agent Skills](https://agentskills.io) in `skills/`:
+The package ships [Agent Skills](https://agentskills.io) for queries, APIs, auth and tests:
 
 ```bash
 npx skills add ScaleDockHQ/better-supabase
@@ -85,12 +202,12 @@ npx skills add ScaleDockHQ/better-supabase
 pnpm better-supabase skills install
 ```
 
-The docs are also available as [`/llms.txt`](https://bettersupabase.com/llms.txt), as Markdown at `/docs/<page>.md`, and through the docs MCP server at `https://bettersupabase.com/mcp`.
+The docs are also available as [`/llms.txt`](https://bettersupabase.com/llms.txt), as Markdown at `/docs/<page>.md`, and through the read-only docs MCP server at `https://bettersupabase.com/mcp`.
 
 ## Documentation
 
-[bettersupabase.com/docs](https://bettersupabase.com/docs)
+The full documentation is at [bettersupabase.com/docs](https://bettersupabase.com/docs), and a runnable app for every adapter is in [`apps/examples`](https://github.com/ScaleDockHQ/better-supabase/tree/main/apps/examples).
 
 ## License
 
-[MIT](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE)
+[MIT](https://github.com/ScaleDockHQ/better-supabase/blob/main/LICENSE) © 2026 ScaleDock

package/dist/actor-DaJjqD5R.d.ts

@@ -0,0 +1,43 @@
+//#region src/auth/actor.d.ts
+/** One level of an RFC 8693 `act` chain: who acts, and who acted before it. */
+interface ActClaim {
+  readonly sub: string;
+  readonly act?: ActClaim;
+  readonly [claim: string]: unknown;
+}
+/**
+ * Who acts for the user, from the outermost level of the RFC 8693 `act`
+ * claim, by its `kind`:
+ *
+ * - `oauth-client`: an `act` without `kind` (prior actors stay on `chain`),
+ *   else the OAuth `client_id` of a Supabase OAuth server token. Only this
+ *   kind is limited to the scopes the user delegated.
+ * - `support`: an admin in a support session (`act.kind: "support"`, from
+ *   `supportClaims`). An `act` without `kind` but with `session_id`, as
+ *   0.5.0 minted it, counts as one until 0.6.
+ * - `impersonation`: an admin acting as the user (`act.kind:
+ *   "impersonation"`, from `actClaim`).
+ */
+type SessionActor = {
+  readonly kind: "oauth-client";
+  readonly id: string;
+  readonly chain?: ActClaim;
+} | {
+  readonly kind: "support";
+  readonly id: string;
+  readonly sessionId: string;
+  /** `act.read_only`; a support token without it is read-only. */
+  readonly readOnly: boolean;
+  readonly reason?: string;
+} | {
+  readonly kind: "impersonation";
+  readonly id: string;
+  readonly reason?: string;
+};
+/** What the user delegated to the actor: the token's OAuth `scope`. */
+interface SessionDelegation {
+  readonly scopes: readonly string[];
+  readonly chain?: ActClaim;
+}
+//#endregion
+export { SessionActor as n, SessionDelegation as r, ActClaim as t };

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as run } from "./run-BKR2W_79.js";
+import { i as run } from "./run-Bo_NLT5n.js";
 import { t as colorEnabled } from "./style-C0NFdJRL.js";
 import { text } from "node:stream/consumers";
 //#region src/cli/bin.ts

package/dist/cli/{doctor-L7Z8mYTx.js → doctor-C_A-KEAz.js}

@@ -2,11 +2,11 @@ import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { r as writeIfChanged } from "./io-k41_z-jT.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { t as VERSION } from "./version-BCtlgDQx.js";
 import { c as diffEngine, d as pgFunctionHooks, f as readSupabaseToml, l as httpHooks, m as tomlGet, p as schemaPaths, s as stdinDatabaseUrl, u as migrationCommand } from "./config-CPVpXP5I.js";
-import { a as parseHookMarker, i as parseGrantsMarker, o as permdockSource, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
+import { c as parseHookMarker, l as permdockSource, s as parseGrantsMarker, t as compiledReadSets, u as readPermdock } from "./read-sets-VQcPgxU9.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { C as catalogOf, D as policyObject, E as lineOf, O as qualified, S as entitlementsKit, T as exposedSchemas, c as openSource, d as snapshotFile, h as CACHE_DIR, k as tableObject, o as loadSnapshot, r as renderFiles, s as managementTarget, w as exposed, x as PERMDOCK_RULES } from "./gen-C2osRcr5.js";
+import { A as tableObject, C as entitlementsKit, D as lineOf, E as exposedSchemas, O as policyObject, S as accessKit, T as exposed, c as openSource, d as snapshotFile, h as CACHE_DIR, k as qualified, o as loadSnapshot, r as renderFiles, s as managementTarget, w as catalogOf, x as PERMDOCK_RULES } from "./gen-CjElD1Vw.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
 import { dirname, resolve } from "node:path";
@@ -1830,9 +1830,11 @@ const isTrue = (expression) => expression !== null && /^\(*\s*true\s*\)*$/i.test
 /** The `sql.kit` files as this release renders them, next to what is on disk. */
 async function kitFiles(context) {
 	if (context.config.sql.kit.length === 0) return [];
+	const access = accessKit(context);
+	if (access.kind === "invalid") return [];
 	const readSets = context.readSets;
 	const skipped = readSets !== void 0 && "skipped" in readSets;
-	const files = renderKit(context.config.sql.kit, kitLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsKit(context))).filter((file) => !(skipped && file.module === "read-sets"));
+	const files = renderKit(context.config.sql.kit, kitLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsKit(context), access.kind === "permdock" ? access.access : void 0)).filter((file) => !(skipped && file.module === "read-sets"));
 	return Promise.all(files.map(async (file) => {
 		const current = await readFile(resolve(context.config.root, file.path), "utf8").catch(() => void 0);
 		const version = kitFileVersion(file.contents)?.version ?? 1;

package/dist/cli/gen-CIdSQZad.js

@@ -0,0 +1,2 @@
+import { n as genCommand } from "./gen-CjElD1Vw.js";
+export { genCommand };

package/dist/cli/{gen-C2osRcr5.js → gen-CjElD1Vw.js}

@@ -2,10 +2,10 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
 import { n as importPath, r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
 import { r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { t as VERSION } from "./version-BCtlgDQx.js";
 import { d as pgFunctionHooks, f as readSupabaseToml, m as tomlGet, s as stdinDatabaseUrl, t as databaseUrl } from "./config-CPVpXP5I.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { a as parseHookMarker, i as parseGrantsMarker, n as entitlementRequirements, r as entitlementsMode, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
+import { a as entitlementsMode, c as parseHookMarker, d as scopeMemberships, f as unsafeKey, i as entitlementRequirements, n as accessPermdockMode, o as kitKeyProblems, r as accessRequirements, s as parseGrantsMarker, t as compiledReadSets, u as readPermdock } from "./read-sets-VQcPgxU9.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
@@ -13,7 +13,7 @@ import { basename, dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { setTimeout } from "node:timers/promises";
-import { PERMDOCK_SCHEMA, kitLayout, permdockKeyStatus, permdockKeys, renderKit, sameKitFile } from "better-supabase/sql";
+import { PERMDOCK_SCHEMA, kitLayout, kitPermissionKeys, permdockKeys, renderKit, resolveModules, sameKitFile } from "better-supabase/sql";
 import { DEFAULT_CLAIMS, tenantClaimPaths } from "better-supabase/config";
 import { toCamel, toSnake } from "better-supabase";
 import { generateTypescript, pgTypeToTsType, sortGeneratorMetadata } from "@supabase/postgrest-typegen/generation";
@@ -318,37 +318,16 @@ function placementProblems(project, catalog, call, where) {
 	if (resolved !== call.scope) problems.push(`${where} checks "${call.key}" at scope "${call.scope}", but ${project.catalogPath} declares it at "${resolved}", so PermDock's helpers never grant it there. Use scope "${resolved}".`);
 	return problems;
 }
-const ROW_CONDITIONS_FIX = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
-const REGENERATE_FIX = "Regenerate it with a current `permdock catalog`, which writes rowConditions for every permission.";
-/**
-* Why the SQL helpers can't be trusted with `key`, or `undefined` when the
-* catalog marks it `rowConditions: false`. An entry without the flag and a
-* key the catalog doesn't list are unknown, so they count as unsafe.
-*/
-function unsafeKey(catalog, key, catalogPath) {
-	const status = permdockKeyStatus(catalog, key);
-	switch (status) {
-		case "scope-only": return;
-		case "row-conditions": return {
-			reason: `has row conditions in ${catalogPath}`,
-			fix: ROW_CONDITIONS_FIX
-		};
-		case "no-flag": return {
-			reason: `has no rowConditions flag in ${catalogPath}, so whether it has row conditions is unknown`,
-			fix: REGENERATE_FIX
-		};
-		case "missing": return {
-			reason: `is not in ${catalogPath}`,
-			fix: REGENERATE_FIX
-		};
-		default: return status;
-	}
-}
 /** PermDock's helpers for the `entitlements` kit module, when the manifest allows PermDock mode. */
 function entitlementsKit(context) {
 	const mode = entitlementsMode(context.config, context.permdock);
 	return mode.kind === "permdock" ? mode.permdock : void 0;
 }
+/** PermDock's helpers for the `permdock` access model, when `sql.kit` installs `access`. */
+function accessKit(context) {
+	if (!resolveModules(context.config.sql.kit, {}).some((module) => module.name === "access")) return { kind: "off" };
+	return accessPermdockMode(context.config, context.permdock);
+}
 const PERMDOCK_RULES = [
 	{
 		code: "BS214",
@@ -451,8 +430,17 @@ const PERMDOCK_RULES = [
 				});
 			}
 			const scope = mode.permdock.scope;
-			if (!mode.permdock.memberships.some((source) => !("value" in source.scope) || source.scope.value === scope)) findings.push({
-				message: `No membership source in ${manifest} covers scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a source for "${scope}" (\`supabase.hook.memberships\` in permdock.config.ts), ${regenerate}`,
+			const memberships = project?.manifest ? scopeMemberships(project.manifest, scope) : {
+				sources: [],
+				from: "hook"
+			};
+			if (memberships.from === "hook") findings.push({
+				severity: "info",
+				message: `${manifest} has no rls.memberships, so entitlement_members() reads the hook's membership sources, which can differ from the tables member_${scope}_ids_for reads. Run \`permdock supabase inspect --out\` with a current PermDock.`,
+				target: `entitlements.permdock.${scope}`
+			});
+			if (memberships.sources.length === 0) findings.push({
+				message: memberships.from === "rls" ? `${manifest} maps no rls.memberships table to scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Map a table for "${scope}" (\`rls.memberships\` or \`rls.membershipSources\` in permdock.config.ts), ${regenerate}` : `No membership source in ${manifest} covers scope "${scope}", so entitlement_members() finds no users and plan changes never invalidate sessions. Add a source for "${scope}" (\`supabase.hook.memberships\` in permdock.config.ts), ${regenerate}`,
 				target: `entitlements.permdock.${scope}`
 			});
 			return findings.concat(entitlementRequirements(mode.permdock).flatMap((requirement) => {
@@ -518,6 +506,55 @@ const PERMDOCK_RULES = [
 			});
 			return findings;
 		}
+	},
+	{
+		code: "BS411",
+		severity: "error",
+		title: "The permdock access model doesn't match PermDock's manifest",
+		description: "With `kits.access.model: 'permdock'`, the `access` module calls PermDock's `<rls.schema>.permitted_<scope>_ids(permission)` for tenant checks and `<rls.schema>.permdock_has(permission)` for platform checks, with the manifest's root scope unless `kits.access.permdock.scope` names another. Doctor reports a project without a readable manifest or `rls` block, no single root scope, a scope, schema or id type the manifest doesn't declare, a helper the manifest doesn't list, doesn't let `authenticated` execute or the database lacks, and every kit permission key (from `kitPermissionKeys`) whose catalog entry isn't `rowConditions: false`, since the helpers check role and scope only. It warns when `kits.access.functions.canAssign` is not set, because only the service role then assigns roles, and notes a `permdock_can_assign` template the manifest's helpers lack.",
+		check: (context) => {
+			const mode = accessKit(context);
+			if (mode.kind === "off") return [];
+			if (mode.kind === "invalid") return [{
+				message: mode.problem,
+				target: "kits.access.permdock"
+			}];
+			const project = context.permdock;
+			const manifest = context.config.permdock.manifest;
+			const findings = [];
+			const listed = new Map((project?.manifest?.rls?.helpers ?? []).map((helper) => [`${mode.access.schema}.${helper.name}`, helper]));
+			const read = context.snapshot.schemas.includes(mode.access.schema);
+			const present = new Set(catalogOf(context).functions.map((fn) => `${fn.schema}.${fn.name}`));
+			for (const { helper, role } of accessRequirements(mode.access)) {
+				const entry = listed.get(helper);
+				if (!entry) findings.push({
+					message: `${manifest} lists no ${helper}, but the permdock access model calls it from can() and the kit modules. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.`,
+					target: helper
+				});
+				else if (!entry.execute.includes(role)) findings.push({
+					message: `${manifest} says ${role} may not execute ${helper}, but the permdock access model calls it as ${role}. Run \`permdock rls generate\` with a current PermDock, then \`permdock supabase inspect --out\`.`,
+					target: helper
+				});
+				else if (read && !present.has(helper)) findings.push({
+					message: `${helper} is in ${manifest} but not in the database. Apply the migration \`permdock rls generate\` wrote before the access module.`,
+					target: helper
+				});
+			}
+			if (project) findings.push(...kitKeyProblems(project, kitPermissionKeys(context.config.kits, context.config.sql.kit), mode.access));
+			const canAssign = context.config.kits.access?.functions?.canAssign;
+			const recipe = `${mode.access.schema}.permdock_can_assign({role}, {tenant}::text)`;
+			if (canAssign === void 0) findings.push({
+				severity: "warning",
+				message: `kits.access.functions.canAssign is not set, so under the permdock model only the service role assigns roles: the memberships guard refuses every membership a member adds or changes${context.config.sql.kit.includes("tenant") ? "" : " (the owner-role fallback needs the tenant module, which PermDock projects don't install)"}. Set canAssign: "${recipe}", which PermDock writes when a role declares \`assigns\`.`,
+				target: "kits.access.functions.canAssign"
+			});
+			else if (canAssign.includes("permdock_can_assign") && !listed.has(`${mode.access.schema}.permdock_can_assign`)) findings.push({
+				severity: "info",
+				message: `kits.access.functions.canAssign calls permdock_can_assign, but ${manifest} doesn't list ${mode.access.schema}.permdock_can_assign. PermDock writes it only when a role in permdock.config.ts declares \`assigns\`; add one, then run \`permdock rls generate\` and \`permdock supabase inspect --out\`.`,
+				target: "kits.access.functions.canAssign"
+			});
+			return findings;
+		}
 	}
 ];
 //#endregion
@@ -908,8 +945,8 @@ async function formatTypes(code) {
 	return formatted;
 }
 /**
-* Renders `database.types.ts`, byte for byte what `supabase gen types` prints
-* when oxfmt is installed.
+* Renders `database.types.ts` as `supabase gen types` prints it when oxfmt is
+* installed, plus the `ComputedFields` keys Supabase CLI 2.119 doesn't write.
 */
 function generateDatabaseTypes(metadata, options) {
 	return generateTypescript(sortGeneratorMetadata(restrictSchemas(metadata, options.schemas)), {
@@ -2020,7 +2057,7 @@ async function rowConditionedBuckets(config) {
 		return problem ? [`  buckets.${bucket}: "${key}" ${problem.reason}. ${problem.fix}`] : [];
 	}));
 }
-const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install the version @supabase/postgrest-typegen pins: pnpm add -D oxfmt@0.66.0. To use a newer oxfmt, allow it in pnpm-workspace.yaml under peerDependencyRules.allowedVersions, keyed \"@supabase/postgrest-typegen>oxfmt\".";
+const UNFORMATTED = "oxfmt is not installed, so database.types.ts is not formatted like `supabase gen types` output. Install it: pnpm add -D oxfmt. @supabase/postgrest-typegen pins oxfmt 0.66.0 as its peer; to allow a newer one, add it to peerDependencyRules.allowedVersions in pnpm-workspace.yaml, keyed \"@supabase/postgrest-typegen>oxfmt\".";
 async function runGen(options) {
 	const { config } = options;
 	const refused = await rowConditionedBuckets(config);
@@ -2201,4 +2238,4 @@ const genCommand = defineCliCommand({
 	}
 });
 //#endregion
-export { toCatalog as A, catalogOf as C, policyObject as D, lineOf as E, qualified as O, entitlementsKit as S, exposedSchemas as T, restrictSchemas as _, sourceArgs as a, emitModule as b, openSource as c, snapshotFile as d, introspect as f, buildModel as g, CACHE_DIR as h, runGen as i, tableObject as k, parseSnapshot as l, pgSource as m, genCommand as n, loadSnapshot as o, managementSource as p, renderFiles as r, managementTarget as s, SOURCE_ARGS as t, serializeSnapshot as u, serializeGenerator as v, exposed as w, PERMDOCK_RULES as x, GENERATED_HEADER as y };
+export { tableObject as A, entitlementsKit as C, lineOf as D, exposedSchemas as E, policyObject as O, accessKit as S, exposed as T, restrictSchemas as _, sourceArgs as a, emitModule as b, openSource as c, snapshotFile as d, introspect as f, buildModel as g, CACHE_DIR as h, runGen as i, toCatalog as j, qualified as k, parseSnapshot as l, pgSource as m, genCommand as n, loadSnapshot as o, managementSource as p, renderFiles as r, managementTarget as s, SOURCE_ARGS as t, serializeSnapshot as u, serializeGenerator as v, catalogOf as w, PERMDOCK_RULES as x, GENERATED_HEADER as y };

package/dist/cli/index.d.ts

@@ -488,6 +488,6 @@ export declare function emitModule(model: Model, options: EmitOptions): string;
 export declare function loadConfig(cwd: string, explicit?: string): Promise<ResolvedConfig>;
 //#endregion
 //#region src/cli/version.d.ts
-export declare const VERSION = "0.5.0";
+export declare const VERSION = "0.5.1";
 //#endregion
 export type { Catalog, CatalogCheck, CatalogColumn, CatalogColumnGrant, CatalogEnum, CatalogForeignKey, CatalogFunction, CatalogFunctionArg, CatalogGrant, CatalogIndex, CatalogPolicy, CatalogTable, CatalogTrigger, CatalogUnique, CliArgs, CliCommandDef, CliContext, CliEnv, CliErrorCode, CliErrorOptions, CliIo, CliProblem, CliProblemExtensions, Command, CommandContext, CommandResult, ExitCode, ExtrasFunction, ExtrasHook, ExtrasHookFunction, ExtrasTable, ForeignKeyAction, GeneratorMetadata, IntrospectionSource, ManagementSourceOptions, ParsedArgs, Queryable, RunOptions, RunResult, Snapshot, SnapshotBucket, SnapshotExtras };

package/dist/cli/index.js

@@ -1,9 +1,9 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError, t as CLI_ERRORS_URL } from "./errors-4v4DTtda.js";
-import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-BKR2W_79.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { i as run, n as help, r as registerCommand, t as commandNames } from "./run-Bo_NLT5n.js";
+import { t as VERSION } from "./version-BCtlgDQx.js";
 import { a as loadConfig } from "./config-CPVpXP5I.js";
-import { A as toCatalog, b as emitModule, f as introspect, g as buildModel, i as runGen, l as parseSnapshot, m as pgSource, o as loadSnapshot, p as managementSource, r as renderFiles, u as serializeSnapshot, y as GENERATED_HEADER } from "./gen-C2osRcr5.js";
+import { b as emitModule, f as introspect, g as buildModel, i as runGen, j as toCatalog, l as parseSnapshot, m as pgSource, o as loadSnapshot, p as managementSource, r as renderFiles, u as serializeSnapshot, y as GENERATED_HEADER } from "./gen-CjElD1Vw.js";
 //#region src/cli/introspect/from-catalog.ts
 /**
 * Builds a snapshot from catalog records: the inverse of `toCatalog`. Tests

package/dist/cli/{init-Saf5-R9T.js → init-DMa6M7hV.js}

@@ -1,6 +1,6 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { t as VERSION } from "./version-BCtlgDQx.js";
 import { n as findConfig } from "./config-CPVpXP5I.js";
 import { n as installCommand, t as detectProject } from "./project-B_GeXyHh.js";
 import { posix, resolve } from "node:path";

package/dist/cli/{introspect--H7oGmcd.js → introspect-BKlaIu_M.js}

@@ -2,7 +2,7 @@ import { r as defineCliCommand } from "./command-CK14fP91.js";
 import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
 import { r as painter } from "./style-C0NFdJRL.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { _ as restrictSchemas, a as sourceArgs, o as loadSnapshot, t as SOURCE_ARGS, u as serializeSnapshot, v as serializeGenerator } from "./gen-C2osRcr5.js";
+import { _ as restrictSchemas, a as sourceArgs, o as loadSnapshot, t as SOURCE_ARGS, u as serializeSnapshot, v as serializeGenerator } from "./gen-CjElD1Vw.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";