better-supabase 0.5.0 → 0.6.0

package/dist/cli/{doctor-L7Z8mYTx.js → doctor-B4JOm_ox.js}

@@ -1,19 +1,20 @@
 import { a as list, r as defineCliCommand } from "./command-CK14fP91.js";
 import { n as CliError } from "./errors-4v4DTtda.js";
-import { r as writeIfChanged } from "./io-k41_z-jT.js";
+import { i as writeIfChanged, t as display } from "./io-DI1mTdSA.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
-import { c as diffEngine, d as pgFunctionHooks, f as readSupabaseToml, l as httpHooks, m as tomlGet, p as schemaPaths, s as stdinDatabaseUrl, u as migrationCommand } from "./config-CPVpXP5I.js";
-import { a as parseHookMarker, i as parseGrantsMarker, o as permdockSource, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
+import { t as VERSION } from "./version-hr88OZG0.js";
+import { s as providerLabel, t as compiledReadSets } from "./read-sets-CETOSFx4.js";
+import { s as stdinDatabaseUrl } from "./config-NiPxAmUF.js";
+import { c as migrationCommand, d as schemaPaths, i as findRepoRoot, l as pgFunctionHooks, n as declarativeSchemasDir, p as tomlGet, r as diffEngine, s as httpHooks, u as readSupabaseToml } from "./supabase-toml-B-bIukQF.js";
 import { t as byCodePoint } from "./compare-BmIWVEui.js";
-import { C as catalogOf, D as policyObject, E as lineOf, O as qualified, S as entitlementsKit, T as exposedSchemas, c as openSource, d as snapshotFile, h as CACHE_DIR, k as tableObject, o as loadSnapshot, r as renderFiles, s as managementTarget, w as exposed, x as PERMDOCK_RULES } from "./gen-C2osRcr5.js";
+import { A as exposed, C as MetadataRejectedError, D as accessModule, E as AUTHORIZATION_RULES, F as qualified, I as tableObject, M as lineOf, N as permissionCatalogKeys, O as entitlementsModule, P as policyObject, S as configFor, _ as METADATA_GAPS_TEXT, a as renderFiles, c as loadSnapshot, j as exposedSchemas, k as catalogOf, l as managementTarget, p as snapshotFile, r as readMetadataSnapshot, u as openSource, v as CACHE_DIR } from "./gen-BGLb_zou.js";
 import { n as withSpinner } from "./prompts-BNcNfAve.js";
 import { t as connect } from "./db-DOBPt660.js";
 import { dirname, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { glob, mkdir, readFile, readdir, writeFile } from "node:fs/promises";
-import { SQL_MODULES, contractSignature, customContracts, kitDeprecations, kitFileVersion, kitLayout, migrationOptionUses, moduleVersion, renderKit, sameKitFile } from "better-supabase/sql";
 import { DEFAULT_ACTIVE_TENANT, tenantClaimPaths } from "better-supabase/config";
+import { SQL_MODULES, contractSignature, customContracts, migrationOptionUses, moduleDeprecations, moduleEventTriggers, moduleFileVersion, moduleLayout, moduleVersion, renderModules, sameModuleFile, sharedRolesProblems } from "better-supabase/sql";
 import { createHash } from "node:crypto";
 import { defineBucket, parseSize } from "better-supabase/storage";
 //#region src/cli/doctor/advisors.ts
@@ -46,6 +47,17 @@ function managementAdvisors(options) {
 		}
 	};
 }
+/** The `[api] schemas` list of a `config.toml`, when it names any. */
+function apiSchemas(document) {
+	const value = document ? tomlGet(document, ["api", "schemas"]) : void 0;
+	if (!Array.isArray(value)) return [];
+	return value.filter((schema) => typeof schema === "string" && schema.trim() !== "");
+}
+const literal$1 = (value) => `'${value.replaceAll("'", "''")}'`;
+/** The read-only transaction splinter runs in, with `pgrst.db_schemas` set first. */
+function splinterScript(sql, schemas = []) {
+	return `begin read only;\n${schemas.length > 0 ? `set local pgrst.db_schemas = ${literal$1(schemas.join(","))};\n` : ""}${sql}\n;\nrollback;`;
+}
 const sha256 = (text) => createHash("sha256").update(text).digest("hex");
 /** Downloads (once) and verifies the pinned `splinter.sql`. */
 async function splinterSql(options) {
@@ -75,7 +87,7 @@ function splinterAdvisors(queryable, describe, options) {
 	let all;
 	const run = async () => {
 		const sql = await splinterSql(options);
-		return lintRows(await queryable.query(`begin read only;\n${sql}\n;\nrollback;`)).filter(isLint);
+		return lintRows(await queryable.query(splinterScript(sql, options.schemas))).filter(isLint);
 	};
 	return {
 		describe: `${describe} (splinter ${SPLINTER_COMMIT.slice(0, 7)})`,
@@ -87,6 +99,153 @@ function splinterAdvisors(queryable, describe, options) {
 	};
 }
 //#endregion
+//#region src/cli/doctor/advisor-rules.ts
+/** One request per advisor category, shared by the advisor rules and the rules that defer to them. */
+const fetched = /* @__PURE__ */ new WeakMap();
+function lintsOf(advisors, category) {
+	let byCategory = fetched.get(advisors);
+	if (!byCategory) {
+		byCategory = /* @__PURE__ */ new Map();
+		fetched.set(advisors, byCategory);
+	}
+	let lints = byCategory.get(category);
+	if (!lints) {
+		lints = advisors.lints(category);
+		byCategory.set(category, lints);
+	}
+	return lints;
+}
+const ADVISOR_SEVERITY = {
+	ERROR: "error",
+	WARN: "warning",
+	INFO: "info"
+};
+function lintObject(lint) {
+	const { schema, name, type } = lint.metadata ?? {};
+	if (typeof schema !== "string" || typeof name !== "string") return void 0;
+	if (type === "table" || type === "view") return {
+		kind: "table",
+		schema,
+		name
+	};
+	if (type === "function") return {
+		kind: "function",
+		schema,
+		name
+	};
+}
+function lintFinding(lint) {
+	const object = lintObject(lint);
+	return {
+		severity: ADVISOR_SEVERITY[lint.level] ?? "warning",
+		title: lint.title,
+		message: `${lint.detail.replaceAll("\\`", "`")} [${lint.name}]`,
+		target: object ? `${object.schema}.${object.name}` : lint.cache_key,
+		help: lint.remediation,
+		...object ? { object } : {}
+	};
+}
+/** A rule that reports one category of Supabase's advisors (splinter) as findings. */
+function advisorRule(code, category, title, description) {
+	return {
+		code,
+		severity: "warning",
+		title,
+		description,
+		async check(context) {
+			const { advisors } = context;
+			if (!advisors) return [];
+			if ("skipped" in advisors) return [{
+				severity: "info",
+				message: `Skipped the ${category} advisor: ${advisors.skipped}`
+			}];
+			try {
+				return (await lintsOf(advisors, category)).map(lintFinding);
+			} catch (cause) {
+				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${cause instanceof Error ? cause.message : String(cause)}` }];
+			}
+		}
+	};
+}
+/** The performance advisor rule the duplicate rules defer to. */
+const PERFORMANCE_ADVISOR = "BS200";
+/**
+* The tables splinter reports `lint` for (`schema.table`), when the
+* performance advisor runs in this run and its lints loaded. A rule that
+* repeats the lint (BS207, BS216) drops its findings for these tables; with
+* `undefined` (no advisors, a saved snapshot, an advisor error, or BS200 not
+* in the run) it reports them itself.
+*/
+async function splinterTables(context, lint) {
+	const { advisors } = context;
+	if (!advisors || "skipped" in advisors) return void 0;
+	if (!context.codes?.includes(PERFORMANCE_ADVISOR)) return void 0;
+	let lints;
+	try {
+		lints = await lintsOf(advisors, "performance");
+	} catch {
+		return;
+	}
+	return new Set(lints.flatMap((entry) => {
+		if (entry.name !== lint) return [];
+		const object = lintObject(entry);
+		return object ? [`${object.schema}.${object.name}`] : [];
+	}));
+}
+//#endregion
+//#region src/cli/doctor/cookies.ts
+const TOKENS_ONLY = /\bencode\s*:\s*["'`]tokens-only["'`]/;
+/** Imports that create the browser client, which writes the session cookie in the browser. */
+const BROWSER_SIDE = /from\s+["']better-supabase\/client["']|\bcreateBrowserClient\s*\(/;
+/** Imports that read or refresh the session cookie on the server. */
+const SERVER_SIDE = /from\s+["']better-supabase\/(?:server|next|ssr|hono|orpc|edge|expo)["']|\bcreateServerClient\s*\(/;
+function cookieSide(file) {
+	const browser = BROWSER_SIDE.test(file.text);
+	if (browser === SERVER_SIDE.test(file.text)) return void 0;
+	return browser ? "browser" : "server";
+}
+/**
+* Files on one side of the session cookie that set `encode: 'tokens-only'`
+* while files on the other side don't (BS412).
+*/
+function encodingDrift(context) {
+	const sides = context.sources.flatMap((file) => {
+		const side = cookieSide(file);
+		return side ? [{
+			file,
+			side,
+			tokensOnly: TOKENS_ONLY.test(file.text)
+		}] : [];
+	});
+	const tokensOnly = sides.filter((entry) => entry.tokensOnly);
+	if (tokensOnly.length === 0) return [];
+	const findings = [];
+	for (const side of ["browser", "server"]) {
+		const set = tokensOnly.find((entry) => entry.side === side);
+		if (!set) continue;
+		const other = side === "browser" ? "server" : "browser";
+		const unset = sides.filter((entry) => entry.side === other && !entry.tokensOnly);
+		if (unset.length === 0) continue;
+		const line = lineOf(set.file.text, TOKENS_ONLY) ?? 1;
+		findings.push({
+			message: `${set.file.path} writes the session cookie with \`encode: 'tokens-only'\`, but the ${other} side (${unset.map((entry) => entry.file.path).join(", ")}) uses the default \`user-and-tokens\`. Set the same \`encode\` on both sides.`,
+			target: `${set.file.path}:encode`,
+			location: {
+				file: set.file.path,
+				line
+			}
+		});
+	}
+	return findings;
+}
+const COOKIE_RULES = [{
+	code: "BS412",
+	severity: "info",
+	title: "Session cookie encoding differs between server and browser",
+	description: "`@supabase/ssr` needs the same `cookies.encode` on the server and in the browser client. With `tokens-only` on one side only, the other side writes the user object back into the cookie, or reads a session without one and `session.user` throws.",
+	check: encodingDrift
+}];
+//#endregion
 //#region src/cli/doctor/live.ts
 /** Statements slower than this (ms, mean) with more calls than `SLOW_CALLS` are BS209. */
 const SLOW_MEAN_MS = 50;
@@ -316,81 +475,61 @@ const LIVE_RULES = [
 //#region src/cli/doctor/hooks.ts
 /** Claims past this size make every request carry a large cookie and header. */
 const HOOK_CLAIMS_LIMIT = 2048;
-/** PermDock's default `supabase.hook.budget`, over `memberships` plus `attrs`. */
-const PERMDOCK_CLAIMS_LIMIT = 1024;
 /**
-* The BS405 limits. With PermDock, `doctor.claimsLimit` (else the manifest's
-* budget) is its budget for `memberships` plus `attrs` and the whole token
-* keeps 2048; without it, `doctor.claimsLimit` limits the whole token.
+* The BS405 limits. With a provider hook budget, `doctor.claimsLimit` (else
+* the budget's bytes) limits its claims and the whole token keeps 2048;
+* without one, `doctor.claimsLimit` limits the whole token.
 */
 function claimsLimits(context) {
 	const configured = context.config.doctor.claimsLimit;
-	return context.permdock ? {
+	const budget = providerHook(context)?.budget;
+	return budget ? {
 		token: HOOK_CLAIMS_LIMIT,
-		budget: configured ?? context.permdock.manifest?.budget ?? PERMDOCK_CLAIMS_LIMIT
-	} : {
-		token: configured ?? HOOK_CLAIMS_LIMIT,
-		budget: void 0
-	};
+		budget: {
+			bytes: configured ?? budget.bytes,
+			claims: budget.claims,
+			...budget.truncatedClaim ? { truncatedClaim: budget.truncatedClaim } : {}
+		}
+	} : { token: configured ?? HOOK_CLAIMS_LIMIT };
 }
-/** The kit function that fills PermDock's `memberships` claim. */
-const KIT_MEMBERSHIPS = /better_supabase\s*\.\s*membership_claims\b/i;
-const PERMDOCK_CALL = /\bpermdock\w*\s*\(|permdock\s*\./i;
-/** Only PermDock's generated hook sets this claim, so it marks that hook's body. */
-const PERMDOCK_HOOK = /'\{\s*(?:claims\s*,\s*)?memberships_truncated\s*\}'/i;
+/** The module function that fills the `memberships` claim. */
+const MODULE_MEMBERSHIPS = /better_supabase\s*\.\s*membership_claims\b/i;
+const providerHook = (context) => context.config.authorization?.tokenHook;
+const splitName = (qualified) => {
+	const dot = qualified.indexOf(".");
+	return {
+		schema: qualified.slice(0, dot),
+		name: qualified.slice(dot + 1)
+	};
+};
 const escapeRegExp$1 = (text) => text.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 /**
-* The claims PermDock's hook writes that a second writer would contradict.
-* The tenant claim is the manifest's when there is one, since that is the
-* claim PermDock's hook really writes.
+* The claims the provider's hook writes that a second writer would
+* contradict, with the tenant claim it writes to.
 */
-function ownedClaims(context) {
-	const manifest = context.permdock?.manifest;
-	const tenant = manifest?.rls?.tenantClaim ?? manifest?.tenantClaim ?? context.config.claims.tenant;
-	return [.../* @__PURE__ */ new Set([
-		"roles",
-		"user_role",
-		"memberships",
-		tenant,
-		context.config.claims.tenant
-	])];
+function ownedClaims(hook) {
+	return [.../* @__PURE__ */ new Set([...hook.ownedClaims, ...hook.tenantClaim ? [hook.tenantClaim] : []])];
 }
 const quotedName = (schema, name) => `(?:"?${escapeRegExp$1(schema)}"?\\s*\\.\\s*)?"?${escapeRegExp$1(name)}"?`;
 const createsFunction = (fn) => new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${quotedName(fn.schema, fn.name)}\\s*\\(`, "i");
-/** The SQL file that starts with PermDock's hook marker and creates `fn`. */
+/** The SQL file that has the provider's hook marker and creates `fn`. */
 function markerFileFor(context, fn) {
+	const marker = providerHook(context)?.markers?.hook;
+	if (marker === void 0) return void 0;
 	const creates = createsFunction(fn);
-	return (context.sqlFiles ?? []).find((file) => parseHookMarker(file.text) && creates.test(file.text));
+	return (context.sqlFiles ?? []).find((file) => file.text.includes(marker) && creates.test(file.text));
 }
-/** Whether `fn` is the hook PermDock generated: by its manifest, its marker file or its body. */
-function isPermdockHook(context, fn) {
-	const hook = context.permdock?.manifest?.hook;
-	if (hook && hook.schema === fn.schema && hook.function === fn.name) return true;
-	if (markerFileFor(context, fn)) return true;
-	return fn.source !== void 0 && PERMDOCK_HOOK.test(fn.source);
+/** Whether `fn` is the provider's hook: by its name or its marker file. */
+function isProviderHook(context, fn) {
+	const hook = providerHook(context);
+	if (!hook) return false;
+	if (hook.function === `${fn.schema}.${fn.name}`) return true;
+	return markerFileFor(context, fn) !== void 0;
 }
-/**
-* Extra claims PermDock's hook writes from `supabase.hook.claims`, by claim
-* name, with the function that fills each: from the manifest, else from the
-* hook marker's `claims=` list.
-*/
-function registeredClaims(context) {
-	const claims = /* @__PURE__ */ new Map();
-	for (const claim of context.permdock?.manifest?.claims ?? []) if (claim.source !== "permdock") claims.set(claim.name, claim.source);
-	if (claims.size > 0) return claims;
-	const owned = /* @__PURE__ */ new Set([
-		...ownedClaims(context),
-		"memberships_truncated",
-		"attrs",
-		"authz_ver"
-	]);
-	for (const file of context.sqlFiles ?? []) for (const name of parseHookMarker(file.text)?.claims ?? []) if (!owned.has(name)) claims.set(name, void 0);
-	return claims;
-}
-/** Whether the hook body calls PermDock's generated hook (a wrapper around it). */
-function wrapsPermdockHook(context, source) {
-	const hook = context.permdock?.manifest?.hook;
-	return hook !== void 0 && new RegExp(`${quotedName(hook.schema, hook.function)}\\s*\\(`, "i").test(source);
+/** Whether the hook body calls the provider's hook (a wrapper around it). */
+function wrapsProviderHook(hook, source) {
+	const { schema, name } = splitName(hook.function);
+	return new RegExp(`${quotedName(schema, name)}\\s*\\(`, "i").test(source);
 }
 /** Which of `claims` the hook body writes through `jsonb_set` or `jsonb_build_object`. */
 function writtenClaims(source, claims) {
@@ -399,7 +538,7 @@ function writtenClaims(source, claims) {
 		return new RegExp(`jsonb_set\\s*\\([^;]*?'\\{\\s*(?:claims\\s*,\\s*)?${name}\\s*\\}'`, "i").test(source) || new RegExp(`jsonb_build_object\\s*\\([^;]*?'${name}'\\s*,`, "i").test(source);
 	});
 }
-const API_ROLES$1 = ["authenticated", "anon"];
+const API_ROLES$2 = ["authenticated", "anon"];
 /** Hooks enabled in `config.toml`, matched with their introspected functions. */
 function configuredHooks(context) {
 	if (!context.configToml) return [];
@@ -430,7 +569,7 @@ function grantProblems(fn) {
 		problems.push("supabase_auth_admin may not execute it");
 		fix.push(`grant execute on function ${signatureOf(fn)} to supabase_auth_admin;`);
 	}
-	const exposedTo = API_ROLES$1.filter((role) => fn.execute.includes(role));
+	const exposedTo = API_ROLES$2.filter((role) => fn.execute.includes(role));
 	if (exposedTo.length > 0 || fn.publicExecute) {
 		const roles = [...exposedTo, ...fn.publicExecute ? ["public"] : []];
 		problems.push(`${roles.join(", ")} may execute it, so any client can call it through the API`);
@@ -443,18 +582,17 @@ function grantProblems(fn) {
 }
 const MIGRATIONS = /(?:^|\/)supabase\/migrations\//;
 /**
-* The file that grants `fn` to `supabase_auth_admin`: a `-- permdock:grants
-* v1` migration, or under pg-delta, which carries grants, the declarative
+* The file that grants `fn` to `supabase_auth_admin`: a migration with the
+* provider's grants marker, or under pg-delta, which carries grants, the declarative
 * schema file that defines `fn`. `supabase db diff` drops grants, so the
 * legacy engine only counts the migration.
 */
 function grantsSourceFor(context, fn, engine) {
 	const grants = new RegExp(`grant\\s+execute\\s+on\\s+function\\s+${quotedName(fn.schema, fn.name)}\\s*\\([^)]*\\)\\s*to\\s+[^;]*\\bsupabase_auth_admin\\b`, "i");
 	const creates = createsFunction(fn);
-	return (context.sqlFiles ?? []).find((file) => grants.test(file.text) && (parseGrantsMarker(file.text) !== void 0 || engine === "pg-delta" && !MIGRATIONS.test(file.path) && creates.test(file.text)))?.path;
+	const marker = providerHook(context)?.markers?.grants;
+	return (context.sqlFiles ?? []).find((file) => grants.test(file.text) && (marker !== void 0 && file.text.includes(marker) || engine === "pg-delta" && !MIGRATIONS.test(file.path) && creates.test(file.text)))?.path;
 }
-const PERMDOCK_GRANTS_COMMAND = "permdock supabase hook generate --grants-out supabase/migrations/<timestamp>_permdock_hook_grants.sql";
-const permdockSchemaCommand = (file) => `permdock supabase hook generate --out ${file ?? "<the schema file that defines it>"}`;
 /** Configured hook functions whose grants are wrong (BS404, `doctor --fix-grants`). */
 function hookGrantProblems(context) {
 	const engine = diffEngine(context.configToml);
@@ -462,7 +600,8 @@ function hookGrantProblems(context) {
 		const { problems, fix } = grantProblems(fn);
 		if (problems.length === 0) return [];
 		const file = grantsSourceFor(context, fn, engine);
-		const hookFile = markerFileFor(context, fn)?.path;
+		const provider = context.config.authorization;
+		const command = provider?.tokenHook?.grantsCommand;
 		return [{
 			hook: config.hook,
 			fn,
@@ -470,9 +609,10 @@ function hookGrantProblems(context) {
 			fix: file ? {
 				kind: "migration",
 				file
-			} : isPermdockHook(context, fn) ? {
-				kind: "permdock",
-				...hookFile ? { file: hookFile } : {}
+			} : provider && isProviderHook(context, fn) ? {
+				kind: "provider",
+				name: providerLabel(provider),
+				...command ? { command } : {}
 			} : {
 				kind: "sql",
 				sql: fix
@@ -484,13 +624,13 @@ function hookGrantProblems(context) {
 function grantFixText(fix, engine) {
 	switch (fix.kind) {
 		case "sql": return engine === "pg-delta" ? `Add to the schema file that defines the function, then run \`supabase db schema declarative sync\` (\`doctor --fix-grants\` prints every block):\n${fix.sql.join("\n")}` : `Append to the migration \`supabase db diff\` wrote (\`doctor --fix-grants\` prints every block):\n${fix.sql.join("\n")}`;
-		case "permdock": return engine === "pg-delta" ? `It is PermDock's hook, so let PermDock write the grants into the schema file that defines it: \`${permdockSchemaCommand(fix.file)}\`, without \`--grants-out\` so pg-delta carries them, then run \`supabase db schema declarative sync\`.` : `It is PermDock's hook, so let PermDock write the grants: \`${PERMDOCK_GRANTS_COMMAND}\`.`;
+		case "provider": return fix.command ? `It is the hook of ${fix.name}, so let the provider write the grants: \`${fix.command}\`.` : `It is the hook of ${fix.name}, so let the provider write the grants.`;
 		case "migration": return engine === "pg-delta" ? `${fix.file} grants it, so the database is behind: run \`supabase db schema declarative sync\`, then apply the migrations (\`supabase migration up\`).` : `${fix.file} grants it, so the database is behind the migrations: apply them (\`supabase migration up\`).`;
 		default: return fix;
 	}
 }
 /** `doctor --fix-grants`: the SQL block for every BS404 problem, as one migration snippet. */
-function hookGrantBlock(problems, engine = "migra") {
+function hookGrantBlock(problems, engine = "pg-delta") {
 	if (problems.length === 0) return "-- Every configured Auth hook function has its grants.";
 	const lines = ["-- Auth hook grants (better-supabase doctor --fix-grants).", engine === "pg-delta" ? "-- Add this to the schema file that defines the function, then run `supabase db schema declarative sync`." : "-- `supabase db diff` does not carry function grants; append this to its migration."];
 	for (const { fn, hook, fix } of problems) {
@@ -499,8 +639,8 @@ function hookGrantBlock(problems, engine = "migra") {
 			case "sql":
 				lines.push("", `-- ${name}`, ...fix.sql);
 				break;
-			case "permdock":
-				lines.push("", engine === "pg-delta" ? `-- ${name} is PermDock's hook: ${permdockSchemaCommand(fix.file)} (without --grants-out), then supabase db schema declarative sync` : `-- ${name} is PermDock's hook: ${PERMDOCK_GRANTS_COMMAND}`);
+			case "provider":
+				lines.push("", `-- ${name} is the hook of ${fix.name}${fix.command ? `: ${fix.command}` : ""}`);
 				break;
 			case "migration":
 				lines.push("", engine === "pg-delta" ? `-- ${name}: ${fix.file} grants it; run \`supabase db schema declarative sync\`, then \`supabase migration up\`.` : `-- ${name}: ${fix.file} grants it; run \`supabase migration up\`.`);
@@ -563,18 +703,19 @@ async function hookClaims(db, fn, userId) {
 		return isRecord(claims) ? claims : {};
 	});
 }
-async function hookClaimsSize(db, fn, userId) {
+async function hookClaimsSize(db, fn, userId, budget) {
+	const budgetSql = budget && budget.claims.length > 0 ? budget.claims.map((claim) => `coalesce(octet_length((c -> ${literal(claim)})::text), 0)`).join(" + ") : "0";
+	const truncatedSql = budget?.truncatedClaim ? `c ->> ${literal(budget.truncatedClaim)} = 'true'` : "false";
 	return withHookEvent(db, userId, async () => {
 		const [row] = await db.query(`select octet_length(c::text) as bytes,
         octet_length((c -> 'memberships')::text) as memberships,
-        octet_length((c -> 'attrs')::text) as attrs,
-        c ->> 'memberships_truncated' = 'true' as truncated
+        ${budgetSql} as budget,
+        ${truncatedSql} as truncated
       from (select ${hookCall(fn)} as c) h`);
-		const memberships = Number(row?.memberships ?? 0);
 		return {
 			bytes: Number(row?.bytes ?? 0),
-			memberships,
-			budget: memberships + Number(row?.attrs ?? 0),
+			memberships: Number(row?.memberships ?? 0),
+			budget: Number(row?.budget ?? 0),
 			truncated: row?.truncated === true
 		};
 	});
@@ -632,7 +773,7 @@ const HOOK_RULES = [
 		code: "BS405",
 		severity: "warning",
 		title: "Custom access token hook shape",
-		description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back. It warns when the whole token's claims pass ${HOOK_CLAIMS_LIMIT} bytes (\`doctor.claimsLimit\` without PermDock). With a \`permdock.config.ts\` it also warns when \`memberships\` plus \`attrs\` pass PermDock's budget, ${PERMDOCK_CLAIMS_LIMIT} bytes or \`doctor.claimsLimit\`, measured with \`octet_length\` as PermDock's hook measures it.`,
+		description: `Auth runs the custom access token hook on every sign-in and refresh. It should be \`stable\` with \`set search_path = ''\`, and the claims it returns end up in every request's cookie and Authorization header. With \`--as <user id>\` doctor calls it for that user in a transaction that is rolled back. It warns when the whole token's claims pass ${HOOK_CLAIMS_LIMIT} bytes (\`doctor.claimsLimit\` without a provider budget). When the authorization provider's hook has a \`budget\`, it also warns when the budget's claims pass its bytes (or \`doctor.claimsLimit\`), measured with \`octet_length\` of each claim.`,
 		async check(context) {
 			const findings = [];
 			const limits = claimsLimits(context);
@@ -663,7 +804,7 @@ const HOOK_RULES = [
 						continue;
 					}
 					try {
-						const size = await hookClaimsSize(db, fn, context.hookUser);
+						const size = await hookClaimsSize(db, fn, context.hookUser, limits.budget);
 						if (size === void 0) {
 							findings.push({
 								severity: "info",
@@ -672,8 +813,8 @@ const HOOK_RULES = [
 							});
 							continue;
 						}
-						if (limits.budget !== void 0 && size.budget > limits.budget) findings.push({
-							message: `${signatureOf(fn)} returns ${size.budget} bytes of memberships and attrs for ${context.hookUser}, over PermDock's budget of ${limits.budget} (memberships ${size.memberships}). Raise \`supabase.hook.budget\` and \`doctor.claimsLimit\` together, or move attrs out of the token.`,
+						if (limits.budget !== void 0 && size.budget > limits.budget.bytes) findings.push({
+							message: `${signatureOf(fn)} returns ${size.budget} bytes of ${limits.budget.claims.join(" and ")} for ${context.hookUser}, over the hook's budget of ${limits.budget.bytes}. Raise the provider's budget and \`doctor.claimsLimit\` together, or move claims out of the token.`,
 							target: `${signatureOf(fn)}:budget`,
 							object
 						});
@@ -684,7 +825,7 @@ const HOOK_RULES = [
 						});
 						if (size.truncated) findings.push({
 							severity: "info",
-							message: `${signatureOf(fn)} sets memberships_truncated for ${context.hookUser}: the token lists only some memberships (${size.memberships} bytes). Server checks for this user need a database lookup (PermDock's claimsFirst falls back to one).`,
+							message: `${signatureOf(fn)} sets ${limits.budget?.truncatedClaim ?? "its truncated claim"} for ${context.hookUser}: the token lists only some entries (memberships ${size.memberships} bytes). Server checks for this user need a database lookup.`,
 							target: `${signatureOf(fn)}:truncated`,
 							object
 						});
@@ -704,42 +845,29 @@ const HOOK_RULES = [
 		code: "BS407",
 		severity: "error",
 		title: "Two authorization hooks",
-		description: "A `permdock.config.ts` or `permdock.manifest.json` (or a hook that calls PermDock's functions) means PermDock writes `user_role`, `roles`, `memberships` and the tenant claim (`claims.tenant`) into the token. A custom access token hook that also calls `better_supabase.membership_claims`, or writes one of those claims itself, gives them a second source that drifts from PermDock's. Generate the hook with `permdock supabase hook generate` and drop the extra writes. Functions registered in PermDock's `supabase.hook.claims` (such as `better_supabase.feature_claims` for `features`) are PermDock's hook's own sources and are not reported; a hook that wraps PermDock's and writes one of those claims again is.",
+		description: "When the authorization provider's hook (`authorization.tokenHook`) owns claims such as `memberships`, `roles` or the tenant claim, a custom access token hook that also calls `better_supabase.membership_claims`, or writes one of those claims itself, gives them a second source that drifts from the provider's. Use the provider's hook and drop the extra writes. Claims the provider's hook fills from other functions (`registeredClaims`, such as `features` from `better_supabase.feature_claims`) are not reported; a hook that wraps the provider's and writes one of those claims again is.",
 		check: (context) => {
-			const project = context.permdock;
+			const provider = context.config.authorization;
+			const hook = provider?.tokenHook;
+			if (!provider || !hook) return [];
+			const label = providerLabel(provider);
+			const registered = new Map((hook.registeredClaims ?? []).map((claim) => [claim.name, claim.function]));
+			const owned = ownedClaims(hook);
 			const findings = [];
-			if (project) {
-				findings.push(...project.problems.filter((problem) => problem.startsWith(project.manifestPath)).map((problem) => ({
-					severity: "info",
-					message: `Could not read PermDock's manifest: ${problem}`,
-					target: project.manifestPath
-				})));
-				if (project.config && !project.manifest && !project.problems.some((problem) => problem.startsWith(project.manifestPath))) findings.push({
-					severity: "info",
-					message: `${project.config} is present but ${project.manifestPath} is not, so doctor and the SQL kit can't see PermDock's hook, helpers and membership sources. Run \`permdock supabase inspect --out\`, and \`permdock supabase inspect --check\` in CI.`,
-					target: project.manifestPath
-				});
-			}
-			const registered = registeredClaims(context);
 			for (const { config, extras } of configuredHooks(context)) {
 				if (config.hook !== "custom_access_token" || !extras) continue;
 				for (const fn of extras.functions) {
-					if (fn.source === void 0 || isPermdockHook(context, fn)) continue;
-					const kit = KIT_MEMBERSHIPS.test(fn.source);
-					const wrapper = wrapsPermdockHook(context, fn.source);
-					const written = writtenClaims(fn.source, [...ownedClaims(context), ...wrapper ? registered.keys() : []]);
-					if (!kit && written.length === 0) continue;
-					const permdock = project ? permdockSource(project) : PERMDOCK_CALL.test(fn.source) ? "the hook body" : void 0;
-					if (!permdock) continue;
+					if (fn.source === void 0 || isProviderHook(context, fn)) continue;
+					const module = owned.includes("memberships") && MODULE_MEMBERSHIPS.test(fn.source);
+					const wrapper = wrapsProviderHook(hook, fn.source);
+					const written = writtenClaims(fn.source, [...owned, ...wrapper ? registered.keys() : []]);
+					if (!module && written.length === 0) continue;
 					const location = hookLocation(context, config.hook);
-					const what = [...kit ? ["calls better_supabase.membership_claims"] : [], ...written.length > 0 ? [`writes ${written.join(", ")}`] : []].join(" and ");
+					const what = [...module ? ["calls better_supabase.membership_claims"] : [], ...written.length > 0 ? [`writes ${written.join(", ")}`] : []].join(" and ");
 					const extra = written.filter((claim) => registered.has(claim));
-					const sources = extra.map((claim) => {
-						const source = registered.get(claim);
-						return source ? `${claim} from ${source}` : claim;
-					}).join(", ");
+					const sources = extra.map((claim) => `${claim} from ${registered.get(claim)}`).join(", ");
 					findings.push({
-						message: `${signatureOf(fn)} ${what}, and ${permdock} says PermDock owns those claims${extra.length > 0 ? ` (its hook already writes ${sources} through supabase.hook.claims)` : ""}. Keep one source: run \`permdock supabase hook generate\` and remove these writes from your hook.`,
+						message: `${signatureOf(fn)} ${what}, but the hook of ${label} (${hook.function}) owns those claims${extra.length > 0 ? ` (it already writes ${sources})` : ""}. Keep one source: use the provider's hook and remove these writes from yours.`,
 						target: signatureOf(fn),
 						object: {
 							kind: "function",
@@ -757,7 +885,7 @@ const HOOK_RULES = [
 		code: "BS410",
 		severity: "warning",
 		title: "HTTP auth hooks",
-		description: "Auth calls an `http://` or `https://` hook with a request signed by the Standard Webhooks secret in `secrets` (`v1,whsec_<base64>`, several joined with `|`). Doctor can't read the endpoint's code, so it reports each HTTP hook and checks what it can: the secret's format, that it comes from `env()` rather than the committed file, and that a non-local endpoint uses https. Verify the request in the endpoint with `authHook` from `better-supabase/webhooks`.",
+		description: "Auth calls an `http://` or `https://` hook with a request signed by the Standard Webhooks secret in `secrets` (`v1,whsec_<base64>`, several joined with `|`). Doctor can't read the endpoint's code, so it reports each HTTP hook and checks what it can: the secret's format, that it comes from `env()` rather than the committed file, and that a non-local endpoint uses https. Verify the request in the endpoint with `authHook` from `better-supabase/blocks/webhooks`.",
 		check: (context) => {
 			const toml = context.configToml;
 			if (!toml) return [];
@@ -767,7 +895,7 @@ const HOOK_RULES = [
 				const target = `[auth.hook.${hook}]`;
 				const findings = [{
 					severity: "info",
-					message: `${target} calls ${uri.origin}${uri.pathname} over HTTP. Doctor can't check its code; verify the signature there with authHook from better-supabase/webhooks.`,
+					message: `${target} calls ${uri.origin}${uri.pathname} over HTTP. Doctor can't check its code; verify the signature there with authHook from better-supabase/blocks/webhooks.`,
 					target,
 					...at
 				}];
@@ -808,7 +936,62 @@ const HOOK_RULES = [
 	}
 ];
 //#endregion
-//#region src/cli/doctor/kits.ts
+//#region src/cli/doctor/metadata.ts
+/**
+* Rules that read what a `GeneratorMetadata` document leaves out (policies,
+* grants, indexes, triggers, buckets, the realtime publication, foreign key
+* actions, multi-column constraints, role settings, hook functions). On a
+* snapshot built from such a document they would report what is missing
+* from the document, not from the database, so they skip with an info finding.
+*/
+const EXTRAS_RULES = /* @__PURE__ */ new Set([
+	"BS103",
+	"BS106",
+	"BS107",
+	"BS108",
+	"BS109",
+	"BS110",
+	"BS111",
+	"BS112",
+	"BS113",
+	"BS114",
+	"BS204",
+	"BS205",
+	"BS206",
+	"BS207",
+	"BS210",
+	"BS211",
+	"BS213",
+	"BS215",
+	"BS216",
+	"BS217",
+	"BS218",
+	"BS219",
+	"BS301",
+	"BS302",
+	"BS303",
+	"BS305",
+	"BS306",
+	"BS310",
+	"BS315",
+	"BS404",
+	"BS405",
+	"BS406",
+	"BS407"
+]);
+/** The info finding for a rule in `EXTRAS_RULES` that did not run, or `undefined` when it can. */
+function skippedForMetadata(snapshot, rule, help) {
+	if (!snapshot.extras.fromMetadata || !EXTRAS_RULES.has(rule.code)) return void 0;
+	return {
+		code: rule.code,
+		severity: "info",
+		title: rule.title,
+		help,
+		message: `Skipped: the schema came from a GeneratorMetadata document (--metadata), which has no ${METADATA_GAPS_TEXT}. Run doctor against the database to run this check.`
+	};
+}
+//#endregion
+//#region src/cli/doctor/modules.ts
 /** The non-empty string at a dotted path, as the tenant() plugin reads it. */
 function claimAt(claims, path) {
 	let value = claims;
@@ -816,7 +999,7 @@ function claimAt(claims, path) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function contractChecks(context) {
-	return customContracts(context.config.sql.kit, kitLayout(context.config)).flatMap((contract) => contract.functions.map((fn) => ({
+	return customContracts(context.config.sql.moduleNames, moduleLayout(context.config, context.config.sql.testsDir, [], void 0, void 0, permissionCatalogKeys(context))).flatMap((contract) => contract.functions.map((fn) => ({
 		module: contract.module,
 		schema: contract.schema,
 		name: fn.name,
@@ -845,10 +1028,10 @@ from (
     limit 1
   ) as hook
 ) h`;
-/** `rate-limit` in `sql.kit` without PostgREST's pre-request hook reaching `check_request()`. */
+/** `rate-limit` in `sql.modules` without PostgREST's pre-request hook reaching `check_request()`. */
 async function rateLimitHook(context) {
 	const db = context.database;
-	if (!context.config.sql.kit.includes("rate-limit") || !db || "skipped" in db) return [];
+	if (!context.config.sql.moduleNames.includes("rate-limit") || !db || "skipped" in db) return [];
 	let rows;
 	try {
 		rows = await db.query(PRE_REQUEST_HOOK);
@@ -862,6 +1045,57 @@ async function rateLimitHook(context) {
 		target: "authenticator pgrst.db_pre_request"
 	}];
 }
+const DANGLING_AUDIT = `select a.target::oid::text as oid
+from better_supabase.audited_tables a
+where pg_catalog.to_regclass('better_supabase.audited_tables') is not null
+  and not exists (select 1 from pg_catalog.pg_class c where c.oid = a.target::oid)
+order by 1`;
+/** `better_supabase.audited_tables` rows whose table no longer exists. */
+async function danglingAuditRegistrations(context) {
+	const db = context.database;
+	if (!context.config.sql.moduleNames.includes("audit") || !db || "skipped" in db) return [];
+	let rows;
+	try {
+		rows = await db.query(DANGLING_AUDIT);
+	} catch {
+		return [];
+	}
+	return rows.map((row) => ({
+		message: `better_supabase.audited_tables registers the table with oid ${row.oid}, which no longer exists. It was dropped before the audit module's sql_drop event trigger was installed. Run \`better-supabase sql sync\` and apply the migration \`better-supabase sql data\` writes, which deletes such rows, or run \`delete from better_supabase.audited_tables where not exists (select 1 from pg_catalog.pg_class c where c.oid = target::oid)\`.`,
+		target: `better_supabase.audited_tables ${row.oid}`
+	}));
+}
+const EVENT_TRIGGER_FIX = "Event triggers belong to no schema, so a schema diff limited to some schemas (`supabase db schema declarative sync -s ...`) leaves them out of the migration. Run `better-supabase sql sync`, then `better-supabase sql data`: the module's data migration creates it.";
+/** Event triggers the `sql.modules` create that the database, or every migration, lacks. */
+async function missingEventTriggers(context) {
+	const expected = moduleEventTriggers(context.config.sql.moduleNames);
+	if (expected.length === 0) return [];
+	const db = context.database;
+	if (db && !("skipped" in db)) {
+		let rows;
+		try {
+			rows = await db.query("select evtname as name from pg_catalog.pg_event_trigger");
+		} catch {
+			return [];
+		}
+		const present = new Set(rows.map((row) => row.name));
+		return expected.filter((trigger) => !present.has(trigger.name)).map((trigger) => ({
+			message: `The database has no event trigger ${trigger.name}, which the ${trigger.module} module creates. ${EVENT_TRIGGER_FIX}`,
+			target: trigger.name
+		}));
+	}
+	const toml = context.configToml;
+	if (toml === void 0) return [];
+	const migrations = (context.sqlFiles ?? []).filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	return expected.filter((trigger) => {
+		const pattern = new RegExp(`create\\s+event\\s+trigger\\s+${ident(trigger.name)}\\s`, "i");
+		return !migrations.some((file) => pattern.test(file.text));
+	}).map((trigger) => ({
+		message: `No migration creates the event trigger ${trigger.name}, which the ${trigger.module} module creates, so a database built from the migrations lacks it. ${EVENT_TRIGGER_FIX}`,
+		target: trigger.name
+	}));
+}
 /** Custom-mode modules whose contract functions the database or SQL files don't have. */
 async function missingContracts(context) {
 	const checks = contractChecks(context);
@@ -869,7 +1103,7 @@ async function missingContracts(context) {
 	const db = context.database;
 	const live = db && !("skipped" in db) ? db : void 0;
 	if (!live) return checks.filter((check) => !declared(context, check)).map((check) => ({
-		message: `kits.${check.module} is in custom mode, but no SQL file declares ${check.schema}.${check.name}(${check.args}). Write it, or switch the module to adopt or managed.`,
+		message: `sql.modules.${check.module} is in custom mode, but no SQL file declares ${check.schema}.${check.name}(${check.args}). Write it, or switch the module to adopt or managed.`,
 		target: `${check.schema}.${check.name}`,
 		object: {
 			kind: "function",
@@ -888,8 +1122,8 @@ async function missingContracts(context) {
 	} catch (cause) {
 		return [{
 			severity: "info",
-			message: `Reading the custom kit contract functions failed: ${errorText(cause)}`,
-			target: "kits"
+			message: `Reading the custom module contract functions failed: ${errorText(cause)}`,
+			target: "modules"
 		}];
 	}
 	return checks.flatMap((check) => {
@@ -901,7 +1135,7 @@ async function missingContracts(context) {
 			name: check.name
 		};
 		if (found.length === 0) return [{
-			message: `kits.${check.module} is in custom mode, but ${target}(${check.args}) doesn't exist. Write it, or switch the module to adopt or managed.`,
+			message: `sql.modules.${check.module} is in custom mode, but ${target}(${check.args}) doesn't exist. Write it, or switch the module to adopt or managed.`,
 			target,
 			object
 		}];
@@ -921,8 +1155,8 @@ async function missingContracts(context) {
 }
 /** With the tenant claim as the active tenant, the hook must put it in the token. */
 async function missingTenantClaim(context) {
-	if (!context.config.sql.kit.includes("tenant")) return [];
-	if ((context.config.kits.access?.activeTenant ?? DEFAULT_ACTIVE_TENANT) !== "claim") return [];
+	if (!context.config.sql.moduleNames.includes("tenant")) return [];
+	if ((context.config.sql.modules.access?.activeTenant ?? DEFAULT_ACTIVE_TENANT) !== "claim") return [];
 	const userId = context.hookUser;
 	const db = context.database;
 	if (!userId || !db || "skipped" in db || !db.session) return [];
@@ -941,7 +1175,7 @@ async function missingTenantClaim(context) {
 			if (claims === void 0) continue;
 			if (tenantClaimPaths(claim).some((path) => claimAt(claims, path) !== void 0)) continue;
 			findings.push({
-				message: `${signatureOf(fn)} returns no \`${claim}\` claim for ${userId} (top level or app_metadata), and kits.access.activeTenant is 'claim', so current_tenant_id() is null and the tenant() plugin rejects their requests. Write the claim in the hook, or set kits.access.activeTenant to 'resolver' (with ServerOptions.tenant) or a profile column.`,
+				message: `${signatureOf(fn)} returns no \`${claim}\` claim for ${userId} (top level or app_metadata), and sql.modules.access.activeTenant is 'claim', so current_tenant_id() is null and the tenant() plugin rejects their requests. Write the claim in the hook, or set sql.modules.access.activeTenant to 'resolver' (with ServerOptions.tenant) or a profile column.`,
 				target,
 				object: {
 					kind: "function",
@@ -989,12 +1223,12 @@ function lineOfUse(entry, text, policyTable) {
 		offset += statement.length + 1;
 	}
 }
-/** SQL files and policies that still use a symbol a kit module deprecated or removed. */
+/** SQL files and policies that still use a symbol a SQL module deprecated or removed. */
 function deprecatedSymbols(context) {
 	const configured = new Set(Object.values(context.config.claims));
-	const entries = kitDeprecations().filter((entry) => context.config.sql.kit.includes(entry.module) && !(entry.kind === "claim" && configured.has(entry.symbol)) && !((entry.kind === "table" || entry.kind === "column") && (context.config.kits[entry.module]?.mode ?? "managed") !== "managed"));
+	const entries = moduleDeprecations().filter((entry) => context.config.sql.moduleNames.includes(entry.module) && !(entry.kind === "claim" && configured.has(entry.symbol)) && !((entry.kind === "table" || entry.kind === "column") && (context.config.sql.modules[entry.module]?.mode ?? "managed") !== "managed"));
 	if (entries.length === 0) return [];
-	const files = (context.sqlFiles ?? []).filter((file) => !file.path.startsWith("supabase/migrations/") && kitFileVersion(file.text) === void 0);
+	const files = (context.sqlFiles ?? []).filter((file) => !/(^|\/)supabase\/migrations\//.test(file.path) && moduleFileVersion(file.text) === void 0);
 	const findings = [];
 	for (const entry of entries) {
 		const status = entry.removed === void 0 ? `deprecated since ${entry.since}` : `removed in ${entry.removed}`;
@@ -1022,7 +1256,7 @@ function deprecatedSymbols(context) {
 	}
 	return findings;
 }
-/** Kit triggers and the equivalent triggers they replace. */
+/** Module triggers and the equivalent triggers they replace. */
 const EQUIVALENT_TRIGGERS = [{
 	trigger: "bs_updated_at",
 	call: "track_updated_at",
@@ -1032,7 +1266,7 @@ const EQUIVALENT_TRIGGERS = [{
 	call: "audit",
 	pattern: /audit/i
 }];
-/** Tables where a kit trigger and an older trigger do the same work. */
+/** Tables where a module trigger and an older trigger do the same work. */
 function duplicateTriggers(context) {
 	return catalogOf(context).tables.flatMap((table) => EQUIVALENT_TRIGGERS.flatMap(({ trigger, call, pattern }) => {
 		if (!table.triggers.some((entry) => entry.name === trigger)) return [];
@@ -1043,72 +1277,418 @@ function duplicateTriggers(context) {
 		}));
 	}));
 }
-/** `better_supabase` and every `kits.*.schema` that `[api] schemas` serves through the Data API. */
-function exposedKitSchemas(context) {
-	if (context.config.sql.kit.length === 0) return [];
-	const kitSchemas = /* @__PURE__ */ new Set(["better_supabase"]);
-	for (const module of Object.values(context.config.kits)) if (module?.schema !== void 0) kitSchemas.add(module.schema);
-	return exposedSchemas(context).filter((schema) => kitSchemas.has(schema)).map((schema) => ({
-		message: `The Data API serves the kit schema ${schema}, so its tables and internal helpers are reachable over REST and RPC. Remove it from [api] schemas in supabase/config.toml (and the dashboard's exposed schemas), and call the kit functions through a wrapper in an exposed schema.`,
+/** `exempt` globs (`public.*_archive`): `*` matches any run of characters. */
+const globs = (value) => (Array.isArray(value) ? value : []).filter((entry) => typeof entry === "string").map((glob) => new RegExp(`^${glob.split("*").map(escapeRegExp).join(".*")}$`, "i"));
+/** The module schemas and the app tables SQL modules adopted, which the audit trigger skips. */
+function moduleOwned(context) {
+	const schemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const module of Object.values(context.config.sql.modules)) {
+		if (module?.schema !== void 0) schemas.add(module.schema);
+		for (const table of Object.values(module?.tables ?? {})) {
+			if (table === null) continue;
+			tables.add(table.includes(".") ? table : `${module?.schema ?? "better_supabase"}.${table}`);
+		}
+	}
+	return {
+		schemas,
+		tables
+	};
+}
+/** Tables in `config.schemas` without the `bs_audit` trigger, when `audit` is in `sql.modules`. */
+function unauditedTables(context) {
+	if (!context.config.sql.moduleNames.includes("audit")) return [];
+	const exempt = globs(context.config.sql.modules["audit"]?.options?.["exempt"]);
+	const owned = moduleOwned(context);
+	return catalogOf(context).tables.filter((table) => table.kind === "table" && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exempt.some((pattern) => pattern.test(qualified(table))) && !table.triggers.some((trigger) => trigger.name === "bs_audit" || trigger.function.split(".").at(-1) === "audit_row_change")).map((table) => ({
+		message: `${qualified(table)} has no audit trigger, so its inserts, updates and deletes are not in the audit log. Run \`select better_supabase.audit('${qualified(table)}')\` in a schema file, or list it in sql.modules.audit.options.exempt.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+}
+/** RLS tables in `config.schemas` without a restrictive `session_active()` policy, when `sessions` is in `sql.modules`. */
+function sessionlessTables(context) {
+	if (!context.config.sql.moduleNames.includes("sessions")) return [];
+	const exclude = globs(context.config.sql.modules["sessions"]?.options?.["exclude"]);
+	const owned = moduleOwned(context);
+	return catalogOf(context).tables.filter((table) => table.kind === "table" && table.rls && context.config.schemas.includes(table.schema) && !owned.schemas.has(table.schema) && !owned.tables.has(qualified(table)) && !exclude.some((pattern) => pattern.test(qualified(table))) && !table.policies.some((policy) => !policy.permissive && `${policy.using ?? ""} ${policy.check ?? ""}`.includes("session_active()"))).map((table) => ({
+		message: `${qualified(table)} has no restrictive session_active() policy, so a signed-out or revoked session keeps its access until the token expires. Set sql.modules.sessions.options.policies to true and run \`better-supabase sql sync\`, add the policy by hand, or list the table in sql.modules.sessions.options.exclude.`,
+		target: qualified(table),
+		object: tableObject(table)
+	}));
+}
+/** `better_supabase` and every `modules.*.schema` that `[api] schemas` serves through the Data API. */
+function exposedModuleSchemas(context) {
+	if (context.config.sql.moduleNames.length === 0) return [];
+	const moduleSchemas = /* @__PURE__ */ new Set(["better_supabase"]);
+	for (const module of Object.values(context.config.sql.modules)) if (module?.schema !== void 0) moduleSchemas.add(module.schema);
+	return exposedSchemas(context).filter((schema) => moduleSchemas.has(schema)).map((schema) => ({
+		message: `The Data API serves the module schema ${schema}, so its tables and internal helpers are reachable over REST and RPC. Remove it from [api] schemas in supabase/config.toml (and the dashboard's exposed schemas), set sql.modules.<module>.api to an exposed schema such as "api" so \`sql add\` writes security invoker entry points there, and call them with rpcTransport(supabase, { schema: "api" }).`,
 		target: schema
 	}));
 }
+/**
+* supautils' `reserved_roles` on Supabase. Nobody but a superuser may alter,
+* drop or change the memberships of these.
+*/
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_functions_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer"
+]);
+/** Reserved roles whose settings (`alter role ... set`) supautils allows changing. */
+const SETTINGS_ONLY_ROLES = /* @__PURE__ */ new Set([
+	"authenticator",
+	"authenticated",
+	"anon",
+	"service_role"
+]);
+/** Comments and string literals blanked, newlines kept so offsets map to lines. */
+const sqlCode = (text) => text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, "").replaceAll(/'(?:[^']|'')*'/g, "''");
+const roleNames = (list) => list.split(",").map((name) => name.trim().replaceAll("\"", "").toLowerCase()).filter((name) => name !== "");
+/** Why a statement changes a reserved role, or undefined when it doesn't. */
+function reservedRoleChange(statement) {
+	const alter = /^\s*(alter|drop)\s+(?:role|user)\s+(?:if\s+exists\s+)?("[^"]+"|\w+)\s*(\w*)/i.exec(statement);
+	if (alter) {
+		const role = roleNames(alter[2])[0];
+		const verb = alter[1].toLowerCase();
+		const next = alter[3].toLowerCase();
+		if (RESERVED_ROLES.has(role)) return `${verb}s the reserved role ${role}`;
+		if (SETTINGS_ONLY_ROLES.has(role) && (verb === "drop" || next !== "set" && next !== "reset" && next !== "in")) return `${verb}s the reserved role ${role}; only \`alter role ${role} set ...\` is allowed`;
+		return;
+	}
+	const membership = /^\s*(grant|revoke)\s+(?![\s\S]*\bon\b)([\w",\s]+?)\s+(?:to|from)\s+([\w",\s]+?)(?:\s+with\s+\w+\s+option)?\s*$/i.exec(statement);
+	if (!membership) return void 0;
+	const role = [...roleNames(membership[2]), ...roleNames(membership[3])].find((name) => RESERVED_ROLES.has(name));
+	return role === void 0 ? void 0 : `${membership[1].toLowerCase()}s a membership of the reserved role ${role}`;
+}
+/** Where a statement ends, including statements inside `do` blocks and function bodies. */
+const STATEMENT_BOUNDARY = /;|\$\w*\$|\b(?:begin|then|else|loop)\b/gi;
+/** Statements in schema files and migrations that supautils rejects on Supabase. */
+function reservedRoles(context) {
+	return (context.sqlFiles ?? []).flatMap((file) => {
+		const code = sqlCode(file.text);
+		const findings = [];
+		let start = 0;
+		for (const end of [...code.matchAll(STATEMENT_BOUNDARY), void 0]) {
+			const until = end?.index ?? code.length;
+			const statement = code.slice(start, until);
+			const reason = reservedRoleChange(statement);
+			if (reason !== void 0) {
+				const at = start + statement.search(/\S/);
+				const line = code.slice(0, at).split("\n").length;
+				findings.push({
+					message: `${file.path}:${String(line)} ${reason}. supautils rejects it on Supabase, so the migration fails on a hosted project; grant privileges to your own role instead.`,
+					target: `${file.path}:${String(line)}`,
+					location: {
+						file: file.path,
+						line
+					}
+				});
+			}
+			start = until + (end?.[0].length ?? 0);
+		}
+		return findings;
+	});
+}
 function migrationOptions(context) {
-	const kit = new Set(context.config.sql.kit);
-	return migrationOptionUses(context.config.kits).filter((use) => kit.has(use.module)).map((use) => ({
+	const module = new Set(context.config.sql.moduleNames);
+	return migrationOptionUses(context.config.sql.modules).filter((use) => module.has(use.module)).map((use) => ({
 		message: `${use.message} It exists to adopt an existing schema; remove it once your data matches the managed default.`,
-		target: `kits.${use.module}.options.${use.option}`
+		target: `sql.modules.${use.module}.options.${use.option}`
+	}));
+}
+/** A roles table shared by tenant and platform roles without `where` on both sides. */
+function sharedRoleTables(context) {
+	if (context.config.sql.moduleNames.length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind !== "provider") return [];
+	let problems;
+	try {
+		problems = sharedRolesProblems(context.config.sql.moduleNames, moduleLayout(context.config, context.config.sql.testsDir, [], entitlementsModule(context), access.access, permissionCatalogKeys(context)));
+	} catch {
+		return [];
+	}
+	return problems.map(({ setting, message }) => ({
+		message: `${message} Without it, ${setting.startsWith("sql.modules.tenant.") ? "an organization invitation, accept or role change can resolve a platform role" : "a platform invitation can resolve a tenant role"}.`,
+		target: setting
 	}));
 }
-const KIT_RULES = [
+const MODULE_RULES = [
 	{
 		code: "BS307",
 		severity: "error",
-		title: "Custom kit module without its contract",
-		description: "A module in `kits` uses `mode: 'custom'`, so the app writes its contract functions. One is missing or has another signature, and the modules and TypeScript APIs that call it fail at run time.",
+		title: "Custom SQL module without its contract",
+		description: "A module in `sql.modules` uses `mode: 'custom'`, so the app writes its contract functions. One is missing or has another signature, and the modules and TypeScript APIs that call it fail at run time.",
 		check: missingContracts
 	},
 	{
 		code: "BS308",
 		severity: "warning",
 		title: "Tenant claim the hook does not write",
-		description: "With the `tenant` module and `kits.access.activeTenant: 'claim'`, `current_tenant_id()` and the `tenant()` plugin read the tenant from the `claims.tenant` claim, at the top level or in `app_metadata`. With `--as <user id>` doctor calls the custom access token hook for that user and warns when the claims it returns have neither. The default source, `'resolver'`, takes the tenant from the request instead.",
+		description: "With the `tenant` module and `sql.modules.access.activeTenant: 'claim'`, `current_tenant_id()` and the `tenant()` plugin read the tenant from the `claims.tenant` claim, at the top level or in `app_metadata`. With `--as <user id>` doctor calls the custom access token hook for that user and warns when the claims it returns have neither. The default source, `'resolver'`, takes the tenant from the request instead.",
 		check: missingTenantClaim
 	},
 	{
 		code: "BS309",
 		severity: "warning",
-		title: "Deprecated SQL kit symbol",
-		description: "A schema file or policy uses a function, table, column or claim that a kit module deprecated or removed. Deprecated symbols keep a wrapper for at least one minor release; removed ones fail at run time.",
+		title: "Deprecated SQL module symbol",
+		description: "A schema file or policy uses a function, table, column or claim that a SQL module deprecated or removed. Deprecated symbols keep a wrapper for at least one minor release; removed ones fail at run time.",
 		check: deprecatedSymbols
 	},
 	{
 		code: "BS310",
 		severity: "warning",
-		title: "Duplicate kit trigger",
-		description: "A table has a kit trigger (`bs_updated_at`, `bs_audit`) and another trigger that does the same work, so both run on every write.",
+		title: "Duplicate module trigger",
+		description: "A table has a module trigger (`bs_updated_at`, `bs_audit`) and another trigger that does the same work, so both run on every write.",
 		check: duplicateTriggers
 	},
 	{
 		code: "BS313",
 		severity: "warning",
 		title: "Rate limits not wired to PostgREST",
-		description: "The `rate-limit` module is in `sql.kit`, but on the live database `pgrst.db_pre_request` for the `authenticator` role is unset or names a function that doesn't call `better_supabase.check_request()`, so Data API requests are never counted.",
+		description: "The `rate-limit` module is in `sql.modules`, but on the live database `pgrst.db_pre_request` for the `authenticator` role is unset or names a function that doesn't call `better_supabase.check_request()`, so Data API requests are never counted.",
 		check: rateLimitHook
 	},
 	{
 		code: "BS312",
 		severity: "error",
-		title: "Kit schema exposed through the Data API",
-		description: "`[api] schemas` in `config.toml` lists `better_supabase` or a `kits.*.schema`. The kit schemas hold internal tables and helpers that are granted to `authenticated` for policies, so exposing them makes those callable over REST and RPC.",
-		check: exposedKitSchemas
+		title: "Module schema exposed through the Data API",
+		description: "`[api] schemas` in `config.toml` lists `better_supabase` or a `modules.*.schema`. The module schemas hold internal tables and helpers that are granted to `authenticated` for policies, so exposing them makes those callable over REST and RPC.",
+		check: exposedModuleSchemas
 	},
 	{
 		code: "BS314",
 		severity: "warning",
-		title: "Migration-only kit option",
-		description: "A module in adopt mode sets an option that only exists to match an existing schema: plain invitation tokens, webhook secrets in a column, non-text webhook ids, or a custom outbox source. Remove it once the data matches the managed default.",
+		title: "Migration-only module option",
+		description: "A module in adopt mode sets an option that only exists to match an existing schema: plain invitation tokens, webhook secrets in a column, non-text webhook ids, a custom outbox source, or audit values mapped to an adopted log's. Remove it once the data matches the managed default.",
 		check: migrationOptions
+	},
+	{
+		code: "BS315",
+		severity: "warning",
+		title: "Table without an audit trigger",
+		description: "The `audit` module is in `sql.modules`, and a table in `schemas` has no `bs_audit` trigger (or another trigger that calls `audit_row_change()`), so its changes are not in the audit log. The module's own schemas and the tables SQL modules adopt are skipped; `sql.modules.audit.options.exempt` lists more, as `schema.table` globs such as `public.*_archive`.",
+		check: unauditedTables
+	},
+	{
+		code: "BS319",
+		severity: "error",
+		title: "SQL alters a reserved role",
+		description: "A schema file, SQL module or migration alters, drops or changes the memberships of a role supautils reserves on Supabase (`supabase_admin`, `supabase_auth_admin`, `supabase_storage_admin`, `pgbouncer` and the other platform roles). The statement fails on a hosted project. `authenticator`, `authenticated`, `anon` and `service_role` accept `alter role ... set` (for example `pgrst.db_pre_request` or `statement_timeout`) and nothing else.",
+		check: reservedRoles
+	},
+	{
+		code: "BS320",
+		severity: "warning",
+		title: "Table without the session policy",
+		description: "The `sessions` module is in `sql.modules`, and a table with RLS in `schemas` has no restrictive policy that calls `better_supabase.session_active()`, so a token whose session was signed out, or whose user was banned or deleted, keeps reaching it until it expires. `sql.modules.sessions.options.policies` writes the policy on every table; `options.exclude` lists the tables to skip, as `schema.table` globs.",
+		check: sessionlessTables
+	},
+	{
+		code: "BS322",
+		severity: "warning",
+		title: "Audit registration of a dropped table",
+		description: "The `audit` module is in `sql.modules`, and `better_supabase.audited_tables` on the live database has a row whose table no longer exists. A table dropped before the module's `sql_drop` event trigger was installed keeps its row; the module's data migration deletes such rows.",
+		check: danglingAuditRegistrations
+	},
+	{
+		code: "BS323",
+		severity: "warning",
+		title: "Module event trigger missing",
+		description: "A module in `sql.modules` creates an event trigger (`bs_audit_forget_dropped` for `audit`, `bs_ensure_rls` for `ensure-rls`) that the live database lacks, or, without a database, that no migration creates. Event triggers belong to no schema, so a schema diff limited to some schemas leaves them out; the module's data migration creates them.",
+		check: missingEventTriggers
+	},
+	{
+		code: "BS324",
+		severity: "error",
+		title: "Shared roles table without a role condition",
+		description: "Under the `provider` model, the tenant module's `roleThrough` and the invitations module's `platformRoles.through` name the same roles table, and one of them has no `where` condition on `{row}`. That side then resolves a role id or key of the other kind: an organization invitation, accept or `update_member_role` can grant a platform role, or a platform invitation a tenant role. `sql sync` refuses the config; set `where` on both, such as `{row}.scope = 'organization'` and `{row}.scope = 'system'`.",
+		check: sharedRoleTables
+	},
+	{
+		code: "BS325",
+		severity: "warning",
+		title: "Audit log readable only as the service role",
+		description: "The `audit` module defaults `eventRoles` to `service_role` and `readPolicy` to false, so `audit.list()` under a user session is 403. Set `options.readPolicy: true` and include `authenticated` in `options.eventRoles` when the app lists the log as the signed-in user.",
+		check: auditUserSession
+	},
+	{
+		code: "BS326",
+		severity: "warning",
+		title: "Admin Auth call without a secret key in env files",
+		description: "`deleteAccount` and `bs.admin()` need `SUPABASE_SECRET_KEY`. The env files doctor reads do not set it, so those calls fail at run time.",
+		check: missingSecretKey
+	},
+	{
+		code: "BS327",
+		severity: "warning",
+		title: "aal2 required without MFA enabled",
+		description: "The app calls `requireAal('aal2')` (or otherwise requires aal2), but `[auth.mfa.totp]` in `config.toml` does not enable enroll and verify, so no user can satisfy the check.",
+		check: aal2WithoutMfa
+	}
+];
+function auditUserSession(context) {
+	if (!context.config.sql.moduleNames.includes("audit")) return [];
+	const options = context.config.sql.modules["audit"]?.options ?? {};
+	const roles = Array.isArray(options["eventRoles"]) ? options["eventRoles"].filter((role) => typeof role === "string") : ["service_role"];
+	if (options["readPolicy"] === true && roles.includes("authenticated")) return [];
+	if (!context.sources.some((file) => /\baudit\.(list|listAll)\s*\(/.test(file.text))) return [];
+	return [{
+		message: "sql.modules.audit leaves the log readable only as the service role (`eventRoles` defaults to service_role, `readPolicy` defaults to false), but the app calls audit.list() or audit.listAll() as a user. Set options.readPolicy to true and include authenticated in options.eventRoles.",
+		target: "sql.modules.audit"
+	}];
+}
+function missingSecretKey(context) {
+	if (!context.sources.some((file) => /\bdeleteAccount\b|\.admin\s*\(|supabaseAdmin\b/.test(file.text))) return [];
+	if (context.envFiles.some((file) => /^\s*(?:SUPABASE_SECRET_KEY|SUPABASE_SERVICE_ROLE_KEY)\s*=/m.test(file.text))) return [];
+	return [{
+		message: "The app calls deleteAccount or bs.admin(), which need SUPABASE_SECRET_KEY, but no env file doctor reads sets it. Add it to .env.local (and the hosted environments), listed without a value in .env.example.",
+		target: "SUPABASE_SECRET_KEY"
+	}];
+}
+function aal2WithoutMfa(context) {
+	const toml = context.configToml;
+	if (!toml) return [];
+	if (!context.sources.some((file) => /requireAal\s*\(\s*['"]aal2['"]/.test(file.text))) return [];
+	const enroll = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"enroll_enabled"
+	]);
+	const verify = tomlGet(toml.document, [
+		"auth",
+		"mfa",
+		"totp",
+		"verify_enabled"
+	]);
+	if (enroll === true && verify === true) return [];
+	return [{
+		message: "The app requires aal2, but [auth.mfa.totp] in config.toml does not set enroll_enabled and verify_enabled to true, so no user can satisfy the check.",
+		target: toml.path,
+		location: {
+			file: toml.path,
+			line: lineOf(toml.text, /^\[auth\.mfa\.totp\]/) ?? 1
+		}
+	}];
+}
+//#endregion
+//#region src/cli/doctor/pgdelta.ts
+/** Comments blanked out, so a commented-out statement never matches and line numbers stay. */
+function withoutComments(text) {
+	return text.replaceAll(/\/\*[\s\S]*?\*\//g, (comment) => comment.replaceAll(/[^\n]/g, " ")).replaceAll(/--[^\n]*/g, (comment) => " ".repeat(comment.length));
+}
+const lineAt = (text, index) => text.slice(0, index).split("\n").length;
+/**
+* The declarative schema files pg-delta loads, outside the SQL module files
+* better-supabase writes, when the project diffs with pg-delta.
+*/
+function pgdeltaSchemaFiles(context) {
+	const toml = context.configToml;
+	if (toml === void 0 || diffEngine(toml) !== "pg-delta") return [];
+	const schemas = `${toml.dir}/schemas/`;
+	return (context.sqlFiles ?? []).filter((file) => file.path.startsWith(schemas) && !/^-- @bs-module /m.test(file.text));
+}
+const BULK_GRANT = /\bgrant\b[^;]*?\bon\s+all\s+(tables|routines|functions|procedures|sequences)\s+in\s+schema\s+("?[\w$]+"?(?:\s*,\s*"?[\w$]+"?)*)\s+to\s+([^;]*)/gi;
+/** Grantees a bulk grant must not reach: the Data API roles and `public`. */
+const API_ROLES$1 = /\b(anon|authenticated|public)\b/i;
+/** `do` blocks; group 2 is the body. */
+const DO_BLOCK = /\bdo\s+(\$[\w]*\$)([\s\S]*?)\1/gi;
+const CATALOG = /\b(information_schema\.\w+|(?:pg_catalog\.)?pg_(?:class|tables|views|proc|namespace|attribute|trigger|constraint|index|type|policies|matviews))\b/i;
+const EXECUTES = /\b(execute|perform)\b/i;
+function bulkGrants(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(BULK_GRANT)].filter((match) => API_ROLES$1.test(match[3])).map((match) => ({
+			message: `${file.path} grants on all ${match[1].toLowerCase()} in schema ${match[2]} at once. pg-delta gives a bulk grant no dependency position, so it can run after the per-object revokes and open functions and tables to anon and authenticated again. Grant each object by name next to its definition, or set Supabase default privileges (alter default privileges in schema ... grant ...) for objects created later.`,
+			target: file.path,
+			location: {
+				file: file.path,
+				line: lineAt(text, match.index)
+			}
+		}));
+	});
+}
+function catalogLoops(context) {
+	return pgdeltaSchemaFiles(context).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(DO_BLOCK)].flatMap((match) => {
+			const body = match[2];
+			const catalog = CATALOG.exec(body);
+			if (!catalog || !EXECUTES.test(body)) return [];
+			return [{
+				message: `${file.path} has a do block that reads ${catalog[1]} to create objects. pg-delta runs a do block with no dependency position, before the tables it looks for exist, so it creates nothing and the diff never sees its objects. Write the statements it would generate (one trigger, grant or policy per table) as static SQL, or call a per-table function such as better_supabase.audit('<table>') or track_updated_at('<table>') once per table.`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt(text, match.index)
+				}
+			}];
+		});
+	});
+}
+const CREATE_EXTENSION = /\bcreate\s+extension\s+(?:if\s+not\s+exists\s+)?"?([\w-]+)"?/gi;
+/**
+* Extensions a pg-delta schema file creates, SQL module files included, that
+* no migration creates. pg-delta can leave an extension that owns its own
+* schema (`pgmq`) out of the generated migration.
+*/
+function missingExtensions(context) {
+	const toml = context.configToml;
+	if (toml === void 0 || diffEngine(toml) !== "pg-delta") return [];
+	const files = context.sqlFiles ?? [];
+	const migrations = files.filter((file) => file.path.startsWith(`${toml.dir}/migrations/`));
+	if (migrations.length === 0) return [];
+	const created = new Set(migrations.flatMap((file) => [...withoutComments(file.text).matchAll(CREATE_EXTENSION)].map((match) => match[1].toLowerCase())));
+	const seen = /* @__PURE__ */ new Set();
+	return files.filter((file) => file.path.startsWith(`${toml.dir}/schemas/`)).flatMap((file) => {
+		const text = withoutComments(file.text);
+		return [...text.matchAll(CREATE_EXTENSION)].flatMap((match) => {
+			const name = match[1].toLowerCase();
+			if (created.has(name) || seen.has(name)) return [];
+			seen.add(name);
+			const module = /^-- @bs-module /m.test(file.text);
+			return [{
+				message: `${file.path} creates the extension ${name}, but no migration creates it. pg-delta can leave an extension that owns its own schema out of the generated migration, and a database built from the migrations then lacks it. ${module ? "Run `better-supabase sql sync`: it writes the extension into a migration that runs before the schema migration." : `Add \`create extension if not exists ${name};\` to a migration that runs before the one that uses it.`}`,
+				target: file.path,
+				location: {
+					file: file.path,
+					line: lineAt(text, match.index)
+				}
+			}];
+		});
+	});
+}
+/** Statements in declarative schema files that pg-delta can't order. */
+const PGDELTA_RULES = [
+	{
+		code: "BS317",
+		severity: "warning",
+		title: "Bulk grant in a pg-delta schema file",
+		description: "A `grant ... on all tables|routines|sequences in schema ... to anon|authenticated|public` statement in `supabase/schemas` under pg-delta. pg-delta can't place it after the objects it covers or before the revokes that narrow them, so it can re-open functions and tables to `anon` and `authenticated`.",
+		check: bulkGrants
+	},
+	{
+		code: "BS318",
+		severity: "warning",
+		title: "Catalog loop in a pg-delta schema file",
+		description: "A `do` block in `supabase/schemas` under pg-delta that reads the catalog (`information_schema`, `pg_class`, ...) to create objects. pg-delta runs it before the tables exist, so it creates nothing.",
+		check: catalogLoops
+	},
+	{
+		code: "BS321",
+		severity: "warning",
+		title: "Extension missing from the migrations under pg-delta",
+		description: "A `create extension` in `supabase/schemas` (a SQL module's file included) under pg-delta that no migration repeats. pg-delta can leave an extension that owns its own schema, such as `pgmq`, out of the generated migration.",
+		check: missingExtensions
 	}
 ];
 //#endregion
@@ -1292,7 +1872,7 @@ function grantColumns(context) {
 		if (existing) return existing;
 		const created = {
 			helpers: /* @__PURE__ */ new Set(),
-			permdock: false
+			provider: false
 		};
 		byColumn.set(column, created);
 		return created;
@@ -1306,20 +1886,22 @@ function grantColumns(context) {
 			if (qualifiedColumn.test(body) || read.length === 1 && bare.test(body)) entry(qualified(table), column.name).helpers.add(helper);
 		}
 	}
-	for (const deciding of context.permdock?.manifest?.decidingColumns ?? []) {
+	for (const deciding of context.config.authorization?.decidingColumns ?? []) {
 		const dot = deciding.lastIndexOf(".");
-		if (dot > 0) entry(deciding.slice(0, dot), deciding.slice(dot + 1)).permdock = true;
+		if (dot > 0) entry(deciding.slice(0, dot), deciding.slice(dot + 1)).provider = true;
 	}
 	return columns;
 }
 /** Whether `role` may run `command` on rows of `table` at all: no RLS, or a permissive policy for it. */
 const policyAllows = (table, command, role) => !table.rls || table.policies.some((policy) => policy.permissive && (policy.command === "all" || policy.command === command) && appliesTo(policy, role));
+/** Whether `grant` reaches `role`: granted to it, or to PUBLIC, which every role inherits. */
+const grantsTo = (grant, role) => grant.role === role || grant.role === "PUBLIC";
 /** The grant columns `role` may write with `command`, through a table-level or a column-level grant. */
 function writableColumns(table, columns, command, role) {
 	if (!policyAllows(table, command, role)) return [];
 	const privilege = command.toUpperCase();
-	if (table.grants.some((grant) => grant.role === role && grant.privileges.includes(privilege))) return [...columns];
-	return columns.filter((column) => (table.columnGrants ?? []).some((grant) => grant.role === role && grant.column === column && grant.privileges.includes(privilege)));
+	if (table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege))) return [...columns];
+	return columns.filter((column) => (table.columnGrants ?? []).some((grant) => grantsTo(grant, role) && grant.column === column && grant.privileges.includes(privilege)));
 }
 /** PostgREST's default for `db-hoisted-tx-settings`. */
 const DEFAULT_HOISTED = [
@@ -1389,24 +1971,28 @@ const RLS_RULES = [
 		code: "BS207",
 		severity: "warning",
 		title: "Several permissive policies for one command and role",
-		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. This replaces splinter's `multiple_permissive_policies` lint for the same table.",
-		check: (context) => rlsTables(context).flatMap((table) => {
-			const overlaps = permissiveOverlaps(table);
-			if (overlaps.length === 0) return [];
-			const first = table.policies.find((policy) => policy.name === overlaps[0].policies[0]);
-			const list = overlaps.map((overlap) => `${overlap.command} for ${overlap.role}: ${overlap.policies.join(", ")}`).join("; ");
-			return [{
-				message: `${qualified(table)} has several permissive policies per command and role (${list}). Postgres runs all of them for every row; merge each group into one policy.`,
-				target: qualified(table),
-				object: policyObject(table, first)
-			}];
-		})
+		description: "Postgres evaluates every permissive policy that applies and ORs them, so each extra policy adds its cost to every row. Merge them into one policy per command and role. When the performance advisor (BS200) runs, splinter's `multiple_permissive_policies` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "multiple_permissive_policies");
+			return rlsTables(context).flatMap((table) => {
+				if (splinter?.has(qualified(table))) return [];
+				const overlaps = permissiveOverlaps(table);
+				if (overlaps.length === 0) return [];
+				const first = table.policies.find((policy) => policy.name === overlaps[0].policies[0]);
+				const list = overlaps.map((overlap) => `${overlap.command} for ${overlap.role}: ${overlap.policies.join(", ")}`).join("; ");
+				return [{
+					message: `${qualified(table)} has several permissive policies per command and role (${list}). Postgres runs all of them for every row; merge each group into one policy.`,
+					target: qualified(table),
+					object: policyObject(table, first)
+				}];
+			});
+		}
 	},
 	{
 		code: "BS213",
 		severity: "warning",
 		title: "API roles can write the columns that grant access",
-		description: "RLS helpers decide access from columns such as `memberships.user_id`, `memberships.role` or `contacts.customer_id`, and PermDock's manifest lists them as `decidingColumns`. When `anon` or `authenticated` may insert or update one of them, and a policy lets them write the row, a user can grant themselves access. A table-level grant counts even after a column-level revoke.",
+		description: "RLS helpers decide access from columns such as `memberships.user_id`, `memberships.role` or `contacts.customer_id`, and an authorization provider lists them as `decidingColumns`. When `anon` or `authenticated` may insert or update one of them, and a policy lets them write the row, a user can grant themselves access. A table-level grant counts even after a column-level revoke.",
 		check: (context) => {
 			const tables = new Map(catalogOf(context).tables.map((table) => [qualified(table), table]));
 			return [...grantColumns(context)].flatMap(([name, byColumn]) => {
@@ -1421,18 +2007,24 @@ const RLS_RULES = [
 						const writable = writableColumns(table, columns, command, role);
 						if (writable.length === 0) continue;
 						writes.push(`${role} may ${command} ${writable.join(", ")}`);
-						if (table.grants.some((grant) => grant.role === role && grant.privileges.includes(command.toUpperCase()))) tableLevel.push(command);
-						else fix.push(`revoke ${command} (${writable.join(", ")}) on ${name} from ${role};`);
+						const privilege = command.toUpperCase();
+						if (table.grants.some((grant) => grantsTo(grant, role) && grant.privileges.includes(privilege))) {
+							tableLevel.push(command);
+							continue;
+						}
+						const fromPublic = (table.columnGrants ?? []).some((grant) => grant.role === "PUBLIC" && writable.includes(grant.column) && grant.privileges.includes(privilege));
+						fix.push(`revoke ${command} (${writable.join(", ")}) on ${name} from ${fromPublic ? `${role}, public` : role};`);
 					}
 					if (tableLevel.length === 0) continue;
-					fix.push(`revoke ${tableLevel.join(", ")} on ${name} from ${role};`);
+					const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && tableLevel.some((command) => grant.privileges.includes(command.toUpperCase())));
+					fix.push(`revoke ${tableLevel.join(", ")} on ${name} from ${fromPublic ? `${role}, public` : role};`);
 					const rest = table.columns.map((column) => column.name).filter((column) => !byColumn.has(column));
 					if (rest.length > 0) fix.push(`grant ${tableLevel.map((command) => `${command} (${rest.join(", ")})`).join(", ")} on ${name} to ${role};`);
 				}
 				if (writes.length === 0) return [];
 				const helpers = [...new Set(columns.flatMap((column) => [...byColumn.get(column).helpers]))].sort();
-				const permdock = columns.filter((column) => byColumn.get(column).permdock);
-				const readers = [...helpers.length > 0 ? [`${helpers.join(", ")} read${helpers.length === 1 ? "s" : ""} them to decide access`] : [], ...permdock.length > 0 ? [`PermDock's manifest lists ${permdock.join(", ")} as deciding columns, which PD028 protects`] : []].join(", and ");
+				const deciding = columns.filter((column) => byColumn.get(column).provider);
+				const readers = [...helpers.length > 0 ? [`${helpers.join(", ")} read${helpers.length === 1 ? "s" : ""} them to decide access`] : [], ...deciding.length > 0 ? [`the authorization provider lists ${deciding.join(", ")} as deciding columns`] : []].join(", and ");
 				return [{
 					message: `${name}: ${writes.join("; ")}. ${readers}, so a user who writes them can grant themselves access. Revoke the columns and grant the rest:\n${fix.join("\n")}`,
 					target: name,
@@ -1474,7 +2066,7 @@ const RLS_RULES = [
 //#region src/cli/doctor/policies.ts
 const AUTH_ROLE = /\bauth"?\s*\.\s*"?role"?\s*\(\s*\)/i;
 /** A check of who is calling: the JWT, the user id, or the session role. */
-const CALLER_CHECK = /\bauth"?\s*\.\s*"?(?:uid|jwt)"?\s*\(|request\.jwt|\b(?:current_user|session_user|current_role)\b|has_org_role|member_org_ids/i;
+const CALLER_CHECK = /\bauth"?\s*\.\s*"?(?:uid|jwt)"?\s*\(|request\.jwt|\b(?:current_user|session_user|current_role)\b|has_organization_role|member_organization_ids/i;
 const USER_METADATA = /\buser_metadata\b/i;
 /** Privileges an API role never needs on a table. */
 const NEEDLESS = [
@@ -1704,15 +2296,18 @@ const SCHEMA_DESIGN_RULES = [
 		code: "BS216",
 		severity: "info",
 		title: "Foreign key without an index",
-		description: "Deletes and updates on the referenced table scan the referencing table for each row, and joins on the key can't use an index. Add an index that starts with the key's columns. This replaces splinter's `unindexed_foreign_keys` for the same table and also runs on a saved snapshot.",
-		check: (context) => exposed(context).flatMap((table) => {
-			if (table.kind !== "table") return [];
-			return unindexedForeignKeys(table).map((key) => ({
-				message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) has no index that starts with its columns, so deletes on ${key.refSchema}.${key.refTable} scan ${qualified(table)}. Run \`create index on ${qualified(table)} (${key.columns.join(", ")});\`.`,
-				target: `${qualified(table)}.${key.name}`,
-				object: tableObject(table)
-			}));
-		})
+		description: "Deletes and updates on the referenced table scan the referencing table for each row, and joins on the key can't use an index. Add an index that starts with the key's columns. When the performance advisor (BS200) runs, splinter's `unindexed_foreign_keys` reports a table it covers and this rule skips it; on a saved snapshot this rule reports every table.",
+		check: async (context) => {
+			const splinter = await splinterTables(context, "unindexed_foreign_keys");
+			return exposed(context).flatMap((table) => {
+				if (table.kind !== "table" || splinter?.has(qualified(table))) return [];
+				return unindexedForeignKeys(table).map((key) => ({
+					message: `${qualified(table)}.${key.name} (${key.columns.join(", ")}) has no index that starts with its columns, so deletes on ${key.refSchema}.${key.refTable} scan ${qualified(table)}. Run \`create index on ${qualified(table)} (${key.columns.join(", ")});\`.`,
+					target: `${qualified(table)}.${key.name}`,
+					object: tableObject(table)
+				}));
+			});
+		}
 	},
 	{
 		code: "BS217",
@@ -1819,6 +2414,27 @@ const SCHEMA_DESIGN_RULES = [
 				}];
 			}));
 		}
+	},
+	{
+		code: "BS222",
+		severity: "warning",
+		title: "Column that can exceed a JavaScript number",
+		description: "`int8` and `numeric` decode as `number` by default, which matches `supabase gen types` but loses precision past 2^53 (or 15 to 17 significant digits). An `int8` identity or sequence keeps growing toward that limit, and `numeric` usually holds exact amounts. Set `codecs.int8` to `bigint` or `string`, or `codecs.numeric` to `string`.",
+		check: (context) => {
+			const { int8, numeric } = context.config.codecs;
+			if (int8 !== "number" && numeric !== "number") return [];
+			return exposed(context).flatMap((table) => {
+				if (configFor(context.config.tables, table.schema, table.name)?.exclude) return [];
+				const columns = table.columns.filter((column) => column.udt === "int8" ? int8 === "number" && !column.isArray && (column.identity !== null || (column.default?.includes("nextval(") ?? false)) : column.udt === "numeric" && numeric === "number");
+				if (columns.length === 0) return [];
+				const codecs = [...columns.some((column) => column.udt === "int8") ? ["`int8: \"bigint\"`"] : [], ...columns.some((column) => column.udt === "numeric") ? ["`numeric: \"string\"`"] : []];
+				return [{
+					message: `${qualified(table)} ${columns.map((column) => `${column.name} (${column.udt})`).join(", ")} decode as number and lose precision past 2^53. Set ${codecs.join(" and ")} in \`codecs\`.`,
+					target: qualified(table),
+					object: tableObject(table)
+				}];
+			});
+		}
 	}
 ];
 //#endregion
@@ -1827,29 +2443,40 @@ const DOCS_URL = "https://bettersupabase.com/docs/cli/doctor";
 const writes = (policy) => policy.command === "all" || policy.command === "insert" || policy.command === "update" || policy.command === "delete";
 const publicRoles = (policy) => policy.roles.length === 0 || policy.roles.some((role) => role === "public" || role === "anon");
 const isTrue = (expression) => expression !== null && /^\(*\s*true\s*\)*$/i.test(expression.trim());
-/** The `sql.kit` files as this release renders them, next to what is on disk. */
-async function kitFiles(context) {
-	if (context.config.sql.kit.length === 0) return [];
+/** The `sql.modules` files as this release renders them, next to what is on disk. */
+async function moduleFiles(context) {
+	if (context.config.sql.moduleNames.length === 0) return [];
+	const access = accessModule(context);
+	if (access.kind === "invalid") return [];
 	const readSets = context.readSets;
 	const skipped = readSets !== void 0 && "skipped" in readSets;
-	const files = renderKit(context.config.sql.kit, kitLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsKit(context))).filter((file) => !(skipped && file.module === "read-sets"));
+	let rendered;
+	try {
+		rendered = renderModules(context.config.sql.moduleNames, {
+			...moduleLayout(context.config, context.config.sql.testsDir, skipped ? [] : readSets, entitlementsModule(context), access.kind === "provider" ? access.access : void 0, permissionCatalogKeys(context)),
+			schemasDir: declarativeSchemasDir(context.configToml)
+		});
+	} catch {
+		return [];
+	}
+	const files = rendered.filter((file) => !(skipped && file.module === "read-sets"));
 	return Promise.all(files.map(async (file) => {
 		const current = await readFile(resolve(context.config.root, file.path), "utf8").catch(() => void 0);
-		const version = kitFileVersion(file.contents)?.version ?? 1;
+		const version = moduleFileVersion(file.contents)?.version ?? 1;
 		return {
 			file,
 			current,
-			behind: current !== void 0 && (kitFileVersion(current)?.version ?? 1) < version
+			behind: current !== void 0 && (moduleFileVersion(current)?.version ?? 1) < version
 		};
 	}));
 }
-async function kitVersionsBehind(context) {
+async function moduleVersionsBehind(context) {
 	const findings = [];
 	const upgrade = "Run `better-supabase sql upgrade`";
-	for (const { file, current, behind } of await kitFiles(context)) {
+	for (const { file, current, behind } of await moduleFiles(context)) {
 		if (!behind || current === void 0) continue;
 		findings.push({
-			message: `${file.path} has ${file.module} version ${String(kitFileVersion(current)?.version ?? 1)}; this release ships version ${String(kitFileVersion(file.contents)?.version ?? 1)}. ${upgrade}, then \`${migrationCommand(context.configToml)}\`.`,
+			message: `${file.path} has ${file.module} version ${String(moduleFileVersion(current)?.version ?? 1)}; this release ships version ${String(moduleFileVersion(file.contents)?.version ?? 1)}. ${upgrade}, then \`${migrationCommand(context.configToml)}\`.`,
 			target: file.path,
 			location: {
 				file: file.path,
@@ -1858,21 +2485,21 @@ async function kitVersionsBehind(context) {
 		});
 	}
 	const db = context.database;
-	if (!db || "skipped" in db || context.config.sql.kit.length === 0) return findings;
+	if (!db || "skipped" in db || context.config.sql.moduleNames.length === 0) return findings;
 	let rows;
 	try {
-		rows = await db.query("select name, version from better_supabase.kit_modules");
+		rows = await db.query("select name, version from better_supabase.modules");
 	} catch {
 		return findings;
 	}
 	for (const row of rows) {
 		const module = SQL_MODULES[row.name];
-		if (!module || !context.config.sql.kit.includes(row.name)) continue;
+		if (!module || !context.config.sql.moduleNames.includes(row.name)) continue;
 		const version = moduleVersion(module);
 		if (row.version >= version) continue;
 		findings.push({
 			message: `The database has ${row.name} version ${String(row.version)}; this release ships version ${String(version)}. ${upgrade} and apply the migrations it prints.`,
-			target: `better_supabase.kit_modules.${row.name}`
+			target: `better_supabase.modules.${row.name}`
 		});
 	}
 	return findings;
@@ -1907,70 +2534,6 @@ function envEntries(file) {
 		}];
 	});
 }
-const ADVISOR_SEVERITY = {
-	ERROR: "error",
-	WARN: "warning",
-	INFO: "info"
-};
-function lintObject(lint) {
-	const { schema, name, type } = lint.metadata ?? {};
-	if (typeof schema !== "string" || typeof name !== "string") return void 0;
-	if (type === "table" || type === "view") return {
-		kind: "table",
-		schema,
-		name
-	};
-	if (type === "function") return {
-		kind: "function",
-		schema,
-		name
-	};
-}
-function lintFinding(lint) {
-	const object = lintObject(lint);
-	return {
-		severity: ADVISOR_SEVERITY[lint.level] ?? "warning",
-		title: lint.title,
-		message: `${lint.detail.replaceAll("\\`", "`")} [${lint.name}]`,
-		target: object ? `${object.schema}.${object.name}` : lint.cache_key,
-		help: lint.remediation,
-		...object ? { object } : {}
-	};
-}
-function advisorRule(code, category, title, description, covered = () => false) {
-	return {
-		code,
-		severity: "warning",
-		title,
-		description,
-		async check(context) {
-			const { advisors } = context;
-			if (!advisors) return [];
-			if ("skipped" in advisors) return [{
-				severity: "info",
-				message: `Skipped the ${category} advisor: ${advisors.skipped}`
-			}];
-			try {
-				return (await advisors.lints(category)).filter((lint) => !covered(lint, context)).map(lintFinding);
-			} catch (cause) {
-				return [{ message: `The ${category} advisor could not run (${advisors.describe}): ${cause instanceof Error ? cause.message : String(cause)}` }];
-			}
-		}
-	};
-}
-/**
-* splinter lints doctor's own rules report for the same table:
-* `multiple_permissive_policies` (BS207) and `unindexed_foreign_keys` (BS216).
-*/
-function coveredByOwnRules(lint, context) {
-	const code = lint.name === "multiple_permissive_policies" ? "BS207" : lint.name === "unindexed_foreign_keys" ? "BS216" : void 0;
-	if (!code || !context.codes?.includes(code)) return false;
-	const object = lintObject(lint);
-	if (!object) return false;
-	const table = exposed(context).find((candidate) => candidate.schema === object.schema && candidate.name === object.name);
-	if (!table) return false;
-	return code === "BS207" ? permissiveOverlaps(table).length > 0 : unindexedForeignKeys(table).length > 0;
-}
 /**
 * `db.x.aggregate(`, an `_sum:`/`_avg:`/`_min:`/`_max:` include or a list
 * with `facetCounts: true`.
@@ -1978,11 +2541,12 @@ function coveredByOwnRules(lint, context) {
 const AGGREGATE_USE = /\.aggregate\(|\b_(?:sum|avg|min|max)\s*:\s*\{|\bfacetCounts\s*:\s*true\b/;
 /**
 * A policy that reads memberships or the tenant claim: `is_member(...)`,
-* `current_tenant_id()`, `memberships`, PermDock's `permitted_*_ids()`.
+* `current_tenant_id()`, `memberships`. The authorization provider's
+* functions (`authorization.requires`) count too.
 */
-const TENANT_HELPER = /member|tenant|current_org|org_id|permitted_\w+_ids/i;
+const TENANT_HELPER = /member|tenant|current_org|org_id/i;
 /** A foreign key to the tenant table itself, whose own policies are usually read-only. */
-const TENANT_COLUMN = /^(?:org|organization|tenant|team|workspace|account)_id$/;
+const TENANT_COLUMN = /^(?:organization|organization|tenant|team|workspace|account)_id$/;
 const COMMANDS = [
 	"select",
 	"insert",
@@ -2008,20 +2572,34 @@ const RULES = [
 			code: "BS106",
 			severity: "error",
 			title: "Table not granted to the Data API",
-			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated.",
+			description: "Supabase no longer grants new tables to anon and authenticated. Without a grant, every Data API request fails with 42501 before RLS runs. Tables in `expose` need the privileges listed there; other tables need `select` for authenticated. Tables marked `serviceRole` in `tables` must have no grants for either role.",
 			check: (context) => {
 				const auto = context.configToml ? tomlGet(context.configToml.document, ["api", "auto_expose_new_tables"]) : void 0;
 				const note = auto === false || auto === "false" ? " config.toml sets [api] auto_expose_new_tables = false, so new tables start without grants." : "";
 				return exposed(context).flatMap((table) => {
-					if (context.config.tables[table.name]?.exclude) return [];
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude) return [];
+					const granted = (role) => new Set(table.grants.filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
+					if (options?.serviceRole) {
+						const fromPublic = table.grants.some((grant) => grant.role === "PUBLIC" && grant.privileges.length > 0);
+						return ["anon", "authenticated"].flatMap((role) => {
+							const have = [...granted(role)];
+							if (have.length === 0) return [];
+							const from = fromPublic ? `${role}, public` : role;
+							return [{
+								message: `${qualified(table)} has \`serviceRole: true\` in \`tables\`, but ${role} has ${have.join(", ")} on it, so the Data API reaches it. Remove it from \`expose\` and run \`revoke all on table ${qualified(table)} from ${from};\`.`,
+								target: `${qualified(table)}:${role}`,
+								object: tableObject(table)
+							}];
+						});
+					}
 					const wanted = context.config.expose[qualified(table)] ?? context.config.expose[table.name] ?? {
 						anon: [],
 						authenticated: ["select"]
 					};
-					const granted = (role) => new Set(table.grants.filter((grant) => grant.role === role || grant.role === "PUBLIC").flatMap((grant) => grant.privileges.map((privilege) => privilege.toLowerCase())));
 					return ["anon", "authenticated"].flatMap((role) => {
 						const have = granted(role);
-						const missing = wanted[role].filter((privilege) => !have.has(privilege));
+						const missing = wanted[role].filter((privilege) => !privilege.includes("(") && !have.has(privilege));
 						if (missing.length === 0) return [];
 						return [{
 							message: `${role} has no ${missing.join(", ")} on ${qualified(table)}, so the Data API answers 42501. Add it to \`expose\` and run \`better-supabase sql add grants\`, or run \`grant ${missing.join(", ")} on table ${qualified(table)} to ${role};\`.${note}`,
@@ -2039,20 +2617,27 @@ const RULES = [
 			description: "A tenant-scoped table with policies for some commands but not all four denies the rest silently: an update or delete then affects 0 rows without an error. Add the missing policies, or a restrictive one, so the intent is explicit, and test it with `expectTenantIsolation`.",
 			check: (context) => {
 				const column = context.config.plugins.tenant?.column;
+				const providerFunctions = [...new Set((context.config.authorization?.requires ?? []).flatMap((entry) => [entry.function, entry.function.slice(entry.function.indexOf(".") + 1)]))];
 				const tables = exposed(context);
 				const roots = new Set(tables.flatMap((table) => table.foreignKeys.filter((key) => key.columns.length === 1 && (column === void 0 ? TENANT_COLUMN.test(key.columns[0]) : key.columns[0] === column)).map((key) => `${key.refSchema}.${key.refTable}`)));
 				return tables.flatMap((table) => {
 					if (table.kind !== "table" || !table.rls) return [];
 					if (roots.has(qualified(table))) return [];
-					if (context.config.tables[table.name]?.exclude) return [];
-					const granting = table.policies.filter((policy) => policy.permissive && policy.roles.some((role) => ["authenticated", "public"].includes(role)));
+					const options = configFor(context.config.tables, table.schema, table.name);
+					if (options?.exclude || options?.serviceRole) return [];
+					const forAuthenticated = (policy) => policy.roles.some((role) => ["authenticated", "public"].includes(role));
+					const granting = table.policies.filter((policy) => policy.permissive && forAuthenticated(policy));
 					if (granting.length === 0) return [];
-					if (!(column !== void 0 && table.columns.some((entry) => entry.name === column) || granting.some((policy) => TENANT_HELPER.test([
-						policy.using ?? "",
-						policy.check ?? "",
-						...policy.functions ?? []
-					].join(" "))))) return [];
-					const covered = new Set(granting.flatMap((policy) => policy.command === "all" ? COMMANDS : [policy.command]));
+					if (!(column !== void 0 && table.columns.some((entry) => entry.name === column) || granting.some((policy) => {
+						const text = [
+							policy.using ?? "",
+							policy.check ?? "",
+							...policy.functions ?? []
+						].join(" ");
+						return TENANT_HELPER.test(text) || providerFunctions.some((fn) => text.includes(fn));
+					}))) return [];
+					const denying = table.policies.filter((policy) => !policy.permissive && forAuthenticated(policy) && /^\s*false\s*$/i.test(policy.using ?? ""));
+					const covered = new Set([...granting, ...denying].flatMap((policy) => policy.command === "all" ? COMMANDS : [policy.command]));
 					const missing = COMMANDS.filter((command) => !covered.has(command));
 					if (missing.length === 0) return [];
 					return [{
@@ -2067,14 +2652,14 @@ const RULES = [
 			code: "BS108",
 			severity: "error",
 			title: "Policy reads auth.mfa_factors directly",
-			description: "`authenticated` has no access to `auth.mfa_factors`, so a policy that reads it fails every request with 42501. Check the factor in a `security definer` function such as `better_supabase.mfa_satisfied()` from the `mfa` kit module.",
+			description: "`authenticated` has no access to `auth.mfa_factors`, so a policy that reads it fails every request with 42501. Check the factor in a `security definer` function such as `better_supabase.mfa_satisfied()` from the `mfa` SQL module.",
 			check: (context) => exposed(context).flatMap((table) => table.policies.filter((policy) => MFA_FACTORS.test(`${policy.using ?? ""} ${policy.check ?? ""}`)).map((policy) => ({
 				message: `Policy "${policy.name}" on ${qualified(table)} reads auth.mfa_factors, which authenticated can't select, so every request fails with 42501. Use \`(select better_supabase.mfa_satisfied())\` from \`better-supabase sql add mfa\` instead.`,
 				target: `${qualified(table)}.${policy.name}`,
 				object: policyObject(table, policy)
 			})))
 		},
-		advisorRule("BS200", "performance", "Supabase performance advisor", "Findings from the Performance Advisor (splinter): unindexed foreign keys, auth calls re-evaluated per row in policies, multiple permissive policies, unused and duplicate indexes and more.", coveredByOwnRules),
+		advisorRule("BS200", "performance", "Supabase performance advisor", "Findings from the Performance Advisor (splinter): unindexed foreign keys, auth calls re-evaluated per row in policies, multiple permissive policies, unused and duplicate indexes and more."),
 		{
 			code: "BS204",
 			severity: "warning",
@@ -2145,7 +2730,9 @@ const RULES = [
 					path: bucket.path,
 					...bucket.public === void 0 ? {} : { public: bucket.public },
 					...bucket.fileSizeLimit === void 0 ? {} : { fileSizeLimit: bucket.fileSizeLimit },
-					...bucket.allowedMimeTypes === void 0 ? {} : { allowedMimeTypes: bucket.allowedMimeTypes }
+					...bucket.allowedMimeTypes === void 0 ? {} : { allowedMimeTypes: bucket.allowedMimeTypes },
+					...bucket.versioning === void 0 ? {} : { versioning: bucket.versioning },
+					...bucket.lifecycle === void 0 ? {} : { lifecycle: bucket.lifecycle }
 				});
 				const actual = catalogOf(context).buckets.find((entry) => entry.id === id);
 				const inDatabase = defined.drift(actual).map((drift) => ({
@@ -2202,13 +2789,13 @@ const RULES = [
 		{
 			code: "BS304",
 			severity: "warning",
-			title: "SQL kit files are out of date",
-			description: "A module listed in `sql.kit` differs from the version in this release. Same check as `sql sync --check`.",
+			title: "SQL module files are out of date",
+			description: "A module listed in `sql.modules` differs from the version in this release. Same check as `sql sync --check`.",
 			check: async (context) => {
 				const stale = [];
-				for (const { file, current, behind } of await kitFiles(context)) {
-					if (behind || sameKitFile(current, file.contents)) continue;
-					const edited = current === void 0 ? "" : ` If you edited it, move the change to \`kits.${file.module}\` in better-supabase.config.ts or to the module's SQL hooks: sync overwrites the file.`;
+				for (const { file, current, behind } of await moduleFiles(context)) {
+					if (behind || sameModuleFile(current, file.contents)) continue;
+					const edited = current === void 0 ? "" : ` If you edited it, move the change to \`sql.modules.${file.module}\` in better-supabase.config.ts or to the module's SQL hooks: sync overwrites the file.`;
 					const next = file.kind === "data" ? "Run `better-supabase sql sync`, which also writes the rows into a migration, since a schema diff skips them." : `Run \`better-supabase sql sync\`, then \`${migrationCommand(context.configToml)}\`.`;
 					stale.push({
 						message: `${file.path} (${file.module}) is ${current === void 0 ? "missing" : "out of date"}. ${next}${edited}`,
@@ -2222,6 +2809,26 @@ const RULES = [
 				return stale;
 			}
 		},
+		{
+			code: "BS316",
+			severity: "warning",
+			title: "Legacy migra diff engine",
+			description: "`supabase/config.toml` has no `[experimental.pgdelta] enabled = true`, so the Supabase CLI diffs `supabase/schemas` with migra, which drops grants, comments and security-invoker views and needs the stack stopped. New projects from `supabase init` use pg-delta.",
+			check: (context) => {
+				const toml = context.configToml;
+				if (toml === void 0 || diffEngine(toml) === "pg-delta") return [];
+				const schemas = `${toml.dir}/schemas/`;
+				if (!(context.config.sql.moduleNames.length > 0 || (context.sqlFiles ?? []).some((file) => file.path.startsWith(schemas)))) return [];
+				return [{
+					message: `${toml.path} uses the legacy migra engine. Add \`[experimental.pgdelta]\` with \`enabled = true\`, remove \`[db.migrations] schema_paths\`, and create migrations with \`supabase db schema declarative sync\` instead of \`supabase db diff\`.`,
+					target: toml.path,
+					location: {
+						file: toml.path,
+						line: 1
+					}
+				}];
+			}
+		},
 		{
 			code: "BS305",
 			severity: "warning",
@@ -2261,9 +2868,9 @@ const RULES = [
 		{
 			code: "BS311",
 			severity: "warning",
-			title: "SQL kit module behind its current version",
-			description: "A module file or `better_supabase.kit_modules` records an older module version than this release ships. Same check as `sql upgrade --check`.",
-			check: kitVersionsBehind
+			title: "SQL module behind its current version",
+			description: "A module file or `better_supabase.modules` records an older module version than this release ships. Same check as `sql upgrade --check`.",
+			check: moduleVersionsBehind
 		},
 		{
 			code: "BS401",
@@ -2370,9 +2977,11 @@ const RULES = [
 	...POLICY_RULES,
 	...SCHEMA_DESIGN_RULES,
 	...HOOK_RULES,
-	...PERMDOCK_RULES,
+	...COOKIE_RULES,
+	...AUTHORIZATION_RULES,
 	...LIVE_RULES,
-	...KIT_RULES
+	...MODULE_RULES,
+	...PGDELTA_RULES
 ].sort((a, b) => byCodePoint(a.code, b.code));
 const RULE_CODES = RULES.map((rule) => rule.code);
 async function runRules(context, rules = RULES) {
@@ -2381,13 +2990,21 @@ async function runRules(context, rules = RULES) {
 		...context,
 		codes: rules.map((rule) => rule.code)
 	};
-	for (const rule of rules) for (const input of await rule.check(scoped)) findings.push({
-		code: rule.code,
-		severity: rule.severity,
-		title: rule.title,
-		help: `${DOCS_URL}#${rule.code.toLowerCase()}`,
-		...input
-	});
+	for (const rule of rules) {
+		const help = `${DOCS_URL}#${rule.code.toLowerCase()}`;
+		const skipped = skippedForMetadata(context.snapshot, rule, help);
+		if (skipped) {
+			findings.push(skipped);
+			continue;
+		}
+		for (const input of await rule.check(scoped)) findings.push({
+			code: rule.code,
+			severity: rule.severity,
+			title: rule.title,
+			help,
+			...input
+		});
+	}
 	return findings;
 }
 //#endregion
@@ -2529,6 +3146,11 @@ const ARGS = {
 		description: "Check a saved snapshot instead of the database",
 		valueHint: "file"
 	},
+	metadata: {
+		type: "string",
+		description: "Check a GeneratorMetadata document (- for stdin); checks it lacks data for are skipped",
+		valueHint: "path|-"
+	},
 	"db-url-stdin": {
 		type: "boolean",
 		description: "Read the connection string from stdin instead of $DATABASE_URL or the config"
@@ -2565,6 +3187,7 @@ const ARGS = {
 const ENV_FILES = [
 	".env",
 	".env.local",
+	".env.example",
 	".env.development",
 	".env.development.local",
 	".env.production",
@@ -2584,8 +3207,9 @@ async function sqlFiles(root, toml) {
 		text: await readFile(resolve(root, path), "utf8")
 	});
 	const schemas = await Promise.all((await schemaPaths(root, toml)).files.map(read));
-	const migrationsDir = resolve(root, "supabase/migrations");
-	const migrations = existsSync(migrationsDir) ? (await readdir(migrationsDir)).filter((name) => name.endsWith(".sql")).sort().reverse().map((name) => `supabase/migrations/${name}`) : [];
+	const migrationsPath = `${toml?.dir ?? "supabase"}/migrations`;
+	const migrationsDir = resolve(root, migrationsPath);
+	const migrations = existsSync(migrationsDir) ? (await readdir(migrationsDir)).filter((name) => name.endsWith(".sql")).sort().reverse().map((name) => `${migrationsPath}/${name}`) : [];
 	return [...schemas, ...await Promise.all(migrations.map(read))];
 }
 /** Files matching `doctor.sources`, skipping dependencies and build output. */
@@ -2605,6 +3229,17 @@ const escape = (name) => name.replaceAll(/[.*+?^${}()|[\]\\]/g, "\\$&");
 function locate(files, object) {
 	const name = `"?${escape(object.name)}"?`;
 	const qualifiedName = `(?:"?${escape(object.schema)}"?\\.)?${name}`;
+	if (object.kind === "policy" && object.table !== void 0) {
+		const onTable = new RegExp(`create\\s+policy\\s+${name}\\s+on\\s+(?:only\\s+)?(?:"?${escape(object.schema)}"?\\.)?"?${escape(object.table)}"?(?:\\s|;|$)`, "i");
+		for (const file of files) {
+			const match = onTable.exec(file.text);
+			if (match) return {
+				file: file.path,
+				line: file.text.slice(0, match.index).split("\n").length
+			};
+		}
+		return;
+	}
 	const pattern = object.kind === "table" ? new RegExp(`create\\s+(?:unlogged\\s+)?table\\s+(?:if\\s+not\\s+exists\\s+)?${qualifiedName}(?:\\s|\\(|$)`, "i") : object.kind === "function" ? new RegExp(`create\\s+(?:or\\s+replace\\s+)?function\\s+${qualifiedName}\\s*\\(`, "i") : new RegExp(`create\\s+policy\\s+${name}`, "i");
 	for (const file of files) {
 		const line = lineOf(file.text, pattern);
@@ -2676,7 +3311,10 @@ function openLive(config, env, source, pg) {
 		advisors: {
 			describe: "database (splinter)",
 			async lints(category) {
-				splinter ??= open().then((db) => splinterAdvisors(db.queryable, db.describe, { cacheDir }));
+				splinter ??= Promise.all([open(), readSupabaseToml(config.root).catch(() => void 0)]).then(([db, toml]) => splinterAdvisors(db.queryable, db.describe, {
+					cacheDir,
+					schemas: apiSchemas(toml?.document)
+				}));
 				return (await splinter).lints(category);
 			}
 		},
@@ -2755,10 +3393,9 @@ async function runDoctor(config, args, env, options = {}) {
 		...options.advisors === void 0 ? {} : { advisors: options.advisors },
 		...options.database === void 0 ? {} : { database: options.database }
 	};
-	const [snapshot, envFiles, permdock, [configToml, sql], gitignore, sources, readSets] = await Promise.all([
+	const [snapshot, envFiles, [configToml, sql], gitignore, sources, readSets] = await Promise.all([
 		options.snapshot ?? loadSnapshot(config, env, source, pg, opened.open),
 		Promise.all(ENV_FILES.map((path) => readText(config.root, path))).then((files) => files.filter((file) => file !== void 0)),
-		readPermdock(config.root, config.permdock),
 		readSupabaseToml(config.root).then(async (toml) => [toml, await sqlFiles(config.root, toml)]),
 		readText(config.root, ".gitignore"),
 		sourceFiles(config),
@@ -2770,7 +3407,6 @@ async function runDoctor(config, args, env, options = {}) {
 	const context = {
 		config,
 		snapshot,
-		...permdock ? { permdock } : {},
 		sqlFiles: sql,
 		configToml,
 		envFiles,
@@ -2808,11 +3444,20 @@ async function runDoctor(config, args, env, options = {}) {
 		} : finding;
 	});
 	const out = args.out;
-	const report = formatReport(findings, {
+	const fromRepo = format === "sarif" || format === "github";
+	const repoRoot = findRepoRoot(config.root);
+	const repoPath = (file) => display(repoRoot, resolve(config.root, file));
+	const report = formatReport(fromRepo ? findings.map((finding) => finding.location ? {
+		...finding,
+		location: {
+			...finding.location,
+			file: repoPath(finding.location.file)
+		}
+	} : finding) : findings, {
 		format,
 		rules,
 		version: VERSION,
-		fallbackFile: context.configToml?.path ?? "package.json",
+		fallbackFile: repoPath(context.configToml?.path ?? "package.json"),
 		...options.paint && !out ? { paint: options.paint } : {}
 	});
 	const errors = findings.filter((finding) => finding.severity === "error").length;
@@ -2850,7 +3495,38 @@ const doctorCommand = defineCliCommand({
 		"ignore",
 		"explain"
 	],
-	run: async (args, { config, env, io, signal }) => {
+	run: async (args, { config, cwd, env, io, signal }) => {
+		if (args.metadata !== void 0) {
+			const conflicting = [
+				...args.snapshot === void 0 ? [] : ["--snapshot"],
+				...args["db-url-stdin"] === true ? ["--db-url-stdin"] : [],
+				...args["project-ref"] === void 0 ? [] : ["--project-ref"],
+				...args.stats === true ? ["--stats"] : [],
+				...args.explain === void 0 ? [] : ["--explain"],
+				...args.as === void 0 ? [] : ["--as"]
+			];
+			if (conflicting.length > 0) return {
+				code: 2,
+				error: `--metadata checks the document, not a database, so it can't be combined with ${conflicting.join(", ")}`
+			};
+			let snapshot;
+			try {
+				snapshot = await readMetadataSnapshot(args.metadata, cwd, io);
+			} catch (cause) {
+				if (cause instanceof MetadataRejectedError) return {
+					code: 65,
+					error: cause.message
+				};
+				throw cause;
+			}
+			const skipped = `reading a GeneratorMetadata document; set $DATABASE_URL, or pass --db-url-stdin or --project-ref, to check a database.`;
+			return runDoctor(config, args, env, {
+				snapshot,
+				advisors: { skipped },
+				database: { skipped },
+				paint: painter(io.color)
+			});
+		}
 		const dbUrl = await stdinDatabaseUrl(args["db-url-stdin"], io);
 		return withSpinner(args.snapshot === void 0 ? io.prompts : void 0, "Checking the database", () => runDoctor(config, args, env, {
 			paint: painter(io.color),