permdock 0.0.0 → 0.1.0

package/dist/doctor-BGle8Gqi.js

@@ -0,0 +1,1314 @@
+import { p as isPrincipalRelation } from "./permissions-DC7GROPA.js";
+import { a as hasConditionOp } from "./refs-ChLSxbST.js";
+import { f as separationConflicts } from "./policy-ANp36PnI.js";
+import { a as resolveScope, i as normalizeMemberships, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
+import { o as parseCredential } from "./credential-B_rkUNlY.js";
+import { p as validateCustomRole } from "./permdock-yoZ7EjxX.js";
+import { n as DOCTOR_REPORT_SCHEMA } from "./version-CnSh33Fj.js";
+import { o as jsonSchemaOf, s as policyRowConditionKeys } from "./catalog-doc-BSo_Q_-6.js";
+import { i as sqlFiles, n as listSourceFiles, r as rel, t as defaultSrcPath } from "./files-B_wAGYmt.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
+import { t as runCollect } from "./collect-O-tOtbnk.js";
+import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
+import { i as quoteSqlLiteral } from "./sql-Bll1d7y0.js";
+import { n as PERMDOCK_SCHEMA } from "./sources-DVHM3Mwq.js";
+import "./markers-B0hYLvMD.js";
+import { t as createStyle } from "./style-CTm1AXDT.js";
+import { i as runSkillsInstall } from "./skills-Dx3QLnMY.js";
+import { A as tableKey, C as pd009, D as pd040, E as pd028, O as group, S as pd006, T as pd022, a as loadScopes, b as MIGRATION_DIRS, i as hookOut, k as sqlStatements, l as pd039, n as attrsPlan, s as supabaseHookManifest, v as pd045, w as pd012, x as pd005, y as supabaseConfig } from "./supabase-hook-D_OqGb_V.js";
+import { S as contextRefs } from "./rls-helpers-BxRuif0l.js";
+import { d as commandFor, f as compileGrants, p as tableFor } from "./pg-4GJWDUxG.js";
+import { d as rowConditionMessage, l as helperTablePolicies, n as graphPlan, o as ROW_CONDITION_FIX } from "./rls-graph-DxQ39PJj.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CUnK6Ou9.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+//#region src/cli/doctor-collect.ts
+async function pd002(input) {
+	const collected = await runCollect({
+		cwd: input.cwd,
+		config: input.config,
+		collect: input.config.collect ?? {},
+		check: true,
+		now: input.now,
+		io: input.io
+	});
+	if (collected.scan === void 0) return [];
+	return collected.scan.unknown.map((usage) => ({
+		code: "PD002",
+		severity: "error",
+		message: `unknown permission ${usage.call} at ${usage.file}:${String(usage.line)}`,
+		fix: "use a defined permission reference"
+	}));
+}
+async function pd003(input) {
+	if (input.config.policy === void 0) return [];
+	const usage = await runUsage({
+		cwd: input.cwd,
+		config: input.config,
+		ignore: [],
+		strict: false,
+		json: true,
+		dynamicAsUsed: false,
+		now: input.now,
+		io: input.io
+	});
+	if (usage.code === 2) return [];
+	return JSON.parse(usage.output).ungranted.map((item) => ({
+		code: "PD003",
+		severity: "warning",
+		message: `${item.key} is used but never granted (${item.detail})`,
+		fix: "add an allow() with a to: selector, or a role() binding, in definePolicy"
+	}));
+}
+async function pd004(input) {
+	const collected = await runCollect({
+		cwd: input.cwd,
+		config: input.config,
+		collect: input.config.collect ?? {},
+		check: true,
+		now: input.now,
+		io: input.io
+	});
+	if (collected.code === 0) return [];
+	if (collected.code === 2) return [];
+	return [{
+		code: "PD004",
+		severity: "error",
+		message: collected.message,
+		fix: "pnpm exec permdock collect"
+	}];
+}
+async function pd027(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const grant of policy.grants) {
+		const refs = [.../* @__PURE__ */ new Set([...contextRefs(grant.where), ...contextRefs(grant.check)])];
+		if (refs.length === 0) continue;
+		findings.push({
+			code: "PD027",
+			severity: "warning",
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} reads ${refs.join(", ")}: request context is not in the token, so permdock rls generate cannot compile it and the database cannot enforce it`,
+			fix: "move the value to a server-set claim and compare with principal.claims.<name>, or keep the check API-side and pass --skip-closures to rls generate"
+		});
+	}
+	return findings;
+}
+async function pd016(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	let policy;
+	try {
+		policy = asPolicy(pickNamed(await loadModule(resolve(input.cwd, input.config.policy)), ["policy"]));
+	} catch {
+		return [];
+	}
+	const findings = [];
+	let opaque = false;
+	let sqlFunction = false;
+	for (const grant of policy.grants) {
+		if (hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque")) opaque = true;
+		if (hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction")) sqlFunction = true;
+	}
+	if (opaque) findings.push({
+		code: "PD016",
+		severity: "warning",
+		message: "policy has opaque RLS conditions that deny in memory",
+		fix: "add rls.functions.<name> with a portable twin, or rewrite as sqlFunction()"
+	});
+	if (sqlFunction) {
+		const fixtures = input.config.rls.fixtures ?? "rls.fixtures.json";
+		if (!existsSync(resolve(input.cwd, fixtures)) && !existsSync(resolve(input.cwd, "rls.fixtures.ts"))) findings.push({
+			code: "PD016",
+			severity: "warning",
+			message: "sqlFunction grants have no rls fixtures for verify --db",
+			fix: "add rls.fixtures.json and run permdock rls verify --db"
+		});
+	}
+	return findings;
+}
+const DEFAULT_SENSITIVE_ACTIONS = [
+	"approve",
+	"pay",
+	"settle",
+	"submit",
+	"transfer",
+	"refund",
+	"disburse"
+];
+async function loadPolicy(cwd, path) {
+	try {
+		return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
+	} catch {
+		return;
+	}
+}
+async function pd017(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
+	const denied = new Set(policy.grants.filter((grant) => grant.effect === "deny").map((grant) => grant.permission.key));
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) {
+		if (grant.effect !== "allow") continue;
+		if (!sensitive.has(grant.permission.action)) continue;
+		if (grant.approval !== void 0) continue;
+		if (denied.has(grant.permission.key)) continue;
+		if (seen.has(grant.permission.key)) continue;
+		seen.add(grant.permission.key);
+		findings.push({
+			code: "PD017",
+			severity: "warning",
+			message: `${grant.permission.key} is a sensitive verb without approval`,
+			fix: "add approval: { by } on the allow, or a deny on the same leaf"
+		});
+	}
+	return findings;
+}
+async function pd024(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const grant of policy.grants) {
+		const approval = grant.approval;
+		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.distinct !== false) continue;
+		findings.push({
+			code: "PD024",
+			severity: "warning",
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.distinct: false, so the requester can approve their own request`,
+			fix: "remove distinct: false unless the requester confirming their own call (an agent asking its user) is the intent"
+		});
+	}
+	return findings;
+}
+function asMembershipsFixture(parsed) {
+	return parsed !== null && typeof parsed === "object" ? parsed : {};
+}
+async function pd018(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	const declared = new Set(policy.roles.map((item) => item.name));
+	for (const binding of policy.roles) for (const name of binding.exclusiveWith ?? []) if (!declared.has(name)) findings.push({
+		code: "PD018",
+		severity: "error",
+		message: `exclusiveWith names undeclared role ${name} on ${binding.name}`,
+		fix: "declare the exclusive role with role() or remove it from exclusiveWith"
+	});
+	const fixturePath = input.config.doctor?.memberships;
+	if (fixturePath === void 0) return findings;
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!existsSync(absolute)) {
+		findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `doctor.memberships fixture ${fixturePath} is missing`,
+			fix: "add the JSON fixture or remove doctor.memberships"
+		});
+		return findings;
+	}
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(absolute, "utf8"));
+	} catch {
+		findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `doctor.memberships fixture ${fixturePath} is not valid JSON`,
+			fix: "fix the JSON fixture"
+		});
+		return findings;
+	}
+	const record = asMembershipsFixture(parsed);
+	for (const custom of record.customRoles ?? []) {
+		const conflicts = separationConflicts(policy, [{
+			principal: custom.name,
+			...custom.tenant === void 0 ? {} : { tenant: custom.tenant },
+			roles: custom.includes ?? []
+		}]);
+		for (const conflict of conflicts) findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `custom role ${custom.name} includes exclusive roles ${conflict.roles.join(" and ")}`,
+			fix: "split the custom role so it does not include exclusiveWith pairs"
+		});
+	}
+	for (const conflict of separationConflicts(policy, record.memberships ?? [])) findings.push({
+		code: "PD018",
+		severity: "warning",
+		message: `membership ${conflict.principal || "unknown"} holds exclusive roles ${conflict.roles.join(" and ")}`,
+		fix: "remove one of the exclusive roles from the membership fixture"
+	});
+	return findings;
+}
+async function pd020(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const tables = input.config.rls.tables;
+	const compiled = (policy.hostable ?? []).filter((key) => {
+		const resource = key.slice(0, key.lastIndexOf("."));
+		return tables === void 0 || tables[resource] !== void 0;
+	});
+	if (compiled.length === 0) return [];
+	return [{
+		code: "PD020",
+		severity: "warning",
+		message: `hostable permissions are also compiled into RLS, which never sees hosted grants: ${compiled.join(", ")}`,
+		fix: "remove them from hostable, or drop their tables from rls.tables and enforce them in the application"
+	}];
+}
+async function pd021(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0 || (policy.hostable ?? []).length === 0) return [];
+	const missing = ["PERMDOCK_CLOUD_URL", "PERMDOCK_CLOUD_KEY"].filter((name) => (input.env[name] ?? "") === "");
+	if (missing.length === 0) return [];
+	return [{
+		code: "PD021",
+		severity: "warning",
+		message: `the policy lists hostable permissions but ${missing.join(" and ")} is not set, so no hosted grant can be published or fetched`,
+		fix: "set the variables from the PermDock Cloud dashboard, or remove hostable"
+	}];
+}
+async function pd019(input) {
+	const rls = input.config.rls;
+	if ((rls?.authorize ?? rls?.rbac?.authorize) !== "jwt") return [];
+	const expiry = supabaseConfig(input.cwd).jwtExpiry ?? 3600;
+	if (expiry <= 3600 || input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
+	const keys = [...new Set(policy.grants.filter((grant) => grant.effect === "allow" && sensitive.has(grant.permission.action)).map((grant) => grant.permission.key))];
+	if (keys.length === 0) return [];
+	return [{
+		code: "PD019",
+		severity: "warning",
+		message: `the RLS helpers and authorize() read roles from the JWT and jwt_expiry is ${String(expiry)}s: a revoked role keeps ${keys.join(", ")} until the token expires`,
+		fix: "set rls.authorize: 'database', or lower [auth] jwt_expiry in supabase/config.toml to 3600 or less"
+	}];
+}
+function customRoleLabel(role) {
+	return role.tenant === void 0 ? `global custom role ${role.name}` : `custom role ${role.name} in ${role.tenant}`;
+}
+async function pd023(input) {
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!existsSync(absolute)) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(absolute, "utf8"));
+	} catch {
+		return [];
+	}
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const entry of validateCustomRole(policy, custom).dropped) {
+		const what = "role" in entry ? `include ${entry.role}` : `permission ${entry.permission}`;
+		findings.push({
+			code: "PD023",
+			severity: "warning",
+			message: `${customRoleLabel(custom)} drops ${what} (${entry.reason})`,
+			fix: entry.reason === "outside-ceiling" ? "grant it to a declared assignable role, or remove it from the custom role" : entry.reason === "condition-not-allowed" ? "remove the condition; custom-role grants inherit the declared grant condition" : "use a declared permission key or assignable role name"
+		});
+	}
+	return findings;
+}
+/**
+* PD055: a stored custom role names a permission by a key it was renamed
+* from. It still resolves; the alias can only be dropped once storage holds
+* the current key.
+*/
+async function pd055(input) {
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!existsSync(absolute)) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(absolute, "utf8"));
+	} catch {
+		return [];
+	}
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const table = `${input.config.rls?.schema ?? "permdock"}.custom_role_permissions`;
+	const findings = [];
+	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const { from, to } of validateCustomRole(policy, custom).renamed) findings.push({
+		code: "PD055",
+		severity: "warning",
+		message: `${customRoleLabel(custom)} stores ${from}, which was renamed to ${to}`,
+		fix: `rewrite the stored key before removing the alias: update ${table} set permission = ${quoteSqlLiteral(to)} where permission = ${quoteSqlLiteral(from)};`
+	});
+	return findings;
+}
+function readJson(cwd, path) {
+	if (path === void 0) return;
+	const absolute = resolve(cwd, path);
+	if (!existsSync(absolute)) return;
+	try {
+		return JSON.parse(readFileSync(absolute, "utf8"));
+	} catch {
+		return;
+	}
+}
+function listField(value, field) {
+	if (value === null || typeof value !== "object") return [];
+	const list = value[field];
+	return Array.isArray(list) ? list : [];
+}
+/** Fixture API keys that never expire, credential policies that allow it, and records that are not v1 credentials. */
+function pd029(input) {
+	const parsed = readJson(input.cwd, input.config.doctor?.credentials);
+	const findings = [];
+	for (const [index, record] of listField(parsed, "credentials").entries()) {
+		const credential = parseCredential(record);
+		if (credential === void 0) {
+			findings.push({
+				code: "PD029",
+				severity: "warning",
+				message: `credentials[${String(index)}] is not a valid v1 credential, so it verifies to no subject`,
+				fix: "give it v: 1, id, kind, principal, permissions, createdBy and createdAt; a service key also needs tenant and roles"
+			});
+			continue;
+		}
+		if (credential.expiresAt === void 0) findings.push({
+			code: "PD029",
+			severity: "warning",
+			message: `API key ${credential.id} never expires`,
+			fix: "set expiresAt and rotate the key before it; a leaked key without expiry stays live until someone revokes it"
+		});
+	}
+	const settings = parsed !== null && typeof parsed === "object" ? parsed.settings : void 0;
+	const tenants = settings !== null && typeof settings === "object" ? Object.entries(settings) : [];
+	for (const [tenant, value] of tenants) if ((value !== null && typeof value === "object" ? value.credentials : void 0)?.allowNoExpiry === true) findings.push({
+		code: "PD029",
+		severity: "warning",
+		message: `tenant ${tenant} allows API keys that never expire`,
+		fix: "drop allowNoExpiry and set maxTtl, or keep it only for a tenant that rotates keys on its own schedule"
+	});
+	return findings;
+}
+/** Fixture memberships the policy's scopes would drop: an undeclared scope, a missing parent id, mixed shapes. */
+/**
+* A scope whose roles can all be removed can end up with nobody able to
+* manage it. Setting `min` on any of its roles (even `min: 0`) records the
+* decision and silences the warning.
+*/
+async function pd026(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const findings = [];
+	for (const { name } of scopes) {
+		const held = policy.roles.filter((binding) => typeof binding.on === "string" && resolveScope(scopes, binding.on) === name);
+		if (held.length === 0 || held.some((binding) => binding.min !== void 0)) continue;
+		findings.push({
+			code: "PD026",
+			severity: "warning",
+			message: `no role on scope '${name}' keeps a holder: every ${name} can lose its last ${held.map((binding) => binding.name).join(" / ")}`,
+			fix: `set min: 1 on the role that manages a ${name} (role(..., { on: '${name}', min: 1 })), or min: 0 to record that none must stay`
+		});
+	}
+	return findings;
+}
+async function pd025(input) {
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!existsSync(absolute)) return [];
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(absolute, "utf8"));
+	} catch {
+		return [];
+	}
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const names = scopes.map((scope) => scope.name).join(", ");
+	const findings = [];
+	for (const [index, membership] of (asMembershipsFixture(parsed).memberships ?? []).entries()) {
+		if (normalizeMemberships([membership], scopes).length > 0) continue;
+		findings.push({
+			code: "PD025",
+			severity: "warning",
+			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, or it mixes shapes`,
+			fix: "use { scope, id, within: { <parent>: id }, roles } with a declared scope, or { on: { resource, id }, roles }"
+		});
+	}
+	return findings;
+}
+/** Columns of `resource` a field-limited read grant can hide: missing from an allow's list, or on a deny's. */
+function limitedColumns(policy, resource, actions) {
+	const reads = policy.grants.filter((grant) => grant.permission.resource === resource && grant.fields !== void 0 && commandFor(grant.permission.action, actions) === "select");
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	const columns = properties !== null && typeof properties === "object" ? Object.keys(properties) : [...new Set(reads.flatMap((grant) => grant.fields ?? []))];
+	const key = node?.id ?? "id";
+	return columns.filter((column) => column !== key && reads.some((grant) => grant.effect === "deny" ? (grant.fields ?? []).includes(column) : !(grant.fields ?? []).includes(column)));
+}
+/**
+* `fields` redact in the application; RLS is row-level unless field views
+* compile, and a field view protects nothing while the base table still
+* returns the columns to a direct read.
+*/
+async function pd030(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const resources = [...new Set(policy.grants.filter((grant) => grant.fields !== void 0 && commandFor(grant.permission.action, rls.actions) === "select").map((grant) => grant.permission.resource))].toSorted();
+	const findings = [];
+	for (const resource of resources) {
+		const columns = limitedColumns(policy, resource, rls.actions);
+		if (columns.length === 0) continue;
+		const table = tableFor(resource, rls.tables);
+		if (rls.fields !== "views") {
+			findings.push({
+				code: "PD030",
+				severity: "warning",
+				message: `read grants on ${resource} limit ${columns.join(", ")}, but RLS on ${table} is row-level: any client that reads ${table} directly gets those columns`,
+				fix: `set rls.fields: 'views' and rls.revokeColumns: true (permdock rls generate --fields views --revoke-columns), or keep direct reads server-side and redact with pick`
+			});
+			continue;
+		}
+		if (rls.revokeColumns !== true) findings.push({
+			code: "PD030",
+			severity: "warning",
+			message: `${table}_visible masks ${columns.join(", ")}, but ${table} still returns them to a direct read`,
+			fix: `set rls.revokeColumns: true (--revoke-columns) so clients read ${columns.join(", ")} only through ${table}_visible`
+		});
+	}
+	return findings;
+}
+/**
+* A self-parented resource no `through` grant walks, or a `restricted`
+* column no graph grant reaches: the declaration has no effect on any
+* decision, and `rls generate` keeps no closure for it.
+*/
+async function pd031(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const plan = graphPlan(policy);
+	const findings = [];
+	for (const node of policy.resources.values()) {
+		const walked = plan.get(node.name)?.closure !== void 0;
+		if (node.parent?.resource === node.name && !walked) findings.push({
+			code: "PD031",
+			severity: "warning",
+			message: `${node.name} parents itself through ${node.parent.field}, but no grant walks it with relation(..., { through: 'parent' }): its ancestors grant nothing and rls generate keeps no closure for it`,
+			fix: `grant through the chain (relation(permissions.${node.name}, '<relation>', { through: 'parent', depth: 16 })) or drop the self-parent`
+		});
+		const reached = [...plan.values()].some((entry) => entry.node.name === node.name || node.parent?.resource === entry.node.name && entry.node.name !== node.name);
+		if (node.restricted !== void 0 && !reached) findings.push({
+			code: "PD031",
+			severity: "warning",
+			message: `${node.name} declares restricted: '${node.restricted}', but no graph grant reaches ${node.name} rows, so the column keeps nothing out`,
+			fix: `add a relation(..., { through: 'parent' }) grant that reaches ${node.name}, or remove restricted`
+		});
+	}
+	return findings;
+}
+/**
+* Under an `rls` config, a graph resource `rls generate` cannot name a helper
+* for: one that shares a scope's name (its `permitted_<name>_ids` would
+* replace the scope helper) or is not a lowercase SQL name.
+*/
+async function pd032(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const findings = [];
+	for (const name of graphPlan(policy).keys()) if (scopes.some((scope) => scope.name === name)) findings.push({
+		code: "PD032",
+		severity: "error",
+		message: `graph resource ${name} shares its name with the ${name} scope: permitted_${name}_ids would replace the scope helper, so rls generate refuses it`,
+		fix: `rename the resource (for example ${name}s or ${name}_node) or the scope`
+	});
+	else if (!/^[a-z][a-z0-9_]*$/u.test(name)) findings.push({
+		code: "PD032",
+		severity: "error",
+		message: `graph resource ${name} is not a lowercase SQL name, so rls generate cannot name permitted_${name}_ids`,
+		fix: "rename the resource to lowercase letters, digits and underscores"
+	});
+	return findings;
+}
+/** Reads the doctor memberships fixture, if one is configured and parseable. */
+function membershipsFixture(input) {
+	const fixturePath = input.config.doctor?.memberships;
+	if (fixturePath === void 0) return {};
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!existsSync(absolute)) return {};
+	try {
+		return asMembershipsFixture(JSON.parse(readFileSync(absolute, "utf8")));
+	} catch {
+		return {};
+	}
+}
+/**
+* PD033: a role activation without a `maxDuration` (an elevation with no
+* ceiling never expires on its own), and an activation role that a fixture
+* membership also holds standing (an eligible-only role must never be held
+* directly).
+*/
+async function pd033(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	const activation = /* @__PURE__ */ new Set();
+	for (const binding of policy.roles) {
+		if (binding.activation === void 0) continue;
+		activation.add(binding.name);
+		if (binding.activation.maxDuration === void 0) findings.push({
+			code: "PD033",
+			severity: "warning",
+			message: `role '${binding.name}' has activation without maxDuration: an elevation never expires on its own`,
+			fix: `set activation: { maxDuration: '4h', ... } on role '${binding.name}'`
+		});
+	}
+	const fixture = membershipsFixture(input);
+	const standing = /* @__PURE__ */ new Set();
+	const eligible = /* @__PURE__ */ new Set();
+	for (const membership of fixture.memberships ?? []) {
+		for (const name of membership.roles ?? []) standing.add(name);
+		for (const name of membership.eligible ?? []) eligible.add(name);
+	}
+	for (const name of activation) if (standing.has(name)) findings.push({
+		code: "PD033",
+		severity: "warning",
+		message: `activation role '${name}' is held standing by a fixture membership: an eligible-only role must never be held directly`,
+		fix: `list '${name}' under eligible, never roles, and activate it with permdock.activate`
+	});
+	return findings;
+}
+/**
+* PD034: a break-glass grant under an `rls` config. RLS never compiles a
+* break-glass override; the server must read through a `security definer`
+* function that checks a signed break-glass session and writes an audit row.
+*/
+async function pd034(input) {
+	if (input.config.policy === void 0 || input.config.rls === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) if (grant.breakGlass !== void 0) keys.add(grant.permission.key);
+	return [...keys].map((key) => ({
+		code: "PD034",
+		severity: "warning",
+		message: `break-glass grant on ${key} cannot be compiled to RLS: it would leak the override into a database policy`,
+		fix: "read break-glass rows through a security definer function that checks a signed break-glass session and writes an audit row"
+	}));
+}
+/**
+* PD035: a `supportAccess` role without `actorRequired`. Support access is
+* impersonation; without an actor the session is unattributed.
+*/
+async function pd035(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const binding of policy.roles) if (binding.support !== void 0 && !binding.support.actorRequired) findings.push({
+		code: "PD035",
+		severity: "warning",
+		message: `support access role '${binding.name}' has actorRequired: false: a support session then runs as the tenant, unattributed`,
+		fix: `set actorRequired: true on supportAccess({ role: '${binding.name}', ... })`
+	});
+	return findings;
+}
+/**
+* Storage and Realtime policies written outside PermDock (better-supabase
+* `permdock` mode) that call the SQL helpers for a permission whose grants
+* carry row conditions: the helpers check only role and scope.
+*/
+async function pd037(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await loadPolicy(input.cwd, input.config.policy);
+	if (policy === void 0) return [];
+	const conditioned = policyRowConditionKeys(policy);
+	const findings = [];
+	for (const file of sqlFiles(input.cwd, input.config.doctor?.migrations ?? MIGRATION_DIRS)) for (const found of helperTablePolicies(readFileSync(file, "utf8"))) {
+		const keys = found.keys.filter((key) => conditioned.has(key));
+		if (keys.length > 0) findings.push({
+			code: "PD037",
+			severity: "error",
+			message: rowConditionMessage(found, keys),
+			fix: ROW_CONDITION_FIX
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor-declarative.ts
+const SCHEMAS = "supabase/schemas";
+const MIGRATIONS = "supabase/migrations";
+const CREATES_HOOK = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*custom_access_token_hook\b/iu;
+const DROPS_HOOK = /\bdrop\s+function\s+(?:if\s+exists\s+)?[\w."]*custom_access_token_hook\b/iu;
+const GRANTS_HOOK = /\bgrant\s+execute\s+on\s+function\s+[\w."]*custom_access_token_hook\s*\(\s*jsonb\s*\)\s+to\s+supabase_auth_admin\b/iu;
+const DEFINES_HELPER = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*permdock_has\s*\(/iu;
+const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids)\s*\(/iu;
+function uncommented(text) {
+	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+}
+/**
+* PD042: a hook declared under `supabase/schemas` reaches the database through
+* `supabase db diff`, which drops its `supabase_auth_admin` grants. pg-delta
+* keeps them, so the check is off under `[experimental.pgdelta]`. A function
+* created (or dropped and created again) without them is executable by
+* `public` and not by the auth server, so a migration at or after the one
+* that creates it must carry the grants.
+*/
+function pd042(cwd, config) {
+	if (config.supabase?.hook === void 0 || supabaseConfig(cwd).pgDelta !== void 0) return [];
+	if (!sqlFiles(cwd, [SCHEMAS]).some((file) => readFileSync(file, "utf8").startsWith(`-- permdock:hook v1 `))) return [];
+	const migrations = sqlFiles(cwd, [MIGRATIONS]).map((file) => ({
+		file,
+		text: uncommented(readFileSync(file, "utf8"))
+	}));
+	const created = migrations.findIndex(({ text }) => CREATES_HOOK.test(text));
+	const dropped = migrations.findLastIndex(({ text }) => DROPS_HOOK.test(text));
+	const needed = Math.max(created, dropped);
+	if (needed === -1) return [];
+	if (migrations.findLastIndex(({ text }) => GRANTS_HOOK.test(text)) >= needed) return [];
+	return [{
+		code: "PD042",
+		severity: "error",
+		message: `${rel(cwd, migrations[needed]?.file ?? MIGRATIONS)} creates custom_access_token_hook from supabase/schemas, and no migration from it on grants it to supabase_auth_admin: supabase db diff drops those grants, so the auth server cannot call the hook and public can`,
+		fix: "generate the grants with permdock supabase hook generate --grants-out (or rls generate --split ...,hook --grants-out) into a new file from supabase migration new, after the db diff migration"
+	}];
+}
+/** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
+function schemaPaths(cwd) {
+	const paths = supabaseConfig(cwd).schemaPaths ?? [];
+	return paths.length === 0 ? ["./schemas/**/*.sql"] : paths;
+}
+/** Schema files in the order `supabase db diff` applies them: each glob in turn, sorted within it. */
+function orderedSchemaFiles(cwd) {
+	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
+}
+/**
+* PD043: `db diff` applies schema files in `schema_paths` order, so a policy
+* that calls `permdock_has` or `permitted_<scope>_ids` before the file that
+* defines them fails to apply. pg-delta orders by dependencies instead.
+*/
+function pd043(cwd) {
+	if (supabaseConfig(cwd).pgDelta !== void 0) return [];
+	if (!existsSync(join(cwd, SCHEMAS))) return [];
+	const files = orderedSchemaFiles(cwd).map((file) => ({
+		file,
+		text: uncommented(readFileSync(file, "utf8"))
+	}));
+	const helpers = files.findIndex(({ text }) => DEFINES_HELPER.test(text));
+	const defined = sqlFiles(cwd, [SCHEMAS]).find((file) => DEFINES_HELPER.test(uncommented(readFileSync(file, "utf8"))));
+	if (helpers === -1) return defined === void 0 ? [] : [{
+		code: "PD043",
+		severity: "warning",
+		message: `${rel(cwd, defined)} defines the PermDock helpers, but schema_paths in supabase/config.toml does not list it, so supabase db diff never applies it`,
+		fix: `add it to [db.migrations] schema_paths before every file that calls permdock_has, permitted_<scope>_ids or member_<scope>_ids`
+	}];
+	const helperFile = rel(cwd, files[helpers]?.file ?? "");
+	return files.slice(0, helpers).filter(({ text }) => CALLS_HELPER.test(text)).map(({ file }) => ({
+		code: "PD043",
+		severity: "warning",
+		message: `${rel(cwd, file)} calls the PermDock helpers, but schema_paths applies it before ${helperFile}, which defines them`,
+		fix: `list ${helperFile} earlier in [db.migrations] schema_paths, or give it a lower number, such as 056_permdock_helpers.sql before 060_policies.sql`
+	}));
+}
+//#endregion
+//#region src/cli/doctor-next.ts
+const ROUTE_GLOBS = ["**/api/permdock/route.{ts,tsx,js,jsx,mjs}"];
+const ENDPOINT = /\bendpoint\s*(?::|=)\s*\{?\s*['"`]/u;
+/** A grant the snapshot marks `portable: false`, so a client check needs the endpoint. */
+function serverOnly(policy, grant) {
+	if (!grant.portable || hasConditionOp(grant.where, "related")) return true;
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return item.through !== void 0 || isPrincipalRelation(spec) && spec.period !== void 0;
+	});
+}
+function serverOnlyKeys(policy) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grant.effect === "allow" && serverOnly(policy, grant)) keys.add(grant.permission.key);
+	return keys;
+}
+/** An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result, or an `endpoint` string in the source. */
+function hasEndpoint(cwd, sources) {
+	if (listSourceFiles(cwd, ROUTE_GLOBS).filter((file) => /(?:^|[\\/])app[\\/]/u.test(rel(cwd, file))).some((file) => readFileSync(file, "utf8").includes("permdockHandler"))) return true;
+	return sources.some((file) => ENDPOINT.test(readFileSync(file, "utf8")));
+}
+/**
+* PD044: `usePermission` reads a permission whose grant the snapshot cannot
+* answer, and the app has no endpoint to ask, so the client always denies it.
+*/
+async function pd044(input) {
+	if (input.config.policy === void 0) return [];
+	let policy;
+	try {
+		policy = asPolicy(pickNamed(await loadModule(resolve(input.cwd, input.config.policy)), ["policy"]));
+	} catch {
+		return [];
+	}
+	const keys = serverOnlyKeys(policy);
+	if (keys.size === 0) return [];
+	const usages = (await runCollect({
+		cwd: input.cwd,
+		config: input.config,
+		collect: input.config.collect ?? {},
+		check: true,
+		now: input.now,
+		io: input.io
+	})).scan?.usages ?? {};
+	const hooked = [...keys].toSorted().flatMap((key) => (usages[key] ?? []).filter((usage) => usage.call === "usePermission").map((usage) => ({
+		key,
+		usage
+	})));
+	if (hooked.length === 0) return [];
+	const sources = listSourceFiles(input.cwd, input.config.collect?.srcPath ?? defaultSrcPath());
+	if (hasEndpoint(input.cwd, sources)) return [];
+	return hooked.map(({ key, usage }) => ({
+		code: "PD044",
+		severity: "warning",
+		message: `usePermission reads ${key} at ${usage.file}:${String(usage.line)}, whose grant needs the server (a closure, graph relation or period), and no app/**/api/permdock/route.ts exports permdockHandler and no endpoint is configured: the client always answers denied (server-only)`,
+		fix: "add app/api/permdock/route.ts exporting permdockHandler(), pass endpoint to createPermDock, or check it on the server with getPermission"
+	}));
+}
+//#endregion
+//#region src/cli/doctor-seeds.ts
+const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
+const SEED_CLEAR = /^delete\s+from\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*$/iu;
+const LITERAL = String.raw`'((?:[^']|'')*)'`;
+const SEED_ROW = new RegExp(String.raw`\(\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*\)`, "gu");
+function rowKey(values) {
+	return values.join(" ");
+}
+/** The rows of the last statement that seeds or clears `table`, in migration order. */
+function lastSeed(cwd, config, table) {
+	let seeded;
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(readFileSync(file, "utf8"))) {
+		const insert = SEED_INSERT.exec(text);
+		if (insert !== null && tableKey(group(insert, 1)) === table) {
+			const rows = /* @__PURE__ */ new Set();
+			for (const row of group(insert, 2).matchAll(SEED_ROW)) rows.add(rowKey(row.slice(1, 6).map((value) => value.replaceAll("''", "'"))));
+			seeded = {
+				file: rel(cwd, file),
+				rows
+			};
+			continue;
+		}
+		const clear = SEED_CLEAR.exec(text);
+		if (clear !== null && tableKey(group(clear, 1)) === table) seeded = {
+			file: rel(cwd, file),
+			rows: /* @__PURE__ */ new Set()
+		};
+	}
+	return seeded;
+}
+/** The first three rows, as `(role permission grant_key scope effect)`. */
+function sample(rows) {
+	return rows.slice(0, 3).map((row) => `(${row})`).join(", ");
+}
+/**
+* PD054: the `role_permissions` rows the migrations seed last are not the
+* rows the policy compiles to, so the helpers answer from a stale policy.
+*/
+async function pd054(input) {
+	const { cwd, config } = input;
+	const rls = config.rls;
+	if (config.policy === void 0 || rls === void 0 && config.supabase === void 0) return [];
+	const schema = rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const seeded = lastSeed(cwd, config, `${schema}.role_permissions`);
+	if (seeded === void 0) return [];
+	const policy = await loadPolicy(cwd, config.policy);
+	if (policy === void 0) return [];
+	const ctx = {
+		dialect: rls?.dialect ?? "supabase",
+		scopes: scopeList(policy.scopes),
+		tenantClaim: rls?.tenantClaim ?? "tenant_id",
+		gucPrefix: rls?.gucPrefix ?? "app",
+		...rls?.actions === void 0 ? {} : { actions: rls.actions },
+		schema,
+		...rls?.fields === "views" ? { fields: "views" } : {}
+	};
+	let expected;
+	try {
+		expected = new Set(compileGrants(policy, ctx, rls?.tables, [], true).rolePermissions.map((row) => rowKey([
+			row.role,
+			row.permission,
+			row.grantKey,
+			row.scope,
+			row.effect
+		])));
+	} catch {
+		return [];
+	}
+	const missing = [...expected].filter((row) => !seeded.rows.has(row));
+	const stale = [...seeded.rows].filter((row) => !expected.has(row));
+	if (missing.length === 0 && stale.length === 0) return [];
+	const parts = [...missing.length === 0 ? [] : [`${String(missing.length)} missing, such as ${sample(missing)}`], ...stale.length === 0 ? [] : [`${String(stale.length)} stale, such as ${sample(stale)}`]];
+	return [{
+		code: "PD054",
+		severity: "warning",
+		message: `${seeded.file} seeds ${schema}.role_permissions with rows the policy no longer compiles to: ${parts.join("; ")}`,
+		fix: "run permdock rls generate (with --split ...,seeds --seeds-out into a new migration for declarative schemas) and apply it"
+	}];
+}
+//#endregion
+//#region src/cli/doctor-sql.ts
+/** Supabase's `[api] schemas` when `config.toml` sets none. */
+const API_SCHEMAS = ["public", "graphql_public"];
+const NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
+const IDENT = String.raw`("[^"]+"|\w+)`;
+/** A statement without its dollar-quoted bodies: what a function header says. */
+function header(text) {
+	return text.replaceAll(/\$([A-Za-z_]*)\$[\s\S]*?\$\1\$/gu, "$$$$");
+}
+function isSupabase(cwd, config) {
+	return existsSync(join(cwd, "supabase")) || config.rls?.dialect === "supabase" || config.supabase !== void 0;
+}
+function migrationStatements(cwd, config) {
+	return sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).flatMap((file) => sqlStatements(readFileSync(file, "utf8")).map((statement) => Object.assign({ file: rel(cwd, file) }, statement)));
+}
+/** The schema of a `tableKey`, which always names one. */
+function schemaOf(key) {
+	return key.slice(0, key.indexOf("."));
+}
+function unquote(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+/**
+* PD046: the schema of PermDock's `security definer` helpers is one the Data
+* API exposes, so PostgREST serves them as RPCs.
+*/
+function pd046(cwd, config) {
+	if (!existsSync(join(cwd, "supabase/config.toml"))) return [];
+	const schema = config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
+	if (!(supabaseConfig(cwd).apiSchemas ?? API_SCHEMAS).includes(schema)) return [];
+	return [{
+		code: "PD046",
+		severity: "warning",
+		message: `the PermDock helper schema ${schema} is in [api] schemas in supabase/config.toml, so the Data API serves its security definer helpers as RPCs`,
+		fix: schema === "public" ? `drop rls.schema: 'public' so the helpers move to the private ${PERMDOCK_SCHEMA} schema, regenerate with permdock rls generate, and keep ${PERMDOCK_SCHEMA} out of [api] schemas` : `remove ${schema} from [api] schemas; policies reach the helpers through grant usage, not the Data API`
+	}];
+}
+const USER_METADATA = /\b(raw_user_meta_data|user_metadata)\b/giu;
+/** PD047: SQL that reads `user_metadata`, which every user can edit for themselves. */
+function pd047(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	return migrationStatements(cwd, config).flatMap((statement) => [...statement.text.matchAll(USER_METADATA)].map((match) => ({
+		code: "PD047",
+		severity: "warning",
+		message: `${statement.file}:${String(statement.line + statement.text.slice(0, match.index).split("\n").length - 1)} reads ${match[0]}, which a user can set for themselves`,
+		fix: "decide access from app_metadata (raw_app_meta_data), a server-owned table or a hook claim; user_metadata is for display only"
+	})));
+}
+const CREATE_FUNCTION = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?function\s+${NAME}\s*\(`, "iu");
+const ALTER_SEARCH_PATH = new RegExp(String.raw`^alter\s+function\s+${NAME}\s*(?:\([^)]*\))?\s+set\s+search_path\b`, "iu");
+const REVOKE_EXECUTE = new RegExp(String.raw`^revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:function|routine)\s+${NAME}\s*(?:\([^)]*\))?\s+from\s+([\s\S]+)$`, "iu");
+const REVOKE_ALL_FUNCTIONS = new RegExp(String.raw`^(?:alter\s+default\s+privileges\s+(?:for\s+role\s+\S+\s+)?in\s+schema\s+${IDENT}\s+)?revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:all\s+)?(?:functions|routines)(?:\s+in\s+schema\s+${IDENT})?\s+from\s+([\s\S]+)$`, "iu");
+function createdFunctions(statements) {
+	return statements.flatMap((statement) => {
+		const match = CREATE_FUNCTION.exec(statement.text);
+		return match === null ? [] : [{
+			...statement,
+			key: tableKey(group(match, 1)),
+			head: header(statement.text)
+		}];
+	});
+}
+/** PD048: a function without `set search_path`, so a caller's objects can shadow the ones it names. */
+function pd048(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	const statements = migrationStatements(cwd, config);
+	const altered = new Set(statements.flatMap((statement) => {
+		const match = ALTER_SEARCH_PATH.exec(statement.text);
+		return match === null ? [] : [tableKey(group(match, 1))];
+	}));
+	return createdFunctions(statements).filter((fn) => !/\bset\s+search_path\b/iu.test(fn.head) && !altered.has(fn.key) && !/\blanguage\s+(?:c|internal)\b/iu.test(fn.head)).map((fn) => {
+		const definer = /\bsecurity\s+definer\b/iu.test(fn.head);
+		return {
+			code: "PD048",
+			severity: "warning",
+			message: `${fn.file}:${String(fn.line)} ${definer ? "security definer " : ""}function ${fn.key} sets no search_path${definer ? ", so a caller can shadow what it reads with their own objects" : ""}`,
+			fix: `add set search_path = '' and qualify every name in the body (Supabase advisor function_search_path_mutable)`
+		};
+	});
+}
+/** Roles each `revoke` statement takes `execute` from, per function key or `schema.*`. */
+function revokedExecute(statements) {
+	const revoked = /* @__PURE__ */ new Map();
+	const add = (key, roles) => {
+		const set = revoked.get(key) ?? /* @__PURE__ */ new Set();
+		for (const role of roles.split(",")) set.add(unquote(role.trim().replace(/\s+(?:cascade|restrict)$/iu, "")));
+		revoked.set(key, set);
+	};
+	for (const statement of statements) {
+		const one = REVOKE_EXECUTE.exec(statement.text);
+		if (one !== null) {
+			add(tableKey(group(one, 1)), group(one, 2));
+			continue;
+		}
+		const all = REVOKE_ALL_FUNCTIONS.exec(statement.text);
+		if (all !== null) {
+			const schema = all[1] ?? all[2];
+			add(`${schema === void 0 ? "*" : unquote(schema)}.*`, group(all, 3));
+		}
+	}
+	return revoked;
+}
+/**
+* PD049: a `security definer` function `public` (every role) or, in Supabase's
+* `public` schema, `anon` may still execute: Postgres grants `execute` to
+* `public` on create, and Supabase's default privileges grant it to `anon`.
+*/
+function pd049(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	const statements = migrationStatements(cwd, config);
+	const revoked = revokedExecute(statements);
+	const findings = [];
+	for (const fn of createdFunctions(statements)) {
+		if (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head)) continue;
+		const schema = schemaOf(fn.key);
+		const from = /* @__PURE__ */ new Set([
+			...revoked.get(fn.key) ?? [],
+			...revoked.get(`${schema}.*`) ?? [],
+			...revoked.get("*.*") ?? []
+		]);
+		const missing = ["public", ...schema === "public" ? ["anon"] : []].filter((role) => !from.has(role));
+		if (missing.length > 0) findings.push({
+			code: "PD049",
+			severity: "warning",
+			message: `${fn.file}:${String(fn.line)} security definer function ${fn.key} can be executed by ${missing.join(" and ")}`,
+			fix: `revoke execute on function ${fn.key}(…) from public, anon; then grant execute to the roles that call it`
+		});
+	}
+	return findings;
+}
+const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}\s*\(`, "iu");
+const ENABLE_RLS = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}[\s\S]*\benable\s+row\s+level\s+security\b`, "iu");
+const DROP_TABLE = /^drop\s+table\s+(?:if\s+exists\s+)?([\s\S]+?)(?:\s+(?:cascade|restrict))?$/iu;
+/** PD050: a `public` table without row level security, which the Data API serves whole. */
+function pd050(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	const created = /* @__PURE__ */ new Map();
+	const enabled = /* @__PURE__ */ new Set();
+	for (const statement of migrationStatements(cwd, config)) {
+		const table = CREATE_TABLE.exec(statement.text);
+		if (table !== null) {
+			created.set(tableKey(group(table, 1)), statement);
+			continue;
+		}
+		const rls = ENABLE_RLS.exec(statement.text);
+		if (rls !== null) {
+			enabled.add(tableKey(group(rls, 1)));
+			continue;
+		}
+		const dropped = DROP_TABLE.exec(statement.text);
+		if (dropped !== null) for (const name of group(dropped, 1).split(",")) created.delete(tableKey(name.trim()));
+	}
+	return [...created].filter(([key]) => schemaOf(key) === "public" && !enabled.has(key)).map(([key, statement]) => ({
+		code: "PD050",
+		severity: "error",
+		message: `${statement.file}:${String(statement.line)} creates ${key} without row level security, so the Data API serves every row to anon and authenticated`,
+		fix: `alter table ${key} enable row level security; permdock rls generate writes its policies`
+	}));
+}
+const CREATE_POLICY = new RegExp(String.raw`^create\s+policy\s+${IDENT}\s+on\s+${NAME}([\s\S]*)$`, "iu");
+const UNWRAPPED_AUTH = /(?<!\bselect\s{1,20})\bauth\.(uid|jwt)\s*\(\s*\)/giu;
+/** PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres runs it once per row. */
+function pd051(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	return migrationStatements(cwd, config).flatMap((statement) => {
+		const policy = CREATE_POLICY.exec(statement.text);
+		if (policy === null) return [];
+		const calls = [...new Set([...group(policy, 3).matchAll(UNWRAPPED_AUTH)].map((match) => `auth.${group(match, 1).toLowerCase()}()`))];
+		const [first] = calls;
+		return first === void 0 ? [] : [{
+			code: "PD051",
+			severity: "warning",
+			message: `${statement.file}:${String(statement.line)} policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} calls ${calls.join(" and ")} once per row`,
+			fix: `wrap each call as (select ${first}) so Postgres evaluates it once per statement (Supabase advisor auth_rls_initplan)`
+		}];
+	});
+}
+/** PD052: an update policy without `with check`, so nothing states what a row may become. */
+function pd052(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	return migrationStatements(cwd, config).flatMap((statement) => {
+		const policy = CREATE_POLICY.exec(statement.text);
+		const rest = policy?.[3] ?? "";
+		if (policy === null || !/\bfor\s+update\b/iu.test(rest) || /\bwith\s+check\b/iu.test(rest)) return [];
+		return [{
+			code: "PD052",
+			severity: "warning",
+			message: `${statement.file}:${String(statement.line)} update policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} has no with check, so Postgres checks the new row against using alone`,
+			fix: "add with check (...) stating what the updated row must satisfy, such as the same tenant and owner test, so an update cannot move a row out of what the user may write"
+		}];
+	});
+}
+/** Top-level comma-separated parts of a parenthesised list. */
+function topLevelParts(body) {
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < body.length; index += 1) {
+		const char = body[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (char === "," && depth === 0) {
+			parts.push(body.slice(start, index).trim());
+			start = index + 1;
+		}
+	}
+	parts.push(body.slice(start).trim());
+	return parts.filter((part) => part !== "");
+}
+/**
+* One column definition or table constraint of a `create table` body: its
+* first column, whether it is a foreign key, and whether a primary key or
+* unique constraint indexes that column.
+*/
+function tablePart(raw) {
+	const part = raw.replace(/^constraint\s+(?:"[^"]+"|\w+)\s+/iu, "");
+	const listed = /^(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)/iu.exec(part);
+	if (listed !== null) {
+		const foreign = /^foreign/iu.test(group(listed, 1));
+		return {
+			column: firstColumn(group(listed, 2)),
+			foreign,
+			indexed: !foreign
+		};
+	}
+	return {
+		column: unquote(/^("[^"]+"|\w+)/u.exec(part)?.[1] ?? ""),
+		foreign: /\breferences\b/iu.test(part),
+		indexed: /\b(?:primary\s+key|unique)\b/iu.test(part)
+	};
+}
+function firstColumn(list) {
+	return unquote(list.replace(/,[\s\S]*$/u, "").trim());
+}
+const ADD_CONSTRAINT = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}\s+add\s+(?:constraint\s+${IDENT}\s+)?(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)`, "iu");
+const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?${NAME}\s*(?:using\s+\w+\s*)?\(\s*${IDENT}`, "iu");
+/** PD053: a foreign key no index starts with, so joins and deletes on the referenced row scan the table. */
+function pd053(cwd, config) {
+	if (!isSupabase(cwd, config)) return [];
+	const keys = [];
+	const indexed = /* @__PURE__ */ new Set();
+	for (const statement of migrationStatements(cwd, config)) {
+		const table = CREATE_TABLE.exec(statement.text);
+		if (table !== null) {
+			const key = tableKey(group(table, 1));
+			const open = statement.text.indexOf("(", table[0].length - 1);
+			const body = statement.text.slice(open + 1, statement.text.lastIndexOf(")"));
+			for (const raw of topLevelParts(body)) {
+				const found = tablePart(raw);
+				if (found.foreign) keys.push({
+					...statement,
+					table: key,
+					column: found.column
+				});
+				if (found.indexed) indexed.add(`${key}.${found.column}`);
+			}
+			continue;
+		}
+		const added = ADD_CONSTRAINT.exec(statement.text);
+		if (added !== null) {
+			const key = tableKey(group(added, 1));
+			const column = firstColumn(group(added, 4));
+			if (/^foreign/iu.test(group(added, 3))) keys.push({
+				...statement,
+				table: key,
+				column
+			});
+			else indexed.add(`${key}.${column}`);
+			continue;
+		}
+		const index = CREATE_INDEX.exec(statement.text);
+		if (index !== null) indexed.add(`${tableKey(group(index, 2))}.${unquote(group(index, 3))}`);
+	}
+	return keys.filter((fk) => !indexed.has(`${fk.table}.${fk.column}`)).map((fk) => ({
+		code: "PD053",
+		severity: "warning",
+		message: `${fk.file}:${String(fk.line)} ${fk.table}.${fk.column} is a foreign key no index starts with, so policies that join on it and deletes of the referenced row scan ${fk.table}`,
+		fix: `create index on ${fk.table} (${fk.column}); (Supabase advisor unindexed_foreign_keys)`
+	}));
+}
+/**
+* PD056: SQL still calls an `rls.migrate` helper by its legacy name, so the
+* shim (or the legacy function) cannot be dropped yet.
+*/
+function pd056(cwd, config) {
+	const helpers = Object.keys(config.rls?.migrate?.helpers ?? {}).filter((name) => /^[a-z_][a-z0-9_]*$/u.test(name));
+	if (helpers.length === 0) return [];
+	const statements = migrationStatements(cwd, config);
+	const findings = [];
+	for (const name of helpers) {
+		const own = new RegExp(String.raw`^\s*(?:create\s+(?:or\s+replace\s+)?function|drop\s+function|revoke|grant|alter\s+function|comment\s+on\s+function)\b[^(]*?(?:^|[\s."])${name}"?\s*\(`, "iu");
+		const call = new RegExp(String.raw`(?<![\w$])(?:(?:"[^"]+"|\w+)\s*\.\s*)?"?${name}"?\s*\(`, "giu");
+		let count = 0;
+		const files = /* @__PURE__ */ new Set();
+		for (const statement of statements) {
+			const hits = own.test(statement.text) ? 0 : (statement.text.match(call) ?? []).length;
+			if (hits > 0) {
+				count += hits;
+				files.add(statement.file);
+			}
+		}
+		if (count === 0) continue;
+		findings.push({
+			code: "PD056",
+			severity: "warning",
+			message: `legacy helper ${name} is still called ${String(count)} time(s), in ${[...files].toSorted().join(", ")}`,
+			fix: `run permdock rls migrate --write for policies, rewrite function bodies, views and triggers onto the permdock helpers by hand, then drop function ${name}`
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor.ts
+/** Static checks over the Supabase migrations; `--only sql` runs them alone. */
+const SQL_CHECKS = [
+	["PD046", pd046],
+	["PD047", pd047],
+	["PD048", pd048],
+	["PD049", pd049],
+	["PD050", pd050],
+	["PD051", pd051],
+	["PD052", pd052],
+	["PD053", pd053]
+];
+async function runDoctor(input) {
+	if (input.fix) {
+		runSkillsInstall({
+			cwd: input.cwd,
+			agents: []
+		});
+		await runCollect({
+			cwd: input.cwd,
+			config: input.config,
+			collect: input.config.collect ?? {},
+			check: false,
+			now: input.now,
+			io: input.io
+		});
+	}
+	const findings = [];
+	const wanted = new Set(input.only);
+	const include = (group) => wanted.size === 0 || wanted.has(group) || wanted.has(group.toLowerCase());
+	const srcPath = input.config.collect?.srcPath ?? defaultSrcPath();
+	const sources = listSourceFiles(input.cwd, srcPath).map((file) => ({
+		file: rel(input.cwd, file),
+		text: readFileSync(file, "utf8")
+	}));
+	if (include("imports") || include("PD001")) {
+		const clientEntries = new Set(listSourceFiles(input.cwd, input.config.doctor?.clientEntries ?? []).map((file) => rel(input.cwd, file)));
+		findings.push(...pd001(sources, clientEntries));
+	}
+	if (include("references") || include("PD002")) findings.push(...await pd002(input));
+	if (include("ungranted") || include("PD003")) findings.push(...await pd003(input));
+	if (include("catalog") || include("PD004")) findings.push(...await pd004(input));
+	if (include("skills") || include("PD005")) findings.push(...pd005(input.cwd));
+	if (include("typescript") || include("PD006")) findings.push(...pd006(input.cwd));
+	if (include("validation") || include("PD007")) findings.push(...pd007(sources));
+	if (include("naming") || include("PD008")) findings.push(...pd008(sources));
+	if (include("duplicates") || include("PD009")) findings.push(...pd009(input.cwd));
+	if (include("claims") || include("PD010")) findings.push(...pd010(sources));
+	if (include("tenant") || include("PD011")) findings.push(...pd011(sources));
+	if (include("drafts") || include("PD012")) findings.push(...pd012(input.cwd, input.config));
+	if (include("algorithms") || include("PD013")) findings.push(...pd013(sources));
+	if (include("discovery") || include("PD014")) findings.push(...pd014(sources));
+	if (include("typ") || include("PD015")) findings.push(...pd015(sources));
+	if (include("rls") || include("PD016")) findings.push(...await pd016(input));
+	if (include("sensitive") || include("PD017")) findings.push(...await pd017(input));
+	if (include("separation") || include("PD018")) findings.push(...await pd018(input));
+	if (include("jwt-roles") || include("PD019")) findings.push(...await pd019(input));
+	if (include("hosted") || include("PD020")) findings.push(...await pd020(input));
+	if (include("hosted") || include("PD021")) findings.push(...await pd021({
+		...input,
+		env: input.io.env ?? process.env
+	}));
+	if (include("views") || include("PD022")) findings.push(...pd022(input.cwd, input.config));
+	if (include("custom-roles") || include("PD023")) findings.push(...await pd023(input));
+	if (include("self-approval") || include("PD024")) findings.push(...await pd024(input));
+	if (include("scopes") || include("PD025")) findings.push(...await pd025(input));
+	if (include("ownership") || include("PD026")) findings.push(...await pd026(input));
+	if (include("rls") || include("context-refs") || include("PD027")) findings.push(...await pd027(input));
+	if (include("attrs") || include("supabase") || include("PD028")) findings.push(...pd028(input.cwd, input.config, attrsPlan));
+	if (include("credentials") || include("PD029")) findings.push(...pd029(input));
+	if (include("fields") || include("PD030")) findings.push(...await pd030(input));
+	if (include("graph") || include("PD031")) findings.push(...await pd031(input));
+	if (include("graph") || include("rls") || include("PD032")) findings.push(...await pd032(input));
+	if (include("activation") || include("PD033")) findings.push(...await pd033(input));
+	if (include("break-glass") || include("PD034")) findings.push(...await pd034(input));
+	if (include("support") || include("PD035")) findings.push(...await pd035(input));
+	if (include("bola") || include("PD036")) findings.push(...pd036(sources));
+	if (include("supabase") || include("row-conditions") || include("PD037")) findings.push(...await pd037(input));
+	if (input.config.supabase?.hook !== void 0 && (include("supabase") || include("helpers") || include("PD039"))) findings.push(...await supabaseSetup(input));
+	if ((input.config.rls !== void 0 || input.config.supabase?.hook !== void 0) && (include("supabase") || include("tenant") || include("PD038"))) findings.push(...pd038(sources, input.config.rls?.tenantClaim ?? "tenant_id", supabaseTenantClaim));
+	if (input.config.rls?.anonymousSignIns === "deny" && (include("supabase") || include("anonymous") || include("PD057"))) findings.push(...pd057(sources));
+	if (include("supabase") || include("auth-role") || include("PD040")) findings.push(...pd040(input.cwd, input.config));
+	if (include("supabase") || include("capabilities") || include("PD041")) findings.push(...pd041(sources));
+	if (include("supabase") || include("declarative") || include("PD042")) findings.push(...pd042(input.cwd, input.config));
+	if (include("supabase") || include("declarative") || include("PD043")) findings.push(...pd043(input.cwd));
+	if (include("supabase") || include("PD045")) findings.push(...pd045(input.cwd));
+	for (const [code, check] of SQL_CHECKS) if (include("supabase") || include("sql") || include(code)) findings.push(...check(input.cwd, input.config));
+	if (include("supabase") || include("seeds") || include("PD054")) findings.push(...await pd054(input));
+	if (include("custom-roles") || include("renamed") || include("PD055")) findings.push(...await pd055(input));
+	if (include("sql") || include("shims") || include("PD056")) findings.push(...pd056(input.cwd, input.config));
+	if (include("next") || include("endpoint") || include("PD044")) findings.push(...await pd044(input));
+	const errors = findings.filter((item) => item.severity === "error").length;
+	const warnings = findings.filter((item) => item.severity === "warning").length;
+	const report = {
+		$schema: DOCTOR_REPORT_SCHEMA,
+		findings,
+		errors,
+		warnings
+	};
+	return {
+		code: errors > 0 || input.strict && warnings > 0 ? 1 : 0,
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatDoctor(report, input.color)
+	};
+}
+function formatDoctor(report, color) {
+	const style = createStyle(color);
+	const lines = [style.paint("bold", "permdock doctor"), ""];
+	for (const finding of report.findings) {
+		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
+		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
+		lines.push(`           ${style.paint("dim", `fix: ${finding.fix}`)}`);
+	}
+	if (report.findings.length === 0) lines.push("  no findings");
+	lines.push("");
+	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}`);
+	return `${lines.join("\n")}\n`;
+}
+async function supabaseSetup(input) {
+	let manifest;
+	try {
+		manifest = supabaseHookManifest(await loadScopes(input.cwd, input.config), input.config, { out: hookOut(input.cwd, input.config) });
+	} catch {
+		return [];
+	}
+	return pd039({
+		cwd: input.cwd,
+		config: input.config,
+		manifest
+	});
+}
+//#endregion
+export { runDoctor };