permdock 0.3.1 → 0.5.0

package/dist/doctor-DvH0IQff.js

@@ -1,1194 +0,0 @@
-import { _ as listPermissions, a as formerKeys, m as isPrincipalRelation } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { d as scopeList } from "./scopes-CVdPrWN-.js";
-import { s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { r as DOCTOR_REPORT_SCHEMA } from "./version-BvacVTZR.js";
-import { a as sqlFiles, i as rel, n as doctorSrcPath, r as listSourceFiles } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DSTE3ml9.js";
-import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-4p0-4xQm.js";
-import "./markers-B0hYLvMD.js";
-import { t as createStyle } from "./style-CTm1AXDT.js";
-import { i as runSkillsInstall } from "./skills-Biq5uup3.js";
-import { a as pd006, c as pd022, d as group, h as tableKey, i as pd005, l as pd028, n as supabaseConfig, o as pd009, p as sqlStatements, r as MIGRATION_DIRS, s as pd012, t as pd045, u as pd040 } from "./supabase-config-Bj3iDH2I.js";
-import { m as compileGrants } from "./rls-fields-CZOMlwHl.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, u as pd036 } from "./usage-ItS7nLcl.js";
-import { C as pd035, E as policyOf, S as pd034, T as pd055, _ as pd029, a as pd004, b as pd032, c as pd018, d as pd021, f as pd023, g as pd027, h as pd026, i as pd003, l as pd019, m as pd025, n as collectedOf, o as pd016, p as pd024, r as pd002, s as pd017, u as pd020, v as pd030, w as pd037, x as pd033, y as pd031 } from "./doctor-collect-CjdO0wQX.js";
-import { a as ownershipRules, i as guardedTables } from "./rls-ownership-DcYlZ09B.js";
-import { a as supabaseHookManifest, c as attrsPlan, h as partPath, n as hookOut, s as pd039 } from "./supabase-hook-ntETYCQu.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-Dv1_aWF7.js";
-import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
-import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
-//#region src/cli/doctor-assignments.ts
-const TRIGGER = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?trigger\s+"?permdock_assignment"?\s[\s\S]*?\bon\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`, "iu");
-/** The tables a `permdock_assignment` trigger is created on in the migrations and the `rls generate` output. */
-function triggeredTables(input) {
-	const out = input.config.rls?.out ?? "rls.sql";
-	const files = sqlFiles(input.cwd, [...input.config.doctor?.migrations ?? MIGRATION_DIRS, ...new Set([
-		out,
-		partPath(out, "helpers"),
-		partPath(out, "policies")
-	].filter((file) => file.endsWith(".sql")))]);
-	const tables = /* @__PURE__ */ new Set();
-	for (const file of files) for (const statement of sqlStatements(readFileSync(file, "utf8"))) {
-		const match = TRIGGER.exec(statement.text);
-		if (match !== null) tables.add(tableKey(group(match, 1)));
-	}
-	return tables;
-}
-/**
-* PD064: `rls.assignments` guards a table (a membership table, the
-* global-roles table or a listed table) that no `permdock_assignment`
-* trigger is created on in the migrations or the `rls generate` output, so a
-* client may write any role there.
-*/
-async function pd064(input) {
-	if (input.config.rls?.assignments === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const scopes = scopeList(policy.scopes);
-	if ((ownershipRules(policy, scopes)?.assigns.length ?? 0) === 0) return [];
-	const found = triggeredTables(input);
-	return guardedTables(input.config, scopes).filter((table) => !found.has(tableKey(table))).map((table) => ({
-		code: "PD064",
-		severity: "warning",
-		message: `rls.assignments guards ${table}, but no migration creates its permdock_assignment trigger, so a client may write any role there`,
-		fix: "run permdock rls generate and apply its output in a migration, or set rls.out or doctor.migrations to where it lives"
-	}));
-}
-//#endregion
-//#region src/cli/doctor-declarative.ts
-const SCHEMAS = "supabase/schemas";
-const MIGRATIONS = "supabase/migrations";
-const CREATES_HOOK = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*custom_access_token_hook\b/iu;
-const DROPS_HOOK = /\bdrop\s+function\s+(?:if\s+exists\s+)?[\w."]*custom_access_token_hook\b/iu;
-const GRANTS_HOOK = /\bgrant\s+execute\s+on\s+function\s+[\w."]*custom_access_token_hook\s*\(\s*jsonb\s*\)\s+to\s+supabase_auth_admin\b/iu;
-const DEFINES_HELPER = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*permdock_has\s*\(/iu;
-const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids)\s*\(/iu;
-function uncommented(text) {
-	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
-}
-/**
-* PD042: a hook declared under `supabase/schemas` reaches the database through
-* `supabase db diff`, which drops its `supabase_auth_admin` grants. pg-delta
-* keeps them, so the check is off under `[experimental.pgdelta]`. A function
-* created (or dropped and created again) without them is executable by
-* `public` and not by the auth server, so a migration at or after the one
-* that creates it must carry the grants.
-*/
-function pd042(cwd, config) {
-	if (config.supabase?.hook === void 0 || supabaseConfig(cwd).pgDelta !== void 0) return [];
-	if (!sqlFiles(cwd, [SCHEMAS]).some((file) => readFileSync(file, "utf8").startsWith(`-- permdock:hook v1 `))) return [];
-	const migrations = sqlFiles(cwd, [MIGRATIONS]).map((file) => ({
-		file,
-		text: uncommented(readFileSync(file, "utf8"))
-	}));
-	const created = migrations.findIndex(({ text }) => CREATES_HOOK.test(text));
-	const dropped = migrations.findLastIndex(({ text }) => DROPS_HOOK.test(text));
-	const needed = Math.max(created, dropped);
-	if (needed === -1) return [];
-	if (migrations.findLastIndex(({ text }) => GRANTS_HOOK.test(text)) >= needed) return [];
-	return [{
-		code: "PD042",
-		severity: "error",
-		message: `${rel(cwd, migrations[needed]?.file ?? MIGRATIONS)} creates custom_access_token_hook from supabase/schemas, and no migration from it on grants it to supabase_auth_admin: supabase db diff drops those grants, so the auth server cannot call the hook and public can`,
-		fix: "generate the grants with permdock supabase hook generate --grants-out (or rls generate --split ...,hook --grants-out) into a new file from supabase migration new, after the db diff migration"
-	}];
-}
-/** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
-function schemaPaths(cwd) {
-	const paths = supabaseConfig(cwd).schemaPaths ?? [];
-	return paths.length === 0 ? ["./schemas/**/*.sql"] : paths;
-}
-/** Schema files in the order `supabase db diff` applies them: each glob in turn, sorted within it. */
-function orderedSchemaFiles(cwd) {
-	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
-}
-/**
-* PD043: `db diff` applies schema files in `schema_paths` order, so a policy
-* that calls `permdock_has` or `permitted_<scope>_ids` before the file that
-* defines them fails to apply. pg-delta orders by dependencies instead.
-*/
-function pd043(cwd) {
-	if (supabaseConfig(cwd).pgDelta !== void 0) return [];
-	if (!existsSync(join(cwd, SCHEMAS))) return [];
-	const files = orderedSchemaFiles(cwd).map((file) => ({
-		file,
-		text: uncommented(readFileSync(file, "utf8"))
-	}));
-	const helpers = files.findIndex(({ text }) => DEFINES_HELPER.test(text));
-	const defined = sqlFiles(cwd, [SCHEMAS]).find((file) => DEFINES_HELPER.test(uncommented(readFileSync(file, "utf8"))));
-	if (helpers === -1) return defined === void 0 ? [] : [{
-		code: "PD043",
-		severity: "warning",
-		message: `${rel(cwd, defined)} defines the PermDock helpers, but schema_paths in supabase/config.toml does not list it, so supabase db diff never applies it`,
-		fix: `add it to [db.migrations] schema_paths before every file that calls permdock_has, permitted_<scope>_ids or member_<scope>_ids`
-	}];
-	const helperFile = rel(cwd, files[helpers]?.file ?? "");
-	return files.slice(0, helpers).filter(({ text }) => CALLS_HELPER.test(text)).map(({ file }) => ({
-		code: "PD043",
-		severity: "warning",
-		message: `${rel(cwd, file)} calls the PermDock helpers, but schema_paths applies it before ${helperFile}, which defines them`,
-		fix: `list ${helperFile} earlier in [db.migrations] schema_paths, or give it a lower number, such as 056_permdock_helpers.sql before 060_policies.sql`
-	}));
-}
-//#endregion
-//#region src/cli/doctor-next.ts
-const ROUTE_GLOBS = ["**/api/permdock/route.{ts,tsx,js,jsx,mjs}"];
-const ENDPOINT = /\bendpoint\s*(?::|=)\s*\{?\s*['"`]/u;
-const NATIVE_IMPORT = /\bfrom\s*['"]permdock\/react-native['"]/u;
-const CLIENT_READS = /* @__PURE__ */ new Set(["usePermission", "reference"]);
-/** A grant the snapshot marks `portable: false`, so a client check needs the endpoint. */
-function serverOnly(policy, grant) {
-	if (!grant.portable || hasConditionOp(grant.where, "related")) return true;
-	const relations = policy.resources.get(grant.permission.resource)?.relations;
-	return flattenGrantee(grant.to).some((item) => {
-		if (item.kind !== "relation") return false;
-		const spec = relations?.[item.relation];
-		return item.through !== void 0 || isPrincipalRelation(spec) && spec.period !== void 0;
-	});
-}
-function serverOnlyKeys(policy) {
-	const keys = /* @__PURE__ */ new Set();
-	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grant.effect === "allow" && serverOnly(policy, grant)) keys.add(grant.permission.key);
-	return keys;
-}
-/** An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result, or an `endpoint` string in the source. */
-function hasEndpoint(cwd, sources) {
-	if (listSourceFiles(cwd, ROUTE_GLOBS).filter((file) => /(?:^|[\\/])app[\\/]/u.test(rel(cwd, file))).some((file) => readFileSync(file, "utf8").includes("permdockHandler"))) return true;
-	return sources.some((file) => ENDPOINT.test(readFileSync(file, "utf8")));
-}
-/**
-* PD044: `usePermission` reads a permission whose grant the snapshot cannot
-* answer, and the app has no endpoint to ask, so the client always denies it.
-*/
-async function pd044(input) {
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const keys = serverOnlyKeys(policy);
-	if (keys.size === 0) return [];
-	const usages = (await collectedOf(input)).scan?.usages ?? {};
-	const hooked = [...keys].toSorted().flatMap((key) => (usages[key] ?? []).filter((usage) => usage.call === "usePermission").map((usage) => ({
-		key,
-		usage
-	})));
-	if (hooked.length === 0) return [];
-	const sources = listSourceFiles(input.cwd, doctorSrcPath(input.config));
-	if (hasEndpoint(input.cwd, sources)) return [];
-	return hooked.map(({ key, usage }) => ({
-		code: "PD044",
-		severity: "warning",
-		message: `usePermission reads ${key} at ${usage.file}:${String(usage.line)}, whose grant needs the server (a closure, graph relation or period), and no app/**/api/permdock/route.ts exports permdockHandler and no endpoint is configured: the client always answers denied (server-only)`,
-		fix: "add app/api/permdock/route.ts exporting permdockHandler(), pass endpoint to createPermDock, or check it on the server with getPermission"
-	}));
-}
-/**
-* PD065: a file that imports `permdock/react-native` reads a permission whose
-* grant the snapshot cannot answer, so the device answers it only online.
-*/
-async function pd065(input) {
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const keys = serverOnlyKeys(policy);
-	if (keys.size === 0) return [];
-	const usages = (await collectedOf(input)).scan?.usages ?? {};
-	const native = /* @__PURE__ */ new Map();
-	const isNative = (file) => {
-		let hit = native.get(file);
-		if (hit === void 0) {
-			try {
-				hit = NATIVE_IMPORT.test(readFileSync(join(input.cwd, file), "utf8"));
-			} catch {
-				hit = false;
-			}
-			native.set(file, hit);
-		}
-		return hit;
-	};
-	return [...keys].toSorted().flatMap((key) => (usages[key] ?? []).filter((usage) => CLIENT_READS.has(usage.call) && isNative(usage.file)).map((usage) => ({
-		code: "PD065",
-		severity: "warning",
-		message: `React Native code reads ${key} at ${usage.file}:${String(usage.line)}, whose grant needs the server (a closure, graph relation or period): offline the device answers denied (server-only)`,
-		fix: "express the grant with a portable condition if the screen must work offline, or show the offline state for it"
-	})));
-}
-//#endregion
-//#region src/cli/doctor-powersync.ts
-/**
-* PD058: `sync-config.yaml` or the `powersync.manifest` file is not what the
-* policy compiles to, so PowerSync syncs rows, or the device builds
-* snapshots, by an older policy. A policy that does not compile is a finding
-* too.
-*/
-async function pd058(input) {
-	const { cwd, config } = input;
-	if (config.powersync === void 0 || config.policy === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	let compiled;
-	try {
-		compiled = powersyncFiles(policy, config);
-	} catch (cause) {
-		return [{
-			code: "PD058",
-			severity: "warning",
-			message: `the policy does not compile to Sync Streams: ${cause instanceof Error ? cause.message : String(cause)}`,
-			fix: "fix the powersync and rls config, then run permdock powersync generate"
-		}];
-	}
-	return staleFiles(cwd, compiled.files).map((file) => ({
-		code: "PD058",
-		severity: "warning",
-		message: file.missing ? `${file.path} is missing, so ${file.path === config.powersync?.manifest ? "the device builds no local snapshot" : "PowerSync syncs no stream the policy compiles to"}` : `${file.path} is not what the policy compiles to, so ${file.path === config.powersync?.manifest ? "the device builds snapshots" : "PowerSync syncs rows"} by an older policy`,
-		fix: "run permdock powersync generate and deploy the files"
-	}));
-}
-//#endregion
-//#region src/cli/doctor-seeds.ts
-const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
-const SEED_CLEAR = /^delete\s+from\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*$/iu;
-const LITERAL = String.raw`'((?:[^']|'')*)'`;
-const SEED_ROW = new RegExp(String.raw`\(\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*\)`, "gu");
-function rowKey(values) {
-	return values.join(" ");
-}
-/** The rows of the last statement that seeds or clears `table`, in migration order. */
-function lastSeed(cwd, config, table) {
-	let seeded;
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(readFileSync(file, "utf8"))) {
-		const insert = SEED_INSERT.exec(text);
-		if (insert !== null && tableKey(group(insert, 1)) === table) {
-			const rows = /* @__PURE__ */ new Set();
-			for (const row of group(insert, 2).matchAll(SEED_ROW)) rows.add(rowKey(row.slice(1, 6).map((value) => value.replaceAll("''", "'"))));
-			seeded = {
-				file: rel(cwd, file),
-				rows
-			};
-			continue;
-		}
-		const clear = SEED_CLEAR.exec(text);
-		if (clear !== null && tableKey(group(clear, 1)) === table) seeded = {
-			file: rel(cwd, file),
-			rows: /* @__PURE__ */ new Set()
-		};
-	}
-	return seeded;
-}
-/** The first three rows, as `(role permission grant_key scope effect)`. */
-function sample(rows) {
-	return rows.slice(0, 3).map((row) => `(${row})`).join(", ");
-}
-/**
-* PD054: the `role_permissions` rows the migrations seed last are not the
-* rows the policy compiles to, so the helpers answer from a stale policy.
-*/
-async function pd054(input) {
-	const { cwd, config } = input;
-	const rls = config.rls;
-	if (config.policy === void 0 || rls === void 0 && config.supabase === void 0) return [];
-	const schema = rls?.schema ?? rls?.rbac?.schema ?? "permdock";
-	const seeded = lastSeed(cwd, config, `${schema}.role_permissions`);
-	if (seeded === void 0) return [];
-	const policy = await policyOf(input);
-	if (policy === void 0) return [];
-	const ctx = {
-		dialect: rls?.dialect ?? "supabase",
-		scopes: scopeList(policy.scopes),
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		gucPrefix: rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		schema,
-		...rls?.fields === "views" ? { fields: "views" } : {}
-	};
-	let expected;
-	try {
-		expected = new Set(compileGrants(policy, ctx, rls?.tables, [], true).rolePermissions.map((row) => rowKey([
-			row.role,
-			row.permission,
-			row.grantKey,
-			row.scope,
-			row.effect
-		])));
-	} catch {
-		return [];
-	}
-	const missing = [...expected].filter((row) => !seeded.rows.has(row));
-	const stale = [...seeded.rows].filter((row) => !expected.has(row));
-	if (missing.length === 0 && stale.length === 0) return [];
-	const parts = [...missing.length === 0 ? [] : [`${String(missing.length)} missing, such as ${sample(missing)}`], ...stale.length === 0 ? [] : [`${String(stale.length)} stale, such as ${sample(stale)}`]];
-	return [{
-		code: "PD054",
-		severity: "warning",
-		message: `${seeded.file} seeds ${schema}.role_permissions with rows the policy no longer compiles to: ${parts.join("; ")}`,
-		fix: "run permdock rls generate (with --split ...,seeds --seeds-out into a new migration for declarative schemas) and apply it"
-	}];
-}
-//#endregion
-//#region src/cli/doctor-sql.ts
-/** Supabase's `[api] schemas` when `config.toml` sets none. */
-const API_SCHEMAS = ["public", "graphql_public"];
-const NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
-const IDENT = String.raw`("[^"]+"|\w+)`;
-/** A statement without its dollar-quoted bodies: what a function header says. */
-function header(text) {
-	return text.replaceAll(/\$([A-Za-z_]*)\$[\s\S]*?\$\1\$/gu, "$$$$");
-}
-function isSupabase(cwd, config) {
-	return existsSync(join(cwd, "supabase")) || config.rls?.dialect === "supabase" || config.supabase !== void 0;
-}
-function migrationStatements(cwd, config) {
-	return sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).flatMap((file) => sqlStatements(readFileSync(file, "utf8")).map((statement) => Object.assign({ file: rel(cwd, file) }, statement)));
-}
-/** The schema of a `tableKey`, which always names one. */
-function schemaOf(key) {
-	return key.slice(0, key.indexOf("."));
-}
-function unquote(name) {
-	return name.replaceAll("\"", "").toLowerCase();
-}
-/**
-* PD046: the schema of PermDock's `security definer` helpers is one the Data
-* API exposes, so PostgREST serves them as RPCs.
-*/
-function pd046(cwd, config) {
-	if (!existsSync(join(cwd, "supabase/config.toml"))) return [];
-	const schema = config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
-	if (!(supabaseConfig(cwd).apiSchemas ?? API_SCHEMAS).includes(schema)) return [];
-	return [{
-		code: "PD046",
-		severity: "warning",
-		message: `the PermDock helper schema ${schema} is in [api] schemas in supabase/config.toml, so the Data API serves its security definer helpers as RPCs`,
-		fix: schema === "public" ? `drop rls.schema: 'public' so the helpers move to the private ${PERMDOCK_SCHEMA} schema, regenerate with permdock rls generate, and keep ${PERMDOCK_SCHEMA} out of [api] schemas` : `remove ${schema} from [api] schemas; policies reach the helpers through grant usage, not the Data API`
-	}];
-}
-const USER_METADATA = /\b(raw_user_meta_data|user_metadata)\b/giu;
-/** PD047: SQL that reads `user_metadata`, which every user can edit for themselves. */
-function pd047(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	return migrationStatements(cwd, config).flatMap((statement) => [...statement.text.matchAll(USER_METADATA)].map((match) => ({
-		code: "PD047",
-		severity: "warning",
-		message: `${statement.file}:${String(statement.line + statement.text.slice(0, match.index).split("\n").length - 1)} reads ${match[0]}, which a user can set for themselves`,
-		fix: "decide access from app_metadata (raw_app_meta_data), a server-owned table or a hook claim; user_metadata is for display only"
-	})));
-}
-const CREATE_FUNCTION = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?function\s+${NAME}\s*\(`, "iu");
-const ALTER_SEARCH_PATH = new RegExp(String.raw`^alter\s+function\s+${NAME}\s*(?:\([^)]*\))?\s+set\s+search_path\b`, "iu");
-const REVOKE_EXECUTE = new RegExp(String.raw`^revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:function|routine)\s+${NAME}\s*(?:\([^)]*\))?\s+from\s+([\s\S]+)$`, "iu");
-const REVOKE_ALL_FUNCTIONS = new RegExp(String.raw`^(?:alter\s+default\s+privileges\s+(?:for\s+role\s+\S+\s+)?in\s+schema\s+${IDENT}\s+)?revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:all\s+)?(?:functions|routines)(?:\s+in\s+schema\s+${IDENT})?\s+from\s+([\s\S]+)$`, "iu");
-function createdFunctions(statements) {
-	return statements.flatMap((statement) => {
-		const match = CREATE_FUNCTION.exec(statement.text);
-		return match === null ? [] : [{
-			...statement,
-			key: tableKey(group(match, 1)),
-			head: header(statement.text)
-		}];
-	});
-}
-/** PD048: a function without `set search_path`, so a caller's objects can shadow the ones it names. */
-function pd048(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	const statements = migrationStatements(cwd, config);
-	const altered = new Set(statements.flatMap((statement) => {
-		const match = ALTER_SEARCH_PATH.exec(statement.text);
-		return match === null ? [] : [tableKey(group(match, 1))];
-	}));
-	return createdFunctions(statements).filter((fn) => !/\bset\s+search_path\b/iu.test(fn.head) && !altered.has(fn.key) && !/\blanguage\s+(?:c|internal)\b/iu.test(fn.head)).map((fn) => {
-		const definer = /\bsecurity\s+definer\b/iu.test(fn.head);
-		return {
-			code: "PD048",
-			severity: "warning",
-			message: `${fn.file}:${String(fn.line)} ${definer ? "security definer " : ""}function ${fn.key} sets no search_path${definer ? ", so a caller can shadow what it reads with their own objects" : ""}`,
-			fix: `add set search_path = '' and qualify every name in the body (Supabase advisor function_search_path_mutable)`
-		};
-	});
-}
-/** Roles each `revoke` statement takes `execute` from, per function key or `schema.*`. */
-function revokedExecute(statements) {
-	const revoked = /* @__PURE__ */ new Map();
-	const add = (key, roles) => {
-		const set = revoked.get(key) ?? /* @__PURE__ */ new Set();
-		for (const role of roles.split(",")) set.add(unquote(role.trim().replace(/\s+(?:cascade|restrict)$/iu, "")));
-		revoked.set(key, set);
-	};
-	for (const statement of statements) {
-		const one = REVOKE_EXECUTE.exec(statement.text);
-		if (one !== null) {
-			add(tableKey(group(one, 1)), group(one, 2));
-			continue;
-		}
-		const all = REVOKE_ALL_FUNCTIONS.exec(statement.text);
-		if (all !== null) {
-			const schema = all[1] ?? all[2];
-			add(`${schema === void 0 ? "*" : unquote(schema)}.*`, group(all, 3));
-		}
-	}
-	return revoked;
-}
-/**
-* PD049: a `security definer` function `public` (every role) or, in Supabase's
-* `public` schema, `anon` may still execute: Postgres grants `execute` to
-* `public` on create, and Supabase's default privileges grant it to `anon`.
-*/
-function pd049(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	const statements = migrationStatements(cwd, config);
-	const revoked = revokedExecute(statements);
-	const findings = [];
-	for (const fn of createdFunctions(statements)) {
-		if (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head)) continue;
-		const schema = schemaOf(fn.key);
-		const from = /* @__PURE__ */ new Set([
-			...revoked.get(fn.key) ?? [],
-			...revoked.get(`${schema}.*`) ?? [],
-			...revoked.get("*.*") ?? []
-		]);
-		const missing = ["public", ...schema === "public" ? ["anon"] : []].filter((role) => !from.has(role));
-		if (missing.length > 0) findings.push({
-			code: "PD049",
-			severity: "warning",
-			message: `${fn.file}:${String(fn.line)} security definer function ${fn.key} can be executed by ${missing.join(" and ")}`,
-			fix: `revoke execute on function ${fn.key}(…) from public, anon; then grant execute to the roles that call it`
-		});
-	}
-	return findings;
-}
-const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}\s*\(`, "iu");
-const ENABLE_RLS = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}[\s\S]*\benable\s+row\s+level\s+security\b`, "iu");
-const DROP_TABLE = /^drop\s+table\s+(?:if\s+exists\s+)?([\s\S]+?)(?:\s+(?:cascade|restrict))?$/iu;
-/** PD050: a `public` table without row level security, which the Data API serves whole. */
-function pd050(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	const created = /* @__PURE__ */ new Map();
-	const enabled = /* @__PURE__ */ new Set();
-	for (const statement of migrationStatements(cwd, config)) {
-		const table = CREATE_TABLE.exec(statement.text);
-		if (table !== null) {
-			created.set(tableKey(group(table, 1)), statement);
-			continue;
-		}
-		const rls = ENABLE_RLS.exec(statement.text);
-		if (rls !== null) {
-			enabled.add(tableKey(group(rls, 1)));
-			continue;
-		}
-		const dropped = DROP_TABLE.exec(statement.text);
-		if (dropped !== null) for (const name of group(dropped, 1).split(",")) created.delete(tableKey(name.trim()));
-	}
-	return [...created].filter(([key]) => schemaOf(key) === "public" && !enabled.has(key)).map(([key, statement]) => ({
-		code: "PD050",
-		severity: "error",
-		message: `${statement.file}:${String(statement.line)} creates ${key} without row level security, so the Data API serves every row to anon and authenticated`,
-		fix: `alter table ${key} enable row level security; permdock rls generate writes its policies`
-	}));
-}
-const CREATE_POLICY = new RegExp(String.raw`^create\s+policy\s+${IDENT}\s+on\s+${NAME}([\s\S]*)$`, "iu");
-const UNWRAPPED_AUTH = /(?<!\bselect\s{1,20})\bauth\.(uid|jwt)\s*\(\s*\)/giu;
-/** PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres runs it once per row. */
-function pd051(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	return migrationStatements(cwd, config).flatMap((statement) => {
-		const policy = CREATE_POLICY.exec(statement.text);
-		if (policy === null) return [];
-		const calls = [...new Set([...group(policy, 3).matchAll(UNWRAPPED_AUTH)].map((match) => `auth.${group(match, 1).toLowerCase()}()`))];
-		const [first] = calls;
-		return first === void 0 ? [] : [{
-			code: "PD051",
-			severity: "warning",
-			message: `${statement.file}:${String(statement.line)} policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} calls ${calls.join(" and ")} once per row`,
-			fix: `wrap each call as (select ${first}) so Postgres evaluates it once per statement (Supabase advisor auth_rls_initplan)`
-		}];
-	});
-}
-/** PD052: an update policy without `with check`, so nothing states what a row may become. */
-function pd052(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	return migrationStatements(cwd, config).flatMap((statement) => {
-		const policy = CREATE_POLICY.exec(statement.text);
-		const rest = policy?.[3] ?? "";
-		if (policy === null || !/\bfor\s+update\b/iu.test(rest) || /\bwith\s+check\b/iu.test(rest)) return [];
-		return [{
-			code: "PD052",
-			severity: "warning",
-			message: `${statement.file}:${String(statement.line)} update policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} has no with check, so Postgres checks the new row against using alone`,
-			fix: "add with check (...) stating what the updated row must satisfy, such as the same tenant and owner test, so an update cannot move a row out of what the user may write"
-		}];
-	});
-}
-/** Top-level comma-separated parts of a parenthesised list. */
-function topLevelParts(body) {
-	const parts = [];
-	let depth = 0;
-	let start = 0;
-	for (let index = 0; index < body.length; index += 1) {
-		const char = body[index];
-		if (char === "(") depth += 1;
-		else if (char === ")") depth -= 1;
-		else if (char === "," && depth === 0) {
-			parts.push(body.slice(start, index).trim());
-			start = index + 1;
-		}
-	}
-	parts.push(body.slice(start).trim());
-	return parts.filter((part) => part !== "");
-}
-/**
-* One column definition or table constraint of a `create table` body: its
-* first column, whether it is a foreign key, and whether a primary key or
-* unique constraint indexes that column.
-*/
-function tablePart(raw) {
-	const part = raw.replace(/^constraint\s+(?:"[^"]+"|\w+)\s+/iu, "");
-	const listed = /^(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)/iu.exec(part);
-	if (listed !== null) {
-		const foreign = /^foreign/iu.test(group(listed, 1));
-		return {
-			column: firstColumn(group(listed, 2)),
-			foreign,
-			indexed: !foreign
-		};
-	}
-	return {
-		column: unquote(/^("[^"]+"|\w+)/u.exec(part)?.[1] ?? ""),
-		foreign: /\breferences\b/iu.test(part),
-		indexed: /\b(?:primary\s+key|unique)\b/iu.test(part)
-	};
-}
-function firstColumn(list) {
-	return unquote(list.replace(/,[\s\S]*$/u, "").trim());
-}
-const ADD_CONSTRAINT = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}\s+add\s+(?:constraint\s+${IDENT}\s+)?(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)`, "iu");
-const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?${NAME}\s*(?:using\s+\w+\s*)?\(\s*${IDENT}`, "iu");
-/** PD053: a foreign key no index starts with, so joins and deletes on the referenced row scan the table. */
-function pd053(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	const keys = [];
-	const indexed = /* @__PURE__ */ new Set();
-	for (const statement of migrationStatements(cwd, config)) {
-		const table = CREATE_TABLE.exec(statement.text);
-		if (table !== null) {
-			const key = tableKey(group(table, 1));
-			const open = statement.text.indexOf("(", table[0].length - 1);
-			const body = statement.text.slice(open + 1, statement.text.lastIndexOf(")"));
-			for (const raw of topLevelParts(body)) {
-				const found = tablePart(raw);
-				if (found.foreign) keys.push({
-					...statement,
-					table: key,
-					column: found.column
-				});
-				if (found.indexed) indexed.add(`${key}.${found.column}`);
-			}
-			continue;
-		}
-		const added = ADD_CONSTRAINT.exec(statement.text);
-		if (added !== null) {
-			const key = tableKey(group(added, 1));
-			const column = firstColumn(group(added, 4));
-			if (/^foreign/iu.test(group(added, 3))) keys.push({
-				...statement,
-				table: key,
-				column
-			});
-			else indexed.add(`${key}.${column}`);
-			continue;
-		}
-		const index = CREATE_INDEX.exec(statement.text);
-		if (index !== null) indexed.add(`${tableKey(group(index, 2))}.${unquote(group(index, 3))}`);
-	}
-	return keys.filter((fk) => !indexed.has(`${fk.table}.${fk.column}`)).map((fk) => ({
-		code: "PD053",
-		severity: "warning",
-		message: `${fk.file}:${String(fk.line)} ${fk.table}.${fk.column} is a foreign key no index starts with, so policies that join on it and deletes of the referenced row scan ${fk.table}`,
-		fix: `create index on ${fk.table} (${fk.column}); (Supabase advisor unindexed_foreign_keys)`
-	}));
-}
-const LEGACY_CLAIM = /\brequest\.jwt\.claim\.(\w+)/giu;
-function at(statement) {
-	return `${statement.file}:${String(statement.line)}`;
-}
-/**
-* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>`
-* setting. Current PostgREST, `withPostgresClient`, PermDock's `withSubject`
-* and `rls verify` set only `request.jwt.claims`. A function replaced by a
-* later migration is judged by its last definition.
-*/
-function pd062(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	const statements = migrationStatements(cwd, config);
-	const latest = /* @__PURE__ */ new Map();
-	for (const fn of createdFunctions(statements)) latest.set(fn.key, at(fn));
-	return statements.flatMap((statement) => {
-		const fn = CREATE_FUNCTION.exec(statement.text);
-		if (fn !== null && latest.get(tableKey(group(fn, 1))) !== at(statement)) return [];
-		return [...new Set([...statement.text.matchAll(LEGACY_CLAIM)].map((match) => group(match, 1).toLowerCase()))].map((name) => ({
-			code: "PD062",
-			severity: "warning",
-			message: `${statement.file}:${String(statement.line)} uses the legacy request.jwt.claim.${name} setting, which PostgREST 12 and PermDock's withSubject no longer set, so it reads null`,
-			fix: name === "sub" ? "read the subject with (select permdock.permdock_user_id()) or (select auth.uid()), and set request.jwt.claims in tests and jobs" : `read (select auth.jwt()) ->> '${name}', and set request.jwt.claims in tests and jobs`
-		}));
-	});
-}
-/**
-* PD063: a migration statement supautils rejects for `postgres`, so
-* `supabase db push` fails on it.
-*/
-function pd063(cwd, config) {
-	if (!isSupabase(cwd, config)) return [];
-	return sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).flatMap((file) => supautilsRejections(readFileSync(file, "utf8")).map((found) => ({
-		code: "PD063",
-		severity: "error",
-		message: `${rel(cwd, file)}:${String(found.line)} ${found.reason}, which supautils rejects for the postgres role on Supabase`,
-		fix: "remove the statement: reserved roles belong to Supabase. Grant your own role to authenticator instead, and change anon, authenticated, authenticator or service_role only with alter role … set"
-	})));
-}
-/**
-* PD056: SQL still calls an `rls.migrate` helper by its legacy name, so the
-* shim (or the legacy function) cannot be dropped yet.
-*/
-function pd056(cwd, config) {
-	const helpers = Object.keys(config.rls?.migrate?.helpers ?? {}).filter((name) => /^[a-z_][a-z0-9_]*$/u.test(name));
-	if (helpers.length === 0) return [];
-	const statements = migrationStatements(cwd, config);
-	const findings = [];
-	for (const name of helpers) {
-		const own = new RegExp(String.raw`^\s*(?:create\s+(?:or\s+replace\s+)?function|drop\s+function|revoke|grant|alter\s+function|comment\s+on\s+function)\b[^(]*?(?:^|[\s."])${name}"?\s*\(`, "iu");
-		const call = new RegExp(String.raw`(?<![\w$])(?:(?:"[^"]+"|\w+)\s*\.\s*)?"?${name}"?\s*\(`, "giu");
-		let count = 0;
-		const files = /* @__PURE__ */ new Set();
-		for (const statement of statements) {
-			const hits = own.test(statement.text) ? 0 : (statement.text.match(call) ?? []).length;
-			if (hits > 0) {
-				count += hits;
-				files.add(statement.file);
-			}
-		}
-		if (count === 0) continue;
-		findings.push({
-			code: "PD056",
-			severity: "warning",
-			message: `legacy helper ${name} is still called ${String(count)} time(s), in ${[...files].toSorted().join(", ")}`,
-			fix: `run permdock rls migrate --write for policies, rewrite function bodies, views and triggers onto the permdock helpers by hand, then drop function ${name}`
-		});
-	}
-	return findings;
-}
-//#endregion
-//#region src/cli/doctor-suspension.ts
-/**
-* PD061: a suspended scope keeps permissions. Each scope's kept keys are
-* listed for review, since its members hold them while the instance is
-* suspended, and a key the definitions do not declare is named apart.
-*/
-async function pd061(input) {
-	const suspension = input.config.rls?.suspension;
-	const kept = [...Object.entries(suspension?.scopes ?? {}).map(([scope, row]) => ({
-		path: `scopes.${scope}`,
-		who: `members of a suspended ${scope}`,
-		row
-	})), ...suspension?.memberships === void 0 ? [] : [{
-		path: "memberships",
-		who: "suspended memberships",
-		row: suspension.memberships
-	}]].flatMap((entry) => {
-		try {
-			const keys = keptKeys(entry.row);
-			return keys.length === 0 ? [] : [{
-				path: entry.path,
-				who: entry.who,
-				keys
-			}];
-		} catch {
-			return [{
-				path: entry.path,
-				who: entry.who,
-				keys: [],
-				invalid: true
-			}];
-		}
-	});
-	if (kept.length === 0) return [];
-	const policy = await policyOf(input);
-	const declared = /* @__PURE__ */ new Set();
-	const former = /* @__PURE__ */ new Map();
-	for (const leaf of policy === void 0 ? [] : listPermissions(policy.permissions)) {
-		declared.add(leaf.key);
-		for (const old of formerKeys(leaf)) former.set(old, leaf.key);
-	}
-	return kept.flatMap((item) => {
-		if (item.invalid === true) return [{
-			code: "PD061",
-			severity: "warning",
-			message: `rls.suspension.${item.path}.keep has an entry that is neither a permission nor a permission key, so generate refuses it`,
-			fix: "list permission references or their keys in keep"
-		}];
-		const findings = [{
-			code: "PD061",
-			severity: "warning",
-			message: `${item.who} still hold ${item.keys.join(", ")}`,
-			fix: item.path === "memberships" ? "keep only what a suspended member must still do, such as leaving or exporting their own data, in rls.suspension.memberships.keep" : `keep only what a suspended ${item.path.slice(7)} must still do, such as restoring it or cancelling its deletion, in rls.suspension.${item.path}.keep`
-		}];
-		if (policy === void 0) return findings;
-		const unknown = item.keys.filter((key) => !declared.has(key));
-		if (unknown.length > 0) findings.push({
-			code: "PD061",
-			severity: "warning",
-			message: `rls.suspension.${item.path}.keep names ${unknown.map((key) => former.has(key) ? `${key} (renamed to ${String(former.get(key))})` : key).join(", ")}, which the definitions do not declare, so a suspended ${item.path === "memberships" ? "membership" : item.path.slice(7)} keeps nothing for them`,
-			fix: "keep permission references instead of keys, or replace each key with its current name"
-		});
-		return findings;
-	});
-}
-//#endregion
-//#region src/cli/project.ts
-function loadProject(input) {
-	const { cwd, config } = input;
-	let sources;
-	let policyLoad;
-	let collected;
-	const loadPolicy = () => {
-		policyLoad ??= readPolicy(cwd, config.policy);
-		return policyLoad;
-	};
-	const policy = async () => {
-		const load = await loadPolicy();
-		return load.status === "loaded" ? load.policy : void 0;
-	};
-	return {
-		cwd,
-		config,
-		now: input.now,
-		io: input.io,
-		sources: () => {
-			sources ??= listSourceFiles(cwd, doctorSrcPath(config)).map((file) => ({
-				file: rel(cwd, file),
-				text: readFileSync(file, "utf8")
-			}));
-			return sources;
-		},
-		policyLoad: loadPolicy,
-		policy,
-		collected: () => {
-			collected ??= runCollect({
-				cwd,
-				config,
-				collect: config.collect ?? {},
-				scanPath: doctorSrcPath(config),
-				check: true,
-				now: input.now,
-				io: input.io,
-				loadPolicy: policy
-			});
-			return collected;
-		}
-	};
-}
-async function readPolicy(cwd, path) {
-	if (path === void 0) return { status: "unset" };
-	try {
-		return {
-			status: "loaded",
-			policy: asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]))
-		};
-	} catch (error) {
-		return {
-			status: "failed",
-			path,
-			message: describeError(error)
-		};
-	}
-}
-const DOCTOR_CHECKS = [
-	{
-		code: "PD001",
-		groups: ["imports"],
-		run: (project) => pd001(project.sources(), new Set(listSourceFiles(project.cwd, project.config.doctor?.clientEntries ?? []).map((file) => rel(project.cwd, file))), project.config.policy === void 0 ? void 0 : {
-			cwd: project.cwd,
-			path: project.config.policy
-		})
-	},
-	{
-		code: "PD059",
-		groups: ["project"],
-		run: pd059
-	},
-	{
-		code: "PD060",
-		groups: ["project"],
-		run: pd060
-	},
-	{
-		code: "PD002",
-		groups: ["references"],
-		run: pd002
-	},
-	{
-		code: "PD003",
-		groups: ["ungranted"],
-		run: pd003
-	},
-	{
-		code: "PD004",
-		groups: ["catalog"],
-		run: pd004
-	},
-	{
-		code: "PD005",
-		groups: ["skills"],
-		run: (project) => pd005(project.cwd)
-	},
-	{
-		code: "PD006",
-		groups: ["typescript"],
-		run: (project) => pd006(project.cwd)
-	},
-	{
-		code: "PD007",
-		groups: ["validation"],
-		run: (project) => pd007(project.sources())
-	},
-	{
-		code: "PD008",
-		groups: ["naming"],
-		run: (project) => pd008(project.sources())
-	},
-	{
-		code: "PD009",
-		groups: ["duplicates"],
-		run: (project) => pd009(project.cwd)
-	},
-	{
-		code: "PD010",
-		groups: ["claims"],
-		run: (project) => pd010(project.sources())
-	},
-	{
-		code: "PD011",
-		groups: ["tenant"],
-		run: (project) => pd011(project.sources())
-	},
-	{
-		code: "PD012",
-		groups: ["drafts"],
-		run: (project) => pd012(project.cwd, project.config)
-	},
-	{
-		code: "PD013",
-		groups: ["algorithms"],
-		run: (project) => pd013(project.sources())
-	},
-	{
-		code: "PD014",
-		groups: ["discovery"],
-		run: (project) => pd014(project.sources())
-	},
-	{
-		code: "PD015",
-		groups: ["typ"],
-		run: (project) => pd015(project.sources())
-	},
-	{
-		code: "PD016",
-		groups: ["rls"],
-		run: pd016
-	},
-	{
-		code: "PD017",
-		groups: ["sensitive"],
-		run: pd017
-	},
-	{
-		code: "PD018",
-		groups: ["separation"],
-		run: pd018
-	},
-	{
-		code: "PD019",
-		groups: ["jwt-roles"],
-		run: pd019
-	},
-	{
-		code: "PD020",
-		groups: ["hosted"],
-		run: pd020
-	},
-	{
-		code: "PD021",
-		groups: ["hosted"],
-		run: (project) => pd021({
-			...project,
-			env: project.io.env ?? process.env
-		})
-	},
-	{
-		code: "PD022",
-		groups: ["views"],
-		run: (project) => pd022(project.cwd, project.config)
-	},
-	{
-		code: "PD023",
-		groups: ["custom-roles"],
-		run: pd023
-	},
-	{
-		code: "PD024",
-		groups: ["self-approval"],
-		run: pd024
-	},
-	{
-		code: "PD025",
-		groups: ["scopes"],
-		run: pd025
-	},
-	{
-		code: "PD026",
-		groups: ["ownership"],
-		run: pd026
-	},
-	{
-		code: "PD027",
-		groups: ["rls", "context-refs"],
-		run: pd027
-	},
-	{
-		code: "PD028",
-		groups: ["attrs", "supabase"],
-		run: (project) => pd028(project.cwd, project.config, attrsPlan)
-	},
-	{
-		code: "PD029",
-		groups: ["credentials"],
-		run: pd029
-	},
-	{
-		code: "PD030",
-		groups: ["fields"],
-		run: pd030
-	},
-	{
-		code: "PD031",
-		groups: ["graph"],
-		run: pd031
-	},
-	{
-		code: "PD032",
-		groups: ["graph", "rls"],
-		run: pd032
-	},
-	{
-		code: "PD033",
-		groups: ["activation"],
-		run: pd033
-	},
-	{
-		code: "PD034",
-		groups: ["break-glass"],
-		run: pd034
-	},
-	{
-		code: "PD035",
-		groups: ["support"],
-		run: pd035
-	},
-	{
-		code: "PD036",
-		groups: ["bola"],
-		run: (project) => pd036(project.sources())
-	},
-	{
-		code: "PD037",
-		groups: ["supabase", "row-conditions"],
-		run: pd037
-	},
-	{
-		code: "PD039",
-		groups: ["supabase", "helpers"],
-		when: (config) => config.supabase?.hook !== void 0,
-		run: supabaseSetup
-	},
-	{
-		code: "PD038",
-		groups: ["supabase", "tenant"],
-		when: (config) => config.rls !== void 0 || config.supabase?.hook !== void 0,
-		run: (project) => pd038(project.sources(), project.config.rls?.tenantClaim ?? "tenant_id", supabaseTenantClaim)
-	},
-	{
-		code: "PD057",
-		groups: ["supabase", "anonymous"],
-		when: (config) => config.rls?.anonymousSignIns === "deny",
-		run: (project) => pd057(project.sources())
-	},
-	{
-		code: "PD040",
-		groups: ["supabase", "auth-role"],
-		run: (project) => pd040(project.cwd, project.config)
-	},
-	{
-		code: "PD041",
-		groups: ["supabase", "capabilities"],
-		run: (project) => pd041(project.sources())
-	},
-	{
-		code: "PD042",
-		groups: ["supabase", "declarative"],
-		run: (project) => pd042(project.cwd, project.config)
-	},
-	{
-		code: "PD043",
-		groups: ["supabase", "declarative"],
-		run: (project) => pd043(project.cwd)
-	},
-	{
-		code: "PD045",
-		groups: ["supabase"],
-		run: (project) => pd045(project.cwd)
-	},
-	...[
-		["PD046", pd046],
-		["PD047", pd047],
-		["PD048", pd048],
-		["PD049", pd049],
-		["PD050", pd050],
-		["PD051", pd051],
-		["PD052", pd052],
-		["PD053", pd053],
-		["PD062", pd062],
-		["PD063", pd063]
-	].map(([code, check]) => ({
-		code,
-		groups: ["supabase", "sql"],
-		run: (project) => check(project.cwd, project.config)
-	})),
-	{
-		code: "PD054",
-		groups: ["supabase", "seeds"],
-		run: pd054
-	},
-	{
-		code: "PD055",
-		groups: ["custom-roles", "renamed"],
-		run: pd055
-	},
-	{
-		code: "PD056",
-		groups: ["sql", "shims"],
-		run: (project) => pd056(project.cwd, project.config)
-	},
-	{
-		code: "PD058",
-		groups: ["powersync"],
-		run: pd058
-	},
-	{
-		code: "PD061",
-		groups: ["rls", "suspension"],
-		when: (config) => config.rls?.suspension?.scopes !== void 0,
-		run: pd061
-	},
-	{
-		code: "PD064",
-		groups: ["rls", "assignments"],
-		when: (config) => config.rls?.assignments !== void 0,
-		run: pd064
-	},
-	{
-		code: "PD044",
-		groups: ["next", "endpoint"],
-		run: pd044
-	},
-	{
-		code: "PD065",
-		groups: ["react-native", "endpoint"],
-		run: pd065
-	}
-];
-async function runDoctor(input) {
-	if (input.fix) {
-		runSkillsInstall({
-			cwd: input.cwd,
-			agents: []
-		});
-		await runCollect({
-			cwd: input.cwd,
-			config: input.config,
-			collect: input.config.collect ?? {},
-			check: false,
-			now: input.now,
-			io: input.io
-		});
-	}
-	const project = loadProject(input);
-	const wanted = new Set(input.only.map((item) => item.toLowerCase()));
-	const selected = (check) => wanted.size === 0 || wanted.has(check.code.toLowerCase()) || check.groups.some((group) => wanted.has(group));
-	const findings = [];
-	for (const check of DOCTOR_CHECKS) {
-		if (check.when !== void 0 && !check.when(input.config)) continue;
-		if (selected(check)) findings.push(...await check.run(project));
-	}
-	const errors = findings.filter((item) => item.severity === "error").length;
-	const warnings = findings.filter((item) => item.severity === "warning").length;
-	const report = {
-		$schema: DOCTOR_REPORT_SCHEMA,
-		findings,
-		errors,
-		warnings
-	};
-	return {
-		code: errors > 0 || input.strict && warnings > 0 ? 1 : 0,
-		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatDoctor(report, input.color)
-	};
-}
-/** PD059: the configured policy module throws or exports no policy, so every policy check is skipped. */
-async function pd059(project) {
-	const load = await project.policyLoad();
-	if (load.status !== "failed") return [];
-	return [{
-		code: "PD059",
-		severity: "error",
-		message: `policy module ${load.path} did not load (${load.message}), so doctor skipped every check that reads the policy`,
-		fix: "fix the module so it exports policy from definePolicy, or point policy in permdock.config.ts at the module that does"
-	}];
-}
-/** PD060: a source file under srcPath has a syntax error, so collect and usage miss what it references. */
-async function pd060(project) {
-	return ((await project.collected()).scan?.unparsed ?? []).map((item) => ({
-		code: "PD060",
-		severity: "warning",
-		message: `${item.file}:${String(item.line)} does not parse (${item.message}), so the catalog and usage report miss the permissions it references`,
-		fix: "fix the syntax error, or exclude the file from collect.srcPath"
-	}));
-}
-function formatDoctor(report, color) {
-	const style = createStyle(color);
-	const lines = [style.paint("bold", "permdock doctor"), ""];
-	for (const finding of report.findings) {
-		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
-		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
-		lines.push(`           ${style.paint("dim", `fix: ${finding.fix}`)}`);
-	}
-	if (report.findings.length === 0) lines.push("  no findings");
-	lines.push("");
-	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}`);
-	return `${lines.join("\n")}\n`;
-}
-async function supabaseSetup(input) {
-	const policy = await input.policy();
-	if (policy === void 0) return [];
-	let manifest;
-	try {
-		manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, { out: hookOut(input.cwd, input.config) }, policy);
-	} catch {
-		return [];
-	}
-	return pd039({
-		cwd: input.cwd,
-		config: input.config,
-		manifest
-	});
-}
-//#endregion
-export { runDoctor };