permdock 0.3.1 → 0.5.0

package/dist/doctor-DFjUxf2f.js

@@ -0,0 +1,2361 @@
+import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { c as separationConflicts } from "./policy-DLZJ5gAp.js";
+import { x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
+import { s as parseCredential } from "./credential-DM2um3ha.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
+import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
+import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
+import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-vs5dGOsS.js";
+import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import "./markers-C6joDI3o.js";
+import { t as didYouMean } from "./args-IIolxxKA.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as createStyle } from "./style-Uao76wO7.js";
+import { r as findingOf } from "./output-Dyw8fyPF.js";
+import { i as runSkillsInstall } from "./skills-B6lVdD_W.js";
+import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
+import { l as partPath } from "./output-files-DhRBBE4n.js";
+import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-DdDQhMlw.js";
+import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-Sq12mEA6.js";
+import { I as graphSqlName, M as contextRefs, S as byKey, a as guardedTables, t as ownershipRules } from "./ownership-BatFgAA4.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-T5mXq98v.js";
+import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DbCL9bnB.js";
+import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { r as staleFiles, t as powersyncFiles } from "./powersync-bYUDLOAO.js";
+import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-CALjIQ7e.js";
+import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { createRequire } from "node:module";
+//#region src/cli/shared/doctor-files.ts
+const nodeFiles = Object.freeze({
+	exists: (path) => existsSync(path),
+	read: (path) => readFileSync(path, "utf8"),
+	list: (path) => readdirSync(path),
+	isDirectory: (path) => statSync(path, { throwIfNoEntry: false })?.isDirectory() === true
+});
+function filesOf(input) {
+	return input.files ?? nodeFiles;
+}
+/** Parses the JSON file at `path`; throws when it is missing or invalid. */
+function readJson(files, path) {
+	return JSON.parse(files.read(path));
+}
+//#endregion
+//#region src/cli/project/project.ts
+function loadProject(input) {
+	const { cwd, config } = input;
+	const files = input.files ?? nodeFiles;
+	let sources;
+	let policyLoad;
+	let collected;
+	const loadPolicy = () => {
+		policyLoad ??= readPolicy(cwd, config.policy);
+		return policyLoad;
+	};
+	const policy = async () => {
+		const load = await loadPolicy();
+		return load.status === "loaded" ? load.policy : void 0;
+	};
+	return {
+		cwd,
+		config,
+		files,
+		now: input.now,
+		io: input.io,
+		sources: () => {
+			sources ??= listSourceFiles(cwd, doctorSrcPath(config)).map((file) => ({
+				file: rel(cwd, file),
+				text: files.read(file)
+			}));
+			return sources;
+		},
+		policyLoad: loadPolicy,
+		policy,
+		collected: () => {
+			collected ??= runCollect({
+				cwd,
+				config,
+				collect: config.collect ?? {},
+				scanPath: doctorSrcPath(config),
+				check: true,
+				now: input.now,
+				io: input.io,
+				loadPolicy: policy
+			});
+			return collected;
+		}
+	};
+}
+async function readPolicy(cwd, path) {
+	if (path === void 0) return { status: "unset" };
+	try {
+		return {
+			status: "loaded",
+			policy: asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]))
+		};
+	} catch (error) {
+		return {
+			status: "failed",
+			path,
+			message: describeError(error)
+		};
+	}
+}
+//#endregion
+//#region src/cli/doctor/inputs.ts
+/** The configured policy, through the project's memoised load when there is one. */
+function policyOf(input) {
+	const path = input.config.policy;
+	if (path === void 0) return Promise.resolve(void 0);
+	return input.policy === void 0 ? loadConfiguredPolicy(input.cwd, path) : input.policy();
+}
+/** `collect --check`, through the project's memoised run when there is one. */
+function collectedOf(input) {
+	return input.collected === void 0 ? runCollect({
+		cwd: input.cwd,
+		config: input.config,
+		collect: input.config.collect ?? {},
+		scanPath: doctorSrcPath(input.config),
+		check: true,
+		now: input.now,
+		io: input.io
+	}) : input.collected();
+}
+function asMembershipsFixture(parsed) {
+	return parsed !== null && typeof parsed === "object" ? parsed : {};
+}
+function readFixture(input, path) {
+	const files = filesOf(input);
+	if (path === void 0) return;
+	const absolute = resolve(input.cwd, path);
+	if (!files.exists(absolute)) return;
+	try {
+		return readJson(files, absolute);
+	} catch {
+		return;
+	}
+}
+function listField(value, field) {
+	if (value === null || typeof value !== "object") return [];
+	const list = value[field];
+	return Array.isArray(list) ? list : [];
+}
+/** Reads the doctor memberships fixture, if one is configured and parseable. */
+function membershipsFixture(input) {
+	const files = filesOf(input);
+	const fixturePath = input.config.doctor?.memberships;
+	if (fixturePath === void 0) return {};
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!files.exists(absolute)) return {};
+	try {
+		return asMembershipsFixture(readJson(files, absolute));
+	} catch {
+		return {};
+	}
+}
+//#endregion
+//#region src/cli/doctor/assignments.ts
+const TRIGGER = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?trigger\s+"?permdock_assignment"?\s[\s\S]*?\bon\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`, "iu");
+/** The tables a `permdock_assignment` trigger is created on in the migrations and the `rls generate` output. */
+function triggeredTables(input) {
+	const out = input.config.rls?.out ?? "rls.sql";
+	const files = sqlFiles(input.cwd, [...input.config.doctor?.migrations ?? MIGRATION_DIRS, ...new Set([
+		out,
+		partPath(out, "helpers"),
+		partPath(out, "policies")
+	].filter((file) => file.endsWith(".sql")))]);
+	const tables = /* @__PURE__ */ new Set();
+	for (const file of files) for (const statement of sqlStatements(filesOf(input).read(file))) {
+		const match = TRIGGER.exec(statement.text);
+		if (match !== null) tables.add(tableKey(group(match, 1)));
+	}
+	return tables;
+}
+/**
+* PD064: `rls.assignments` guards a table (a membership table, the
+* global-roles table or a listed table) that no `permdock_assignment`
+* trigger is created on in the migrations or the `rls generate` output, so a
+* client may write any role there.
+*/
+async function pd064(input) {
+	if (input.config.rls?.assignments === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	if ((ownershipRules(policy, scopes)?.assigns.length ?? 0) === 0) return [];
+	const found = triggeredTables(input);
+	return guardedTables(input.config, scopes).filter((table) => !found.has(tableKey(table))).map((table) => ({
+		code: "PD064",
+		severity: "warning",
+		message: `rls.assignments guards ${table}, but no migration creates its permdock_assignment trigger, so a client may write any role there`,
+		fix: "run permdock rls generate and apply its output in a migration, or set rls.out or doctor.migrations to where it lives"
+	}));
+}
+//#endregion
+//#region src/cli/doctor/catalog.ts
+/**
+* A policy that declares `oauthScopes` against a catalog on disk without
+* them, or with another set. `authorizationProvider` builds better-supabase's
+* `delegation.scopes` from the catalog, so its SQL checks deny a token that
+* holds only the coarse scope.
+*/
+async function pd070(input) {
+	const declared = (await policyOf(input))?.oauthScopes ?? [];
+	if (declared.length === 0) return [];
+	const files = filesOf(input);
+	const path = catalogPath(input.config, input.cwd);
+	if (!files.exists(path)) return [];
+	let listed;
+	try {
+		listed = parseCatalog(files.read(path)).oauthScopes;
+	} catch {
+		return [];
+	}
+	const expected = catalogOAuthScopes(declared);
+	if (listed !== void 0 && canonicalJson(listed) === canonicalJson(expected)) return [];
+	return [{
+		code: "PD070",
+		severity: "warning",
+		message: listed === void 0 ? `the policy declares oauthScopes (${expected.map(({ scope }) => scope).join(", ")}) and ${rel(input.cwd, path)} lists none, so better-supabase's SQL checks deny a token that holds only a coarse scope` : `${rel(input.cwd, path)} lists other oauthScopes than the policy declares`,
+		fix: "pnpm exec permdock collect"
+	}];
+}
+async function pd002(input) {
+	const collected = await collectedOf(input);
+	if (collected.scan === void 0) return [];
+	return collected.scan.unknown.map((usage) => ({
+		code: "PD002",
+		severity: "error",
+		message: `unknown permission ${usage.call} at ${usage.file}:${String(usage.line)}`,
+		fix: "use a defined permission reference"
+	}));
+}
+async function pd003(input) {
+	if (input.config.policy === void 0) return [];
+	const usage = await runUsage({
+		cwd: input.cwd,
+		config: input.config,
+		ignore: [],
+		strict: false,
+		json: true,
+		dynamicAsUsed: false,
+		now: input.now,
+		io: input.io,
+		collected: () => collectedOf(input),
+		policy: () => policyOf(input)
+	});
+	if (usage.code === 2) return [];
+	return JSON.parse(usage.output).ungranted.map((item) => ({
+		code: "PD003",
+		severity: "warning",
+		message: `${item.key} is used but never granted (${item.detail})`,
+		fix: "add an allow() with a to: selector, or a role() binding, in definePolicy"
+	}));
+}
+async function pd004(input) {
+	const collected = await collectedOf(input);
+	if (collected.code === 0) return [];
+	if (collected.code === 2) return [];
+	return [{
+		code: "PD004",
+		severity: "error",
+		message: collected.message,
+		fix: "pnpm exec permdock collect"
+	}];
+}
+async function pd067(input) {
+	if (input.config.operations === void 0) return [];
+	const document = (await collectedOf(input)).document;
+	if (document?.operations === void 0) return [];
+	const declared = new Set(document.permissions.map(({ key }) => key));
+	return document.operations.flatMap((operation) => [["permission", operation.permission], ["results", operation.results]].flatMap(([field, key]) => key === void 0 || declared.has(key) ? [] : [{
+		code: "PD067",
+		severity: "error",
+		message: `operation ${operation.name} has ${field} ${key}, which the permissions module does not declare`,
+		fix: "pass the same permission tree to defineOperations and to permdock.config.ts permissions, or declare the permission"
+	}]));
+}
+//#endregion
+//#region src/cli/doctor/declarative.ts
+const SCHEMAS = "supabase/schemas";
+const MIGRATIONS = "supabase/migrations";
+const CREATES_HOOK = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*custom_access_token_hook\b/iu;
+const DROPS_HOOK = /\bdrop\s+function\s+(?:if\s+exists\s+)?[\w."]*custom_access_token_hook\b/iu;
+const GRANTS_HOOK = /\bgrant\s+execute\s+on\s+function\s+[\w."]*custom_access_token_hook\s*\(\s*jsonb\s*\)\s+to\s+supabase_auth_admin\b/iu;
+const DEFINES_HELPER = /\bcreate\s+(?:or\s+replace\s+)?function\s+[\w."]*permdock_has\s*\(/iu;
+const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids)\s*\(/iu;
+function uncommented(text) {
+	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+}
+/** Whether `text` starts with a line `rls generate` or `supabase hook generate` writes. */
+function generatedByPermDock(text) {
+	return text.startsWith("-- permdock:") || text.startsWith("-- generated by permdock");
+}
+/**
+* PD042: under migra, a hook declared under `supabase/schemas` reaches the
+* database through `supabase db diff`, which drops its `supabase_auth_admin`
+* grants. pg-delta keeps them, so the check runs only for `migra`. A function
+* created (or dropped and created again) without them is executable by
+* `public` and not by the auth server, so a migration at or after the one
+* that creates it must carry the grants.
+*/
+function pd042(cwd, config, files = nodeFiles) {
+	if (config.supabase?.hook === void 0 || resolveSchemas(cwd, config).mode !== "migra") return [];
+	if (!sqlFiles(cwd, [SCHEMAS]).some((file) => files.read(file).startsWith(`-- permdock:hook v1 `))) return [];
+	const migrations = sqlFiles(cwd, [MIGRATIONS]).map((file) => ({
+		file,
+		text: uncommented(files.read(file))
+	}));
+	const created = migrations.findIndex(({ text }) => CREATES_HOOK.test(text));
+	const dropped = migrations.findLastIndex(({ text }) => DROPS_HOOK.test(text));
+	const needed = Math.max(created, dropped);
+	if (needed === -1) return [];
+	if (migrations.findLastIndex(({ text }) => GRANTS_HOOK.test(text)) >= needed) return [];
+	return [{
+		code: "PD042",
+		severity: "error",
+		message: `${rel(cwd, migrations[needed]?.file ?? MIGRATIONS)} creates custom_access_token_hook from supabase/schemas, and no migration from it on grants it to supabase_auth_admin: supabase db diff drops those grants, so the auth server cannot call the hook and public can`,
+		fix: "switch to pg-delta, which keeps the grants ([experimental.pgdelta] enabled = true and no supabase.schemas: 'migra'), or generate the grants with permdock supabase hook generate --grants-out (or rls generate --split ...,hook --grants-out) into a new file from supabase migration new, after the db diff migration"
+	}];
+}
+/** The PermDock-generated files under the declarative schema directory. */
+function generatedSchemaFiles(cwd, schemaDir, files) {
+	if (!files.exists(join(cwd, schemaDir))) return [];
+	return sqlFiles(cwd, [schemaDir]).filter((file) => generatedByPermDock(files.read(file)));
+}
+/**
+* PD068: PermDock generates for pg-delta (the default), but
+* `supabase/config.toml` does not set `[experimental.pgdelta] enabled =
+* true`, so Supabase CLI 2.x diffs the schema files with migra. migra drops
+* the hook's `supabase_auth_admin` grants and the helpers' privileges, and
+* PermDock wrote no `--grants-out` file to restore them.
+*/
+function pd068(cwd, config, files = nodeFiles) {
+	const read = readSupabaseConfig(cwd);
+	if (read?.ok !== true || read.config.pgDelta?.enabled === true) return [];
+	const schemas = resolveSchemas(cwd, config);
+	if (schemas.mode !== "pg-delta") return [];
+	const [first] = generatedSchemaFiles(cwd, schemas.schemaDir, files);
+	if (first === void 0) return [];
+	return [{
+		code: "PD068",
+		severity: "error",
+		message: `${rel(cwd, first)} is written for pg-delta, but supabase/config.toml does not set [experimental.pgdelta] enabled = true, so the Supabase CLI diffs it with migra and drops the hook and helper grants`,
+		fix: "add [experimental.pgdelta] with enabled = true to supabase/config.toml (Supabase CLI 2.119 or later), or set supabase.schemas: 'migra' in permdock.config.ts and regenerate with --grants-out"
+	}];
+}
+/**
+* PD069: leftovers of declarative schemas on migra in a pg-delta project:
+* `[db.migrations] schema_paths`, which pg-delta's dependency order makes
+* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate
+* the per-schema layout `rls generate --split` now writes.
+*/
+function pd069(cwd, config, files = nodeFiles) {
+	const schemas = resolveSchemas(cwd, config);
+	if (schemas.mode !== "pg-delta") return [];
+	const findings = [];
+	if ((supabaseConfig(cwd).schemaPaths ?? []).length > 0) findings.push({
+		code: "PD069",
+		severity: "warning",
+		message: "supabase/config.toml sets [db.migrations] schema_paths, which pg-delta does not need: it orders the schema files by their dependencies",
+		fix: "remove schema_paths from [db.migrations] in supabase/config.toml"
+	});
+	for (const file of generatedSchemaFiles(cwd, schemas.schemaDir, files)) if (/^\d+_permdock_/u.test(basename(file))) findings.push({
+		code: "PD069",
+		severity: "warning",
+		message: `${rel(cwd, file)} is a numbered part from declarative schemas on migra; under pg-delta, rls generate --split writes the per-schema layout instead`,
+		fix: "delete the numbered parts, run permdock rls generate --split without --out, then supabase db schema declarative sync"
+	});
+	return findings;
+}
+/** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
+function schemaPaths(cwd) {
+	const paths = supabaseConfig(cwd).schemaPaths ?? [];
+	return paths.length === 0 ? ["./schemas/**/*.sql"] : paths;
+}
+/** Schema files in the order `supabase db diff` applies them: each glob in turn, sorted within it. */
+function orderedSchemaFiles(cwd) {
+	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
+}
+/**
+* PD043: under migra, `db diff` applies schema files in `schema_paths`
+* order, so a policy that calls `permdock_has` or `permitted_<scope>_ids`
+* before the file that defines them fails to apply. pg-delta orders by
+* dependencies instead.
+*/
+function pd043(cwd, config, files = nodeFiles) {
+	if (resolveSchemas(cwd, config).mode !== "migra") return [];
+	if (!files.exists(join(cwd, SCHEMAS))) return [];
+	const schemas = orderedSchemaFiles(cwd).map((file) => ({
+		file,
+		text: uncommented(files.read(file))
+	}));
+	const helpers = schemas.findIndex(({ text }) => DEFINES_HELPER.test(text));
+	const defined = sqlFiles(cwd, [SCHEMAS]).find((file) => DEFINES_HELPER.test(uncommented(files.read(file))));
+	if (helpers === -1) return defined === void 0 ? [] : [{
+		code: "PD043",
+		severity: "warning",
+		message: `${rel(cwd, defined)} defines the PermDock helpers, but schema_paths in supabase/config.toml does not list it, so supabase db diff never applies it`,
+		fix: `add it to [db.migrations] schema_paths before every file that calls permdock_has, permitted_<scope>_ids or member_<scope>_ids`
+	}];
+	const helperFile = rel(cwd, schemas[helpers]?.file ?? "");
+	return schemas.slice(0, helpers).filter(({ text }) => CALLS_HELPER.test(text)).map(({ file }) => ({
+		code: "PD043",
+		severity: "warning",
+		message: `${rel(cwd, file)} calls the PermDock helpers, but schema_paths applies it before ${helperFile}, which defines them`,
+		fix: `list ${helperFile} earlier in [db.migrations] schema_paths, or give it a lower number, such as 056_permdock_helpers.sql before 060_policies.sql`
+	}));
+}
+//#endregion
+//#region src/cli/doctor/fixtures.ts
+async function pd018(input) {
+	const files = filesOf(input);
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	const declared = new Set(policy.roles.map((item) => item.name));
+	for (const binding of policy.roles) for (const name of binding.exclusiveWith ?? []) if (!declared.has(name)) findings.push({
+		code: "PD018",
+		severity: "error",
+		message: `exclusiveWith names undeclared role ${name} on ${binding.name}`,
+		fix: "declare the exclusive role with role() or remove it from exclusiveWith"
+	});
+	const fixturePath = input.config.doctor?.memberships;
+	if (fixturePath === void 0) return findings;
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!files.exists(absolute)) {
+		findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `doctor.memberships fixture ${fixturePath} is missing`,
+			fix: "add the JSON fixture or remove doctor.memberships"
+		});
+		return findings;
+	}
+	let parsed;
+	try {
+		parsed = readJson(files, absolute);
+	} catch {
+		findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `doctor.memberships fixture ${fixturePath} is not valid JSON`,
+			fix: "fix the JSON fixture"
+		});
+		return findings;
+	}
+	const record = asMembershipsFixture(parsed);
+	for (const custom of record.customRoles ?? []) {
+		const conflicts = separationConflicts(policy, [{
+			principal: custom.name,
+			...custom.tenant === void 0 ? {} : { tenant: custom.tenant },
+			roles: custom.includes ?? []
+		}]);
+		for (const conflict of conflicts) findings.push({
+			code: "PD018",
+			severity: "warning",
+			message: `custom role ${custom.name} includes exclusive roles ${conflict.roles.join(" and ")}`,
+			fix: "split the custom role so it does not include exclusiveWith pairs"
+		});
+	}
+	for (const conflict of separationConflicts(policy, record.memberships ?? [])) findings.push({
+		code: "PD018",
+		severity: "warning",
+		message: `membership ${conflict.principal || "unknown"} holds exclusive roles ${conflict.roles.join(" and ")}`,
+		fix: "remove one of the exclusive roles from the membership fixture"
+	});
+	return findings;
+}
+function customRoleLabel(role) {
+	return role.tenant === void 0 ? `global custom role ${role.name}` : `custom role ${role.name} in ${role.tenant}`;
+}
+async function pd023(input) {
+	const files = filesOf(input);
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!files.exists(absolute)) return [];
+	let parsed;
+	try {
+		parsed = readJson(files, absolute);
+	} catch {
+		return [];
+	}
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const entry of validateCustomRole(policy, custom).dropped) {
+		const what = "role" in entry ? `include ${entry.role}` : `permission ${entry.permission}`;
+		findings.push({
+			code: "PD023",
+			severity: "warning",
+			message: `${customRoleLabel(custom)} drops ${what} (${entry.reason})`,
+			fix: entry.reason === "outside-ceiling" ? "grant it to a declared assignable role, or remove it from the custom role" : entry.reason === "condition-not-allowed" ? "remove the condition; custom-role grants inherit the declared grant condition" : "use a declared permission key or assignable role name"
+		});
+	}
+	return findings;
+}
+/**
+* PD055: a stored custom role names a permission by a key it was renamed
+* from. It still resolves; the alias can only be dropped once storage holds
+* the current key.
+*/
+async function pd055(input) {
+	const files = filesOf(input);
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!files.exists(absolute)) return [];
+	let parsed;
+	try {
+		parsed = readJson(files, absolute);
+	} catch {
+		return [];
+	}
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const table = `${input.config.rls?.schema ?? "permdock"}.custom_role_permissions`;
+	const findings = [];
+	for (const custom of asMembershipsFixture(parsed).customRoles ?? []) for (const { from, to } of validateCustomRole(policy, custom).renamed) findings.push({
+		code: "PD055",
+		severity: "warning",
+		message: `${customRoleLabel(custom)} stores ${from}, which was renamed to ${to}`,
+		fix: `rewrite the stored key before removing the alias: update ${table} set permission = ${quoteSqlLiteral(to)} where permission = ${quoteSqlLiteral(from)};`
+	});
+	return findings;
+}
+/** Fixture API keys that never expire, credential policies that allow it, and records that are not v1 credentials. */
+function pd029(input) {
+	const parsed = readFixture(input, input.config.doctor?.credentials);
+	const findings = [];
+	for (const [index, record] of listField(parsed, "credentials").entries()) {
+		const credential = parseCredential(record);
+		if (credential === void 0) {
+			findings.push({
+				code: "PD029",
+				severity: "warning",
+				message: `credentials[${String(index)}] is not a valid v1 credential, so it verifies to no subject`,
+				fix: "give it v: 1, id, kind, principal, permissions, createdBy and createdAt; a service key also needs tenant and roles"
+			});
+			continue;
+		}
+		if (credential.expiresAt === void 0) findings.push({
+			code: "PD029",
+			severity: "warning",
+			message: `API key ${credential.id} never expires`,
+			fix: "set expiresAt and rotate the key before it; a leaked key without expiry stays live until someone revokes it"
+		});
+	}
+	const settings = parsed !== null && typeof parsed === "object" ? parsed.settings : void 0;
+	const tenants = settings !== null && typeof settings === "object" ? Object.entries(settings) : [];
+	for (const [tenant, value] of tenants) if ((value !== null && typeof value === "object" ? value.credentials : void 0)?.allowNoExpiry === true) findings.push({
+		code: "PD029",
+		severity: "warning",
+		message: `tenant ${tenant} allows API keys that never expire`,
+		fix: "drop allowNoExpiry and set maxTtl, or keep it only for a tenant that rotates keys on its own schedule"
+	});
+	return findings;
+}
+async function pd025(input) {
+	const files = filesOf(input);
+	const fixturePath = input.config.doctor?.memberships;
+	if (input.config.policy === void 0 || fixturePath === void 0) return [];
+	const absolute = resolve(input.cwd, fixturePath);
+	if (!files.exists(absolute)) return [];
+	let parsed;
+	try {
+		parsed = readJson(files, absolute);
+	} catch {
+		return [];
+	}
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const names = scopes.map((scope) => scope.name).join(", ");
+	const findings = [];
+	for (const [index, membership] of (asMembershipsFixture(parsed).memberships ?? []).entries()) {
+		if (normalizeMemberships([membership], scopes).length > 0) continue;
+		findings.push({
+			code: "PD025",
+			severity: "warning",
+			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, or it mixes shapes`,
+			fix: "use { scope, id, within: { <parent>: id }, roles } with a declared scope, or { on: { resource, id }, roles }"
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor/next.ts
+const ROUTE_GLOBS = ["**/api/permdock/route.{ts,tsx,js,jsx,mjs}"];
+const ENDPOINT = /\bendpoint\s*(?::|=)\s*\{?\s*['"`]/u;
+const NATIVE_IMPORT = /\bfrom\s*['"]permdock\/react-native['"]/u;
+const CLIENT_READS = /* @__PURE__ */ new Set(["usePermission", "reference"]);
+/** A grant the snapshot marks `portable: false`, so a client check needs the endpoint. */
+function serverOnly(policy, grant) {
+	if (!grant.portable || hasConditionOp(grant.where, "related")) return true;
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return item.through !== void 0 || isPrincipalRelation(spec) && spec.period !== void 0;
+	});
+}
+function serverOnlyKeys(policy) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grant.effect === "allow" && serverOnly(policy, grant)) keys.add(grant.permission.key);
+	return keys;
+}
+/** An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result, or an `endpoint` string in the source. */
+function hasEndpoint(files, cwd, sources) {
+	if (listSourceFiles(cwd, ROUTE_GLOBS).filter((file) => /(?:^|[\\/])app[\\/]/u.test(rel(cwd, file))).some((file) => files.read(file).includes("permdockHandler"))) return true;
+	return sources.some((file) => ENDPOINT.test(files.read(file)));
+}
+/**
+* PD044: `usePermission` reads a permission whose grant the snapshot cannot
+* answer, and the app has no endpoint to ask, so the client always denies it.
+*/
+async function pd044(input) {
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const keys = serverOnlyKeys(policy);
+	if (keys.size === 0) return [];
+	const usages = (await collectedOf(input)).scan?.usages ?? {};
+	const hooked = [...keys].toSorted().flatMap((key) => (usages[key] ?? []).filter((usage) => usage.call === "usePermission").map((usage) => ({
+		key,
+		usage
+	})));
+	if (hooked.length === 0) return [];
+	const sources = listSourceFiles(input.cwd, doctorSrcPath(input.config));
+	if (hasEndpoint(filesOf(input), input.cwd, sources)) return [];
+	return hooked.map(({ key, usage }) => ({
+		code: "PD044",
+		severity: "warning",
+		message: `usePermission reads ${key} at ${usage.file}:${String(usage.line)}, whose grant needs the server (a closure, graph relation or period), and no app/**/api/permdock/route.ts exports permdockHandler and no endpoint is configured: the client always answers denied (server-only)`,
+		fix: "add app/api/permdock/route.ts exporting permdockHandler(), pass endpoint to createPermDock, or check it on the server with getPermission"
+	}));
+}
+/**
+* PD065: a file that imports `permdock/react-native` reads a permission whose
+* grant the snapshot cannot answer, so the device answers it only online.
+*/
+async function pd065(input) {
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const keys = serverOnlyKeys(policy);
+	if (keys.size === 0) return [];
+	const usages = (await collectedOf(input)).scan?.usages ?? {};
+	const native = /* @__PURE__ */ new Map();
+	const isNative = (file) => {
+		let hit = native.get(file);
+		if (hit === void 0) {
+			try {
+				hit = NATIVE_IMPORT.test(filesOf(input).read(join(input.cwd, file)));
+			} catch {
+				hit = false;
+			}
+			native.set(file, hit);
+		}
+		return hit;
+	};
+	return [...keys].toSorted().flatMap((key) => (usages[key] ?? []).filter((usage) => CLIENT_READS.has(usage.call) && isNative(usage.file)).map((usage) => ({
+		code: "PD065",
+		severity: "warning",
+		message: `React Native code reads ${key} at ${usage.file}:${String(usage.line)}, whose grant needs the server (a closure, graph relation or period): offline the device answers denied (server-only)`,
+		fix: "express the grant with a portable condition if the screen must work offline, or show the offline state for it"
+	})));
+}
+//#endregion
+//#region src/cli/doctor/policy.ts
+async function pd017(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
+	const denied = new Set(policy.grants.filter((grant) => grant.effect === "deny").map((grant) => grant.permission.key));
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) {
+		if (grant.effect !== "allow") continue;
+		if (!sensitive.has(grant.permission.action)) continue;
+		if (grant.approval !== void 0) continue;
+		if (denied.has(grant.permission.key)) continue;
+		if (seen.has(grant.permission.key)) continue;
+		seen.add(grant.permission.key);
+		findings.push({
+			code: "PD017",
+			severity: "warning",
+			message: `${grant.permission.key} is a sensitive verb without approval`,
+			fix: "add approval: { by } on the allow, or a deny on the same leaf"
+		});
+	}
+	return findings;
+}
+async function pd024(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const grant of policy.grants) {
+		const approval = grant.approval;
+		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.distinct !== false) continue;
+		findings.push({
+			code: "PD024",
+			severity: "warning",
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.distinct: false, so the requester can approve their own request`,
+			fix: "remove distinct: false unless the requester confirming their own call (an agent asking its user) is the intent"
+		});
+	}
+	return findings;
+}
+async function pd021(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0 || (policy.hostable ?? []).length === 0) return [];
+	const missing = ["PERMDOCK_CLOUD_URL", "PERMDOCK_CLOUD_KEY"].filter((name) => (input.env[name] ?? "") === "");
+	if (missing.length === 0) return [];
+	return [{
+		code: "PD021",
+		severity: "warning",
+		message: `the policy lists hostable permissions but ${missing.join(" and ")} is not set, so no hosted grant can be published or fetched`,
+		fix: "set the variables from the PermDock Cloud dashboard, or remove hostable"
+	}];
+}
+async function pd019(input) {
+	const rls = input.config.rls;
+	if ((rls?.authorize ?? rls?.rbac?.authorize) !== "jwt") return [];
+	const expiry = supabaseConfig(input.cwd).jwtExpiry ?? 3600;
+	if (expiry <= 3600 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const sensitive = new Set(input.config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS);
+	const keys = [...new Set(policy.grants.filter((grant) => grant.effect === "allow" && sensitive.has(grant.permission.action)).map((grant) => grant.permission.key))];
+	if (keys.length === 0) return [];
+	return [{
+		code: "PD019",
+		severity: "warning",
+		message: `the RLS helpers and authorize() read roles from the JWT and jwt_expiry is ${String(expiry)}s: a revoked role keeps ${keys.join(", ")} until the token expires`,
+		fix: "set rls.authorize: 'database', or lower [auth] jwt_expiry in supabase/config.toml to 3600 or less"
+	}];
+}
+/** Fixture memberships the policy's scopes would drop: an undeclared scope, a missing parent id, mixed shapes. */
+/**
+* A scope whose roles can all be removed can end up with nobody able to
+* manage it. Setting `min` on any of its roles (even `min: 0`) records the
+* decision and silences the warning.
+*/
+async function pd026(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const findings = [];
+	for (const { name } of scopes) {
+		const held = policy.roles.filter((binding) => typeof binding.on === "string" && resolveScope(scopes, binding.on) === name);
+		if (held.length === 0 || held.some((binding) => binding.min !== void 0)) continue;
+		findings.push({
+			code: "PD026",
+			severity: "warning",
+			message: `no role on scope '${name}' keeps a holder: every ${name} can lose its last ${held.map((binding) => binding.name).join(" / ")}`,
+			fix: `set min: 1 on the role that manages a ${name} (role(..., { on: '${name}', min: 1 })), or min: 0 to record that none must stay`
+		});
+	}
+	return findings;
+}
+/**
+* PD033: a role activation without a `maxDuration` (an elevation with no
+* ceiling never expires on its own), and an activation role that a fixture
+* membership also holds standing (an eligible-only role must never be held
+* directly).
+*/
+async function pd033(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	const activation = /* @__PURE__ */ new Set();
+	for (const binding of policy.roles) {
+		if (binding.activation === void 0) continue;
+		activation.add(binding.name);
+		if (binding.activation.maxDuration === void 0) findings.push({
+			code: "PD033",
+			severity: "warning",
+			message: `role '${binding.name}' has activation without maxDuration: an elevation never expires on its own`,
+			fix: `set activation: { maxDuration: 14_400, ... } on role '${binding.name}'`
+		});
+	}
+	const fixture = membershipsFixture(input);
+	const standing = /* @__PURE__ */ new Set();
+	const eligible = /* @__PURE__ */ new Set();
+	for (const membership of fixture.memberships ?? []) {
+		for (const name of membership.roles ?? []) standing.add(name);
+		for (const name of membership.eligible ?? []) eligible.add(name);
+	}
+	for (const name of activation) if (standing.has(name)) findings.push({
+		code: "PD033",
+		severity: "warning",
+		message: `activation role '${name}' is held standing by a fixture membership: an eligible-only role must never be held directly`,
+		fix: `list '${name}' under eligible, never roles, and activate it with permdock.activate`
+	});
+	return findings;
+}
+/**
+* PD035: a `supportAccess` role without `actorRequired`. Support access is
+* impersonation; without an actor the session is unattributed.
+*/
+async function pd035(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const binding of policy.roles) if (binding.support !== void 0 && !binding.support.actorRequired) findings.push({
+		code: "PD035",
+		severity: "warning",
+		message: `support access role '${binding.name}' has actorRequired: false: a support session then runs as the tenant, unattributed`,
+		fix: `set actorRequired: true on supportAccess({ role: '${binding.name}', ... })`
+	});
+	return findings;
+}
+//#endregion
+//#region src/cli/doctor/powersync.ts
+/**
+* PD058: `sync-config.yaml` or the `powersync.manifest` file is not what the
+* policy compiles to, so PowerSync syncs rows, or the device builds
+* snapshots, by an older policy. A policy that does not compile is a finding
+* too.
+*/
+async function pd058(input) {
+	const { cwd, config } = input;
+	if (config.powersync === void 0 || config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	let compiled;
+	try {
+		compiled = powersyncFiles(policy, config);
+	} catch (cause) {
+		return [{
+			code: "PD058",
+			severity: "warning",
+			message: `the policy does not compile to Sync Streams: ${cause instanceof Error ? cause.message : String(cause)}`,
+			fix: "fix the powersync and rls config, then run permdock powersync generate"
+		}];
+	}
+	return staleFiles(cwd, compiled.files).map((file) => ({
+		code: "PD058",
+		severity: "warning",
+		message: file.missing ? `${file.path} is missing, so ${file.path === config.powersync?.manifest ? "the device builds no local snapshot" : "PowerSync syncs no stream the policy compiles to"}` : `${file.path} is not what the policy compiles to, so ${file.path === config.powersync?.manifest ? "the device builds snapshots" : "PowerSync syncs rows"} by an older policy`,
+		fix: "run permdock powersync generate and deploy the files"
+	}));
+}
+//#endregion
+//#region src/cli/doctor/project.ts
+/**
+* The directories from `cwd` up to the workspace root: the first one with a
+* `pnpm-workspace.yaml`, a `package.json` that declares `workspaces`, or a
+* `.git`. Skills are often installed once at a monorepo's root.
+*/
+function workspaceDirs(files, cwd) {
+	const dirs = [];
+	let dir = resolve(cwd);
+	for (;;) {
+		dirs.push(dir);
+		if (isWorkspaceRoot(files, dir)) return dirs;
+		const parent = dirname(dir);
+		if (parent === dir) return [resolve(cwd)];
+		dir = parent;
+	}
+}
+function isWorkspaceRoot(files, dir) {
+	if (files.exists(join(dir, "pnpm-workspace.yaml")) || files.exists(join(dir, ".git"))) return true;
+	const manifest = join(dir, "package.json");
+	if (!files.exists(manifest)) return false;
+	try {
+		const parsed = readJson(files, manifest);
+		return parsed !== null && typeof parsed === "object" && Object.hasOwn(parsed, "workspaces");
+	} catch {
+		return false;
+	}
+}
+/** Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's naming the `permdock` skill. */
+function hasSkillsLock(files, dir) {
+	if (files.exists(join(dir, ".permdock/skills-lock.json"))) return true;
+	const shared = join(dir, "skills-lock.json");
+	if (!files.exists(shared)) return false;
+	try {
+		const parsed = readJson(files, shared);
+		const skills = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, "skills") : void 0;
+		return skills !== null && typeof skills === "object" && Object.hasOwn(skills, "permdock");
+	} catch {
+		return false;
+	}
+}
+function pd005(cwd, files = nodeFiles) {
+	const dirs = workspaceDirs(files, cwd);
+	if (!dirs.some((dir) => [
+		".agents/skills",
+		".claude/skills",
+		".cursor/skills"
+	].some((folder) => files.exists(join(dir, folder, "permdock/SKILL.md"))))) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "Agent Skills are not installed",
+		fix: "pnpm exec permdock skills install"
+	}];
+	if (!dirs.some((dir) => hasSkillsLock(files, dir))) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "skills lock is missing",
+		fix: "pnpm exec permdock skills install"
+	}];
+	return [];
+}
+function pd006(cwd) {
+	try {
+		const pkg = createRequire(resolve(cwd, "package.json"))("typescript/package.json");
+		const major = Number(pkg.version.split(".")[0]);
+		if (major < 5 || major === 5 && Number(pkg.version.split(".")[1]) < 9) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is below the supported matrix (5.9, 6, 7)`,
+			fix: "upgrade typescript to 5.9 or later"
+		}];
+		if (major > 7) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is not in the supported matrix (5.9, 6, 7)`,
+			fix: "use TypeScript 5.9, 6 or 7"
+		}];
+		return [];
+	} catch {
+		return [{
+			code: "PD006",
+			severity: "error",
+			message: "typescript is not installed",
+			fix: "add typescript 5.9, 6 or 7"
+		}];
+	}
+}
+function pd009(cwd, files = nodeFiles) {
+	const copies = [];
+	function walk(dir, depth) {
+		if (depth > 6 || !files.exists(dir)) return;
+		const pkg = join(dir, "node_modules/permdock/package.json");
+		if (files.exists(pkg)) copies.push(pkg);
+		if (!files.exists(join(dir, "node_modules"))) return;
+		for (const name of files.list(join(dir, "node_modules"))) {
+			if (name.startsWith(".")) continue;
+			const nested = join(dir, "node_modules", name);
+			try {
+				if (files.isDirectory(nested)) walk(nested, depth + 1);
+			} catch {}
+		}
+	}
+	walk(cwd, 0);
+	if (copies.length > 1) return [{
+		code: "PD009",
+		severity: "error",
+		message: `duplicate permdock copies: ${copies.map((item) => rel(cwd, dirname(item))).join(", ")}`,
+		fix: "dedupe so only one permdock version is installed"
+	}];
+	return [];
+}
+function pd012(cwd, config, files = nodeFiles) {
+	const docs = config.openapi?.doc ?? [];
+	const findings = [];
+	for (const doc of docs) {
+		const abs = resolve(cwd, doc);
+		if (!files.exists(abs)) continue;
+		const text = files.read(abs);
+		if (text.includes("\"drafts\"") && !text.includes("overlay")) findings.push({
+			code: "PD012",
+			severity: "warning",
+			message: `${doc} carries a draft pin the CLI no longer emits`,
+			fix: "regenerate with permdock openapi"
+		});
+	}
+	return findings;
+}
+const VIEW_NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
+const CREATE_VIEW = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:temp(?:orary)?\s+)?(?:recursive\s+)?view\s+${VIEW_NAME}([\s\S]*?)\bas\b`, "giu");
+const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${VIEW_NAME}\s+set\s*\(([^)]*)\)`, "giu");
+const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
+const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
+/**
+* Views run as their owner unless `security_invoker` is set, so they read
+* past RLS on the tables beneath them. The `<table>_visible_fields`
+* companion `rls generate --revoke-columns` writes reads as its owner on
+* purpose and carries a comment that says so.
+*/
+function pd022(cwd, config, files = nodeFiles) {
+	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
+	const created = /* @__PURE__ */ new Map();
+	const invoker = /* @__PURE__ */ new Set();
+	const companions = /* @__PURE__ */ new Set();
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const raw = files.read(file);
+		const text = raw.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+		for (const [, name = "", options = ""] of text.matchAll(CREATE_VIEW)) {
+			const key = tableKey(name);
+			created.set(key, rel(cwd, file));
+			if (INVOKER.test(options)) invoker.add(key);
+			else invoker.delete(key);
+		}
+		for (const [, name = "", options = ""] of text.matchAll(ALTER_VIEW)) if (INVOKER.test(options)) invoker.add(tableKey(name));
+		for (const [, name = ""] of raw.matchAll(COMPANION)) companions.add(tableKey(name));
+	}
+	return [...created].filter(([key]) => !invoker.has(key) && !companions.has(key)).map(([key, file]) => ({
+		code: "PD022",
+		severity: "warning",
+		message: `view ${key} in ${file} is not security_invoker, so it reads past row level security`,
+		fix: `create the view with (security_invoker = true), or alter view ${key} set (security_invoker = true); Postgres 15 or later. For column-level reads, generate field views with permdock rls generate --fields views`
+	}));
+}
+const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
+/**
+* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
+* names its Postgres roles with `to authenticated` instead, and the role
+* claim it reads is the one PostgREST already switched to.
+*/
+function pd040(cwd, config, files = nodeFiles) {
+	const findings = [];
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const text = files.read(file).replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+		for (const match of text.matchAll(AUTH_ROLE)) {
+			const line = text.slice(0, match.index).split("\n").length;
+			findings.push({
+				code: "PD040",
+				severity: "warning",
+				message: `${rel(cwd, file)}:${String(line)} calls auth.role(), which Supabase deprecated`,
+				fix: "name the roles on the policy (create policy ... to authenticated) and drop the auth.role() = 'authenticated' test; call permdock_has or permitted_<scope>_ids for permissions"
+			});
+		}
+	}
+	return findings;
+}
+const GRANT = /\b(grant|revoke)\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\w."]+)\s+(?:to|from)\s+([\w\s,"]+?)(?:\s+with\s+grant\s+option|\s+cascade|\s+restrict)?\s*;/giu;
+const CLIENT_ROLES = /* @__PURE__ */ new Set([
+	"anon",
+	"authenticated",
+	"public"
+]);
+function applyPrivilege(writable, verb, part) {
+	const match = /^\s*(all(?:\s+privileges)?|insert|update)\s*(?:\(([^)]*)\))?\s*$/iu.exec(part);
+	if (match === null) return;
+	const kind = (match[1] ?? "").toLowerCase();
+	const sets = kind === "insert" ? [writable.insert] : kind === "update" ? [writable.update] : [writable.insert, writable.update];
+	const columns = match[2] === void 0 ? ["*"] : match[2].split(",").map((column) => column.trim().replaceAll("\"", ""));
+	for (const set of sets) for (const column of columns) if (verb.toLowerCase() === "grant") set.add(column);
+	else if (column === "*") set.clear();
+	else set.delete(column);
+}
+const CREATE_TABLE$1 = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
+const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
+/**
+* Columns of `table` a client role may insert or update, per the migrations
+* in order; `*` for every column. On Supabase a table created in `public`
+* starts writable: the default privileges grant `anon` and `authenticated`
+* everything, until a migration revokes them.
+*/
+function clientWritable(files, cwd, config, target) {
+	const writable = {
+		insert: /* @__PURE__ */ new Set(),
+		update: /* @__PURE__ */ new Set()
+	};
+	let defaults = config.supabase !== void 0 && target.startsWith("public.");
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(files.read(file))) {
+		if (REVOKE_DEFAULT_TABLES.test(text)) {
+			defaults = false;
+			continue;
+		}
+		const created = CREATE_TABLE$1.exec(text);
+		if (created !== null) {
+			if (defaults && tableKey(created[1] ?? "") === target) {
+				writable.insert.add("*");
+				writable.update.add("*");
+			}
+			continue;
+		}
+		for (const [, verb = "", privileges = "", name = "", roles = ""] of `${text};`.matchAll(GRANT)) {
+			if (tableKey(name) !== target) continue;
+			if (!roles.split(",").map((role) => role.trim().replaceAll("\"", "").toLowerCase()).some((role) => CLIENT_ROLES.has(role))) continue;
+			for (const part of privileges.split(/,(?![^(]*\))/u)) applyPrivilege(writable, verb, part);
+		}
+	}
+	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
+}
+/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
+function membershipFindings(files, cwd, config) {
+	const findings = [];
+	for (const [table, columns] of membershipColumns(config)) {
+		const writable = clientWritable(files, cwd, config, table);
+		const exposed = [...columns].filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `${table}.${exposed.join(", ")} decide${exposed.length === 1 ? "s" : ""} memberships, and the migrations let anon or authenticated insert or update ${exposed.length === 1 ? "it" : "them"}: a user could give themselves a membership`,
+			fix: `revoke insert, update on ${table} from anon, authenticated, then grant update (<columns clients edit>) on ${table} to authenticated; a column-level revoke alone leaves a table-level grant in place`
+		});
+	}
+	return findings;
+}
+/**
+* `attrs` claims must come from server-owned columns: never `user_metadata`,
+* never a column clients can write. Membership sources' deciding columns are
+* held to the same rule.
+*/
+function pd028(cwd, config, plan, files = nodeFiles) {
+	const memberships = membershipFindings(files, cwd, config);
+	const attrs = config.supabase?.hook?.attrs;
+	if (attrs === void 0) return memberships;
+	const planned = plan(attrs);
+	const findings = planned.errors.map((message) => ({
+		code: "PD028",
+		severity: "error",
+		message,
+		fix: "list server-owned columns or app_metadata.<key> entries; user_metadata is user-editable"
+	}));
+	if (planned.table !== void 0 && planned.columns.length > 0) {
+		const writable = clientWritable(files, cwd, config, tableKey(planned.table));
+		const exposed = planned.columns.filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `attrs reads ${exposed.join(", ")} from ${tableKey(planned.table)}, which the migrations let anon or authenticated insert or update: a user could set their own attribute`,
+			fix: `revoke insert, update on ${tableKey(planned.table)} from anon, authenticated, and grant column-level update only on columns that are not attributes; the generated hook migration refuses to install otherwise`
+		});
+	}
+	return [...findings, ...memberships];
+}
+//#endregion
+//#region src/cli/doctor/rls.ts
+async function pd027(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	for (const grant of policy.grants) {
+		const refs = [.../* @__PURE__ */ new Set([...contextRefs(grant.where), ...contextRefs(grant.check)])];
+		if (refs.length === 0) continue;
+		findings.push({
+			code: "PD027",
+			severity: "warning",
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} reads ${refs.join(", ")}: request context is not in the token, so permdock rls generate cannot compile it and the database cannot enforce it`,
+			fix: "move the value to a server-set claim and compare with principal.claims.<name>, or keep the check API-side and pass --skip-closures to rls generate"
+		});
+	}
+	return findings;
+}
+async function pd016(input) {
+	const files = filesOf(input);
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const findings = [];
+	let opaque = false;
+	let sqlFunction = false;
+	for (const grant of policy.grants) {
+		if (hasConditionOp(grant.where, "opaque") || hasConditionOp(grant.check, "opaque")) opaque = true;
+		if (hasConditionOp(grant.where, "sqlFunction") || hasConditionOp(grant.check, "sqlFunction")) sqlFunction = true;
+	}
+	if (opaque) findings.push({
+		code: "PD016",
+		severity: "warning",
+		message: "policy has opaque RLS conditions that deny in memory",
+		fix: "add rls.functions.<name> with a portable twin, or rewrite as sqlFunction()"
+	});
+	if (sqlFunction) {
+		const fixtures = input.config.rls.fixtures ?? "rls.fixtures.json";
+		if (!files.exists(resolve(input.cwd, fixtures)) && !files.exists(resolve(input.cwd, "rls.fixtures.ts"))) findings.push({
+			code: "PD016",
+			severity: "warning",
+			message: "sqlFunction grants have no rls fixtures for verify --db-url-stdin",
+			fix: "add rls.fixtures.json and run permdock rls verify --db-url-stdin"
+		});
+	}
+	return findings;
+}
+async function pd020(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const tables = input.config.rls.tables;
+	const compiled = (policy.hostable ?? []).filter((key) => {
+		const resource = key.slice(0, key.lastIndexOf("."));
+		return tables === void 0 || tables[resource] !== void 0;
+	});
+	if (compiled.length === 0) return [];
+	return [{
+		code: "PD020",
+		severity: "warning",
+		message: `hostable permissions are also compiled into RLS, which never sees hosted grants: ${compiled.join(", ")}`,
+		fix: "remove them from hostable, or drop their tables from rls.tables and enforce them in the application"
+	}];
+}
+/** Columns of `resource` a field-limited read grant can hide: missing from an allow's list, or on a deny's. */
+function limitedColumns(policy, resource, actions) {
+	const reads = policy.grants.filter((grant) => grant.permission.resource === resource && grant.fields !== void 0 && commandFor(grant.permission.action, actions) === "select");
+	const node = policy.resources.get(resource);
+	const schema = node === void 0 ? null : jsonSchemaOf(node);
+	const properties = schema !== null && typeof schema === "object" ? schema.properties : void 0;
+	const columns = properties !== null && typeof properties === "object" ? Object.keys(properties) : [...new Set(reads.flatMap((grant) => grant.fields ?? []))];
+	const key = node?.id ?? "id";
+	return columns.filter((column) => column !== key && reads.some((grant) => grant.effect === "deny" ? (grant.fields ?? []).includes(column) : !(grant.fields ?? []).includes(column)));
+}
+/**
+* `fields` redact in the application; RLS is row-level unless field views
+* compile, and a field view protects nothing while the base table still
+* returns the columns to a direct read.
+*/
+async function pd030(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const resources = [...new Set(policy.grants.filter((grant) => grant.fields !== void 0 && commandFor(grant.permission.action, rls.actions) === "select").map((grant) => grant.permission.resource))].toSorted();
+	const findings = [];
+	for (const resource of resources) {
+		const columns = limitedColumns(policy, resource, rls.actions);
+		if (columns.length === 0) continue;
+		const table = tableFor(resource, rls.tables);
+		if (rls.fields !== "views") {
+			findings.push({
+				code: "PD030",
+				severity: "warning",
+				message: `read grants on ${resource} limit ${columns.join(", ")}, but RLS on ${table} is row-level: any client that reads ${table} directly gets those columns`,
+				fix: `set rls.fields: 'views' and rls.revokeColumns: true (permdock rls generate --fields views --revoke-columns), or keep direct reads server-side and redact with pick`
+			});
+			continue;
+		}
+		if (rls.revokeColumns !== true) findings.push({
+			code: "PD030",
+			severity: "warning",
+			message: `${table}_visible masks ${columns.join(", ")}, but ${table} still returns them to a direct read`,
+			fix: `set rls.revokeColumns: true (--revoke-columns) so clients read ${columns.join(", ")} only through ${table}_visible`
+		});
+	}
+	return findings;
+}
+/**
+* A self-parented resource no `through` grant walks, or a `restricted`
+* column no graph grant reaches: the declaration has no effect on any
+* decision, and `rls generate` keeps no closure for it.
+*/
+async function pd031(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const plan = graphPlan(policy);
+	const findings = [];
+	for (const node of policy.resources.values()) {
+		const walked = plan.get(node.name)?.closure !== void 0;
+		if (node.parent?.resource === node.name && !walked) findings.push({
+			code: "PD031",
+			severity: "warning",
+			message: `${node.name} parents itself through ${node.parent.field}, but no grant walks it with relation(..., { through: 'parent' }): its ancestors grant nothing and rls generate keeps no closure for it`,
+			fix: `grant through the chain (relation(permissions.${node.name}, '<relation>', { through: 'parent', depth: 16 })) or drop the self-parent`
+		});
+		const reached = [...plan.values()].some((entry) => entry.node.name === node.name || node.parent?.resource === entry.node.name && entry.node.name !== node.name);
+		if (node.restricted !== void 0 && !reached) findings.push({
+			code: "PD031",
+			severity: "warning",
+			message: `${node.name} declares restricted: '${node.restricted}', but no graph grant reaches ${node.name} rows, so the column keeps nothing out`,
+			fix: `add a relation(..., { through: 'parent' }) grant that reaches ${node.name}, or remove restricted`
+		});
+	}
+	return findings;
+}
+/**
+* Under an `rls` config, a graph resource `rls generate` cannot name a helper
+* for: one that shares a scope's name (its `permitted_<name>_ids` would
+* replace the scope helper) or is not a lowercase SQL name.
+*/
+async function pd032(input) {
+	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const findings = [];
+	const sqlNames = /* @__PURE__ */ new Map();
+	for (const name of graphPlan(policy).keys()) {
+		const sql = graphSqlName(name);
+		if (sql === void 0) {
+			findings.push({
+				code: "PD032",
+				severity: "error",
+				message: `graph resource ${name} is not a SQL name, so rls generate cannot name its permitted_<name>_ids helper`,
+				fix: "rename the resource to letters, digits and underscores, starting with a letter"
+			});
+			continue;
+		}
+		if (scopes.some((scope) => scope.name === sql)) findings.push({
+			code: "PD032",
+			severity: "error",
+			message: `graph resource ${name} shares its SQL name with the ${sql} scope: permitted_${sql}_ids would replace the scope helper, so rls generate refuses it`,
+			fix: `rename the resource (for example ${sql}s or ${sql}_node) or the scope`
+		});
+		const other = sqlNames.get(sql);
+		if (other !== void 0) findings.push({
+			code: "PD032",
+			severity: "error",
+			message: `graph resources ${other} and ${name} both become permitted_${sql}_ids in SQL, so rls generate refuses them`,
+			fix: "rename one of the resources"
+		});
+		sqlNames.set(sql, name);
+	}
+	return findings;
+}
+/**
+* PD034: a break-glass grant under an `rls` config. RLS never compiles a
+* break-glass override; the server must read through a `security definer`
+* function that checks a signed break-glass session and writes an audit row.
+*/
+async function pd034(input) {
+	if (input.config.policy === void 0 || input.config.rls === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const keys = /* @__PURE__ */ new Set();
+	for (const grant of policy.grants) if (grant.breakGlass !== void 0) keys.add(grant.permission.key);
+	return [...keys].map((key) => ({
+		code: "PD034",
+		severity: "warning",
+		message: `break-glass grant on ${key} cannot be compiled to RLS: it would leak the override into a database policy`,
+		fix: "read break-glass rows through a security definer function that checks a signed break-glass session and writes an audit row"
+	}));
+}
+/**
+* Storage and Realtime policies written outside PermDock that call the SQL helpers for a permission whose grants
+* carry row conditions: the helpers check only role and scope.
+*/
+async function pd037(input) {
+	const files = filesOf(input);
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const conditioned = policyRowConditionKeys(policy);
+	const findings = [];
+	for (const file of sqlFiles(input.cwd, input.config.doctor?.migrations ?? MIGRATION_DIRS)) for (const found of helperTablePolicies(files.read(file))) {
+		const keys = found.keys.filter((key) => conditioned.has(key));
+		if (keys.length > 0) findings.push({
+			code: "PD037",
+			severity: "error",
+			message: rowConditionMessage(found, keys),
+			fix: ROW_CONDITION_FIX
+		});
+	}
+	return findings;
+}
+const WRITE_VERB_PREFIXES = [
+	"create",
+	"update",
+	"delete",
+	"remove",
+	"send",
+	"mark",
+	"cancel",
+	"approve",
+	"receive",
+	"fulfill",
+	"reimburse",
+	"withdraw",
+	"writeOff",
+	"confirm",
+	"pause"
+];
+/** `verb` starts with a write prefix that ends at a word boundary: `markPaid`, not `market`. */
+function suggestsWrite(verb) {
+	return WRITE_VERB_PREFIXES.some((prefix) => {
+		if (!verb.startsWith(prefix)) return false;
+		const next = verb.charAt(prefix.length);
+		return next === "" || /[A-Z0-9_-]/u.test(next);
+	});
+}
+async function pd071(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const byVerb = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		if (rls.actions !== void 0 && Object.hasOwn(rls.actions, leaf.action) || commandFor(leaf.action) !== void 0 || !suggestsWrite(leaf.action)) continue;
+		byVerb.set(leaf.action, [...byVerb.get(leaf.action) ?? [], leaf.key]);
+	}
+	return [...byVerb.entries()].toSorted(byKey).map(([verb, keys]) => ({
+		code: "PD071",
+		severity: "warning",
+		message: `action '${verb}' (${keys.toSorted().join(", ")}) reads as a write but has no rls.actions entry, so it compiles to 'none' and adds no SQL policy`,
+		fix: `map it on purpose in rls.actions: ${verb}: "insert", "update", "delete" or "none"`
+	}));
+}
+//#endregion
+//#region src/cli/doctor/seeds.ts
+const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
+const SEED_CLEAR = /^delete\s+from\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*$/iu;
+const LITERAL = String.raw`'((?:[^']|'')*)'`;
+const SEED_ROW = new RegExp(String.raw`\(\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*\)`, "gu");
+function rowKey(values) {
+	return values.join(" ");
+}
+/** The rows of the last statement that seeds or clears `table`, in migration order. */
+function lastSeed(files, cwd, config, table) {
+	let seeded;
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(files.read(file))) {
+		const insert = SEED_INSERT.exec(text);
+		if (insert !== null && tableKey(group(insert, 1)) === table) {
+			const rows = /* @__PURE__ */ new Set();
+			for (const row of group(insert, 2).matchAll(SEED_ROW)) rows.add(rowKey(row.slice(1, 6).map((value) => value.replaceAll("''", "'"))));
+			seeded = {
+				file: rel(cwd, file),
+				rows
+			};
+			continue;
+		}
+		const clear = SEED_CLEAR.exec(text);
+		if (clear !== null && tableKey(group(clear, 1)) === table) seeded = {
+			file: rel(cwd, file),
+			rows: /* @__PURE__ */ new Set()
+		};
+	}
+	return seeded;
+}
+/** The first three rows, as `(role permission grant_key scope effect)`. */
+function sample(rows) {
+	return rows.slice(0, 3).map((row) => `(${row})`).join(", ");
+}
+/**
+* PD054: the `role_permissions` rows the migrations seed last are not the
+* rows the policy compiles to, so the helpers answer from a stale policy.
+*/
+async function pd054(input) {
+	const { cwd, config } = input;
+	const rls = config.rls;
+	if (config.policy === void 0 || rls === void 0 && config.supabase === void 0) return [];
+	const schema = rls?.schema ?? rls?.rbac?.schema ?? "permdock";
+	const seeded = lastSeed(filesOf(input), cwd, config, `${schema}.role_permissions`);
+	if (seeded === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const ctx = {
+		dialect: rls?.dialect ?? "supabase",
+		scopes: scopeList(policy.scopes),
+		tenantClaim: rls?.tenantClaim ?? "tenant_id",
+		gucPrefix: rls?.gucPrefix ?? "app",
+		...rls?.actions === void 0 ? {} : { actions: rls.actions },
+		schema,
+		...rls?.fields === "views" ? { fields: "views" } : {}
+	};
+	let expected;
+	try {
+		expected = new Set(compileGrants(policy, ctx, rls?.tables, [], true).rolePermissions.map((row) => rowKey([
+			row.role,
+			row.permission,
+			row.grantKey,
+			row.scope,
+			row.effect
+		])));
+	} catch {
+		return [];
+	}
+	const missing = [...expected].filter((row) => !seeded.rows.has(row));
+	const stale = [...seeded.rows].filter((row) => !expected.has(row));
+	if (missing.length === 0 && stale.length === 0) return [];
+	const parts = [...missing.length === 0 ? [] : [`${String(missing.length)} missing, such as ${sample(missing)}`], ...stale.length === 0 ? [] : [`${String(stale.length)} stale, such as ${sample(stale)}`]];
+	return [{
+		code: "PD054",
+		severity: "warning",
+		message: `${seeded.file} seeds ${schema}.role_permissions with rows the policy no longer compiles to: ${parts.join("; ")}`,
+		fix: "run permdock rls generate (for declarative schemas, --split ...,seeds --seeds-out supabase/migrations/, which writes a new migration) and apply it"
+	}];
+}
+//#endregion
+//#region src/cli/doctor/sql.ts
+/** Supabase's `[api] schemas` when `config.toml` sets none. */
+const API_SCHEMAS = ["public", "graphql_public"];
+const NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
+const IDENT = String.raw`("[^"]+"|\w+)`;
+/** A statement without its dollar-quoted bodies: what a function header says. */
+function header(text) {
+	return text.replaceAll(/\$([A-Za-z_]*)\$[\s\S]*?\$\1\$/gu, "$$$$");
+}
+function isSupabase(files, cwd, config) {
+	return files.exists(join(cwd, "supabase")) || config.rls?.dialect === "supabase" || config.supabase !== void 0;
+}
+function migrationStatements(files, cwd, config) {
+	return sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).flatMap((file) => sqlStatements(files.read(file)).map((statement) => Object.assign({ file: rel(cwd, file) }, statement)));
+}
+/** The schema of a `tableKey`, which always names one. */
+function schemaOf(key) {
+	return key.slice(0, key.indexOf("."));
+}
+function unquote(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+/**
+* PD046: the schema of PermDock's `security definer` helpers is one the Data
+* API exposes, so PostgREST serves them as RPCs.
+*/
+function pd046(cwd, config, files = nodeFiles) {
+	if (!files.exists(join(cwd, "supabase/config.toml"))) return [];
+	const schema = config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock";
+	if (!(supabaseConfig(cwd).apiSchemas ?? API_SCHEMAS).includes(schema)) return [];
+	return [{
+		code: "PD046",
+		severity: "warning",
+		message: `the PermDock helper schema ${schema} is in [api] schemas in supabase/config.toml, so the Data API serves its security definer helpers as RPCs`,
+		fix: schema === "public" ? `drop rls.schema: 'public' so the helpers move to the private ${PERMDOCK_SCHEMA} schema, regenerate with permdock rls generate, and keep ${PERMDOCK_SCHEMA} out of [api] schemas` : `remove ${schema} from [api] schemas; policies reach the helpers through grant usage, not the Data API`
+	}];
+}
+const USER_METADATA = /\b(raw_user_meta_data|user_metadata)\b/giu;
+/** PD047: SQL that reads `user_metadata`, which every user can edit for themselves. */
+function pd047(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	return migrationStatements(files, cwd, config).flatMap((statement) => [...statement.text.matchAll(USER_METADATA)].map((match) => ({
+		code: "PD047",
+		severity: "warning",
+		message: `${statement.file}:${String(statement.line + statement.text.slice(0, match.index).split("\n").length - 1)} reads ${match[0]}, which a user can set for themselves`,
+		fix: "decide access from app_metadata (raw_app_meta_data), a server-owned table or a hook claim; user_metadata is for display only"
+	})));
+}
+const CREATE_FUNCTION = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?function\s+${NAME}\s*\(`, "iu");
+const ALTER_SEARCH_PATH = new RegExp(String.raw`^alter\s+function\s+${NAME}\s*(?:\([^)]*\))?\s+set\s+search_path\b`, "iu");
+const REVOKE_EXECUTE = new RegExp(String.raw`^revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:function|routine)\s+${NAME}\s*(?:\([^)]*\))?\s+from\s+([\s\S]+)$`, "iu");
+const REVOKE_ALL_FUNCTIONS = new RegExp(String.raw`^(?:alter\s+default\s+privileges\s+(?:for\s+role\s+\S+\s+)?in\s+schema\s+${IDENT}\s+)?revoke\s+(?:all(?:\s+privileges)?|execute)\s+on\s+(?:all\s+)?(?:functions|routines)(?:\s+in\s+schema\s+${IDENT})?\s+from\s+([\s\S]+)$`, "iu");
+function createdFunctions(statements) {
+	return statements.flatMap((statement) => {
+		const match = CREATE_FUNCTION.exec(statement.text);
+		return match === null ? [] : [{
+			...statement,
+			key: tableKey(group(match, 1)),
+			head: header(statement.text)
+		}];
+	});
+}
+/** PD048: a function without `set search_path`, so a caller's objects can shadow the ones it names. */
+function pd048(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	const statements = migrationStatements(files, cwd, config);
+	const altered = new Set(statements.flatMap((statement) => {
+		const match = ALTER_SEARCH_PATH.exec(statement.text);
+		return match === null ? [] : [tableKey(group(match, 1))];
+	}));
+	return createdFunctions(statements).filter((fn) => !/\bset\s+search_path\b/iu.test(fn.head) && !altered.has(fn.key) && !/\blanguage\s+(?:c|internal)\b/iu.test(fn.head)).map((fn) => {
+		const definer = /\bsecurity\s+definer\b/iu.test(fn.head);
+		return {
+			code: "PD048",
+			severity: "warning",
+			message: `${fn.file}:${String(fn.line)} ${definer ? "security definer " : ""}function ${fn.key} sets no search_path${definer ? ", so a caller can shadow what it reads with their own objects" : ""}`,
+			fix: `add set search_path = '' and qualify every name in the body (Supabase advisor function_search_path_mutable)`
+		};
+	});
+}
+/** Roles each `revoke` statement takes `execute` from, per function key or `schema.*`. */
+function revokedExecute(statements) {
+	const revoked = /* @__PURE__ */ new Map();
+	const add = (key, roles) => {
+		const set = revoked.get(key) ?? /* @__PURE__ */ new Set();
+		for (const role of roles.split(",")) set.add(unquote(role.trim().replace(/\s+(?:cascade|restrict)$/iu, "")));
+		revoked.set(key, set);
+	};
+	for (const statement of statements) {
+		const one = REVOKE_EXECUTE.exec(statement.text);
+		if (one !== null) {
+			add(tableKey(group(one, 1)), group(one, 2));
+			continue;
+		}
+		const all = REVOKE_ALL_FUNCTIONS.exec(statement.text);
+		if (all !== null) {
+			const schema = all[1] ?? all[2];
+			add(`${schema === void 0 ? "*" : unquote(schema)}.*`, group(all, 3));
+		}
+	}
+	return revoked;
+}
+/**
+* PD049: a `security definer` function `public` (every role) or, in Supabase's
+* `public` schema, `anon` may still execute: Postgres grants `execute` to
+* `public` on create, and Supabase's default privileges grant it to `anon`.
+*/
+function pd049(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	const statements = migrationStatements(files, cwd, config);
+	const revoked = revokedExecute(statements);
+	const findings = [];
+	for (const fn of createdFunctions(statements)) {
+		if (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head)) continue;
+		const schema = schemaOf(fn.key);
+		const from = /* @__PURE__ */ new Set([
+			...revoked.get(fn.key) ?? [],
+			...revoked.get(`${schema}.*`) ?? [],
+			...revoked.get("*.*") ?? []
+		]);
+		const missing = ["public", ...schema === "public" ? ["anon"] : []].filter((role) => !from.has(role));
+		if (missing.length > 0) findings.push({
+			code: "PD049",
+			severity: "warning",
+			message: `${fn.file}:${String(fn.line)} security definer function ${fn.key} can be executed by ${missing.join(" and ")}`,
+			fix: `revoke execute on function ${fn.key}(…) from public, anon; then grant execute to the roles that call it`
+		});
+	}
+	return findings;
+}
+const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}\s*\(`, "iu");
+const ENABLE_RLS = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}[\s\S]*\benable\s+row\s+level\s+security\b`, "iu");
+const DROP_TABLE = /^drop\s+table\s+(?:if\s+exists\s+)?([\s\S]+?)(?:\s+(?:cascade|restrict))?$/iu;
+/** PD050: a `public` table without row level security, which the Data API serves whole. */
+function pd050(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	const created = /* @__PURE__ */ new Map();
+	const enabled = /* @__PURE__ */ new Set();
+	for (const statement of migrationStatements(files, cwd, config)) {
+		const table = CREATE_TABLE.exec(statement.text);
+		if (table !== null) {
+			created.set(tableKey(group(table, 1)), statement);
+			continue;
+		}
+		const rls = ENABLE_RLS.exec(statement.text);
+		if (rls !== null) {
+			enabled.add(tableKey(group(rls, 1)));
+			continue;
+		}
+		const dropped = DROP_TABLE.exec(statement.text);
+		if (dropped !== null) for (const name of group(dropped, 1).split(",")) created.delete(tableKey(name.trim()));
+	}
+	return [...created].filter(([key]) => schemaOf(key) === "public" && !enabled.has(key)).map(([key, statement]) => ({
+		code: "PD050",
+		severity: "error",
+		message: `${statement.file}:${String(statement.line)} creates ${key} without row level security, so the Data API serves every row to anon and authenticated`,
+		fix: `alter table ${key} enable row level security; permdock rls generate writes its policies`
+	}));
+}
+const CREATE_POLICY = new RegExp(String.raw`^create\s+policy\s+${IDENT}\s+on\s+${NAME}([\s\S]*)$`, "iu");
+const UNWRAPPED_AUTH = /(?<!\bselect\s{1,20})\bauth\.(uid|jwt)\s*\(\s*\)/giu;
+/** PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres runs it once per row. */
+function pd051(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	return migrationStatements(files, cwd, config).flatMap((statement) => {
+		const policy = CREATE_POLICY.exec(statement.text);
+		if (policy === null) return [];
+		const calls = [...new Set([...group(policy, 3).matchAll(UNWRAPPED_AUTH)].map((match) => `auth.${group(match, 1).toLowerCase()}()`))];
+		const [first] = calls;
+		return first === void 0 ? [] : [{
+			code: "PD051",
+			severity: "warning",
+			message: `${statement.file}:${String(statement.line)} policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} calls ${calls.join(" and ")} once per row`,
+			fix: `wrap each call as (select ${first}) so Postgres evaluates it once per statement (Supabase advisor auth_rls_initplan)`
+		}];
+	});
+}
+/** PD052: an update policy without `with check`, so nothing states what a row may become. */
+function pd052(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	return migrationStatements(files, cwd, config).flatMap((statement) => {
+		const policy = CREATE_POLICY.exec(statement.text);
+		const rest = policy?.[3] ?? "";
+		if (policy === null || !/\bfor\s+update\b/iu.test(rest) || /\bwith\s+check\b/iu.test(rest)) return [];
+		return [{
+			code: "PD052",
+			severity: "warning",
+			message: `${statement.file}:${String(statement.line)} update policy ${unquote(group(policy, 1))} on ${tableKey(group(policy, 2))} has no with check, so Postgres checks the new row against using alone`,
+			fix: "add with check (...) stating what the updated row must satisfy, such as the same tenant and owner test, so an update cannot move a row out of what the user may write"
+		}];
+	});
+}
+/** Top-level comma-separated parts of a parenthesised list. */
+function topLevelParts(body) {
+	const parts = [];
+	let depth = 0;
+	let start = 0;
+	for (let index = 0; index < body.length; index += 1) {
+		const char = body[index];
+		if (char === "(") depth += 1;
+		else if (char === ")") depth -= 1;
+		else if (char === "," && depth === 0) {
+			parts.push(body.slice(start, index).trim());
+			start = index + 1;
+		}
+	}
+	parts.push(body.slice(start).trim());
+	return parts.filter((part) => part !== "");
+}
+/**
+* One column definition or table constraint of a `create table` body: its
+* first column, whether it is a foreign key, and whether a primary key or
+* unique constraint indexes that column.
+*/
+function tablePart(raw) {
+	const part = raw.replace(/^constraint\s+(?:"[^"]+"|\w+)\s+/iu, "");
+	const listed = /^(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)/iu.exec(part);
+	if (listed !== null) {
+		const foreign = /^foreign/iu.test(group(listed, 1));
+		return {
+			column: firstColumn(group(listed, 2)),
+			foreign,
+			indexed: !foreign
+		};
+	}
+	return {
+		column: unquote(/^("[^"]+"|\w+)/u.exec(part)?.[1] ?? ""),
+		foreign: /\breferences\b/iu.test(part),
+		indexed: /\b(?:primary\s+key|unique)\b/iu.test(part)
+	};
+}
+function firstColumn(list) {
+	return unquote(list.replace(/,[\s\S]*$/u, "").trim());
+}
+const ADD_CONSTRAINT = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}\s+add\s+(?:constraint\s+${IDENT}\s+)?(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)`, "iu");
+const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?${NAME}\s*(?:using\s+\w+\s*)?\(\s*${IDENT}`, "iu");
+/** PD053: a foreign key no index starts with, so joins and deletes on the referenced row scan the table. */
+function pd053(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	const keys = [];
+	const indexed = /* @__PURE__ */ new Set();
+	for (const statement of migrationStatements(files, cwd, config)) {
+		const table = CREATE_TABLE.exec(statement.text);
+		if (table !== null) {
+			const key = tableKey(group(table, 1));
+			const open = statement.text.indexOf("(", table[0].length - 1);
+			const body = statement.text.slice(open + 1, statement.text.lastIndexOf(")"));
+			for (const raw of topLevelParts(body)) {
+				const found = tablePart(raw);
+				if (found.foreign) keys.push({
+					...statement,
+					table: key,
+					column: found.column
+				});
+				if (found.indexed) indexed.add(`${key}.${found.column}`);
+			}
+			continue;
+		}
+		const added = ADD_CONSTRAINT.exec(statement.text);
+		if (added !== null) {
+			const key = tableKey(group(added, 1));
+			const column = firstColumn(group(added, 4));
+			if (/^foreign/iu.test(group(added, 3))) keys.push({
+				...statement,
+				table: key,
+				column
+			});
+			else indexed.add(`${key}.${column}`);
+			continue;
+		}
+		const index = CREATE_INDEX.exec(statement.text);
+		if (index !== null) indexed.add(`${tableKey(group(index, 2))}.${unquote(group(index, 3))}`);
+	}
+	return keys.filter((fk) => !indexed.has(`${fk.table}.${fk.column}`)).map((fk) => ({
+		code: "PD053",
+		severity: "warning",
+		message: `${fk.file}:${String(fk.line)} ${fk.table}.${fk.column} is a foreign key no index starts with, so policies that join on it and deletes of the referenced row scan ${fk.table}`,
+		fix: `create index on ${fk.table} (${fk.column}); (Supabase advisor unindexed_foreign_keys)`
+	}));
+}
+const LEGACY_CLAIM = /\brequest\.jwt\.claim\.(\w+)/giu;
+function at(statement) {
+	return `${statement.file}:${String(statement.line)}`;
+}
+/**
+* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>`
+* setting. Current PostgREST, `withPostgresClient`, PermDock's `withSubject`
+* and `rls verify` set only `request.jwt.claims`. A function replaced by a
+* later migration is judged by its last definition.
+*/
+function pd062(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	const statements = migrationStatements(files, cwd, config);
+	const latest = /* @__PURE__ */ new Map();
+	for (const fn of createdFunctions(statements)) latest.set(fn.key, at(fn));
+	return statements.flatMap((statement) => {
+		const fn = CREATE_FUNCTION.exec(statement.text);
+		if (fn !== null && latest.get(tableKey(group(fn, 1))) !== at(statement)) return [];
+		return [...new Set([...statement.text.matchAll(LEGACY_CLAIM)].map((match) => group(match, 1).toLowerCase()))].map((name) => ({
+			code: "PD062",
+			severity: "warning",
+			message: `${statement.file}:${String(statement.line)} uses the legacy request.jwt.claim.${name} setting, which PostgREST 12 and PermDock's withSubject no longer set, so it reads null`,
+			fix: name === "sub" ? "read the subject with (select permdock.permdock_user_id()) or (select auth.uid()), and set request.jwt.claims in tests and jobs" : `read (select auth.jwt()) ->> '${name}', and set request.jwt.claims in tests and jobs`
+		}));
+	});
+}
+/**
+* PD063: a migration statement supautils rejects for `postgres`, so
+* `supabase db push` fails on it.
+*/
+function pd063(cwd, config, files = nodeFiles) {
+	if (!isSupabase(files, cwd, config)) return [];
+	return sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).flatMap((file) => supautilsRejections(files.read(file)).map((found) => ({
+		code: "PD063",
+		severity: "error",
+		message: `${rel(cwd, file)}:${String(found.line)} ${found.reason}, which supautils rejects for the postgres role on Supabase`,
+		fix: "remove the statement: reserved roles belong to Supabase. Grant your own role to authenticator instead, and change anon, authenticated, authenticator or service_role only with alter role … set"
+	})));
+}
+/**
+* PD056: SQL still calls an `rls.migrate` helper by its legacy name, so the
+* shim (or the legacy function) cannot be dropped yet.
+*/
+function pd056(cwd, config, files = nodeFiles) {
+	const migrate = config.rls?.migrate;
+	const helpers = migrate === void 0 ? [] : legacyHelperNames(migrate);
+	if (helpers.length === 0) return [];
+	const statements = migrationStatements(files, cwd, config);
+	const findings = [];
+	for (const name of helpers) {
+		const { count, files: callers } = legacyHelperCalls(statements, name);
+		if (count === 0) continue;
+		findings.push({
+			code: "PD056",
+			severity: "warning",
+			message: `legacy helper ${name} is still called ${String(count)} time(s), in ${callers.join(", ")}`,
+			fix: `run permdock rls migrate for policies, rewrite function bodies, views and triggers onto the permdock helpers by hand, then drop function ${name}`
+		});
+	}
+	return findings;
+}
+/**
+* PD066: the migrations still create an `rls.migrate.tables` table: something
+* still reads it, or `rls migrate --retire-out` can drop it now.
+*/
+function pd066(cwd, config, files = nodeFiles) {
+	const migrate = config.rls?.migrate;
+	if (migrate?.tables === void 0) return [];
+	return retirePlan(migrationStatements(files, cwd, config), migrate).tables.filter((table) => table.present).map((table) => {
+		const [first] = table.readers;
+		return first === void 0 ? {
+			code: "PD066",
+			severity: "warning",
+			message: `${table.table} has no reader left, but the migrations still create it and its ${String(table.refreshTriggers.length)} refresh trigger(s)`,
+			fix: "run permdock rls migrate --sql <dir> --retire-out supabase/migrations/ and apply the migration it writes"
+		} : {
+			code: "PD066",
+			severity: "warning",
+			message: `${table.table} is still read by ${String(table.readers.length)} object(s), first ${first.kind} ${first.name} at ${first.file}:${String(first.line)}`,
+			fix: "rewrite each reader onto the permdock helpers, then run permdock rls migrate --retire-out"
+		};
+	});
+}
+//#endregion
+//#region src/cli/doctor/suspension.ts
+/**
+* PD061: a suspended scope keeps permissions. Each scope's kept keys are
+* listed for review, since its members hold them while the instance is
+* suspended, and a key the definitions do not declare is named apart.
+*/
+async function pd061(input) {
+	const suspension = input.config.rls?.suspension;
+	const kept = [...Object.entries(suspension?.scopes ?? {}).map(([scope, row]) => ({
+		path: `scopes.${scope}`,
+		who: `members of a suspended ${scope}`,
+		row
+	})), ...suspension?.memberships === void 0 ? [] : [{
+		path: "memberships",
+		who: "suspended memberships",
+		row: suspension.memberships
+	}]].flatMap((entry) => {
+		try {
+			const keys = keptKeys(entry.row);
+			return keys.length === 0 ? [] : [{
+				path: entry.path,
+				who: entry.who,
+				keys
+			}];
+		} catch {
+			return [{
+				path: entry.path,
+				who: entry.who,
+				keys: [],
+				invalid: true
+			}];
+		}
+	});
+	if (kept.length === 0) return [];
+	const policy = await policyOf(input);
+	const declared = /* @__PURE__ */ new Set();
+	const former = /* @__PURE__ */ new Map();
+	for (const leaf of policy === void 0 ? [] : listPermissions(policy.permissions)) {
+		declared.add(leaf.key);
+		for (const old of formerKeys(leaf)) former.set(old, leaf.key);
+	}
+	return kept.flatMap((item) => {
+		if (item.invalid === true) return [{
+			code: "PD061",
+			severity: "warning",
+			message: `rls.suspension.${item.path}.keep has an entry that is neither a permission nor a permission key, so generate refuses it`,
+			fix: "list permission references or their keys in keep"
+		}];
+		const findings = [{
+			code: "PD061",
+			severity: "warning",
+			message: `${item.who} still hold ${item.keys.join(", ")}`,
+			fix: item.path === "memberships" ? "keep only what a suspended member must still do, such as leaving or exporting their own data, in rls.suspension.memberships.keep" : `keep only what a suspended ${item.path.slice(7)} must still do, such as restoring it or cancelling its deletion, in rls.suspension.${item.path}.keep`
+		}];
+		if (policy === void 0) return findings;
+		const unknown = item.keys.filter((key) => !declared.has(key));
+		if (unknown.length > 0) findings.push({
+			code: "PD061",
+			severity: "warning",
+			message: `rls.suspension.${item.path}.keep names ${unknown.map((key) => former.has(key) ? `${key} (renamed to ${String(former.get(key))})` : key).join(", ")}, which the definitions do not declare, so a suspended ${item.path === "memberships" ? "membership" : item.path.slice(7)} keeps nothing for them`,
+			fix: "keep permission references instead of keys, or replace each key with its current name"
+		});
+		return findings;
+	});
+}
+const DOCTOR_CHECKS = [
+	{
+		code: "PD001",
+		groups: ["imports"],
+		run: (project) => pd001(project.sources(), new Set(listSourceFiles(project.cwd, project.config.doctor?.clientEntries ?? []).map((file) => rel(project.cwd, file))), project.config.policy === void 0 ? void 0 : {
+			cwd: project.cwd,
+			path: project.config.policy
+		})
+	},
+	{
+		code: "PD059",
+		groups: ["project"],
+		run: pd059
+	},
+	{
+		code: "PD060",
+		groups: ["project"],
+		run: pd060
+	},
+	{
+		code: "PD002",
+		groups: ["references"],
+		run: pd002
+	},
+	{
+		code: "PD003",
+		groups: ["ungranted"],
+		run: pd003
+	},
+	{
+		code: "PD004",
+		groups: ["catalog"],
+		run: pd004
+	},
+	{
+		code: "PD067",
+		groups: ["catalog", "operations"],
+		when: (config) => config.operations !== void 0,
+		run: pd067
+	},
+	{
+		code: "PD070",
+		groups: ["catalog", "better-supabase"],
+		when: (config) => config.policy !== void 0,
+		run: pd070
+	},
+	{
+		code: "PD005",
+		groups: ["skills"],
+		run: (project) => pd005(project.cwd, project.files)
+	},
+	{
+		code: "PD006",
+		groups: ["typescript"],
+		run: (project) => pd006(project.cwd)
+	},
+	{
+		code: "PD007",
+		groups: ["validation"],
+		run: (project) => pd007(project.sources())
+	},
+	{
+		code: "PD008",
+		groups: ["naming"],
+		run: (project) => pd008(project.sources())
+	},
+	{
+		code: "PD009",
+		groups: ["duplicates"],
+		run: (project) => pd009(project.cwd, project.files)
+	},
+	{
+		code: "PD010",
+		groups: ["claims"],
+		run: (project) => pd010(project.sources())
+	},
+	{
+		code: "PD011",
+		groups: ["tenant"],
+		run: (project) => pd011(project.sources())
+	},
+	{
+		code: "PD012",
+		groups: ["drafts"],
+		run: (project) => pd012(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD013",
+		groups: ["algorithms"],
+		run: (project) => pd013(project.sources())
+	},
+	{
+		code: "PD014",
+		groups: ["discovery"],
+		run: (project) => pd014(project.sources())
+	},
+	{
+		code: "PD015",
+		groups: ["typ"],
+		run: (project) => pd015(project.sources())
+	},
+	{
+		code: "PD016",
+		groups: ["rls"],
+		run: pd016
+	},
+	{
+		code: "PD017",
+		groups: ["sensitive"],
+		run: pd017
+	},
+	{
+		code: "PD018",
+		groups: ["separation"],
+		run: pd018
+	},
+	{
+		code: "PD019",
+		groups: ["jwt-roles"],
+		run: pd019
+	},
+	{
+		code: "PD020",
+		groups: ["hosted"],
+		run: pd020
+	},
+	{
+		code: "PD021",
+		groups: ["hosted"],
+		run: (project) => pd021({
+			...project,
+			env: project.io.env ?? process.env
+		})
+	},
+	{
+		code: "PD022",
+		groups: ["views"],
+		run: (project) => pd022(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD023",
+		groups: ["custom-roles"],
+		run: pd023
+	},
+	{
+		code: "PD024",
+		groups: ["self-approval"],
+		run: pd024
+	},
+	{
+		code: "PD025",
+		groups: ["scopes"],
+		run: pd025
+	},
+	{
+		code: "PD026",
+		groups: ["ownership"],
+		run: pd026
+	},
+	{
+		code: "PD027",
+		groups: ["rls", "context-refs"],
+		run: pd027
+	},
+	{
+		code: "PD071",
+		groups: ["rls"],
+		run: pd071
+	},
+	{
+		code: "PD028",
+		groups: ["attrs", "supabase"],
+		run: (project) => pd028(project.cwd, project.config, attrsPlan, project.files)
+	},
+	{
+		code: "PD029",
+		groups: ["credentials"],
+		run: pd029
+	},
+	{
+		code: "PD030",
+		groups: ["fields"],
+		run: pd030
+	},
+	{
+		code: "PD031",
+		groups: ["graph"],
+		run: pd031
+	},
+	{
+		code: "PD032",
+		groups: ["graph", "rls"],
+		run: pd032
+	},
+	{
+		code: "PD033",
+		groups: ["activation"],
+		run: pd033
+	},
+	{
+		code: "PD034",
+		groups: ["break-glass"],
+		run: pd034
+	},
+	{
+		code: "PD035",
+		groups: ["support"],
+		run: pd035
+	},
+	{
+		code: "PD036",
+		groups: ["bola"],
+		run: (project) => pd036(project.sources())
+	},
+	{
+		code: "PD037",
+		groups: ["supabase", "row-conditions"],
+		run: pd037
+	},
+	{
+		code: "PD039",
+		groups: ["supabase", "helpers"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: supabaseSetup
+	},
+	{
+		code: "PD038",
+		groups: ["supabase", "tenant"],
+		when: (config) => config.rls !== void 0 || config.supabase?.hook !== void 0,
+		run: (project) => pd038(project.sources(), project.config.rls?.tenantClaim ?? "tenant_id", supabaseTenantClaim)
+	},
+	{
+		code: "PD057",
+		groups: ["supabase", "anonymous"],
+		when: (config) => config.rls?.anonymousSignIns === "deny",
+		run: (project) => pd057(project.sources())
+	},
+	{
+		code: "PD040",
+		groups: ["supabase", "auth-role"],
+		run: (project) => pd040(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD041",
+		groups: ["supabase", "capabilities"],
+		run: (project) => pd041(project.sources())
+	},
+	{
+		code: "PD042",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd042(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD043",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd043(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD068",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd068(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD069",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd069(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD045",
+		groups: ["supabase"],
+		run: (project) => pd045(project.cwd)
+	},
+	...[
+		["PD046", pd046],
+		["PD047", pd047],
+		["PD048", pd048],
+		["PD049", pd049],
+		["PD050", pd050],
+		["PD051", pd051],
+		["PD052", pd052],
+		["PD053", pd053],
+		["PD062", pd062],
+		["PD063", pd063]
+	].map(([code, check]) => ({
+		code,
+		groups: ["supabase", "sql"],
+		run: (project) => check(project.cwd, project.config, project.files)
+	})),
+	{
+		code: "PD054",
+		groups: ["supabase", "seeds"],
+		run: pd054
+	},
+	{
+		code: "PD055",
+		groups: ["custom-roles", "renamed"],
+		run: pd055
+	},
+	{
+		code: "PD056",
+		groups: ["sql", "shims"],
+		run: (project) => pd056(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD066",
+		groups: ["sql", "shims"],
+		when: (config) => config.rls?.migrate?.tables !== void 0,
+		run: (project) => pd066(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD058",
+		groups: ["powersync"],
+		run: pd058
+	},
+	{
+		code: "PD061",
+		groups: ["rls", "suspension"],
+		when: (config) => config.rls?.suspension?.scopes !== void 0,
+		run: pd061
+	},
+	{
+		code: "PD064",
+		groups: ["rls", "assignments"],
+		when: (config) => config.rls?.assignments !== void 0,
+		run: pd064
+	},
+	{
+		code: "PD044",
+		groups: ["next", "endpoint"],
+		run: pd044
+	},
+	{
+		code: "PD065",
+		groups: ["react-native", "endpoint"],
+		run: pd065
+	}
+];
+async function runDoctor(input) {
+	const wanted = new Set(input.only.map((item) => item.toLowerCase()));
+	const unknown = unknownOnly(wanted);
+	if (unknown !== void 0) return {
+		code: 2,
+		output: unknown
+	};
+	const fixed = [];
+	if (input.fix) {
+		const skills = runSkillsInstall({
+			cwd: input.cwd,
+			agents: []
+		});
+		fixed.push(`skills: ${skills.output}`);
+		const collected = await runCollect({
+			cwd: input.cwd,
+			config: input.config,
+			collect: input.config.collect ?? {},
+			check: false,
+			now: input.now,
+			io: input.io
+		});
+		fixed.push(`catalog: ${collected.message.trim()}`);
+	}
+	const project = loadProject(input);
+	const selected = (check) => wanted.size === 0 || wanted.has(check.code.toLowerCase()) || check.groups.some((group) => wanted.has(group));
+	const findings = [];
+	for (const check of DOCTOR_CHECKS) {
+		if (check.when !== void 0 && !check.when(input.config)) continue;
+		if (selected(check)) findings.push(...await check.run(project));
+	}
+	const errors = findings.filter((item) => item.severity === "error").length;
+	const warnings = findings.filter((item) => item.severity === "warning").length;
+	const report = {
+		$schema: DOCTOR_REPORT_SCHEMA,
+		fixed,
+		findings,
+		errors,
+		warnings
+	};
+	return {
+		code: errors > 0 || input.strict && warnings > 0 ? 1 : 0,
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatDoctor(report, input.color),
+		findings: findings.map((item) => findingOf({
+			...item,
+			docs: `${DOCS_BASE}/doctor#checks`
+		}))
+	};
+}
+/** PD059: the configured policy module throws or exports no policy, so every policy check is skipped. */
+async function pd059(project) {
+	const load = await project.policyLoad();
+	if (load.status !== "failed") return [];
+	return [{
+		code: "PD059",
+		severity: "error",
+		message: `policy module ${load.path} did not load (${load.message}), so doctor skipped every check that reads the policy`,
+		fix: "fix the module so it exports policy from definePolicy, or point policy in permdock.config.ts at the module that does"
+	}];
+}
+/** PD060: a source file under srcPath has a syntax error, so collect and usage miss what it references. */
+async function pd060(project) {
+	return ((await project.collected()).scan?.unparsed ?? []).map((item) => ({
+		code: "PD060",
+		severity: "warning",
+		message: `${item.file}:${String(item.line)} does not parse (${item.message}), so the catalog and usage report miss the permissions it references`,
+		fix: "fix the syntax error, or exclude the file from collect.srcPath"
+	}));
+}
+/** A usage message for the first `--only` value that names no check code or group. */
+function unknownOnly(wanted) {
+	const known = /* @__PURE__ */ new Set();
+	for (const check of DOCTOR_CHECKS) {
+		known.add(check.code.toLowerCase());
+		for (const group of check.groups) known.add(group);
+	}
+	for (const item of wanted) if (!known.has(item)) {
+		const suggestion = didYouMean(item, [...known]);
+		return `doctor: --only ${item} names no check code or group${suggestion === void 0 ? "" : `. Did you mean ${suggestion}?`}`;
+	}
+}
+function formatDoctor(report, color) {
+	const style = createStyle(color);
+	const lines = [style.paint("bold", "permdock doctor"), ""];
+	for (const change of report.fixed) lines.push(`  ${style.okMark} fixed ${change}`);
+	if (report.fixed.length > 0) lines.push("");
+	for (const finding of report.findings) {
+		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
+		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
+		lines.push(`           ${style.paint("dim", `fix: ${finding.fix}`)}`);
+	}
+	if (report.findings.length === 0) lines.push("  no findings");
+	lines.push("");
+	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}`);
+	return `${lines.join("\n")}\n`;
+}
+async function supabaseSetup(input) {
+	const policy = await input.policy();
+	if (policy === void 0) return [];
+	let manifest;
+	try {
+		manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, { out: hookOut(input.cwd, input.config) }, policy);
+	} catch {
+		return [];
+	}
+	return pd039({
+		cwd: input.cwd,
+		config: input.config,
+		manifest
+	});
+}
+//#endregion
+export { DOCTOR_CHECKS, runDoctor };