permdock 0.4.0 → 0.5.0

package/dist/{doctor-owlv6ddh.js → doctor-DFjUxf2f.js}

@@ -1,38 +1,43 @@
-import { a as hasConditionOp } from "./refs-f3imMjNW.js";
-import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-BsblpB-z.js";
-import { u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
-import { o as flattenGrantee } from "./grantee-CXY-0C87.js";
-import { d as separationConflicts } from "./hosted-CBHgkzDl.js";
-import { b as validateCustomRole } from "./permdock-L26udHSk.js";
-import { o as parseCredential } from "./credential-kue0qpbm.js";
-import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { c as separationConflicts } from "./policy-DLZJ5gAp.js";
+import { x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
+import { s as parseCredential } from "./credential-DM2um3ha.js";
+import { a as describeError } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { r as DOCTOR_REPORT_SCHEMA } from "./version-BEogC-rB.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-C3_oTHyO.js";
-import { r as runCollect } from "./collect-2SrB7lfk.js";
+import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-B1-b-R0t.js";
-import "./markers-CiwAOZtO.js";
-import { t as createStyle } from "./style-CTm1AXDT.js";
-import { i as runSkillsInstall } from "./skills-BZdRQkxs.js";
+import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-vs5dGOsS.js";
+import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import "./markers-C6joDI3o.js";
+import { t as didYouMean } from "./args-IIolxxKA.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as createStyle } from "./style-Uao76wO7.js";
+import { r as findingOf } from "./output-Dyw8fyPF.js";
+import { i as runSkillsInstall } from "./skills-B6lVdD_W.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { a as supabaseHookManifest, d as attrsPlan, f as pd045, n as hookOut, p as supabaseConfig, u as pd039 } from "./supabase-hook-Cva3ikXz.js";
-import { o as partPath } from "./output-files-CgIsvdSa.js";
+import { l as partPath } from "./output-files-DhRBBE4n.js";
+import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-DdDQhMlw.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-Sq12mEA6.js";
-import { N as graphSqlName, k as contextRefs } from "./permission-keys-B26jeyUv.js";
-import { i as guardedTables, t as ownershipRules } from "./ownership-BgnbOJFT.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CG9nOYZw.js";
-import { h as tableFor, m as compileGrants, p as commandFor, t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
-import { d as rowConditionMessage, i as graphPlan, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-BztUB3GX.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-cZe4kzhL.js";
-import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-BFcxL6un.js";
+import { I as graphSqlName, M as contextRefs, S as byKey, a as guardedTables, t as ownershipRules } from "./ownership-BatFgAA4.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-T5mXq98v.js";
+import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DbCL9bnB.js";
+import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { r as staleFiles, t as powersyncFiles } from "./powersync-bYUDLOAO.js";
+import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-CALjIQ7e.js";
 import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { basename, dirname, join, resolve } from "node:path";
 import { createRequire } from "node:module";
 //#region src/cli/shared/doctor-files.ts
 const nodeFiles = Object.freeze({
@@ -49,7 +54,7 @@ function readJson(files, path) {
 	return JSON.parse(files.read(path));
 }
 //#endregion
-//#region src/cli/project.ts
+//#region src/cli/project/project.ts
 function loadProject(input) {
 	const { cwd, config } = input;
 	const files = input.files ?? nodeFiles;
@@ -201,6 +206,33 @@ async function pd064(input) {
 }
 //#endregion
 //#region src/cli/doctor/catalog.ts
+/**
+* A policy that declares `oauthScopes` against a catalog on disk without
+* them, or with another set. `authorizationProvider` builds better-supabase's
+* `delegation.scopes` from the catalog, so its SQL checks deny a token that
+* holds only the coarse scope.
+*/
+async function pd070(input) {
+	const declared = (await policyOf(input))?.oauthScopes ?? [];
+	if (declared.length === 0) return [];
+	const files = filesOf(input);
+	const path = catalogPath(input.config, input.cwd);
+	if (!files.exists(path)) return [];
+	let listed;
+	try {
+		listed = parseCatalog(files.read(path)).oauthScopes;
+	} catch {
+		return [];
+	}
+	const expected = catalogOAuthScopes(declared);
+	if (listed !== void 0 && canonicalJson(listed) === canonicalJson(expected)) return [];
+	return [{
+		code: "PD070",
+		severity: "warning",
+		message: listed === void 0 ? `the policy declares oauthScopes (${expected.map(({ scope }) => scope).join(", ")}) and ${rel(input.cwd, path)} lists none, so better-supabase's SQL checks deny a token that holds only a coarse scope` : `${rel(input.cwd, path)} lists other oauthScopes than the policy declares`,
+		fix: "pnpm exec permdock collect"
+	}];
+}
 async function pd002(input) {
 	const collected = await collectedOf(input);
 	if (collected.scan === void 0) return [];
@@ -244,6 +276,18 @@ async function pd004(input) {
 		fix: "pnpm exec permdock collect"
 	}];
 }
+async function pd067(input) {
+	if (input.config.operations === void 0) return [];
+	const document = (await collectedOf(input)).document;
+	if (document?.operations === void 0) return [];
+	const declared = new Set(document.permissions.map(({ key }) => key));
+	return document.operations.flatMap((operation) => [["permission", operation.permission], ["results", operation.results]].flatMap(([field, key]) => key === void 0 || declared.has(key) ? [] : [{
+		code: "PD067",
+		severity: "error",
+		message: `operation ${operation.name} has ${field} ${key}, which the permissions module does not declare`,
+		fix: "pass the same permission tree to defineOperations and to permdock.config.ts permissions, or declare the permission"
+	}]));
+}
 //#endregion
 //#region src/cli/doctor/declarative.ts
 const SCHEMAS = "supabase/schemas";
@@ -256,16 +300,20 @@ const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids
 function uncommented(text) {
 	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 }
+/** Whether `text` starts with a line `rls generate` or `supabase hook generate` writes. */
+function generatedByPermDock(text) {
+	return text.startsWith("-- permdock:") || text.startsWith("-- generated by permdock");
+}
 /**
-* PD042: a hook declared under `supabase/schemas` reaches the database through
-* `supabase db diff`, which drops its `supabase_auth_admin` grants. pg-delta
-* keeps them, so the check is off under `[experimental.pgdelta]`. A function
+* PD042: under migra, a hook declared under `supabase/schemas` reaches the
+* database through `supabase db diff`, which drops its `supabase_auth_admin`
+* grants. pg-delta keeps them, so the check runs only for `migra`. A function
 * created (or dropped and created again) without them is executable by
 * `public` and not by the auth server, so a migration at or after the one
 * that creates it must carry the grants.
 */
 function pd042(cwd, config, files = nodeFiles) {
-	if (config.supabase?.hook === void 0 || supabaseConfig(cwd).pgDelta !== void 0) return [];
+	if (config.supabase?.hook === void 0 || resolveSchemas(cwd, config).mode !== "migra") return [];
 	if (!sqlFiles(cwd, [SCHEMAS]).some((file) => files.read(file).startsWith(`-- permdock:hook v1 `))) return [];
 	const migrations = sqlFiles(cwd, [MIGRATIONS]).map((file) => ({
 		file,
@@ -280,9 +328,59 @@ function pd042(cwd, config, files = nodeFiles) {
 		code: "PD042",
 		severity: "error",
 		message: `${rel(cwd, migrations[needed]?.file ?? MIGRATIONS)} creates custom_access_token_hook from supabase/schemas, and no migration from it on grants it to supabase_auth_admin: supabase db diff drops those grants, so the auth server cannot call the hook and public can`,
-		fix: "generate the grants with permdock supabase hook generate --grants-out (or rls generate --split ...,hook --grants-out) into a new file from supabase migration new, after the db diff migration"
+		fix: "switch to pg-delta, which keeps the grants ([experimental.pgdelta] enabled = true and no supabase.schemas: 'migra'), or generate the grants with permdock supabase hook generate --grants-out (or rls generate --split ...,hook --grants-out) into a new file from supabase migration new, after the db diff migration"
 	}];
 }
+/** The PermDock-generated files under the declarative schema directory. */
+function generatedSchemaFiles(cwd, schemaDir, files) {
+	if (!files.exists(join(cwd, schemaDir))) return [];
+	return sqlFiles(cwd, [schemaDir]).filter((file) => generatedByPermDock(files.read(file)));
+}
+/**
+* PD068: PermDock generates for pg-delta (the default), but
+* `supabase/config.toml` does not set `[experimental.pgdelta] enabled =
+* true`, so Supabase CLI 2.x diffs the schema files with migra. migra drops
+* the hook's `supabase_auth_admin` grants and the helpers' privileges, and
+* PermDock wrote no `--grants-out` file to restore them.
+*/
+function pd068(cwd, config, files = nodeFiles) {
+	const read = readSupabaseConfig(cwd);
+	if (read?.ok !== true || read.config.pgDelta?.enabled === true) return [];
+	const schemas = resolveSchemas(cwd, config);
+	if (schemas.mode !== "pg-delta") return [];
+	const [first] = generatedSchemaFiles(cwd, schemas.schemaDir, files);
+	if (first === void 0) return [];
+	return [{
+		code: "PD068",
+		severity: "error",
+		message: `${rel(cwd, first)} is written for pg-delta, but supabase/config.toml does not set [experimental.pgdelta] enabled = true, so the Supabase CLI diffs it with migra and drops the hook and helper grants`,
+		fix: "add [experimental.pgdelta] with enabled = true to supabase/config.toml (Supabase CLI 2.119 or later), or set supabase.schemas: 'migra' in permdock.config.ts and regenerate with --grants-out"
+	}];
+}
+/**
+* PD069: leftovers of declarative schemas on migra in a pg-delta project:
+* `[db.migrations] schema_paths`, which pg-delta's dependency order makes
+* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate
+* the per-schema layout `rls generate --split` now writes.
+*/
+function pd069(cwd, config, files = nodeFiles) {
+	const schemas = resolveSchemas(cwd, config);
+	if (schemas.mode !== "pg-delta") return [];
+	const findings = [];
+	if ((supabaseConfig(cwd).schemaPaths ?? []).length > 0) findings.push({
+		code: "PD069",
+		severity: "warning",
+		message: "supabase/config.toml sets [db.migrations] schema_paths, which pg-delta does not need: it orders the schema files by their dependencies",
+		fix: "remove schema_paths from [db.migrations] in supabase/config.toml"
+	});
+	for (const file of generatedSchemaFiles(cwd, schemas.schemaDir, files)) if (/^\d+_permdock_/u.test(basename(file))) findings.push({
+		code: "PD069",
+		severity: "warning",
+		message: `${rel(cwd, file)} is a numbered part from declarative schemas on migra; under pg-delta, rls generate --split writes the per-schema layout instead`,
+		fix: "delete the numbered parts, run permdock rls generate --split without --out, then supabase db schema declarative sync"
+	});
+	return findings;
+}
 /** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
 function schemaPaths(cwd) {
 	const paths = supabaseConfig(cwd).schemaPaths ?? [];
@@ -293,12 +391,13 @@ function orderedSchemaFiles(cwd) {
 	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
 }
 /**
-* PD043: `db diff` applies schema files in `schema_paths` order, so a policy
-* that calls `permdock_has` or `permitted_<scope>_ids` before the file that
-* defines them fails to apply. pg-delta orders by dependencies instead.
+* PD043: under migra, `db diff` applies schema files in `schema_paths`
+* order, so a policy that calls `permdock_has` or `permitted_<scope>_ids`
+* before the file that defines them fails to apply. pg-delta orders by
+* dependencies instead.
 */
-function pd043(cwd, files = nodeFiles) {
-	if (supabaseConfig(cwd).pgDelta !== void 0) return [];
+function pd043(cwd, config, files = nodeFiles) {
+	if (resolveSchemas(cwd, config).mode !== "migra") return [];
 	if (!files.exists(join(cwd, SCHEMAS))) return [];
 	const schemas = orderedSchemaFiles(cwd).map((file) => ({
 		file,
@@ -695,7 +794,7 @@ async function pd033(input) {
 			code: "PD033",
 			severity: "warning",
 			message: `role '${binding.name}' has activation without maxDuration: an elevation never expires on its own`,
-			fix: `set activation: { maxDuration: '4h', ... } on role '${binding.name}'`
+			fix: `set activation: { maxDuration: 14_400, ... } on role '${binding.name}'`
 		});
 	}
 	const fixture = membershipsFixture(input);
@@ -1082,8 +1181,8 @@ async function pd016(input) {
 		if (!files.exists(resolve(input.cwd, fixtures)) && !files.exists(resolve(input.cwd, "rls.fixtures.ts"))) findings.push({
 			code: "PD016",
 			severity: "warning",
-			message: "sqlFunction grants have no rls fixtures for verify --db",
-			fix: "add rls.fixtures.json and run permdock rls verify --db"
+			message: "sqlFunction grants have no rls fixtures for verify --db-url-stdin",
+			fix: "add rls.fixtures.json and run permdock rls verify --db-url-stdin"
 		});
 	}
 	return findings;
@@ -1258,6 +1357,48 @@ async function pd037(input) {
 	}
 	return findings;
 }
+const WRITE_VERB_PREFIXES = [
+	"create",
+	"update",
+	"delete",
+	"remove",
+	"send",
+	"mark",
+	"cancel",
+	"approve",
+	"receive",
+	"fulfill",
+	"reimburse",
+	"withdraw",
+	"writeOff",
+	"confirm",
+	"pause"
+];
+/** `verb` starts with a write prefix that ends at a word boundary: `markPaid`, not `market`. */
+function suggestsWrite(verb) {
+	return WRITE_VERB_PREFIXES.some((prefix) => {
+		if (!verb.startsWith(prefix)) return false;
+		const next = verb.charAt(prefix.length);
+		return next === "" || /[A-Z0-9_-]/u.test(next);
+	});
+}
+async function pd071(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const byVerb = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		if (rls.actions !== void 0 && Object.hasOwn(rls.actions, leaf.action) || commandFor(leaf.action) !== void 0 || !suggestsWrite(leaf.action)) continue;
+		byVerb.set(leaf.action, [...byVerb.get(leaf.action) ?? [], leaf.key]);
+	}
+	return [...byVerb.entries()].toSorted(byKey).map(([verb, keys]) => ({
+		code: "PD071",
+		severity: "warning",
+		message: `action '${verb}' (${keys.toSorted().join(", ")}) reads as a write but has no rls.actions entry, so it compiles to 'none' and adds no SQL policy`,
+		fix: `map it on purpose in rls.actions: ${verb}: "insert", "update", "delete" or "none"`
+	}));
+}
 //#endregion
 //#region src/cli/doctor/seeds.ts
 const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
@@ -1335,7 +1476,7 @@ async function pd054(input) {
 		code: "PD054",
 		severity: "warning",
 		message: `${seeded.file} seeds ${schema}.role_permissions with rows the policy no longer compiles to: ${parts.join("; ")}`,
-		fix: "run permdock rls generate (with --split ...,seeds --seeds-out into a new migration for declarative schemas) and apply it"
+		fix: "run permdock rls generate (for declarative schemas, --split ...,seeds --seeds-out supabase/migrations/, which writes a new migration) and apply it"
 	}];
 }
 //#endregion
@@ -1675,7 +1816,7 @@ function pd056(cwd, config, files = nodeFiles) {
 			code: "PD056",
 			severity: "warning",
 			message: `legacy helper ${name} is still called ${String(count)} time(s), in ${callers.join(", ")}`,
-			fix: `run permdock rls migrate --write for policies, rewrite function bodies, views and triggers onto the permdock helpers by hand, then drop function ${name}`
+			fix: `run permdock rls migrate for policies, rewrite function bodies, views and triggers onto the permdock helpers by hand, then drop function ${name}`
 		});
 	}
 	return findings;
@@ -1802,6 +1943,18 @@ const DOCTOR_CHECKS = [
 		groups: ["catalog"],
 		run: pd004
 	},
+	{
+		code: "PD067",
+		groups: ["catalog", "operations"],
+		when: (config) => config.operations !== void 0,
+		run: pd067
+	},
+	{
+		code: "PD070",
+		groups: ["catalog", "better-supabase"],
+		when: (config) => config.policy !== void 0,
+		run: pd070
+	},
 	{
 		code: "PD005",
 		groups: ["skills"],
@@ -1920,6 +2073,11 @@ const DOCTOR_CHECKS = [
 		groups: ["rls", "context-refs"],
 		run: pd027
 	},
+	{
+		code: "PD071",
+		groups: ["rls"],
+		run: pd071
+	},
 	{
 		code: "PD028",
 		groups: ["attrs", "supabase"],
@@ -2006,7 +2164,17 @@ const DOCTOR_CHECKS = [
 	{
 		code: "PD043",
 		groups: ["supabase", "declarative"],
-		run: (project) => pd043(project.cwd, project.files)
+		run: (project) => pd043(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD068",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd068(project.cwd, project.config, project.files)
+	},
+	{
+		code: "PD069",
+		groups: ["supabase", "declarative"],
+		run: (project) => pd069(project.cwd, project.config, project.files)
 	},
 	{
 		code: "PD045",
@@ -2079,12 +2247,20 @@ const DOCTOR_CHECKS = [
 	}
 ];
 async function runDoctor(input) {
+	const wanted = new Set(input.only.map((item) => item.toLowerCase()));
+	const unknown = unknownOnly(wanted);
+	if (unknown !== void 0) return {
+		code: 2,
+		output: unknown
+	};
+	const fixed = [];
 	if (input.fix) {
-		runSkillsInstall({
+		const skills = runSkillsInstall({
 			cwd: input.cwd,
 			agents: []
 		});
-		await runCollect({
+		fixed.push(`skills: ${skills.output}`);
+		const collected = await runCollect({
 			cwd: input.cwd,
 			config: input.config,
 			collect: input.config.collect ?? {},
@@ -2092,9 +2268,9 @@ async function runDoctor(input) {
 			now: input.now,
 			io: input.io
 		});
+		fixed.push(`catalog: ${collected.message.trim()}`);
 	}
 	const project = loadProject(input);
-	const wanted = new Set(input.only.map((item) => item.toLowerCase()));
 	const selected = (check) => wanted.size === 0 || wanted.has(check.code.toLowerCase()) || check.groups.some((group) => wanted.has(group));
 	const findings = [];
 	for (const check of DOCTOR_CHECKS) {
@@ -2105,13 +2281,18 @@ async function runDoctor(input) {
 	const warnings = findings.filter((item) => item.severity === "warning").length;
 	const report = {
 		$schema: DOCTOR_REPORT_SCHEMA,
+		fixed,
 		findings,
 		errors,
 		warnings
 	};
 	return {
 		code: errors > 0 || input.strict && warnings > 0 ? 1 : 0,
-		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatDoctor(report, input.color)
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatDoctor(report, input.color),
+		findings: findings.map((item) => findingOf({
+			...item,
+			docs: `${DOCS_BASE}/doctor#checks`
+		}))
 	};
 }
 /** PD059: the configured policy module throws or exports no policy, so every policy check is skipped. */
@@ -2134,9 +2315,23 @@ async function pd060(project) {
 		fix: "fix the syntax error, or exclude the file from collect.srcPath"
 	}));
 }
+/** A usage message for the first `--only` value that names no check code or group. */
+function unknownOnly(wanted) {
+	const known = /* @__PURE__ */ new Set();
+	for (const check of DOCTOR_CHECKS) {
+		known.add(check.code.toLowerCase());
+		for (const group of check.groups) known.add(group);
+	}
+	for (const item of wanted) if (!known.has(item)) {
+		const suggestion = didYouMean(item, [...known]);
+		return `doctor: --only ${item} names no check code or group${suggestion === void 0 ? "" : `. Did you mean ${suggestion}?`}`;
+	}
+}
 function formatDoctor(report, color) {
 	const style = createStyle(color);
 	const lines = [style.paint("bold", "permdock doctor"), ""];
+	for (const change of report.fixed) lines.push(`  ${style.okMark} fixed ${change}`);
+	if (report.fixed.length > 0) lines.push("");
 	for (const finding of report.findings) {
 		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
 		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
@@ -2163,4 +2358,4 @@ async function supabaseSetup(input) {
 	});
 }
 //#endregion
-export { runDoctor };
+export { DOCTOR_CHECKS, runDoctor };

package/dist/drizzle/index.d.ts

@@ -1,6 +1,7 @@
-import { It as WhereResult, jr as Condition, kr as Subject } from "../policy-types-sp9P1iIV.js";
+import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
+import { c as WhereResult } from "../permdock-D7eeLJER.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-CtTP7eur.js";
+import { s as MembershipsMapping } from "../compile-Ckm2HqBZ.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts
@@ -13,7 +14,8 @@ type DrizzleWhereOptions<T = unknown> = {
   readonly memberships?: MembershipsMapping;
   /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
   readonly relations?: RelationsMapping;
-  readonly now?: number;
+  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  readonly now?: Instant;
   readonly operators?: DrizzleOperators;
 };
 type DrizzleOperators = {

package/dist/drizzle/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { a as assertSafeKey } from "../thenable-QSmvt-vZ.js";
-import { n as escapeLike, t as compileWhere } from "../compile-CcEu2ZQ1.js";
+import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CMqMx_IN.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {

package/dist/elysia/index.d.ts

@@ -1,30 +1,31 @@
-import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, C as verifyWebBotAuth, O as Connection, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
-import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
-type ElysiaCtx = {
+type ElysiaRequestContext = {
   readonly request: Request;
   readonly body?: unknown;
   readonly params?: Readonly<Record<string, string | undefined>>;
 };
-type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaCtx, TUser> & {
+type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaRequestContext, TUser> & {
   /** Ends or revalidates open sockets. */
   readonly revocations?: RevocationFeed;
 };
 /** The `ws` Elysia passes to `.ws` handlers; `data` is the upgrade context. */
 type ElysiaSocket = {
-  readonly data: ElysiaCtx;
+  readonly data: ElysiaRequestContext;
   close(code?: number, reason?: string): unknown;
 };
-type ElysiaContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaCtx & {
+type ElysiaPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaRequestContext & {
   permdock: PermDock<V>;
   permdockData?: unknown;
 };
-type ElysiaProtect = (permission: Permission | null, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
-/** The `permdock()` plugin: its global derive types `permdock` in every later handler. */
+type ElysiaProtect = (permission: Permission | null, data?: (ctx: ElysiaRequestContext) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaRequestContext) => Promise<Response | undefined>;
+/** The `middleware()` plugin: its global derive types `permdock` in every later handler. */
 type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
   decorator: Record<never, never>;
   store: Record<never, never>;
@@ -34,7 +35,9 @@ type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysi
   resolve: Record<never, never>;
 }>;
 type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => ElysiaPermDockPlugin<V>;
+  /** The `PermDock` for one request, for code the middleware does not run before. */
+  readonly getPermDock: (ctx: ElysiaRequestContext) => Promise<PermDock<V>>;
+  readonly middleware: () => ElysiaPermDockPlugin<V>;
   readonly protect: ElysiaProtect;
   /**
    * One connection per socket: the same promise for every handler
@@ -46,4 +49,4 @@ type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ElysiaPermDockOptions<TUser>): ElysiaPermDock<V>;
 //#endregion
-export { type ElysiaContext, type ElysiaCtx, type ElysiaPermDock, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, verifyWebBotAuth };
+export { type ElysiaPermDock, type ElysiaPermDockContext, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaRequestContext, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/elysia/index.js

@@ -1,23 +1,23 @@
 import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
-import { t as problemFromError } from "../map-error-BE27PYkE.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-kk-uyCwH.js";
-import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-BMui98KK.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts
 function createPermDock(policy, options) {
 	const seed = globalThis.crypto.randomUUID();
-	const { kernel, bind, scopeOf, handlerScope, guard: runGuard } = bindKernel(policy, options, "elysia", toRequest);
-	const permdock = () => new Elysia({
+	const { kernel, bind, scopeOf, handlerScope, getPermDock, guard: runGuard } = bindKernel(policy, options, "elysia", toRequest);
+	const middleware = () => new Elysia({
 		name: "permdock",
 		seed
 	}).derive({ as: "global" }, async (ctx) => {
-		const instance = await kernel.permdock(bind(ctx), await scopeOf(ctx));
+		const instance = await kernel.getPermDock(bind(ctx), await scopeOf(ctx));
 		decorate(ctx, instance);
 		return { permdock: instance };
 	}).onError({ as: "global" }, ({ error, request }) => problemFromError(error, { credentials: hasCredentials(request) }));
-	const protect = (permission, loadData, protectOptions) => async (ctx) => {
-		const guard = await runGuard(permission, loadData, ctx, protectOptions);
+	const protect = (permission, data, protectOptions) => async (ctx) => {
+		const guard = await runGuard(permission, data, ctx, protectOptions);
 		if (!guard.ok) return guard.response;
 		decorate(ctx, guard.permdock, guard.data);
 	};
@@ -25,7 +25,7 @@ function createPermDock(policy, options) {
 	const connection = (ws, connectionOptions) => socketConnection(sockets, ws.data, async () => {
 		const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
 		onRevoked(conn, (problem) => {
-			ws.close(POLICY_VIOLATION, problem.type);
+			ws.close(POLICY_VIOLATION, closeReason(problem));
 		});
 		return conn;
 	});
@@ -37,7 +37,8 @@ function createPermDock(policy, options) {
 		}).post("/", (ctx) => POST(bind(ctx))).get("/", (ctx) => GET(bind(ctx)));
 	};
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
 		permdockHandler,
@@ -56,4 +57,4 @@ function toRequest(ctx) {
 	});
 }
 //#endregion
-export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/env-DJZrPjRi.js

@@ -0,0 +1,8 @@
+//#region src/cli/core/env.ts
+/** `CI` set to anything but an empty string, `0` or `false`. */
+function isCi(env) {
+	const value = env["CI"]?.trim().toLowerCase();
+	return value !== void 0 && value !== "" && value !== "0" && value !== "false";
+}
+//#endregion
+export { isCi };

package/dist/errors-BDUwg2qC.js

@@ -0,0 +1,27 @@
+//#region src/approvals/access-reviews/errors.ts
+var AccessReviewError = class extends Error {
+	name = "AccessReviewError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"review-not-found",
+	"review-closed",
+	"item-not-found",
+	"item-not-pending",
+	"reviewer-unauthenticated",
+	"reviewer-not-eligible",
+	"reviewer-is-holder",
+	"not-revoked",
+	"already-applied"
+]);
+function isAccessReviewError(value) {
+	if (!(value instanceof Error) || value.name !== "AccessReviewError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+export { isAccessReviewError as n, AccessReviewError as t };