permdock 0.5.0 → 0.7.0

package/dist/{doctor-DFjUxf2f.js → doctor-BU1szn63.js}

@@ -1,41 +1,43 @@
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
 import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { c as separationConflicts } from "./policy-DLZJ5gAp.js";
-import { x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
-import { s as parseCredential } from "./credential-DM2um3ha.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { l as separationConflicts } from "./policy-DaJy4nK4.js";
+import { T as validateCustomRole } from "./evaluate-B_oqFbWC.js";
+import { s as parseCredential } from "./credential-CIM7wHwA.js";
+import { a as describeError } from "./errors-DpP_U6Bf.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
 import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-CV9s6B1S.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
+import { r as runCollect } from "./collect-BaWeMjwV.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-B96movIM.js";
+import { i as scopeMembershipTable } from "./compile-BAEO5bOk.js";
 import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-vs5dGOsS.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-B-zYB4GS.js";
+import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
 import "./markers-C6joDI3o.js";
-import { t as didYouMean } from "./args-IIolxxKA.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
-import { t as createStyle } from "./style-Uao76wO7.js";
-import { r as findingOf } from "./output-Dyw8fyPF.js";
-import { i as runSkillsInstall } from "./skills-B6lVdD_W.js";
+import { t as didYouMean } from "./args-CC3OwyHW.js";
+import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { t as createStyle } from "./style-Cqo7-73x.js";
+import { r as findingOf } from "./output-DgSDLrta.js";
+import { i as runSkillsInstall } from "./skills-Dcjw9_1C.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { l as partPath } from "./output-files-DhRBBE4n.js";
-import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-DdDQhMlw.js";
-import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-Sq12mEA6.js";
-import { I as graphSqlName, M as contextRefs, S as byKey, a as guardedTables, t as ownershipRules } from "./ownership-BatFgAA4.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-T5mXq98v.js";
-import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DbCL9bnB.js";
-import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-bYUDLOAO.js";
-import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-CALjIQ7e.js";
-import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { l as partPath } from "./output-files-CCMdcFWb.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-Dg0SrQWR.js";
+import { D as byKey, U as graphSqlName, o as guardedTables, r as unsatisfiedKinds, t as ownershipRules, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-DRo2QM6E.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-Bybmck7f.js";
+import { _ as helperTablePolicies, b as compileGrants, d as tableNames, i as graphPlan, m as ROW_CONDITION_FIX, u as tableNameOf, v as rowConditionMessage, x as tableFor, y as commandFor } from "./verify-pe8rL_Qw.js";
+import { t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-53ryOZip.js";
+import { a as generateOptions, c as buildContext, n as inheritTargets, o as isRefusal, t as supautilsRejections } from "./supautils-MESd81bF.js";
+import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-Wj6dkyDE.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -831,11 +833,26 @@ async function pd035(input) {
 }
 //#endregion
 //#region src/cli/doctor/powersync.ts
+/** Why each membership source of a scope the streams read through sources has no stream form, once per source. */
+function sourceGaps(policy, config) {
+	const scopes = scopeList(policy.scopes);
+	const sources = membershipSourcesOf(config);
+	const gaps = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		if (scopeMembershipTable(config.rls?.memberships, scopes, scope.name) !== void 0) continue;
+		for (const source of scopeSourcesOf(sources, scope.name)) {
+			const stream = streamOf(source);
+			if (typeof stream === "string") gaps.add(stream);
+		}
+	}
+	return [...gaps];
+}
 /**
 * PD058: `sync-config.yaml` or the `powersync.manifest` file is not what the
 * policy compiles to, so PowerSync syncs rows, or the device builds
 * snapshots, by an older policy. A policy that does not compile is a finding
-* too.
+* too, and so is each membership source of a synced scope with no stream
+* form: its members sync none of the rows it grants.
 */
 async function pd058(input) {
 	const { cwd, config } = input;
@@ -853,12 +870,18 @@ async function pd058(input) {
 			fix: "fix the powersync and rls config, then run permdock powersync generate"
 		}];
 	}
-	return staleFiles(cwd, compiled.files).map((file) => ({
+	const gaps = sourceGaps(policy, config).map((gap) => ({
+		code: "PD058",
+		severity: "warning",
+		message: gap,
+		fix: "build the source with tableMembershipSource or junctionMembershipSource, without expiresAt or disabledAt, or serve its members from the server"
+	}));
+	return [...staleFiles(cwd, compiled.files).map((file) => ({
 		code: "PD058",
 		severity: "warning",
 		message: file.missing ? `${file.path} is missing, so ${file.path === config.powersync?.manifest ? "the device builds no local snapshot" : "PowerSync syncs no stream the policy compiles to"}` : `${file.path} is not what the policy compiles to, so ${file.path === config.powersync?.manifest ? "the device builds snapshots" : "PowerSync syncs rows"} by an older policy`,
 		fix: "run permdock powersync generate and deploy the files"
-	}));
+	})), ...gaps];
 }
 //#endregion
 //#region src/cli/doctor/project.ts
@@ -1229,8 +1252,8 @@ async function pd030(input) {
 	for (const resource of resources) {
 		const columns = limitedColumns(policy, resource, rls.actions);
 		if (columns.length === 0) continue;
-		const table = tableFor(resource, rls.tables);
-		if (rls.fields !== "views") {
+		const table = tableFor(resource, tableNames(rls.tables));
+		if (rls.fields === void 0) {
 			findings.push({
 				code: "PD030",
 				severity: "warning",
@@ -1336,6 +1359,32 @@ async function pd034(input) {
 	}));
 }
 /**
+* PD076: `rls.actions` entries set to `'none'` that change nothing: a verb
+* that is not one of the six default verbs and does not read as a write
+* compiles to no policy anyway, and a verb no permission uses compiles to
+* nothing at all. A write-sounding `none` stays, because it silences PD071.
+*/
+async function pd076(input) {
+	const actions = input.config.rls?.actions;
+	if (actions === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const used = new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.action));
+	const unused = Object.keys(actions).filter((verb) => !used.has(verb)).toSorted();
+	const noop = Object.entries(actions).filter(([verb, command]) => command === "none" && used.has(verb) && commandFor(verb) === void 0 && !suggestsWrite(verb)).map(([verb]) => verb).toSorted();
+	return [...noop.length === 0 ? [] : [{
+		code: "PD076",
+		severity: "info",
+		message: `rls.actions sets ${noop.join(", ")} to 'none', which is already what ${noop.length === 1 ? "that verb compiles" : "those verbs compile"} to`,
+		fix: `delete these entries: ${noop.join(", ")}`
+	}], ...unused.length === 0 ? [] : [{
+		code: "PD076",
+		severity: "info",
+		message: `rls.actions maps ${unused.join(", ")}, which no permission uses`,
+		fix: `delete these entries, or fix the verb's spelling: ${unused.join(", ")}`
+	}]];
+}
+/**
 * Storage and Realtime policies written outside PermDock that call the SQL helpers for a permission whose grants
 * carry row conditions: the helpers check only role and scope.
 */
@@ -1399,20 +1448,94 @@ async function pd071(input) {
 		fix: `map it on purpose in rls.actions: ${verb}: "insert", "update", "delete" or "none"`
 	}));
 }
+/**
+* PD072: a membership source reads role keys through the table of custom
+* roles (`rls.customRoleWrites.roles`), which tenants write.
+*/
+function pd072(input) {
+	const roles = input.config.rls?.customRoleWrites?.roles;
+	if (roles?.tenant === void 0) return [];
+	const target = qualifySqlTable(roles.table);
+	return membershipSourcesOf(input.config).filter((source) => source.sql.throughs.some((through) => through.table === target)).map((source) => ({
+		code: "PD072",
+		severity: "warning",
+		message: `the ${source.sql.table} membership source reads role keys through ${target}, whose tenant rows tenants write: a tenant row named like a declared role must not grant it`,
+		fix: `keep the permdock_custom_role_name_guard trigger on ${target} (rls generate emits it with customRoleWrites.roles) and generate with this config, so helpers read a tenant row named like a declared role as no role`
+	}));
+}
+/** PD073: a role's `for` lists kinds no membership source of its scope can hold. */
+async function pd073(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const ownership = ownershipRules(policy, scopes);
+	const sources = membershipSourcesOf(input.config);
+	const ctx = {
+		dialect: "supabase",
+		scopes,
+		tenantClaim: "tenant_id",
+		gucPrefix: "app",
+		...rls.memberships === void 0 ? {} : { memberships: rls.memberships },
+		...sources === void 0 ? {} : { memberSources: sources },
+		...ownership === void 0 ? {} : { ownership }
+	};
+	return unsatisfiedKinds(ctx, policy).map((item) => ({
+		code: "PD073",
+		severity: "error",
+		message: `role ${item.role} is for ${item.for.join(", ")}, but its membership sources hold ${item.sources.join(", ")}: no membership can hold it`,
+		fix: `set via on one of those sources to ${item.for.join(" or ")}, or change for on role ${item.role}`
+	}));
+}
+/**
+* PD075: two resources that `rls.tables` maps to one table, each with its own
+* keys and helpers for the same rows. `doctor.sharedTables` lists tables split
+* on purpose (two resources over disjoint rows).
+*/
+async function pd075(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const allowed = new Set((input.config.doctor?.sharedTables ?? []).map(qualifySqlTable));
+	const byTable = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		const table = qualifySqlTable(tableNameOf(rls.tables?.[leaf.resource], leaf.resource));
+		byTable.set(table, (byTable.get(table) ?? /* @__PURE__ */ new Set()).add(leaf.resource));
+	}
+	return [...byTable.entries()].filter(([table, resources]) => resources.size > 1 && !allowed.has(table)).toSorted(byKey).map(([table, resources]) => {
+		return {
+			code: "PD075",
+			severity: "warning",
+			message: `rls.tables maps ${[...resources].toSorted().join(" and ")} to ${table}, so the same rows carry two sets of keys and helpers`,
+			fix: `merge them into one resource (https://permdock.com/docs/guides/merge-resources), or list ${table} in doctor.sharedTables when the resources cover disjoint rows`
+		};
+	});
+}
 //#endregion
 //#region src/cli/doctor/seeds.ts
 const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
 const SEED_CLEAR = /^delete\s+from\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*$/iu;
 const LITERAL = String.raw`'((?:[^']|'')*)'`;
 const SEED_ROW = new RegExp(String.raw`\(\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*\)`, "gu");
+const SEED_VIEW = /^create\s+(?:or\s+replace\s+)?view\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\([^)]*\)\s*with\s*\([^)]*\)\s*as\s+([\s\S]*)$/iu;
+const SEED_FUNCTION = /^create\s+(?:or\s+replace\s+)?function\s+(?:"[^"]+"|\w+)\.(?:"seed"|seed)\s*\(\s*\)[\s\S]*?\$(\w*)\$([\s\S]*)\$\1\$/iu;
 function rowKey(values) {
 	return values.join(" ");
 }
+/** The statements of a file, with the body of `<schema>.seed()` (`rls.seeds: 'function'`) in place of its `create function`. */
+function seedStatements(sql) {
+	return sqlStatements(sql).flatMap((statement) => {
+		const fn = SEED_FUNCTION.exec(statement.text);
+		return fn === null ? [statement] : sqlStatements(group(fn, 2));
+	});
+}
 /** The rows of the last statement that seeds or clears `table`, in migration order. */
 function lastSeed(files, cwd, config, table) {
 	let seeded;
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(files.read(file))) {
-		const insert = SEED_INSERT.exec(text);
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of seedStatements(files.read(file))) {
+		const insert = SEED_INSERT.exec(text) ?? SEED_VIEW.exec(text);
 		if (insert !== null && tableKey(group(insert, 1)) === table) {
 			const rows = /* @__PURE__ */ new Set();
 			for (const row of group(insert, 2).matchAll(SEED_ROW)) rows.add(rowKey(row.slice(1, 6).map((value) => value.replaceAll("''", "'"))));
@@ -1447,18 +1570,26 @@ async function pd054(input) {
 	if (seeded === void 0) return [];
 	const policy = await policyOf(input);
 	if (policy === void 0) return [];
-	const ctx = {
+	const generate = {
+		cwd,
+		config,
+		target: "sql",
 		dialect: rls?.dialect ?? "supabase",
-		scopes: scopeList(policy.scopes),
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		gucPrefix: rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		schema,
-		...rls?.fields === "views" ? { fields: "views" } : {}
+		rbac: false,
+		check: false,
+		skipClosures: true,
+		inlineFunctions: false,
+		io: {
+			stdout: () => void 0,
+			stderr: () => void 0
+		}
 	};
 	let expected;
 	try {
-		expected = new Set(compileGrants(policy, ctx, rls?.tables, [], true).rolePermissions.map((row) => rowKey([
+		const options = generateOptions(generate);
+		const built = isRefusal(options) ? options : buildContext(generate, policy, options);
+		if (isRefusal(built)) return [];
+		expected = new Set(compileGrants(policy, built.ctx, tableNames(rls?.tables), [], true, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0).rolePermissions.map((row) => rowKey([
 			row.role,
 			row.permission,
 			row.grantKey,
@@ -1582,25 +1713,51 @@ function revokedExecute(statements) {
 	}
 	return revoked;
 }
+/** `supabase.hook.claims` and `hook.before` functions, by key, with the argument type the hook calls them with. */
+function hookClaimFunctions(config) {
+	const hook = config.supabase?.hook;
+	const before = hook?.before;
+	const functions = /* @__PURE__ */ new Map();
+	for (const fn of Object.values(hook?.claims ?? {})) if (typeof fn === "string") functions.set(tableKey(fn), "uuid");
+	for (const fn of typeof before === "string" ? [before] : before ?? []) if (typeof fn === "string") functions.set(tableKey(fn), "jsonb");
+	return functions;
+}
 /**
 * PD049: a `security definer` function `public` (every role) or, in Supabase's
 * `public` schema, `anon` may still execute: Postgres grants `execute` to
 * `public` on create, and Supabase's default privileges grant it to `anon`.
+* A hook claim function returns any user's claims, so `authenticated` must
+* not execute it either, definer or not.
 */
 function pd049(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const statements = migrationStatements(files, cwd, config);
 	const revoked = revokedExecute(statements);
+	const hookFunctions = hookClaimFunctions(config);
 	const findings = [];
 	for (const fn of createdFunctions(statements)) {
-		if (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head)) continue;
+		const hookArgument = hookFunctions.get(fn.key);
+		if (hookArgument === void 0 && (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head))) continue;
 		const schema = schemaOf(fn.key);
 		const from = /* @__PURE__ */ new Set([
 			...revoked.get(fn.key) ?? [],
 			...revoked.get(`${schema}.*`) ?? [],
 			...revoked.get("*.*") ?? []
 		]);
-		const missing = ["public", ...schema === "public" ? ["anon"] : []].filter((role) => !from.has(role));
+		const missing = (hookArgument === void 0 ? ["public", ...schema === "public" ? ["anon"] : []] : [
+			"public",
+			"anon",
+			"authenticated"
+		]).filter((role) => !from.has(role));
+		if (missing.length > 0 && hookArgument !== void 0) {
+			findings.push({
+				code: "PD049",
+				severity: "warning",
+				message: `${fn.file}:${String(fn.line)} hook claim function ${fn.key} returns any user's claims and can be executed by ${missing.join(" and ")}`,
+				fix: `regenerate the hook (permdock rls generate), which revokes it, or add revoke all on function ${fn.key}(${hookArgument}) from public, anon, authenticated;`
+			});
+			continue;
+		}
 		if (missing.length > 0) findings.push({
 			code: "PD049",
 			severity: "warning",
@@ -2078,6 +2235,26 @@ const DOCTOR_CHECKS = [
 		groups: ["rls"],
 		run: pd071
 	},
+	{
+		code: "PD072",
+		groups: ["rls"],
+		run: pd072
+	},
+	{
+		code: "PD073",
+		groups: ["rls", "ownership"],
+		run: pd073
+	},
+	{
+		code: "PD075",
+		groups: ["rls"],
+		run: pd075
+	},
+	{
+		code: "PD076",
+		groups: ["rls"],
+		run: pd076
+	},
 	{
 		code: "PD028",
 		groups: ["attrs", "supabase"],
@@ -2181,6 +2358,12 @@ const DOCTOR_CHECKS = [
 		groups: ["supabase"],
 		run: (project) => pd045(project.cwd)
 	},
+	{
+		code: "PD074",
+		groups: ["supabase", "helpers"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: (project) => pd074(project.cwd, project.config)
+	},
 	...[
 		["PD046", pd046],
 		["PD047", pd047],
@@ -2333,15 +2516,24 @@ function formatDoctor(report, color) {
 	for (const change of report.fixed) lines.push(`  ${style.okMark} fixed ${change}`);
 	if (report.fixed.length > 0) lines.push("");
 	for (const finding of report.findings) {
-		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
+		const mark = markOf(finding.severity, style);
 		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
 		lines.push(`           ${style.paint("dim", `fix: ${finding.fix}`)}`);
 	}
 	if (report.findings.length === 0) lines.push("  no findings");
 	lines.push("");
-	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}`);
+	const notes = report.findings.filter((finding) => finding.severity === "info").length;
+	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}${notes === 0 ? "" : `, ${String(notes)} note${notes === 1 ? "" : "s"}`}`);
 	return `${lines.join("\n")}\n`;
 }
+function markOf(severity, style) {
+	switch (severity) {
+		case "error": return style.errorMark;
+		case "warning": return style.warnMark;
+		case "info": return style.infoMark;
+		default: return severity;
+	}
+}
 async function supabaseSetup(input) {
 	const policy = await input.policy();
 	if (policy === void 0) return [];

package/dist/{doctor-CxiwSfqH.js → doctor-BoK_y0KO.js}

@@ -1,6 +1,6 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-C3DktBDY.js";
-import { n as ask, t as CANCELLED } from "./prompt-DfZLJLIn.js";
+import { a as failOnFlag } from "./flags-aaeRAdiD.js";
+import { n as ask, t as CANCELLED } from "./prompt-DwtVemER.js";
 //#region src/cli/commands/doctor.ts
 const doctor = defineLeaf({
 	flags: {
@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-DFjUxf2f.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-BU1szn63.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-DFjUxf2f.js")).runDoctor({
+		return (await import("./doctor-BU1szn63.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
-import { c as WhereResult } from "../permdock-D7eeLJER.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-B-F-qAZk.js";
+import { u as WhereResult } from "../permdock-Dco6dyCK.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-Ckm2HqBZ.js";
+import { s as MembershipsMapping } from "../compile-COM2VKuN.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/drizzle/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as escapeLike, t as compileWhere } from "../compile-CMqMx_IN.js";
+import { n as escapeLike, t as compileWhere } from "../compile-BAEO5bOk.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-C2PXIv4c.d.ts → errors-B_Qg9D3e.d.ts}

@@ -1,5 +1,5 @@
-import { Nn as Decision, an as WireDenial, ir as Subject } from "./policy-types-DzwivBgR.js";
-import { t as Disclosure } from "./problem-details-DXlt-vks.js";
+import { Ln as Decision, ln as WireDenial, lr as Subject } from "./policy-types-B-F-qAZk.js";
+import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */

package/dist/{errors-CWTY6uih.js → errors-DpP_U6Bf.js}

@@ -18,6 +18,7 @@ const CODES = {
 	dirty_worktree: ["Uncommitted changes", 3],
 	write_failed: ["Write failed", 1],
 	check_failed: ["Out of date", 1],
+	catalog_invalid: ["Invalid catalog", 1],
 	input_required: ["Input required", 3],
 	consent_required: ["Consent required", 3],
 	cancelled: ["Cancelled", 130],