permdock 0.6.0 → 0.8.0

package/dist/{doctor-BdZw53-k.js → doctor-CHD1M9R5.js}

@@ -1,41 +1,45 @@
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
-import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { c as separationConflicts } from "./policy-DbM5YYtV.js";
-import { C as validateCustomRole } from "./evaluate-CNClBvcj.js";
-import { s as parseCredential } from "./credential-BcoiejpY.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { r as runCollect } from "./collect-mLTY4nwb.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
+import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { u as separationConflicts } from "./policy-CLQ8__GF.js";
+import { T as validateCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { s as parseCredential } from "./credential-CyyyvCsL.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-vs5dGOsS.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import "./markers-C6joDI3o.js";
-import { t as didYouMean } from "./args-IIolxxKA.js";
-import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
-import { t as createStyle } from "./style-Uao76wO7.js";
-import { r as findingOf } from "./output-1im__-08.js";
-import { i as runSkillsInstall } from "./skills-B6lVdD_W.js";
+import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
+import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-CMAM-2A3.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import "./markers-BeHZ4x9Q.js";
+import { t as didYouMean } from "./args-0FrVs5EH.js";
+import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as createStyle } from "./style-Ds11Hmk4.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-tkju6U7R.js";
+import { i as runSkillsInstall } from "./skills-Bjj7BNEQ.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { l as partPath } from "./output-files-DhRBBE4n.js";
-import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-BMoEhZir.js";
-import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-Sq12mEA6.js";
-import { C as byKey, L as graphSqlName, N as contextRefs, a as guardedTables, t as ownershipRules } from "./ownership-DqaJNJPn.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-SveTRTyr.js";
-import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-BaAKx7t6.js";
-import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-BkWWCS1K.js";
-import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-CALjIQ7e.js";
-import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
+import { l as partPath } from "./output-files-BIQ_9pIs.js";
+import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-B-yXnzUl.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DeMNEy6V.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-B4L59T9u.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
+import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CxEzS4ey.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DZeqoWu5.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DHNQX06W.js";
+import { a as generateOptions, c as buildContext, n as inheritTargets, o as isRefusal, t as supautilsRejections } from "./supautils-BU-pAEpf.js";
+import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -169,7 +173,10 @@ function membershipsFixture(input) {
 //#endregion
 //#region src/cli/doctor/assignments.ts
 const TRIGGER = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?trigger\s+"?permdock_assignment"?\s[\s\S]*?\bon\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`, "iu");
-/** The tables a `permdock_assignment` trigger is created on in the migrations and the `rls generate` output. */
+/**
+* The tables a `permdock_assignment` trigger is created on in the migrations
+* and the `rls generate` output.
+*/
 function triggeredTables(input) {
 	const out = input.config.rls?.out ?? "rls.sql";
 	const files = sqlFiles(input.cwd, [...input.config.doctor?.migrations ?? MIGRATION_DIRS, ...new Set([
@@ -185,10 +192,10 @@ function triggeredTables(input) {
 	return tables;
 }
 /**
-* PD064: `rls.assignments` guards a table (a membership table, the
-* global-roles table or a listed table) that no `permdock_assignment`
-* trigger is created on in the migrations or the `rls generate` output, so a
-* client may write any role there.
+* PD064: `rls.assignments` guards a table (a membership table, the global-roles
+* table or a listed table) that no `permdock_assignment` trigger is created on
+* in the migrations or the `rls generate` output, so a client may write any
+* role there.
 */
 async function pd064(input) {
 	if (input.config.rls?.assignments === void 0) return [];
@@ -207,8 +214,8 @@ async function pd064(input) {
 //#endregion
 //#region src/cli/doctor/catalog.ts
 /**
-* A policy that declares `oauthScopes` against a catalog on disk without
-* them, or with another set. `authorizationProvider` builds better-supabase's
+* A policy that declares `oauthScopes` against a catalog on disk without them,
+* or with another set. `authorizationProvider` builds better-supabase's
 * `delegation.scopes` from the catalog, so its SQL checks deny a token that
 * holds only the coarse scope.
 */
@@ -289,6 +296,72 @@ async function pd067(input) {
 	}]));
 }
 //#endregion
+//#region src/cli/doctor/config-names.ts
+const PLACEHOLDER = /\{([^{}]*)\}/gu;
+/** The scope aliases `ScopeNames` admits next to the declared names. */
+const ALIASES = ["tenant", "team"];
+function keysOf(record) {
+	return record === void 0 ? [] : Object.keys(record);
+}
+function named(where, kind, names) {
+	return names.map((name) => ({
+		where,
+		kind,
+		name
+	}));
+}
+function namedIn(config) {
+	const rls = config.rls;
+	return [
+		...named("rls.tables", "resource", keysOf(rls?.tables)),
+		...named("rls.scopeTypes", "scope", keysOf(rls?.scopeTypes)),
+		...named("rls.actions", "action", keysOf(rls?.actions)),
+		...named("rls.memberships.scopes", "scope", keysOf(rls?.memberships?.scopes)),
+		...named("rls.suspension.scopes", "scope", keysOf(rls?.suspension?.scopes)),
+		...Object.keys(rls?.realtime?.topics ?? {}).flatMap((pattern) => named(`rls.realtime.topics['${pattern}']`, "scope", [...pattern.matchAll(PLACEHOLDER)].map((match) => match[1] ?? ""))),
+		...Object.entries(rls?.storage?.buckets ?? {}).flatMap(([name, bucket]) => named(`rls.storage.buckets.${name}.scope`, "scope", [bucket.scope])),
+		...named("powersync.resources", "resource", config.powersync?.resources ?? []),
+		...named("powersync.action", "action", config.powersync?.action === void 0 ? [] : [config.powersync.action])
+	];
+}
+/**
+* PD077: a config key or value names a scope, resource or action the policy
+* does not declare, such as a Realtime topic `{organisation}` placeholder for
+* the scope `organization`. `defineConfig` with the policy value reports the
+* same names at compile time. Also a SQL helper name `resolveNames` rejects:
+* two sources sharing one, or one Postgres cannot hold.
+*/
+async function pd077(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const leaves = listPermissions(policy.vocabulary.permissions);
+	const declared = {
+		scope: /* @__PURE__ */ new Set([...policy.scopes.map((scope) => scope.name), ...ALIASES]),
+		resource: new Set(leaves.map((leaf) => leaf.resource)),
+		action: new Set(leaves.map((leaf) => leaf.action))
+	};
+	return [...namedIn(input.config).filter((entry) => !declared[entry.kind].has(entry.name)).map((entry) => ({
+		code: "PD077",
+		severity: "error",
+		message: `${entry.where} names the ${entry.kind} '${entry.name}', which the policy does not declare`,
+		fix: `use one of ${[...declared[entry.kind]].toSorted().join(", ")}, or pass the policy value to defineConfig to catch this at compile time`
+	})), ...helperNames(policy, input.config)];
+}
+function helperNames(policy, config) {
+	try {
+		resolveNames(policy, config);
+		return [];
+	} catch (cause) {
+		return [{
+			code: "PD077",
+			severity: "error",
+			message: describeError(cause).replace(/^PermDock CLI: /u, ""),
+			fix: "rename the scope or resource so each generated SQL helper has its own name of at most 63 bytes"
+		}];
+	}
+}
+//#endregion
 //#region src/cli/doctor/declarative.ts
 const SCHEMAS = "supabase/schemas";
 const MIGRATIONS = "supabase/migrations";
@@ -300,7 +373,10 @@ const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids
 function uncommented(text) {
 	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 }
-/** Whether `text` starts with a line `rls generate` or `supabase hook generate` writes. */
+/**
+* Whether `text` starts with a line `rls generate` or `supabase hook generate`
+* writes.
+*/
 function generatedByPermDock(text) {
 	return text.startsWith("-- permdock:") || text.startsWith("-- generated by permdock");
 }
@@ -308,9 +384,9 @@ function generatedByPermDock(text) {
 * PD042: under migra, a hook declared under `supabase/schemas` reaches the
 * database through `supabase db diff`, which drops its `supabase_auth_admin`
 * grants. pg-delta keeps them, so the check runs only for `migra`. A function
-* created (or dropped and created again) without them is executable by
-* `public` and not by the auth server, so a migration at or after the one
-* that creates it must carry the grants.
+* created (or dropped and created again) without them is executable by `public`
+* and not by the auth server, so a migration at or after the one that creates
+* it must carry the grants.
 */
 function pd042(cwd, config, files = nodeFiles) {
 	if (config.supabase?.hook === void 0 || resolveSchemas(cwd, config).mode !== "migra") return [];
@@ -338,10 +414,10 @@ function generatedSchemaFiles(cwd, schemaDir, files) {
 }
 /**
 * PD068: PermDock generates for pg-delta (the default), but
-* `supabase/config.toml` does not set `[experimental.pgdelta] enabled =
-* true`, so Supabase CLI 2.x diffs the schema files with migra. migra drops
-* the hook's `supabase_auth_admin` grants and the helpers' privileges, and
-* PermDock wrote no `--grants-out` file to restore them.
+* `supabase/config.toml` does not set `[experimental.pgdelta] enabled = true`,
+* so Supabase CLI 2.x diffs the schema files with migra. migra drops the hook's
+* `supabase_auth_admin` grants and the helpers' privileges, and PermDock wrote
+* no `--grants-out` file to restore them.
 */
 function pd068(cwd, config, files = nodeFiles) {
 	const read = readSupabaseConfig(cwd);
@@ -360,8 +436,8 @@ function pd068(cwd, config, files = nodeFiles) {
 /**
 * PD069: leftovers of declarative schemas on migra in a pg-delta project:
 * `[db.migrations] schema_paths`, which pg-delta's dependency order makes
-* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate
-* the per-schema layout `rls generate --split` now writes.
+* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate the
+* per-schema layout `rls generate --split` now writes.
 */
 function pd069(cwd, config, files = nodeFiles) {
 	const schemas = resolveSchemas(cwd, config);
@@ -381,20 +457,26 @@ function pd069(cwd, config, files = nodeFiles) {
 	});
 	return findings;
 }
-/** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
+/**
+* The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or
+* Supabase's default.
+*/
 function schemaPaths(cwd) {
 	const paths = supabaseConfig(cwd).schemaPaths ?? [];
 	return paths.length === 0 ? ["./schemas/**/*.sql"] : paths;
 }
-/** Schema files in the order `supabase db diff` applies them: each glob in turn, sorted within it. */
+/**
+* Schema files in the order `supabase db diff` applies them: each glob in turn,
+* sorted within it.
+*/
 function orderedSchemaFiles(cwd) {
 	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
 }
 /**
-* PD043: under migra, `db diff` applies schema files in `schema_paths`
-* order, so a policy that calls `permdock_has` or `permitted_<scope>_ids`
-* before the file that defines them fails to apply. pg-delta orders by
-* dependencies instead.
+* PD043: under migra, `db diff` applies schema files in `schema_paths` order,
+* so a policy that calls `permdock_has` or `permitted_<scope>_ids` before the
+* file that defines them fails to apply. pg-delta orders by dependencies
+* instead.
 */
 function pd043(cwd, config, files = nodeFiles) {
 	if (resolveSchemas(cwd, config).mode !== "migra") return [];
@@ -475,7 +557,7 @@ async function pd018(input) {
 	for (const conflict of separationConflicts(policy, record.memberships ?? [])) findings.push({
 		code: "PD018",
 		severity: "warning",
-		message: `membership ${conflict.principal || "unknown"} holds exclusive roles ${conflict.roles.join(" and ")}`,
+		message: `membership ${nonEmptyOr(conflict.principal, "unknown")} holds exclusive roles ${conflict.roles.join(" and ")}`,
 		fix: "remove one of the exclusive roles from the membership fixture"
 	});
 	return findings;
@@ -510,9 +592,9 @@ async function pd023(input) {
 	return findings;
 }
 /**
-* PD055: a stored custom role names a permission by a key it was renamed
-* from. It still resolves; the alias can only be dropped once storage holds
-* the current key.
+* PD055: a stored custom role names a permission by a key it was renamed from.
+* It still resolves; the alias can only be dropped once storage holds the
+* current key.
 */
 async function pd055(input) {
 	const files = filesOf(input);
@@ -538,7 +620,10 @@ async function pd055(input) {
 	});
 	return findings;
 }
-/** Fixture API keys that never expire, credential policies that allow it, and records that are not v1 credentials. */
+/**
+* Fixture API keys that never expire, credential policies that allow it, and
+* records that are not v1 credentials.
+*/
 function pd029(input) {
 	const parsed = readFixture(input, input.config.doctor?.credentials);
 	const findings = [];
@@ -604,7 +689,10 @@ const ROUTE_GLOBS = ["**/api/permdock/route.{ts,tsx,js,jsx,mjs}"];
 const ENDPOINT = /\bendpoint\s*(?::|=)\s*\{?\s*['"`]/u;
 const NATIVE_IMPORT = /\bfrom\s*['"]permdock\/react-native['"]/u;
 const CLIENT_READS = /* @__PURE__ */ new Set(["usePermission", "reference"]);
-/** A grant the snapshot marks `portable: false`, so a client check needs the endpoint. */
+/**
+* A grant the snapshot marks `portable: false`, so a client check needs the
+* endpoint.
+*/
 function serverOnly(policy, grant) {
 	if (!grant.portable || hasConditionOp(grant.where, "related")) return true;
 	const relations = policy.resources.get(grant.permission.resource)?.relations;
@@ -619,7 +707,10 @@ function serverOnlyKeys(policy) {
 	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grant.effect === "allow" && serverOnly(policy, grant)) keys.add(grant.permission.key);
 	return keys;
 }
-/** An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result, or an `endpoint` string in the source. */
+/**
+* An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result,
+* or an `endpoint` string in the source.
+*/
 function hasEndpoint(files, cwd, sources) {
 	if (listSourceFiles(cwd, ROUTE_GLOBS).filter((file) => /(?:^|[\\/])app[\\/]/u.test(rel(cwd, file))).some((file) => files.read(file).includes("permdockHandler"))) return true;
 	return sources.some((file) => ENDPOINT.test(files.read(file)));
@@ -751,11 +842,14 @@ async function pd019(input) {
 		fix: "set rls.authorize: 'database', or lower [auth] jwt_expiry in supabase/config.toml to 3600 or less"
 	}];
 }
-/** Fixture memberships the policy's scopes would drop: an undeclared scope, a missing parent id, mixed shapes. */
 /**
-* A scope whose roles can all be removed can end up with nobody able to
-* manage it. Setting `min` on any of its roles (even `min: 0`) records the
-* decision and silences the warning.
+* Fixture memberships the policy's scopes would drop: an undeclared scope, a
+* missing parent id, mixed shapes.
+*/
+/**
+* A scope whose roles can all be removed can end up with nobody able to manage
+* it. Setting `min` on any of its roles (even `min: 0`) records the decision
+* and silences the warning.
 */
 async function pd026(input) {
 	if (input.config.policy === void 0) return [];
@@ -832,10 +926,28 @@ async function pd035(input) {
 //#endregion
 //#region src/cli/doctor/powersync.ts
 /**
+* Why each membership source of a scope the streams read through sources has no
+* stream form, once per source.
+*/
+function sourceGaps(policy, config) {
+	const scopes = scopeList(policy.scopes);
+	const sources = membershipSourcesOf(config);
+	const gaps = /* @__PURE__ */ new Set();
+	for (const scope of scopes) {
+		if (scopeMembershipTable(config.rls?.memberships, scopes, scope.name) !== void 0) continue;
+		for (const source of scopeSourcesOf(sources, scope.name)) {
+			const stream = streamOf(source);
+			if (typeof stream === "string") gaps.add(stream);
+		}
+	}
+	return [...gaps];
+}
+/**
 * PD058: `sync-config.yaml` or the `powersync.manifest` file is not what the
-* policy compiles to, so PowerSync syncs rows, or the device builds
-* snapshots, by an older policy. A policy that does not compile is a finding
-* too.
+* policy compiles to, so PowerSync syncs rows, or the device builds snapshots,
+* by an older policy. A policy that does not compile is a finding too, and so
+* is each membership source of a synced scope with no stream form: its members
+* sync none of the rows it grants.
 */
 async function pd058(input) {
 	const { cwd, config } = input;
@@ -853,12 +965,18 @@ async function pd058(input) {
 			fix: "fix the powersync and rls config, then run permdock powersync generate"
 		}];
 	}
-	return staleFiles(cwd, compiled.files).map((file) => ({
+	const gaps = sourceGaps(policy, config).map((gap) => ({
+		code: "PD058",
+		severity: "warning",
+		message: gap,
+		fix: "build the source with tableMembershipSource or junctionMembershipSource, without expiresAt or disabledAt, or serve its members from the server"
+	}));
+	return [...staleFiles(cwd, compiled.files).map((file) => ({
 		code: "PD058",
 		severity: "warning",
 		message: file.missing ? `${file.path} is missing, so ${file.path === config.powersync?.manifest ? "the device builds no local snapshot" : "PowerSync syncs no stream the policy compiles to"}` : `${file.path} is not what the policy compiles to, so ${file.path === config.powersync?.manifest ? "the device builds snapshots" : "PowerSync syncs rows"} by an older policy`,
 		fix: "run permdock powersync generate and deploy the files"
-	}));
+	})), ...gaps];
 }
 //#endregion
 //#region src/cli/doctor/project.ts
@@ -889,7 +1007,10 @@ function isWorkspaceRoot(files, dir) {
 		return false;
 	}
 }
-/** Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's naming the `permdock` skill. */
+/**
+* Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's
+* naming the `permdock` skill.
+*/
 function hasSkillsLock(files, dir) {
 	if (files.exists(join(dir, ".permdock/skills-lock.json"))) return true;
 	const shared = join(dir, "skills-lock.json");
@@ -994,10 +1115,10 @@ const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${V
 const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
 const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
 /**
-* Views run as their owner unless `security_invoker` is set, so they read
-* past RLS on the tables beneath them. The `<table>_visible_fields`
-* companion `rls generate --revoke-columns` writes reads as its owner on
-* purpose and carries a comment that says so.
+* Views run as their owner unless `security_invoker` is set, so they read past
+* RLS on the tables beneath them. The `<table>_visible_fields` companion `rls
+* generate --revoke-columns` writes reads as its owner on purpose and carries a
+* comment that says so.
 */
 function pd022(cwd, config, files = nodeFiles) {
 	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
@@ -1025,9 +1146,9 @@ function pd022(cwd, config, files = nodeFiles) {
 }
 const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
 /**
-* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
-* names its Postgres roles with `to authenticated` instead, and the role
-* claim it reads is the one PostgREST already switched to.
+* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy names
+* its Postgres roles with `to authenticated` instead, and the role claim it
+* reads is the one PostgREST already switched to.
 */
 function pd040(cwd, config, files = nodeFiles) {
 	const findings = [];
@@ -1064,10 +1185,10 @@ function applyPrivilege(writable, verb, part) {
 const CREATE_TABLE$1 = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
 const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
 /**
-* Columns of `table` a client role may insert or update, per the migrations
-* in order; `*` for every column. On Supabase a table created in `public`
-* starts writable: the default privileges grant `anon` and `authenticated`
-* everything, until a migration revokes them.
+* Columns of `table` a client role may insert or update, per the migrations in
+* order; `*` for every column. On Supabase a table created in `public` starts
+* writable: the default privileges grant `anon` and `authenticated` everything,
+* until a migration revokes them.
 */
 function clientWritable(files, cwd, config, target) {
 	const writable = {
@@ -1096,7 +1217,10 @@ function clientWritable(files, cwd, config, target) {
 	}
 	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
 }
-/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
+/**
+* Membership columns a client can write: a user who sets `user_id` or `role`
+* grants themselves access.
+*/
 function membershipFindings(files, cwd, config) {
 	const findings = [];
 	for (const [table, columns] of membershipColumns(config)) {
@@ -1204,7 +1328,10 @@ async function pd020(input) {
 		fix: "remove them from hostable, or drop their tables from rls.tables and enforce them in the application"
 	}];
 }
-/** Columns of `resource` a field-limited read grant can hide: missing from an allow's list, or on a deny's. */
+/**
+* Columns of `resource` a field-limited read grant can hide: missing from an
+* allow's list, or on a deny's.
+*/
 function limitedColumns(policy, resource, actions) {
 	const reads = policy.grants.filter((grant) => grant.permission.resource === resource && grant.fields !== void 0 && commandFor(grant.permission.action, actions) === "select");
 	const node = policy.resources.get(resource);
@@ -1216,8 +1343,8 @@ function limitedColumns(policy, resource, actions) {
 }
 /**
 * `fields` redact in the application; RLS is row-level unless field views
-* compile, and a field view protects nothing while the base table still
-* returns the columns to a direct read.
+* compile, and a field view protects nothing while the base table still returns
+* the columns to a direct read.
 */
 async function pd030(input) {
 	const rls = input.config.rls;
@@ -1229,8 +1356,8 @@ async function pd030(input) {
 	for (const resource of resources) {
 		const columns = limitedColumns(policy, resource, rls.actions);
 		if (columns.length === 0) continue;
-		const table = tableFor(resource, rls.tables);
-		if (rls.fields !== "views") {
+		const table = tableFor(resource, tableNames(rls.tables));
+		if (rls.fields === void 0) {
 			findings.push({
 				code: "PD030",
 				severity: "warning",
@@ -1249,9 +1376,9 @@ async function pd030(input) {
 	return findings;
 }
 /**
-* A self-parented resource no `through` grant walks, or a `restricted`
-* column no graph grant reaches: the declaration has no effect on any
-* decision, and `rls generate` keeps no closure for it.
+* A self-parented resource no `through` grant walks, or a `restricted` column
+* no graph grant reaches: the declaration has no effect on any decision, and
+* `rls generate` keeps no closure for it.
 */
 async function pd031(input) {
 	if (input.config.policy === void 0) return [];
@@ -1279,8 +1406,8 @@ async function pd031(input) {
 }
 /**
 * Under an `rls` config, a graph resource `rls generate` cannot name a helper
-* for: one that shares a scope's name (its `permitted_<name>_ids` would
-* replace the scope helper) or is not a lowercase SQL name.
+* for: one that shares a scope's name (its `permitted_<name>_ids` would replace
+* the scope helper) or is not a lowercase SQL name.
 */
 async function pd032(input) {
 	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
@@ -1336,8 +1463,35 @@ async function pd034(input) {
 	}));
 }
 /**
-* Storage and Realtime policies written outside PermDock that call the SQL helpers for a permission whose grants
-* carry row conditions: the helpers check only role and scope.
+* PD076: `rls.actions` entries set to `'none'` that change nothing: a verb that
+* is not one of the six default verbs and does not read as a write compiles to
+* no policy anyway, and a verb no permission uses compiles to nothing at all. A
+* write-sounding `none` stays, because it silences PD071.
+*/
+async function pd076(input) {
+	const actions = input.config.rls?.actions;
+	if (actions === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const used = new Set(listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.action));
+	const unused = Object.keys(actions).filter((verb) => !used.has(verb)).toSorted();
+	const noop = Object.entries(actions).filter(([verb, command]) => command === "none" && used.has(verb) && commandFor(verb) === void 0 && !suggestsWrite(verb)).map(([verb]) => verb).toSorted();
+	return [...noop.length === 0 ? [] : [{
+		code: "PD076",
+		severity: "info",
+		message: `rls.actions sets ${noop.join(", ")} to 'none', which is already what ${noop.length === 1 ? "that verb compiles" : "those verbs compile"} to`,
+		fix: `delete these entries: ${noop.join(", ")}`
+	}], ...unused.length === 0 ? [] : [{
+		code: "PD076",
+		severity: "info",
+		message: `rls.actions maps ${unused.join(", ")}, which no permission uses`,
+		fix: `delete these entries, or fix the verb's spelling: ${unused.join(", ")}`
+	}]];
+}
+/**
+* Storage and Realtime policies written outside PermDock that call the SQL
+* helpers for a permission whose grants carry row conditions: the helpers check
+* only role and scope.
 */
 async function pd037(input) {
 	const files = filesOf(input);
@@ -1374,7 +1528,10 @@ const WRITE_VERB_PREFIXES = [
 	"confirm",
 	"pause"
 ];
-/** `verb` starts with a write prefix that ends at a word boundary: `markPaid`, not `market`. */
+/**
+* `verb` starts with a write prefix that ends at a word boundary: `markPaid`,
+* not `market`.
+*/
 function suggestsWrite(verb) {
 	return WRITE_VERB_PREFIXES.some((prefix) => {
 		if (!verb.startsWith(prefix)) return false;
@@ -1399,20 +1556,100 @@ async function pd071(input) {
 		fix: `map it on purpose in rls.actions: ${verb}: "insert", "update", "delete" or "none"`
 	}));
 }
+/**
+* PD072: a membership source reads role keys through the table of custom roles
+* (`rls.customRoleWrites.roles`), which tenants write.
+*/
+function pd072(input) {
+	const roles = input.config.rls?.customRoleWrites?.roles;
+	if (roles?.tenant === void 0) return [];
+	const target = qualifySqlTable(roles.table);
+	return membershipSourcesOf(input.config).filter((source) => source.sql.throughs.some((through) => through.table === target)).map((source) => ({
+		code: "PD072",
+		severity: "warning",
+		message: `the ${source.sql.table} membership source reads role keys through ${target}, whose tenant rows tenants write: a tenant row named like a declared role must not grant it`,
+		fix: `keep the permdock_custom_role_name_guard trigger on ${target} (rls generate emits it with customRoleWrites.roles) and generate with this config, so helpers read a tenant row named like a declared role as no role`
+	}));
+}
+/** PD073: a role's `for` lists kinds no membership source of its scope can hold. */
+async function pd073(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const scopes = scopeList(policy.scopes);
+	const ownership = ownershipRules(policy, scopes);
+	const sources = membershipSourcesOf(input.config);
+	const ctx = {
+		dialect: "supabase",
+		scopes,
+		tenantClaim: "tenant_id",
+		gucPrefix: "app",
+		...rls.memberships === void 0 ? {} : { memberships: rls.memberships },
+		...sources === void 0 ? {} : { memberSources: sources },
+		...ownership === void 0 ? {} : { ownership }
+	};
+	return unsatisfiedKinds(ctx, policy).map((item) => ({
+		code: "PD073",
+		severity: "error",
+		message: `role ${item.role} is for ${item.for.join(", ")}, but its membership sources hold ${item.sources.join(", ")}: no membership can hold it`,
+		fix: `set via on one of those sources to ${item.for.join(" or ")}, or change for on role ${item.role}`
+	}));
+}
+/**
+* PD075: two resources that `rls.tables` maps to one table, each with its own
+* keys and helpers for the same rows. `doctor.sharedTables` lists tables split
+* on purpose (two resources over disjoint rows).
+*/
+async function pd075(input) {
+	const rls = input.config.rls;
+	if (rls === void 0 || input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const allowed = new Set((input.config.doctor?.sharedTables ?? []).map(qualifySqlTable));
+	const byTable = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(policy.vocabulary.permissions)) {
+		const table = qualifySqlTable(tableNameOf(rls.tables?.[leaf.resource], leaf.resource));
+		byTable.set(table, (byTable.get(table) ?? /* @__PURE__ */ new Set()).add(leaf.resource));
+	}
+	return [...byTable.entries()].filter(([table, resources]) => resources.size > 1 && !allowed.has(table)).toSorted(byKey).map(([table, resources]) => {
+		return {
+			code: "PD075",
+			severity: "warning",
+			message: `rls.tables maps ${[...resources].toSorted().join(" and ")} to ${table}, so the same rows carry two sets of keys and helpers`,
+			fix: `merge them into one resource (https://permdock.com/docs/guides/merge-resources), or list ${table} in doctor.sharedTables when the resources cover disjoint rows`
+		};
+	});
+}
 //#endregion
 //#region src/cli/doctor/seeds.ts
 const SEED_INSERT = /^insert\s+into\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(\s*role\s*,\s*permission\s*,\s*grant_key\s*,\s*scope\s*,\s*effect\s*\)\s*values\s*([\s\S]*?)\s*on\s+conflict\b/iu;
 const SEED_CLEAR = /^delete\s+from\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*$/iu;
 const LITERAL = String.raw`'((?:[^']|'')*)'`;
 const SEED_ROW = new RegExp(String.raw`\(\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*,\s*${LITERAL}\s*\)`, "gu");
+const SEED_VIEW = /^create\s+(?:or\s+replace\s+)?view\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\([^)]*\)\s*with\s*\([^)]*\)\s*as\s+([\s\S]*)$/iu;
+const SEED_FUNCTION = /^create\s+(?:or\s+replace\s+)?function\s+(?:"[^"]+"|\w+)\.(?:"seed"|seed)\s*\(\s*\)[\s\S]*?\$(\w*)\$([\s\S]*)\$\1\$/iu;
 function rowKey(values) {
 	return values.join(" ");
 }
-/** The rows of the last statement that seeds or clears `table`, in migration order. */
+/**
+* The statements of a file, with the body of `<schema>.seed()` (`rls.seeds:
+* 'function'`) in place of its `create function`.
+*/
+function seedStatements(sql) {
+	return sqlStatements(sql).flatMap((statement) => {
+		const fn = SEED_FUNCTION.exec(statement.text);
+		return fn === null ? [statement] : sqlStatements(group(fn, 2));
+	});
+}
+/**
+* The rows of the last statement that seeds or clears `table`, in migration
+* order.
+*/
 function lastSeed(files, cwd, config, table) {
 	let seeded;
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(files.read(file))) {
-		const insert = SEED_INSERT.exec(text);
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of seedStatements(files.read(file))) {
+		const insert = SEED_INSERT.exec(text) ?? SEED_VIEW.exec(text);
 		if (insert !== null && tableKey(group(insert, 1)) === table) {
 			const rows = /* @__PURE__ */ new Set();
 			for (const row of group(insert, 2).matchAll(SEED_ROW)) rows.add(rowKey(row.slice(1, 6).map((value) => value.replaceAll("''", "'"))));
@@ -1435,8 +1672,8 @@ function sample(rows) {
 	return rows.slice(0, 3).map((row) => `(${row})`).join(", ");
 }
 /**
-* PD054: the `role_permissions` rows the migrations seed last are not the
-* rows the policy compiles to, so the helpers answer from a stale policy.
+* PD054: the `role_permissions` rows the migrations seed last are not the rows
+* the policy compiles to, so the helpers answer from a stale policy.
 */
 async function pd054(input) {
 	const { cwd, config } = input;
@@ -1447,18 +1684,26 @@ async function pd054(input) {
 	if (seeded === void 0) return [];
 	const policy = await policyOf(input);
 	if (policy === void 0) return [];
-	const ctx = {
+	const generate = {
+		cwd,
+		config,
+		target: "sql",
 		dialect: rls?.dialect ?? "supabase",
-		scopes: scopeList(policy.scopes),
-		tenantClaim: rls?.tenantClaim ?? "tenant_id",
-		gucPrefix: rls?.gucPrefix ?? "app",
-		...rls?.actions === void 0 ? {} : { actions: rls.actions },
-		schema,
-		...rls?.fields === "views" ? { fields: "views" } : {}
+		rbac: false,
+		check: false,
+		skipClosures: true,
+		inlineFunctions: false,
+		io: {
+			stdout: () => void 0,
+			stderr: () => void 0
+		}
 	};
 	let expected;
 	try {
-		expected = new Set(compileGrants(policy, ctx, rls?.tables, [], true).rolePermissions.map((row) => rowKey([
+		const options = generateOptions(generate);
+		const built = isRefusal(options) ? options : buildContext(generate, policy, options);
+		if (isRefusal(built)) return [];
+		expected = new Set(compileGrants(policy, built.ctx, tableNames(rls?.tables), [], true, rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0).rolePermissions.map((row) => rowKey([
 			row.role,
 			row.permission,
 			row.grantKey,
@@ -1518,7 +1763,10 @@ function pd046(cwd, config, files = nodeFiles) {
 	}];
 }
 const USER_METADATA = /\b(raw_user_meta_data|user_metadata)\b/giu;
-/** PD047: SQL that reads `user_metadata`, which every user can edit for themselves. */
+/**
+* PD047: SQL that reads `user_metadata`, which every user can edit for
+* themselves.
+*/
 function pd047(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => [...statement.text.matchAll(USER_METADATA)].map((match) => ({
@@ -1542,7 +1790,10 @@ function createdFunctions(statements) {
 		}];
 	});
 }
-/** PD048: a function without `set search_path`, so a caller's objects can shadow the ones it names. */
+/**
+* PD048: a function without `set search_path`, so a caller's objects can shadow
+* the ones it names.
+*/
 function pd048(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const statements = migrationStatements(files, cwd, config);
@@ -1560,7 +1811,10 @@ function pd048(cwd, config, files = nodeFiles) {
 		};
 	});
 }
-/** Roles each `revoke` statement takes `execute` from, per function key or `schema.*`. */
+/**
+* Roles each `revoke` statement takes `execute` from, per function key or
+* `schema.*`.
+*/
 function revokedExecute(statements) {
 	const revoked = /* @__PURE__ */ new Map();
 	const add = (key, roles) => {
@@ -1583,24 +1837,53 @@ function revokedExecute(statements) {
 	return revoked;
 }
 /**
+* `supabase.hook.claims` and `hook.before` functions, by key, with the argument
+* type the hook calls them with.
+*/
+function hookClaimFunctions(config) {
+	const hook = config.supabase?.hook;
+	const before = hook?.before;
+	const functions = /* @__PURE__ */ new Map();
+	for (const fn of Object.values(hook?.claims ?? {})) if (typeof fn === "string") functions.set(tableKey(fn), "uuid");
+	for (const fn of typeof before === "string" ? [before] : before ?? []) if (typeof fn === "string") functions.set(tableKey(fn), "jsonb");
+	return functions;
+}
+/**
 * PD049: a `security definer` function `public` (every role) or, in Supabase's
 * `public` schema, `anon` may still execute: Postgres grants `execute` to
-* `public` on create, and Supabase's default privileges grant it to `anon`.
+* `public` on create, and Supabase's default privileges grant it to `anon`. A
+* hook claim function returns any user's claims, so `authenticated` must not
+* execute it either, definer or not.
 */
 function pd049(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const statements = migrationStatements(files, cwd, config);
 	const revoked = revokedExecute(statements);
+	const hookFunctions = hookClaimFunctions(config);
 	const findings = [];
 	for (const fn of createdFunctions(statements)) {
-		if (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head)) continue;
+		const hookArgument = hookFunctions.get(fn.key);
+		if (hookArgument === void 0 && (!/\bsecurity\s+definer\b/iu.test(fn.head) || /\breturns\s+(?:event_)?trigger\b/iu.test(fn.head))) continue;
 		const schema = schemaOf(fn.key);
 		const from = /* @__PURE__ */ new Set([
 			...revoked.get(fn.key) ?? [],
 			...revoked.get(`${schema}.*`) ?? [],
 			...revoked.get("*.*") ?? []
 		]);
-		const missing = ["public", ...schema === "public" ? ["anon"] : []].filter((role) => !from.has(role));
+		const missing = (hookArgument === void 0 ? ["public", ...schema === "public" ? ["anon"] : []] : [
+			"public",
+			"anon",
+			"authenticated"
+		]).filter((role) => !from.has(role));
+		if (missing.length > 0 && hookArgument !== void 0) {
+			findings.push({
+				code: "PD049",
+				severity: "warning",
+				message: `${fn.file}:${String(fn.line)} hook claim function ${fn.key} returns any user's claims and can be executed by ${missing.join(" and ")}`,
+				fix: `regenerate the hook (permdock rls generate), which revokes it, or add revoke all on function ${fn.key}(${hookArgument}) from public, anon, authenticated;`
+			});
+			continue;
+		}
 		if (missing.length > 0) findings.push({
 			code: "PD049",
 			severity: "warning",
@@ -1613,7 +1896,10 @@ function pd049(cwd, config, files = nodeFiles) {
 const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}\s*\(`, "iu");
 const ENABLE_RLS = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}[\s\S]*\benable\s+row\s+level\s+security\b`, "iu");
 const DROP_TABLE = /^drop\s+table\s+(?:if\s+exists\s+)?([\s\S]+?)(?:\s+(?:cascade|restrict))?$/iu;
-/** PD050: a `public` table without row level security, which the Data API serves whole. */
+/**
+* PD050: a `public` table without row level security, which the Data API serves
+* whole.
+*/
 function pd050(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const created = /* @__PURE__ */ new Map();
@@ -1641,7 +1927,10 @@ function pd050(cwd, config, files = nodeFiles) {
 }
 const CREATE_POLICY = new RegExp(String.raw`^create\s+policy\s+${IDENT}\s+on\s+${NAME}([\s\S]*)$`, "iu");
 const UNWRAPPED_AUTH = /(?<!\bselect\s{1,20})\bauth\.(uid|jwt)\s*\(\s*\)/giu;
-/** PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres runs it once per row. */
+/**
+* PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres
+* runs it once per row.
+*/
 function pd051(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => {
@@ -1657,7 +1946,10 @@ function pd051(cwd, config, files = nodeFiles) {
 		}];
 	});
 }
-/** PD052: an update policy without `with check`, so nothing states what a row may become. */
+/**
+* PD052: an update policy without `with check`, so nothing states what a row
+* may become.
+*/
 function pd052(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => {
@@ -1690,9 +1982,9 @@ function topLevelParts(body) {
 	return parts.filter((part) => part !== "");
 }
 /**
-* One column definition or table constraint of a `create table` body: its
-* first column, whether it is a foreign key, and whether a primary key or
-* unique constraint indexes that column.
+* One column definition or table constraint of a `create table` body: its first
+* column, whether it is a foreign key, and whether a primary key or unique
+* constraint indexes that column.
 */
 function tablePart(raw) {
 	const part = raw.replace(/^constraint\s+(?:"[^"]+"|\w+)\s+/iu, "");
@@ -1716,7 +2008,10 @@ function firstColumn(list) {
 }
 const ADD_CONSTRAINT = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}\s+add\s+(?:constraint\s+${IDENT}\s+)?(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)`, "iu");
 const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?${NAME}\s*(?:using\s+\w+\s*)?\(\s*${IDENT}`, "iu");
-/** PD053: a foreign key no index starts with, so joins and deletes on the referenced row scan the table. */
+/**
+* PD053: a foreign key no index starts with, so joins and deletes on the
+* referenced row scan the table.
+*/
 function pd053(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const keys = [];
@@ -1765,10 +2060,10 @@ function at(statement) {
 	return `${statement.file}:${String(statement.line)}`;
 }
 /**
-* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>`
-* setting. Current PostgREST, `withPostgresClient`, PermDock's `withSubject`
-* and `rls verify` set only `request.jwt.claims`. A function replaced by a
-* later migration is judged by its last definition.
+* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>` setting.
+* Current PostgREST, `withPostgresClient`, PermDock's `withSubject` and `rls
+* verify` set only `request.jwt.claims`. A function replaced by a later
+* migration is judged by its last definition.
 */
 function pd062(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
@@ -1787,8 +2082,8 @@ function pd062(cwd, config, files = nodeFiles) {
 	});
 }
 /**
-* PD063: a migration statement supautils rejects for `postgres`, so
-* `supabase db push` fails on it.
+* PD063: a migration statement supautils rejects for `postgres`, so `supabase
+* db push` fails on it.
 */
 function pd063(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
@@ -1846,9 +2141,9 @@ function pd066(cwd, config, files = nodeFiles) {
 //#endregion
 //#region src/cli/doctor/suspension.ts
 /**
-* PD061: a suspended scope keeps permissions. Each scope's kept keys are
-* listed for review, since its members hold them while the instance is
-* suspended, and a key the definitions do not declare is named apart.
+* PD061: a suspended scope keeps permissions. Each scope's kept keys are listed
+* for review, since its members hold them while the instance is suspended, and
+* a key the definitions do not declare is named apart.
 */
 async function pd061(input) {
 	const suspension = input.config.rls?.suspension;
@@ -2078,6 +2373,31 @@ const DOCTOR_CHECKS = [
 		groups: ["rls"],
 		run: pd071
 	},
+	{
+		code: "PD072",
+		groups: ["rls"],
+		run: pd072
+	},
+	{
+		code: "PD073",
+		groups: ["rls", "ownership"],
+		run: pd073
+	},
+	{
+		code: "PD075",
+		groups: ["rls"],
+		run: pd075
+	},
+	{
+		code: "PD076",
+		groups: ["rls"],
+		run: pd076
+	},
+	{
+		code: "PD077",
+		groups: ["rls", "scopes"],
+		run: pd077
+	},
 	{
 		code: "PD028",
 		groups: ["attrs", "supabase"],
@@ -2181,6 +2501,12 @@ const DOCTOR_CHECKS = [
 		groups: ["supabase"],
 		run: (project) => pd045(project.cwd)
 	},
+	{
+		code: "PD074",
+		groups: ["supabase", "helpers"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: (project) => pd074(project.cwd, project.config)
+	},
 	...[
 		["PD046", pd046],
 		["PD047", pd047],
@@ -2295,7 +2621,10 @@ async function runDoctor(input) {
 		}))
 	};
 }
-/** PD059: the configured policy module throws or exports no policy, so every policy check is skipped. */
+/**
+* PD059: the configured policy module throws or exports no policy, so every
+* policy check is skipped.
+*/
 async function pd059(project) {
 	const load = await project.policyLoad();
 	if (load.status !== "failed") return [];
@@ -2306,7 +2635,10 @@ async function pd059(project) {
 		fix: "fix the module so it exports policy from definePolicy, or point policy in permdock.config.ts at the module that does"
 	}];
 }
-/** PD060: a source file under srcPath has a syntax error, so collect and usage miss what it references. */
+/**
+* PD060: a source file under srcPath has a syntax error, so collect and usage
+* miss what it references.
+*/
 async function pd060(project) {
 	return ((await project.collected()).scan?.unparsed ?? []).map((item) => ({
 		code: "PD060",
@@ -2315,7 +2647,10 @@ async function pd060(project) {
 		fix: "fix the syntax error, or exclude the file from collect.srcPath"
 	}));
 }
-/** A usage message for the first `--only` value that names no check code or group. */
+/**
+* A usage message for the first `--only` value that names no check code or
+* group.
+*/
 function unknownOnly(wanted) {
 	const known = /* @__PURE__ */ new Set();
 	for (const check of DOCTOR_CHECKS) {
@@ -2333,15 +2668,24 @@ function formatDoctor(report, color) {
 	for (const change of report.fixed) lines.push(`  ${style.okMark} fixed ${change}`);
 	if (report.fixed.length > 0) lines.push("");
 	for (const finding of report.findings) {
-		const mark = finding.severity === "error" ? style.errorMark : style.warnMark;
+		const mark = markOf(finding.severity, style);
 		lines.push(`  ${mark} ${style.paint("bold", finding.code)}  ${finding.message}`);
 		lines.push(`           ${style.paint("dim", `fix: ${finding.fix}`)}`);
 	}
 	if (report.findings.length === 0) lines.push("  no findings");
 	lines.push("");
-	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}`);
+	const notes = report.findings.filter((finding) => finding.severity === "info").length;
+	lines.push(`  ${String(report.errors)} error${report.errors === 1 ? "" : "s"}, ${String(report.warnings)} warning${report.warnings === 1 ? "" : "s"}${notes === 0 ? "" : `, ${String(notes)} note${notes === 1 ? "" : "s"}`}`);
 	return `${lines.join("\n")}\n`;
 }
+function markOf(severity, style) {
+	switch (severity) {
+		case "error": return style.errorMark;
+		case "warning": return style.warnMark;
+		case "info": return style.infoMark;
+		default: return severity;
+	}
+}
 async function supabaseSetup(input) {
 	const policy = await input.policy();
 	if (policy === void 0) return [];