permdock 0.7.0 → 0.9.0

package/dist/{doctor-BU1szn63.js → doctor-ClRVAtXQ.js}

@@ -1,43 +1,45 @@
-import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
-import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
+import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { l as separationConflicts } from "./policy-DaJy4nK4.js";
-import { T as validateCustomRole } from "./evaluate-B_oqFbWC.js";
-import { s as parseCredential } from "./credential-CIM7wHwA.js";
-import { a as describeError } from "./errors-DpP_U6Bf.js";
-import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
-import { r as runCollect } from "./collect-BaWeMjwV.js";
+import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { u as separationConflicts } from "./policy-CLQ8__GF.js";
+import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
+import { s as parseCredential } from "./credential-CyyyvCsL.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
+import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-B96movIM.js";
-import { i as scopeMembershipTable } from "./compile-BAEO5bOk.js";
-import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-B-zYB4GS.js";
-import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
-import "./markers-C6joDI3o.js";
-import { t as didYouMean } from "./args-CC3OwyHW.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
-import { t as createStyle } from "./style-Cqo7-73x.js";
-import { r as findingOf } from "./output-DgSDLrta.js";
-import { i as runSkillsInstall } from "./skills-Dcjw9_1C.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
+import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-CMAM-2A3.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import "./markers-BeHZ4x9Q.js";
+import { t as didYouMean } from "./args-0FrVs5EH.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { t as createStyle } from "./style-Ds11Hmk4.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-DV5dwOTs.js";
+import { i as runSkillsInstall } from "./skills-CQQcuGBi.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { l as partPath } from "./output-files-CCMdcFWb.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-Dg0SrQWR.js";
-import { D as byKey, U as graphSqlName, o as guardedTables, r as unsatisfiedKinds, t as ownershipRules, z as contextRefs } from "./ownership-Z2LpxsGa.js";
+import { l as partPath } from "./output-files-BIQ_9pIs.js";
+import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-CrgU06WH.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BqrxBCir.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-DRo2QM6E.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-Bybmck7f.js";
-import { _ as helperTablePolicies, b as compileGrants, d as tableNames, i as graphPlan, m as ROW_CONDITION_FIX, u as tableNameOf, v as rowConditionMessage, x as tableFor, y as commandFor } from "./verify-pe8rL_Qw.js";
-import { t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-53ryOZip.js";
-import { a as generateOptions, c as buildContext, n as inheritTargets, o as isRefusal, t as supautilsRejections } from "./supautils-MESd81bF.js";
-import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-Wj6dkyDE.js";
+import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
+import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-B9EtHWLa.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DlUcTDBz.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CJrT1DSc.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-ByezN3b8.js";
+import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -171,7 +173,10 @@ function membershipsFixture(input) {
 //#endregion
 //#region src/cli/doctor/assignments.ts
 const TRIGGER = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?trigger\s+"?permdock_assignment"?\s[\s\S]*?\bon\s+((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`, "iu");
-/** The tables a `permdock_assignment` trigger is created on in the migrations and the `rls generate` output. */
+/**
+* The tables a `permdock_assignment` trigger is created on in the migrations
+* and the `rls generate` output.
+*/
 function triggeredTables(input) {
 	const out = input.config.rls?.out ?? "rls.sql";
 	const files = sqlFiles(input.cwd, [...input.config.doctor?.migrations ?? MIGRATION_DIRS, ...new Set([
@@ -187,10 +192,10 @@ function triggeredTables(input) {
 	return tables;
 }
 /**
-* PD064: `rls.assignments` guards a table (a membership table, the
-* global-roles table or a listed table) that no `permdock_assignment`
-* trigger is created on in the migrations or the `rls generate` output, so a
-* client may write any role there.
+* PD064: `rls.assignments` guards a table (a membership table, the global-roles
+* table or a listed table) that no `permdock_assignment` trigger is created on
+* in the migrations or the `rls generate` output, so a client may write any
+* role there.
 */
 async function pd064(input) {
 	if (input.config.rls?.assignments === void 0) return [];
@@ -209,8 +214,8 @@ async function pd064(input) {
 //#endregion
 //#region src/cli/doctor/catalog.ts
 /**
-* A policy that declares `oauthScopes` against a catalog on disk without
-* them, or with another set. `authorizationProvider` builds better-supabase's
+* A policy that declares `oauthScopes` against a catalog on disk without them,
+* or with another set. `authorizationProvider` builds better-supabase's
 * `delegation.scopes` from the catalog, so its SQL checks deny a token that
 * holds only the coarse scope.
 */
@@ -291,6 +296,72 @@ async function pd067(input) {
 	}]));
 }
 //#endregion
+//#region src/cli/doctor/config-names.ts
+const PLACEHOLDER = /\{([^{}]*)\}/gu;
+/** The scope aliases `ScopeNames` admits next to the declared names. */
+const ALIASES = ["tenant", "team"];
+function keysOf(record) {
+	return record === void 0 ? [] : Object.keys(record);
+}
+function named(where, kind, names) {
+	return names.map((name) => ({
+		where,
+		kind,
+		name
+	}));
+}
+function namedIn(config) {
+	const rls = config.rls;
+	return [
+		...named("rls.tables", "resource", keysOf(rls?.tables)),
+		...named("rls.scopeTypes", "scope", keysOf(rls?.scopeTypes)),
+		...named("rls.actions", "action", keysOf(rls?.actions)),
+		...named("rls.memberships.scopes", "scope", keysOf(rls?.memberships?.scopes)),
+		...named("rls.suspension.scopes", "scope", keysOf(rls?.suspension?.scopes)),
+		...Object.keys(rls?.realtime?.topics ?? {}).flatMap((pattern) => named(`rls.realtime.topics['${pattern}']`, "scope", [...pattern.matchAll(PLACEHOLDER)].map((match) => match[1] ?? ""))),
+		...Object.entries(rls?.storage?.buckets ?? {}).flatMap(([name, bucket]) => named(`rls.storage.buckets.${name}.scope`, "scope", [bucket.scope])),
+		...named("powersync.resources", "resource", config.powersync?.resources ?? []),
+		...named("powersync.action", "action", config.powersync?.action === void 0 ? [] : [config.powersync.action])
+	];
+}
+/**
+* PD077: a config key or value names a scope, resource or action the policy
+* does not declare, such as a Realtime topic `{organisation}` placeholder for
+* the scope `organization`. `defineConfig` with the policy value reports the
+* same names at compile time. Also a SQL helper name `resolveNames` rejects:
+* two sources sharing one, or one Postgres cannot hold.
+*/
+async function pd077(input) {
+	if (input.config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	const leaves = listPermissions(policy.vocabulary.permissions);
+	const declared = {
+		scope: /* @__PURE__ */ new Set([...policy.scopes.map((scope) => scope.name), ...ALIASES]),
+		resource: new Set(leaves.map((leaf) => leaf.resource)),
+		action: new Set(leaves.map((leaf) => leaf.action))
+	};
+	return [...namedIn(input.config).filter((entry) => !declared[entry.kind].has(entry.name)).map((entry) => ({
+		code: "PD077",
+		severity: "error",
+		message: `${entry.where} names the ${entry.kind} '${entry.name}', which the policy does not declare`,
+		fix: `use one of ${[...declared[entry.kind]].toSorted().join(", ")}, or pass the policy value to defineConfig to catch this at compile time`
+	})), ...helperNames(policy, input.config)];
+}
+function helperNames(policy, config) {
+	try {
+		resolveNames(policy, config);
+		return [];
+	} catch (cause) {
+		return [{
+			code: "PD077",
+			severity: "error",
+			message: describeError(cause).replace(/^PermDock CLI: /u, ""),
+			fix: "rename the scope or resource so each generated SQL helper has its own name of at most 63 bytes"
+		}];
+	}
+}
+//#endregion
 //#region src/cli/doctor/declarative.ts
 const SCHEMAS = "supabase/schemas";
 const MIGRATIONS = "supabase/migrations";
@@ -302,7 +373,10 @@ const CALLS_HELPER = /\b(?:permdock_has|(?:permitted|member)_[a-z][a-z0-9_]*_ids
 function uncommented(text) {
 	return text.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 }
-/** Whether `text` starts with a line `rls generate` or `supabase hook generate` writes. */
+/**
+* Whether `text` starts with a line `rls generate` or `supabase hook generate`
+* writes.
+*/
 function generatedByPermDock(text) {
 	return text.startsWith("-- permdock:") || text.startsWith("-- generated by permdock");
 }
@@ -310,9 +384,9 @@ function generatedByPermDock(text) {
 * PD042: under migra, a hook declared under `supabase/schemas` reaches the
 * database through `supabase db diff`, which drops its `supabase_auth_admin`
 * grants. pg-delta keeps them, so the check runs only for `migra`. A function
-* created (or dropped and created again) without them is executable by
-* `public` and not by the auth server, so a migration at or after the one
-* that creates it must carry the grants.
+* created (or dropped and created again) without them is executable by `public`
+* and not by the auth server, so a migration at or after the one that creates
+* it must carry the grants.
 */
 function pd042(cwd, config, files = nodeFiles) {
 	if (config.supabase?.hook === void 0 || resolveSchemas(cwd, config).mode !== "migra") return [];
@@ -340,10 +414,10 @@ function generatedSchemaFiles(cwd, schemaDir, files) {
 }
 /**
 * PD068: PermDock generates for pg-delta (the default), but
-* `supabase/config.toml` does not set `[experimental.pgdelta] enabled =
-* true`, so Supabase CLI 2.x diffs the schema files with migra. migra drops
-* the hook's `supabase_auth_admin` grants and the helpers' privileges, and
-* PermDock wrote no `--grants-out` file to restore them.
+* `supabase/config.toml` does not set `[experimental.pgdelta] enabled = true`,
+* so Supabase CLI 2.x diffs the schema files with migra. migra drops the hook's
+* `supabase_auth_admin` grants and the helpers' privileges, and PermDock wrote
+* no `--grants-out` file to restore them.
 */
 function pd068(cwd, config, files = nodeFiles) {
 	const read = readSupabaseConfig(cwd);
@@ -362,8 +436,8 @@ function pd068(cwd, config, files = nodeFiles) {
 /**
 * PD069: leftovers of declarative schemas on migra in a pg-delta project:
 * `[db.migrations] schema_paths`, which pg-delta's dependency order makes
-* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate
-* the per-schema layout `rls generate --split` now writes.
+* unnecessary, and numbered `NNN_permdock_<part>.sql` files that duplicate the
+* per-schema layout `rls generate --split` now writes.
 */
 function pd069(cwd, config, files = nodeFiles) {
 	const schemas = resolveSchemas(cwd, config);
@@ -383,20 +457,26 @@ function pd069(cwd, config, files = nodeFiles) {
 	});
 	return findings;
 }
-/** The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or Supabase's default. */
+/**
+* The `[db.migrations] schema_paths` globs of `supabase/config.toml`, or
+* Supabase's default.
+*/
 function schemaPaths(cwd) {
 	const paths = supabaseConfig(cwd).schemaPaths ?? [];
 	return paths.length === 0 ? ["./schemas/**/*.sql"] : paths;
 }
-/** Schema files in the order `supabase db diff` applies them: each glob in turn, sorted within it. */
+/**
+* Schema files in the order `supabase db diff` applies them: each glob in turn,
+* sorted within it.
+*/
 function orderedSchemaFiles(cwd) {
 	return sqlFiles(join(cwd, "supabase"), schemaPaths(cwd), { order: "entry" });
 }
 /**
-* PD043: under migra, `db diff` applies schema files in `schema_paths`
-* order, so a policy that calls `permdock_has` or `permitted_<scope>_ids`
-* before the file that defines them fails to apply. pg-delta orders by
-* dependencies instead.
+* PD043: under migra, `db diff` applies schema files in `schema_paths` order,
+* so a policy that calls `permdock_has` or `permitted_<scope>_ids` before the
+* file that defines them fails to apply. pg-delta orders by dependencies
+* instead.
 */
 function pd043(cwd, config, files = nodeFiles) {
 	if (resolveSchemas(cwd, config).mode !== "migra") return [];
@@ -477,7 +557,7 @@ async function pd018(input) {
 	for (const conflict of separationConflicts(policy, record.memberships ?? [])) findings.push({
 		code: "PD018",
 		severity: "warning",
-		message: `membership ${conflict.principal || "unknown"} holds exclusive roles ${conflict.roles.join(" and ")}`,
+		message: `membership ${nonEmptyOr(conflict.principal, "unknown")} holds exclusive roles ${conflict.roles.join(" and ")}`,
 		fix: "remove one of the exclusive roles from the membership fixture"
 	});
 	return findings;
@@ -512,9 +592,9 @@ async function pd023(input) {
 	return findings;
 }
 /**
-* PD055: a stored custom role names a permission by a key it was renamed
-* from. It still resolves; the alias can only be dropped once storage holds
-* the current key.
+* PD055: a stored custom role names a permission by a key it was renamed from.
+* It still resolves; the alias can only be dropped once storage holds the
+* current key.
 */
 async function pd055(input) {
 	const files = filesOf(input);
@@ -540,7 +620,10 @@ async function pd055(input) {
 	});
 	return findings;
 }
-/** Fixture API keys that never expire, credential policies that allow it, and records that are not v1 credentials. */
+/**
+* Fixture API keys that never expire, credential policies that allow it, and
+* records that are not v1 credentials.
+*/
 function pd029(input) {
 	const parsed = readFixture(input, input.config.doctor?.credentials);
 	const findings = [];
@@ -606,7 +689,10 @@ const ROUTE_GLOBS = ["**/api/permdock/route.{ts,tsx,js,jsx,mjs}"];
 const ENDPOINT = /\bendpoint\s*(?::|=)\s*\{?\s*['"`]/u;
 const NATIVE_IMPORT = /\bfrom\s*['"]permdock\/react-native['"]/u;
 const CLIENT_READS = /* @__PURE__ */ new Set(["usePermission", "reference"]);
-/** A grant the snapshot marks `portable: false`, so a client check needs the endpoint. */
+/**
+* A grant the snapshot marks `portable: false`, so a client check needs the
+* endpoint.
+*/
 function serverOnly(policy, grant) {
 	if (!grant.portable || hasConditionOp(grant.where, "related")) return true;
 	const relations = policy.resources.get(grant.permission.resource)?.relations;
@@ -621,7 +707,10 @@ function serverOnlyKeys(policy) {
 	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grant.effect === "allow" && serverOnly(policy, grant)) keys.add(grant.permission.key);
 	return keys;
 }
-/** An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result, or an `endpoint` string in the source. */
+/**
+* An `app/**\/api/permdock/route.ts` that exports `permdockHandler`'s result,
+* or an `endpoint` string in the source.
+*/
 function hasEndpoint(files, cwd, sources) {
 	if (listSourceFiles(cwd, ROUTE_GLOBS).filter((file) => /(?:^|[\\/])app[\\/]/u.test(rel(cwd, file))).some((file) => files.read(file).includes("permdockHandler"))) return true;
 	return sources.some((file) => ENDPOINT.test(files.read(file)));
@@ -753,11 +842,14 @@ async function pd019(input) {
 		fix: "set rls.authorize: 'database', or lower [auth] jwt_expiry in supabase/config.toml to 3600 or less"
 	}];
 }
-/** Fixture memberships the policy's scopes would drop: an undeclared scope, a missing parent id, mixed shapes. */
 /**
-* A scope whose roles can all be removed can end up with nobody able to
-* manage it. Setting `min` on any of its roles (even `min: 0`) records the
-* decision and silences the warning.
+* Fixture memberships the policy's scopes would drop: an undeclared scope, a
+* missing parent id, mixed shapes.
+*/
+/**
+* A scope whose roles can all be removed can end up with nobody able to manage
+* it. Setting `min` on any of its roles (even `min: 0`) records the decision
+* and silences the warning.
 */
 async function pd026(input) {
 	if (input.config.policy === void 0) return [];
@@ -833,7 +925,10 @@ async function pd035(input) {
 }
 //#endregion
 //#region src/cli/doctor/powersync.ts
-/** Why each membership source of a scope the streams read through sources has no stream form, once per source. */
+/**
+* Why each membership source of a scope the streams read through sources has no
+* stream form, once per source.
+*/
 function sourceGaps(policy, config) {
 	const scopes = scopeList(policy.scopes);
 	const sources = membershipSourcesOf(config);
@@ -849,10 +944,10 @@ function sourceGaps(policy, config) {
 }
 /**
 * PD058: `sync-config.yaml` or the `powersync.manifest` file is not what the
-* policy compiles to, so PowerSync syncs rows, or the device builds
-* snapshots, by an older policy. A policy that does not compile is a finding
-* too, and so is each membership source of a synced scope with no stream
-* form: its members sync none of the rows it grants.
+* policy compiles to, so PowerSync syncs rows, or the device builds snapshots,
+* by an older policy. A policy that does not compile is a finding too, and so
+* is each membership source of a synced scope with no stream form: its members
+* sync none of the rows it grants.
 */
 async function pd058(input) {
 	const { cwd, config } = input;
@@ -912,7 +1007,10 @@ function isWorkspaceRoot(files, dir) {
 		return false;
 	}
 }
-/** Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's naming the `permdock` skill. */
+/**
+* Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's
+* naming the `permdock` skill.
+*/
 function hasSkillsLock(files, dir) {
 	if (files.exists(join(dir, ".permdock/skills-lock.json"))) return true;
 	const shared = join(dir, "skills-lock.json");
@@ -1017,10 +1115,10 @@ const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${V
 const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
 const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
 /**
-* Views run as their owner unless `security_invoker` is set, so they read
-* past RLS on the tables beneath them. The `<table>_visible_fields`
-* companion `rls generate --revoke-columns` writes reads as its owner on
-* purpose and carries a comment that says so.
+* Views run as their owner unless `security_invoker` is set, so they read past
+* RLS on the tables beneath them. The `<table>_visible_fields` companion `rls
+* generate --revoke-columns` writes reads as its owner on purpose and carries a
+* comment that says so.
 */
 function pd022(cwd, config, files = nodeFiles) {
 	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
@@ -1048,9 +1146,9 @@ function pd022(cwd, config, files = nodeFiles) {
 }
 const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
 /**
-* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
-* names its Postgres roles with `to authenticated` instead, and the role
-* claim it reads is the one PostgREST already switched to.
+* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy names
+* its Postgres roles with `to authenticated` instead, and the role claim it
+* reads is the one PostgREST already switched to.
 */
 function pd040(cwd, config, files = nodeFiles) {
 	const findings = [];
@@ -1087,10 +1185,10 @@ function applyPrivilege(writable, verb, part) {
 const CREATE_TABLE$1 = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
 const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
 /**
-* Columns of `table` a client role may insert or update, per the migrations
-* in order; `*` for every column. On Supabase a table created in `public`
-* starts writable: the default privileges grant `anon` and `authenticated`
-* everything, until a migration revokes them.
+* Columns of `table` a client role may insert or update, per the migrations in
+* order; `*` for every column. On Supabase a table created in `public` starts
+* writable: the default privileges grant `anon` and `authenticated` everything,
+* until a migration revokes them.
 */
 function clientWritable(files, cwd, config, target) {
 	const writable = {
@@ -1119,7 +1217,10 @@ function clientWritable(files, cwd, config, target) {
 	}
 	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
 }
-/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
+/**
+* Membership columns a client can write: a user who sets `user_id` or `role`
+* grants themselves access.
+*/
 function membershipFindings(files, cwd, config) {
 	const findings = [];
 	for (const [table, columns] of membershipColumns(config)) {
@@ -1227,7 +1328,10 @@ async function pd020(input) {
 		fix: "remove them from hostable, or drop their tables from rls.tables and enforce them in the application"
 	}];
 }
-/** Columns of `resource` a field-limited read grant can hide: missing from an allow's list, or on a deny's. */
+/**
+* Columns of `resource` a field-limited read grant can hide: missing from an
+* allow's list, or on a deny's.
+*/
 function limitedColumns(policy, resource, actions) {
 	const reads = policy.grants.filter((grant) => grant.permission.resource === resource && grant.fields !== void 0 && commandFor(grant.permission.action, actions) === "select");
 	const node = policy.resources.get(resource);
@@ -1239,8 +1343,8 @@ function limitedColumns(policy, resource, actions) {
 }
 /**
 * `fields` redact in the application; RLS is row-level unless field views
-* compile, and a field view protects nothing while the base table still
-* returns the columns to a direct read.
+* compile, and a field view protects nothing while the base table still returns
+* the columns to a direct read.
 */
 async function pd030(input) {
 	const rls = input.config.rls;
@@ -1272,9 +1376,9 @@ async function pd030(input) {
 	return findings;
 }
 /**
-* A self-parented resource no `through` grant walks, or a `restricted`
-* column no graph grant reaches: the declaration has no effect on any
-* decision, and `rls generate` keeps no closure for it.
+* A self-parented resource no `through` grant walks, or a `restricted` column
+* no graph grant reaches: the declaration has no effect on any decision, and
+* `rls generate` keeps no closure for it.
 */
 async function pd031(input) {
 	if (input.config.policy === void 0) return [];
@@ -1302,8 +1406,8 @@ async function pd031(input) {
 }
 /**
 * Under an `rls` config, a graph resource `rls generate` cannot name a helper
-* for: one that shares a scope's name (its `permitted_<name>_ids` would
-* replace the scope helper) or is not a lowercase SQL name.
+* for: one that shares a scope's name (its `permitted_<name>_ids` would replace
+* the scope helper) or is not a lowercase SQL name.
 */
 async function pd032(input) {
 	if (input.config.rls === void 0 || input.config.policy === void 0) return [];
@@ -1359,10 +1463,10 @@ async function pd034(input) {
 	}));
 }
 /**
-* PD076: `rls.actions` entries set to `'none'` that change nothing: a verb
-* that is not one of the six default verbs and does not read as a write
-* compiles to no policy anyway, and a verb no permission uses compiles to
-* nothing at all. A write-sounding `none` stays, because it silences PD071.
+* PD076: `rls.actions` entries set to `'none'` that change nothing: a verb that
+* is not one of the six default verbs and does not read as a write compiles to
+* no policy anyway, and a verb no permission uses compiles to nothing at all. A
+* write-sounding `none` stays, because it silences PD071.
 */
 async function pd076(input) {
 	const actions = input.config.rls?.actions;
@@ -1385,8 +1489,9 @@ async function pd076(input) {
 	}]];
 }
 /**
-* Storage and Realtime policies written outside PermDock that call the SQL helpers for a permission whose grants
-* carry row conditions: the helpers check only role and scope.
+* Storage and Realtime policies written outside PermDock that call the SQL
+* helpers for a permission whose grants carry row conditions: the helpers check
+* only role and scope.
 */
 async function pd037(input) {
 	const files = filesOf(input);
@@ -1423,7 +1528,10 @@ const WRITE_VERB_PREFIXES = [
 	"confirm",
 	"pause"
 ];
-/** `verb` starts with a write prefix that ends at a word boundary: `markPaid`, not `market`. */
+/**
+* `verb` starts with a write prefix that ends at a word boundary: `markPaid`,
+* not `market`.
+*/
 function suggestsWrite(verb) {
 	return WRITE_VERB_PREFIXES.some((prefix) => {
 		if (!verb.startsWith(prefix)) return false;
@@ -1449,8 +1557,8 @@ async function pd071(input) {
 	}));
 }
 /**
-* PD072: a membership source reads role keys through the table of custom
-* roles (`rls.customRoleWrites.roles`), which tenants write.
+* PD072: a membership source reads role keys through the table of custom roles
+* (`rls.customRoleWrites.roles`), which tenants write.
 */
 function pd072(input) {
 	const roles = input.config.rls?.customRoleWrites?.roles;
@@ -1524,14 +1632,20 @@ const SEED_FUNCTION = /^create\s+(?:or\s+replace\s+)?function\s+(?:"[^"]+"|\w+)\
 function rowKey(values) {
 	return values.join(" ");
 }
-/** The statements of a file, with the body of `<schema>.seed()` (`rls.seeds: 'function'`) in place of its `create function`. */
+/**
+* The statements of a file, with the body of `<schema>.seed()` (`rls.seeds:
+* 'function'`) in place of its `create function`.
+*/
 function seedStatements(sql) {
 	return sqlStatements(sql).flatMap((statement) => {
 		const fn = SEED_FUNCTION.exec(statement.text);
 		return fn === null ? [statement] : sqlStatements(group(fn, 2));
 	});
 }
-/** The rows of the last statement that seeds or clears `table`, in migration order. */
+/**
+* The rows of the last statement that seeds or clears `table`, in migration
+* order.
+*/
 function lastSeed(files, cwd, config, table) {
 	let seeded;
 	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of seedStatements(files.read(file))) {
@@ -1558,8 +1672,8 @@ function sample(rows) {
 	return rows.slice(0, 3).map((row) => `(${row})`).join(", ");
 }
 /**
-* PD054: the `role_permissions` rows the migrations seed last are not the
-* rows the policy compiles to, so the helpers answer from a stale policy.
+* PD054: the `role_permissions` rows the migrations seed last are not the rows
+* the policy compiles to, so the helpers answer from a stale policy.
 */
 async function pd054(input) {
 	const { cwd, config } = input;
@@ -1649,7 +1763,10 @@ function pd046(cwd, config, files = nodeFiles) {
 	}];
 }
 const USER_METADATA = /\b(raw_user_meta_data|user_metadata)\b/giu;
-/** PD047: SQL that reads `user_metadata`, which every user can edit for themselves. */
+/**
+* PD047: SQL that reads `user_metadata`, which every user can edit for
+* themselves.
+*/
 function pd047(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => [...statement.text.matchAll(USER_METADATA)].map((match) => ({
@@ -1673,7 +1790,10 @@ function createdFunctions(statements) {
 		}];
 	});
 }
-/** PD048: a function without `set search_path`, so a caller's objects can shadow the ones it names. */
+/**
+* PD048: a function without `set search_path`, so a caller's objects can shadow
+* the ones it names.
+*/
 function pd048(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const statements = migrationStatements(files, cwd, config);
@@ -1691,7 +1811,10 @@ function pd048(cwd, config, files = nodeFiles) {
 		};
 	});
 }
-/** Roles each `revoke` statement takes `execute` from, per function key or `schema.*`. */
+/**
+* Roles each `revoke` statement takes `execute` from, per function key or
+* `schema.*`.
+*/
 function revokedExecute(statements) {
 	const revoked = /* @__PURE__ */ new Map();
 	const add = (key, roles) => {
@@ -1713,7 +1836,10 @@ function revokedExecute(statements) {
 	}
 	return revoked;
 }
-/** `supabase.hook.claims` and `hook.before` functions, by key, with the argument type the hook calls them with. */
+/**
+* `supabase.hook.claims` and `hook.before` functions, by key, with the argument
+* type the hook calls them with.
+*/
 function hookClaimFunctions(config) {
 	const hook = config.supabase?.hook;
 	const before = hook?.before;
@@ -1725,9 +1851,9 @@ function hookClaimFunctions(config) {
 /**
 * PD049: a `security definer` function `public` (every role) or, in Supabase's
 * `public` schema, `anon` may still execute: Postgres grants `execute` to
-* `public` on create, and Supabase's default privileges grant it to `anon`.
-* A hook claim function returns any user's claims, so `authenticated` must
-* not execute it either, definer or not.
+* `public` on create, and Supabase's default privileges grant it to `anon`. A
+* hook claim function returns any user's claims, so `authenticated` must not
+* execute it either, definer or not.
 */
 function pd049(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
@@ -1770,7 +1896,10 @@ function pd049(cwd, config, files = nodeFiles) {
 const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}\s*\(`, "iu");
 const ENABLE_RLS = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}[\s\S]*\benable\s+row\s+level\s+security\b`, "iu");
 const DROP_TABLE = /^drop\s+table\s+(?:if\s+exists\s+)?([\s\S]+?)(?:\s+(?:cascade|restrict))?$/iu;
-/** PD050: a `public` table without row level security, which the Data API serves whole. */
+/**
+* PD050: a `public` table without row level security, which the Data API serves
+* whole.
+*/
 function pd050(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const created = /* @__PURE__ */ new Map();
@@ -1798,7 +1927,10 @@ function pd050(cwd, config, files = nodeFiles) {
 }
 const CREATE_POLICY = new RegExp(String.raw`^create\s+policy\s+${IDENT}\s+on\s+${NAME}([\s\S]*)$`, "iu");
 const UNWRAPPED_AUTH = /(?<!\bselect\s{1,20})\bauth\.(uid|jwt)\s*\(\s*\)/giu;
-/** PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres runs it once per row. */
+/**
+* PD051: a policy that calls `auth.uid()` or `auth.jwt()` bare, so Postgres
+* runs it once per row.
+*/
 function pd051(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => {
@@ -1814,7 +1946,10 @@ function pd051(cwd, config, files = nodeFiles) {
 		}];
 	});
 }
-/** PD052: an update policy without `with check`, so nothing states what a row may become. */
+/**
+* PD052: an update policy without `with check`, so nothing states what a row
+* may become.
+*/
 function pd052(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	return migrationStatements(files, cwd, config).flatMap((statement) => {
@@ -1847,9 +1982,9 @@ function topLevelParts(body) {
 	return parts.filter((part) => part !== "");
 }
 /**
-* One column definition or table constraint of a `create table` body: its
-* first column, whether it is a foreign key, and whether a primary key or
-* unique constraint indexes that column.
+* One column definition or table constraint of a `create table` body: its first
+* column, whether it is a foreign key, and whether a primary key or unique
+* constraint indexes that column.
 */
 function tablePart(raw) {
 	const part = raw.replace(/^constraint\s+(?:"[^"]+"|\w+)\s+/iu, "");
@@ -1873,7 +2008,10 @@ function firstColumn(list) {
 }
 const ADD_CONSTRAINT = new RegExp(String.raw`^alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?${NAME}\s+add\s+(?:constraint\s+${IDENT}\s+)?(foreign\s+key|primary\s+key|unique)\s*\(([^)]*)\)`, "iu");
 const CREATE_INDEX = new RegExp(String.raw`^create\s+(?:unique\s+)?index\s+(?:concurrently\s+)?(?:if\s+not\s+exists\s+)?(?:${IDENT}\s+)?on\s+(?:only\s+)?${NAME}\s*(?:using\s+\w+\s*)?\(\s*${IDENT}`, "iu");
-/** PD053: a foreign key no index starts with, so joins and deletes on the referenced row scan the table. */
+/**
+* PD053: a foreign key no index starts with, so joins and deletes on the
+* referenced row scan the table.
+*/
 function pd053(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
 	const keys = [];
@@ -1922,10 +2060,10 @@ function at(statement) {
 	return `${statement.file}:${String(statement.line)}`;
 }
 /**
-* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>`
-* setting. Current PostgREST, `withPostgresClient`, PermDock's `withSubject`
-* and `rls verify` set only `request.jwt.claims`. A function replaced by a
-* later migration is judged by its last definition.
+* PD062: SQL that reads or sets a per-claim `request.jwt.claim.<name>` setting.
+* Current PostgREST, `withPostgresClient`, PermDock's `withSubject` and `rls
+* verify` set only `request.jwt.claims`. A function replaced by a later
+* migration is judged by its last definition.
 */
 function pd062(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
@@ -1944,8 +2082,8 @@ function pd062(cwd, config, files = nodeFiles) {
 	});
 }
 /**
-* PD063: a migration statement supautils rejects for `postgres`, so
-* `supabase db push` fails on it.
+* PD063: a migration statement supautils rejects for `postgres`, so `supabase
+* db push` fails on it.
 */
 function pd063(cwd, config, files = nodeFiles) {
 	if (!isSupabase(files, cwd, config)) return [];
@@ -2003,9 +2141,9 @@ function pd066(cwd, config, files = nodeFiles) {
 //#endregion
 //#region src/cli/doctor/suspension.ts
 /**
-* PD061: a suspended scope keeps permissions. Each scope's kept keys are
-* listed for review, since its members hold them while the instance is
-* suspended, and a key the definitions do not declare is named apart.
+* PD061: a suspended scope keeps permissions. Each scope's kept keys are listed
+* for review, since its members hold them while the instance is suspended, and
+* a key the definitions do not declare is named apart.
 */
 async function pd061(input) {
 	const suspension = input.config.rls?.suspension;
@@ -2255,6 +2393,11 @@ const DOCTOR_CHECKS = [
 		groups: ["rls"],
 		run: pd076
 	},
+	{
+		code: "PD077",
+		groups: ["rls", "scopes"],
+		run: pd077
+	},
 	{
 		code: "PD028",
 		groups: ["attrs", "supabase"],
@@ -2478,7 +2621,10 @@ async function runDoctor(input) {
 		}))
 	};
 }
-/** PD059: the configured policy module throws or exports no policy, so every policy check is skipped. */
+/**
+* PD059: the configured policy module throws or exports no policy, so every
+* policy check is skipped.
+*/
 async function pd059(project) {
 	const load = await project.policyLoad();
 	if (load.status !== "failed") return [];
@@ -2489,7 +2635,10 @@ async function pd059(project) {
 		fix: "fix the module so it exports policy from definePolicy, or point policy in permdock.config.ts at the module that does"
 	}];
 }
-/** PD060: a source file under srcPath has a syntax error, so collect and usage miss what it references. */
+/**
+* PD060: a source file under srcPath has a syntax error, so collect and usage
+* miss what it references.
+*/
 async function pd060(project) {
 	return ((await project.collected()).scan?.unparsed ?? []).map((item) => ({
 		code: "PD060",
@@ -2498,7 +2647,10 @@ async function pd060(project) {
 		fix: "fix the syntax error, or exclude the file from collect.srcPath"
 	}));
 }
-/** A usage message for the first `--only` value that names no check code or group. */
+/**
+* A usage message for the first `--only` value that names no check code or
+* group.
+*/
 function unknownOnly(wanted) {
 	const known = /* @__PURE__ */ new Set();
 	for (const check of DOCTOR_CHECKS) {