permdock 0.0.0 → 0.1.0

package/dist/supabase-hook-D_OqGb_V.js

@@ -0,0 +1,1528 @@
+import { a as resolveScope, c as scopeChain, s as rootScope, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { r as SUPABASE_MANIFEST_SCHEMA } from "./version-CnSh33Fj.js";
+import { i as sqlFiles, r as rel } from "./files-B_wAGYmt.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
+import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
+import { r as scopeColumn } from "./compile-D22iwvuV.js";
+import { o as authorizeSql, r as readMemberships } from "./supabase-DTxGtYdi.js";
+import "./budget-NbEtbJC_.js";
+import { t as AUTHZ_VERSION_TABLE } from "./sources-DVHM3Mwq.js";
+import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
+import { A as memberForSources, E as hasMemberFor, H as scopeTypeOf, I as quoteIdent, L as quoteLiteral, M as memberIdsHelper, R as quoteTable, h as activeRowSql, j as memberForTable, k as memberForHelper, p as globalRoleSource, y as checkSuspension } from "./rls-helpers-BxRuif0l.js";
+import { r as FIELD_VIEWS, t as connectPg, y as roleNames } from "./pg-4GJWDUxG.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { parse } from "smol-toml";
+//#region src/cli/deciding-columns.ts
+/** `schema.table`, unquoted and lower case; `public` when unqualified. */
+function tableKey(name) {
+	const parts = name.split(".").map((part) => part.replaceAll("\"", ""));
+	return (parts.length === 1 ? ["public", ...parts] : parts).join(".").toLowerCase();
+}
+/**
+* The columns of each membership source's table that decide who holds which
+* membership (user, scope, id, `within`, role, `via`, expiry), keyed by
+* {@link tableKey}. A client that can write one can give itself a membership.
+*/
+function membershipColumns(config) {
+	const sources = config.supabase?.hook?.memberships ?? config.rls?.membershipSources ?? [];
+	const byTable = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		const table = tableKey(source.sql.table);
+		const columns = byTable.get(table) ?? /* @__PURE__ */ new Set();
+		for (const column of source.sql.columns) columns.add(column);
+		byTable.set(table, columns);
+	}
+	return byTable;
+}
+/**
+* Every `schema.table.column` a claim or a membership is computed from: the
+* membership columns and the `attrs` table columns. Sorted.
+*/
+function decidingColumns(config, attrs) {
+	const entries = /* @__PURE__ */ new Set();
+	for (const [table, columns] of membershipColumns(config)) for (const column of columns) entries.add(`${table}.${column}`);
+	if (attrs?.table !== void 0) {
+		const table = tableKey(attrs.table);
+		for (const column of attrs.columns) entries.add(`${table}.${column}`);
+	}
+	return [...entries].toSorted();
+}
+//#endregion
+//#region src/cli/sql-statements.ts
+function blankComments(sql) {
+	return sql.replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+}
+/** Split on `;` outside string literals and dollar-quoted bodies. */
+function sqlStatements(sql) {
+	const text = blankComments(sql);
+	const statements = [];
+	const push = (start, end) => {
+		const body = text.slice(start, end);
+		const lead = body.length - body.trimStart().length;
+		const trimmed = body.trim();
+		if (trimmed !== "") statements.push({
+			line: text.slice(0, start + lead).split("\n").length,
+			text: trimmed
+		});
+	};
+	let start = 0;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === "'") {
+			const end = text.indexOf("'", index + 1);
+			index = end === -1 ? text.length : end + 1;
+			continue;
+		}
+		if (char === "$") {
+			const tag = /^\$[A-Za-z_]*\$/u.exec(text.slice(index, index + 64));
+			if (tag !== null) {
+				const end = text.indexOf(tag[0], index + tag[0].length);
+				index = end === -1 ? text.length : end + tag[0].length;
+				continue;
+			}
+		}
+		if (char === ";") {
+			push(start, index);
+			start = index + 1;
+		}
+		index += 1;
+	}
+	push(start, text.length);
+	return statements;
+}
+/** Capture group `index` of a match, or '' when an optional group took no part. */
+function group(match, index) {
+	return match[index] ?? "";
+}
+//#endregion
+//#region src/cli/doctor-project.ts
+function pd005(cwd) {
+	const lockPath = join(cwd, ".permdock/skills-lock.json");
+	if (![
+		join(cwd, ".agents/skills"),
+		join(cwd, ".claude/skills"),
+		join(cwd, ".cursor/skills")
+	].some((folder) => existsSync(join(folder, "permdock/SKILL.md")))) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "Agent Skills are not installed",
+		fix: "pnpm exec permdock skills install"
+	}];
+	if (!existsSync(lockPath)) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "skills lock is missing",
+		fix: "pnpm exec permdock skills install"
+	}];
+	return [];
+}
+function pd006(cwd) {
+	try {
+		const pkg = createRequire(resolve(cwd, "package.json"))("typescript/package.json");
+		const major = Number(pkg.version.split(".")[0]);
+		if (major < 5 || major === 5 && Number(pkg.version.split(".")[1]) < 9) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is below the supported matrix (5.9, 6, 7)`,
+			fix: "upgrade typescript to 5.9 or later"
+		}];
+		if (major > 7) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is not in the supported matrix (5.9, 6, 7)`,
+			fix: "use TypeScript 5.9, 6 or 7"
+		}];
+		return [];
+	} catch {
+		return [{
+			code: "PD006",
+			severity: "error",
+			message: "typescript is not installed",
+			fix: "add typescript 5.9, 6 or 7"
+		}];
+	}
+}
+function pd009(cwd) {
+	const copies = [];
+	function walk(dir, depth) {
+		if (depth > 6 || !existsSync(dir)) return;
+		const pkg = join(dir, "node_modules/permdock/package.json");
+		if (existsSync(pkg)) copies.push(pkg);
+		if (!existsSync(join(dir, "node_modules"))) return;
+		for (const name of readdirSync(join(dir, "node_modules"))) {
+			if (name.startsWith(".")) continue;
+			const nested = join(dir, "node_modules", name);
+			try {
+				if (statSync(nested).isDirectory()) walk(nested, depth + 1);
+			} catch {}
+		}
+	}
+	walk(cwd, 0);
+	if (copies.length > 1) return [{
+		code: "PD009",
+		severity: "error",
+		message: `duplicate permdock copies: ${copies.map((item) => rel(cwd, dirname(item))).join(", ")}`,
+		fix: "dedupe so only one permdock version is installed"
+	}];
+	return [];
+}
+function pd012(cwd, config) {
+	const docs = config.openapi?.doc ?? [];
+	const findings = [];
+	for (const doc of docs) {
+		const abs = resolve(cwd, doc);
+		if (!existsSync(abs)) continue;
+		const text = readFileSync(abs, "utf8");
+		if (text.includes("\"drafts\"") && !text.includes("overlay")) findings.push({
+			code: "PD012",
+			severity: "warning",
+			message: `${doc} carries a draft pin the CLI no longer emits`,
+			fix: "regenerate with permdock openapi"
+		});
+	}
+	return findings;
+}
+const MIGRATION_DIRS = [
+	"supabase/migrations",
+	"supabase/schemas",
+	"migrations",
+	"drizzle",
+	"prisma/migrations",
+	"db/migrations"
+];
+const VIEW_NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
+const CREATE_VIEW = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:temp(?:orary)?\s+)?(?:recursive\s+)?view\s+${VIEW_NAME}([\s\S]*?)\bas\b`, "giu");
+const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${VIEW_NAME}\s+set\s*\(([^)]*)\)`, "giu");
+const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
+const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
+/**
+* Views run as their owner unless `security_invoker` is set, so they read
+* past RLS on the tables beneath them. The `<table>_visible_fields`
+* companion `rls generate --revoke-columns` writes reads as its owner on
+* purpose and carries a comment that says so.
+*/
+function pd022(cwd, config) {
+	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
+	const created = /* @__PURE__ */ new Map();
+	const invoker = /* @__PURE__ */ new Set();
+	const companions = /* @__PURE__ */ new Set();
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const raw = readFileSync(file, "utf8");
+		const text = raw.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+		for (const [, name = "", options = ""] of text.matchAll(CREATE_VIEW)) {
+			const key = tableKey(name);
+			created.set(key, rel(cwd, file));
+			if (INVOKER.test(options)) invoker.add(key);
+			else invoker.delete(key);
+		}
+		for (const [, name = "", options = ""] of text.matchAll(ALTER_VIEW)) if (INVOKER.test(options)) invoker.add(tableKey(name));
+		for (const [, name = ""] of raw.matchAll(COMPANION)) companions.add(tableKey(name));
+	}
+	return [...created].filter(([key]) => !invoker.has(key) && !companions.has(key)).map(([key, file]) => ({
+		code: "PD022",
+		severity: "warning",
+		message: `view ${key} in ${file} is not security_invoker, so it reads past row level security`,
+		fix: `create the view with (security_invoker = true), or alter view ${key} set (security_invoker = true); Postgres 15 or later. For column-level reads, generate field views with permdock rls generate --fields views`
+	}));
+}
+const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
+/**
+* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
+* names its Postgres roles with `to authenticated` instead, and the role
+* claim it reads is the one PostgREST already switched to.
+*/
+function pd040(cwd, config) {
+	const findings = [];
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const text = readFileSync(file, "utf8").replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+		for (const match of text.matchAll(AUTH_ROLE)) {
+			const line = text.slice(0, match.index).split("\n").length;
+			findings.push({
+				code: "PD040",
+				severity: "warning",
+				message: `${rel(cwd, file)}:${String(line)} calls auth.role(), which Supabase deprecated`,
+				fix: "name the roles on the policy (create policy ... to authenticated) and drop the auth.role() = 'authenticated' test; call permdock_has or permitted_<scope>_ids for permissions"
+			});
+		}
+	}
+	return findings;
+}
+const GRANT = /\b(grant|revoke)\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\w."]+)\s+(?:to|from)\s+([\w\s,"]+?)(?:\s+with\s+grant\s+option|\s+cascade|\s+restrict)?\s*;/giu;
+const CLIENT_ROLES = /* @__PURE__ */ new Set([
+	"anon",
+	"authenticated",
+	"public"
+]);
+function applyPrivilege(writable, verb, part) {
+	const match = /^\s*(all(?:\s+privileges)?|insert|update)\s*(?:\(([^)]*)\))?\s*$/iu.exec(part);
+	if (match === null) return;
+	const kind = (match[1] ?? "").toLowerCase();
+	const sets = kind === "insert" ? [writable.insert] : kind === "update" ? [writable.update] : [writable.insert, writable.update];
+	const columns = match[2] === void 0 ? ["*"] : match[2].split(",").map((column) => column.trim().replaceAll("\"", ""));
+	for (const set of sets) for (const column of columns) if (verb.toLowerCase() === "grant") set.add(column);
+	else if (column === "*") set.clear();
+	else set.delete(column);
+}
+const CREATE_TABLE = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
+const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
+/**
+* Columns of `table` a client role may insert or update, per the migrations
+* in order; `*` for every column. On Supabase a table created in `public`
+* starts writable: the default privileges grant `anon` and `authenticated`
+* everything, until a migration revokes them.
+*/
+function clientWritable(cwd, config, target) {
+	const writable = {
+		insert: /* @__PURE__ */ new Set(),
+		update: /* @__PURE__ */ new Set()
+	};
+	let defaults = config.supabase !== void 0 && target.startsWith("public.");
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(readFileSync(file, "utf8"))) {
+		if (REVOKE_DEFAULT_TABLES.test(text)) {
+			defaults = false;
+			continue;
+		}
+		const created = CREATE_TABLE.exec(text);
+		if (created !== null) {
+			if (defaults && tableKey(created[1] ?? "") === target) {
+				writable.insert.add("*");
+				writable.update.add("*");
+			}
+			continue;
+		}
+		for (const [, verb = "", privileges = "", name = "", roles = ""] of `${text};`.matchAll(GRANT)) {
+			if (tableKey(name) !== target) continue;
+			if (!roles.split(",").map((role) => role.trim().replaceAll("\"", "").toLowerCase()).some((role) => CLIENT_ROLES.has(role))) continue;
+			for (const part of privileges.split(/,(?![^(]*\))/u)) applyPrivilege(writable, verb, part);
+		}
+	}
+	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
+}
+/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
+function membershipFindings(cwd, config) {
+	const findings = [];
+	for (const [table, columns] of membershipColumns(config)) {
+		const writable = clientWritable(cwd, config, table);
+		const exposed = [...columns].filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `${table}.${exposed.join(", ")} decide${exposed.length === 1 ? "s" : ""} memberships, and the migrations let anon or authenticated insert or update ${exposed.length === 1 ? "it" : "them"}: a user could give themselves a membership`,
+			fix: `revoke insert, update on ${table} from anon, authenticated, then grant update (<columns clients edit>) on ${table} to authenticated; a column-level revoke alone leaves a table-level grant in place`
+		});
+	}
+	return findings;
+}
+/**
+* `attrs` claims must come from server-owned columns: never `user_metadata`,
+* never a column clients can write. Membership sources' deciding columns are
+* held to the same rule.
+*/
+function pd028(cwd, config, plan) {
+	const memberships = membershipFindings(cwd, config);
+	const attrs = config.supabase?.hook?.attrs;
+	if (attrs === void 0) return memberships;
+	const planned = plan(attrs);
+	const findings = planned.errors.map((message) => ({
+		code: "PD028",
+		severity: "error",
+		message,
+		fix: "list server-owned columns or app_metadata.<key> entries; user_metadata is user-editable"
+	}));
+	if (planned.table !== void 0 && planned.columns.length > 0) {
+		const writable = clientWritable(cwd, config, tableKey(planned.table));
+		const exposed = planned.columns.filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `attrs reads ${exposed.join(", ")} from ${tableKey(planned.table)}, which the migrations let anon or authenticated insert or update: a user could set their own attribute`,
+			fix: `revoke insert, update on ${tableKey(planned.table)} from anon, authenticated, and grant column-level update only on columns that are not attributes; the generated hook migration refuses to install otherwise`
+		});
+	}
+	return [...findings, ...memberships];
+}
+//#endregion
+//#region src/cli/supabase-config.ts
+const SUPABASE_CONFIG = "supabase/config.toml";
+function table$1(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	return value;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
+}
+/** `supabase/config.toml`, parsed; `undefined` when the project has none. */
+function readSupabaseConfig(cwd) {
+	const file = join(cwd, SUPABASE_CONFIG);
+	if (!existsSync(file)) return;
+	let root;
+	try {
+		root = parse(readFileSync(file, "utf8"));
+	} catch (error) {
+		return {
+			ok: false,
+			error: error instanceof Error ? error.message : String(error)
+		};
+	}
+	const expiry = table$1(root["auth"])?.["jwt_expiry"];
+	const paths = table$1(table$1(root["db"])?.["migrations"])?.["schema_paths"];
+	const schemaPaths = strings(paths);
+	const apiSchemas = strings(table$1(root["api"])?.["schemas"]);
+	const pgDelta = table$1(table$1(root["experimental"])?.["pgdelta"]);
+	const schemaPath = pgDelta?.["declarative_schema_path"];
+	return {
+		ok: true,
+		config: {
+			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
+			...schemaPaths === void 0 ? {} : { schemaPaths },
+			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...pgDelta?.["enabled"] === true ? { pgDelta: { schemaDir: posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "") } } : {}
+		}
+	};
+}
+/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+function supabaseConfig(cwd) {
+	const read = readSupabaseConfig(cwd);
+	return read?.ok === true ? read.config : {};
+}
+/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+function pd045(cwd) {
+	const read = readSupabaseConfig(cwd);
+	if (read === void 0 || read.ok) return [];
+	return [{
+		code: "PD045",
+		severity: "warning",
+		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
+		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then doctor assumes Supabase's defaults for jwt_expiry and schema_paths`
+	}];
+}
+//#endregion
+//#region src/cli/rls-rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+function hookTable(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+function authAdminRead(table, label) {
+	const t = hookTable(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
+* The token hook comes only from `permdock supabase hook generate`, so one
+* function writes the claims. Policies never call `authorize()` per row; they
+* call the helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+function driftOf(cwd, files) {
+	const drift = [];
+	for (const file of files) {
+		if (file.rel === "-") continue;
+		const path = resolve(cwd, file.rel);
+		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
+		else {
+			const onDisk = readFileSync(path, "utf8");
+			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
+		}
+	}
+	return drift;
+}
+/** Writes every file but the stdout ones, whose text it returns for printing. */
+function writeSqlFiles(cwd, files) {
+	const wrote = [];
+	const printed = [];
+	for (const file of files) {
+		if (file.rel === "-") {
+			printed.push(file.text.trimEnd());
+			continue;
+		}
+		const path = resolve(cwd, file.rel);
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, file.text);
+		wrote.push(file.rel);
+	}
+	return {
+		wrote,
+		printed: printed.join("\n")
+	};
+}
+const PARTS = [
+	"helpers",
+	"seeds",
+	"indexes",
+	"policies",
+	"hook"
+];
+/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+function parseSplit(raw) {
+	if (raw === void 0) return;
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return PARTS.filter((part) => names.includes(part));
+}
+/** The path of one split part: `{part}` in `out` replaced by the part name. */
+function partPath(out, part) {
+	return out.replaceAll("{part}", part);
+}
+/**
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
+* their dependencies, so no file needs a number to apply first.
+*/
+function pgDeltaPath(root, part, schema) {
+	switch (part) {
+		case "helpers":
+		case "indexes":
+		case "seeds": return `${root}/${schema}/${part}.sql`;
+		case "policies": return `${root}/public/policies/permdock.sql`;
+		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
+		default: return part;
+	}
+}
+//#endregion
+//#region src/cli/supabase-setup.ts
+const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
+function escape(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+function helpersDefined(sql, schema) {
+	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
+	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
+	const names = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(create)) {
+		const name = (match[1] ?? "").toLowerCase();
+		if (HELPER_NAME.test(name)) names.add(name);
+	}
+	return names;
+}
+/** SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`) and the migration folders, not the hook itself. */
+function helperSources(cwd, config, hookOut) {
+	const hook = resolve(cwd, hookOut);
+	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
+	const rlsOut = resolve(cwd, config.rls?.out ?? "rls.sql");
+	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
+	files.delete(hook);
+	return [...files];
+}
+function missingHelpersInFiles(cwd, config, manifest) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
+	return manifest.helpers.functions.filter((name) => !found.has(name));
+}
+async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
+	const client = await connect(db);
+	try {
+		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
+		const found = new Set(result.rows.map((row) => row["proname"]));
+		return manifest.helpers.functions.filter((name) => !found.has(name));
+	} finally {
+		await client.end();
+	}
+}
+function missingHelpersMessage(manifest, missing) {
+	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
+}
+/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+function oversizedClaims(samples, manifest) {
+	const encoder = new TextEncoder();
+	const oversized = [];
+	for (const claim of manifest.claims) {
+		if (claim.source === "permdock") continue;
+		let bytes = 0;
+		for (const sample of samples) {
+			if (sample === null || typeof sample !== "object") continue;
+			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
+			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
+		}
+		if (bytes > manifest.budget.bytes) oversized.push({
+			name: claim.name,
+			bytes
+		});
+	}
+	return oversized;
+}
+/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
+function droppedMemberships(samples) {
+	const out = [];
+	for (const [index, sample] of samples.entries()) {
+		if (sample === null || typeof sample !== "object") continue;
+		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
+		const { dropped } = readMemberships(claim);
+		if (dropped.length > 0) out.push({
+			sample: index,
+			entries: dropped
+		});
+	}
+	return out;
+}
+function pd039(input) {
+	const findings = [];
+	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
+	if (missing.length > 0) findings.push({
+		code: "PD039",
+		severity: "warning",
+		message: missingHelpersMessage(input.manifest, missing).slice(6),
+		fix: "run permdock rls generate, or set rls.out to the migration that holds the helpers"
+	});
+	const fixture = input.config.doctor?.claims;
+	if (fixture !== void 0) {
+		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
+		const samples = Array.isArray(parsed) ? parsed : [];
+		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
+			fix: "return less from the claim function, or read the data per request instead of from the token"
+		});
+		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
+			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/supabase-hook.ts
+const SUPABASE_HELP = `permdock supabase hook generate | inspect
+
+  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
+                [--active-from app_metadata.active_<scope>|<table>.<column>]
+                [--budget 1024] [--schema public] [--grants-out <file>|-]
+  inspect [--json] [--out [permdock.manifest.json]] [--check]
+
+Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
+passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
+needs (in --grants-out instead, for declarative schemas), the permdock_authz_version table
+and its triggers. Never grants anything to
+service_role. inspect prints the manifest: helper schema, names and signatures, tenant claim,
+budget, the claims the hook writes, the membership sources and the columns that decide them.
+--out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
+file differs.
+`;
+const MANIFEST_FILE = "permdock.manifest.json";
+const MANAGED_TRIGGER = "permdock_protect_managed";
+const CLAIM_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const PROTOTYPE_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const USER_EDITABLE = /^(raw_)?user_meta(_)?data$/iu;
+/**
+* Splits `supabase.hook.attrs` into table columns and `app_metadata` keys and
+* lists what cannot be compiled: `user_metadata` (the user can edit it), a
+* direct `auth.users` column, an unsafe or prototype key, a duplicate key,
+* or a table column without a table.
+*/
+function attrsPlan(attrs) {
+	const errors = [];
+	const columns = [];
+	const meta = [];
+	const seen = /* @__PURE__ */ new Set();
+	if (attrs.table?.replaceAll("\"", "").toLowerCase() === "auth.users") errors.push("supabase.hook.attrs.table cannot be auth.users: list app_metadata.<key> entries instead");
+	for (const entry of attrs.columns) {
+		const [head = "", ...rest] = entry.split(".");
+		const isMeta = head === "app_metadata" || head === "raw_app_meta_data";
+		const key = isMeta ? rest.join(".") : entry;
+		if (USER_EDITABLE.test(head) || USER_EDITABLE.test(key) || /user_?meta/iu.test(entry)) {
+			errors.push(`supabase.hook.attrs lists ${entry}: user_metadata is user-editable and never becomes a claim`);
+			continue;
+		}
+		if (!CLAIM_KEY.test(key) || PROTOTYPE_KEYS.has(key)) {
+			errors.push(`supabase.hook.attrs lists ${entry}: a key must match ${CLAIM_KEY.source} and not be a prototype key`);
+			continue;
+		}
+		if (seen.has(key)) {
+			errors.push(`supabase.hook.attrs names the key ${key} twice`);
+			continue;
+		}
+		seen.add(key);
+		if (isMeta) meta.push(key);
+		else columns.push(key);
+	}
+	if (columns.length > 0 && attrs.table === void 0) errors.push(`supabase.hook.attrs lists ${columns.join(", ")} without a table`);
+	return {
+		...attrs.table === void 0 ? {} : { table: attrs.table },
+		id: attrs.id ?? "id",
+		columns,
+		meta,
+		errors
+	};
+}
+/**
+* Claim names `supabase.hook.claims` cannot write: the ones this hook owns
+* (plus the tenant claim) and the ones Supabase Auth issues.
+*/
+const RESERVED_CLAIMS = /* @__PURE__ */ new Set([
+	"roles",
+	"user_role",
+	"memberships",
+	"memberships_truncated",
+	"attrs",
+	"authz_ver",
+	"sub",
+	"aud",
+	"role",
+	"exp",
+	"iat",
+	"iss",
+	"aal",
+	"amr",
+	"session_id",
+	"is_anonymous",
+	"email",
+	"phone",
+	"app_metadata",
+	"user_metadata"
+]);
+const CLAIM_FUNCTION = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/u;
+/**
+* Checks `supabase.hook.claims`: each name is a safe claim key outside
+* {@link RESERVED_CLAIMS} and the tenant claim, each function is
+* schema-qualified (the hook runs with an empty `search_path`).
+*/
+function extraClaimsPlan(claims, tenantClaim) {
+	const errors = [];
+	const planned = [];
+	for (const [claim, fn] of Object.entries(claims ?? {})) {
+		if (!CLAIM_KEY.test(claim) || PROTOTYPE_KEYS.has(claim)) {
+			errors.push(`supabase.hook.claims names ${claim}: a claim must match ${CLAIM_KEY.source} and not be a prototype key`);
+			continue;
+		}
+		if (RESERVED_CLAIMS.has(claim) || claim === tenantClaim) {
+			errors.push(`supabase.hook.claims names ${claim}, which PermDock or Supabase Auth writes`);
+			continue;
+		}
+		if (typeof fn !== "string" || !CLAIM_FUNCTION.test(fn)) {
+			errors.push(`supabase.hook.claims.${claim} must be a schema-qualified function name such as better_supabase.feature_claims`);
+			continue;
+		}
+		planned.push({
+			claim,
+			fn
+		});
+	}
+	return {
+		claims: planned,
+		errors
+	};
+}
+const VERSION_TRIGGER = "permdock_authz_version";
+const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
+function memberForPlan(input) {
+	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
+		dialect: "supabase",
+		...input
+	}, name));
+	const entries = /* @__PURE__ */ new Map();
+	for (const name of memberFor) {
+		const mapped = memberForTable(input, name);
+		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
+		for (const entry of found) entries.set(JSON.stringify(entry), entry);
+	}
+	return {
+		memberFor,
+		memberships: [...entries.values()]
+	};
+}
+/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
+function mappedMembership(mapped, scopes, name) {
+	const id = scopeColumn(mapped, scopes, name) ?? "";
+	const within = {};
+	for (const ancestor of scopeChain(scopes, name).slice(1)) {
+		const column = scopeColumn(mapped, scopes, ancestor);
+		if (column !== void 0) within[ancestor] = column;
+	}
+	const columns = [
+		mapped.user,
+		id,
+		mapped.role,
+		...Object.values(within),
+		...mapped.via === void 0 ? [] : [mapped.via],
+		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt]
+	];
+	return {
+		table: mapped.table.includes(".") ? mapped.table : `public.${mapped.table}`,
+		user: { column: mapped.user },
+		scope: { value: name },
+		id: { column: id },
+		role: { column: mapped.role },
+		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
+		...mapped.via === void 0 ? {} : { via: { column: mapped.via } },
+		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
+		columns: [...new Set(columns)]
+	};
+}
+function table(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+function positiveInteger(value, label) {
+	const number = typeof value === "string" ? Number(value) : value;
+	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
+	return number;
+}
+/**
+* SQL for the active first-scope id, as text, for user `uid`; a table source
+* compares its id column with `v_active_user`, declared as `userType`.
+*/
+function activeFromSql(input, root) {
+	const spec = input ?? `app_metadata.active_${root}`;
+	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
+		const key = spec.slice(13);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
+		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+	}
+	const parsed = typeof spec === "string" ? (() => {
+		const dot = spec.lastIndexOf(".");
+		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
+		return {
+			table: spec.slice(0, dot),
+			column: spec.slice(dot + 1)
+		};
+	})() : spec;
+	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
+	return {
+		sql: `(select a.${quoteIdent(parsed.column)}::text from ${table(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
+		userType: `${table(parsed.table)}.${quoteIdent(id)}%type`
+	};
+}
+/**
+* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
+* Supabase Auth issues) as that column's type, so each lookup compares the
+* column uncast and its index applies.
+*/
+function typedUsers(parts) {
+	return [
+		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
+		...parts.roles === void 0 ? [] : [`v_roles_user ${table(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
+		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${table(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
+		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
+	].map((line) => `\n  ${line}`).join("");
+}
+function checkSources(parts) {
+	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
+	for (const source of parts.sources) {
+		if (source.sql === void 0 || typeof source.sql.select !== "function") throw new Error("PermDock CLI: supabase.hook.memberships takes fromTable / fromJunction sources from permdock/supabase");
+		const scope = source.sql.scope;
+		if (scope === void 0) continue;
+		if (resolveScope(parts.scopes, scope) !== scope) throw new Error(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
+		const chain = scopeChain(parts.scopes, scope);
+		const holds = new Set(source.sql.holds ?? [scope]);
+		const missing = chain.filter((ancestor) => !holds.has(ancestor));
+		if (missing.length > 0) throw new Error(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
+	}
+}
+function entriesSql(parts) {
+	const tenant = `case when s.scope = ${quoteLiteral(parts.root)} then s.id else s.within ->> ${quoteLiteral(parts.root)} end`;
+	return parts.sources.map((source, index) => `select ${String(index)} as ord,
+  (${tenant}) as tenant,
+  jsonb_strip_nulls(jsonb_build_object(
+    'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+    'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+    'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+    'managedBy', s.managed_by, 'entitlements', s.seats
+  )) as entry
+from (
+${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
+) s`).join("\nunion all\n");
+}
+function hookSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.custom_access_token_hook`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const plan = parts.attrs;
+	const fromTable = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
+  select jsonb_strip_nulls(jsonb_build_object(${plan.columns.map((column) => `${quoteLiteral(column)}, to_jsonb(p.${quoteIdent(column)})`).join(", ")}))
+    into attrs
+    from ${table(plan.table)} p
+    where p.${quoteIdent(plan.id)} = v_attrs_user;`;
+	const fromMeta = plan === void 0 || plan.meta.length === 0 ? "" : `
+  attrs := coalesce(attrs, '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object(${plan.meta.map((key) => `${quoteLiteral(key)}, claims -> 'app_metadata' -> ${quoteLiteral(key)}`).join(", ")}));`;
+	const attrs = plan === void 0 ? "" : `${fromTable}${fromMeta}
+  if attrs is not null and attrs <> '{}'::jsonb then
+    used := octet_length(attrs::text);
+    if used > budget then
+      truncated := true;
+      used := 0;
+    else
+      claims := jsonb_set(claims, '{attrs}', attrs);
+    end if;
+  end if;`;
+	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
+	const version = parts.version ? `
+  select v.version into ver from ${versionTable} v where v.user_id = uid;
+  claims := jsonb_set(claims, '{authz_ver}', to_jsonb(coalesce(ver, 0)));` : "";
+	const dropExtra = parts.extra.map((entry) => ` - ${quoteLiteral(entry.claim)}`).join("");
+	const extra = parts.extra.map((entry) => `
+  extra := ${quoteTable(entry.fn)}(uid);
+  if extra is not null then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
+  end if;`).join("");
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    claims := claims - 'memberships_truncated' - 'attrs' - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
+    claims := claims || jsonb_build_object('user_role', '[]'::jsonb, 'roles', '[]'::jsonb, 'memberships', '[]'::jsonb);${version}
+    return jsonb_set(event, '{claims}', claims);
+  end if;`;
+	return `${parts.schema === "public" ? "" : `create schema if not exists ${schema};\nrevoke all on schema ${schema} from public;\n\n`}create or replace function ${fn}(event jsonb)
+returns jsonb
+language plpgsql
+stable
+set search_path = ''
+as $$
+declare
+  claims jsonb := event -> 'claims';
+  uid uuid := (event ->> 'user_id')::uuid;
+  active text;
+  held jsonb;
+  kept jsonb := '[]'::jsonb;
+  truncated boolean := false;
+  in_active boolean := false;
+  budget integer := ${String(parts.budget)};
+  used integer := 0;
+  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}
+begin${suspended}
+  claims := claims - 'attrs'${dropExtra};
+${roles}
+  claims := jsonb_set(claims, '{roles}', held);
+  if jsonb_array_length(held) = 1 then
+    claims := jsonb_set(claims, '{user_role}', held -> 0);
+  elsif jsonb_array_length(held) > 1 then
+    claims := jsonb_set(claims, '{user_role}', held);
+  end if;
+  active := ${parts.active.sql};${attrs}
+  for item in
+    select x.entry, x.tenant is not distinct from active as current
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x
+    order by (x.tenant is not distinct from active) desc, x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text
+  loop
+    if octet_length((kept || jsonb_build_array(item.entry))::text) + used > budget then
+      truncated := true;
+      exit;
+    end if;
+    kept := kept || jsonb_build_array(item.entry);
+    in_active := in_active or (active is not null and item.current);
+  end loop;
+  claims := jsonb_set(claims, '{memberships}', kept);
+  if truncated then
+    claims := jsonb_set(claims, '{memberships_truncated}', 'true'::jsonb);
+  else
+    claims := claims - 'memberships_truncated';
+  end if;
+  if in_active then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${parts.tenantClaim}}`)}, to_jsonb(active));
+  end if;${extra}${version}
+  return jsonb_set(event, '{claims}', claims);
+end;
+$$;`;
+}
+/**
+* Everything the hook grants `supabase_auth_admin`, and the execute revoke:
+* the statements `supabase db diff` drops, so `--grants-out` moves them to
+* their own file.
+*/
+function grantsSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.custom_access_token_hook`;
+	return [
+		`-- supabase_auth_admin: the grants and read policies the hook needs
+grant usage on schema ${schema} to supabase_auth_admin;
+grant execute on function ${fn}(jsonb) to supabase_auth_admin;
+revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extraGrantsSql(parts.extra)}${memberForGrantsSql(parts)}`,
+		readsSql(parts),
+		parts.version ? authAdminRead(`${parts.schema}.${AUTHZ_VERSION_TABLE}`, "version") : ""
+	].filter((chunk) => chunk !== "").join("\n");
+}
+function extraGrantsSql(extra) {
+	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+}
+/**
+* Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
+* functions, which run as `supabase_auth_admin` and may call them. Only with
+* `hook.claims`: the grant needs the helpers migration applied first, and a
+* hook without extra claims does not.
+*/
+function memberForGrantsSql(parts) {
+	const { schema, memberFor } = parts.helpers;
+	if (memberFor.length === 0 || parts.extra.length === 0) return "";
+	return [...schema === parts.schema ? [] : [`\ngrant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`], ...memberFor.map((scope) => `\ngrant execute on function ${quoteIdent(schema)}.${memberForHelper(scope)}(uuid) to supabase_auth_admin;`)].join("");
+}
+function readsSql(parts) {
+	const reads = /* @__PURE__ */ new Map();
+	for (const source of parts.sources) reads.set(source.sql.table, "memberships");
+	for (const source of parts.sources) for (const name of source.sql.reads) reads.set(name, reads.get(name) ?? "status");
+	if (parts.roles !== void 0) {
+		const { table: rolesTable, through } = parts.roles;
+		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
+		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+	}
+	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
+	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
+	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
+}
+function versionSql(parts) {
+	if (!parts.version) return "";
+	const schema = quoteIdent(parts.schema);
+	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
+	const bump = `${schema}.permdock_bump_authz_version`;
+	const bumpFor = `${schema}.${AUTHZ_VERSION_BUMP}`;
+	const tables = [...new Map(parts.sources.map((source) => [source.sql.table, source.sql.user]))];
+	if (parts.roles !== void 0) tables.push([parts.roles.table, parts.roles.user]);
+	return `-- the authorization version: bumped on every membership change, written to authz_ver
+create table if not exists ${versionTable} (
+  user_id uuid primary key references auth.users on delete cascade,
+  version bigint not null default 0
+);
+alter table ${versionTable} enable row level security;
+revoke all on table ${versionTable} from anon, authenticated, public;
+
+-- bumps each listed user once, for a membership source outside the hook; no client role may call it
+create or replace function ${bumpFor}(p_users uuid[])
+returns void
+language sql
+security definer
+set search_path = ''
+as $$
+  insert into ${versionTable} as v (user_id, version)
+  select distinct u, 1 from unnest(p_users) u where u is not null
+  on conflict (user_id) do update set version = v.version + 1
+$$;
+revoke execute on function ${bumpFor}(uuid[]) from public, anon, authenticated;
+
+create or replace function ${bump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array[
+    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+  ]::uuid[]);
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${table(name)}
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${roleKeysVersionSql(parts, versionTable)}`;
+}
+/** A renamed role key changes every holder's `roles` claim, so updates to the roles table bump each holder. */
+function roleKeysVersionSql(parts, versionTable) {
+	const through = parts.roles?.through;
+	if (parts.roles === void 0 || through === void 0) return "";
+	const bump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_role_keys`;
+	const id = quoteIdent(through.id);
+	const key = quoteIdent(through.key);
+	return `
+
+-- a renamed role key changes the roles claim of everyone who holds it
+create or replace function ${bump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'UPDATE'
+    and new.${key} is not distinct from old.${key}
+    and new.${id} is not distinct from old.${id} then
+    return null;
+  end if;
+  insert into ${versionTable} as v (user_id, version)
+  select distinct h.${quoteIdent(parts.roles.user)}::uuid, 1
+  from ${table(parts.roles.table)} h
+  where h.${quoteIdent(through.ref)} = old.${id}
+  on conflict (user_id) do update set version = v.version + 1;
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(through.table)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after update or delete on ${table(through.table)}
+  for each row execute function ${bump}();`;
+}
+/**
+* Fails the migration when a client role can write an `attrs` column: a
+* claim the user can set is not a server-owned attribute.
+*/
+function attrsGuardSql(plan) {
+	if (plan?.table === void 0 || plan.columns.length === 0) return "";
+	const target = quoteLiteral(table(plan.table));
+	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
+do $$
+begin
+  if exists (
+    select 1
+    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
+    cross join (values ('anon'), ('authenticated')) r(role)
+    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
+       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
+  ) then
+    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
+      using errcode = '42501';
+  end if;
+end
+$$;`;
+}
+function managedSql(parts) {
+	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
+	if (managed.length === 0) return "";
+	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
+	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
+create or replace function ${guard}()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  if current_user in ('anon', 'authenticated') and (
+    column_name = ''
+    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
+    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
+  ) then
+    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
+      using errcode = '42501';
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${table(source.sql.table)};
+create trigger ${quoteIdent(MANAGED_TRIGGER)}
+  before insert or update or delete on ${table(source.sql.table)}
+  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
+}
+/** The `config.toml` block that enables the hook and bounds token staleness. */
+function configToml(schema, jwtExpiry) {
+	return `[auth]
+jwt_expiry = ${String(jwtExpiry)}
+
+[auth.hook.custom_access_token]
+enabled = true
+uri = "${hookUri(schema)}"`;
+}
+const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
+function hookParts(scopes, config, overrides) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
+	const root = rootScope(scopes) ?? "tenant";
+	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
+	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
+	quoteIdent(schema);
+	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
+	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
+	checkSources({
+		sources: hook.memberships,
+		scopes
+	});
+	const parts = {
+		schema,
+		scopes,
+		root,
+		sources: hook.memberships,
+		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
+		version: hook.version !== false,
+		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
+		tenantClaim,
+		users: suspension?.users,
+		hook,
+		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r"),
+		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
+		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
+		extra: extraPlan.claims,
+		helpers: {
+			schema: config.rls?.schema ?? "permdock",
+			...memberForPlan({
+				scopes,
+				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
+				memberSources: config.rls?.membershipSources ?? hook.memberships
+			})
+		}
+	};
+	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
+	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
+	quoteIdent(parts.tenantClaim);
+	return parts;
+}
+function permdockClaim(name, budget = false) {
+	return {
+		name,
+		source: "permdock",
+		budget
+	};
+}
+function hookClaims(parts) {
+	return [
+		permdockClaim("user_role"),
+		permdockClaim("roles"),
+		permdockClaim("memberships", true),
+		permdockClaim("memberships_truncated"),
+		permdockClaim(parts.tenantClaim),
+		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
+		...parts.version ? [permdockClaim("authz_ver")] : [],
+		...parts.extra.map((entry) => ({
+			name: entry.claim,
+			source: entry.fn,
+			budget: false
+		}))
+	];
+}
+function helperList(parts, types) {
+	const client = ["authenticated"];
+	return [{
+		name: "permdock_has",
+		args: "p_grant text",
+		returns: "boolean",
+		execute: client
+	}, ...parts.scopes.flatMap((scope) => {
+		const returns = `setof ${types.get(scope.name) ?? "uuid"}`;
+		return [
+			{
+				name: `permitted_${scope.name}_ids`,
+				args: "p_grant text",
+				returns,
+				execute: client
+			},
+			{
+				name: memberIdsHelper(scope.name),
+				args: "",
+				returns,
+				execute: client
+			},
+			...parts.helpers.memberFor.includes(scope.name) ? [{
+				name: memberForHelper(scope.name),
+				args: "p_user uuid",
+				returns,
+				execute: parts.extra.length === 0 ? [] : ["supabase_auth_admin"]
+			}] : []
+		];
+	})];
+}
+function manifestOf(parts, out, config) {
+	const rls = config.rls;
+	const ctx = {
+		dialect: "supabase",
+		scopes: parts.scopes,
+		tenantClaim: parts.tenantClaim,
+		gucPrefix: rls?.gucPrefix ?? "app",
+		tenantType: rls?.tenantType ?? "uuid",
+		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes }
+	};
+	const types = new Map(parts.scopes.map((scope) => [scope.name, scopeTypeOf(ctx, scope.name)]));
+	const helpers = helperList(parts, types);
+	return {
+		$schema: SUPABASE_MANIFEST_SCHEMA,
+		version: 1,
+		hook: {
+			schema: parts.schema,
+			function: "custom_access_token_hook",
+			out
+		},
+		helpers: {
+			schema: parts.helpers.schema,
+			functions: helpers.map((helper) => helper.name)
+		},
+		tenantClaim: parts.tenantClaim,
+		budget: {
+			bytes: parts.budget,
+			measure: BUDGET_MEASURE
+		},
+		claims: hookClaims(parts),
+		authzVersion: parts.version,
+		...parts.version ? { authzVersionBump: {
+			schema: parts.schema,
+			function: AUTHZ_VERSION_BUMP,
+			args: "p_users uuid[]"
+		} } : {},
+		memberships: parts.sources.map((source) => source.sql.manifest),
+		rls: {
+			schema: parts.helpers.schema,
+			mode: resolveAuthorize(config),
+			tenantClaim: parts.tenantClaim,
+			scopes: parts.scopes.map((scope) => ({
+				name: scope.name,
+				type: types.get(scope.name) ?? "uuid",
+				...scope.within === void 0 ? {} : { within: scope.within }
+			})),
+			helpers,
+			memberships: parts.helpers.memberships
+		},
+		decidingColumns: decidingColumns(config, parts.attrs === void 0 ? void 0 : {
+			...parts.attrs.table === void 0 ? {} : { table: parts.attrs.table },
+			columns: parts.attrs.columns
+		}),
+		markers: {
+			hook: "v1",
+			grants: "v1"
+		}
+	};
+}
+/** The first line of the generated hook: fields `--check` compares before the full text. */
+function hookMarker(manifest) {
+	return `${HOOK_MARKER} schema=${manifest.hook.schema} tenant=${manifest.tenantClaim} budget=${String(manifest.budget.bytes)} claims=${manifest.claims.map((claim) => claim.name).join(",")}`;
+}
+function defaultOut(config) {
+	return config.supabase?.hook?.out ?? "supabase/permdock-hook.sql";
+}
+/** `supabase.hook.out`, else pg-delta's per-schema path, else `supabase/permdock-hook.sql`. */
+function hookOut(cwd, config, schema) {
+	const pgDelta = supabaseConfig(cwd).pgDelta;
+	return config.supabase?.hook?.out !== void 0 || pgDelta === void 0 ? defaultOut(config) : pgDeltaPath(pgDelta.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
+}
+function supabaseHookManifest(scopes, config, overrides = {}) {
+	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config);
+}
+/**
+* The hook migration. With `grantsOut`, the `supabase_auth_admin` grants are
+* left out of `sql` and returned in `grants` for that file.
+*/
+function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
+	const parts = hookParts(scopes, config, overrides);
+	const manifest = manifestOf(parts, defaultOut(config), config);
+	const toml = configToml(parts.schema, parts.jwtExpiry).split("\n").map((line) => line === "" ? "--" : `--   ${line}`).join("\n");
+	const sql = [
+		`${hookMarker(manifest)}
+-- custom_access_token_hook(jsonb): memberships go active ${parts.root} first and stop at the budget
+-- supabase/config.toml:
+${toml}${grantsOut === void 0 ? "" : `\n-- the supabase_auth_admin grants are in ${grantsOut}`}`,
+		attrsGuardSql(parts.attrs),
+		hookSql(parts),
+		versionSql(parts),
+		grantsOut === void 0 ? grantsSql(parts) : "",
+		managedSql(parts)
+	].filter((chunk) => chunk !== "").join("\n\n");
+	const grants = `${GRANTS_MARKER} schema=${parts.schema}
+${grantsSql(parts)}
+`;
+	return {
+		sql: `${sql}\n`,
+		grants,
+		manifest
+	};
+}
+/** What the hook file's header says about where its grants went. */
+function grantsLabel(grantsOut) {
+	if (grantsOut === void 0) return;
+	return grantsOut === "-" ? "a separate migration" : grantsOut;
+}
+function markerDrift(onDisk, expected, outRel) {
+	const found = hookMarkerFields(onDisk);
+	if (found === void 0) return `supabase hook drift: ${outRel} has no ${HOOK_MARKER} line`;
+	const want = hookMarkerFields(hookMarker(expected)) ?? {};
+	const changed = Object.keys(want).filter((key) => found[key] !== want[key]).map((key) => `${key} ${found[key] ?? "(none)"} -> ${want[key] ?? ""}`);
+	return changed.length === 0 ? "supabase hook drift" : `supabase hook drift: ${changed.join("; ")}`;
+}
+function inspectText(manifest) {
+	return [
+		`hook ${manifest.hook.schema}.${manifest.hook.function} (${manifest.hook.out})`,
+		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
+		`tenant claim ${manifest.tenantClaim}`,
+		`budget ${String(manifest.budget.bytes)} bytes of ${manifest.budget.measure}`,
+		`claims ${manifest.claims.map((claim) => `${claim.name}${claim.source === "permdock" ? "" : ` (${claim.source})`}${claim.budget ? " [budget]" : ""}`).join(", ")}`,
+		`authz_ver ${manifest.authzVersion ? "on" : "off"}`
+	].join("\n");
+}
+/**
+* Writes the manifest to `rel`, or with `check` compares it as JSON, so a
+* formatter that reflows the file is not drift.
+*/
+function manifestFile(cwd, rel, manifest, check) {
+	const path = resolve(cwd, rel);
+	if (!check) {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+		return {
+			code: 0,
+			output: `wrote ${rel}`
+		};
+	}
+	if (!existsSync(path)) return {
+		code: 1,
+		output: `supabase manifest drift: missing ${rel}`
+	};
+	let onDisk;
+	try {
+		onDisk = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {
+			code: 1,
+			output: `supabase manifest drift: ${rel} is not JSON`
+		};
+	}
+	const found = typeof onDisk === "object" && onDisk !== null && !Array.isArray(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
+	const changed = [.../* @__PURE__ */ new Set([...Object.keys(manifest), ...Object.keys(found)])].filter((key) => JSON.stringify(Reflect.get(manifest, key)) !== JSON.stringify(found[key]));
+	return changed.length === 0 ? {
+		code: 0,
+		output: "supabase manifest up to date"
+	} : {
+		code: 1,
+		output: `supabase manifest drift: ${rel} differs in ${changed.join(", ")}; run permdock supabase inspect --out ${rel}`
+	};
+}
+async function loadScopes(cwd, config) {
+	if (config.policy === void 0) throw new Error("PermDock CLI: supabase hook generate needs policy in permdock.config.ts");
+	const policy = asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
+	return scopeList(policy.scopes);
+}
+async function runSupabase(input) {
+	const [area, action] = input.rest;
+	const overrides = Object.fromEntries(Object.entries({
+		activeFrom: input.activeFrom,
+		budget: input.budget,
+		schema: input.schema
+	}).filter(([, value]) => value !== void 0));
+	if (area === "inspect" && action === void 0) {
+		const manifest = supabaseHookManifest(await loadScopes(input.cwd, input.config), input.config, {
+			...overrides,
+			out: hookOut(input.cwd, input.config, input.schema)
+		});
+		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
+		return {
+			code: 0,
+			output: input.json === true ? JSON.stringify(manifest, null, 2) : inspectText(manifest)
+		};
+	}
+	if (area !== "hook" || action !== "generate") return {
+		code: 2,
+		output: SUPABASE_HELP
+	};
+	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema);
+	const outPath = resolve(input.cwd, outRel);
+	const hook = input.config.supabase?.hook;
+	const grantsFile = input.grantsOut === void 0 ? [] : [{
+		part: "grants",
+		rel: input.grantsOut,
+		text: grants
+	}];
+	const toml = configToml(input.schema ?? hook?.schema ?? input.config.rls?.schema ?? "permdock", hook?.jwtExpiry ?? 900);
+	if (input.check) {
+		if (!existsSync(outPath)) return {
+			code: 1,
+			output: `supabase hook drift: missing ${outRel}`
+		};
+		const onDisk = readFileSync(outPath, "utf8");
+		if (onDisk !== sql) return {
+			code: 1,
+			output: markerDrift(onDisk, manifest, outRel)
+		};
+		const drift = driftOf(input.cwd, grantsFile);
+		return drift.length === 0 ? {
+			code: 0,
+			output: "supabase hook up to date"
+		} : {
+			code: 1,
+			output: `supabase hook drift: ${drift.join("; ")}`
+		};
+	}
+	mkdirSync(dirname(outPath), { recursive: true });
+	writeFileSync(outPath, sql);
+	const grantsWritten = writeSqlFiles(input.cwd, grantsFile);
+	const placed = {
+		...manifest,
+		hook: {
+			...manifest.hook,
+			out: outRel
+		}
+	};
+	const missing = input.db === void 0 ? missingHelpersInFiles(input.cwd, input.config, placed) : await missingHelpersInDb(input.db, placed);
+	return {
+		code: 0,
+		output: [
+			`wrote ${[outRel, ...grantsWritten.wrote].join(", ")}`,
+			...grantsWritten.printed === "" ? [] : [grantsWritten.printed],
+			"add to supabase/config.toml:",
+			toml,
+			...missing.length === 0 ? [] : [missingHelpersMessage(placed, missing)]
+		].join("\n")
+	};
+}
+//#endregion
+export { tableKey as A, pd009 as C, pd040 as D, pd028 as E, group as O, pd006 as S, pd022 as T, resolveAuthorize as _, loadScopes as a, MIGRATION_DIRS as b, supabaseHookSql as c, parseSplit as d, partPath as f, rbacScaffold as g, parseRbacAuthorize as h, hookOut as i, sqlStatements as k, pd039 as l, writeSqlFiles as m, attrsPlan as n, runSupabase as o, pgDeltaPath as p, grantsLabel as r, supabaseHookManifest as s, activeFromSql as t, driftOf as u, pd045 as v, pd012 as w, pd005 as x, supabaseConfig as y };