permdock 0.0.0 → 0.2.0

package/dist/supabase-hook-BuxLQLpU.js

@@ -0,0 +1,1814 @@
+import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BvacVTZR.js";
+import { a as sqlFiles } from "./files-DWUN9PzI.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
+import { r as scopeColumn } from "./compile-Ba4blROR.js";
+import { t as authorizeSql } from "./supabase-DTBaC20O.js";
+import "./budget-NbEtbJC_.js";
+import { c as roleManifest, l as keptKeys, t as AUTHZ_VERSION_TABLE } from "./sources-B0UvrJ21.js";
+import { i as readMemberships } from "./manifest-iaoBXHKc.js";
+import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
+import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
+import { E as hasMemberFor, F as memberForSources, G as quoteLiteral, H as permittedIdsHelper, I as memberForTable, K as quoteTable, L as memberIdsHelper, P as memberForHelper, R as memberRoleOf, U as qualifiedTable, V as permittedForHelper, W as quoteIdent, Z as scopeTypeOf, f as USER_ID_HELPER, h as activeRowSql, it as tenantTypeOf, n as HELPERS, v as checkSuspension } from "./rls-shared-aOQ4hGTO.js";
+import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-BMasREhR.js";
+import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-B5Lkq62W.js";
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+function driftOf(cwd, files) {
+	const drift = [];
+	for (const file of files) {
+		if (file.rel === "-") continue;
+		const path = resolve(cwd, file.rel);
+		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
+		else {
+			const onDisk = readFileSync(path, "utf8");
+			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
+		}
+	}
+	return drift;
+}
+/** Writes every file but the stdout ones, whose text it returns for printing. */
+function writeSqlFiles(cwd, files) {
+	const wrote = [];
+	const printed = [];
+	for (const file of files) {
+		if (file.rel === "-") {
+			printed.push(file.text.trimEnd());
+			continue;
+		}
+		const path = resolve(cwd, file.rel);
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, file.text);
+		wrote.push(file.rel);
+	}
+	return {
+		wrote,
+		printed: printed.join("\n")
+	};
+}
+const PARTS = [
+	"helpers",
+	"seeds",
+	"indexes",
+	"policies",
+	"hook"
+];
+/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+function parseSplit(raw) {
+	if (raw === void 0) return;
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return PARTS.filter((part) => names.includes(part));
+}
+/** The path of one split part: `{part}` in `out` replaced by the part name. */
+function partPath(out, part) {
+	return out.replaceAll("{part}", part);
+}
+/**
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
+* their dependencies, so no file needs a number to apply first.
+*/
+function pgDeltaPath(root, part, schema) {
+	switch (part) {
+		case "helpers":
+		case "indexes":
+		case "seeds": return `${root}/${schema}/${part}.sql`;
+		case "policies": return `${root}/public/policies/permdock.sql`;
+		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
+		default: return part;
+	}
+}
+/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+function isSeedsDirectory(cwd, out) {
+	if (out === "-") return false;
+	if (out.endsWith("/")) return true;
+	const path = resolve(cwd, out);
+	return existsSync(path) && statSync(path).isDirectory();
+}
+/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
+}
+/**
+* The seeds part in a migrations directory: the newest migration there that
+* starts with \`marker\` when its text is \`text\` already, otherwise a new
+* \`<version>_permdock_seeds.sql\`. \`current\` is false when a new one is due.
+*/
+function seedsMigration(cwd, dir, marker, text, now) {
+	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
+	const path = resolve(cwd, base);
+	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
+	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
+		rel: `${base}/${latest}`,
+		current: true
+	};
+	return {
+		rel: `${base}/${migrationVersion(now)}_permdock_seeds.sql`,
+		current: false
+	};
+}
+//#endregion
+//#region src/cli/claims-schema.ts
+/**
+* The PermDock claims of `schemas/supabase-claims-v1.json` (its
+* `permdockClaims` and `membership` definitions), self-contained so
+* `supabase.hook.validate` can inline it into the hook for pg_jsonschema.
+*/
+const PERMDOCK_CLAIMS_SCHEMA = {
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$ref: "#/$defs/permdockClaims",
+	$defs: {
+		permdockClaims: {
+			type: "object",
+			properties: {
+				user_role: {
+					description: "Global roles: one name, a list, or null for none.",
+					anyOf: [
+						{ type: "string" },
+						{
+							type: "array",
+							items: { type: "string" }
+						},
+						{ type: "null" }
+					]
+				},
+				roles: {
+					type: "array",
+					items: { type: "string" }
+				},
+				memberships: {
+					type: "array",
+					items: { $ref: "#/$defs/membership" }
+				},
+				memberships_truncated: {
+					description: "true when the size budget cut memberships or attrs.",
+					type: "boolean"
+				},
+				tenant_id: {
+					description: "The active tenant (the default rls.tenantClaim): the canonical text of one instance of the first scope.",
+					type: "string"
+				},
+				attrs: {
+					description: "Allow-listed server-owned attributes, read as principal.claims.attrs.<key>.",
+					type: "object"
+				},
+				authz_ver: {
+					description: "The principal's authorization version.",
+					type: "integer"
+				}
+			}
+		},
+		membership: {
+			type: "object",
+			required: ["roles"],
+			properties: {
+				scope: { type: "string" },
+				id: {
+					description: "Canonical text of the scope instance id (uuid::text for a uuid column); compared exactly, never lower-cased.",
+					type: "string"
+				},
+				within: {
+					description: "The id of every ancestor scope instance, by scope name.",
+					type: "object",
+					additionalProperties: { type: "string" }
+				},
+				on: {
+					type: "object",
+					required: ["resource", "id"],
+					properties: {
+						resource: { type: "string" },
+						id: { type: "string" }
+					}
+				},
+				tenant: { type: "string" },
+				team: { type: "string" },
+				roles: {
+					type: "array",
+					minItems: 1,
+					items: { type: "string" }
+				},
+				via: { type: "string" },
+				expiresAt: {
+					description: "Seconds since the epoch.",
+					type: "number"
+				},
+				grantedBy: { type: "string" },
+				reason: { type: "string" },
+				member: {
+					description: "The subgroup a membership source's group fills.",
+					type: "object",
+					required: ["group"],
+					properties: { group: {
+						type: "string",
+						minLength: 1
+					} }
+				},
+				managedBy: { const: "idp" },
+				entitlements: {
+					type: "array",
+					items: { type: "string" }
+				},
+				keep: {
+					description: "Set when the instance or an ancestor is suspended: the permission keys the membership still grants.",
+					type: "array",
+					items: {
+						type: "string",
+						minLength: 1
+					}
+				},
+				grants: {
+					description: "Custom roles in compact form, read by the helpers in jwt mode.",
+					type: "object"
+				}
+			},
+			anyOf: [
+				{ required: ["scope", "id"] },
+				{ required: ["tenant"] },
+				{ required: ["team"] },
+				{ required: ["on"] }
+			]
+		}
+	}
+};
+//#endregion
+//#region src/cli/rls-rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+function hookTable(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+function authAdminRead(table, label) {
+	const t = hookTable(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
+* The token hook comes only from `permdock supabase hook generate`, so one
+* function writes the claims. Policies never call `authorize()` per row; they
+* call the helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+//#endregion
+//#region src/cli/supabase-hook-sql.ts
+const MANAGED_TRIGGER = "permdock_protect_managed";
+const CLAIM_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+const PROTOTYPE_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const USER_EDITABLE = /^(raw_)?user_meta(_)?data$/iu;
+/**
+* Splits `supabase.hook.attrs` into table columns and `app_metadata` keys and
+* lists what cannot be compiled: `user_metadata` (the user can edit it), a
+* direct `auth.users` column, an unsafe or prototype key, a duplicate key,
+* or a table column without a table.
+*/
+function attrsPlan(attrs) {
+	const errors = [];
+	const columns = [];
+	const meta = [];
+	const seen = /* @__PURE__ */ new Set();
+	if (attrs.table?.replaceAll("\"", "").toLowerCase() === "auth.users") errors.push("supabase.hook.attrs.table cannot be auth.users: list app_metadata.<key> entries instead");
+	for (const entry of attrs.columns) {
+		const [head = "", ...rest] = entry.split(".");
+		const isMeta = head === "app_metadata" || head === "raw_app_meta_data";
+		const key = isMeta ? rest.join(".") : entry;
+		if (USER_EDITABLE.test(head) || USER_EDITABLE.test(key) || /user_?meta/iu.test(entry)) {
+			errors.push(`supabase.hook.attrs lists ${entry}: user_metadata is user-editable and never becomes a claim`);
+			continue;
+		}
+		if (!CLAIM_KEY.test(key) || PROTOTYPE_KEYS.has(key)) {
+			errors.push(`supabase.hook.attrs lists ${entry}: a key must match ${CLAIM_KEY.source} and not be a prototype key`);
+			continue;
+		}
+		if (seen.has(key)) {
+			errors.push(`supabase.hook.attrs names the key ${key} twice`);
+			continue;
+		}
+		seen.add(key);
+		if (isMeta) meta.push(key);
+		else columns.push(key);
+	}
+	if (columns.length > 0 && attrs.table === void 0) errors.push(`supabase.hook.attrs lists ${columns.join(", ")} without a table`);
+	return {
+		...attrs.table === void 0 ? {} : { table: attrs.table },
+		id: attrs.id ?? "id",
+		columns,
+		meta,
+		errors
+	};
+}
+/**
+* Claim names `supabase.hook.claims` cannot write: the ones this hook owns
+* (plus the tenant claim) and the ones Supabase Auth issues.
+*/
+const RESERVED_CLAIMS = /* @__PURE__ */ new Set([
+	"roles",
+	"user_role",
+	"memberships",
+	"memberships_truncated",
+	"attrs",
+	"authz_ver",
+	"sub",
+	"aud",
+	"role",
+	"exp",
+	"iat",
+	"iss",
+	"aal",
+	"amr",
+	"session_id",
+	"is_anonymous",
+	"email",
+	"phone",
+	"app_metadata",
+	"user_metadata"
+]);
+const CLAIM_FUNCTION = /^[A-Za-z_][A-Za-z0-9_]*\.[A-Za-z_][A-Za-z0-9_]*$/u;
+/**
+* Checks `supabase.hook.claims`: each name is a safe claim key outside
+* {@link RESERVED_CLAIMS} and the tenant claim, each function is
+* schema-qualified (the hook runs with an empty `search_path`).
+*/
+function extraClaimsPlan(claims, tenantClaim) {
+	const errors = [];
+	const planned = [];
+	for (const [claim, fn] of Object.entries(claims ?? {})) {
+		if (!CLAIM_KEY.test(claim) || PROTOTYPE_KEYS.has(claim)) {
+			errors.push(`supabase.hook.claims names ${claim}: a claim must match ${CLAIM_KEY.source} and not be a prototype key`);
+			continue;
+		}
+		if (RESERVED_CLAIMS.has(claim) || claim === tenantClaim) {
+			errors.push(`supabase.hook.claims names ${claim}, which PermDock or Supabase Auth writes`);
+			continue;
+		}
+		if (typeof fn !== "string" || !CLAIM_FUNCTION.test(fn)) {
+			errors.push(`supabase.hook.claims.${claim} must be a schema-qualified function name such as public.feature_claims`);
+			continue;
+		}
+		planned.push({
+			claim,
+			fn
+		});
+	}
+	return {
+		claims: planned,
+		errors
+	};
+}
+function beforePlan(before) {
+	const list = before === void 0 ? [] : typeof before === "string" ? [before] : before;
+	const bad = list.filter((fn) => typeof fn !== "string" || !CLAIM_FUNCTION.test(fn));
+	if (bad.length > 0) throw new Error(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
+	return [...new Set(list)];
+}
+function beforeSql(before) {
+	return before.map((fn) => `
+  checked := ${quoteTable(fn)}(event);
+  if checked is null or jsonb_typeof(checked) is distinct from 'object' then
+    return jsonb_build_object('error', jsonb_build_object('http_code', 500, 'message', ${quoteLiteral(`${fn} returned no event`)}));
+  end if;
+  if checked ? 'error' then
+    return checked;
+  end if;
+  event := checked;`).join("").concat(before.length === 0 ? "" : "\n  claims := event -> 'claims';");
+}
+/**
+* `hook.validate`: the claims the hook writes, dropped together when they do
+* not match `supabase-claims-v1.json`, so a bad claim denies instead of
+* failing sign-in. `hook.claims` entries belong to other packages and stay.
+*/
+function validateSql(parts) {
+	if (parts.hook.validate !== true) return "";
+	const keys = /* @__PURE__ */ new Set([
+		"user_role",
+		"roles",
+		"memberships",
+		"memberships_truncated",
+		"attrs",
+		"authz_ver",
+		parts.tenantClaim
+	]);
+	return `
+  if not extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(PERMDOCK_CLAIMS_SCHEMA))}::json, claims) then
+    claims := claims${[...keys].map((key) => ` - ${quoteLiteral(key)}`).join("")};
+  end if;`;
+}
+function validateGrantsSql(parts) {
+	return parts.hook.validate === true ? `
+create extension if not exists pg_jsonschema with schema extensions;
+grant usage on schema extensions to supabase_auth_admin;
+grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
+}
+const VERSION_TRIGGER = "permdock_authz_version";
+const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
+function memberForPlan(input) {
+	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
+		dialect: "supabase",
+		...input
+	}, name));
+	const entries = /* @__PURE__ */ new Map();
+	for (const name of memberFor) {
+		const mapped = memberForTable(input, name);
+		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
+		for (const entry of found) entries.set(JSON.stringify(entry), entry);
+	}
+	return {
+		memberFor,
+		memberships: [...entries.values()]
+	};
+}
+/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
+function mappedMembership(mapped, scopes, name) {
+	const id = scopeColumn(mapped, scopes, name) ?? "";
+	const within = {};
+	for (const ancestor of scopeChain(scopes, name).slice(1)) {
+		const column = scopeColumn(mapped, scopes, ancestor);
+		if (column !== void 0) within[ancestor] = column;
+	}
+	const role = memberRoleOf(mapped);
+	const columns = [
+		mapped.user,
+		id,
+		...role.columns,
+		...Object.values(within),
+		...typeof mapped.via === "string" ? [mapped.via] : [],
+		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
+		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
+	];
+	return {
+		table: mapped.table.includes(".") ? mapped.table : `public.${mapped.table}`,
+		user: { column: mapped.user },
+		scope: { value: name },
+		id: { column: id },
+		role: roleManifest(role),
+		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
+		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
+		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
+		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
+		columns: [...new Set(columns)]
+	};
+}
+function table(name) {
+	return quoteTable(name.includes(".") ? name : `public.${name}`);
+}
+function positiveInteger(value, label) {
+	const number = typeof value === "string" ? Number(value) : value;
+	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
+	return number;
+}
+/**
+* SQL for the active first-scope id, as text, for user `uid`; a table source
+* compares its id column with `v_active_user`, declared as `userType`.
+*/
+function activeFromSql(input, root) {
+	const spec = input ?? `app_metadata.active_${root}`;
+	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
+		const key = spec.slice(13);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
+		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+	}
+	const parsed = typeof spec === "string" ? (() => {
+		const dot = spec.lastIndexOf(".");
+		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
+		return {
+			table: spec.slice(0, dot),
+			column: spec.slice(dot + 1)
+		};
+	})() : spec;
+	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
+	return {
+		sql: `(select a.${quoteIdent(parsed.column)}::text from ${table(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
+		userType: `${table(parsed.table)}.${quoteIdent(id)}%type`
+	};
+}
+/**
+* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
+* Supabase Auth issues) as that column's type, so each lookup compares the
+* column uncast and its index applies.
+*/
+function typedUsers(parts) {
+	return [
+		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
+		...parts.roles === void 0 ? [] : [`v_roles_user ${table(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
+		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${table(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
+		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
+	].map((line) => `\n  ${line}`).join("");
+}
+function checkSources(parts) {
+	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
+	for (const source of parts.sources) {
+		if (source.sql === void 0 || typeof source.sql.select !== "function") throw new Error("PermDock CLI: supabase.hook.memberships takes fromTable / fromJunction sources from permdock/supabase");
+		const scope = source.sql.scope;
+		if (scope === void 0) continue;
+		if (resolveScope(parts.scopes, scope) !== scope) throw new Error(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
+		const chain = scopeChain(parts.scopes, scope);
+		const holds = new Set(source.sql.holds ?? [scope]);
+		const missing = chain.filter((ancestor) => !holds.has(ancestor));
+		if (missing.length > 0) throw new Error(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
+	}
+}
+function entriesSql(parts) {
+	const tenant = `case when s.scope = ${quoteLiteral(parts.root)} then s.id else s.within ->> ${quoteLiteral(parts.root)} end`;
+	return parts.sources.map((source, index) => `select ${String(index)} as ord,
+  (${tenant}) as tenant,
+  jsonb_strip_nulls(jsonb_build_object(
+    'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+    'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+    'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+    'managedBy', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
+  )) as entry
+from (
+${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
+) s`).join("\nunion all\n");
+}
+function hookSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.custom_access_token_hook`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const plan = parts.attrs;
+	const fromTable = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
+  select jsonb_strip_nulls(jsonb_build_object(${plan.columns.map((column) => `${quoteLiteral(column)}, to_jsonb(p.${quoteIdent(column)})`).join(", ")}))
+    into attrs
+    from ${table(plan.table)} p
+    where p.${quoteIdent(plan.id)} = v_attrs_user;`;
+	const fromMeta = plan === void 0 || plan.meta.length === 0 ? "" : `
+  attrs := coalesce(attrs, '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object(${plan.meta.map((key) => `${quoteLiteral(key)}, claims -> 'app_metadata' -> ${quoteLiteral(key)}`).join(", ")}));`;
+	const attrs = plan === void 0 ? "" : `${fromTable}${fromMeta}
+  if attrs is not null and attrs <> '{}'::jsonb then
+    used := octet_length(attrs::text);
+    if used > budget then
+      truncated := true;
+      used := 0;
+    else
+      claims := jsonb_set(claims, '{attrs}', attrs);
+    end if;
+  end if;`;
+	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
+	const version = parts.version ? `
+  select v.version into ver from ${versionTable} v where v.user_id = uid;
+  claims := jsonb_set(claims, '{authz_ver}', to_jsonb(coalesce(ver, 0)));` : "";
+	const dropExtra = parts.extra.map((entry) => ` - ${quoteLiteral(entry.claim)}`).join("");
+	const extra = parts.extra.map((entry) => `
+  extra := ${quoteTable(entry.fn)}(uid);
+  if extra is not null then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
+  end if;`).join("");
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    claims := claims - 'memberships_truncated' - 'attrs' - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
+    claims := claims || jsonb_build_object('user_role', '[]'::jsonb, 'roles', '[]'::jsonb, 'memberships', '[]'::jsonb);${version}
+    return jsonb_set(event, '{claims}', claims);
+  end if;`;
+	return `${parts.schema === "public" ? "" : `create schema if not exists ${schema};\nrevoke all on schema ${schema} from public;\n\n`}create or replace function ${fn}(event jsonb)
+returns jsonb
+language plpgsql
+stable
+set search_path = ''
+as $$
+declare
+  claims jsonb := event -> 'claims';
+  uid uuid := (event ->> 'user_id')::uuid;
+  active text;
+  held jsonb;
+  kept jsonb := '[]'::jsonb;
+  truncated boolean := false;
+  in_active boolean := false;
+  budget integer := ${String(parts.budget)};
+  used integer := 0;
+  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
+begin${beforeSql(parts.before)}${suspended}
+  claims := claims - 'attrs'${dropExtra};
+${roles}
+  claims := jsonb_set(claims, '{roles}', held);
+  if jsonb_array_length(held) = 1 then
+    claims := jsonb_set(claims, '{user_role}', held -> 0);
+  elsif jsonb_array_length(held) > 1 then
+    claims := jsonb_set(claims, '{user_role}', held);
+  end if;
+  active := ${parts.active.sql};${attrs}
+  for item in
+    select x.entry, x.tenant is not distinct from active as current
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x
+    order by (x.tenant is not distinct from active) desc, x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text
+  loop
+    if octet_length((kept || jsonb_build_array(item.entry))::text) + used > budget then
+      truncated := true;
+      exit;
+    end if;
+    kept := kept || jsonb_build_array(item.entry);
+    in_active := in_active or (active is not null and item.current);
+  end loop;
+  claims := jsonb_set(claims, '{memberships}', kept);
+  if truncated then
+    claims := jsonb_set(claims, '{memberships_truncated}', 'true'::jsonb);
+  else
+    claims := claims - 'memberships_truncated';
+  end if;
+  if in_active then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${parts.tenantClaim}}`)}, to_jsonb(active));
+  end if;${extra}${version}${validateSql(parts)}
+  return jsonb_set(event, '{claims}', claims);
+end;
+$$;`;
+}
+/** Everything the hook grants `supabase_auth_admin`, and the execute revoke. */
+function grantsSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.custom_access_token_hook`;
+	return [
+		`-- supabase_auth_admin: the grants and read policies the hook needs
+grant usage on schema ${schema} to supabase_auth_admin;
+grant execute on function ${fn}(jsonb) to supabase_auth_admin;
+revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extraGrantsSql(parts.extra)}${beforeGrantsSql(parts.before, parts.extra)}${memberForGrantsSql(parts)}${validateGrantsSql(parts)}`,
+		readsSql(parts),
+		parts.version ? authAdminRead(`${parts.schema}.${AUTHZ_VERSION_TABLE}`, "version") : ""
+	].filter((chunk) => chunk !== "").join("\n");
+}
+function extraGrantsSql(extra) {
+	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+}
+function beforeGrantsSql(before, extra) {
+	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
+	return [...[...new Set(before.map((fn) => fn.split(".")[0] ?? ""))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+}
+/**
+* Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
+* functions, which run as `supabase_auth_admin` and may call them. Only with
+* `hook.claims`: the grant needs the helpers migration applied first, and a
+* hook without extra claims does not.
+*/
+function memberForGrantsSql(parts) {
+	const { schema, memberFor } = parts.helpers;
+	if (memberFor.length === 0 || parts.extra.length === 0) return "";
+	return [...schema === parts.schema ? [] : [`\ngrant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`], ...memberFor.map((scope) => `\ngrant execute on function ${quoteIdent(schema)}.${memberForHelper(scope)}(uuid) to supabase_auth_admin;`)].join("");
+}
+function readsSql(parts) {
+	const reads = /* @__PURE__ */ new Map();
+	for (const source of parts.sources) reads.set(source.sql.table, "memberships");
+	for (const source of parts.sources) {
+		for (const name of source.sql.reads) reads.set(name, reads.get(name) ?? "status");
+		for (const through of source.sql.throughs) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+		const users = source.sql.userThrough;
+		if (users !== void 0) reads.set(users.table, reads.get(users.table) ?? "member_users");
+	}
+	if (parts.roles !== void 0) {
+		const { table: rolesTable, through } = parts.roles;
+		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
+		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+	}
+	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
+	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
+	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
+}
+function versionSql(parts) {
+	if (!parts.version) return "";
+	const schema = quoteIdent(parts.schema);
+	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
+	const bump = `${schema}.permdock_bump_authz_version`;
+	const bumpFor = `${schema}.${AUTHZ_VERSION_BUMP}`;
+	const tables = [...new Map(parts.sources.filter((source) => source.sql.userThrough === void 0).map((source) => [source.sql.table, source.sql.user]))];
+	if (parts.roles !== void 0) tables.push([parts.roles.table, parts.roles.user]);
+	return `-- the authorization version: bumped on every membership change, written to authz_ver
+create table if not exists ${versionTable} (
+  user_id uuid primary key references auth.users on delete cascade,
+  version bigint not null default 0
+);
+alter table ${versionTable} enable row level security;
+revoke all on table ${versionTable} from anon, authenticated, public;
+
+-- bumps each listed user once, skipping users already deleted from auth.users; no client role may call it
+create or replace function ${bumpFor}(p_users uuid[])
+returns void
+language sql
+security definer
+set search_path = ''
+as $$
+  insert into ${versionTable} as v (user_id, version)
+  select distinct u, 1 from unnest(p_users) u
+  where u is not null and exists (select 1 from auth.users au where au.id = u)
+  on conflict (user_id) do update set version = v.version + 1
+$$;
+revoke execute on function ${bumpFor}(uuid[]) from public, anon, authenticated;
+
+create or replace function ${bump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array[
+    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+  ]::uuid[]);
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${table(name)}
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+}
+const SUBJECT_FOR = "subject_for";
+/**
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
+* token for `p_user`, from the same membership, role, suspension and version
+* reads, plus the custom roles the user holds when `database` mode keeps them
+* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no
+* client role may execute it.
+*/
+function subjectForSql(parts, config) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${SUBJECT_FOR}`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return jsonb_build_object('id', uid::text, 'active', false);
+  end if;`;
+	const version = parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : "";
+	const custom = config.rls?.customRoles === true && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
+	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  held jsonb;
+  memberships jsonb;
+  custom jsonb := '[]'::jsonb;
+  ver bigint;${typedUsers(parts)}
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${suspended}
+${roles}
+  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
+    into memberships
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x;${custom}${version}
+  return jsonb_strip_nulls(jsonb_build_object(
+    'id', uid::text,
+    'active', true,
+    'roles', held,
+    'memberships', memberships,
+    'customRoles', custom,
+    'authzVersion', ver
+  ));
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const AUTHZ_VERSION_FOR = "authz_version_for";
+/**
+* `authz_version_for(p_user uuid) returns bigint`: the authorization version
+* `subject_for` reports, without reading roles or memberships, so a
+* `claimsFirst` reread can check a token's freshness on every request and read
+* the full subject only when it is behind. `null` for an unknown or suspended
+* user, and when the version is off.
+*/
+function authzVersionForSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
+	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns bigint
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  ver bigint;
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return null;
+  end if;`}${parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : ""}
+  return ver;
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const MEMBERS_OF = "members_of";
+function membersOfSql(parts) {
+	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
+	const keep = parts.sources.some((source) => source.sql.keeps);
+	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
+	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
+create or replace function ${fn}(p_scope text, p_id text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(jsonb_agg(jsonb_build_object(
+      'principal', jsonb_build_object('id', s.user_id),
+      'membership', jsonb_strip_nulls(jsonb_build_object(
+        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
+      ))
+    ) order by s.user_id, s.roles::text), '[]'::jsonb)
+  from (
+${rows}
+  ) s
+$$;
+revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
+}
+/**
+* The custom roles `p_user` holds: tenant roles named on a membership of the
+* scope (and instance) they live at, and platform roles among the global
+* roles, each with its grants and includes in `CustomRole` form.
+*/
+function customRolesOfSql(parts) {
+	const helpers = quoteIdent(parts.helpers.schema);
+	const perms = `${helpers}.custom_role_permissions`;
+	const includes = `${helpers}.custom_role_includes`;
+	const root = quoteLiteral(parts.root);
+	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
+	return `
+  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+      'name', c.role,
+      'tenant', c.tenant_id::text,
+      'scope', c.scope,
+      'id', c.scope_id,
+      'grants', (
+        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+            'permission', p.permission,
+            'effect', p.effect,
+            'level', to_jsonb(p) ->> 'level'
+          )) order by p.permission, p.effect), '[]'::jsonb)
+        from ${perms} p
+        where ${match}
+      ),
+      'includes', (
+        select jsonb_agg(p.include_role order by p.include_role)
+        from ${includes} p
+        where ${match}
+      )
+    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
+    into custom
+    from (
+      select tenant_id, scope, scope_id, role from ${perms}
+      union
+      select tenant_id, scope, scope_id, role from ${includes}
+    ) c
+    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
+      or exists (
+        select 1
+        from jsonb_array_elements(memberships) m
+        where m -> 'roles' ? c.role
+          and m ->> 'scope' = c.scope
+          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (c.scope_id is null or c.scope_id = m ->> 'id')
+      );`;
+}
+function signedUp(user) {
+	return `exists (select 1 from auth.users a where a.id = ${user})`;
+}
+/**
+* Every membership source whose user id lives in another table: a row of
+* the source bumps the users its old and new references hold, and a change
+* of that table's user id (a contact re-linked to another login) bumps the
+* old and the new user.
+*/
+function memberUsersVersionSql(parts, bumpFor) {
+	const holders = /* @__PURE__ */ new Map();
+	for (const source of parts.sources) {
+		const users = source.sql.userThrough;
+		if (users !== void 0) holders.set(JSON.stringify([
+			tableKey(source.sql.table),
+			tableKey(users.table),
+			users.id,
+			users.key,
+			users.ref
+		]), {
+			table: source.sql.table,
+			users
+		});
+	}
+	if (holders.size === 0) return "";
+	const byTable = /* @__PURE__ */ new Map();
+	for (const holder of holders.values()) {
+		const key = tableKey(holder.table);
+		const group = byTable.get(key);
+		if (group === void 0) byTable.set(key, {
+			table: holder.table,
+			users: [holder.users]
+		});
+		else group.users.push(holder.users);
+	}
+	const memberBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_member_users`;
+	const linkedBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_linked_users`;
+	const groups = [...byTable];
+	const lookup = (users, indent) => `${indent}perform ${bumpFor}(array(
+${indent}  select u.${quoteIdent(users.key)}::uuid from ${table(users.table)} u
+${indent}  where ((tg_op <> 'INSERT' and u.${quoteIdent(users.id)} = old.${quoteIdent(users.ref)})
+${indent}     or (tg_op <> 'DELETE' and u.${quoteIdent(users.id)} = new.${quoteIdent(users.ref)}))
+${indent}    and ${signedUp(`u.${quoteIdent(users.key)}::uuid`)}
+${indent}));`;
+	const body = groups.map(([key, group]) => {
+		if (groups.length === 1) return group.users.map((users) => lookup(users, "  ")).join("\n");
+		const dot = key.indexOf(".");
+		return `  if tg_table_schema = ${quoteLiteral(key.slice(0, dot))} and tg_table_name = ${quoteLiteral(key.slice(dot + 1))} then
+${group.users.map((users) => lookup(users, "    ")).join("\n")}
+  end if;`;
+	}).join("\n");
+	const memberTriggers = groups.map(([, group]) => {
+		const target = table(group.table);
+		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${target}
+  for each row execute function ${memberBump}();`;
+	}).join("\n");
+	const userTables = /* @__PURE__ */ new Map();
+	for (const { users } of holders.values()) {
+		const key = JSON.stringify([tableKey(users.table), users.key]);
+		const entry = userTables.get(key) ?? {
+			table: users.table,
+			key: users.key,
+			ids: /* @__PURE__ */ new Set()
+		};
+		entry.ids.add(users.id);
+		userTables.set(key, entry);
+	}
+	const userTriggers = [...userTables.values()].map((entry) => {
+		const target = table(entry.table);
+		const name = quoteIdent(`${VERSION_TRIGGER}_${entry.key}`);
+		return `drop trigger if exists ${name} on ${target};
+create trigger ${name}
+  after update of ${[entry.key, ...entry.ids].map(quoteIdent).join(", ")} or delete on ${target}
+  for each row execute function ${linkedBump}(${quoteLiteral(entry.key)});`;
+	}).join("\n");
+	return `
+
+-- a membership whose user id lives in another table bumps the users its old and new rows reference
+create or replace function ${memberBump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+${body}
+  return null;
+end;
+$$;
+revoke execute on function ${memberBump}() from public, anon, authenticated;
+${memberTriggers}
+
+-- re-linking that table's user id moves every membership that references the row: bump the old and the new user,
+-- skipping a login being deleted (its version row goes with it)
+create or replace function ${linkedBump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array(
+    select u
+    from unnest(array[
+      case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+      case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+    ]::uuid[]) u
+    where ${signedUp("u")}
+  ));
+  return null;
+end;
+$$;
+revoke execute on function ${linkedBump}() from public, anon, authenticated;
+${userTriggers}`;
+}
+/** Every table whose role column references a roles table: the global roles and the membership sources. */
+function roleKeyHolders(parts) {
+	const holders = [];
+	if (parts.roles?.through !== void 0) holders.push({
+		table: parts.roles.table,
+		user: parts.roles.user,
+		through: parts.roles.through
+	});
+	for (const source of parts.sources) for (const through of source.sql.throughs) holders.push({
+		table: source.sql.table,
+		user: source.sql.user,
+		...source.sql.userThrough === void 0 ? {} : { userThrough: source.sql.userThrough },
+		through
+	});
+	const seen = /* @__PURE__ */ new Set();
+	return holders.filter((holder) => {
+		const key = JSON.stringify([
+			tableKey(holder.table),
+			holder.user,
+			holder.userThrough === void 0 ? null : [
+				tableKey(holder.userThrough.table),
+				holder.userThrough.id,
+				holder.userThrough.key
+			],
+			tableKey(holder.through.table),
+			holder.through.id,
+			holder.through.key,
+			holder.through.ref
+		]);
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+/** The bump for one roles table: unchanged keys and ids return early, else every holder of `old` is bumped. */
+function roleKeysBumpSql(holders, versionTable, indent) {
+	return `${indent}if tg_op = 'UPDATE'
+${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, holder.through.id]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
+${indent}  return null;
+${indent}end if;
+${indent}insert into ${versionTable} as v (user_id, version)
+${indent}select distinct h.user_id, 1
+${indent}from (
+${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${table(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${table(holder.table)} h join ${table(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
+${indent}) h
+${indent}where h.user_id is not null
+${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
+${indent}on conflict (user_id) do update set version = v.version + 1;`;
+}
+/**
+* A renamed role key changes the `roles` claim of everyone who holds it and
+* the `roles` of every membership that references it, so updates to a roles
+* table bump each holder.
+*/
+function roleKeysVersionSql(parts, versionTable) {
+	const holders = roleKeyHolders(parts);
+	if (holders.length === 0) return "";
+	const byTable = /* @__PURE__ */ new Map();
+	for (const holder of holders) {
+		const key = tableKey(holder.through.table);
+		const group = byTable.get(key);
+		if (group === void 0) byTable.set(key, {
+			table: holder.through.table,
+			holders: [holder]
+		});
+		else group.holders.push(holder);
+	}
+	const bump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_role_keys`;
+	const groups = [...byTable];
+	return `
+
+-- a renamed role key changes the roles of everyone who holds it, globally or through a membership
+create or replace function ${bump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+${groups.map(([key, group]) => {
+		if (groups.length === 1) return roleKeysBumpSql(group.holders, versionTable, "  ");
+		const dot = key.indexOf(".");
+		return `  if tg_table_schema = ${quoteLiteral(key.slice(0, dot))} and tg_table_name = ${quoteLiteral(key.slice(dot + 1))} then
+${roleKeysBumpSql(group.holders, versionTable, "    ")}
+  end if;`;
+	}).join("\n")}
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${groups.map(([, group]) => {
+		const target = table(group.table);
+		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after update or delete on ${target}
+  for each row execute function ${bump}();`;
+	}).join("\n")}`;
+}
+/**
+* Fails the migration when a client role can write an `attrs` column: a
+* claim the user can set is not a server-owned attribute.
+*/
+function attrsGuardSql(plan) {
+	if (plan?.table === void 0 || plan.columns.length === 0) return "";
+	const target = quoteLiteral(table(plan.table));
+	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
+do $$
+begin
+  if exists (
+    select 1
+    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
+    cross join (values ('anon'), ('authenticated')) r(role)
+    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
+       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
+  ) then
+    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
+      using errcode = '42501';
+  end if;
+end
+$$;`;
+}
+function managedSql(parts) {
+	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
+	if (managed.length === 0) return "";
+	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
+	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
+create or replace function ${guard}()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  if current_user in ('anon', 'authenticated') and (
+    column_name = ''
+    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
+    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
+  ) then
+    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
+      using errcode = '42501';
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${table(source.sql.table)};
+create trigger ${quoteIdent(MANAGED_TRIGGER)}
+  before insert or update or delete on ${table(source.sql.table)}
+  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
+}
+/** The `config.toml` block that enables the hook and bounds token staleness. */
+function configToml(schema, jwtExpiry) {
+	return `[auth]
+jwt_expiry = ${String(jwtExpiry)}
+
+[auth.hook.custom_access_token]
+enabled = true
+uri = "${hookUri(schema)}"`;
+}
+const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
+function hookParts(scopes, config, overrides) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
+	const root = rootScope(scopes) ?? "tenant";
+	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
+	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
+	quoteIdent(schema);
+	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
+	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
+	checkSources({
+		sources: hook.memberships,
+		scopes
+	});
+	const parts = {
+		schema,
+		scopes,
+		root,
+		sources: hook.memberships,
+		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
+		version: hook.version !== false,
+		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
+		tenantClaim,
+		users: suspension?.users,
+		hook,
+		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r"),
+		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
+		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
+		extra: extraPlan.claims,
+		before: beforePlan(hook.before),
+		helpers: {
+			schema: config.rls?.schema ?? "permdock",
+			...memberForPlan({
+				scopes,
+				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
+				memberSources: config.rls?.membershipSources ?? hook.memberships
+			})
+		}
+	};
+	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
+	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
+	quoteIdent(parts.tenantClaim);
+	return parts;
+}
+function permdockClaim(name, budget = false) {
+	return {
+		name,
+		source: "permdock",
+		budget
+	};
+}
+function hookClaims(parts) {
+	return [
+		permdockClaim("user_role"),
+		permdockClaim("roles"),
+		permdockClaim("memberships", true),
+		permdockClaim("memberships_truncated"),
+		permdockClaim(parts.tenantClaim),
+		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
+		...parts.version ? [permdockClaim("authz_ver")] : [],
+		...parts.extra.map((entry) => ({
+			name: entry.claim,
+			source: entry.fn,
+			budget: false
+		}))
+	];
+}
+//#endregion
+//#region src/cli/supabase-hook-manifest.ts
+function helperList(parts, types) {
+	const client = ["authenticated"];
+	return [helperEntry(HELPERS.has, "p_grant text", "boolean", client), ...parts.scopes.flatMap((scope) => {
+		const returns = `setof ${types.get(scope.name) ?? "uuid"}`;
+		return [
+			helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
+			helperEntry(memberIdsHelper(scope.name), "", returns, client),
+			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : []
+		];
+	})];
+}
+function helperEntry(name, args, returns, execute) {
+	return {
+		name,
+		args,
+		returns,
+		execute
+	};
+}
+/**
+* The helpers `rls generate` writes beyond the ones the hook's claims feed:
+* the `_for` forms in `database` mode, and the assignment checks when a role
+* declares `assigns` (known only with the policy).
+*/
+function trustedHelpers(parts, config, types, tenantType, policy) {
+	const database = resolveAuthorize(config) === "database";
+	const custom = database && config.rls?.customRoles === true;
+	const everyFor = parts.scopes.every((scope) => parts.helpers.memberFor.includes(scope.name));
+	const client = ["authenticated"];
+	const scopeTypes = parts.scopes.map((scope) => [scope.name, types.get(scope.name) ?? "uuid"]);
+	const forUser = database ? [
+		helperEntry(HELPERS.hasFor, "p_user uuid, p_grant text", "boolean", []),
+		...scopeTypes.map(([scope, type]) => helperEntry(permittedForHelper(scope), "p_user uuid, p_grant text", `setof ${type}`, [])),
+		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", []))
+	] : [];
+	const keyed = [
+		helperEntry(USER_ID_HELPER, "", "uuid", client),
+		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...forUser
+	];
+	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
+	const customArgs = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text`;
+	const anyArgs = `p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text`;
+	return [
+		...keyed,
+		helperEntry(OWNERSHIP.canAssign, "p_role text, p_scope_id text", "boolean", client),
+		...database ? [helperEntry(OWNERSHIP.canAssignFor, "p_user uuid, p_role text, p_scope_id text", "boolean", [])] : [],
+		...custom ? [helperEntry(ASSIGNMENTS.custom, customArgs, "boolean", client)] : [],
+		...custom && everyFor ? [helperEntry(ASSIGNMENTS.customFor, `p_user uuid, ${customArgs}`, "boolean", [])] : [],
+		helperEntry(OWNERSHIP.canAssignAny, anyArgs, "boolean", client),
+		...database && (!custom || everyFor) ? [helperEntry(OWNERSHIP.canAssignAnyFor, `p_user uuid, ${anyArgs}`, "boolean", [])] : []
+	];
+}
+function activeRowManifest(row) {
+	const keep = "keep" in row ? keptKeys(row) : [];
+	return {
+		table: qualifiedTable(row.table),
+		id: row.id,
+		...row.disabledAt === void 0 ? {} : { disabledAt: row.disabledAt },
+		...row.status === void 0 ? {} : { status: row.status },
+		...row.active === void 0 ? {} : { active: row.active },
+		...keep.length === 0 ? {} : { keep }
+	};
+}
+/** The `rls` settings a package writing SQL next to the helpers reads: custom roles, global roles, suspension and assignment triggers. */
+function rlsSettings(parts, config) {
+	const rls = config.rls;
+	const suspension = checkSuspension(rls?.suspension, parts.scopes);
+	const scopes = Object.entries(suspension?.scopes ?? {});
+	const assigned = rls?.assignments === void 0 ? void 0 : guardedTables(config, parts.scopes);
+	return {
+		customRoles: resolveAuthorize(config) === "database" && rls?.customRoles === true,
+		...parts.roles === void 0 ? {} : { roles: {
+			table: qualifiedTable(parts.roles.table),
+			user: { column: parts.roles.user },
+			role: parts.roles.role
+		} },
+		...suspension === void 0 ? {} : { suspension: {
+			...suspension.users === void 0 ? {} : { users: activeRowManifest(suspension.users) },
+			...scopes.length === 0 ? {} : { scopes: Object.fromEntries(scopes.map(([name, row]) => [name, activeRowManifest(row)])) },
+			...suspension.memberships === void 0 ? {} : { memberships: { keep: keptKeys(suspension.memberships) } }
+		} },
+		...assigned === void 0 ? {} : { assignments: { tables: assigned } },
+		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) }
+	};
+}
+/** The `supabase/sdk` release `requires.capabilities` names features of. */
+const CAPABILITY_MATRIX = "capability-matrix-v1.12.0";
+function usesLiveSession(policy) {
+	return [...policy?.grants ?? [], ...policy?.roles.flatMap((binding) => binding.grants) ?? []].some((grant) => hasConditionOp(grant.where, "liveSession") || hasConditionOp(grant.check, "liveSession"));
+}
+function requiredCapabilities(config, policy) {
+	const ids = /* @__PURE__ */ new Set(["auth.session.get_claims"]);
+	if (usesLiveSession(policy)) ids.add("auth.session.get_user");
+	if (config.rls?.realtime !== void 0) ids.add("realtime.subscriptions.private_channel");
+	for (const bucket of Object.values(config.rls?.storage?.buckets ?? {})) {
+		if (bucket.read !== void 0) {
+			ids.add("storage.file_buckets.download");
+			ids.add("storage.file_buckets.list_files");
+		}
+		if (bucket.write !== void 0) {
+			ids.add("storage.file_buckets.upload");
+			ids.add("storage.file_buckets.update_file");
+			ids.add("storage.file_buckets.move");
+		}
+		if (bucket.delete !== void 0) ids.add("storage.file_buckets.remove");
+	}
+	return {
+		matrix: CAPABILITY_MATRIX,
+		capabilities: [...ids].toSorted()
+	};
+}
+function manifestOf(parts, out, config, policy) {
+	const rls = config.rls;
+	const ctx = {
+		dialect: "supabase",
+		scopes: parts.scopes,
+		tenantClaim: parts.tenantClaim,
+		gucPrefix: rls?.gucPrefix ?? "app",
+		tenantType: rls?.tenantType ?? "uuid",
+		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes }
+	};
+	const types = new Map(parts.scopes.map((scope) => [scope.name, scopeTypeOf(ctx, scope.name)]));
+	const helpers = helperList(parts, types);
+	return {
+		$schema: SUPABASE_MANIFEST_SCHEMA,
+		version: 1,
+		hook: {
+			schema: parts.schema,
+			function: "custom_access_token_hook",
+			out,
+			...parts.before.length === 0 ? {} : { before: parts.before }
+		},
+		helpers: {
+			schema: parts.helpers.schema,
+			functions: helpers.map((entry) => entry.name)
+		},
+		tenantClaim: parts.tenantClaim,
+		budget: {
+			bytes: parts.budget,
+			measure: BUDGET_MEASURE
+		},
+		claims: hookClaims(parts),
+		authzVersion: parts.version,
+		...parts.version ? { authzVersionBump: {
+			schema: parts.schema,
+			function: AUTHZ_VERSION_BUMP,
+			args: "p_users uuid[]"
+		} } : {},
+		memberships: parts.sources.map((source) => source.sql.manifest),
+		rls: {
+			schema: parts.helpers.schema,
+			mode: resolveAuthorize(config),
+			tenantClaim: parts.tenantClaim,
+			scopes: parts.scopes.map((scope) => ({
+				name: scope.name,
+				type: types.get(scope.name) ?? "uuid",
+				...scope.within === void 0 ? {} : { within: scope.within }
+			})),
+			helpers: [...helpers, ...trustedHelpers(parts, config, types, tenantTypeOf(ctx), policy)],
+			memberships: parts.helpers.memberships,
+			...rlsSettings(parts, config)
+		},
+		decidingColumns: decidingColumns(config, parts.attrs === void 0 ? void 0 : {
+			...parts.attrs.table === void 0 ? {} : { table: parts.attrs.table },
+			columns: parts.attrs.columns
+		}),
+		markers: {
+			hook: "v1",
+			grants: "v1"
+		},
+		requires: requiredCapabilities(config, policy)
+	};
+}
+/** The first line of the generated hook: fields `--check` compares before the full text. */
+function hookMarker(manifest) {
+	return `${HOOK_MARKER} schema=${manifest.hook.schema} tenant=${manifest.tenantClaim} budget=${String(manifest.budget.bytes)} claims=${manifest.claims.map((claim) => claim.name).join(",")}`;
+}
+function defaultOut(config) {
+	return config.supabase?.hook?.out ?? "supabase/permdock-hook.sql";
+}
+//#endregion
+//#region src/cli/supabase-setup.ts
+const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
+function escape(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+function helpersDefined(sql, schema) {
+	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
+	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
+	const names = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(create)) {
+		const name = (match[1] ?? "").toLowerCase();
+		if (HELPER_NAME.test(name)) names.add(name);
+	}
+	return names;
+}
+/**
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
+* its `helpers` part when it has `{part}`), the SQL files next to the hook,
+* and the migration folders, not the hook itself.
+*/
+function helperSources(cwd, config, hookOut) {
+	const hook = resolve(cwd, hookOut);
+	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
+	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
+	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
+	const beside = dirname(hook);
+	if (existsSync(beside)) {
+		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
+	}
+	files.delete(hook);
+	return [...files];
+}
+function missingHelpersInFiles(cwd, config, manifest) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
+	return manifest.helpers.functions.filter((name) => !found.has(name));
+}
+async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
+	const client = await connect(db);
+	try {
+		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
+		const found = new Set(result.rows.map((row) => row["proname"]));
+		return manifest.helpers.functions.filter((name) => !found.has(name));
+	} finally {
+		await client.end();
+	}
+}
+function missingHelpersMessage(manifest, missing) {
+	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
+}
+/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+function oversizedClaims(samples, manifest) {
+	const encoder = new TextEncoder();
+	const oversized = [];
+	for (const claim of manifest.claims) {
+		if (claim.source === "permdock") continue;
+		let bytes = 0;
+		for (const sample of samples) {
+			if (sample === null || typeof sample !== "object") continue;
+			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
+			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
+		}
+		if (bytes > manifest.budget.bytes) oversized.push({
+			name: claim.name,
+			bytes
+		});
+	}
+	return oversized;
+}
+/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
+function droppedMemberships(samples) {
+	const out = [];
+	for (const [index, sample] of samples.entries()) {
+		if (sample === null || typeof sample !== "object") continue;
+		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
+		const { dropped } = readMemberships(claim);
+		if (dropped.length > 0) out.push({
+			sample: index,
+			entries: dropped
+		});
+	}
+	return out;
+}
+function pd039(input) {
+	const findings = [];
+	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
+	if (missing.length > 0) findings.push({
+		code: "PD039",
+		severity: "warning",
+		message: missingHelpersMessage(input.manifest, missing).slice(6),
+		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
+	});
+	const fixture = input.config.doctor?.claims;
+	if (fixture !== void 0) {
+		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
+		const samples = Array.isArray(parsed) ? parsed : [];
+		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
+			fix: "return less from the claim function, or read the data per request instead of from the token"
+		});
+		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
+			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/supabase-hook.ts
+const SUPABASE_HELP = `permdock supabase hook generate | inspect
+
+  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
+                [--active-from app_metadata.active_<scope>|<table>.<column>]
+                [--budget 1024] [--schema public] [--grants-out <file>|-]
+  inspect [--json] [--out [permdock.manifest.json]] [--check]
+
+Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
+passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
+needs (the ones db diff drops in --grants-out, for declarative schemas), the permdock_authz_version table
+and its triggers. Never grants anything to
+service_role. inspect prints the manifest: helper schema, names and signatures, tenant claim,
+budget, the claims the hook writes, the membership sources and the columns that decide them.
+--out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
+file differs.
+`;
+const MANIFEST_FILE = "permdock.manifest.json";
+/** `supabase.hook.out`, else pg-delta's per-schema path, else `supabase/permdock-hook.sql`. */
+function hookOut(cwd, config, schema) {
+	const pgDelta = supabaseConfig(cwd).pgDelta;
+	return config.supabase?.hook?.out !== void 0 || pgDelta === void 0 ? defaultOut(config) : pgDeltaPath(pgDelta.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
+}
+/**
+* The manifest `supabase inspect` prints. With `policy`, `rls.helpers` also
+* lists the assignment checks `rls generate` writes for roles that declare
+* `assigns`.
+*/
+function supabaseHookManifest(scopes, config, overrides = {}, policy) {
+	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
+}
+/**
+* The hook migration. With `grantsOut`, the statements `supabase db diff`
+* drops are left out of `sql` and returned in `grants` for that file.
+*/
+function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
+	const parts = hookParts(scopes, config, overrides);
+	const manifest = manifestOf(parts, defaultOut(config), config);
+	const toml = configToml(parts.schema, parts.jwtExpiry).split("\n").map((line) => line === "" ? "--" : `--   ${line}`).join("\n");
+	const sql = [
+		`${hookMarker(manifest)}
+-- custom_access_token_hook(jsonb): memberships go active ${parts.root} first and stop at the budget
+-- supabase/config.toml:
+${toml}${grantsOut === void 0 ? "" : `\n-- what supabase db diff drops from this part is in ${grantsOut}`}`,
+		attrsGuardSql(parts.attrs),
+		hookSql(parts),
+		versionSql(parts),
+		subjectForSql(parts, config),
+		authzVersionForSql(parts),
+		membersOfSql(parts),
+		grantsSql(parts),
+		managedSql(parts)
+	].filter((chunk) => chunk !== "").join("\n\n");
+	const { kept, moved } = splitUndiffed(`${sql}\n`);
+	const grants = `${GRANTS_MARKER} schema=${parts.schema}
+-- the privileges and view options supabase db diff drops from the hook part
+${moved.join("\n")}
+`;
+	return {
+		sql: grantsOut === void 0 ? `${sql}\n` : kept,
+		grants,
+		manifest
+	};
+}
+/** What the hook file's header says about where its grants went. */
+function grantsLabel(grantsOut) {
+	if (grantsOut === void 0) return;
+	return grantsOut === "-" ? "a separate migration" : grantsOut;
+}
+function markerDrift(onDisk, expected, outRel) {
+	const found = hookMarkerFields(onDisk);
+	if (found === void 0) return `supabase hook drift: ${outRel} has no ${HOOK_MARKER} line`;
+	const want = hookMarkerFields(hookMarker(expected)) ?? {};
+	const changed = Object.keys(want).filter((key) => found[key] !== want[key]).map((key) => `${key} ${found[key] ?? "(none)"} -> ${want[key] ?? ""}`);
+	return changed.length === 0 ? "supabase hook drift" : `supabase hook drift: ${changed.join("; ")}`;
+}
+function inspectText(manifest) {
+	return [
+		`hook ${manifest.hook.schema}.${manifest.hook.function} (${manifest.hook.out})`,
+		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
+		`tenant claim ${manifest.tenantClaim}`,
+		`budget ${String(manifest.budget.bytes)} bytes of ${manifest.budget.measure}`,
+		`claims ${manifest.claims.map((claim) => `${claim.name}${claim.source === "permdock" ? "" : ` (${claim.source})`}${claim.budget ? " [budget]" : ""}`).join(", ")}`,
+		`authz_ver ${manifest.authzVersion ? "on" : "off"}`
+	].join("\n");
+}
+/**
+* Writes the manifest to `rel`, or with `check` compares it as JSON, so a
+* formatter that reflows the file is not drift.
+*/
+function manifestFile(cwd, rel, manifest, check) {
+	const path = resolve(cwd, rel);
+	if (!check) {
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+		return {
+			code: 0,
+			output: `wrote ${rel}`
+		};
+	}
+	if (!existsSync(path)) return {
+		code: 1,
+		output: `supabase manifest drift: missing ${rel}`
+	};
+	let onDisk;
+	try {
+		onDisk = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		return {
+			code: 1,
+			output: `supabase manifest drift: ${rel} is not JSON`
+		};
+	}
+	const found = typeof onDisk === "object" && onDisk !== null && !Array.isArray(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
+	const changed = [.../* @__PURE__ */ new Set([...Object.keys(manifest), ...Object.keys(found)])].filter((key) => JSON.stringify(Reflect.get(manifest, key)) !== JSON.stringify(found[key]));
+	return changed.length === 0 ? {
+		code: 0,
+		output: "supabase manifest up to date"
+	} : {
+		code: 1,
+		output: `supabase manifest drift: ${rel} differs in ${changed.join(", ")}; run permdock supabase inspect --out ${rel}`
+	};
+}
+async function loadScopes(cwd, config) {
+	return scopeList((await loadHookPolicy(cwd, config)).scopes);
+}
+async function loadHookPolicy(cwd, config) {
+	if (config.policy === void 0) throw new Error("PermDock CLI: supabase hook generate needs policy in permdock.config.ts");
+	return asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
+}
+async function runSupabase(input) {
+	const [area, action] = input.rest;
+	const overrides = Object.fromEntries(Object.entries({
+		activeFrom: input.activeFrom,
+		budget: input.budget,
+		schema: input.schema
+	}).filter(([, value]) => value !== void 0));
+	if (area === "inspect" && action === void 0) {
+		const policy = await loadHookPolicy(input.cwd, input.config);
+		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
+			...overrides,
+			out: hookOut(input.cwd, input.config, input.schema)
+		}, policy);
+		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
+		return {
+			code: 0,
+			output: input.json === true ? JSON.stringify(manifest, null, 2) : inspectText(manifest)
+		};
+	}
+	if (area !== "hook" || action !== "generate") return {
+		code: 2,
+		output: SUPABASE_HELP
+	};
+	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema);
+	const outPath = resolve(input.cwd, outRel);
+	const hook = input.config.supabase?.hook;
+	const grantsFile = input.grantsOut === void 0 ? [] : [{
+		part: "grants",
+		rel: input.grantsOut,
+		text: grants
+	}];
+	const toml = configToml(input.schema ?? hook?.schema ?? input.config.rls?.schema ?? "permdock", hook?.jwtExpiry ?? 900);
+	if (input.check) {
+		if (!existsSync(outPath)) return {
+			code: 1,
+			output: `supabase hook drift: missing ${outRel}`
+		};
+		const onDisk = readFileSync(outPath, "utf8");
+		if (onDisk !== sql) return {
+			code: 1,
+			output: markerDrift(onDisk, manifest, outRel)
+		};
+		const drift = driftOf(input.cwd, grantsFile);
+		return drift.length === 0 ? {
+			code: 0,
+			output: "supabase hook up to date"
+		} : {
+			code: 1,
+			output: `supabase hook drift: ${drift.join("; ")}`
+		};
+	}
+	mkdirSync(dirname(outPath), { recursive: true });
+	writeFileSync(outPath, sql);
+	const grantsWritten = writeSqlFiles(input.cwd, grantsFile);
+	const placed = {
+		...manifest,
+		hook: {
+			...manifest.hook,
+			out: outRel
+		}
+	};
+	const missing = input.db === void 0 ? missingHelpersInFiles(input.cwd, input.config, placed) : await missingHelpersInDb(input.db, placed);
+	return {
+		code: 0,
+		output: [
+			`wrote ${[outRel, ...grantsWritten.wrote].join(", ")}`,
+			...grantsWritten.printed === "" ? [] : [grantsWritten.printed],
+			"add to supabase/config.toml:",
+			toml,
+			...missing.length === 0 ? [] : [missingHelpersMessage(placed, missing)]
+		].join("\n")
+	};
+}
+//#endregion
+export { seedsMigration as _, supabaseHookManifest as a, attrsPlan as c, resolveAuthorize as d, driftOf as f, pgDeltaPath as g, partPath as h, runSupabase as i, parseRbacAuthorize as l, parseSplit as m, hookOut as n, supabaseHookSql as o, isSeedsDirectory as p, loadScopes as r, pd039 as s, grantsLabel as t, rbacScaffold as u, writeSqlFiles as v };