permdock 0.1.0 → 0.2.0

package/dist/{supabase-hook-D_OqGb_V.js → supabase-hook-BuxLQLpU.js}

@@ -1,404 +1,238 @@
-import { a as resolveScope, c as scopeChain, s as rootScope, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { r as SUPABASE_MANIFEST_SCHEMA } from "./version-CnSh33Fj.js";
-import { i as sqlFiles, r as rel } from "./files-B_wAGYmt.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
+import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BvacVTZR.js";
+import { a as sqlFiles } from "./files-DWUN9PzI.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { r as scopeColumn } from "./compile-D22iwvuV.js";
-import { o as authorizeSql, r as readMemberships } from "./supabase-DTxGtYdi.js";
+import { r as scopeColumn } from "./compile-Ba4blROR.js";
+import { t as authorizeSql } from "./supabase-DTBaC20O.js";
 import "./budget-NbEtbJC_.js";
-import { t as AUTHZ_VERSION_TABLE } from "./sources-DVHM3Mwq.js";
+import { c as roleManifest, l as keptKeys, t as AUTHZ_VERSION_TABLE } from "./sources-B0UvrJ21.js";
+import { i as readMemberships } from "./manifest-iaoBXHKc.js";
 import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { A as memberForSources, E as hasMemberFor, H as scopeTypeOf, I as quoteIdent, L as quoteLiteral, M as memberIdsHelper, R as quoteTable, h as activeRowSql, j as memberForTable, k as memberForHelper, p as globalRoleSource, y as checkSuspension } from "./rls-helpers-BxRuif0l.js";
-import { r as FIELD_VIEWS, t as connectPg, y as roleNames } from "./pg-4GJWDUxG.js";
+import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
+import { E as hasMemberFor, F as memberForSources, G as quoteLiteral, H as permittedIdsHelper, I as memberForTable, K as quoteTable, L as memberIdsHelper, P as memberForHelper, R as memberRoleOf, U as qualifiedTable, V as permittedForHelper, W as quoteIdent, Z as scopeTypeOf, f as USER_ID_HELPER, h as activeRowSql, it as tenantTypeOf, n as HELPERS, v as checkSuspension } from "./rls-shared-aOQ4hGTO.js";
+import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-BMasREhR.js";
+import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-B5Lkq62W.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, posix, resolve } from "node:path";
-import { createRequire } from "node:module";
-import { parse } from "smol-toml";
-//#region src/cli/deciding-columns.ts
-/** `schema.table`, unquoted and lower case; `public` when unqualified. */
-function tableKey(name) {
-	const parts = name.split(".").map((part) => part.replaceAll("\"", ""));
-	return (parts.length === 1 ? ["public", ...parts] : parts).join(".").toLowerCase();
-}
-/**
-* The columns of each membership source's table that decide who holds which
-* membership (user, scope, id, `within`, role, `via`, expiry), keyed by
-* {@link tableKey}. A client that can write one can give itself a membership.
-*/
-function membershipColumns(config) {
-	const sources = config.supabase?.hook?.memberships ?? config.rls?.membershipSources ?? [];
-	const byTable = /* @__PURE__ */ new Map();
-	for (const source of sources) {
-		const table = tableKey(source.sql.table);
-		const columns = byTable.get(table) ?? /* @__PURE__ */ new Set();
-		for (const column of source.sql.columns) columns.add(column);
-		byTable.set(table, columns);
-	}
-	return byTable;
-}
-/**
-* Every `schema.table.column` a claim or a membership is computed from: the
-* membership columns and the `attrs` table columns. Sorted.
-*/
-function decidingColumns(config, attrs) {
-	const entries = /* @__PURE__ */ new Set();
-	for (const [table, columns] of membershipColumns(config)) for (const column of columns) entries.add(`${table}.${column}`);
-	if (attrs?.table !== void 0) {
-		const table = tableKey(attrs.table);
-		for (const column of attrs.columns) entries.add(`${table}.${column}`);
+import { dirname, join, resolve } from "node:path";
+/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
+function driftOf(cwd, files) {
+	const drift = [];
+	for (const file of files) {
+		if (file.rel === "-") continue;
+		const path = resolve(cwd, file.rel);
+		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
+		else {
+			const onDisk = readFileSync(path, "utf8");
+			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
+		}
 	}
-	return [...entries].toSorted();
+	return drift;
 }
-//#endregion
-//#region src/cli/sql-statements.ts
-function blankComments(sql) {
-	return sql.replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
-}
-/** Split on `;` outside string literals and dollar-quoted bodies. */
-function sqlStatements(sql) {
-	const text = blankComments(sql);
-	const statements = [];
-	const push = (start, end) => {
-		const body = text.slice(start, end);
-		const lead = body.length - body.trimStart().length;
-		const trimmed = body.trim();
-		if (trimmed !== "") statements.push({
-			line: text.slice(0, start + lead).split("\n").length,
-			text: trimmed
-		});
-	};
-	let start = 0;
-	let index = 0;
-	while (index < text.length) {
-		const char = text[index];
-		if (char === "'") {
-			const end = text.indexOf("'", index + 1);
-			index = end === -1 ? text.length : end + 1;
+/** Writes every file but the stdout ones, whose text it returns for printing. */
+function writeSqlFiles(cwd, files) {
+	const wrote = [];
+	const printed = [];
+	for (const file of files) {
+		if (file.rel === "-") {
+			printed.push(file.text.trimEnd());
 			continue;
 		}
-		if (char === "$") {
-			const tag = /^\$[A-Za-z_]*\$/u.exec(text.slice(index, index + 64));
-			if (tag !== null) {
-				const end = text.indexOf(tag[0], index + tag[0].length);
-				index = end === -1 ? text.length : end + tag[0].length;
-				continue;
-			}
-		}
-		if (char === ";") {
-			push(start, index);
-			start = index + 1;
-		}
-		index += 1;
-	}
-	push(start, text.length);
-	return statements;
-}
-/** Capture group `index` of a match, or '' when an optional group took no part. */
-function group(match, index) {
-	return match[index] ?? "";
-}
-//#endregion
-//#region src/cli/doctor-project.ts
-function pd005(cwd) {
-	const lockPath = join(cwd, ".permdock/skills-lock.json");
-	if (![
-		join(cwd, ".agents/skills"),
-		join(cwd, ".claude/skills"),
-		join(cwd, ".cursor/skills")
-	].some((folder) => existsSync(join(folder, "permdock/SKILL.md")))) return [{
-		code: "PD005",
-		severity: "warning",
-		message: "Agent Skills are not installed",
-		fix: "pnpm exec permdock skills install"
-	}];
-	if (!existsSync(lockPath)) return [{
-		code: "PD005",
-		severity: "warning",
-		message: "skills lock is missing",
-		fix: "pnpm exec permdock skills install"
-	}];
-	return [];
-}
-function pd006(cwd) {
-	try {
-		const pkg = createRequire(resolve(cwd, "package.json"))("typescript/package.json");
-		const major = Number(pkg.version.split(".")[0]);
-		if (major < 5 || major === 5 && Number(pkg.version.split(".")[1]) < 9) return [{
-			code: "PD006",
-			severity: "error",
-			message: `TypeScript ${pkg.version} is below the supported matrix (5.9, 6, 7)`,
-			fix: "upgrade typescript to 5.9 or later"
-		}];
-		if (major > 7) return [{
-			code: "PD006",
-			severity: "error",
-			message: `TypeScript ${pkg.version} is not in the supported matrix (5.9, 6, 7)`,
-			fix: "use TypeScript 5.9, 6 or 7"
-		}];
-		return [];
-	} catch {
-		return [{
-			code: "PD006",
-			severity: "error",
-			message: "typescript is not installed",
-			fix: "add typescript 5.9, 6 or 7"
-		}];
+		const path = resolve(cwd, file.rel);
+		mkdirSync(dirname(path), { recursive: true });
+		writeFileSync(path, file.text);
+		wrote.push(file.rel);
 	}
+	return {
+		wrote,
+		printed: printed.join("\n")
+	};
 }
-function pd009(cwd) {
-	const copies = [];
-	function walk(dir, depth) {
-		if (depth > 6 || !existsSync(dir)) return;
-		const pkg = join(dir, "node_modules/permdock/package.json");
-		if (existsSync(pkg)) copies.push(pkg);
-		if (!existsSync(join(dir, "node_modules"))) return;
-		for (const name of readdirSync(join(dir, "node_modules"))) {
-			if (name.startsWith(".")) continue;
-			const nested = join(dir, "node_modules", name);
-			try {
-				if (statSync(nested).isDirectory()) walk(nested, depth + 1);
-			} catch {}
-		}
-	}
-	walk(cwd, 0);
-	if (copies.length > 1) return [{
-		code: "PD009",
-		severity: "error",
-		message: `duplicate permdock copies: ${copies.map((item) => rel(cwd, dirname(item))).join(", ")}`,
-		fix: "dedupe so only one permdock version is installed"
-	}];
-	return [];
+const PARTS = [
+	"helpers",
+	"seeds",
+	"indexes",
+	"policies",
+	"hook"
+];
+/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
+function parseSplit(raw) {
+	if (raw === void 0) return;
+	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
+	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
+	return PARTS.filter((part) => names.includes(part));
 }
-function pd012(cwd, config) {
-	const docs = config.openapi?.doc ?? [];
-	const findings = [];
-	for (const doc of docs) {
-		const abs = resolve(cwd, doc);
-		if (!existsSync(abs)) continue;
-		const text = readFileSync(abs, "utf8");
-		if (text.includes("\"drafts\"") && !text.includes("overlay")) findings.push({
-			code: "PD012",
-			severity: "warning",
-			message: `${doc} carries a draft pin the CLI no longer emits`,
-			fix: "regenerate with permdock openapi"
-		});
-	}
-	return findings;
+/** The path of one split part: `{part}` in `out` replaced by the part name. */
+function partPath(out, part) {
+	return out.replaceAll("{part}", part);
 }
-const MIGRATION_DIRS = [
-	"supabase/migrations",
-	"supabase/schemas",
-	"migrations",
-	"drizzle",
-	"prisma/migrations",
-	"db/migrations"
-];
-const VIEW_NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
-const CREATE_VIEW = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:temp(?:orary)?\s+)?(?:recursive\s+)?view\s+${VIEW_NAME}([\s\S]*?)\bas\b`, "giu");
-const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${VIEW_NAME}\s+set\s*\(([^)]*)\)`, "giu");
-const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
-const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
 /**
-* Views run as their owner unless `security_invoker` is set, so they read
-* past RLS on the tables beneath them. The `<table>_visible_fields`
-* companion `rls generate --revoke-columns` writes reads as its owner on
-* purpose and carries a comment that says so.
+* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
+* their dependencies, so no file needs a number to apply first.
 */
-function pd022(cwd, config) {
-	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
-	const created = /* @__PURE__ */ new Map();
-	const invoker = /* @__PURE__ */ new Set();
-	const companions = /* @__PURE__ */ new Set();
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
-		const raw = readFileSync(file, "utf8");
-		const text = raw.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
-		for (const [, name = "", options = ""] of text.matchAll(CREATE_VIEW)) {
-			const key = tableKey(name);
-			created.set(key, rel(cwd, file));
-			if (INVOKER.test(options)) invoker.add(key);
-			else invoker.delete(key);
-		}
-		for (const [, name = "", options = ""] of text.matchAll(ALTER_VIEW)) if (INVOKER.test(options)) invoker.add(tableKey(name));
-		for (const [, name = ""] of raw.matchAll(COMPANION)) companions.add(tableKey(name));
+function pgDeltaPath(root, part, schema) {
+	switch (part) {
+		case "helpers":
+		case "indexes":
+		case "seeds": return `${root}/${schema}/${part}.sql`;
+		case "policies": return `${root}/public/policies/permdock.sql`;
+		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
+		default: return part;
 	}
-	return [...created].filter(([key]) => !invoker.has(key) && !companions.has(key)).map(([key, file]) => ({
-		code: "PD022",
-		severity: "warning",
-		message: `view ${key} in ${file} is not security_invoker, so it reads past row level security`,
-		fix: `create the view with (security_invoker = true), or alter view ${key} set (security_invoker = true); Postgres 15 or later. For column-level reads, generate field views with permdock rls generate --fields views`
-	}));
 }
-const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
-/**
-* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
-* names its Postgres roles with `to authenticated` instead, and the role
-* claim it reads is the one PostgREST already switched to.
-*/
-function pd040(cwd, config) {
-	const findings = [];
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
-		const text = readFileSync(file, "utf8").replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
-		for (const match of text.matchAll(AUTH_ROLE)) {
-			const line = text.slice(0, match.index).split("\n").length;
-			findings.push({
-				code: "PD040",
-				severity: "warning",
-				message: `${rel(cwd, file)}:${String(line)} calls auth.role(), which Supabase deprecated`,
-				fix: "name the roles on the policy (create policy ... to authenticated) and drop the auth.role() = 'authenticated' test; call permdock_has or permitted_<scope>_ids for permissions"
-			});
-		}
-	}
-	return findings;
+/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
+function isSeedsDirectory(cwd, out) {
+	if (out === "-") return false;
+	if (out.endsWith("/")) return true;
+	const path = resolve(cwd, out);
+	return existsSync(path) && statSync(path).isDirectory();
+}
+/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
+function migrationVersion(now) {
+	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
 }
-const GRANT = /\b(grant|revoke)\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\w."]+)\s+(?:to|from)\s+([\w\s,"]+?)(?:\s+with\s+grant\s+option|\s+cascade|\s+restrict)?\s*;/giu;
-const CLIENT_ROLES = /* @__PURE__ */ new Set([
-	"anon",
-	"authenticated",
-	"public"
-]);
-function applyPrivilege(writable, verb, part) {
-	const match = /^\s*(all(?:\s+privileges)?|insert|update)\s*(?:\(([^)]*)\))?\s*$/iu.exec(part);
-	if (match === null) return;
-	const kind = (match[1] ?? "").toLowerCase();
-	const sets = kind === "insert" ? [writable.insert] : kind === "update" ? [writable.update] : [writable.insert, writable.update];
-	const columns = match[2] === void 0 ? ["*"] : match[2].split(",").map((column) => column.trim().replaceAll("\"", ""));
-	for (const set of sets) for (const column of columns) if (verb.toLowerCase() === "grant") set.add(column);
-	else if (column === "*") set.clear();
-	else set.delete(column);
-}
-const CREATE_TABLE = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
-const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
 /**
-* Columns of `table` a client role may insert or update, per the migrations
-* in order; `*` for every column. On Supabase a table created in `public`
-* starts writable: the default privileges grant `anon` and `authenticated`
-* everything, until a migration revokes them.
+* The seeds part in a migrations directory: the newest migration there that
+* starts with \`marker\` when its text is \`text\` already, otherwise a new
+* \`<version>_permdock_seeds.sql\`. \`current\` is false when a new one is due.
 */
-function clientWritable(cwd, config, target) {
-	const writable = {
-		insert: /* @__PURE__ */ new Set(),
-		update: /* @__PURE__ */ new Set()
+function seedsMigration(cwd, dir, marker, text, now) {
+	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
+	const path = resolve(cwd, base);
+	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
+	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
+		rel: `${base}/${latest}`,
+		current: true
+	};
+	return {
+		rel: `${base}/${migrationVersion(now)}_permdock_seeds.sql`,
+		current: false
 	};
-	let defaults = config.supabase !== void 0 && target.startsWith("public.");
-	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(readFileSync(file, "utf8"))) {
-		if (REVOKE_DEFAULT_TABLES.test(text)) {
-			defaults = false;
-			continue;
-		}
-		const created = CREATE_TABLE.exec(text);
-		if (created !== null) {
-			if (defaults && tableKey(created[1] ?? "") === target) {
-				writable.insert.add("*");
-				writable.update.add("*");
-			}
-			continue;
-		}
-		for (const [, verb = "", privileges = "", name = "", roles = ""] of `${text};`.matchAll(GRANT)) {
-			if (tableKey(name) !== target) continue;
-			if (!roles.split(",").map((role) => role.trim().replaceAll("\"", "").toLowerCase()).some((role) => CLIENT_ROLES.has(role))) continue;
-			for (const part of privileges.split(/,(?![^(]*\))/u)) applyPrivilege(writable, verb, part);
-		}
-	}
-	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
-}
-/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
-function membershipFindings(cwd, config) {
-	const findings = [];
-	for (const [table, columns] of membershipColumns(config)) {
-		const writable = clientWritable(cwd, config, table);
-		const exposed = [...columns].filter((column) => writable.has("*") || writable.has(column));
-		if (exposed.length > 0) findings.push({
-			code: "PD028",
-			severity: "warning",
-			message: `${table}.${exposed.join(", ")} decide${exposed.length === 1 ? "s" : ""} memberships, and the migrations let anon or authenticated insert or update ${exposed.length === 1 ? "it" : "them"}: a user could give themselves a membership`,
-			fix: `revoke insert, update on ${table} from anon, authenticated, then grant update (<columns clients edit>) on ${table} to authenticated; a column-level revoke alone leaves a table-level grant in place`
-		});
-	}
-	return findings;
 }
+//#endregion
+//#region src/cli/claims-schema.ts
 /**
-* `attrs` claims must come from server-owned columns: never `user_metadata`,
-* never a column clients can write. Membership sources' deciding columns are
-* held to the same rule.
+* The PermDock claims of `schemas/supabase-claims-v1.json` (its
+* `permdockClaims` and `membership` definitions), self-contained so
+* `supabase.hook.validate` can inline it into the hook for pg_jsonschema.
 */
-function pd028(cwd, config, plan) {
-	const memberships = membershipFindings(cwd, config);
-	const attrs = config.supabase?.hook?.attrs;
-	if (attrs === void 0) return memberships;
-	const planned = plan(attrs);
-	const findings = planned.errors.map((message) => ({
-		code: "PD028",
-		severity: "error",
-		message,
-		fix: "list server-owned columns or app_metadata.<key> entries; user_metadata is user-editable"
-	}));
-	if (planned.table !== void 0 && planned.columns.length > 0) {
-		const writable = clientWritable(cwd, config, tableKey(planned.table));
-		const exposed = planned.columns.filter((column) => writable.has("*") || writable.has(column));
-		if (exposed.length > 0) findings.push({
-			code: "PD028",
-			severity: "warning",
-			message: `attrs reads ${exposed.join(", ")} from ${tableKey(planned.table)}, which the migrations let anon or authenticated insert or update: a user could set their own attribute`,
-			fix: `revoke insert, update on ${tableKey(planned.table)} from anon, authenticated, and grant column-level update only on columns that are not attributes; the generated hook migration refuses to install otherwise`
-		});
-	}
-	return [...findings, ...memberships];
-}
-//#endregion
-//#region src/cli/supabase-config.ts
-const SUPABASE_CONFIG = "supabase/config.toml";
-function table$1(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-	return value;
-}
-function strings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
-}
-/** `supabase/config.toml`, parsed; `undefined` when the project has none. */
-function readSupabaseConfig(cwd) {
-	const file = join(cwd, SUPABASE_CONFIG);
-	if (!existsSync(file)) return;
-	let root;
-	try {
-		root = parse(readFileSync(file, "utf8"));
-	} catch (error) {
-		return {
-			ok: false,
-			error: error instanceof Error ? error.message : String(error)
-		};
-	}
-	const expiry = table$1(root["auth"])?.["jwt_expiry"];
-	const paths = table$1(table$1(root["db"])?.["migrations"])?.["schema_paths"];
-	const schemaPaths = strings(paths);
-	const apiSchemas = strings(table$1(root["api"])?.["schemas"]);
-	const pgDelta = table$1(table$1(root["experimental"])?.["pgdelta"]);
-	const schemaPath = pgDelta?.["declarative_schema_path"];
-	return {
-		ok: true,
-		config: {
-			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
-			...schemaPaths === void 0 ? {} : { schemaPaths },
-			...apiSchemas === void 0 ? {} : { apiSchemas },
-			...pgDelta?.["enabled"] === true ? { pgDelta: { schemaDir: posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "") } } : {}
+const PERMDOCK_CLAIMS_SCHEMA = {
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$ref: "#/$defs/permdockClaims",
+	$defs: {
+		permdockClaims: {
+			type: "object",
+			properties: {
+				user_role: {
+					description: "Global roles: one name, a list, or null for none.",
+					anyOf: [
+						{ type: "string" },
+						{
+							type: "array",
+							items: { type: "string" }
+						},
+						{ type: "null" }
+					]
+				},
+				roles: {
+					type: "array",
+					items: { type: "string" }
+				},
+				memberships: {
+					type: "array",
+					items: { $ref: "#/$defs/membership" }
+				},
+				memberships_truncated: {
+					description: "true when the size budget cut memberships or attrs.",
+					type: "boolean"
+				},
+				tenant_id: {
+					description: "The active tenant (the default rls.tenantClaim): the canonical text of one instance of the first scope.",
+					type: "string"
+				},
+				attrs: {
+					description: "Allow-listed server-owned attributes, read as principal.claims.attrs.<key>.",
+					type: "object"
+				},
+				authz_ver: {
+					description: "The principal's authorization version.",
+					type: "integer"
+				}
+			}
+		},
+		membership: {
+			type: "object",
+			required: ["roles"],
+			properties: {
+				scope: { type: "string" },
+				id: {
+					description: "Canonical text of the scope instance id (uuid::text for a uuid column); compared exactly, never lower-cased.",
+					type: "string"
+				},
+				within: {
+					description: "The id of every ancestor scope instance, by scope name.",
+					type: "object",
+					additionalProperties: { type: "string" }
+				},
+				on: {
+					type: "object",
+					required: ["resource", "id"],
+					properties: {
+						resource: { type: "string" },
+						id: { type: "string" }
+					}
+				},
+				tenant: { type: "string" },
+				team: { type: "string" },
+				roles: {
+					type: "array",
+					minItems: 1,
+					items: { type: "string" }
+				},
+				via: { type: "string" },
+				expiresAt: {
+					description: "Seconds since the epoch.",
+					type: "number"
+				},
+				grantedBy: { type: "string" },
+				reason: { type: "string" },
+				member: {
+					description: "The subgroup a membership source's group fills.",
+					type: "object",
+					required: ["group"],
+					properties: { group: {
+						type: "string",
+						minLength: 1
+					} }
+				},
+				managedBy: { const: "idp" },
+				entitlements: {
+					type: "array",
+					items: { type: "string" }
+				},
+				keep: {
+					description: "Set when the instance or an ancestor is suspended: the permission keys the membership still grants.",
+					type: "array",
+					items: {
+						type: "string",
+						minLength: 1
+					}
+				},
+				grants: {
+					description: "Custom roles in compact form, read by the helpers in jwt mode.",
+					type: "object"
+				}
+			},
+			anyOf: [
+				{ required: ["scope", "id"] },
+				{ required: ["tenant"] },
+				{ required: ["team"] },
+				{ required: ["on"] }
+			]
 		}
-	};
-}
-/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
-function supabaseConfig(cwd) {
-	const read = readSupabaseConfig(cwd);
-	return read?.ok === true ? read.config : {};
-}
-/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
-function pd045(cwd) {
-	const read = readSupabaseConfig(cwd);
-	if (read === void 0 || read.ok) return [];
-	return [{
-		code: "PD045",
-		severity: "warning",
-		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
-		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then doctor assumes Supabase's defaults for jwt_expiry and schema_paths`
-	}];
-}
+	}
+};
 //#endregion
 //#region src/cli/rls-rbac.ts
 /**
@@ -483,196 +317,8 @@ revoke all on table ${q("user_roles")} from authenticated, anon, public;
 		warnings: []
 	};
 }
-/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
-function driftOf(cwd, files) {
-	const drift = [];
-	for (const file of files) {
-		if (file.rel === "-") continue;
-		const path = resolve(cwd, file.rel);
-		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
-		else {
-			const onDisk = readFileSync(path, "utf8");
-			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
-		}
-	}
-	return drift;
-}
-/** Writes every file but the stdout ones, whose text it returns for printing. */
-function writeSqlFiles(cwd, files) {
-	const wrote = [];
-	const printed = [];
-	for (const file of files) {
-		if (file.rel === "-") {
-			printed.push(file.text.trimEnd());
-			continue;
-		}
-		const path = resolve(cwd, file.rel);
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, file.text);
-		wrote.push(file.rel);
-	}
-	return {
-		wrote,
-		printed: printed.join("\n")
-	};
-}
-const PARTS = [
-	"helpers",
-	"seeds",
-	"indexes",
-	"policies",
-	"hook"
-];
-/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
-function parseSplit(raw) {
-	if (raw === void 0) return;
-	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
-	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
-	return PARTS.filter((part) => names.includes(part));
-}
-/** The path of one split part: `{part}` in `out` replaced by the part name. */
-function partPath(out, part) {
-	return out.replaceAll("{part}", part);
-}
-/**
-* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
-* their dependencies, so no file needs a number to apply first.
-*/
-function pgDeltaPath(root, part, schema) {
-	switch (part) {
-		case "helpers":
-		case "indexes":
-		case "seeds": return `${root}/${schema}/${part}.sql`;
-		case "policies": return `${root}/public/policies/permdock.sql`;
-		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
-		default: return part;
-	}
-}
 //#endregion
-//#region src/cli/supabase-setup.ts
-const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
-function escape(text) {
-	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
-}
-/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
-function helpersDefined(sql, schema) {
-	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
-	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
-	const names = /* @__PURE__ */ new Set();
-	for (const match of sql.matchAll(create)) {
-		const name = (match[1] ?? "").toLowerCase();
-		if (HELPER_NAME.test(name)) names.add(name);
-	}
-	return names;
-}
-/** SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`) and the migration folders, not the hook itself. */
-function helperSources(cwd, config, hookOut) {
-	const hook = resolve(cwd, hookOut);
-	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
-	const rlsOut = resolve(cwd, config.rls?.out ?? "rls.sql");
-	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
-	files.delete(hook);
-	return [...files];
-}
-function missingHelpersInFiles(cwd, config, manifest) {
-	const found = /* @__PURE__ */ new Set();
-	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
-	return manifest.helpers.functions.filter((name) => !found.has(name));
-}
-async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
-	const client = await connect(db);
-	try {
-		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
-where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
-		const found = new Set(result.rows.map((row) => row["proname"]));
-		return manifest.helpers.functions.filter((name) => !found.has(name));
-	} finally {
-		await client.end();
-	}
-}
-function missingHelpersMessage(manifest, missing) {
-	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
-}
-/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
-function oversizedClaims(samples, manifest) {
-	const encoder = new TextEncoder();
-	const oversized = [];
-	for (const claim of manifest.claims) {
-		if (claim.source === "permdock") continue;
-		let bytes = 0;
-		for (const sample of samples) {
-			if (sample === null || typeof sample !== "object") continue;
-			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
-			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
-		}
-		if (bytes > manifest.budget.bytes) oversized.push({
-			name: claim.name,
-			bytes
-		});
-	}
-	return oversized;
-}
-/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
-function droppedMemberships(samples) {
-	const out = [];
-	for (const [index, sample] of samples.entries()) {
-		if (sample === null || typeof sample !== "object") continue;
-		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
-		const { dropped } = readMemberships(claim);
-		if (dropped.length > 0) out.push({
-			sample: index,
-			entries: dropped
-		});
-	}
-	return out;
-}
-function pd039(input) {
-	const findings = [];
-	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
-	if (missing.length > 0) findings.push({
-		code: "PD039",
-		severity: "warning",
-		message: missingHelpersMessage(input.manifest, missing).slice(6),
-		fix: "run permdock rls generate, or set rls.out to the migration that holds the helpers"
-	});
-	const fixture = input.config.doctor?.claims;
-	if (fixture !== void 0) {
-		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
-		const samples = Array.isArray(parsed) ? parsed : [];
-		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
-			fix: "return less from the claim function, or read the data per request instead of from the token"
-		});
-		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
-			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
-		});
-	}
-	return findings;
-}
-//#endregion
-//#region src/cli/supabase-hook.ts
-const SUPABASE_HELP = `permdock supabase hook generate | inspect
-
-  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
-                [--active-from app_metadata.active_<scope>|<table>.<column>]
-                [--budget 1024] [--schema public] [--grants-out <file>|-]
-  inspect [--json] [--out [permdock.manifest.json]] [--check]
-
-Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
-passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
-needs (in --grants-out instead, for declarative schemas), the permdock_authz_version table
-and its triggers. Never grants anything to
-service_role. inspect prints the manifest: helper schema, names and signatures, tenant claim,
-budget, the claims the hook writes, the membership sources and the columns that decide them.
---out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
-file differs.
-`;
-const MANIFEST_FILE = "permdock.manifest.json";
+//#region src/cli/supabase-hook-sql.ts
 const MANAGED_TRIGGER = "permdock_protect_managed";
 const CLAIM_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 const PROTOTYPE_KEYS = /* @__PURE__ */ new Set([
@@ -767,7 +413,7 @@ function extraClaimsPlan(claims, tenantClaim) {
 			continue;
 		}
 		if (typeof fn !== "string" || !CLAIM_FUNCTION.test(fn)) {
-			errors.push(`supabase.hook.claims.${claim} must be a schema-qualified function name such as better_supabase.feature_claims`);
+			errors.push(`supabase.hook.claims.${claim} must be a schema-qualified function name such as public.feature_claims`);
 			continue;
 		}
 		planned.push({
@@ -780,6 +426,50 @@ function extraClaimsPlan(claims, tenantClaim) {
 		errors
 	};
 }
+function beforePlan(before) {
+	const list = before === void 0 ? [] : typeof before === "string" ? [before] : before;
+	const bad = list.filter((fn) => typeof fn !== "string" || !CLAIM_FUNCTION.test(fn));
+	if (bad.length > 0) throw new Error(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
+	return [...new Set(list)];
+}
+function beforeSql(before) {
+	return before.map((fn) => `
+  checked := ${quoteTable(fn)}(event);
+  if checked is null or jsonb_typeof(checked) is distinct from 'object' then
+    return jsonb_build_object('error', jsonb_build_object('http_code', 500, 'message', ${quoteLiteral(`${fn} returned no event`)}));
+  end if;
+  if checked ? 'error' then
+    return checked;
+  end if;
+  event := checked;`).join("").concat(before.length === 0 ? "" : "\n  claims := event -> 'claims';");
+}
+/**
+* `hook.validate`: the claims the hook writes, dropped together when they do
+* not match `supabase-claims-v1.json`, so a bad claim denies instead of
+* failing sign-in. `hook.claims` entries belong to other packages and stay.
+*/
+function validateSql(parts) {
+	if (parts.hook.validate !== true) return "";
+	const keys = /* @__PURE__ */ new Set([
+		"user_role",
+		"roles",
+		"memberships",
+		"memberships_truncated",
+		"attrs",
+		"authz_ver",
+		parts.tenantClaim
+	]);
+	return `
+  if not extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(PERMDOCK_CLAIMS_SCHEMA))}::json, claims) then
+    claims := claims${[...keys].map((key) => ` - ${quoteLiteral(key)}`).join("")};
+  end if;`;
+}
+function validateGrantsSql(parts) {
+	return parts.hook.validate === true ? `
+create extension if not exists pg_jsonschema with schema extensions;
+grant usage on schema extensions to supabase_auth_admin;
+grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
+}
 const VERSION_TRIGGER = "permdock_authz_version";
 const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
 function memberForPlan(input) {
@@ -806,23 +496,26 @@ function mappedMembership(mapped, scopes, name) {
 		const column = scopeColumn(mapped, scopes, ancestor);
 		if (column !== void 0) within[ancestor] = column;
 	}
+	const role = memberRoleOf(mapped);
 	const columns = [
 		mapped.user,
 		id,
-		mapped.role,
+		...role.columns,
 		...Object.values(within),
-		...mapped.via === void 0 ? [] : [mapped.via],
-		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt]
+		...typeof mapped.via === "string" ? [mapped.via] : [],
+		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
+		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
 	];
 	return {
 		table: mapped.table.includes(".") ? mapped.table : `public.${mapped.table}`,
 		user: { column: mapped.user },
 		scope: { value: name },
 		id: { column: id },
-		role: { column: mapped.role },
+		role: roleManifest(role),
 		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
-		...mapped.via === void 0 ? {} : { via: { column: mapped.via } },
+		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
 		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
+		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
 		columns: [...new Set(columns)]
 	};
 }
@@ -893,7 +586,7 @@ function entriesSql(parts) {
     'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
     'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
     'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-    'managedBy', s.managed_by, 'entitlements', s.seats
+    'managedBy', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
   )) as entry
 from (
 ${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
@@ -957,8 +650,8 @@ declare
   in_active boolean := false;
   budget integer := ${String(parts.budget)};
   used integer := 0;
-  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}
-begin${suspended}
+  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
+begin${beforeSql(parts.before)}${suspended}
   claims := claims - 'attrs'${dropExtra};
 ${roles}
   claims := jsonb_set(claims, '{roles}', held);
@@ -990,85 +683,382 @@ ${entriesSql(parts).replaceAll(/^/gmu, "      ")}
   end if;
   if in_active then
     claims := jsonb_set(claims, ${quoteLiteral(`{${parts.tenantClaim}}`)}, to_jsonb(active));
-  end if;${extra}${version}
+  end if;${extra}${version}${validateSql(parts)}
   return jsonb_set(event, '{claims}', claims);
 end;
 $$;`;
 }
+/** Everything the hook grants `supabase_auth_admin`, and the execute revoke. */
+function grantsSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.custom_access_token_hook`;
+	return [
+		`-- supabase_auth_admin: the grants and read policies the hook needs
+grant usage on schema ${schema} to supabase_auth_admin;
+grant execute on function ${fn}(jsonb) to supabase_auth_admin;
+revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extraGrantsSql(parts.extra)}${beforeGrantsSql(parts.before, parts.extra)}${memberForGrantsSql(parts)}${validateGrantsSql(parts)}`,
+		readsSql(parts),
+		parts.version ? authAdminRead(`${parts.schema}.${AUTHZ_VERSION_TABLE}`, "version") : ""
+	].filter((chunk) => chunk !== "").join("\n");
+}
+function extraGrantsSql(extra) {
+	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+}
+function beforeGrantsSql(before, extra) {
+	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
+	return [...[...new Set(before.map((fn) => fn.split(".")[0] ?? ""))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+}
+/**
+* Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
+* functions, which run as `supabase_auth_admin` and may call them. Only with
+* `hook.claims`: the grant needs the helpers migration applied first, and a
+* hook without extra claims does not.
+*/
+function memberForGrantsSql(parts) {
+	const { schema, memberFor } = parts.helpers;
+	if (memberFor.length === 0 || parts.extra.length === 0) return "";
+	return [...schema === parts.schema ? [] : [`\ngrant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`], ...memberFor.map((scope) => `\ngrant execute on function ${quoteIdent(schema)}.${memberForHelper(scope)}(uuid) to supabase_auth_admin;`)].join("");
+}
+function readsSql(parts) {
+	const reads = /* @__PURE__ */ new Map();
+	for (const source of parts.sources) reads.set(source.sql.table, "memberships");
+	for (const source of parts.sources) {
+		for (const name of source.sql.reads) reads.set(name, reads.get(name) ?? "status");
+		for (const through of source.sql.throughs) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+		const users = source.sql.userThrough;
+		if (users !== void 0) reads.set(users.table, reads.get(users.table) ?? "member_users");
+	}
+	if (parts.roles !== void 0) {
+		const { table: rolesTable, through } = parts.roles;
+		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
+		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+	}
+	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
+	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
+	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
+}
+function versionSql(parts) {
+	if (!parts.version) return "";
+	const schema = quoteIdent(parts.schema);
+	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
+	const bump = `${schema}.permdock_bump_authz_version`;
+	const bumpFor = `${schema}.${AUTHZ_VERSION_BUMP}`;
+	const tables = [...new Map(parts.sources.filter((source) => source.sql.userThrough === void 0).map((source) => [source.sql.table, source.sql.user]))];
+	if (parts.roles !== void 0) tables.push([parts.roles.table, parts.roles.user]);
+	return `-- the authorization version: bumped on every membership change, written to authz_ver
+create table if not exists ${versionTable} (
+  user_id uuid primary key references auth.users on delete cascade,
+  version bigint not null default 0
+);
+alter table ${versionTable} enable row level security;
+revoke all on table ${versionTable} from anon, authenticated, public;
+
+-- bumps each listed user once, skipping users already deleted from auth.users; no client role may call it
+create or replace function ${bumpFor}(p_users uuid[])
+returns void
+language sql
+security definer
+set search_path = ''
+as $$
+  insert into ${versionTable} as v (user_id, version)
+  select distinct u, 1 from unnest(p_users) u
+  where u is not null and exists (select 1 from auth.users au where au.id = u)
+  on conflict (user_id) do update set version = v.version + 1
+$$;
+revoke execute on function ${bumpFor}(uuid[]) from public, anon, authenticated;
+
+create or replace function ${bump}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array[
+    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+  ]::uuid[]);
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${table(name)}
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+}
+const SUBJECT_FOR = "subject_for";
+/**
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
+* token for `p_user`, from the same membership, role, suspension and version
+* reads, plus the custom roles the user holds when `database` mode keeps them
+* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no
+* client role may execute it.
+*/
+function subjectForSql(parts, config) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${SUBJECT_FOR}`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return jsonb_build_object('id', uid::text, 'active', false);
+  end if;`;
+	const version = parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : "";
+	const custom = config.rls?.customRoles === true && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
+	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  held jsonb;
+  memberships jsonb;
+  custom jsonb := '[]'::jsonb;
+  ver bigint;${typedUsers(parts)}
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${suspended}
+${roles}
+  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
+    into memberships
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x;${custom}${version}
+  return jsonb_strip_nulls(jsonb_build_object(
+    'id', uid::text,
+    'active', true,
+    'roles', held,
+    'memberships', memberships,
+    'customRoles', custom,
+    'authzVersion', ver
+  ));
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const AUTHZ_VERSION_FOR = "authz_version_for";
+/**
+* `authz_version_for(p_user uuid) returns bigint`: the authorization version
+* `subject_for` reports, without reading roles or memberships, so a
+* `claimsFirst` reread can check a token's freshness on every request and read
+* the full subject only when it is behind. `null` for an unknown or suspended
+* user, and when the version is off.
+*/
+function authzVersionForSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
+	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns bigint
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  ver bigint;
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return null;
+  end if;`}${parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : ""}
+  return ver;
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const MEMBERS_OF = "members_of";
+function membersOfSql(parts) {
+	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
+	const keep = parts.sources.some((source) => source.sql.keeps);
+	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
+	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
+create or replace function ${fn}(p_scope text, p_id text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(jsonb_agg(jsonb_build_object(
+      'principal', jsonb_build_object('id', s.user_id),
+      'membership', jsonb_strip_nulls(jsonb_build_object(
+        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
+      ))
+    ) order by s.user_id, s.roles::text), '[]'::jsonb)
+  from (
+${rows}
+  ) s
+$$;
+revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
+}
 /**
-* Everything the hook grants `supabase_auth_admin`, and the execute revoke:
-* the statements `supabase db diff` drops, so `--grants-out` moves them to
-* their own file.
+* The custom roles `p_user` holds: tenant roles named on a membership of the
+* scope (and instance) they live at, and platform roles among the global
+* roles, each with its grants and includes in `CustomRole` form.
 */
-function grantsSql(parts) {
-	const schema = quoteIdent(parts.schema);
-	const fn = `${schema}.custom_access_token_hook`;
-	return [
-		`-- supabase_auth_admin: the grants and read policies the hook needs
-grant usage on schema ${schema} to supabase_auth_admin;
-grant execute on function ${fn}(jsonb) to supabase_auth_admin;
-revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extraGrantsSql(parts.extra)}${memberForGrantsSql(parts)}`,
-		readsSql(parts),
-		parts.version ? authAdminRead(`${parts.schema}.${AUTHZ_VERSION_TABLE}`, "version") : ""
-	].filter((chunk) => chunk !== "").join("\n");
-}
-function extraGrantsSql(extra) {
-	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+function customRolesOfSql(parts) {
+	const helpers = quoteIdent(parts.helpers.schema);
+	const perms = `${helpers}.custom_role_permissions`;
+	const includes = `${helpers}.custom_role_includes`;
+	const root = quoteLiteral(parts.root);
+	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
+	return `
+  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+      'name', c.role,
+      'tenant', c.tenant_id::text,
+      'scope', c.scope,
+      'id', c.scope_id,
+      'grants', (
+        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+            'permission', p.permission,
+            'effect', p.effect,
+            'level', to_jsonb(p) ->> 'level'
+          )) order by p.permission, p.effect), '[]'::jsonb)
+        from ${perms} p
+        where ${match}
+      ),
+      'includes', (
+        select jsonb_agg(p.include_role order by p.include_role)
+        from ${includes} p
+        where ${match}
+      )
+    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
+    into custom
+    from (
+      select tenant_id, scope, scope_id, role from ${perms}
+      union
+      select tenant_id, scope, scope_id, role from ${includes}
+    ) c
+    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
+      or exists (
+        select 1
+        from jsonb_array_elements(memberships) m
+        where m -> 'roles' ? c.role
+          and m ->> 'scope' = c.scope
+          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (c.scope_id is null or c.scope_id = m ->> 'id')
+      );`;
+}
+function signedUp(user) {
+	return `exists (select 1 from auth.users a where a.id = ${user})`;
 }
 /**
-* Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
-* functions, which run as `supabase_auth_admin` and may call them. Only with
-* `hook.claims`: the grant needs the helpers migration applied first, and a
-* hook without extra claims does not.
+* Every membership source whose user id lives in another table: a row of
+* the source bumps the users its old and new references hold, and a change
+* of that table's user id (a contact re-linked to another login) bumps the
+* old and the new user.
 */
-function memberForGrantsSql(parts) {
-	const { schema, memberFor } = parts.helpers;
-	if (memberFor.length === 0 || parts.extra.length === 0) return "";
-	return [...schema === parts.schema ? [] : [`\ngrant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`], ...memberFor.map((scope) => `\ngrant execute on function ${quoteIdent(schema)}.${memberForHelper(scope)}(uuid) to supabase_auth_admin;`)].join("");
-}
-function readsSql(parts) {
-	const reads = /* @__PURE__ */ new Map();
-	for (const source of parts.sources) reads.set(source.sql.table, "memberships");
-	for (const source of parts.sources) for (const name of source.sql.reads) reads.set(name, reads.get(name) ?? "status");
-	if (parts.roles !== void 0) {
-		const { table: rolesTable, through } = parts.roles;
-		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
-		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
+function memberUsersVersionSql(parts, bumpFor) {
+	const holders = /* @__PURE__ */ new Map();
+	for (const source of parts.sources) {
+		const users = source.sql.userThrough;
+		if (users !== void 0) holders.set(JSON.stringify([
+			tableKey(source.sql.table),
+			tableKey(users.table),
+			users.id,
+			users.key,
+			users.ref
+		]), {
+			table: source.sql.table,
+			users
+		});
 	}
-	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
-	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
-	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
-}
-function versionSql(parts) {
-	if (!parts.version) return "";
-	const schema = quoteIdent(parts.schema);
-	const versionTable = `${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)}`;
-	const bump = `${schema}.permdock_bump_authz_version`;
-	const bumpFor = `${schema}.${AUTHZ_VERSION_BUMP}`;
-	const tables = [...new Map(parts.sources.map((source) => [source.sql.table, source.sql.user]))];
-	if (parts.roles !== void 0) tables.push([parts.roles.table, parts.roles.user]);
-	return `-- the authorization version: bumped on every membership change, written to authz_ver
-create table if not exists ${versionTable} (
-  user_id uuid primary key references auth.users on delete cascade,
-  version bigint not null default 0
-);
-alter table ${versionTable} enable row level security;
-revoke all on table ${versionTable} from anon, authenticated, public;
+	if (holders.size === 0) return "";
+	const byTable = /* @__PURE__ */ new Map();
+	for (const holder of holders.values()) {
+		const key = tableKey(holder.table);
+		const group = byTable.get(key);
+		if (group === void 0) byTable.set(key, {
+			table: holder.table,
+			users: [holder.users]
+		});
+		else group.users.push(holder.users);
+	}
+	const memberBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_member_users`;
+	const linkedBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_linked_users`;
+	const groups = [...byTable];
+	const lookup = (users, indent) => `${indent}perform ${bumpFor}(array(
+${indent}  select u.${quoteIdent(users.key)}::uuid from ${table(users.table)} u
+${indent}  where ((tg_op <> 'INSERT' and u.${quoteIdent(users.id)} = old.${quoteIdent(users.ref)})
+${indent}     or (tg_op <> 'DELETE' and u.${quoteIdent(users.id)} = new.${quoteIdent(users.ref)}))
+${indent}    and ${signedUp(`u.${quoteIdent(users.key)}::uuid`)}
+${indent}));`;
+	const body = groups.map(([key, group]) => {
+		if (groups.length === 1) return group.users.map((users) => lookup(users, "  ")).join("\n");
+		const dot = key.indexOf(".");
+		return `  if tg_table_schema = ${quoteLiteral(key.slice(0, dot))} and tg_table_name = ${quoteLiteral(key.slice(dot + 1))} then
+${group.users.map((users) => lookup(users, "    ")).join("\n")}
+  end if;`;
+	}).join("\n");
+	const memberTriggers = groups.map(([, group]) => {
+		const target = table(group.table);
+		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${target}
+  for each row execute function ${memberBump}();`;
+	}).join("\n");
+	const userTables = /* @__PURE__ */ new Map();
+	for (const { users } of holders.values()) {
+		const key = JSON.stringify([tableKey(users.table), users.key]);
+		const entry = userTables.get(key) ?? {
+			table: users.table,
+			key: users.key,
+			ids: /* @__PURE__ */ new Set()
+		};
+		entry.ids.add(users.id);
+		userTables.set(key, entry);
+	}
+	const userTriggers = [...userTables.values()].map((entry) => {
+		const target = table(entry.table);
+		const name = quoteIdent(`${VERSION_TRIGGER}_${entry.key}`);
+		return `drop trigger if exists ${name} on ${target};
+create trigger ${name}
+  after update of ${[entry.key, ...entry.ids].map(quoteIdent).join(", ")} or delete on ${target}
+  for each row execute function ${linkedBump}(${quoteLiteral(entry.key)});`;
+	}).join("\n");
+	return `
 
--- bumps each listed user once, for a membership source outside the hook; no client role may call it
-create or replace function ${bumpFor}(p_users uuid[])
-returns void
-language sql
+-- a membership whose user id lives in another table bumps the users its old and new rows reference
+create or replace function ${memberBump}()
+returns trigger
+language plpgsql
 security definer
 set search_path = ''
 as $$
-  insert into ${versionTable} as v (user_id, version)
-  select distinct u, 1 from unnest(p_users) u where u is not null
-  on conflict (user_id) do update set version = v.version + 1
+begin
+${body}
+  return null;
+end;
 $$;
-revoke execute on function ${bumpFor}(uuid[]) from public, anon, authenticated;
+revoke execute on function ${memberBump}() from public, anon, authenticated;
+${memberTriggers}
 
-create or replace function ${bump}()
+-- re-linking that table's user id moves every membership that references the row: bump the old and the new user,
+-- skipping a login being deleted (its version row goes with it)
+create or replace function ${linkedBump}()
 returns trigger
 language plpgsql
 security definer
@@ -1077,29 +1067,92 @@ as $$
 declare
   column_name text := tg_argv[0];
 begin
-  perform ${bumpFor}(array[
-    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
-    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
-  ]::uuid[]);
+  perform ${bumpFor}(array(
+    select u
+    from unnest(array[
+      case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+      case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+    ]::uuid[]) u
+    where ${signedUp("u")}
+  ));
   return null;
 end;
 $$;
-revoke execute on function ${bump}() from public, anon, authenticated;
-${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
-create trigger ${quoteIdent(VERSION_TRIGGER)}
-  after insert or update or delete on ${table(name)}
-  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${roleKeysVersionSql(parts, versionTable)}`;
+revoke execute on function ${linkedBump}() from public, anon, authenticated;
+${userTriggers}`;
+}
+/** Every table whose role column references a roles table: the global roles and the membership sources. */
+function roleKeyHolders(parts) {
+	const holders = [];
+	if (parts.roles?.through !== void 0) holders.push({
+		table: parts.roles.table,
+		user: parts.roles.user,
+		through: parts.roles.through
+	});
+	for (const source of parts.sources) for (const through of source.sql.throughs) holders.push({
+		table: source.sql.table,
+		user: source.sql.user,
+		...source.sql.userThrough === void 0 ? {} : { userThrough: source.sql.userThrough },
+		through
+	});
+	const seen = /* @__PURE__ */ new Set();
+	return holders.filter((holder) => {
+		const key = JSON.stringify([
+			tableKey(holder.table),
+			holder.user,
+			holder.userThrough === void 0 ? null : [
+				tableKey(holder.userThrough.table),
+				holder.userThrough.id,
+				holder.userThrough.key
+			],
+			tableKey(holder.through.table),
+			holder.through.id,
+			holder.through.key,
+			holder.through.ref
+		]);
+		if (seen.has(key)) return false;
+		seen.add(key);
+		return true;
+	});
+}
+/** The bump for one roles table: unchanged keys and ids return early, else every holder of `old` is bumped. */
+function roleKeysBumpSql(holders, versionTable, indent) {
+	return `${indent}if tg_op = 'UPDATE'
+${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, holder.through.id]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
+${indent}  return null;
+${indent}end if;
+${indent}insert into ${versionTable} as v (user_id, version)
+${indent}select distinct h.user_id, 1
+${indent}from (
+${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${table(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${table(holder.table)} h join ${table(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
+${indent}) h
+${indent}where h.user_id is not null
+${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
+${indent}on conflict (user_id) do update set version = v.version + 1;`;
 }
-/** A renamed role key changes every holder's `roles` claim, so updates to the roles table bump each holder. */
+/**
+* A renamed role key changes the `roles` claim of everyone who holds it and
+* the `roles` of every membership that references it, so updates to a roles
+* table bump each holder.
+*/
 function roleKeysVersionSql(parts, versionTable) {
-	const through = parts.roles?.through;
-	if (parts.roles === void 0 || through === void 0) return "";
+	const holders = roleKeyHolders(parts);
+	if (holders.length === 0) return "";
+	const byTable = /* @__PURE__ */ new Map();
+	for (const holder of holders) {
+		const key = tableKey(holder.through.table);
+		const group = byTable.get(key);
+		if (group === void 0) byTable.set(key, {
+			table: holder.through.table,
+			holders: [holder]
+		});
+		else group.holders.push(holder);
+	}
 	const bump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_role_keys`;
-	const id = quoteIdent(through.id);
-	const key = quoteIdent(through.key);
+	const groups = [...byTable];
 	return `
 
--- a renamed role key changes the roles claim of everyone who holds it
+-- a renamed role key changes the roles of everyone who holds it, globally or through a membership
 create or replace function ${bump}()
 returns trigger
 language plpgsql
@@ -1107,24 +1160,24 @@ security definer
 set search_path = ''
 as $$
 begin
-  if tg_op = 'UPDATE'
-    and new.${key} is not distinct from old.${key}
-    and new.${id} is not distinct from old.${id} then
-    return null;
-  end if;
-  insert into ${versionTable} as v (user_id, version)
-  select distinct h.${quoteIdent(parts.roles.user)}::uuid, 1
-  from ${table(parts.roles.table)} h
-  where h.${quoteIdent(through.ref)} = old.${id}
-  on conflict (user_id) do update set version = v.version + 1;
+${groups.map(([key, group]) => {
+		if (groups.length === 1) return roleKeysBumpSql(group.holders, versionTable, "  ");
+		const dot = key.indexOf(".");
+		return `  if tg_table_schema = ${quoteLiteral(key.slice(0, dot))} and tg_table_name = ${quoteLiteral(key.slice(dot + 1))} then
+${roleKeysBumpSql(group.holders, versionTable, "    ")}
+  end if;`;
+	}).join("\n")}
   return null;
 end;
 $$;
 revoke execute on function ${bump}() from public, anon, authenticated;
-drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(through.table)};
+${groups.map(([, group]) => {
+		const target = table(group.table);
+		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
-  after update or delete on ${table(through.table)}
+  after update or delete on ${target}
   for each row execute function ${bump}();`;
+	}).join("\n")}`;
 }
 /**
 * Fails the migration when a client role can write an `attrs` column: a
@@ -1216,6 +1269,7 @@ function hookParts(scopes, config, overrides) {
 		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
 		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
 		extra: extraPlan.claims,
+		before: beforePlan(hook.before),
 		helpers: {
 			schema: config.rls?.schema ?? "permdock",
 			...memberForPlan({
@@ -1253,38 +1307,121 @@ function hookClaims(parts) {
 		}))
 	];
 }
+//#endregion
+//#region src/cli/supabase-hook-manifest.ts
 function helperList(parts, types) {
 	const client = ["authenticated"];
-	return [{
-		name: "permdock_has",
-		args: "p_grant text",
-		returns: "boolean",
-		execute: client
-	}, ...parts.scopes.flatMap((scope) => {
+	return [helperEntry(HELPERS.has, "p_grant text", "boolean", client), ...parts.scopes.flatMap((scope) => {
 		const returns = `setof ${types.get(scope.name) ?? "uuid"}`;
 		return [
-			{
-				name: `permitted_${scope.name}_ids`,
-				args: "p_grant text",
-				returns,
-				execute: client
-			},
-			{
-				name: memberIdsHelper(scope.name),
-				args: "",
-				returns,
-				execute: client
-			},
-			...parts.helpers.memberFor.includes(scope.name) ? [{
-				name: memberForHelper(scope.name),
-				args: "p_user uuid",
-				returns,
-				execute: parts.extra.length === 0 ? [] : ["supabase_auth_admin"]
-			}] : []
+			helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
+			helperEntry(memberIdsHelper(scope.name), "", returns, client),
+			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : []
 		];
 	})];
 }
-function manifestOf(parts, out, config) {
+function helperEntry(name, args, returns, execute) {
+	return {
+		name,
+		args,
+		returns,
+		execute
+	};
+}
+/**
+* The helpers `rls generate` writes beyond the ones the hook's claims feed:
+* the `_for` forms in `database` mode, and the assignment checks when a role
+* declares `assigns` (known only with the policy).
+*/
+function trustedHelpers(parts, config, types, tenantType, policy) {
+	const database = resolveAuthorize(config) === "database";
+	const custom = database && config.rls?.customRoles === true;
+	const everyFor = parts.scopes.every((scope) => parts.helpers.memberFor.includes(scope.name));
+	const client = ["authenticated"];
+	const scopeTypes = parts.scopes.map((scope) => [scope.name, types.get(scope.name) ?? "uuid"]);
+	const forUser = database ? [
+		helperEntry(HELPERS.hasFor, "p_user uuid, p_grant text", "boolean", []),
+		...scopeTypes.map(([scope, type]) => helperEntry(permittedForHelper(scope), "p_user uuid, p_grant text", `setof ${type}`, [])),
+		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", []))
+	] : [];
+	const keyed = [
+		helperEntry(USER_ID_HELPER, "", "uuid", client),
+		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...forUser
+	];
+	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
+	const customArgs = `p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text`;
+	const anyArgs = `p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text`;
+	return [
+		...keyed,
+		helperEntry(OWNERSHIP.canAssign, "p_role text, p_scope_id text", "boolean", client),
+		...database ? [helperEntry(OWNERSHIP.canAssignFor, "p_user uuid, p_role text, p_scope_id text", "boolean", [])] : [],
+		...custom ? [helperEntry(ASSIGNMENTS.custom, customArgs, "boolean", client)] : [],
+		...custom && everyFor ? [helperEntry(ASSIGNMENTS.customFor, `p_user uuid, ${customArgs}`, "boolean", [])] : [],
+		helperEntry(OWNERSHIP.canAssignAny, anyArgs, "boolean", client),
+		...database && (!custom || everyFor) ? [helperEntry(OWNERSHIP.canAssignAnyFor, `p_user uuid, ${anyArgs}`, "boolean", [])] : []
+	];
+}
+function activeRowManifest(row) {
+	const keep = "keep" in row ? keptKeys(row) : [];
+	return {
+		table: qualifiedTable(row.table),
+		id: row.id,
+		...row.disabledAt === void 0 ? {} : { disabledAt: row.disabledAt },
+		...row.status === void 0 ? {} : { status: row.status },
+		...row.active === void 0 ? {} : { active: row.active },
+		...keep.length === 0 ? {} : { keep }
+	};
+}
+/** The `rls` settings a package writing SQL next to the helpers reads: custom roles, global roles, suspension and assignment triggers. */
+function rlsSettings(parts, config) {
+	const rls = config.rls;
+	const suspension = checkSuspension(rls?.suspension, parts.scopes);
+	const scopes = Object.entries(suspension?.scopes ?? {});
+	const assigned = rls?.assignments === void 0 ? void 0 : guardedTables(config, parts.scopes);
+	return {
+		customRoles: resolveAuthorize(config) === "database" && rls?.customRoles === true,
+		...parts.roles === void 0 ? {} : { roles: {
+			table: qualifiedTable(parts.roles.table),
+			user: { column: parts.roles.user },
+			role: parts.roles.role
+		} },
+		...suspension === void 0 ? {} : { suspension: {
+			...suspension.users === void 0 ? {} : { users: activeRowManifest(suspension.users) },
+			...scopes.length === 0 ? {} : { scopes: Object.fromEntries(scopes.map(([name, row]) => [name, activeRowManifest(row)])) },
+			...suspension.memberships === void 0 ? {} : { memberships: { keep: keptKeys(suspension.memberships) } }
+		} },
+		...assigned === void 0 ? {} : { assignments: { tables: assigned } },
+		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) }
+	};
+}
+/** The `supabase/sdk` release `requires.capabilities` names features of. */
+const CAPABILITY_MATRIX = "capability-matrix-v1.12.0";
+function usesLiveSession(policy) {
+	return [...policy?.grants ?? [], ...policy?.roles.flatMap((binding) => binding.grants) ?? []].some((grant) => hasConditionOp(grant.where, "liveSession") || hasConditionOp(grant.check, "liveSession"));
+}
+function requiredCapabilities(config, policy) {
+	const ids = /* @__PURE__ */ new Set(["auth.session.get_claims"]);
+	if (usesLiveSession(policy)) ids.add("auth.session.get_user");
+	if (config.rls?.realtime !== void 0) ids.add("realtime.subscriptions.private_channel");
+	for (const bucket of Object.values(config.rls?.storage?.buckets ?? {})) {
+		if (bucket.read !== void 0) {
+			ids.add("storage.file_buckets.download");
+			ids.add("storage.file_buckets.list_files");
+		}
+		if (bucket.write !== void 0) {
+			ids.add("storage.file_buckets.upload");
+			ids.add("storage.file_buckets.update_file");
+			ids.add("storage.file_buckets.move");
+		}
+		if (bucket.delete !== void 0) ids.add("storage.file_buckets.remove");
+	}
+	return {
+		matrix: CAPABILITY_MATRIX,
+		capabilities: [...ids].toSorted()
+	};
+}
+function manifestOf(parts, out, config, policy) {
 	const rls = config.rls;
 	const ctx = {
 		dialect: "supabase",
@@ -1303,11 +1440,12 @@ function manifestOf(parts, out, config) {
 		hook: {
 			schema: parts.schema,
 			function: "custom_access_token_hook",
-			out
+			out,
+			...parts.before.length === 0 ? {} : { before: parts.before }
 		},
 		helpers: {
 			schema: parts.helpers.schema,
-			functions: helpers.map((helper) => helper.name)
+			functions: helpers.map((entry) => entry.name)
 		},
 		tenantClaim: parts.tenantClaim,
 		budget: {
@@ -1331,8 +1469,9 @@ function manifestOf(parts, out, config) {
 				type: types.get(scope.name) ?? "uuid",
 				...scope.within === void 0 ? {} : { within: scope.within }
 			})),
-			helpers,
-			memberships: parts.helpers.memberships
+			helpers: [...helpers, ...trustedHelpers(parts, config, types, tenantTypeOf(ctx), policy)],
+			memberships: parts.helpers.memberships,
+			...rlsSettings(parts, config)
 		},
 		decidingColumns: decidingColumns(config, parts.attrs === void 0 ? void 0 : {
 			...parts.attrs.table === void 0 ? {} : { table: parts.attrs.table },
@@ -1341,7 +1480,8 @@ function manifestOf(parts, out, config) {
 		markers: {
 			hook: "v1",
 			grants: "v1"
-		}
+		},
+		requires: requiredCapabilities(config, policy)
 	};
 }
 /** The first line of the generated hook: fields `--check` compares before the full text. */
@@ -1351,17 +1491,155 @@ function hookMarker(manifest) {
 function defaultOut(config) {
 	return config.supabase?.hook?.out ?? "supabase/permdock-hook.sql";
 }
+//#endregion
+//#region src/cli/supabase-setup.ts
+const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
+function escape(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+function helpersDefined(sql, schema) {
+	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
+	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
+	const names = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(create)) {
+		const name = (match[1] ?? "").toLowerCase();
+		if (HELPER_NAME.test(name)) names.add(name);
+	}
+	return names;
+}
+/**
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
+* its `helpers` part when it has `{part}`), the SQL files next to the hook,
+* and the migration folders, not the hook itself.
+*/
+function helperSources(cwd, config, hookOut) {
+	const hook = resolve(cwd, hookOut);
+	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
+	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
+	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
+	const beside = dirname(hook);
+	if (existsSync(beside)) {
+		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
+	}
+	files.delete(hook);
+	return [...files];
+}
+function missingHelpersInFiles(cwd, config, manifest) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
+	return manifest.helpers.functions.filter((name) => !found.has(name));
+}
+async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
+	const client = await connect(db);
+	try {
+		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
+		const found = new Set(result.rows.map((row) => row["proname"]));
+		return manifest.helpers.functions.filter((name) => !found.has(name));
+	} finally {
+		await client.end();
+	}
+}
+function missingHelpersMessage(manifest, missing) {
+	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
+}
+/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+function oversizedClaims(samples, manifest) {
+	const encoder = new TextEncoder();
+	const oversized = [];
+	for (const claim of manifest.claims) {
+		if (claim.source === "permdock") continue;
+		let bytes = 0;
+		for (const sample of samples) {
+			if (sample === null || typeof sample !== "object") continue;
+			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
+			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
+		}
+		if (bytes > manifest.budget.bytes) oversized.push({
+			name: claim.name,
+			bytes
+		});
+	}
+	return oversized;
+}
+/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
+function droppedMemberships(samples) {
+	const out = [];
+	for (const [index, sample] of samples.entries()) {
+		if (sample === null || typeof sample !== "object") continue;
+		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
+		const { dropped } = readMemberships(claim);
+		if (dropped.length > 0) out.push({
+			sample: index,
+			entries: dropped
+		});
+	}
+	return out;
+}
+function pd039(input) {
+	const findings = [];
+	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
+	if (missing.length > 0) findings.push({
+		code: "PD039",
+		severity: "warning",
+		message: missingHelpersMessage(input.manifest, missing).slice(6),
+		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
+	});
+	const fixture = input.config.doctor?.claims;
+	if (fixture !== void 0) {
+		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
+		const samples = Array.isArray(parsed) ? parsed : [];
+		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
+			fix: "return less from the claim function, or read the data per request instead of from the token"
+		});
+		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
+			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/supabase-hook.ts
+const SUPABASE_HELP = `permdock supabase hook generate | inspect
+
+  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
+                [--active-from app_metadata.active_<scope>|<table>.<column>]
+                [--budget 1024] [--schema public] [--grants-out <file>|-]
+  inspect [--json] [--out [permdock.manifest.json]] [--check]
+
+Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
+passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
+needs (the ones db diff drops in --grants-out, for declarative schemas), the permdock_authz_version table
+and its triggers. Never grants anything to
+service_role. inspect prints the manifest: helper schema, names and signatures, tenant claim,
+budget, the claims the hook writes, the membership sources and the columns that decide them.
+--out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
+file differs.
+`;
+const MANIFEST_FILE = "permdock.manifest.json";
 /** `supabase.hook.out`, else pg-delta's per-schema path, else `supabase/permdock-hook.sql`. */
 function hookOut(cwd, config, schema) {
 	const pgDelta = supabaseConfig(cwd).pgDelta;
 	return config.supabase?.hook?.out !== void 0 || pgDelta === void 0 ? defaultOut(config) : pgDeltaPath(pgDelta.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
 }
-function supabaseHookManifest(scopes, config, overrides = {}) {
-	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config);
+/**
+* The manifest `supabase inspect` prints. With `policy`, `rls.helpers` also
+* lists the assignment checks `rls generate` writes for roles that declare
+* `assigns`.
+*/
+function supabaseHookManifest(scopes, config, overrides = {}, policy) {
+	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
 }
 /**
-* The hook migration. With `grantsOut`, the `supabase_auth_admin` grants are
-* left out of `sql` and returned in `grants` for that file.
+* The hook migration. With `grantsOut`, the statements `supabase db diff`
+* drops are left out of `sql` and returned in `grants` for that file.
 */
 function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
 	const parts = hookParts(scopes, config, overrides);
@@ -1371,18 +1649,23 @@ function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
 		`${hookMarker(manifest)}
 -- custom_access_token_hook(jsonb): memberships go active ${parts.root} first and stop at the budget
 -- supabase/config.toml:
-${toml}${grantsOut === void 0 ? "" : `\n-- the supabase_auth_admin grants are in ${grantsOut}`}`,
+${toml}${grantsOut === void 0 ? "" : `\n-- what supabase db diff drops from this part is in ${grantsOut}`}`,
 		attrsGuardSql(parts.attrs),
 		hookSql(parts),
 		versionSql(parts),
-		grantsOut === void 0 ? grantsSql(parts) : "",
+		subjectForSql(parts, config),
+		authzVersionForSql(parts),
+		membersOfSql(parts),
+		grantsSql(parts),
 		managedSql(parts)
 	].filter((chunk) => chunk !== "").join("\n\n");
+	const { kept, moved } = splitUndiffed(`${sql}\n`);
 	const grants = `${GRANTS_MARKER} schema=${parts.schema}
-${grantsSql(parts)}
+-- the privileges and view options supabase db diff drops from the hook part
+${moved.join("\n")}
 `;
 	return {
-		sql: `${sql}\n`,
+		sql: grantsOut === void 0 ? `${sql}\n` : kept,
 		grants,
 		manifest
 	};
@@ -1447,9 +1730,11 @@ function manifestFile(cwd, rel, manifest, check) {
 	};
 }
 async function loadScopes(cwd, config) {
+	return scopeList((await loadHookPolicy(cwd, config)).scopes);
+}
+async function loadHookPolicy(cwd, config) {
 	if (config.policy === void 0) throw new Error("PermDock CLI: supabase hook generate needs policy in permdock.config.ts");
-	const policy = asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
-	return scopeList(policy.scopes);
+	return asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
 }
 async function runSupabase(input) {
 	const [area, action] = input.rest;
@@ -1459,10 +1744,11 @@ async function runSupabase(input) {
 		schema: input.schema
 	}).filter(([, value]) => value !== void 0));
 	if (area === "inspect" && action === void 0) {
-		const manifest = supabaseHookManifest(await loadScopes(input.cwd, input.config), input.config, {
+		const policy = await loadHookPolicy(input.cwd, input.config);
+		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
 			...overrides,
 			out: hookOut(input.cwd, input.config, input.schema)
-		});
+		}, policy);
 		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
 		return {
 			code: 0,
@@ -1525,4 +1811,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { tableKey as A, pd009 as C, pd040 as D, pd028 as E, group as O, pd006 as S, pd022 as T, resolveAuthorize as _, loadScopes as a, MIGRATION_DIRS as b, supabaseHookSql as c, parseSplit as d, partPath as f, rbacScaffold as g, parseRbacAuthorize as h, hookOut as i, sqlStatements as k, pd039 as l, writeSqlFiles as m, attrsPlan as n, runSupabase as o, pgDeltaPath as p, grantsLabel as r, supabaseHookManifest as s, activeFromSql as t, driftOf as u, pd045 as v, pd012 as w, pd005 as x, supabaseConfig as y };
+export { seedsMigration as _, supabaseHookManifest as a, attrsPlan as c, resolveAuthorize as d, driftOf as f, pgDeltaPath as g, partPath as h, runSupabase as i, parseRbacAuthorize as l, parseSplit as m, hookOut as n, supabaseHookSql as o, isSeedsDirectory as p, loadScopes as r, pd039 as s, grantsLabel as t, rbacScaffold as u, writeSqlFiles as v };