permdock 0.3.1 → 0.4.0

package/dist/{supabase-hook-ntETYCQu.js → supabase-hook-Cva3ikXz.js}

@@ -1,129 +1,79 @@
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BvacVTZR.js";
-import { a as sqlFiles } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { r as scopeColumn } from "./compile-Ba4blROR.js";
-import { t as authorizeSql } from "./supabase-C0qESOa-.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp } from "./refs-f3imMjNW.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BEogC-rB.js";
+import { c as requirePolicy } from "./load-C3_oTHyO.js";
+import { r as scopeColumn } from "./compile-CcEu2ZQ1.js";
+import { t as authorizeSql } from "./supabase-C1TWlnYt.js";
 import "./budget-NbEtbJC_.js";
-import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-4p0-4xQm.js";
-import { i as readMemberships } from "./manifest-iaoBXHKc.js";
-import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
-import { D as hasMemberFor, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, K as quoteLiteral, L as memberForTable, Q as scopeTypeOf, R as memberIdsHelper, U as permittedIdsHelper, W as qualifiedTable, at as tenantTypeOf, g as activeRowSql, p as USER_ID_HELPER, q as quoteTable, r as HELPERS, y as checkSuspension, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-CZOMlwHl.js";
-import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-DcYlZ09B.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
-function driftOf(cwd, files) {
-	const drift = [];
-	for (const file of files) {
-		if (file.rel === "-") continue;
-		const path = resolve(cwd, file.rel);
-		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
-		else {
-			const onDisk = readFileSync(path, "utf8");
-			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
-		}
-	}
-	return drift;
-}
-/** Writes every file but the stdout ones, whose text it returns for printing. */
-function writeSqlFiles(cwd, files) {
-	const wrote = [];
-	const printed = [];
-	for (const file of files) {
-		if (file.rel === "-") {
-			printed.push(file.text.trimEnd());
-			continue;
-		}
-		const path = resolve(cwd, file.rel);
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, file.text);
-		wrote.push(file.rel);
+import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
+import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-B1-b-R0t.js";
+import { i as readMemberships } from "./manifest-BngWKryL.js";
+import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-CiwAOZtO.js";
+import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
+import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS } from "./shared-1uhI-e-b.js";
+import { l as writeOutputFiles, n as driftOf, o as partPath, s as pgDeltaPath } from "./output-files-CgIsvdSa.js";
+import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
+import { B as memberIdsHelper, D as roleNames, F as hasMemberFor, H as permittedForHelper, L as memberForHelper, R as memberForSources, S as apiKeyFields, U as permittedIdsHelper, V as memberRoleOf, Y as checkSuspension, Z as pgConnector, _ as globalRoleSource, b as API_KEY_ALLOWS, n as permissionKeysForHelper, q as activeRowSql, z as memberForTable } from "./permission-keys-B26jeyUv.js";
+import { a as ASSIGNMENTS, i as guardedTables, o as OWNERSHIP, t as ownershipRules } from "./ownership-BgnbOJFT.js";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { parse } from "smol-toml";
+//#region src/cli/supabase-config.ts
+const SUPABASE_CONFIG = "supabase/config.toml";
+function table(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	return value;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
+}
+/** `supabase/config.toml`, parsed; `undefined` when the project has none. */
+function readSupabaseConfig(cwd) {
+	const file = join(cwd, SUPABASE_CONFIG);
+	if (!existsSync(file)) return;
+	let root;
+	try {
+		root = parse(readFileSync(file, "utf8"));
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeError(error)
+		};
 	}
+	const expiry = table(root["auth"])?.["jwt_expiry"];
+	const paths = table(table(root["db"])?.["migrations"])?.["schema_paths"];
+	const schemaPaths = strings(paths);
+	const apiSchemas = strings(table(root["api"])?.["schemas"]);
+	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
+	const schemaPath = pgDelta?.["declarative_schema_path"];
 	return {
-		wrote,
-		printed: printed.join("\n")
+		ok: true,
+		config: {
+			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
+			...schemaPaths === void 0 ? {} : { schemaPaths },
+			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...pgDelta?.["enabled"] === true ? { pgDelta: { schemaDir: posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "") } } : {}
+		}
 	};
 }
-const PARTS = [
-	"helpers",
-	"seeds",
-	"indexes",
-	"policies",
-	"hook"
-];
-/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
-function parseSplit(raw) {
-	if (raw === void 0) return;
-	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
-	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
-	return PARTS.filter((part) => names.includes(part));
-}
-/** The path of one split part: `{part}` in `out` replaced by the part name. */
-function partPath(out, part) {
-	return out.replaceAll("{part}", part);
-}
-/**
-* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
-* their dependencies, so no file needs a number to apply first.
-*/
-function pgDeltaPath(root, part, schema) {
-	switch (part) {
-		case "helpers":
-		case "indexes":
-		case "seeds": return `${root}/${schema}/${part}.sql`;
-		case "policies": return `${root}/public/policies/permdock.sql`;
-		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
-		default: return part;
-	}
-}
-/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
-function isSeedsDirectory(cwd, out) {
-	if (out === "-") return false;
-	if (out.endsWith("/")) return true;
-	const path = resolve(cwd, out);
-	return existsSync(path) && statSync(path).isDirectory();
-}
-/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
-function migrationVersion(now) {
-	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
-}
-const VERSION_PREFIX = /^\d{14}(?=_)/u;
-/**
-* The version of a new migration that sorts after every migration in
-* `names`: one second past the newest, so the same directory always gives the
-* same name. Only a directory with no versioned migration falls back to `now`.
-*/
-function nextMigrationVersion(names, now) {
-	const times = names.flatMap((name) => {
-		const stamp = VERSION_PREFIX.exec(name)?.[0];
-		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
-	});
-	return times.length === 0 ? migrationVersion(now) : migrationVersion(new Date(Math.max(...times) + 1e3));
-}
-/**
-* The seeds part in a migrations directory: the newest migration there that
-* starts with \`marker\` when its text is \`text\` already, otherwise a new
-* \`<version>_permdock_seeds.sql\` one second after the newest migration
-* (\`nextMigrationVersion\`), so a regeneration of the same directory names it
-* the same. \`current\` is false when a new one is due.
-*/
-function seedsMigration(cwd, dir, marker, text, now) {
-	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
-	const path = resolve(cwd, base);
-	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
-	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
-		rel: `${base}/${latest}`,
-		current: true
-	};
-	return {
-		rel: `${base}/${nextMigrationVersion(existsSync(path) ? readdirSync(path) : [], now)}_permdock_seeds.sql`,
-		current: false
-	};
+/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+function supabaseConfig(cwd) {
+	const read = readSupabaseConfig(cwd);
+	return read?.ok === true ? read.config : {};
+}
+/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+function pd045(cwd) {
+	const read = readSupabaseConfig(cwd);
+	if (read === void 0 || read.ok) return [];
+	return [{
+		code: "PD045",
+		severity: "warning",
+		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
+		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then doctor assumes Supabase's defaults for jwt_expiry and schema_paths`
+	}];
 }
 //#endregion
 //#region src/cli/claims-schema.ts
@@ -249,92 +199,7 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 	}
 };
 //#endregion
-//#region src/cli/rls-rbac.ts
-/**
-* Where the helpers read roles and memberships: the flag, `rls.authorize`,
-* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
-* `--rbac` or with a mapped memberships table, else `jwt`.
-*/
-function resolveAuthorize(config, flags = {}) {
-	const rls = config.rls;
-	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
-	if (explicit !== void 0) return explicit;
-	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
-	const memberships = flags.memberships ?? rls?.memberships;
-	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
-}
-function parseRbacAuthorize(raw) {
-	if (raw === void 0) return;
-	if (raw === "database" || raw === "jwt") return raw;
-	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
-}
-function hookUri(schema) {
-	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
-}
-function createEnum(schema, name, values) {
-	const list = values.map((value) => quoteLiteral(value)).join(", ");
-	return `do $$ begin
-  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
-exception when duplicate_object then null;
-end $$;`;
-}
-function hookTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
-function authAdminRead(table, label) {
-	const t = hookTable(table);
-	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
-	return `grant select on table ${t} to supabase_auth_admin;
-drop policy if exists ${policy} on ${t};
-create policy ${policy} on ${t}
-  as permissive for select
-  to supabase_auth_admin
-  using (true);`;
-}
-/**
-* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
-* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
-* The token hook comes only from `permdock supabase hook generate`, so one
-* function writes the claims. Policies never call `authorize()` per row; they
-* call the helpers. Never grants anything to `service_role`.
-*/
-function rbacScaffold(policy, options) {
-	const schema = options.schema;
-	const q = (name) => quoteTable(`${schema}.${name}`);
-	const s = quoteIdent(schema);
-	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
-	const authorizeFn = authorizeSql({
-		schema,
-		authorize: options.authorize,
-		...options.scope === void 0 ? {} : { scope: options.scope },
-		...options.memberships === void 0 ? {} : { tenant: options.memberships },
-		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
-		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
-	});
-	return {
-		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
--- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
--- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
-${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
-${createEnum(schema, "app_permission", permissions)}
-
-create table if not exists ${q("user_roles")} (
-  user_id uuid not null references auth.users on delete cascade,
-  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
-  primary key (user_id, role)
-);
-
-alter table ${q("user_roles")} enable row level security;
-revoke all on table ${q("user_roles")} from authenticated, anon, public;
-`,
-		tail: authorizeFn,
-		warnings: []
-	};
-}
-//#endregion
-//#region src/cli/supabase-hook-sql.ts
-const MANAGED_TRIGGER = "permdock_protect_managed";
+//#region src/cli/supabase-hook/claims.ts
 const CLAIM_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 const PROTOTYPE_KEYS = /* @__PURE__ */ new Set([
 	"__proto__",
@@ -485,103 +350,341 @@ create extension if not exists pg_jsonschema with schema extensions;
 grant usage on schema extensions to supabase_auth_admin;
 grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
 }
-const VERSION_TRIGGER = "permdock_authz_version";
-const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
-function memberForPlan(input) {
-	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
-		dialect: "supabase",
-		...input
-	}, name));
-	const entries = /* @__PURE__ */ new Map();
-	for (const name of memberFor) {
-		const mapped = memberForTable(input, name);
-		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
-		for (const entry of found) entries.set(JSON.stringify(entry), entry);
-	}
-	return {
-		memberFor,
-		memberships: [...entries.values()]
-	};
+/**
+* Fails the migration when a client role can write an `attrs` column: a
+* claim the user can set is not a server-owned attribute.
+*/
+function attrsGuardSql(plan) {
+	if (plan?.table === void 0 || plan.columns.length === 0) return "";
+	const target = quoteLiteral(quoteQualified(plan.table));
+	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
+do $$
+begin
+  if exists (
+    select 1
+    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
+    cross join (values ('anon'), ('authenticated')) r(role)
+    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
+       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
+  ) then
+    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
+      using errcode = '42501';
+  end if;
+end
+$$;`;
 }
-/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
-function mappedMembership(mapped, scopes, name) {
-	const id = scopeColumn(mapped, scopes, name) ?? "";
-	const within = {};
-	for (const ancestor of scopeChain(scopes, name).slice(1)) {
-		const column = scopeColumn(mapped, scopes, ancestor);
-		if (column !== void 0) within[ancestor] = column;
-	}
-	const role = memberRoleOf(mapped);
-	const columns = [
-		mapped.user,
-		id,
-		...role.columns,
-		...Object.values(within),
-		...typeof mapped.via === "string" ? [mapped.via] : [],
-		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
-		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
-	];
+function permdockClaim(name, budget = false) {
 	return {
-		table: mapped.table.includes(".") ? mapped.table : `public.${mapped.table}`,
-		user: { column: mapped.user },
-		scope: { value: name },
-		id: { column: id },
-		role: roleManifest(role),
-		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
-		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
-		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
-		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
-		columns: [...new Set(columns)]
+		name,
+		source: "permdock",
+		budget
 	};
 }
-function table(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
+function hookClaims(parts) {
+	return [
+		permdockClaim("user_role"),
+		permdockClaim("roles"),
+		permdockClaim("memberships", true),
+		permdockClaim("memberships_truncated"),
+		permdockClaim(parts.tenantClaim),
+		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
+		...parts.version ? [permdockClaim("authz_ver")] : [],
+		...parts.extra.map((entry) => ({
+			name: entry.claim,
+			source: entry.fn,
+			budget: false
+		}))
+	];
 }
-function positiveInteger(value, label) {
-	const number = typeof value === "string" ? Number(value) : value;
-	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
-	return number;
+//#endregion
+//#region src/cli/supabase-setup.ts
+const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
+function escape(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
 }
-/**
-* SQL for the active first-scope id, as text, for user `uid`; a table source
-* compares its id column with `v_active_user`, declared as `userType`.
-*/
-function activeFromSql(input, root) {
-	const spec = input ?? `app_metadata.active_${root}`;
-	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
-		const key = spec.slice(13);
-		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
-		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+function helpersDefined(sql, schema) {
+	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
+	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
+	const names = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(create)) {
+		const name = (match[1] ?? "").toLowerCase();
+		if (HELPER_NAME.test(name)) names.add(name);
 	}
-	const parsed = typeof spec === "string" ? (() => {
-		const dot = spec.lastIndexOf(".");
-		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
-		return {
-			table: spec.slice(0, dot),
-			column: spec.slice(dot + 1)
-		};
-	})() : spec;
-	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
-	return {
-		sql: `(select a.${quoteIdent(parsed.column)}::text from ${table(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
-		userType: `${table(parsed.table)}.${quoteIdent(id)}%type`
-	};
+	return names;
 }
 /**
-* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
-* Supabase Auth issues) as that column's type, so each lookup compares the
-* column uncast and its index applies.
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
+* its `helpers` part when it has `{part}`), the SQL files next to the hook,
+* and the migration folders, not the hook itself.
 */
-function typedUsers(parts) {
-	return [
-		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
-		...parts.roles === void 0 ? [] : [`v_roles_user ${table(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
-		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${table(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
-		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
-	].map((line) => `\n  ${line}`).join("");
+function helperSources(cwd, config, hookOut) {
+	const hook = resolve(cwd, hookOut);
+	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
+	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
+	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
+	const beside = dirname(hook);
+	if (existsSync(beside)) {
+		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
+	}
+	files.delete(hook);
+	return [...files];
 }
-function checkSources(parts) {
-	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
+function missingHelpersInFiles(cwd, config, manifest) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
+	return manifest.helpers.functions.filter((name) => !found.has(name));
+}
+async function missingHelpersInDb(db, manifest, connect = pgConnector("permdock supabase hook generate --db")) {
+	const client = await connect(db);
+	try {
+		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
+		const found = new Set(result.rows.map((row) => row["proname"]));
+		return manifest.helpers.functions.filter((name) => !found.has(name));
+	} finally {
+		await client.end();
+	}
+}
+function missingHelpersMessage(manifest, missing) {
+	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
+}
+/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+function oversizedClaims(samples, manifest) {
+	const encoder = new TextEncoder();
+	const oversized = [];
+	for (const claim of manifest.claims) {
+		if (claim.source === "permdock") continue;
+		let bytes = 0;
+		for (const sample of samples) {
+			if (sample === null || typeof sample !== "object") continue;
+			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
+			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
+		}
+		if (bytes > manifest.budget.bytes) oversized.push({
+			name: claim.name,
+			bytes
+		});
+	}
+	return oversized;
+}
+/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
+function droppedMemberships(samples) {
+	const out = [];
+	for (const [index, sample] of samples.entries()) {
+		if (sample === null || typeof sample !== "object") continue;
+		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
+		const { dropped } = readMemberships(claim);
+		if (dropped.length > 0) out.push({
+			sample: index,
+			entries: dropped
+		});
+	}
+	return out;
+}
+function pd039(input) {
+	const findings = [];
+	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
+	if (missing.length > 0) findings.push({
+		code: "PD039",
+		severity: "warning",
+		message: missingHelpersMessage(input.manifest, missing).slice(6),
+		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
+	});
+	const fixture = input.config.doctor?.claims;
+	if (fixture !== void 0) {
+		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
+		const samples = Array.isArray(parsed) ? parsed : [];
+		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
+			fix: "return less from the claim function, or read the data per request instead of from the token"
+		});
+		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
+			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/cli/rls/rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+function authAdminRead(table, label) {
+	const t = quoteQualified(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
+* The token hook comes only from `permdock supabase hook generate`, so one
+* function writes the claims. Policies never call `authorize()` per row; they
+* call the helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+//#endregion
+//#region src/cli/supabase-hook/memberships.ts
+function memberForPlan(input) {
+	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
+		dialect: "supabase",
+		...input
+	}, name));
+	const entries = /* @__PURE__ */ new Map();
+	for (const name of memberFor) {
+		const mapped = memberForTable(input, name);
+		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
+		for (const entry of found) entries.set(JSON.stringify(entry), entry);
+	}
+	return {
+		memberFor,
+		memberships: [...entries.values()]
+	};
+}
+/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
+function mappedMembership(mapped, scopes, name) {
+	const id = scopeColumn(mapped, scopes, name) ?? "";
+	const within = {};
+	for (const ancestor of scopeChain(scopes, name).slice(1)) {
+		const column = scopeColumn(mapped, scopes, ancestor);
+		if (column !== void 0) within[ancestor] = column;
+	}
+	const role = memberRoleOf(mapped);
+	const columns = [
+		mapped.user,
+		id,
+		...role.columns,
+		...Object.values(within),
+		...typeof mapped.via === "string" ? [mapped.via] : [],
+		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
+		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
+	];
+	return {
+		table: qualifySqlTable(mapped.table),
+		user: { column: mapped.user },
+		scope: { value: name },
+		id: { column: id },
+		role: roleManifest(role),
+		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
+		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
+		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
+		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
+		columns: [...new Set(columns)]
+	};
+}
+function positiveInteger(value, label) {
+	const number = typeof value === "string" ? Number(value) : value;
+	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
+	return number;
+}
+/**
+* SQL for the active first-scope id, as text, for user `uid`; a table source
+* compares its id column with `v_active_user`, declared as `userType`.
+*/
+function activeFromSql(input, root) {
+	const spec = input ?? `app_metadata.active_${root}`;
+	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
+		const key = spec.slice(13);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
+		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+	}
+	const parsed = typeof spec === "string" ? (() => {
+		const dot = spec.lastIndexOf(".");
+		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
+		return {
+			table: spec.slice(0, dot),
+			column: spec.slice(dot + 1)
+		};
+	})() : spec;
+	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
+	return {
+		sql: `(select a.${quoteIdent(parsed.column)}::text from ${quoteQualified(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
+		userType: `${quoteQualified(parsed.table)}.${quoteIdent(id)}%type`
+	};
+}
+/**
+* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
+* Supabase Auth issues) as that column's type, so each lookup compares the
+* column uncast and its index applies.
+*/
+function typedUsers(parts) {
+	return [
+		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
+		...parts.roles === void 0 ? [] : [`v_roles_user ${quoteQualified(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
+		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${quoteQualified(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
+		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
+	].map((line) => `\n  ${line}`).join("");
+}
+function checkSources(parts) {
+	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
 	for (const source of parts.sources) {
 		if (source.sql === void 0 || typeof source.sql.select !== "function") throw new Error("PermDock CLI: supabase.hook.memberships takes fromTable / fromJunction sources from permdock/supabase");
 		const scope = source.sql.scope;
@@ -607,6 +710,214 @@ from (
 ${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
 ) s`).join("\nunion all\n");
 }
+//#endregion
+//#region src/cli/supabase-hook/api.ts
+const SUBJECT_FOR = "subject_for";
+/**
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
+* token for `p_user`, from the same membership, role, suspension and version
+* reads, plus the custom roles the user holds when `database` mode keeps them
+* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no
+* client role may execute it.
+*/
+function subjectForSql(parts, config) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${SUBJECT_FOR}`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return jsonb_build_object('id', uid::text, 'active', false);
+  end if;`;
+	const version = parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : "";
+	const custom = customRolesOn(config.rls) && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
+	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  held jsonb;
+  memberships jsonb;
+  custom jsonb := '[]'::jsonb;
+  ver bigint;${typedUsers(parts)}
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${suspended}
+${roles}
+  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
+    into memberships
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x;${custom}${version}
+  return jsonb_strip_nulls(jsonb_build_object(
+    'id', uid::text,
+    'active', true,
+    'roles', held,
+    'memberships', memberships,
+    'customRoles', custom,
+    'authzVersion', ver
+  ));
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+/**
+* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
+* function per reader, in the API schema, executable by `service_role` only.
+*/
+function apiWrappersSql(parts) {
+	const api = parts.hook.api;
+	if (api === void 0) return "";
+	const target = api.schema ?? "public";
+	const names = hookApiNames(api.prefix);
+	const source = quoteIdent(parts.schema);
+	const wrapper = (name, inner, params, args, types, returns) => {
+		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
+		if (target === parts.schema && name === inner) throw new Error(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
+		return `create or replace function ${fn}(${params})
+returns ${returns}
+language sql
+stable
+security definer
+set search_path = ''
+as $$ select ${source}.${inner}(${args}) $$;
+revoke execute on function ${fn}(${types}) from public, anon, authenticated;
+grant execute on function ${fn}(${types}) to service_role;`;
+	};
+	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
+${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
+
+${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
+
+${wrapper(names.authzVersionFor, AUTHZ_VERSION_FOR, "p_user uuid", "p_user", "uuid", "bigint")}`;
+}
+const AUTHZ_VERSION_FOR = "authz_version_for";
+/**
+* `authz_version_for(p_user uuid) returns bigint`: the authorization version
+* `subject_for` reports, without reading roles or memberships, so a
+* `claimsFirst` reread can check a token's freshness on every request and read
+* the full subject only when it is behind. `null` for an unknown or suspended
+* user, and when the version is off.
+*/
+function authzVersionForSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
+	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns bigint
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  ver bigint;
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return null;
+  end if;`}${parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : ""}
+  return ver;
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const MEMBERS_OF = "members_of";
+function membersOfSql(parts) {
+	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
+	const keep = parts.sources.some((source) => source.sql.keeps);
+	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
+	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
+create or replace function ${fn}(p_scope text, p_id text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(jsonb_agg(jsonb_build_object(
+      'principal', jsonb_build_object('id', s.user_id),
+      'membership', jsonb_strip_nulls(jsonb_build_object(
+        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
+      ))
+    ) order by s.user_id, s.roles::text), '[]'::jsonb)
+  from (
+${rows}
+  ) s
+$$;
+revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
+}
+/**
+* The custom roles `p_user` holds: tenant roles named on a membership of the
+* scope (and instance) they live at, and platform roles among the global
+* roles, each with its grants and includes in `CustomRole` form.
+*/
+function customRolesOfSql(parts) {
+	const helpers = quoteIdent(parts.helpers.schema);
+	const perms = `${helpers}.custom_role_permissions`;
+	const includes = `${helpers}.custom_role_includes`;
+	const root = quoteLiteral(parts.root);
+	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
+	return `
+  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+      'name', c.role,
+      'tenant', c.tenant_id::text,
+      'scope', c.scope,
+      'id', c.scope_id,
+      'grants', (
+        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+            'permission', p.permission,
+            'effect', p.effect,
+            'level', to_jsonb(p) ->> 'level'
+          )) order by p.permission, p.effect), '[]'::jsonb)
+        from ${perms} p
+        where ${match}
+      ),
+      'includes', (
+        select jsonb_agg(p.include_role order by p.include_role)
+        from ${includes} p
+        where ${match}
+      )
+    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
+    into custom
+    from (
+      select tenant_id, scope, scope_id, role from ${perms}
+      union
+      select tenant_id, scope, scope_id, role from ${includes}
+    ) c
+    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
+      or exists (
+        select 1
+        from jsonb_array_elements(memberships) m
+        where m -> 'roles' ? c.role
+          and m ->> 'scope' = c.scope
+          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (c.scope_id is null or c.scope_id = m ->> 'id')
+      );`;
+}
+//#endregion
+//#region src/cli/supabase-hook/sql.ts
+const MANAGED_TRIGGER = "permdock_protect_managed";
 function hookSql(parts) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.custom_access_token_hook`;
@@ -619,7 +930,7 @@ function hookSql(parts) {
 	const fromTable = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
   select jsonb_strip_nulls(jsonb_build_object(${plan.columns.map((column) => `${quoteLiteral(column)}, to_jsonb(p.${quoteIdent(column)})`).join(", ")}))
     into attrs
-    from ${table(plan.table)} p
+    from ${quoteQualified(plan.table)} p
     where p.${quoteIdent(plan.id)} = v_attrs_user;`;
 	const fromMeta = plan === void 0 || plan.meta.length === 0 ? "" : `
   attrs := coalesce(attrs, '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object(${plan.meta.map((key) => `${quoteLiteral(key)}, claims -> 'app_metadata' -> ${quoteLiteral(key)}`).join(", ")}));`;
@@ -752,6 +1063,92 @@ function readsSql(parts) {
 	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
 	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
 }
+function managedSql(parts) {
+	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
+	if (managed.length === 0) return "";
+	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
+	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
+create or replace function ${guard}()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  if current_user in ('anon', 'authenticated') and (
+    column_name = ''
+    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
+    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
+  ) then
+    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
+      using errcode = '42501';
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${quoteQualified(source.sql.table)};
+create trigger ${quoteIdent(MANAGED_TRIGGER)}
+  before insert or update or delete on ${quoteQualified(source.sql.table)}
+  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
+}
+/** The `config.toml` block that enables the hook and bounds token staleness. */
+function configToml(schema, jwtExpiry) {
+	return `[auth]
+jwt_expiry = ${String(jwtExpiry)}
+
+[auth.hook.custom_access_token]
+enabled = true
+uri = "${hookUri(schema)}"`;
+}
+const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
+function hookParts(scopes, config, overrides) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
+	const root = rootScope(scopes) ?? "tenant";
+	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
+	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
+	quoteIdent(schema);
+	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
+	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
+	checkSources({
+		sources: hook.memberships,
+		scopes
+	});
+	const parts = {
+		schema,
+		scopes,
+		root,
+		sources: hook.memberships,
+		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
+		version: hook.version !== false,
+		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
+		tenantClaim,
+		users: suspension?.users,
+		hook,
+		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
+		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
+		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
+		extra: extraPlan.claims,
+		before: beforePlan(hook.before),
+		helpers: {
+			schema: config.rls?.schema ?? "permdock",
+			...memberForPlan({
+				scopes,
+				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
+				memberSources: config.rls?.membershipSources ?? hook.memberships
+			})
+		}
+	};
+	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
+	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
+	quoteIdent(parts.tenantClaim);
+	return parts;
+}
+//#endregion
+//#region src/cli/supabase-hook/version.ts
+const VERSION_TRIGGER = "permdock_authz_version";
+const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
 function versionSql(parts) {
 	if (!parts.version) return "";
 	const schema = quoteIdent(parts.schema);
@@ -783,229 +1180,26 @@ $$;
 revoke execute on function ${bumpFor}(uuid[]) from public, anon, authenticated;
 
 create or replace function ${bump}()
-returns trigger
-language plpgsql
-security definer
-set search_path = ''
-as $$
-declare
-  column_name text := tg_argv[0];
-begin
-  perform ${bumpFor}(array[
-    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
-    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
-  ]::uuid[]);
-  return null;
-end;
-$$;
-revoke execute on function ${bump}() from public, anon, authenticated;
-${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
-create trigger ${quoteIdent(VERSION_TRIGGER)}
-  after insert or update or delete on ${table(name)}
-  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
-}
-const SUBJECT_FOR = "subject_for";
-/**
-* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
-* token for `p_user`, from the same membership, role, suspension and version
-* reads, plus the custom roles the user holds when `database` mode keeps them
-* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
-* subject for an acting user or a job from it. Naming the user is why no
-* client role may execute it.
-*/
-function subjectForSql(parts, config) {
-	const schema = quoteIdent(parts.schema);
-	const fn = `${schema}.${SUBJECT_FOR}`;
-	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
-    into held
-    from ${rows.from}
-    where ${rows.userSql} = v_roles_user;`;
-	const suspended = parts.users === void 0 ? "" : `
-  if not ${activeRowSql(parts.users, "uid")} then
-    return jsonb_build_object('id', uid::text, 'active', false);
-  end if;`;
-	const version = parts.version ? `
-  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
-  ver := coalesce(ver, 0);` : "";
-	const custom = config.rls?.customRoles === true && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
-	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
-create or replace function ${fn}(p_user uuid)
-returns jsonb
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  uid uuid := p_user;
-  held jsonb;
-  memberships jsonb;
-  custom jsonb := '[]'::jsonb;
-  ver bigint;${typedUsers(parts)}
-begin
-  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
-    return null;
-  end if;${suspended}
-${roles}
-  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
-    into memberships
-    from (
-${entriesSql(parts).replaceAll(/^/gmu, "      ")}
-    ) x;${custom}${version}
-  return jsonb_strip_nulls(jsonb_build_object(
-    'id', uid::text,
-    'active', true,
-    'roles', held,
-    'memberships', memberships,
-    'customRoles', custom,
-    'authzVersion', ver
-  ));
-end;
-$$;
-revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
-}
-/**
-* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
-* function per reader, in the API schema, executable by `service_role` only.
-*/
-function apiWrappersSql(parts) {
-	const api = parts.hook.api;
-	if (api === void 0) return "";
-	const target = api.schema ?? "public";
-	const names = hookApiNames(api.prefix);
-	const source = quoteIdent(parts.schema);
-	const wrapper = (name, inner, params, args, types, returns) => {
-		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
-		if (target === parts.schema && name === inner) throw new Error(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
-		return `create or replace function ${fn}(${params})
-returns ${returns}
-language sql
-stable
-security definer
-set search_path = ''
-as $$ select ${source}.${inner}(${args}) $$;
-revoke execute on function ${fn}(${types}) from public, anon, authenticated;
-grant execute on function ${fn}(${types}) to service_role;`;
-	};
-	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
-${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
-
-${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
-
-${wrapper(names.authzVersionFor, AUTHZ_VERSION_FOR, "p_user uuid", "p_user", "uuid", "bigint")}`;
-}
-const AUTHZ_VERSION_FOR = "authz_version_for";
-/**
-* `authz_version_for(p_user uuid) returns bigint`: the authorization version
-* `subject_for` reports, without reading roles or memberships, so a
-* `claimsFirst` reread can check a token's freshness on every request and read
-* the full subject only when it is behind. `null` for an unknown or suspended
-* user, and when the version is off.
-*/
-function authzVersionForSql(parts) {
-	const schema = quoteIdent(parts.schema);
-	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
-	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
-create or replace function ${fn}(p_user uuid)
-returns bigint
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  uid uuid := p_user;
-  ver bigint;
-begin
-  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
-    return null;
-  end if;${parts.users === void 0 ? "" : `
-  if not ${activeRowSql(parts.users, "uid")} then
-    return null;
-  end if;`}${parts.version ? `
-  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
-  ver := coalesce(ver, 0);` : ""}
-  return ver;
-end;
-$$;
-revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
-}
-const MEMBERS_OF = "members_of";
-function membersOfSql(parts) {
-	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
-	const keep = parts.sources.some((source) => source.sql.keeps);
-	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
-	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
-create or replace function ${fn}(p_scope text, p_id text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select coalesce(jsonb_agg(jsonb_build_object(
-      'principal', jsonb_build_object('id', s.user_id),
-      'membership', jsonb_strip_nulls(jsonb_build_object(
-        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
-        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
-        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
-      ))
-    ) order by s.user_id, s.roles::text), '[]'::jsonb)
-  from (
-${rows}
-  ) s
-$$;
-revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
-}
-/**
-* The custom roles `p_user` holds: tenant roles named on a membership of the
-* scope (and instance) they live at, and platform roles among the global
-* roles, each with its grants and includes in `CustomRole` form.
-*/
-function customRolesOfSql(parts) {
-	const helpers = quoteIdent(parts.helpers.schema);
-	const perms = `${helpers}.custom_role_permissions`;
-	const includes = `${helpers}.custom_role_includes`;
-	const root = quoteLiteral(parts.root);
-	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
-	return `
-  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
-      'name', c.role,
-      'tenant', c.tenant_id::text,
-      'scope', c.scope,
-      'id', c.scope_id,
-      'grants', (
-        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
-            'permission', p.permission,
-            'effect', p.effect,
-            'level', to_jsonb(p) ->> 'level'
-          )) order by p.permission, p.effect), '[]'::jsonb)
-        from ${perms} p
-        where ${match}
-      ),
-      'includes', (
-        select jsonb_agg(p.include_role order by p.include_role)
-        from ${includes} p
-        where ${match}
-      )
-    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
-    into custom
-    from (
-      select tenant_id, scope, scope_id, role from ${perms}
-      union
-      select tenant_id, scope, scope_id, role from ${includes}
-    ) c
-    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
-      or exists (
-        select 1
-        from jsonb_array_elements(memberships) m
-        where m -> 'roles' ? c.role
-          and m ->> 'scope' = c.scope
-          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
-          and (c.scope_id is null or c.scope_id = m ->> 'id')
-      );`;
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array[
+    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+  ]::uuid[]);
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${quoteQualified(name)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${quoteQualified(name)}
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
 }
 function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;
@@ -1046,7 +1240,7 @@ function memberUsersVersionSql(parts, bumpFor) {
 	const linkedBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_linked_users`;
 	const groups = [...byTable];
 	const lookup = (users, indent) => `${indent}perform ${bumpFor}(array(
-${indent}  select u.${quoteIdent(users.key)}::uuid from ${table(users.table)} u
+${indent}  select u.${quoteIdent(users.key)}::uuid from ${quoteQualified(users.table)} u
 ${indent}  where ((tg_op <> 'INSERT' and u.${quoteIdent(users.id)} = old.${quoteIdent(users.ref)})
 ${indent}     or (tg_op <> 'DELETE' and u.${quoteIdent(users.id)} = new.${quoteIdent(users.ref)}))
 ${indent}    and ${signedUp(`u.${quoteIdent(users.key)}::uuid`)}
@@ -1059,7 +1253,7 @@ ${group.users.map((users) => lookup(users, "    ")).join("\n")}
   end if;`;
 	}).join("\n");
 	const memberTriggers = groups.map(([, group]) => {
-		const target = table(group.table);
+		const target = quoteQualified(group.table);
 		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after insert or update or delete on ${target}
@@ -1077,7 +1271,7 @@ create trigger ${quoteIdent(VERSION_TRIGGER)}
 		userTables.set(key, entry);
 	}
 	const userTriggers = [...userTables.values()].map((entry) => {
-		const target = table(entry.table);
+		const target = quoteQualified(entry.table);
 		const name = quoteIdent(`${VERSION_TRIGGER}_${entry.key}`);
 		return `drop trigger if exists ${name} on ${target};
 create trigger ${name}
@@ -1169,7 +1363,7 @@ ${indent}end if;
 ${indent}insert into ${versionTable} as v (user_id, version)
 ${indent}select distinct h.user_id, 1
 ${indent}from (
-${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${table(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${table(holder.table)} h join ${table(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
+${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${quoteQualified(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${quoteQualified(holder.table)} h join ${quoteQualified(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
 ${indent}) h
 ${indent}where h.user_id is not null
 ${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
@@ -1217,143 +1411,15 @@ end;
 $$;
 revoke execute on function ${bump}() from public, anon, authenticated;
 ${groups.map(([, group]) => {
-		const target = table(group.table);
+		const target = quoteQualified(group.table);
 		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after update or delete on ${target}
   for each row execute function ${bump}();`;
 	}).join("\n")}`;
 }
-/**
-* Fails the migration when a client role can write an `attrs` column: a
-* claim the user can set is not a server-owned attribute.
-*/
-function attrsGuardSql(plan) {
-	if (plan?.table === void 0 || plan.columns.length === 0) return "";
-	const target = quoteLiteral(table(plan.table));
-	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
-do $$
-begin
-  if exists (
-    select 1
-    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
-    cross join (values ('anon'), ('authenticated')) r(role)
-    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
-       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
-  ) then
-    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
-      using errcode = '42501';
-  end if;
-end
-$$;`;
-}
-function managedSql(parts) {
-	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
-	if (managed.length === 0) return "";
-	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
-	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
-create or replace function ${guard}()
-returns trigger
-language plpgsql
-set search_path = ''
-as $$
-declare
-  column_name text := tg_argv[0];
-begin
-  if current_user in ('anon', 'authenticated') and (
-    column_name = ''
-    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
-    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
-  ) then
-    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
-      using errcode = '42501';
-  end if;
-  return coalesce(new, old);
-end;
-$$;
-${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${table(source.sql.table)};
-create trigger ${quoteIdent(MANAGED_TRIGGER)}
-  before insert or update or delete on ${table(source.sql.table)}
-  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
-}
-/** The `config.toml` block that enables the hook and bounds token staleness. */
-function configToml(schema, jwtExpiry) {
-	return `[auth]
-jwt_expiry = ${String(jwtExpiry)}
-
-[auth.hook.custom_access_token]
-enabled = true
-uri = "${hookUri(schema)}"`;
-}
-const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
-function hookParts(scopes, config, overrides) {
-	const hook = config.supabase?.hook;
-	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
-	const root = rootScope(scopes) ?? "tenant";
-	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
-	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
-	quoteIdent(schema);
-	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
-	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
-	checkSources({
-		sources: hook.memberships,
-		scopes
-	});
-	const parts = {
-		schema,
-		scopes,
-		root,
-		sources: hook.memberships,
-		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
-		version: hook.version !== false,
-		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
-		tenantClaim,
-		users: suspension?.users,
-		hook,
-		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
-		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
-		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
-		extra: extraPlan.claims,
-		before: beforePlan(hook.before),
-		helpers: {
-			schema: config.rls?.schema ?? "permdock",
-			...memberForPlan({
-				scopes,
-				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
-				memberSources: config.rls?.membershipSources ?? hook.memberships
-			})
-		}
-	};
-	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
-	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
-	quoteIdent(parts.tenantClaim);
-	return parts;
-}
-function permdockClaim(name, budget = false) {
-	return {
-		name,
-		source: "permdock",
-		budget
-	};
-}
-function hookClaims(parts) {
-	return [
-		permdockClaim("user_role"),
-		permdockClaim("roles"),
-		permdockClaim("memberships", true),
-		permdockClaim("memberships_truncated"),
-		permdockClaim(parts.tenantClaim),
-		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
-		...parts.version ? [permdockClaim("authz_ver")] : [],
-		...parts.extra.map((entry) => ({
-			name: entry.claim,
-			source: entry.fn,
-			budget: false
-		}))
-	];
-}
 //#endregion
-//#region src/cli/supabase-hook-manifest.ts
+//#region src/cli/supabase-hook/manifest.ts
 function helperList(parts, types) {
 	const client = ["authenticated"];
 	return [helperEntry(HELPERS.has, "p_grant text", "boolean", client), ...parts.scopes.flatMap((scope) => {
@@ -1380,7 +1446,7 @@ function helperEntry(name, args, returns, execute) {
 */
 function trustedHelpers(parts, config, types, tenantType, policy) {
 	const database = resolveAuthorize(config) === "database";
-	const custom = database && config.rls?.customRoles === true;
+	const custom = database && customRolesOn(config.rls);
 	const everyFor = parts.scopes.every((scope) => parts.helpers.memberFor.includes(scope.name));
 	const client = ["authenticated"];
 	const scopeTypes = parts.scopes.map((scope) => [scope.name, types.get(scope.name) ?? "uuid"]);
@@ -1410,7 +1476,7 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 function activeRowManifest(row) {
 	const keep = "keep" in row ? keptKeys(row) : [];
 	return {
-		table: qualifiedTable(row.table),
+		table: qualifySqlTable(row.table),
 		id: row.id,
 		...row.disabledAt === void 0 ? {} : { disabledAt: row.disabledAt },
 		...row.status === void 0 ? {} : { status: row.status },
@@ -1425,9 +1491,9 @@ function rlsSettings(parts, config) {
 	const scopes = Object.entries(suspension?.scopes ?? {});
 	const assigned = rls?.assignments === void 0 ? void 0 : guardedTables(config, parts.scopes);
 	return {
-		customRoles: resolveAuthorize(config) === "database" && rls?.customRoles === true,
+		customRoles: resolveAuthorize(config) === "database" && customRolesOn(rls),
 		...parts.roles === void 0 ? {} : { roles: {
-			table: qualifiedTable(parts.roles.table),
+			table: qualifySqlTable(parts.roles.table),
 			user: { column: parts.roles.user },
 			role: parts.roles.role
 		} },
@@ -1537,121 +1603,7 @@ function defaultOut(config) {
 	return config.supabase?.hook?.out ?? "supabase/permdock-hook.sql";
 }
 //#endregion
-//#region src/cli/supabase-setup.ts
-const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
-function escape(text) {
-	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
-}
-/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
-function helpersDefined(sql, schema) {
-	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
-	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
-	const names = /* @__PURE__ */ new Set();
-	for (const match of sql.matchAll(create)) {
-		const name = (match[1] ?? "").toLowerCase();
-		if (HELPER_NAME.test(name)) names.add(name);
-	}
-	return names;
-}
-/**
-* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
-* its `helpers` part when it has `{part}`), the SQL files next to the hook,
-* and the migration folders, not the hook itself.
-*/
-function helperSources(cwd, config, hookOut) {
-	const hook = resolve(cwd, hookOut);
-	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
-	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
-	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
-	const beside = dirname(hook);
-	if (existsSync(beside)) {
-		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
-	}
-	files.delete(hook);
-	return [...files];
-}
-function missingHelpersInFiles(cwd, config, manifest) {
-	const found = /* @__PURE__ */ new Set();
-	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
-	return manifest.helpers.functions.filter((name) => !found.has(name));
-}
-async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
-	const client = await connect(db);
-	try {
-		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
-where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
-		const found = new Set(result.rows.map((row) => row["proname"]));
-		return manifest.helpers.functions.filter((name) => !found.has(name));
-	} finally {
-		await client.end();
-	}
-}
-function missingHelpersMessage(manifest, missing) {
-	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
-}
-/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
-function oversizedClaims(samples, manifest) {
-	const encoder = new TextEncoder();
-	const oversized = [];
-	for (const claim of manifest.claims) {
-		if (claim.source === "permdock") continue;
-		let bytes = 0;
-		for (const sample of samples) {
-			if (sample === null || typeof sample !== "object") continue;
-			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
-			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
-		}
-		if (bytes > manifest.budget.bytes) oversized.push({
-			name: claim.name,
-			bytes
-		});
-	}
-	return oversized;
-}
-/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
-function droppedMemberships(samples) {
-	const out = [];
-	for (const [index, sample] of samples.entries()) {
-		if (sample === null || typeof sample !== "object") continue;
-		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
-		const { dropped } = readMemberships(claim);
-		if (dropped.length > 0) out.push({
-			sample: index,
-			entries: dropped
-		});
-	}
-	return out;
-}
-function pd039(input) {
-	const findings = [];
-	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
-	if (missing.length > 0) findings.push({
-		code: "PD039",
-		severity: "warning",
-		message: missingHelpersMessage(input.manifest, missing).slice(6),
-		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
-	});
-	const fixture = input.config.doctor?.claims;
-	if (fixture !== void 0) {
-		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
-		const samples = Array.isArray(parsed) ? parsed : [];
-		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
-			fix: "return less from the claim function, or read the data per request instead of from the token"
-		});
-		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
-			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
-		});
-	}
-	return findings;
-}
-//#endregion
-//#region src/cli/supabase-hook.ts
+//#region src/cli/supabase-hook/supabase-hook.ts
 const SUPABASE_HELP = `permdock supabase hook generate | inspect
 
   hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
@@ -1745,8 +1697,7 @@ function inspectText(manifest) {
 function manifestFile(cwd, rel, manifest, check) {
 	const path = resolve(cwd, rel);
 	if (!check) {
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+		writeFileEnsuringDir(path, `${JSON.stringify(manifest, null, 2)}\n`);
 		return {
 			code: 0,
 			output: `wrote ${rel}`
@@ -1758,14 +1709,14 @@ function manifestFile(cwd, rel, manifest, check) {
 	};
 	let onDisk;
 	try {
-		onDisk = JSON.parse(readFileSync(path, "utf8"));
+		onDisk = readJsonFile(path);
 	} catch {
 		return {
 			code: 1,
 			output: `supabase manifest drift: ${rel} is not JSON`
 		};
 	}
-	const found = typeof onDisk === "object" && onDisk !== null && !Array.isArray(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
+	const found = isRecord(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
 	const changed = [.../* @__PURE__ */ new Set([...Object.keys(manifest), ...Object.keys(found)])].filter((key) => JSON.stringify(Reflect.get(manifest, key)) !== JSON.stringify(found[key]));
 	return changed.length === 0 ? {
 		code: 0,
@@ -1778,9 +1729,8 @@ function manifestFile(cwd, rel, manifest, check) {
 async function loadScopes(cwd, config) {
 	return scopeList((await loadHookPolicy(cwd, config)).scopes);
 }
-async function loadHookPolicy(cwd, config) {
-	if (config.policy === void 0) throw new Error("PermDock CLI: supabase hook generate needs policy in permdock.config.ts");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
+function loadHookPolicy(cwd, config) {
+	return requirePolicy(cwd, config.policy, "supabase hook generate needs policy in permdock.config.ts");
 }
 async function runSupabase(input) {
 	const [area, action] = input.rest;
@@ -1834,9 +1784,8 @@ async function runSupabase(input) {
 			output: `supabase hook drift: ${drift.join("; ")}`
 		};
 	}
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, sql);
-	const grantsWritten = writeSqlFiles(input.cwd, grantsFile);
+	writeFileEnsuringDir(outPath, sql);
+	const grantsWritten = writeOutputFiles(input.cwd, grantsFile);
 	const placed = {
 		...manifest,
 		hook: {
@@ -1857,4 +1806,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { seedsMigration as _, supabaseHookManifest as a, attrsPlan as c, resolveAuthorize as d, driftOf as f, pgDeltaPath as g, partPath as h, runSupabase as i, parseRbacAuthorize as l, parseSplit as m, hookOut as n, supabaseHookSql as o, isSeedsDirectory as p, loadScopes as r, pd039 as s, grantsLabel as t, rbacScaffold as u, writeSqlFiles as v };
+export { supabaseHookManifest as a, rbacScaffold as c, attrsPlan as d, pd045 as f, runSupabase as i, resolveAuthorize as l, hookOut as n, supabaseHookSql as o, supabaseConfig as p, loadScopes as r, parseRbacAuthorize as s, grantsLabel as t, pd039 as u };