permdock 0.3.1 → 0.5.0

package/dist/{supabase-hook-ntETYCQu.js → supabase-hook-DdDQhMlw.js}

@@ -1,129 +1,90 @@
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BvacVTZR.js";
-import { a as sqlFiles } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
-import { r as scopeColumn } from "./compile-Ba4blROR.js";
-import { t as authorizeSql } from "./supabase-C0qESOa-.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
+import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
+import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
+import { c as requirePolicy } from "./load-DFS_ry0W.js";
+import { r as scopeColumn } from "./compile-CMqMx_IN.js";
+import { t as authorizeSql } from "./supabase-Dxlp8A94.js";
 import "./budget-NbEtbJC_.js";
-import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-4p0-4xQm.js";
-import { i as readMemberships } from "./manifest-iaoBXHKc.js";
-import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
-import { D as hasMemberFor, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, K as quoteLiteral, L as memberForTable, Q as scopeTypeOf, R as memberIdsHelper, U as permittedIdsHelper, W as qualifiedTable, at as tenantTypeOf, g as activeRowSql, p as USER_ID_HELPER, q as quoteTable, r as HELPERS, y as checkSuspension, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-CZOMlwHl.js";
-import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-DcYlZ09B.js";
-import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-/** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
-function driftOf(cwd, files) {
-	const drift = [];
-	for (const file of files) {
-		if (file.rel === "-") continue;
-		const path = resolve(cwd, file.rel);
-		if (!existsSync(path)) drift.push(`${file.part}: missing ${file.rel}`);
-		else {
-			const onDisk = readFileSync(path, "utf8");
-			if (onDisk !== file.text) drift.push(`${file.part}: ${file.rel}\n${shortDiff(file.rel, onDisk, file.text)}`);
-		}
-	}
-	return drift;
-}
-/** Writes every file but the stdout ones, whose text it returns for printing. */
-function writeSqlFiles(cwd, files) {
-	const wrote = [];
-	const printed = [];
-	for (const file of files) {
-		if (file.rel === "-") {
-			printed.push(file.text.trimEnd());
-			continue;
-		}
-		const path = resolve(cwd, file.rel);
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, file.text);
-		wrote.push(file.rel);
+import { i as qualifySqlTable } from "./sql-B5T1IL83.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-vs5dGOsS.js";
+import { o as readMemberships } from "./postgrest-CW0IqC-U.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
+import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
+import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
+import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-CD11nBbC.js";
+import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
+import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-CO1oOymN.js";
+import { $ as checkSuspension, A as roleNames, C as API_KEY_ALLOWS, G as memberRoleOf, H as memberForSources, K as permittedForHelper, R as hasMemberFor, T as apiKeyFields, U as memberForTable, V as memberForHelper, W as memberIdsHelper, X as scopeTable, Z as activeRowSql, a as guardedTables, b as globalRoleSource, c as PERMISSION_HELPERS, d as permissionKeysForHelper, f as permittedByPermissionHelper, l as checkName, o as ASSIGNMENTS, q as permittedIdsHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, y as globalRoleRows, z as hasPermittedUsers } from "./ownership-BatFgAA4.js";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { parse } from "smol-toml";
+//#region src/cli/supabase-config.ts
+const SUPABASE_CONFIG = "supabase/config.toml";
+function table(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	return value;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
+}
+/** `supabase/config.toml`, parsed; `undefined` when the project has none. */
+function readSupabaseConfig(cwd) {
+	const file = join(cwd, SUPABASE_CONFIG);
+	if (!existsSync(file)) return;
+	let root;
+	try {
+		root = parse(readFileSync(file, "utf8"));
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeError(error)
+		};
 	}
+	const expiry = table(root["auth"])?.["jwt_expiry"];
+	const paths = table(table(root["db"])?.["migrations"])?.["schema_paths"];
+	const schemaPaths = strings(paths);
+	const apiSchemas = strings(table(root["api"])?.["schemas"]);
+	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
+	const schemaPath = pgDelta?.["declarative_schema_path"];
+	const enabled = pgDelta?.["enabled"];
 	return {
-		wrote,
-		printed: printed.join("\n")
+		ok: true,
+		config: {
+			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
+			...schemaPaths === void 0 ? {} : { schemaPaths },
+			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...pgDelta === void 0 ? {} : { pgDelta: {
+				...typeof enabled === "boolean" ? { enabled } : {},
+				schemaDir: declarativeSchemaDir(schemaPath)
+			} }
+		}
 	};
 }
-const PARTS = [
-	"helpers",
-	"seeds",
-	"indexes",
-	"policies",
-	"hook"
-];
-/** `--split helpers,seeds,indexes,policies,hook`: the parts in that fixed order, or an error. */
-function parseSplit(raw) {
-	if (raw === void 0) return;
-	const names = raw.split(",").map((name) => name.trim()).filter((name) => name !== "");
-	if (names.filter((name) => !PARTS.some((part) => part === name)).length > 0 || names.length === 0) return `rls generate --split takes helpers, seeds, indexes, policies and hook, got '${raw}'`;
-	return PARTS.filter((part) => names.includes(part));
-}
-/** The path of one split part: `{part}` in `out` replaced by the part name. */
-function partPath(out, part) {
-	return out.replaceAll("{part}", part);
-}
-/**
-* pg-delta's per-schema, unnumbered layout: pg-delta orders statements by
-* their dependencies, so no file needs a number to apply first.
-*/
-function pgDeltaPath(root, part, schema) {
-	switch (part) {
-		case "helpers":
-		case "indexes":
-		case "seeds": return `${root}/${schema}/${part}.sql`;
-		case "policies": return `${root}/public/policies/permdock.sql`;
-		case "hook": return `${root}/${schema}/functions/custom_access_token_hook.sql`;
-		default: return part;
-	}
-}
-/** Whether `--seeds-out` names a migrations directory: it ends with \`/\` or is an existing directory. */
-function isSeedsDirectory(cwd, out) {
-	if (out === "-") return false;
-	if (out.endsWith("/")) return true;
-	const path = resolve(cwd, out);
-	return existsSync(path) && statSync(path).isDirectory();
-}
-/** `YYYYMMDDHHMMSS` in UTC, the Supabase migration version. */
-function migrationVersion(now) {
-	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
-}
-const VERSION_PREFIX = /^\d{14}(?=_)/u;
-/**
-* The version of a new migration that sorts after every migration in
-* `names`: one second past the newest, so the same directory always gives the
-* same name. Only a directory with no versioned migration falls back to `now`.
-*/
-function nextMigrationVersion(names, now) {
-	const times = names.flatMap((name) => {
-		const stamp = VERSION_PREFIX.exec(name)?.[0];
-		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
-	});
-	return times.length === 0 ? migrationVersion(now) : migrationVersion(new Date(Math.max(...times) + 1e3));
-}
-/**
-* The seeds part in a migrations directory: the newest migration there that
-* starts with \`marker\` when its text is \`text\` already, otherwise a new
-* \`<version>_permdock_seeds.sql\` one second after the newest migration
-* (\`nextMigrationVersion\`), so a regeneration of the same directory names it
-* the same. \`current\` is false when a new one is due.
-*/
-function seedsMigration(cwd, dir, marker, text, now) {
-	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
-	const path = resolve(cwd, base);
-	const latest = existsSync(path) ? readdirSync(path).filter((name) => name.endsWith(".sql")).toSorted().toReversed().find((name) => readFileSync(resolve(path, name), "utf8").startsWith(marker)) : void 0;
-	if (latest !== void 0 && readFileSync(resolve(path, latest), "utf8") === text) return {
-		rel: `${base}/${latest}`,
-		current: true
-	};
-	return {
-		rel: `${base}/${nextMigrationVersion(existsSync(path) ? readdirSync(path) : [], now)}_permdock_seeds.sql`,
-		current: false
-	};
+/** `supabase/` joined with `declarative_schema_path`, which defaults to `schemas`. */
+function declarativeSchemaDir(schemaPath) {
+	return posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "");
+}
+/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+function supabaseConfig(cwd) {
+	const read = readSupabaseConfig(cwd);
+	return read?.ok === true ? read.config : {};
+}
+/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+function pd045(cwd) {
+	const read = readSupabaseConfig(cwd);
+	if (read === void 0 || read.ok) return [];
+	return [{
+		code: "PD045",
+		severity: "warning",
+		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
+		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then PermDock assumes Supabase's defaults for jwt_expiry, schema_paths and [experimental.pgdelta], and generates for pg-delta`
+	}];
 }
 //#endregion
 //#region src/cli/claims-schema.ts
@@ -206,11 +167,11 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 					items: { type: "string" }
 				},
 				via: { type: "string" },
-				expiresAt: {
-					description: "Seconds since the epoch.",
+				expires_at: {
+					description: "NumericDate (RFC 7519): seconds since the epoch.",
 					type: "number"
 				},
-				grantedBy: { type: "string" },
+				granted_by: { type: "string" },
 				reason: { type: "string" },
 				member: {
 					description: "The subgroup a membership source's group fills.",
@@ -221,7 +182,7 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 						minLength: 1
 					} }
 				},
-				managedBy: { const: "idp" },
+				managed_by: { const: "idp" },
 				entitlements: {
 					type: "array",
 					items: { type: "string" }
@@ -249,92 +210,7 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 	}
 };
 //#endregion
-//#region src/cli/rls-rbac.ts
-/**
-* Where the helpers read roles and memberships: the flag, `rls.authorize`,
-* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
-* `--rbac` or with a mapped memberships table, else `jwt`.
-*/
-function resolveAuthorize(config, flags = {}) {
-	const rls = config.rls;
-	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
-	if (explicit !== void 0) return explicit;
-	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
-	const memberships = flags.memberships ?? rls?.memberships;
-	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
-}
-function parseRbacAuthorize(raw) {
-	if (raw === void 0) return;
-	if (raw === "database" || raw === "jwt") return raw;
-	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
-}
-function hookUri(schema) {
-	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
-}
-function createEnum(schema, name, values) {
-	const list = values.map((value) => quoteLiteral(value)).join(", ");
-	return `do $$ begin
-  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
-exception when duplicate_object then null;
-end $$;`;
-}
-function hookTable(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
-}
-/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
-function authAdminRead(table, label) {
-	const t = hookTable(table);
-	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
-	return `grant select on table ${t} to supabase_auth_admin;
-drop policy if exists ${policy} on ${t};
-create policy ${policy} on ${t}
-  as permissive for select
-  to supabase_auth_admin
-  using (true);`;
-}
-/**
-* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
-* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
-* The token hook comes only from `permdock supabase hook generate`, so one
-* function writes the claims. Policies never call `authorize()` per row; they
-* call the helpers. Never grants anything to `service_role`.
-*/
-function rbacScaffold(policy, options) {
-	const schema = options.schema;
-	const q = (name) => quoteTable(`${schema}.${name}`);
-	const s = quoteIdent(schema);
-	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
-	const authorizeFn = authorizeSql({
-		schema,
-		authorize: options.authorize,
-		...options.scope === void 0 ? {} : { scope: options.scope },
-		...options.memberships === void 0 ? {} : { tenant: options.memberships },
-		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
-		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
-	});
-	return {
-		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
--- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
--- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
-${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
-${createEnum(schema, "app_permission", permissions)}
-
-create table if not exists ${q("user_roles")} (
-  user_id uuid not null references auth.users on delete cascade,
-  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
-  primary key (user_id, role)
-);
-
-alter table ${q("user_roles")} enable row level security;
-revoke all on table ${q("user_roles")} from authenticated, anon, public;
-`,
-		tail: authorizeFn,
-		warnings: []
-	};
-}
-//#endregion
-//#region src/cli/supabase-hook-sql.ts
-const MANAGED_TRIGGER = "permdock_protect_managed";
+//#region src/cli/supabase-hook/claims.ts
 const CLAIM_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 const PROTOTYPE_KEYS = /* @__PURE__ */ new Set([
 	"__proto__",
@@ -444,7 +320,7 @@ function extraClaimsPlan(claims, tenantClaim) {
 function beforePlan(before) {
 	const list = before === void 0 ? [] : typeof before === "string" ? [before] : before;
 	const bad = list.filter((fn) => typeof fn !== "string" || !CLAIM_FUNCTION.test(fn));
-	if (bad.length > 0) throw new Error(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
+	if (bad.length > 0) throw configError(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
 	return [...new Set(list)];
 }
 function beforeSql(before) {
@@ -485,128 +361,1432 @@ create extension if not exists pg_jsonschema with schema extensions;
 grant usage on schema extensions to supabase_auth_admin;
 grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
 }
-const VERSION_TRIGGER = "permdock_authz_version";
-const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
-function memberForPlan(input) {
-	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
-		dialect: "supabase",
-		...input
-	}, name));
-	const entries = /* @__PURE__ */ new Map();
-	for (const name of memberFor) {
-		const mapped = memberForTable(input, name);
-		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
-		for (const entry of found) entries.set(JSON.stringify(entry), entry);
-	}
+/**
+* Fails the migration when a client role can write an `attrs` column: a
+* claim the user can set is not a server-owned attribute.
+*/
+function attrsGuardSql(plan) {
+	if (plan?.table === void 0 || plan.columns.length === 0) return "";
+	const target = quoteLiteral(quoteQualified(plan.table));
+	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
+do $$
+begin
+  if exists (
+    select 1
+    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
+    cross join (values ('anon'), ('authenticated')) r(role)
+    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
+       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
+  ) then
+    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
+      using errcode = '42501';
+  end if;
+end
+$$;`;
+}
+function permdockClaim(name, budget = false) {
 	return {
-		memberFor,
-		memberships: [...entries.values()]
+		name,
+		source: "permdock",
+		budget
 	};
 }
-/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
-function mappedMembership(mapped, scopes, name) {
-	const id = scopeColumn(mapped, scopes, name) ?? "";
-	const within = {};
-	for (const ancestor of scopeChain(scopes, name).slice(1)) {
-		const column = scopeColumn(mapped, scopes, ancestor);
-		if (column !== void 0) within[ancestor] = column;
-	}
-	const role = memberRoleOf(mapped);
-	const columns = [
-		mapped.user,
-		id,
-		...role.columns,
-		...Object.values(within),
-		...typeof mapped.via === "string" ? [mapped.via] : [],
-		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
-		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
+function hookClaims(parts) {
+	return [
+		permdockClaim("user_role"),
+		permdockClaim("roles"),
+		permdockClaim("memberships", true),
+		permdockClaim("memberships_truncated"),
+		permdockClaim(parts.tenantClaim),
+		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
+		...parts.version ? [permdockClaim("authz_ver")] : [],
+		...parts.extra.map((entry) => ({
+			name: entry.claim,
+			source: entry.fn,
+			budget: false
+		}))
 	];
-	return {
-		table: mapped.table.includes(".") ? mapped.table : `public.${mapped.table}`,
-		user: { column: mapped.user },
-		scope: { value: name },
-		id: { column: id },
-		role: roleManifest(role),
-		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
-		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
-		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
-		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
-		columns: [...new Set(columns)]
-	};
 }
-function table(name) {
-	return quoteTable(name.includes(".") ? name : `public.${name}`);
+//#endregion
+//#region src/cli/supabase-schemas.ts
+const MODES = [
+	"pg-delta",
+	"migra",
+	"migrations"
+];
+function isSupabaseSchemas(value) {
+	return MODES.some((mode) => mode === value);
 }
-function positiveInteger(value, label) {
-	const number = typeof value === "string" ? Number(value) : value;
-	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
-	return number;
+/** The `--schemas` refusal, or `undefined` when the value is one of the modes. */
+function schemasRefusal(command, value) {
+	return value === void 0 || isSupabaseSchemas(value) ? void 0 : `${command} --schemas must be ${MODES.join(", ")} (got ${value})`;
 }
 /**
-* SQL for the active first-scope id, as text, for user `uid`; a table source
-* compares its id column with `v_active_user`, declared as `userType`.
+* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml`
+* sets `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default
+* of new Supabase projects and of the next Supabase CLI major.
 */
-function activeFromSql(input, root) {
-	const spec = input ?? `app_metadata.active_${root}`;
-	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
-		const key = spec.slice(13);
-		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
-		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
-	}
-	const parsed = typeof spec === "string" ? (() => {
-		const dot = spec.lastIndexOf(".");
-		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
-		return {
-			table: spec.slice(0, dot),
-			column: spec.slice(dot + 1)
+function resolveSchemas(cwd, config, flag) {
+	const toml = supabaseConfig(cwd).pgDelta;
+	const mode = flag ?? config.supabase?.schemas ?? (toml?.enabled === false ? "migra" : "pg-delta");
+	switch (mode) {
+		case "pg-delta": return {
+			mode,
+			schemaDir: toml?.schemaDir ?? declarativeSchemaDir()
 		};
-	})() : spec;
-	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
-	return {
-		sql: `(select a.${quoteIdent(parsed.column)}::text from ${table(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
-		userType: `${table(parsed.table)}.${quoteIdent(id)}%type`
-	};
+		case "migra":
+		case "migrations": return { mode };
+		default: return mode;
+	}
 }
-/**
-* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
-* Supabase Auth issues) as that column's type, so each lookup compares the
-* column uncast and its index applies.
-*/
-function typedUsers(parts) {
-	return [
-		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
-		...parts.roles === void 0 ? [] : [`v_roles_user ${table(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
-		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${table(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
-		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
-	].map((line) => `\n  ${line}`).join("");
+//#endregion
+//#region src/cli/supabase-setup.ts
+const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
+function escape(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
 }
-function checkSources(parts) {
-	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
-	for (const source of parts.sources) {
-		if (source.sql === void 0 || typeof source.sql.select !== "function") throw new Error("PermDock CLI: supabase.hook.memberships takes fromTable / fromJunction sources from permdock/supabase");
-		const scope = source.sql.scope;
-		if (scope === void 0) continue;
-		if (resolveScope(parts.scopes, scope) !== scope) throw new Error(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
-		const chain = scopeChain(parts.scopes, scope);
-		const holds = new Set(source.sql.holds ?? [scope]);
-		const missing = chain.filter((ancestor) => !holds.has(ancestor));
-		if (missing.length > 0) throw new Error(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
+/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+function helpersDefined(sql, schema) {
+	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
+	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
+	const names = /* @__PURE__ */ new Set();
+	for (const match of sql.matchAll(create)) {
+		const name = (match[1] ?? "").toLowerCase();
+		if (HELPER_NAME.test(name)) names.add(name);
 	}
+	return names;
 }
-function entriesSql(parts) {
-	const tenant = `case when s.scope = ${quoteLiteral(parts.root)} then s.id else s.within ->> ${quoteLiteral(parts.root)} end`;
-	return parts.sources.map((source, index) => `select ${String(index)} as ord,
-  (${tenant}) as tenant,
-  jsonb_strip_nulls(jsonb_build_object(
-    'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
-    'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
-    'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-    'managedBy', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
-  )) as entry
-from (
-${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
-) s`).join("\nunion all\n");
+/**
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
+* its `helpers` part when it has `{part}`), the SQL files next to the hook,
+* and the migration folders, not the hook itself.
+*/
+function helperSources(cwd, config, hookOut) {
+	const hook = resolve(cwd, hookOut);
+	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
+	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
+	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
+	const beside = dirname(hook);
+	if (existsSync(beside)) {
+		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
+	}
+	files.delete(hook);
+	return [...files];
+}
+function missingHelpersInFiles(cwd, config, manifest) {
+	const found = /* @__PURE__ */ new Set();
+	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
+	return manifest.helpers.functions.filter((name) => !found.has(name));
+}
+async function missingHelpersInDb(db, manifest, connect = pgConnector("permdock supabase hook generate --db-url-stdin")) {
+	const client = await connect(db);
+	try {
+		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
+where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
+		const found = new Set(result.rows.map((row) => row["proname"]));
+		return manifest.helpers.functions.filter((name) => !found.has(name));
+	} finally {
+		await client.end();
+	}
+}
+function missingHelpersMessage(manifest, missing) {
+	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
+}
+/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+function oversizedClaims(samples, manifest) {
+	const encoder = new TextEncoder();
+	const oversized = [];
+	for (const claim of manifest.claims) {
+		if (claim.source === "permdock") continue;
+		let bytes = 0;
+		for (const sample of samples) {
+			if (sample === null || typeof sample !== "object") continue;
+			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
+			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
+		}
+		if (bytes > manifest.budget.bytes) oversized.push({
+			name: claim.name,
+			bytes
+		});
+	}
+	return oversized;
+}
+/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
+function droppedMemberships(samples) {
+	const out = [];
+	for (const [index, sample] of samples.entries()) {
+		if (sample === null || typeof sample !== "object") continue;
+		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
+		const { dropped } = readMemberships(claim);
+		if (dropped.length > 0) out.push({
+			sample: index,
+			entries: dropped
+		});
+	}
+	return out;
+}
+function pd039(input) {
+	const findings = [];
+	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
+	if (missing.length > 0) findings.push({
+		code: "PD039",
+		severity: "warning",
+		message: missingHelpersMessage(input.manifest, missing).slice(6),
+		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
+	});
+	const fixture = input.config.doctor?.claims;
+	if (fixture !== void 0) {
+		const parsed = readClaimsFixture(resolve(input.cwd, fixture));
+		if (!parsed.ok) {
+			findings.push({
+				code: "PD039",
+				severity: "warning",
+				message: `doctor.claims ${fixture} is not a JSON file doctor can read (${parsed.message}), so the claim budget went unchecked`,
+				fix: "point doctor.claims at a JSON array of sample claims"
+			});
+			return findings;
+		}
+		const samples = Array.isArray(parsed.value) ? parsed.value : [];
+		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
+			fix: "return less from the claim function, or read the data per request instead of from the token"
+		});
+		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
+			code: "PD039",
+			severity: "warning",
+			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
+			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
+		});
+	}
+	return findings;
+}
+function readClaimsFixture(path) {
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(readFileSync(path, "utf8"))
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+//#endregion
+//#region src/cli/rls/rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+function authAdminRead(table, label) {
+	const t = quoteQualified(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
+* The token hook comes only from `permdock supabase hook generate`, so one
+* function writes the claims. Policies never call `authorize()` per row; they
+* call the helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+//#endregion
+//#region src/cli/supabase-hook/memberships.ts
+function memberForPlan(input) {
+	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
+		dialect: "supabase",
+		...input
+	}, name));
+	const holders = memberFor.filter((name) => hasPermittedUsers(input, name));
+	const entries = /* @__PURE__ */ new Map();
+	for (const name of memberFor) {
+		const mapped = memberForTable(input, name);
+		const found = mapped === void 0 ? memberForSources(input, name).map((source) => source.sql.manifest) : [mappedMembership(mapped, input.scopes, name)];
+		for (const entry of found) entries.set(JSON.stringify(entry), entry);
+	}
+	return {
+		memberFor,
+		holders,
+		memberships: [...entries.values()]
+	};
+}
+/** An `rls.memberships` table in the manifest's `tableMembershipSource` / `junctionMembershipSource` shape, for scope `name`. */
+function mappedMembership(mapped, scopes, name) {
+	const id = scopeColumn(mapped, scopes, name) ?? "";
+	const within = {};
+	for (const ancestor of scopeChain(scopes, name).slice(1)) {
+		const column = scopeColumn(mapped, scopes, ancestor);
+		if (column !== void 0) within[ancestor] = column;
+	}
+	const role = memberRoleOf(mapped);
+	const columns = [
+		mapped.user,
+		id,
+		...role.columns,
+		...Object.values(within),
+		...typeof mapped.via === "string" ? [mapped.via] : [],
+		...mapped.expiresAt === void 0 ? [] : [mapped.expiresAt],
+		...mapped.disabledAt === void 0 ? [] : [mapped.disabledAt]
+	];
+	return {
+		table: qualifySqlTable(mapped.table),
+		user: { column: mapped.user },
+		scope: { value: name },
+		id: { column: id },
+		role: roleManifest(role),
+		...Object.keys(within).length === 0 ? {} : { within: { columns: within } },
+		...mapped.via === void 0 ? {} : { via: typeof mapped.via === "string" ? { column: mapped.via } : { value: mapped.via.value } },
+		...mapped.expiresAt === void 0 ? {} : { expiresAt: { column: mapped.expiresAt } },
+		...mapped.disabledAt === void 0 ? {} : { disabledAt: { column: mapped.disabledAt } },
+		columns: [...new Set(columns)]
+	};
+}
+function positiveInteger(value, label) {
+	const number = typeof value === "string" ? Number(value) : value;
+	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw configError(`PermDock CLI: ${label} must be a positive integer`);
+	return number;
+}
+/**
+* SQL for the active first-scope id, as text, for user `uid`; a table source
+* compares its id column with `v_active_user`, declared as `userType`.
+*/
+function activeFromSql(input, root) {
+	const spec = input ?? `app_metadata.active_${root}`;
+	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
+		const key = spec.slice(13);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw configError(`PermDock CLI: unsafe app_metadata key '${key}'`);
+		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+	}
+	const parsed = typeof spec === "string" ? (() => {
+		const dot = spec.lastIndexOf(".");
+		if (dot <= 0) throw configError(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
+		return {
+			table: spec.slice(0, dot),
+			column: spec.slice(dot + 1)
+		};
+	})() : spec;
+	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
+	return {
+		sql: `(select a.${quoteIdent(parsed.column)}::text from ${quoteQualified(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
+		userType: `${quoteQualified(parsed.table)}.${quoteIdent(id)}%type`
+	};
+}
+/**
+* One variable per user-keyed table the hook reads, holding `uid` (a uuid, as
+* Supabase Auth issues) as that column's type, so each lookup compares the
+* column uncast and its index applies.
+*/
+function typedUsers(parts) {
+	return [
+		...parts.sources.map((source, index) => `v_user_${String(index)} ${source.sql.userType} := uid;`),
+		...parts.roles === void 0 ? [] : [`v_roles_user ${quoteQualified(parts.roles.table)}.${quoteIdent(parts.roles.user)}%type := uid;`],
+		...parts.attrs?.table === void 0 || parts.attrs.columns.length === 0 ? [] : [`v_attrs_user ${quoteQualified(parts.attrs.table)}.${quoteIdent(parts.attrs.id)}%type := uid;`],
+		...parts.active.userType === void 0 ? [] : [`v_active_user ${parts.active.userType} := uid;`]
+	].map((line) => `\n  ${line}`).join("");
+}
+function checkSources(parts) {
+	if (parts.sources.length === 0) throw configError("PermDock CLI: supabase.hook.memberships needs at least one tableMembershipSource or junctionMembershipSource source");
+	for (const source of parts.sources) {
+		if (source.sql === void 0 || typeof source.sql.select !== "function") throw configError("PermDock CLI: supabase.hook.memberships takes tableMembershipSource / junctionMembershipSource sources from permdock/supabase");
+		const scope = source.sql.scope;
+		if (scope === void 0) continue;
+		if (resolveScope(parts.scopes, scope) !== scope) throw configError(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
+		const chain = scopeChain(parts.scopes, scope);
+		const holds = new Set(source.sql.holds ?? [scope]);
+		const missing = chain.filter((ancestor) => !holds.has(ancestor));
+		if (missing.length > 0) throw configError(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
+	}
+}
+function entriesSql(parts) {
+	const tenant = `case when s.scope = ${quoteLiteral(parts.root)} then s.id else s.within ->> ${quoteLiteral(parts.root)} end`;
+	return parts.sources.map((source, index) => `select ${String(index)} as ord,
+  (${tenant}) as tenant,
+  jsonb_strip_nulls(jsonb_build_object(
+    'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+    'expires_at', s.expires_at, 'granted_by', s.granted_by, 'reason', s.reason,
+    'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+    'managed_by', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
+  )) as entry
+from (
+${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
+) s`).join("\nunion all\n");
+}
+//#endregion
+//#region src/cli/supabase-hook/api.ts
+const SUBJECT_FOR = "subject_for";
+/**
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
+* token for `p_user`, from the same membership, role, suspension and version
+* reads, plus the custom roles the user holds when `database` mode keeps them
+* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no
+* client role may execute it.
+*/
+function subjectForSql(parts, config) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${SUBJECT_FOR}`;
+	const rows = parts.roles;
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+    into held
+    from ${rows.from}
+    where ${rows.userSql} = v_roles_user;`;
+	const suspended = parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return jsonb_build_object('id', uid::text, 'active', false);
+  end if;`;
+	const version = parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : "";
+	const custom = customRolesOn(config.rls) && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
+	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns jsonb
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  held jsonb;
+  memberships jsonb;
+  custom jsonb := '[]'::jsonb;
+  ver bigint;${typedUsers(parts)}
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${suspended}
+${roles}
+  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
+    into memberships
+    from (
+${entriesSql(parts).replaceAll(/^/gmu, "      ")}
+    ) x;${custom}${version}
+  return jsonb_strip_nulls(jsonb_build_object(
+    'id', uid::text,
+    'active', true,
+    'roles', held,
+    'memberships', memberships,
+    'customRoles', custom,
+    'authzVersion', ver
+  ));
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+/**
+* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
+* function per reader, in the API schema, executable by `service_role` only.
+*/
+function apiWrappersSql(parts) {
+	const api = parts.hook.api;
+	if (api === void 0) return "";
+	const target = api.schema ?? "public";
+	const names = hookApiNames(api.prefix);
+	const source = quoteIdent(parts.schema);
+	const wrapper = (name, inner, params, args, types, returns) => {
+		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
+		if (target === parts.schema && name === inner) throw configError(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
+		return `create or replace function ${fn}(${params})
+returns ${returns}
+language sql
+stable
+security definer
+set search_path = ''
+as $$ select ${source}.${inner}(${args}) $$;
+revoke execute on function ${fn}(${types}) from public, anon, authenticated;
+grant execute on function ${fn}(${types}) to service_role;`;
+	};
+	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
+${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
+
+${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
+
+${wrapper(names.authzVersionFor, AUTHZ_VERSION_FOR, "p_user uuid", "p_user", "uuid", "bigint")}`;
+}
+const AUTHZ_VERSION_FOR = "authz_version_for";
+/**
+* `authz_version_for(p_user uuid) returns bigint`: the authorization version
+* `subject_for` reports, without reading roles or memberships, so a
+* `claimsFirst` reread can check a token's freshness on every request and read
+* the full subject only when it is behind. `null` for an unknown or suspended
+* user, and when the version is off.
+*/
+function authzVersionForSql(parts) {
+	const schema = quoteIdent(parts.schema);
+	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
+	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
+create or replace function ${fn}(p_user uuid)
+returns bigint
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  uid uuid := p_user;
+  ver bigint;
+begin
+  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
+    return null;
+  end if;${parts.users === void 0 ? "" : `
+  if not ${activeRowSql(parts.users, "uid")} then
+    return null;
+  end if;`}${parts.version ? `
+  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
+  ver := coalesce(ver, 0);` : ""}
+  return ver;
+end;
+$$;
+revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
+}
+const MEMBERS_OF = "members_of";
+function membersOfSql(parts) {
+	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
+	const keep = parts.sources.some((source) => source.sql.keeps);
+	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
+	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
+create or replace function ${fn}(p_scope text, p_id text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(jsonb_agg(jsonb_build_object(
+      'principal', jsonb_build_object('id', s.user_id),
+      'membership', jsonb_strip_nulls(jsonb_build_object(
+        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
+        'expires_at', s.expires_at, 'granted_by', s.granted_by, 'reason', s.reason,
+        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
+        'managed_by', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
+      ))
+    ) order by s.user_id, s.roles::text), '[]'::jsonb)
+  from (
+${rows}
+  ) s
+$$;
+revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
+}
+/**
+* The custom roles `p_user` holds: tenant roles named on a membership of the
+* scope (and instance) they live at, and platform roles among the global
+* roles, each with its grants and includes in `CustomRole` form.
+*/
+function customRolesOfSql(parts) {
+	const helpers = quoteIdent(parts.helpers.schema);
+	const perms = `${helpers}.custom_role_permissions`;
+	const includes = `${helpers}.custom_role_includes`;
+	const root = quoteLiteral(parts.root);
+	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
+	return `
+  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+      'name', c.role,
+      'tenant', c.tenant_id::text,
+      'scope', c.scope,
+      'id', c.scope_id,
+      'grants', (
+        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
+            'permission', p.permission,
+            'effect', p.effect,
+            'level', to_jsonb(p) ->> 'level'
+          )) order by p.permission, p.effect), '[]'::jsonb)
+        from ${perms} p
+        where ${match}
+      ),
+      'includes', (
+        select jsonb_agg(p.include_role order by p.include_role)
+        from ${includes} p
+        where ${match}
+      )
+    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
+    into custom
+    from (
+      select tenant_id, scope, scope_id, role from ${perms}
+      union
+      select tenant_id, scope, scope_id, role from ${includes}
+    ) c
+    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
+      or exists (
+        select 1
+        from jsonb_array_elements(memberships) m
+        where m -> 'roles' ? c.role
+          and m ->> 'scope' = c.scope
+          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (c.scope_id is null or c.scope_id = m ->> 'id')
+      );`;
+}
+//#endregion
+//#region src/cli/rls/approvals.ts
+/** `rls.approvals`' approver check; better-supabase's `isApprover` template calls it. */
+const IS_APPROVER = "permdock_is_approver";
+/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
+const APPROVAL_STORE = {
+	table: "approval_requests",
+	open: "permdock_approval_open",
+	get: "permdock_approval_get",
+	resolve: "permdock_approval_resolve",
+	consume: "permdock_approval_consume",
+	list: "permdock_approval_list",
+	expire: "permdock_approval_expire",
+	cancel: "permdock_approval_cancel",
+	isApprover: IS_APPROVER
+};
+/** `body` as the row's filter columns hold it. */
+const COLUMNS = `p_request ->> 'token',
+    p_request,
+    p_request ->> 'status',
+    p_request #>> '{subject,principal,tenant}',
+    p_request #>> '{subject,principal,id}',
+    p_request #>> '{subject,actor,id}',
+    p_request #>> '{subject,session}',
+    coalesce(jsonb_array_length(p_request -> 'approvals'), 0),
+    p_request ->> 'createdAt',
+    (p_request ->> 'expiresAt')::timestamptz,
+    (p_request ->> 'consumedAt')::timestamptz`;
+/** The `ApprovalListFilter` in `p_filter`, over the row aliased `a`. */
+const FILTER = `(p_filter ->> 'status' is null or a.status = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.tenant = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.principal_id = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.actor_id = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.session = p_filter ->> 'session')`;
+function serverOnly(fn, args) {
+	return `revoke execute on function ${fn}(${args}) from public, anon, authenticated;`;
+}
+const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
+/**
+* `rls.jsonSchema`: a pg_jsonschema check that `body` matches
+* `approval-request-v1.json`, added `not valid` and then validated. `auto`
+* adds it only where the extension is available.
+*/
+function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
+	const statements = [
+		"create schema if not exists extensions;",
+		"create extension if not exists pg_jsonschema with schema extensions;",
+		`alter table ${table} drop constraint if exists "${check}";`,
+		`alter table ${table} add constraint "${check}" check (extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(APPROVAL_REQUEST_SCHEMA))}::json, ${body})) not valid;`,
+		`alter table ${table} validate constraint "${check}";`
+	];
+	const comment = "-- approval store: body matches schemas/approval-request-v1.json through pg_jsonschema";
+	if (mode === true) return `\n${comment}\n${statements.join("\n")}\n`;
+	return `\n${comment}, where the extension is available
+do $permdock$
+begin
+  if exists (select 1 from pg_available_extensions where name = 'pg_jsonschema') then
+${statements.map((statement) => `    ${statement}`).join("\n")}
+  end if;
+end
+$permdock$;\n`;
+}
+/**
+* The approval store (`rls.approvals`): one table of `ApprovalRequest`
+* bodies with the columns a list filters on, and one `security definer`
+* function per `ApprovalStore` method, each one atomic statement. No client
+* role may read the table or execute the functions: approvals are opened and
+* resolved by the server, which grants its own role.
+*/
+function approvalStoreSql(ctx, jsonSchema = false) {
+	const table = qualified(ctx, APPROVAL_STORE.table);
+	const fn = (name) => qualified(ctx, name);
+	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
+	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
+create table if not exists ${table} (
+  token text primary key,
+  body jsonb not null,
+  status text not null check (status in ('pending', 'approved', 'rejected', 'expired')),
+  tenant text,
+  principal_id text,
+  actor_id text,
+  session text,
+  approvals integer not null default 0,
+  created_at text not null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz
+);
+create index if not exists ${index("page")} on ${table} (created_at collate "C", token collate "C");
+create index if not exists ${index("pending")} on ${table} (status, expires_at);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema)}
+-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (token, body, status, tenant, principal_id, actor_id, session, approvals, created_at, expires_at, consumed_at)
+  values (
+    ${COLUMNS}
+  )
+  on conflict (token) do update
+    set body = excluded.body, status = excluded.status, tenant = excluded.tenant,
+      principal_id = excluded.principal_id, actor_id = excluded.actor_id, session = excluded.session,
+      approvals = excluded.approvals, created_at = excluded.created_at,
+      expires_at = excluded.expires_at, consumed_at = excluded.consumed_at
+    where a.status = 'expired' or a.expires_at <= now()
+$$;
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body from ${table} a where a.token = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set body = p_next,
+    status = p_next ->> 'status',
+    approvals = coalesce(jsonb_array_length(p_next -> 'approvals'), 0)
+  where a.token = p_token
+    and a.status = 'pending'
+    and a.expires_at > now()
+    and a.approvals = p_seen
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set consumed_at = p_now::timestamptz,
+    body = a.body || jsonb_build_object('consumedAt', p_now)
+  where a.token = p_token
+    and a.status = 'approved'
+    and a.consumed_at is null
+    and a.expires_at > p_now::timestamptz
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body
+  from ${table} a
+  where ${FILTER}
+    and (p_after_created is null
+      or (a.created_at collate "C", a.token collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by a.created_at collate "C", a.token collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set status = 'expired', body = a.body || '{"status":"expired"}'::jsonb
+    where a.status = 'pending' and a.expires_at <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set status = 'rejected',
+      body = (a.body - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))
+    where a.status = 'pending'
+      and ${FILTER.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+/**
+* `permdock_is_approver(p_approvers jsonb, p_tenant text default null)`: true
+* when the signed-in user matches the serialised approvers of a request
+* (`approvers.by`), for policies on the app's own approval views. A list
+* needs every item and `any-of` one of them; `user` compares the user id and
+* `holder(permission)` reads `permitted_<root>_ids_by_permission` in
+* `p_tenant`, or `permdock_has_permission` without one. Role, relation and
+* other grantee approvers need facts the database does not hold for every
+* membership source, so they match nobody.
+*/
+function isApproverSql(ctx) {
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	const root = ctx.scopes[0]?.name;
+	const inTenant = root === void 0 ? "false" : `exists (
+          select 1
+          from ${qualified(ctx, checkName(permittedByPermissionHelper(root)))}(p_approvers ->> 'permission') i(id)
+          where i.id::text = p_tenant
+        )`;
+	return `
+-- approvers: whether the signed-in user matches a request's approvers.by; policies on approval views call it
+create or replace function ${fn}(p_approvers jsonb, p_tenant text default null)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+  v_user text := ${subjectIdSql(ctx)}::text;
+begin
+  if coalesce(v_user, '') = '' or p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${fn}(v_item, p_tenant) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'user' then
+      return coalesce(p_approvers ->> 'id' = v_user, false);
+    when 'permission' then
+      if p_tenant is null then
+        return coalesce(${qualified(ctx, PERMISSION_HELPERS.has)}(p_approvers ->> 'permission'), false);
+      end if;
+      return ${inTenant};
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${fn}(v_item, p_tenant) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return false;
+  end case;
+end;
+$$;
+revoke execute on function ${fn}(jsonb, text) from public, anon;
+grant execute on function ${fn}(jsonb, text) to authenticated;
+`;
+}
+/**
+* Everything `rls.approvals` writes: the generated or adopted store, the
+* approver check and, with `delegations: true`, the covers.
+*/
+function approvalsSql(ctx, approvals, jsonSchema) {
+	if (approvals === void 0 || approvals === false) return;
+	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
+	const { table, delegations } = approvals;
+	if (delegations !== void 0 && typeof delegations !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.delegations must be a boolean");
+	let store;
+	if (table === void 0) {
+		const adoptOnly = [
+			"token",
+			"body",
+			"open",
+			"schema",
+			"mirror"
+		].find((key) => approvals[key] !== void 0);
+		if (adoptOnly !== void 0) throw configError(`PermDock CLI: rls.approvals.${adoptOnly} adopts a table; set rls.approvals.table too`);
+		store = approvalStoreSql(ctx, jsonSchema);
+	} else store = adoptedApprovalStoreSql(ctx, {
+		...approvals,
+		table
+	}, jsonSchema);
+	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx) : "");
+}
+/** The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource` reads the table. */
+const DELEGATIONS = {
+	table: "approval_delegations",
+	covers: "permdock_cover_approves"
+};
+/**
+* `rls.approvals.delegations`: one table of out-of-office covers that a
+* user writes for themselves, and a four-argument `permdock_is_approver`
+* that also answers for a delegate inside an active cover. One hop: a cover
+* is checked against the delegator's own approver rights, never the
+* delegator's covers. A delegator who is the requester never counts. A
+* `holder()` approver through a cover needs `rls.mode: "database"`, where
+* the `_for` helpers exist; in `jwt` mode only `user()` approvers pass.
+*/
+function approvalDelegationsSql(ctx) {
+	const table = qualified(ctx, DELEGATIONS.table);
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	const covers = qualified(ctx, DELEGATIONS.covers);
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const me = `${subjectIdSql(ctx)}::text`;
+	const defaultMe = subjectIdSql(ctx).replace(/^\(select (.+)\)$/su, "$1");
+	const root = ctx.scopes[0]?.name;
+	const member = (tenant) => root === void 0 ? "false" : `${tenant} in (select m.id::text from ${qualified(ctx, memberIdsHelper(root))}() m(id))`;
+	const database = ctx.authorize === "database";
+	const holderGlobal = database ? `coalesce(${qualified(ctx, PERMISSION_HELPERS.hasFor)}(p_delegator, p_approvers ->> 'permission'), false)` : "false";
+	const holderTenant = database && root !== void 0 ? `exists (
+          select 1
+          from ${qualified(ctx, checkName(`${permittedByPermissionHelper(root)}_for`))}(p_delegator, p_approvers ->> 'permission') i(id)
+          where i.id::text = p_tenant
+        )` : "false";
+	const policy = (name) => quoteIdent(`${DELEGATIONS.table}_${name}`);
+	const own = `delegator::text = ${me} and (tenant is null or ${member("tenant")})`;
+	return `
+-- approval delegations: out-of-office covers a user writes for themselves; tableApprovalDelegationSource and permdock_is_approver read them
+create table if not exists ${table} (
+  id text primary key default gen_random_uuid()::text,
+  delegator ${user} not null default (${defaultMe})::${user},
+  delegate ${user} not null,
+  tenant text,
+  permissions text[],
+  resources text[],
+  "from" timestamptz not null default now(),
+  "until" timestamptz not null,
+  created_at timestamptz not null default now(),
+  constraint ${quoteIdent(`${DELEGATIONS.table}_window`)} check ("from" < "until"),
+  constraint ${quoteIdent(`${DELEGATIONS.table}_distinct`)} check (delegator <> delegate)
+);
+create index if not exists ${quoteIdent(`${DELEGATIONS.table}_delegate`)} on ${table} (delegate, "until");
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, public;
+grant select, insert, update, delete on table ${table} to authenticated;
+drop policy if exists ${policy("read")} on ${table};
+create policy ${policy("read")} on ${table}
+  for select to authenticated
+  using (delegator::text = ${me} or delegate::text = ${me});
+drop policy if exists ${policy("insert")} on ${table};
+create policy ${policy("insert")} on ${table}
+  for insert to authenticated
+  with check (${own});
+drop policy if exists ${policy("update")} on ${table};
+create policy ${policy("update")} on ${table}
+  for update to authenticated
+  using (delegator::text = ${me})
+  with check (${own});
+drop policy if exists ${policy("delete")} on ${table};
+create policy ${policy("delete")} on ${table}
+  for delete to authenticated
+  using (delegator::text = ${me});
+
+-- approval delegations: whether a delegator's own rights match approvers.by; only permdock_is_approver calls it
+create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+begin
+  if p_delegator is null or p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${covers}(p_delegator, v_item, p_tenant) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'user' then
+      return coalesce(p_approvers ->> 'id' = p_delegator::text, false);
+    when 'permission' then
+      if p_tenant is null then
+        return ${holderGlobal};
+      end if;
+      return ${holderTenant};
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${covers}(p_delegator, v_item, p_tenant) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return false;
+  end case;
+end;
+$$;
+revoke execute on function ${covers}(${user}, jsonb, text) from public, anon, authenticated;
+
+-- approvers with covers: the signed-in user, or a delegate inside an active cover of a delegator who is not the requester
+create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_delegator ${user};
+  v_user text := ${me};
+begin
+  if ${fn}(p_approvers, p_tenant) then
+    return true;
+  end if;
+  if coalesce(v_user, '') = '' or coalesce(p_requester, '') = '' then
+    return false;
+  end if;
+  if p_tenant is not null and not (${member("p_tenant")}) then
+    return false;
+  end if;
+  for v_delegator in
+    select d.delegator
+    from ${table} d
+    where d.delegate::text = v_user
+      and d.delegator::text <> v_user
+      and d.delegator::text <> p_requester
+      and d."from" <= now()
+      and now() < d."until"
+      and (d.tenant is null or d.tenant = p_tenant)
+      and d.permissions is null
+      and (d.resources is null or p_resource = any (d.resources))
+  loop
+    if ${covers}(v_delegator, p_approvers, p_tenant) then
+      return true;
+    end if;
+  end loop;
+  return false;
+end;
+$$;
+revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
+grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
+`;
+}
+/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
+const MIRRORS = {
+	status: (body) => `${body} ->> 'status'`,
+	permission: (body) => `${body} ->> 'permission'`,
+	tenant: (body) => `${body} #>> '{subject,principal,tenant}'`,
+	principalId: (body) => `${body} #>> '{subject,principal,id}'`,
+	actorId: (body) => `${body} #>> '{subject,actor,id}'`,
+	session: (body) => `${body} #>> '{subject,session}'`,
+	approvals: (body) => `coalesce(jsonb_array_length(${body} -> 'approvals'), 0)`,
+	createdAt: (body) => `${body} ->> 'createdAt'`,
+	expiresAt: (body) => `${body} ->> 'expiresAt'`,
+	resolvedAt: (body) => `${body} ->> 'resolvedAt'`,
+	resolvedBy: (body) => `${body} ->> 'resolvedBy'`,
+	consumedAt: (body) => `${body} ->> 'consumedAt'`
+};
+function mirrorsOf(adopt) {
+	const out = [];
+	for (const [field, column] of Object.entries(adopt.mirror ?? {})) {
+		if (!Object.hasOwn(MIRRORS, field)) throw configError(`PermDock CLI: rls.approvals.mirror.${field} is not a request field; use ${Object.keys(MIRRORS).join(", ")}`);
+		if (typeof column !== "string") throw new TypeError(`PermDock CLI: rls.approvals.mirror.${field} must be a column name`);
+		out.push([column, field]);
+	}
+	return out;
+}
+/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
+function populate(table, values) {
+	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
 }
+/** The mirrored columns' values for the request `body`. */
+function mirrorRow(table, mirror, body) {
+	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
+}
+/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
+function mirrorSet(table, mirror, body) {
+	if (mirror.length === 0) return "";
+	const columns = mirror.map(([column]) => quoteIdent(column));
+	const picked = columns.map((column) => `r.${column}`).join(", ");
+	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
+}
+/**
+* The approval store over a table the app already has (`rls.approvals:
+* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
+* functions, reading every field from the request body in `body`, keyed by
+* the text column `token`, and copying the fields `mirror` names into the
+* app's own columns, converted to their types, on every write. The table's
+* grants and policies stay the app's.
+*/
+function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
+	const table = quoteQualified(adopt.table);
+	const base = adopt.table.split(".").at(-1) ?? adopt.table;
+	const token = quoteIdent(adopt.token ?? "token");
+	const body = quoteIdent(adopt.body ?? "body");
+	const mirror = mirrorsOf(adopt);
+	for (const [column] of mirror) if (column === (adopt.token ?? "token") || column === (adopt.body ?? "body")) throw configError(`PermDock CLI: rls.approvals.mirror names the ${column} column, which already holds the token or the body`);
+	const open = adopt.open ?? "insert";
+	if (open !== "insert" && open !== "attach") throw configError(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
+	const schema = adopt.schema;
+	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw configError("PermDock CLI: rls.approvals.schema must be a schema name");
+	const fn = (name) => schema === void 0 ? qualified(ctx, name) : `${quoteIdent(schema)}.${name}`;
+	const index = (name) => quoteIdent(`${base}_permdock_${name}`);
+	const status = `a.${body} ->> 'status'`;
+	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
+	const created = `(a.${body} ->> 'createdAt')`;
+	const filter = `(p_filter ->> 'status' is null or ${status} = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.${body} #>> '{subject,principal,tenant}' = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.${body} #>> '{subject,principal,id}' = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.${body} #>> '{subject,actor,id}' = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.${body} #>> '{subject,session}' = p_filter ->> 'session')`;
+	const columns = [
+		token,
+		body,
+		...mirror.map(([column]) => quoteIdent(column))
+	];
+	const inserted = populate(table, [
+		[adopt.token ?? "token", "p_request ->> 'token'"],
+		[adopt.body ?? "body", "p_request"],
+		...mirror.map(([column, field]) => [column, MIRRORS[field]("p_request")])
+	]);
+	const insertSql = `-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (${columns.join(", ")})
+  select ${columns.map((column) => `r.${column}`).join(", ")}
+  from ${inserted} r
+  on conflict (${token}) do update
+    set ${columns.filter((column) => column !== token).map((column) => `${column} = excluded.${column}`).join(", ")}
+    where ${status} = 'expired' or ${expires} <= now()
+$$;`;
+	const attachSql = `create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+begin
+  update ${table} a
+  set ${body} = p_request${mirrorSet(table, mirror, "p_request")}
+  where a.${token} = p_request ->> 'token'
+    and (a.${body} is null or ${status} = 'expired' or ${expires} <= now());
+  if not found and not exists (select 1 from ${table} a where a.${token} = p_request ->> 'token') then
+    raise exception using
+      errcode = 'P0002',
+      message = 'permdock: no row of ${adopt.table.replaceAll("'", "''")} holds approval token ' || (p_request ->> 'token'),
+      hint = 'insert the application row with this token before opening the request';
+  end if;
+end;
+$$;`;
+	return `-- approval store adopted onto ${adopt.table}: ApprovalRequest bodies in ${adopt.body ?? "body"}, keyed by ${adopt.token ?? "token"}; supabaseApprovalStore calls the functions below
+alter table ${table} add column if not exists ${token} text;
+alter table ${table} add column if not exists ${body} jsonb;
+create unique index if not exists ${index("token")} on ${table} (${token});
+create index if not exists ${index("page")} on ${table} ((${body} ->> 'createdAt') collate "C", ${token} collate "C");
+create index if not exists ${index("status")} on ${table} ((${body} ->> 'status'));
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema, body, `${base}_permdock_body_schema`)}
+${open === "attach" ? attachSql : insertSql}
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body} from ${table} a where a.${token} = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = p_next${mirrorSet(table, mirror, "p_next")}
+  where a.${token} = p_token
+    and ${status} = 'pending'
+    and ${expires} > now()
+    and coalesce(jsonb_array_length(a.${body} -> 'approvals'), 0) = p_seen
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = a.${body} || jsonb_build_object('consumedAt', p_now)${mirrorSet(table, mirror, `(a.${body} || jsonb_build_object('consumedAt', p_now))`)}
+  where a.${token} = p_token
+    and ${status} = 'approved'
+    and a.${body} ->> 'consumedAt' is null
+    and ${expires} > p_now::timestamptz
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body}
+  from ${table} a
+  where a.${body} is not null
+    and ${filter}
+    and (p_after_created is null
+      or (${created} collate "C", a.${token} collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by ${created} collate "C", a.${token} collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set ${body} = a.${body} || '{"status":"expired"}'::jsonb${mirrorSet(table, mirror, `(a.${body} || '{"status":"expired"}'::jsonb)`)}
+    where ${status} = 'pending' and ${expires} <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set ${body} = (a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))${mirrorSet(table, mirror, `((a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object('status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note)))`)}
+    where ${status} = 'pending'
+      and ${filter.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+//#endregion
+//#region src/cli/rls/permission-holders.ts
+/** `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL contract. */
+function permittedUsersHelper(scope) {
+	return checkName(`permitted_${scope}_users`);
+}
+/** The users with a membership row on the instance `p_id`, or `undefined` when the scope's memberships are not all in tables. */
+function candidatesSql(ctx, scope, user) {
+	const mapped = scopeTable(ctx, scope);
+	if (mapped !== void 0) return {
+		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
+    from ${quoteQualified(mapped.table.table)} m
+    where m.${quoteIdent(mapped.column)} = p_id`,
+		keys: []
+	};
+	const sources = holderSources(ctx, scope);
+	if (sources === void 0 || sources === "not-tables") return;
+	return {
+		sql: sources.map((source, index) => `    select h.user_id::${user}
+    from (
+${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
+    ) h`).join("\n    union\n"),
+		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
+	};
+}
+/** `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a `%type` variable. */
+function functionBody(keys, query) {
+	if (keys.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${query}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${keys.map((key) => `  ${key} := p_id;`).join("\n")}
+begin
+  return query
+${query.replaceAll(/^/gmu, "  ")};
+end
+$$;`;
+}
+/**
+* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
+* mode: the users who hold a permission key on one instance, read from the
+* scope's membership rows and the global-roles table and kept when
+* `permitted_<scope>_ids_by_permission_for` lists the instance or
+* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
+* suspension apply as for the user. It names other users, so no client role
+* may execute it, and a backend role needs its own grant.
+*/
+function permissionHoldersSql(ctx) {
+	if (ctx.authorize !== "database") return "";
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const global = globalRoleRows(ctx);
+	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
+	return `${ctx.scopes.map(({ name }) => {
+		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
+		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
+		const fn = qualified(ctx, permittedUsersHelper(name));
+		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
+		const type = scopeTypeOf(ctx, name);
+		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
+create or replace function ${fn}(p_permission text, p_id ${type})
+returns setof ${user}
+${functionBody(candidates.keys, `  select c.user_id
+  from (
+${candidates.sql}
+    union
+    select ${global.userSql}::${user}
+    from ${global.from}
+  ) c(user_id)
+  where c.user_id is not null
+    and (
+      p_id in (select ${ids}(c.user_id, p_permission))
+      or ${hasFor}(c.user_id, p_permission)
+    )
+  order by 1`)}
+revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
+	}).join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/supabase-hook/sql.ts
+const MANAGED_TRIGGER = "permdock_protect_managed";
 function hookSql(parts) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.custom_access_token_hook`;
@@ -616,14 +1796,14 @@ function hookSql(parts) {
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
 	const plan = parts.attrs;
-	const fromTable = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
+	const tableMembershipSource = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
   select jsonb_strip_nulls(jsonb_build_object(${plan.columns.map((column) => `${quoteLiteral(column)}, to_jsonb(p.${quoteIdent(column)})`).join(", ")}))
     into attrs
-    from ${table(plan.table)} p
+    from ${quoteQualified(plan.table)} p
     where p.${quoteIdent(plan.id)} = v_attrs_user;`;
 	const fromMeta = plan === void 0 || plan.meta.length === 0 ? "" : `
   attrs := coalesce(attrs, '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object(${plan.meta.map((key) => `${quoteLiteral(key)}, claims -> 'app_metadata' -> ${quoteLiteral(key)}`).join(", ")}));`;
-	const attrs = plan === void 0 ? "" : `${fromTable}${fromMeta}
+	const attrs = plan === void 0 ? "" : `${tableMembershipSource}${fromMeta}
   if attrs is not null and attrs <> '{}'::jsonb then
     used := octet_length(attrs::text);
     if used > budget then
@@ -721,7 +1901,7 @@ function extraGrantsSql(extra) {
 }
 function beforeGrantsSql(before, extra) {
 	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
-	return [...[...new Set(before.map((fn) => fn.split(".")[0] ?? ""))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
 }
 /**
 * Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
@@ -752,6 +1932,92 @@ function readsSql(parts) {
 	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
 	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
 }
+function managedSql(parts) {
+	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
+	if (managed.length === 0) return "";
+	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
+	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
+create or replace function ${guard}()
+returns trigger
+language plpgsql
+set search_path = ''
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  if current_user in ('anon', 'authenticated') and (
+    column_name = ''
+    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
+    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
+  ) then
+    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
+      using errcode = '42501';
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${quoteQualified(source.sql.table)};
+create trigger ${quoteIdent(MANAGED_TRIGGER)}
+  before insert or update or delete on ${quoteQualified(source.sql.table)}
+  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
+}
+/** The `config.toml` block that enables the hook and bounds token staleness. */
+function configToml(schema, jwtExpiry) {
+	return `[auth]
+jwt_expiry = ${String(jwtExpiry)}
+
+[auth.hook.custom_access_token]
+enabled = true
+uri = "${hookUri(schema)}"`;
+}
+const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
+function hookParts(scopes, config, overrides) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0) throw configError("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
+	const root = rootScope(scopes) ?? "tenant";
+	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
+	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
+	quoteIdent(schema);
+	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
+	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
+	checkSources({
+		sources: hook.memberships,
+		scopes
+	});
+	const parts = {
+		schema,
+		scopes,
+		root,
+		sources: hook.memberships,
+		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
+		version: hook.version !== false,
+		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
+		tenantClaim,
+		users: suspension?.users,
+		hook,
+		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
+		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
+		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
+		extra: extraPlan.claims,
+		before: beforePlan(hook.before),
+		helpers: {
+			schema: config.rls?.schema ?? "permdock",
+			...memberForPlan({
+				scopes,
+				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
+				memberSources: config.rls?.membershipSources ?? hook.memberships
+			})
+		}
+	};
+	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw configError(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
+	if (extraPlan.errors.length > 0) throw configError(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
+	quoteIdent(parts.tenantClaim);
+	return parts;
+}
+//#endregion
+//#region src/cli/supabase-hook/version.ts
+const VERSION_TRIGGER = "permdock_authz_version";
+const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
 function versionSql(parts) {
 	if (!parts.version) return "";
 	const schema = quoteIdent(parts.schema);
@@ -787,225 +2053,22 @@ returns trigger
 language plpgsql
 security definer
 set search_path = ''
-as $$
-declare
-  column_name text := tg_argv[0];
-begin
-  perform ${bumpFor}(array[
-    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
-    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
-  ]::uuid[]);
-  return null;
-end;
-$$;
-revoke execute on function ${bump}() from public, anon, authenticated;
-${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${table(name)};
-create trigger ${quoteIdent(VERSION_TRIGGER)}
-  after insert or update or delete on ${table(name)}
-  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
-}
-const SUBJECT_FOR = "subject_for";
-/**
-* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
-* token for `p_user`, from the same membership, role, suspension and version
-* reads, plus the custom roles the user holds when `database` mode keeps them
-* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
-* subject for an acting user or a job from it. Naming the user is why no
-* client role may execute it.
-*/
-function subjectForSql(parts, config) {
-	const schema = quoteIdent(parts.schema);
-	const fn = `${schema}.${SUBJECT_FOR}`;
-	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
-    into held
-    from ${rows.from}
-    where ${rows.userSql} = v_roles_user;`;
-	const suspended = parts.users === void 0 ? "" : `
-  if not ${activeRowSql(parts.users, "uid")} then
-    return jsonb_build_object('id', uid::text, 'active', false);
-  end if;`;
-	const version = parts.version ? `
-  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
-  ver := coalesce(ver, 0);` : "";
-	const custom = config.rls?.customRoles === true && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
-	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
-create or replace function ${fn}(p_user uuid)
-returns jsonb
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  uid uuid := p_user;
-  held jsonb;
-  memberships jsonb;
-  custom jsonb := '[]'::jsonb;
-  ver bigint;${typedUsers(parts)}
-begin
-  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
-    return null;
-  end if;${suspended}
-${roles}
-  select coalesce(jsonb_agg(x.entry order by x.ord, x.entry ->> 'scope', x.entry ->> 'id', x.entry::text), '[]'::jsonb)
-    into memberships
-    from (
-${entriesSql(parts).replaceAll(/^/gmu, "      ")}
-    ) x;${custom}${version}
-  return jsonb_strip_nulls(jsonb_build_object(
-    'id', uid::text,
-    'active', true,
-    'roles', held,
-    'memberships', memberships,
-    'customRoles', custom,
-    'authzVersion', ver
-  ));
-end;
-$$;
-revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
-}
-/**
-* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
-* function per reader, in the API schema, executable by `service_role` only.
-*/
-function apiWrappersSql(parts) {
-	const api = parts.hook.api;
-	if (api === void 0) return "";
-	const target = api.schema ?? "public";
-	const names = hookApiNames(api.prefix);
-	const source = quoteIdent(parts.schema);
-	const wrapper = (name, inner, params, args, types, returns) => {
-		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
-		if (target === parts.schema && name === inner) throw new Error(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
-		return `create or replace function ${fn}(${params})
-returns ${returns}
-language sql
-stable
-security definer
-set search_path = ''
-as $$ select ${source}.${inner}(${args}) $$;
-revoke execute on function ${fn}(${types}) from public, anon, authenticated;
-grant execute on function ${fn}(${types}) to service_role;`;
-	};
-	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
-${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
-
-${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
-
-${wrapper(names.authzVersionFor, AUTHZ_VERSION_FOR, "p_user uuid", "p_user", "uuid", "bigint")}`;
-}
-const AUTHZ_VERSION_FOR = "authz_version_for";
-/**
-* `authz_version_for(p_user uuid) returns bigint`: the authorization version
-* `subject_for` reports, without reading roles or memberships, so a
-* `claimsFirst` reread can check a token's freshness on every request and read
-* the full subject only when it is behind. `null` for an unknown or suspended
-* user, and when the version is off.
-*/
-function authzVersionForSql(parts) {
-	const schema = quoteIdent(parts.schema);
-	const fn = `${schema}.${AUTHZ_VERSION_FOR}`;
-	return `-- the authorization version subject_for reports for p_user, for a cheap freshness check; no client role may execute it
-create or replace function ${fn}(p_user uuid)
-returns bigint
-language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-  uid uuid := p_user;
-  ver bigint;
-begin
-  if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
-    return null;
-  end if;${parts.users === void 0 ? "" : `
-  if not ${activeRowSql(parts.users, "uid")} then
-    return null;
-  end if;`}${parts.version ? `
-  select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
-  ver := coalesce(ver, 0);` : ""}
-  return ver;
-end;
-$$;
-revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
-}
-const MEMBERS_OF = "members_of";
-function membersOfSql(parts) {
-	const fn = `${quoteIdent(parts.schema)}.${MEMBERS_OF}`;
-	const keep = parts.sources.some((source) => source.sql.keeps);
-	const rows = parts.sources.map((source) => source.sql.list(keep).replaceAll(/^/gmu, "      ")).join("\n      union all\n");
-	return `-- the live memberships of one scope instance, for a backend that lists members over PostgREST; no client role may execute it
-create or replace function ${fn}(p_scope text, p_id text)
-returns jsonb
-language sql
-stable
-security definer
-set search_path = ''
-as $$
-  select coalesce(jsonb_agg(jsonb_build_object(
-      'principal', jsonb_build_object('id', s.user_id),
-      'membership', jsonb_strip_nulls(jsonb_build_object(
-        'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
-        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
-        'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
-      ))
-    ) order by s.user_id, s.roles::text), '[]'::jsonb)
-  from (
-${rows}
-  ) s
-$$;
-revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
-}
-/**
-* The custom roles `p_user` holds: tenant roles named on a membership of the
-* scope (and instance) they live at, and platform roles among the global
-* roles, each with its grants and includes in `CustomRole` form.
-*/
-function customRolesOfSql(parts) {
-	const helpers = quoteIdent(parts.helpers.schema);
-	const perms = `${helpers}.custom_role_permissions`;
-	const includes = `${helpers}.custom_role_includes`;
-	const root = quoteLiteral(parts.root);
-	const match = `p.tenant_id is not distinct from c.tenant_id and p.scope = c.scope and p.scope_id is not distinct from c.scope_id and p.role = c.role`;
-	return `
-  select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
-      'name', c.role,
-      'tenant', c.tenant_id::text,
-      'scope', c.scope,
-      'id', c.scope_id,
-      'grants', (
-        select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
-            'permission', p.permission,
-            'effect', p.effect,
-            'level', to_jsonb(p) ->> 'level'
-          )) order by p.permission, p.effect), '[]'::jsonb)
-        from ${perms} p
-        where ${match}
-      ),
-      'includes', (
-        select jsonb_agg(p.include_role order by p.include_role)
-        from ${includes} p
-        where ${match}
-      )
-    )) order by c.tenant_id::text, c.scope, c.scope_id, c.role), '[]'::jsonb)
-    into custom
-    from (
-      select tenant_id, scope, scope_id, role from ${perms}
-      union
-      select tenant_id, scope, scope_id, role from ${includes}
-    ) c
-    where (c.scope = 'global' and c.tenant_id is null and held ? c.role)
-      or exists (
-        select 1
-        from jsonb_array_elements(memberships) m
-        where m -> 'roles' ? c.role
-          and m ->> 'scope' = c.scope
-          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
-          and (c.scope_id is null or c.scope_id = m ->> 'id')
-      );`;
+as $$
+declare
+  column_name text := tg_argv[0];
+begin
+  perform ${bumpFor}(array[
+    case when tg_op <> 'INSERT' then to_jsonb(old) ->> column_name end,
+    case when tg_op <> 'DELETE' then to_jsonb(new) ->> column_name end
+  ]::uuid[]);
+  return null;
+end;
+$$;
+revoke execute on function ${bump}() from public, anon, authenticated;
+${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${quoteQualified(name)};
+create trigger ${quoteIdent(VERSION_TRIGGER)}
+  after insert or update or delete on ${quoteQualified(name)}
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
 }
 function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;
@@ -1046,7 +2109,7 @@ function memberUsersVersionSql(parts, bumpFor) {
 	const linkedBump = `${quoteIdent(parts.schema)}.permdock_bump_authz_version_linked_users`;
 	const groups = [...byTable];
 	const lookup = (users, indent) => `${indent}perform ${bumpFor}(array(
-${indent}  select u.${quoteIdent(users.key)}::uuid from ${table(users.table)} u
+${indent}  select u.${quoteIdent(users.key)}::uuid from ${quoteQualified(users.table)} u
 ${indent}  where ((tg_op <> 'INSERT' and u.${quoteIdent(users.id)} = old.${quoteIdent(users.ref)})
 ${indent}     or (tg_op <> 'DELETE' and u.${quoteIdent(users.id)} = new.${quoteIdent(users.ref)}))
 ${indent}    and ${signedUp(`u.${quoteIdent(users.key)}::uuid`)}
@@ -1059,7 +2122,7 @@ ${group.users.map((users) => lookup(users, "    ")).join("\n")}
   end if;`;
 	}).join("\n");
 	const memberTriggers = groups.map(([, group]) => {
-		const target = table(group.table);
+		const target = quoteQualified(group.table);
 		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after insert or update or delete on ${target}
@@ -1077,7 +2140,7 @@ create trigger ${quoteIdent(VERSION_TRIGGER)}
 		userTables.set(key, entry);
 	}
 	const userTriggers = [...userTables.values()].map((entry) => {
-		const target = table(entry.table);
+		const target = quoteQualified(entry.table);
 		const name = quoteIdent(`${VERSION_TRIGGER}_${entry.key}`);
 		return `drop trigger if exists ${name} on ${target};
 create trigger ${name}
@@ -1169,7 +2232,7 @@ ${indent}end if;
 ${indent}insert into ${versionTable} as v (user_id, version)
 ${indent}select distinct h.user_id, 1
 ${indent}from (
-${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${table(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${table(holder.table)} h join ${table(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
+${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${quoteQualified(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${quoteQualified(holder.table)} h join ${quoteQualified(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
 ${indent}) h
 ${indent}where h.user_id is not null
 ${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
@@ -1217,143 +2280,15 @@ end;
 $$;
 revoke execute on function ${bump}() from public, anon, authenticated;
 ${groups.map(([, group]) => {
-		const target = table(group.table);
+		const target = quoteQualified(group.table);
 		return `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${target};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after update or delete on ${target}
   for each row execute function ${bump}();`;
 	}).join("\n")}`;
 }
-/**
-* Fails the migration when a client role can write an `attrs` column: a
-* claim the user can set is not a server-owned attribute.
-*/
-function attrsGuardSql(plan) {
-	if (plan?.table === void 0 || plan.columns.length === 0) return "";
-	const target = quoteLiteral(table(plan.table));
-	return `-- attrs must be server-owned: refuse columns anon or authenticated can insert or update
-do $$
-begin
-  if exists (
-    select 1
-    from (values ${plan.columns.map((column) => `(${quoteLiteral(column)})`).join(", ")}) c(name)
-    cross join (values ('anon'), ('authenticated')) r(role)
-    where has_column_privilege(r.role, ${target}, c.name, 'INSERT')
-       or has_column_privilege(r.role, ${target}, c.name, 'UPDATE')
-  ) then
-    raise exception 'PermDock: an attrs column of % is writable by anon or authenticated; revoke insert and update on it before it becomes a claim', ${target}
-      using errcode = '42501';
-  end if;
-end
-$$;`;
-}
-function managedSql(parts) {
-	const managed = parts.sources.filter((source) => source.sql.managed !== void 0);
-	if (managed.length === 0) return "";
-	const guard = `${quoteIdent(parts.schema)}.permdock_protect_managed`;
-	return `-- memberships the identity provider owns: clients (anon, authenticated) cannot write them
-create or replace function ${guard}()
-returns trigger
-language plpgsql
-set search_path = ''
-as $$
-declare
-  column_name text := tg_argv[0];
-begin
-  if current_user in ('anon', 'authenticated') and (
-    column_name = ''
-    or (tg_op <> 'INSERT' and to_jsonb(old) ->> column_name = 'idp')
-    or (tg_op <> 'DELETE' and to_jsonb(new) ->> column_name = 'idp')
-  ) then
-    raise exception 'PermDock: % rows managed by the identity provider cannot be changed here', tg_table_name
-      using errcode = '42501';
-  end if;
-  return coalesce(new, old);
-end;
-$$;
-${managed.map((source) => `drop trigger if exists ${quoteIdent(MANAGED_TRIGGER)} on ${table(source.sql.table)};
-create trigger ${quoteIdent(MANAGED_TRIGGER)}
-  before insert or update or delete on ${table(source.sql.table)}
-  for each row execute function ${guard}(${quoteLiteral(source.sql.managed ?? "")});`).join("\n")}`;
-}
-/** The `config.toml` block that enables the hook and bounds token staleness. */
-function configToml(schema, jwtExpiry) {
-	return `[auth]
-jwt_expiry = ${String(jwtExpiry)}
-
-[auth.hook.custom_access_token]
-enabled = true
-uri = "${hookUri(schema)}"`;
-}
-const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
-function hookParts(scopes, config, overrides) {
-	const hook = config.supabase?.hook;
-	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
-	const root = rootScope(scopes) ?? "tenant";
-	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
-	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
-	quoteIdent(schema);
-	const tenantClaim = config.rls?.tenantClaim ?? "tenant_id";
-	const extraPlan = extraClaimsPlan(hook.claims, tenantClaim);
-	checkSources({
-		sources: hook.memberships,
-		scopes
-	});
-	const parts = {
-		schema,
-		scopes,
-		root,
-		sources: hook.memberships,
-		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
-		version: hook.version !== false,
-		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
-		tenantClaim,
-		users: suspension?.users,
-		hook,
-		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
-		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
-		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
-		extra: extraPlan.claims,
-		before: beforePlan(hook.before),
-		helpers: {
-			schema: config.rls?.schema ?? "permdock",
-			...memberForPlan({
-				scopes,
-				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
-				memberSources: config.rls?.membershipSources ?? hook.memberships
-			})
-		}
-	};
-	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
-	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
-	quoteIdent(parts.tenantClaim);
-	return parts;
-}
-function permdockClaim(name, budget = false) {
-	return {
-		name,
-		source: "permdock",
-		budget
-	};
-}
-function hookClaims(parts) {
-	return [
-		permdockClaim("user_role"),
-		permdockClaim("roles"),
-		permdockClaim("memberships", true),
-		permdockClaim("memberships_truncated"),
-		permdockClaim(parts.tenantClaim),
-		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
-		...parts.version ? [permdockClaim("authz_ver")] : [],
-		...parts.extra.map((entry) => ({
-			name: entry.claim,
-			source: entry.fn,
-			budget: false
-		}))
-	];
-}
 //#endregion
-//#region src/cli/supabase-hook-manifest.ts
+//#region src/cli/supabase-hook/manifest.ts
 function helperList(parts, types) {
 	const client = ["authenticated"];
 	return [helperEntry(HELPERS.has, "p_grant text", "boolean", client), ...parts.scopes.flatMap((scope) => {
@@ -1380,18 +2315,21 @@ function helperEntry(name, args, returns, execute) {
 */
 function trustedHelpers(parts, config, types, tenantType, policy) {
 	const database = resolveAuthorize(config) === "database";
-	const custom = database && config.rls?.customRoles === true;
+	const custom = database && customRolesOn(config.rls);
 	const everyFor = parts.scopes.every((scope) => parts.helpers.memberFor.includes(scope.name));
 	const client = ["authenticated"];
 	const scopeTypes = parts.scopes.map((scope) => [scope.name, types.get(scope.name) ?? "uuid"]);
 	const forUser = database ? [
 		helperEntry(HELPERS.hasFor, "p_user uuid, p_grant text", "boolean", []),
 		...scopeTypes.map(([scope, type]) => helperEntry(permittedForHelper(scope), "p_user uuid, p_grant text", `setof ${type}`, [])),
-		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", []))
+		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", [])),
+		...scopeTypes.filter(([scope]) => parts.helpers.holders.includes(scope)).map(([scope, type]) => helperEntry(permittedUsersHelper(scope), `p_permission text, p_id ${type}`, "setof uuid", []))
 	] : [];
 	const keyed = [
 		helperEntry(USER_ID_HELPER, "", "uuid", client),
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
+		...!config.rls?.approvals ? [] : [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
@@ -1410,7 +2348,7 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 function activeRowManifest(row) {
 	const keep = "keep" in row ? keptKeys(row) : [];
 	return {
-		table: qualifiedTable(row.table),
+		table: qualifySqlTable(row.table),
 		id: row.id,
 		...row.disabledAt === void 0 ? {} : { disabledAt: row.disabledAt },
 		...row.status === void 0 ? {} : { status: row.status },
@@ -1425,9 +2363,9 @@ function rlsSettings(parts, config) {
 	const scopes = Object.entries(suspension?.scopes ?? {});
 	const assigned = rls?.assignments === void 0 ? void 0 : guardedTables(config, parts.scopes);
 	return {
-		customRoles: resolveAuthorize(config) === "database" && rls?.customRoles === true,
+		customRoles: resolveAuthorize(config) === "database" && customRolesOn(rls),
 		...parts.roles === void 0 ? {} : { roles: {
-			table: qualifiedTable(parts.roles.table),
+			table: qualifySqlTable(parts.roles.table),
 			user: { column: parts.roles.user },
 			role: parts.roles.role
 		} },
@@ -1537,142 +2475,28 @@ function defaultOut(config) {
 	return config.supabase?.hook?.out ?? "supabase/permdock-hook.sql";
 }
 //#endregion
-//#region src/cli/supabase-setup.ts
-const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
-function escape(text) {
-	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
-}
-/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
-function helpersDefined(sql, schema) {
-	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
-	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
-	const names = /* @__PURE__ */ new Set();
-	for (const match of sql.matchAll(create)) {
-		const name = (match[1] ?? "").toLowerCase();
-		if (HELPER_NAME.test(name)) names.add(name);
-	}
-	return names;
-}
-/**
-* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
-* its `helpers` part when it has `{part}`), the SQL files next to the hook,
-* and the migration folders, not the hook itself.
-*/
-function helperSources(cwd, config, hookOut) {
-	const hook = resolve(cwd, hookOut);
-	const files = new Set(sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS));
-	const rlsOut = resolve(cwd, partPath(config.rls?.out ?? "rls.sql", "helpers"));
-	if (rlsOut.endsWith(".sql") && existsSync(rlsOut)) files.add(rlsOut);
-	const beside = dirname(hook);
-	if (existsSync(beside)) {
-		for (const entry of readdirSync(beside, { withFileTypes: true })) if (entry.isFile() && entry.name.endsWith(".sql")) files.add(join(beside, entry.name));
-	}
-	files.delete(hook);
-	return [...files];
-}
-function missingHelpersInFiles(cwd, config, manifest) {
-	const found = /* @__PURE__ */ new Set();
-	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
-	return manifest.helpers.functions.filter((name) => !found.has(name));
-}
-async function missingHelpersInDb(db, manifest, connect = (url) => connectPg(url, "permdock supabase hook generate --db")) {
-	const client = await connect(db);
-	try {
-		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
-where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema, [...manifest.helpers.functions]]);
-		const found = new Set(result.rows.map((row) => row["proname"]));
-		return manifest.helpers.functions.filter((name) => !found.has(name));
-	} finally {
-		await client.end();
-	}
-}
-function missingHelpersMessage(manifest, missing) {
-	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
-}
-/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
-function oversizedClaims(samples, manifest) {
-	const encoder = new TextEncoder();
-	const oversized = [];
-	for (const claim of manifest.claims) {
-		if (claim.source === "permdock") continue;
-		let bytes = 0;
-		for (const sample of samples) {
-			if (sample === null || typeof sample !== "object") continue;
-			const value = Object.hasOwn(sample, claim.name) ? sample[claim.name] : void 0;
-			if (value !== void 0) bytes = Math.max(bytes, encoder.encode(JSON.stringify(value)).byteLength);
-		}
-		if (bytes > manifest.budget.bytes) oversized.push({
-			name: claim.name,
-			bytes
-		});
-	}
-	return oversized;
-}
-/** `memberships[i]` entries `subjectFromSupabase` drops, per sample index. */
-function droppedMemberships(samples) {
-	const out = [];
-	for (const [index, sample] of samples.entries()) {
-		if (sample === null || typeof sample !== "object") continue;
-		const claim = Object.hasOwn(sample, "memberships") ? sample["memberships"] : void 0;
-		const { dropped } = readMemberships(claim);
-		if (dropped.length > 0) out.push({
-			sample: index,
-			entries: dropped
-		});
-	}
-	return out;
-}
-function pd039(input) {
-	const findings = [];
-	const missing = missingHelpersInFiles(input.cwd, input.config, input.manifest);
-	if (missing.length > 0) findings.push({
-		code: "PD039",
-		severity: "warning",
-		message: missingHelpersMessage(input.manifest, missing).slice(6),
-		fix: "run permdock rls generate, or set rls.out to the file that holds the helpers (with {part} for --split output) or write them next to the hook"
-	});
-	const fixture = input.config.doctor?.claims;
-	if (fixture !== void 0) {
-		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
-		const samples = Array.isArray(parsed) ? parsed : [];
-		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `claim ${claim.name} is ${String(claim.bytes)} bytes of JSON in ${fixture}, more than the ${String(input.manifest.budget.bytes)}-byte memberships budget`,
-			fix: "return less from the claim function, or read the data per request instead of from the token"
-		});
-		for (const { sample, entries } of droppedMemberships(samples)) findings.push({
-			code: "PD039",
-			severity: "warning",
-			message: `sample ${String(sample)} in ${fixture} has memberships ${entries.map((entry) => `[${String(entry)}]`).join(", ")} that subjectFromSupabase drops (membership-dropped)`,
-			fix: "emit { scope, id, roles } (or tenant, team or on) with a non-empty roles array for each entry"
-		});
-	}
-	return findings;
-}
-//#endregion
-//#region src/cli/supabase-hook.ts
+//#region src/cli/supabase-hook/supabase-hook.ts
 const SUPABASE_HELP = `permdock supabase hook generate | inspect
 
-  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
+  hook generate [--out <file>] [--check] [--db-url-stdin] [--schemas pg-delta|migra|migrations]
                 [--active-from app_metadata.active_<scope>|<table>.<column>]
                 [--budget 1024] [--schema public] [--grants-out <file>|-]
   inspect [--json] [--out [permdock.manifest.json]] [--check]
 
-Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
+Reads supabase.hook from permdock.config.ts: the tableMembershipSource / junctionMembershipSource sources the app
 passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
-needs (the ones db diff drops in --grants-out, for declarative schemas), the permdock_authz_version table
-and its triggers. Never grants anything to
+needs, the permdock_authz_version table and its triggers. Under pg-delta (the default) --out defaults to
+supabase/schemas/<schema>/functions/custom_access_token_hook.sql and the grants stay in it; under
+--schemas migra, --grants-out takes the privileges supabase db diff drops. Never grants anything to
 service_role unless supabase.hook.api is set, which grants its wrappers to it. inspect prints the manifest: helper schema, names and signatures, tenant claim,
 budget, the claims the hook writes, the membership sources and the columns that decide them.
 --out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
 file differs.
 `;
-const MANIFEST_FILE = "permdock.manifest.json";
-/** `supabase.hook.out`, else pg-delta's per-schema path, else `supabase/permdock-hook.sql`. */
-function hookOut(cwd, config, schema) {
-	const pgDelta = supabaseConfig(cwd).pgDelta;
-	return config.supabase?.hook?.out !== void 0 || pgDelta === void 0 ? defaultOut(config) : pgDeltaPath(pgDelta.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
+/** `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else `supabase/permdock-hook.sql`. */
+function hookOut(cwd, config, schema, flag) {
+	const schemas = resolveSchemas(cwd, config, flag);
+	return config.supabase?.hook?.out !== void 0 || schemas.mode !== "pg-delta" ? defaultOut(config) : pgDeltaPath(schemas.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
 }
 /**
 * The manifest `supabase inspect` prints. With `policy`, `rls.helpers` also
@@ -1680,7 +2504,14 @@ function hookOut(cwd, config, schema) {
 * `assigns`.
 */
 function supabaseHookManifest(scopes, config, overrides = {}, policy) {
-	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
+	const manifest = manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
+	return overrides.schemas === void 0 ? manifest : {
+		...manifest,
+		hook: {
+			...manifest.hook,
+			schemas: overrides.schemas
+		}
+	};
 }
 /**
 * The hook migration. With `grantsOut`, the statements `supabase db diff`
@@ -1745,8 +2576,7 @@ function inspectText(manifest) {
 function manifestFile(cwd, rel, manifest, check) {
 	const path = resolve(cwd, rel);
 	if (!check) {
-		mkdirSync(dirname(path), { recursive: true });
-		writeFileSync(path, `${JSON.stringify(manifest, null, 2)}\n`);
+		writeFileEnsuringDir(path, formatManifestJson(manifest));
 		return {
 			code: 0,
 			output: `wrote ${rel}`
@@ -1758,14 +2588,14 @@ function manifestFile(cwd, rel, manifest, check) {
 	};
 	let onDisk;
 	try {
-		onDisk = JSON.parse(readFileSync(path, "utf8"));
+		onDisk = readJsonFile(path);
 	} catch {
 		return {
 			code: 1,
 			output: `supabase manifest drift: ${rel} is not JSON`
 		};
 	}
-	const found = typeof onDisk === "object" && onDisk !== null && !Array.isArray(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
+	const found = isRecord(onDisk) ? Object.fromEntries(Object.entries(onDisk)) : {};
 	const changed = [.../* @__PURE__ */ new Set([...Object.keys(manifest), ...Object.keys(found)])].filter((key) => JSON.stringify(Reflect.get(manifest, key)) !== JSON.stringify(found[key]));
 	return changed.length === 0 ? {
 		code: 0,
@@ -1778,12 +2608,18 @@ function manifestFile(cwd, rel, manifest, check) {
 async function loadScopes(cwd, config) {
 	return scopeList((await loadHookPolicy(cwd, config)).scopes);
 }
-async function loadHookPolicy(cwd, config) {
-	if (config.policy === void 0) throw new Error("PermDock CLI: supabase hook generate needs policy in permdock.config.ts");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, config.policy)), ["policy"]));
+function loadHookPolicy(cwd, config) {
+	return requirePolicy(cwd, config.policy, "supabase hook generate needs policy in permdock.config.ts");
 }
 async function runSupabase(input) {
 	const [area, action] = input.rest;
+	const badSchemas = schemasRefusal("supabase", input.schemas);
+	if (badSchemas !== void 0) return {
+		code: 2,
+		output: badSchemas
+	};
+	const flag = isSupabaseSchemas(input.schemas) ? input.schemas : void 0;
+	const schemas = resolveSchemas(input.cwd, input.config, flag);
 	const overrides = Object.fromEntries(Object.entries({
 		activeFrom: input.activeFrom,
 		budget: input.budget,
@@ -1793,7 +2629,8 @@ async function runSupabase(input) {
 		const policy = await loadHookPolicy(input.cwd, input.config);
 		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
 			...overrides,
-			out: hookOut(input.cwd, input.config, input.schema)
+			out: hookOut(input.cwd, input.config, input.schema, flag),
+			schemas: schemas.mode
 		}, policy);
 		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
 		return {
@@ -1805,8 +2642,12 @@ async function runSupabase(input) {
 		code: 2,
 		output: SUPABASE_HELP
 	};
+	if (input.grantsOut !== void 0 && schemas.mode !== "migra") return {
+		code: 2,
+		output: `supabase hook generate --grants-out is for --schemas migra: ${schemas.mode === "pg-delta" ? "pg-delta keeps the grants in the hook file" : "a hand-written migration keeps its grants"}, so drop --grants-out`
+	};
 	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
-	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema);
+	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema, flag);
 	const outPath = resolve(input.cwd, outRel);
 	const hook = input.config.supabase?.hook;
 	const grantsFile = input.grantsOut === void 0 ? [] : [{
@@ -1834,9 +2675,8 @@ async function runSupabase(input) {
 			output: `supabase hook drift: ${drift.join("; ")}`
 		};
 	}
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, sql);
-	const grantsWritten = writeSqlFiles(input.cwd, grantsFile);
+	writeFileEnsuringDir(outPath, sql);
+	const grantsWritten = writeOutputFiles(input.cwd, grantsFile);
 	const placed = {
 		...manifest,
 		hook: {
@@ -1857,4 +2697,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { seedsMigration as _, supabaseHookManifest as a, attrsPlan as c, resolveAuthorize as d, driftOf as f, pgDeltaPath as g, partPath as h, runSupabase as i, parseRbacAuthorize as l, parseSplit as m, hookOut as n, supabaseHookSql as o, isSeedsDirectory as p, loadScopes as r, pd039 as s, grantsLabel as t, rbacScaffold as u, writeSqlFiles as v };
+export { pd045 as _, supabaseHookManifest as a, approvalsSql as c, resolveAuthorize as d, pd039 as f, attrsPlan as g, schemasRefusal as h, runSupabase as i, parseRbacAuthorize as l, resolveSchemas as m, hookOut as n, supabaseHookSql as o, isSupabaseSchemas as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, rbacScaffold as u, readSupabaseConfig as v, supabaseConfig as y };