permdock 0.4.0 → 0.6.0

package/dist/{supabase-hook-Cva3ikXz.js → supabase-hook-BMoEhZir.js}

@@ -1,23 +1,26 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp } from "./refs-f3imMjNW.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
+import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { i as SUPABASE_MANIFEST_SCHEMA } from "./version-BEogC-rB.js";
-import { c as requirePolicy } from "./load-C3_oTHyO.js";
-import { r as scopeColumn } from "./compile-CcEu2ZQ1.js";
-import { t as authorizeSql } from "./supabase-C1TWlnYt.js";
+import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
+import { c as requirePolicy } from "./load-DFS_ry0W.js";
+import { r as scopeColumn } from "./compile-CMqMx_IN.js";
+import { t as authorizeSql } from "./supabase-x5JtR2tc.js";
 import "./budget-NbEtbJC_.js";
-import { r as qualifySqlTable } from "./sql-t8teWOfo.js";
-import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-B1-b-R0t.js";
-import { i as readMemberships } from "./manifest-BngWKryL.js";
-import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-CiwAOZtO.js";
+import { i as qualifySqlTable } from "./sql-B5T1IL83.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-vs5dGOsS.js";
+import { o as readMemberships } from "./postgrest-DAjUkF9w.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
+import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS } from "./shared-1uhI-e-b.js";
-import { l as writeOutputFiles, n as driftOf, o as partPath, s as pgDeltaPath } from "./output-files-CgIsvdSa.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
+import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
-import { B as memberIdsHelper, D as roleNames, F as hasMemberFor, H as permittedForHelper, L as memberForHelper, R as memberForSources, S as apiKeyFields, U as permittedIdsHelper, V as memberRoleOf, Y as checkSuspension, Z as pgConnector, _ as globalRoleSource, b as API_KEY_ALLOWS, n as permissionKeysForHelper, q as activeRowSql, z as memberForTable } from "./permission-keys-B26jeyUv.js";
-import { a as ASSIGNMENTS, i as guardedTables, o as OWNERSHIP, t as ownershipRules } from "./ownership-BgnbOJFT.js";
+import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
+import { B as hasPermittedUsers, E as apiKeyFields, G as memberIdsHelper, H as memberForHelper, J as permittedIdsHelper, K as memberRoleOf, Q as activeRowSql, U as memberForSources, W as memberForTable, Z as scopeTable, a as guardedTables, c as PERMISSION_HELPERS, d as permissionKeysForHelper, et as checkSuspension, f as permittedByPermissionHelper, j as roleNames, l as checkName, o as ASSIGNMENTS, q as permittedForHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, v as globalRoleRows, w as API_KEY_ALLOWS, y as globalRoleSource, z as hasMemberFor } from "./ownership-DqaJNJPn.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { parse } from "smol-toml";
@@ -49,16 +52,24 @@ function readSupabaseConfig(cwd) {
 	const apiSchemas = strings(table(root["api"])?.["schemas"]);
 	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
 	const schemaPath = pgDelta?.["declarative_schema_path"];
+	const enabled = pgDelta?.["enabled"];
 	return {
 		ok: true,
 		config: {
 			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
 			...schemaPaths === void 0 ? {} : { schemaPaths },
 			...apiSchemas === void 0 ? {} : { apiSchemas },
-			...pgDelta?.["enabled"] === true ? { pgDelta: { schemaDir: posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "") } } : {}
+			...pgDelta === void 0 ? {} : { pgDelta: {
+				...typeof enabled === "boolean" ? { enabled } : {},
+				schemaDir: declarativeSchemaDir(schemaPath)
+			} }
 		}
 	};
 }
+/** `supabase/` joined with `declarative_schema_path`, which defaults to `schemas`. */
+function declarativeSchemaDir(schemaPath) {
+	return posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "");
+}
 /** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
 function supabaseConfig(cwd) {
 	const read = readSupabaseConfig(cwd);
@@ -72,7 +83,7 @@ function pd045(cwd) {
 		code: "PD045",
 		severity: "warning",
 		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
-		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then doctor assumes Supabase's defaults for jwt_expiry and schema_paths`
+		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then PermDock assumes Supabase's defaults for jwt_expiry, schema_paths and [experimental.pgdelta], and generates for pg-delta`
 	}];
 }
 //#endregion
@@ -156,11 +167,11 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 					items: { type: "string" }
 				},
 				via: { type: "string" },
-				expiresAt: {
-					description: "Seconds since the epoch.",
+				expires_at: {
+					description: "NumericDate (RFC 7519): seconds since the epoch.",
 					type: "number"
 				},
-				grantedBy: { type: "string" },
+				granted_by: { type: "string" },
 				reason: { type: "string" },
 				member: {
 					description: "The subgroup a membership source's group fills.",
@@ -171,7 +182,7 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 						minLength: 1
 					} }
 				},
-				managedBy: { const: "idp" },
+				managed_by: { const: "idp" },
 				entitlements: {
 					type: "array",
 					items: { type: "string" }
@@ -309,7 +320,7 @@ function extraClaimsPlan(claims, tenantClaim) {
 function beforePlan(before) {
 	const list = before === void 0 ? [] : typeof before === "string" ? [before] : before;
 	const bad = list.filter((fn) => typeof fn !== "string" || !CLAIM_FUNCTION.test(fn));
-	if (bad.length > 0) throw new Error(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
+	if (bad.length > 0) throw configError(`PermDock CLI: supabase.hook.before must name schema-qualified functions such as auth_checks.before_token (got ${bad.map(String).join(", ")})`);
 	return [...new Set(list)];
 }
 function beforeSql(before) {
@@ -397,6 +408,38 @@ function hookClaims(parts) {
 	];
 }
 //#endregion
+//#region src/cli/supabase-schemas.ts
+const MODES = [
+	"pg-delta",
+	"migra",
+	"migrations"
+];
+function isSupabaseSchemas(value) {
+	return MODES.some((mode) => mode === value);
+}
+/** The `--schemas` refusal, or `undefined` when the value is one of the modes. */
+function schemasRefusal(command, value) {
+	return value === void 0 || isSupabaseSchemas(value) ? void 0 : `${command} --schemas must be ${MODES.join(", ")} (got ${value})`;
+}
+/**
+* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml`
+* sets `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default
+* of new Supabase projects and of the next Supabase CLI major.
+*/
+function resolveSchemas(cwd, config, flag) {
+	const toml = supabaseConfig(cwd).pgDelta;
+	const mode = flag ?? config.supabase?.schemas ?? (toml?.enabled === false ? "migra" : "pg-delta");
+	switch (mode) {
+		case "pg-delta": return {
+			mode,
+			schemaDir: toml?.schemaDir ?? declarativeSchemaDir()
+		};
+		case "migra":
+		case "migrations": return { mode };
+		default: return mode;
+	}
+}
+//#endregion
 //#region src/cli/supabase-setup.ts
 const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids(?:_for)?)$/u;
 function escape(text) {
@@ -435,7 +478,7 @@ function missingHelpersInFiles(cwd, config, manifest) {
 	for (const file of helperSources(cwd, config, manifest.hook.out)) for (const name of helpersDefined(readFileSync(file, "utf8"), manifest.helpers.schema)) found.add(name);
 	return manifest.helpers.functions.filter((name) => !found.has(name));
 }
-async function missingHelpersInDb(db, manifest, connect = pgConnector("permdock supabase hook generate --db")) {
+async function missingHelpersInDb(db, manifest, connect = pgConnector("permdock supabase hook generate --db-url-stdin")) {
 	const client = await connect(db);
 	try {
 		const result = await client.query(`select p.proname from pg_proc p join pg_namespace n on n.oid = p.pronamespace
@@ -493,8 +536,17 @@ function pd039(input) {
 	});
 	const fixture = input.config.doctor?.claims;
 	if (fixture !== void 0) {
-		const parsed = JSON.parse(readFileSync(resolve(input.cwd, fixture), "utf8"));
-		const samples = Array.isArray(parsed) ? parsed : [];
+		const parsed = readClaimsFixture(resolve(input.cwd, fixture));
+		if (!parsed.ok) {
+			findings.push({
+				code: "PD039",
+				severity: "warning",
+				message: `doctor.claims ${fixture} is not a JSON file doctor can read (${parsed.message}), so the claim budget went unchecked`,
+				fix: "point doctor.claims at a JSON array of sample claims"
+			});
+			return findings;
+		}
+		const samples = Array.isArray(parsed.value) ? parsed.value : [];
 		for (const claim of oversizedClaims(samples, input.manifest)) findings.push({
 			code: "PD039",
 			severity: "warning",
@@ -510,6 +562,19 @@ function pd039(input) {
 	}
 	return findings;
 }
+function readClaimsFixture(path) {
+	try {
+		return {
+			ok: true,
+			value: JSON.parse(readFileSync(path, "utf8"))
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
 //#endregion
 //#region src/cli/rls/rbac.ts
 /**
@@ -528,7 +593,7 @@ function resolveAuthorize(config, flags = {}) {
 function parseRbacAuthorize(raw) {
 	if (raw === void 0) return;
 	if (raw === "database" || raw === "jwt") return raw;
-	throw new Error(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
 }
 function hookUri(schema) {
 	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
@@ -598,6 +663,7 @@ function memberForPlan(input) {
 		dialect: "supabase",
 		...input
 	}, name));
+	const holders = memberFor.filter((name) => hasPermittedUsers(input, name));
 	const entries = /* @__PURE__ */ new Map();
 	for (const name of memberFor) {
 		const mapped = memberForTable(input, name);
@@ -606,10 +672,11 @@ function memberForPlan(input) {
 	}
 	return {
 		memberFor,
+		holders,
 		memberships: [...entries.values()]
 	};
 }
-/** An `rls.memberships` table in the manifest's `fromTable` / `fromJunction` shape, for scope `name`. */
+/** An `rls.memberships` table in the manifest's `tableMembershipSource` / `junctionMembershipSource` shape, for scope `name`. */
 function mappedMembership(mapped, scopes, name) {
 	const id = scopeColumn(mapped, scopes, name) ?? "";
 	const within = {};
@@ -642,7 +709,7 @@ function mappedMembership(mapped, scopes, name) {
 }
 function positiveInteger(value, label) {
 	const number = typeof value === "string" ? Number(value) : value;
-	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw new Error(`PermDock CLI: ${label} must be a positive integer`);
+	if (typeof number !== "number" || !Number.isInteger(number) || number <= 0) throw configError(`PermDock CLI: ${label} must be a positive integer`);
 	return number;
 }
 /**
@@ -653,12 +720,12 @@ function activeFromSql(input, root) {
 	const spec = input ?? `app_metadata.active_${root}`;
 	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
 		const key = spec.slice(13);
-		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw new Error(`PermDock CLI: unsafe app_metadata key '${key}'`);
+		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw configError(`PermDock CLI: unsafe app_metadata key '${key}'`);
 		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
 	}
 	const parsed = typeof spec === "string" ? (() => {
 		const dot = spec.lastIndexOf(".");
-		if (dot <= 0) throw new Error(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
+		if (dot <= 0) throw configError(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
 		return {
 			table: spec.slice(0, dot),
 			column: spec.slice(dot + 1)
@@ -684,16 +751,16 @@ function typedUsers(parts) {
 	].map((line) => `\n  ${line}`).join("");
 }
 function checkSources(parts) {
-	if (parts.sources.length === 0) throw new Error("PermDock CLI: supabase.hook.memberships needs at least one fromTable or fromJunction source");
+	if (parts.sources.length === 0) throw configError("PermDock CLI: supabase.hook.memberships needs at least one tableMembershipSource or junctionMembershipSource source");
 	for (const source of parts.sources) {
-		if (source.sql === void 0 || typeof source.sql.select !== "function") throw new Error("PermDock CLI: supabase.hook.memberships takes fromTable / fromJunction sources from permdock/supabase");
+		if (source.sql === void 0 || typeof source.sql.select !== "function") throw configError("PermDock CLI: supabase.hook.memberships takes tableMembershipSource / junctionMembershipSource sources from permdock/supabase");
 		const scope = source.sql.scope;
 		if (scope === void 0) continue;
-		if (resolveScope(parts.scopes, scope) !== scope) throw new Error(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
+		if (resolveScope(parts.scopes, scope) !== scope) throw configError(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
 		const chain = scopeChain(parts.scopes, scope);
 		const holds = new Set(source.sql.holds ?? [scope]);
 		const missing = chain.filter((ancestor) => !holds.has(ancestor));
-		if (missing.length > 0) throw new Error(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
+		if (missing.length > 0) throw configError(`PermDock CLI: the ${source.sql.table} source needs within columns for ${missing.join(", ")}: a ${scope} membership without every ancestor grants nothing`);
 	}
 }
 function entriesSql(parts) {
@@ -702,9 +769,9 @@ function entriesSql(parts) {
   (${tenant}) as tenant,
   jsonb_strip_nulls(jsonb_build_object(
     'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
-    'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+    'expires_at', s.expires_at, 'granted_by', s.granted_by, 'reason', s.reason,
     'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-    'managedBy', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
+    'managed_by', s.managed_by, 'entitlements', s.seats${source.sql.keeps ? ", 'keep', s.keep" : ""}
   )) as entry
 from (
 ${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
@@ -785,7 +852,7 @@ function apiWrappersSql(parts) {
 	const source = quoteIdent(parts.schema);
 	const wrapper = (name, inner, params, args, types, returns) => {
 		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
-		if (target === parts.schema && name === inner) throw new Error(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
+		if (target === parts.schema && name === inner) throw configError(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
 		return `create or replace function ${fn}(${params})
 returns ${returns}
 language sql
@@ -856,9 +923,9 @@ as $$
       'principal', jsonb_build_object('id', s.user_id),
       'membership', jsonb_strip_nulls(jsonb_build_object(
         'scope', s.scope, 'id', s.id, 'within', s.within, 'roles', s.roles, 'via', s.via,
-        'expiresAt', s.expires_at, 'grantedBy', s.granted_by, 'reason', s.reason,
+        'expires_at', s.expires_at, 'granted_by', s.granted_by, 'reason', s.reason,
         'member', case when s.member_group is not null then jsonb_build_object('group', s.member_group) end,
-        'managedBy', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
+        'managed_by', s.managed_by, 'entitlements', s.seats${keep ? ", 'keep', s.keep" : ""}
       ))
     ) order by s.user_id, s.roles::text), '[]'::jsonb)
   from (
@@ -868,9 +935,10 @@ $$;
 revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
 }
 /**
-* The custom roles `p_user` holds: tenant roles named on a membership of the
-* scope (and instance) they live at, and platform roles among the global
-* roles, each with its grants and includes in `CustomRole` form.
+* The custom roles `p_user` holds: tenant and shared roles named on a
+* membership of the scope (and instance) they live at, and platform roles
+* among the global roles, each with its grants and includes in `CustomRole`
+* form. A shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
 */
 function customRolesOfSql(parts) {
 	const helpers = quoteIdent(parts.helpers.schema);
@@ -881,6 +949,7 @@ function customRolesOfSql(parts) {
 	return `
   select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
       'name', c.role,
+      'shared', case when c.tenant_id is null and c.scope <> 'global' then true end,
       'tenant', c.tenant_id::text,
       'scope', c.scope,
       'id', c.scope_id,
@@ -911,11 +980,816 @@ function customRolesOfSql(parts) {
         from jsonb_array_elements(memberships) m
         where m -> 'roles' ? c.role
           and m ->> 'scope' = c.scope
-          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (
+            (c.tenant_id is null and c.scope_id is null)
+            or c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          )
           and (c.scope_id is null or c.scope_id = m ->> 'id')
       );`;
 }
 //#endregion
+//#region src/cli/rls/approvals.ts
+/** `rls.approvals`' approver check; better-supabase's `isApprover` template calls it. */
+const IS_APPROVER = "permdock_is_approver";
+/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
+const APPROVAL_STORE = {
+	table: "approval_requests",
+	open: "permdock_approval_open",
+	get: "permdock_approval_get",
+	resolve: "permdock_approval_resolve",
+	consume: "permdock_approval_consume",
+	list: "permdock_approval_list",
+	expire: "permdock_approval_expire",
+	cancel: "permdock_approval_cancel",
+	isApprover: IS_APPROVER
+};
+/** `body` as the row's filter columns hold it. */
+const COLUMNS = `p_request ->> 'token',
+    p_request,
+    p_request ->> 'status',
+    p_request #>> '{subject,principal,tenant}',
+    p_request #>> '{subject,principal,id}',
+    p_request #>> '{subject,actor,id}',
+    p_request #>> '{subject,session}',
+    coalesce(jsonb_array_length(p_request -> 'approvals'), 0),
+    p_request ->> 'createdAt',
+    (p_request ->> 'expiresAt')::timestamptz,
+    (p_request ->> 'consumedAt')::timestamptz`;
+/** The `ApprovalListFilter` in `p_filter`, over the row aliased `a`. */
+const FILTER = `(p_filter ->> 'status' is null or a.status = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.tenant = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.principal_id = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.actor_id = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.session = p_filter ->> 'session')`;
+function serverOnly(fn, args) {
+	return `revoke execute on function ${fn}(${args}) from public, anon, authenticated;`;
+}
+const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
+/**
+* `rls.jsonSchema`: a pg_jsonschema check that `body` matches
+* `approval-request-v1.json`, added `not valid` and then validated. `auto`
+* adds it only where the extension is available.
+*/
+function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
+	const statements = [
+		"create schema if not exists extensions;",
+		"create extension if not exists pg_jsonschema with schema extensions;",
+		`alter table ${table} drop constraint if exists "${check}";`,
+		`alter table ${table} add constraint "${check}" check (extensions.jsonb_matches_schema(${quoteLiteral(JSON.stringify(APPROVAL_REQUEST_SCHEMA))}::json, ${body})) not valid;`,
+		`alter table ${table} validate constraint "${check}";`
+	];
+	const comment = "-- approval store: body matches schemas/approval-request-v1.json through pg_jsonschema";
+	if (mode === true) return `\n${comment}\n${statements.join("\n")}\n`;
+	return `\n${comment}, where the extension is available
+do $permdock$
+begin
+  if exists (select 1 from pg_available_extensions where name = 'pg_jsonschema') then
+${statements.map((statement) => `    ${statement}`).join("\n")}
+  end if;
+end
+$permdock$;\n`;
+}
+/**
+* The approval store (`rls.approvals`): one table of `ApprovalRequest`
+* bodies with the columns a list filters on, and one `security definer`
+* function per `ApprovalStore` method, each one atomic statement. No client
+* role may read the table or execute the functions: approvals are opened and
+* resolved by the server, which grants its own role.
+*/
+function approvalStoreSql(ctx, jsonSchema = false) {
+	const table = qualified(ctx, APPROVAL_STORE.table);
+	const fn = (name) => qualified(ctx, name);
+	const index = (name) => `"${APPROVAL_STORE.table}_${name}"`;
+	return `-- approval store: ApprovalRequest bodies, opened, resolved and consumed through the functions below; supabaseApprovalStore calls them
+create table if not exists ${table} (
+  token text primary key,
+  body jsonb not null,
+  status text not null check (status in ('pending', 'approved', 'rejected', 'expired')),
+  tenant text,
+  principal_id text,
+  actor_id text,
+  session text,
+  approvals integer not null default 0,
+  created_at text not null,
+  expires_at timestamptz not null,
+  consumed_at timestamptz
+);
+create index if not exists ${index("page")} on ${table} (created_at collate "C", token collate "C");
+create index if not exists ${index("pending")} on ${table} (status, expires_at);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema)}
+-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (token, body, status, tenant, principal_id, actor_id, session, approvals, created_at, expires_at, consumed_at)
+  values (
+    ${COLUMNS}
+  )
+  on conflict (token) do update
+    set body = excluded.body, status = excluded.status, tenant = excluded.tenant,
+      principal_id = excluded.principal_id, actor_id = excluded.actor_id, session = excluded.session,
+      approvals = excluded.approvals, created_at = excluded.created_at,
+      expires_at = excluded.expires_at, consumed_at = excluded.consumed_at
+    where a.status = 'expired' or a.expires_at <= now()
+$$;
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body from ${table} a where a.token = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set body = p_next,
+    status = p_next ->> 'status',
+    approvals = coalesce(jsonb_array_length(p_next -> 'approvals'), 0)
+  where a.token = p_token
+    and a.status = 'pending'
+    and a.expires_at > now()
+    and a.approvals = p_seen
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set consumed_at = p_now::timestamptz,
+    body = a.body || jsonb_build_object('consumedAt', p_now)
+  where a.token = p_token
+    and a.status = 'approved'
+    and a.consumed_at is null
+    and a.expires_at > p_now::timestamptz
+  returning a.body
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.body
+  from ${table} a
+  where ${FILTER}
+    and (p_after_created is null
+      or (a.created_at collate "C", a.token collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by a.created_at collate "C", a.token collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set status = 'expired', body = a.body || '{"status":"expired"}'::jsonb
+    where a.status = 'pending' and a.expires_at <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set status = 'rejected',
+      body = (a.body - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))
+    where a.status = 'pending'
+      and ${FILTER.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+/**
+* `permdock_is_approver(p_approvers jsonb, p_tenant text default null)`: true
+* when the signed-in user matches the serialised approvers of a request
+* (`approvers.by`), for policies on the app's own approval views. A list
+* needs every item and `any-of` one of them; `user` compares the user id and
+* `holder(permission)` reads `permitted_<root>_ids_by_permission` in
+* `p_tenant`, or `permdock_has_permission` without one. Role, relation and
+* other grantee approvers need facts the database does not hold for every
+* membership source, so they match nobody.
+*/
+function isApproverSql(ctx) {
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	const root = ctx.scopes[0]?.name;
+	const inTenant = root === void 0 ? "false" : `exists (
+          select 1
+          from ${qualified(ctx, checkName(permittedByPermissionHelper(root)))}(p_approvers ->> 'permission') i(id)
+          where i.id::text = p_tenant
+        )`;
+	return `
+-- approvers: whether the signed-in user matches a request's approvers.by; policies on approval views call it
+create or replace function ${fn}(p_approvers jsonb, p_tenant text default null)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+  v_user text := ${subjectIdSql(ctx)}::text;
+begin
+  if coalesce(v_user, '') = '' or p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${fn}(v_item, p_tenant) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'user' then
+      return coalesce(p_approvers ->> 'id' = v_user, false);
+    when 'permission' then
+      if p_tenant is null then
+        return coalesce(${qualified(ctx, PERMISSION_HELPERS.has)}(p_approvers ->> 'permission'), false);
+      end if;
+      return ${inTenant};
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${fn}(v_item, p_tenant) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return false;
+  end case;
+end;
+$$;
+revoke execute on function ${fn}(jsonb, text) from public, anon;
+grant execute on function ${fn}(jsonb, text) to authenticated;
+`;
+}
+/**
+* Everything `rls.approvals` writes: the generated or adopted store, the
+* approver check and, with `delegations: true`, the covers.
+*/
+function approvalsSql(ctx, approvals, jsonSchema) {
+	if (approvals === void 0 || approvals === false) return;
+	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
+	const { table, delegations } = approvals;
+	if (delegations !== void 0 && typeof delegations !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.delegations must be a boolean");
+	let store;
+	if (table === void 0) {
+		const adoptOnly = [
+			"token",
+			"body",
+			"open",
+			"schema",
+			"mirror"
+		].find((key) => approvals[key] !== void 0);
+		if (adoptOnly !== void 0) throw configError(`PermDock CLI: rls.approvals.${adoptOnly} adopts a table; set rls.approvals.table too`);
+		store = approvalStoreSql(ctx, jsonSchema);
+	} else store = adoptedApprovalStoreSql(ctx, {
+		...approvals,
+		table
+	}, jsonSchema);
+	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx) : "");
+}
+/** The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource` reads the table. */
+const DELEGATIONS = {
+	table: "approval_delegations",
+	covers: "permdock_cover_approves"
+};
+/**
+* `rls.approvals.delegations`: one table of out-of-office covers that a
+* user writes for themselves, and a four-argument `permdock_is_approver`
+* that also answers for a delegate inside an active cover. One hop: a cover
+* is checked against the delegator's own approver rights, never the
+* delegator's covers. A delegator who is the requester never counts. A
+* `holder()` approver through a cover needs `rls.mode: "database"`, where
+* the `_for` helpers exist; in `jwt` mode only `user()` approvers pass.
+*/
+function approvalDelegationsSql(ctx) {
+	const table = qualified(ctx, DELEGATIONS.table);
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	const covers = qualified(ctx, DELEGATIONS.covers);
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const me = `${subjectIdSql(ctx)}::text`;
+	const defaultMe = subjectIdSql(ctx).replace(/^\(select (.+)\)$/su, "$1");
+	const root = ctx.scopes[0]?.name;
+	const member = (tenant) => root === void 0 ? "false" : `${tenant} in (select m.id::text from ${qualified(ctx, memberIdsHelper(root))}() m(id))`;
+	const database = ctx.authorize === "database";
+	const holderGlobal = database ? `coalesce(${qualified(ctx, PERMISSION_HELPERS.hasFor)}(p_delegator, p_approvers ->> 'permission'), false)` : "false";
+	const holderTenant = database && root !== void 0 ? `exists (
+          select 1
+          from ${qualified(ctx, checkName(`${permittedByPermissionHelper(root)}_for`))}(p_delegator, p_approvers ->> 'permission') i(id)
+          where i.id::text = p_tenant
+        )` : "false";
+	const policy = (name) => quoteIdent(`${DELEGATIONS.table}_${name}`);
+	const own = `delegator::text = ${me} and (tenant is null or ${member("tenant")})`;
+	return `
+-- approval delegations: out-of-office covers a user writes for themselves; tableApprovalDelegationSource and permdock_is_approver read them
+create table if not exists ${table} (
+  id text primary key default gen_random_uuid()::text,
+  delegator ${user} not null default (${defaultMe})::${user},
+  delegate ${user} not null,
+  tenant text,
+  permissions text[],
+  resources text[],
+  "from" timestamptz not null default now(),
+  "until" timestamptz not null,
+  created_at timestamptz not null default now(),
+  constraint ${quoteIdent(`${DELEGATIONS.table}_window`)} check ("from" < "until"),
+  constraint ${quoteIdent(`${DELEGATIONS.table}_distinct`)} check (delegator <> delegate)
+);
+create index if not exists ${quoteIdent(`${DELEGATIONS.table}_delegate`)} on ${table} (delegate, "until");
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, public;
+grant select, insert, update, delete on table ${table} to authenticated;
+drop policy if exists ${policy("read")} on ${table};
+create policy ${policy("read")} on ${table}
+  for select to authenticated
+  using (delegator::text = ${me} or delegate::text = ${me});
+drop policy if exists ${policy("insert")} on ${table};
+create policy ${policy("insert")} on ${table}
+  for insert to authenticated
+  with check (${own});
+drop policy if exists ${policy("update")} on ${table};
+create policy ${policy("update")} on ${table}
+  for update to authenticated
+  using (delegator::text = ${me})
+  with check (${own});
+drop policy if exists ${policy("delete")} on ${table};
+create policy ${policy("delete")} on ${table}
+  for delete to authenticated
+  using (delegator::text = ${me});
+
+-- approval delegations: whether a delegator's own rights match approvers.by; only permdock_is_approver calls it
+create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+begin
+  if p_delegator is null or p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${covers}(p_delegator, v_item, p_tenant) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'user' then
+      return coalesce(p_approvers ->> 'id' = p_delegator::text, false);
+    when 'permission' then
+      if p_tenant is null then
+        return ${holderGlobal};
+      end if;
+      return ${holderTenant};
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${covers}(p_delegator, v_item, p_tenant) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return false;
+  end case;
+end;
+$$;
+revoke execute on function ${covers}(${user}, jsonb, text) from public, anon, authenticated;
+
+-- approvers with covers: the signed-in user, or a delegate inside an active cover of a delegator who is not the requester
+create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_delegator ${user};
+  v_user text := ${me};
+begin
+  if ${fn}(p_approvers, p_tenant) then
+    return true;
+  end if;
+  if coalesce(v_user, '') = '' or coalesce(p_requester, '') = '' then
+    return false;
+  end if;
+  if p_tenant is not null and not (${member("p_tenant")}) then
+    return false;
+  end if;
+  for v_delegator in
+    select d.delegator
+    from ${table} d
+    where d.delegate::text = v_user
+      and d.delegator::text <> v_user
+      and d.delegator::text <> p_requester
+      and d."from" <= now()
+      and now() < d."until"
+      and (d.tenant is null or d.tenant = p_tenant)
+      and d.permissions is null
+      and (d.resources is null or p_resource = any (d.resources))
+  loop
+    if ${covers}(v_delegator, p_approvers, p_tenant) then
+      return true;
+    end if;
+  end loop;
+  return false;
+end;
+$$;
+revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
+grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
+`;
+}
+/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
+const MIRRORS = {
+	status: (body) => `${body} ->> 'status'`,
+	permission: (body) => `${body} ->> 'permission'`,
+	tenant: (body) => `${body} #>> '{subject,principal,tenant}'`,
+	principalId: (body) => `${body} #>> '{subject,principal,id}'`,
+	actorId: (body) => `${body} #>> '{subject,actor,id}'`,
+	session: (body) => `${body} #>> '{subject,session}'`,
+	approvals: (body) => `coalesce(jsonb_array_length(${body} -> 'approvals'), 0)`,
+	createdAt: (body) => `${body} ->> 'createdAt'`,
+	expiresAt: (body) => `${body} ->> 'expiresAt'`,
+	resolvedAt: (body) => `${body} ->> 'resolvedAt'`,
+	resolvedBy: (body) => `${body} ->> 'resolvedBy'`,
+	consumedAt: (body) => `${body} ->> 'consumedAt'`
+};
+function mirrorsOf(adopt) {
+	const out = [];
+	for (const [field, column] of Object.entries(adopt.mirror ?? {})) {
+		if (!Object.hasOwn(MIRRORS, field)) throw configError(`PermDock CLI: rls.approvals.mirror.${field} is not a request field; use ${Object.keys(MIRRORS).join(", ")}`);
+		if (typeof column !== "string") throw new TypeError(`PermDock CLI: rls.approvals.mirror.${field} must be a column name`);
+		out.push([column, field]);
+	}
+	return out;
+}
+/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
+function populate(table, values) {
+	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
+}
+/** The mirrored columns' values for the request `body`. */
+function mirrorRow(table, mirror, body) {
+	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
+}
+/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
+function mirrorSet(table, mirror, body) {
+	if (mirror.length === 0) return "";
+	const columns = mirror.map(([column]) => quoteIdent(column));
+	const picked = columns.map((column) => `r.${column}`).join(", ");
+	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
+}
+/**
+* The approval store over a table the app already has (`rls.approvals:
+* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
+* functions, reading every field from the request body in `body`, keyed by
+* the text column `token`, and copying the fields `mirror` names into the
+* app's own columns, converted to their types, on every write. The table's
+* grants and policies stay the app's.
+*/
+function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
+	const table = quoteQualified(adopt.table);
+	const base = adopt.table.split(".").at(-1) ?? adopt.table;
+	const token = quoteIdent(adopt.token ?? "token");
+	const body = quoteIdent(adopt.body ?? "body");
+	const mirror = mirrorsOf(adopt);
+	for (const [column] of mirror) if (column === (adopt.token ?? "token") || column === (adopt.body ?? "body")) throw configError(`PermDock CLI: rls.approvals.mirror names the ${column} column, which already holds the token or the body`);
+	const open = adopt.open ?? "insert";
+	if (open !== "insert" && open !== "attach") throw configError(`PermDock CLI: rls.approvals.open must be 'insert' or 'attach', got '${String(open)}'`);
+	const schema = adopt.schema;
+	if (schema !== void 0 && (typeof schema !== "string" || schema === "")) throw configError("PermDock CLI: rls.approvals.schema must be a schema name");
+	const fn = (name) => schema === void 0 ? qualified(ctx, name) : `${quoteIdent(schema)}.${name}`;
+	const index = (name) => quoteIdent(`${base}_permdock_${name}`);
+	const status = `a.${body} ->> 'status'`;
+	const expires = `(a.${body} ->> 'expiresAt')::timestamptz`;
+	const created = `(a.${body} ->> 'createdAt')`;
+	const filter = `(p_filter ->> 'status' is null or ${status} = p_filter ->> 'status')
+    and (p_filter ->> 'tenant' is null or a.${body} #>> '{subject,principal,tenant}' = p_filter ->> 'tenant')
+    and (p_filter ->> 'principalId' is null or a.${body} #>> '{subject,principal,id}' = p_filter ->> 'principalId')
+    and (p_filter ->> 'actorId' is null or a.${body} #>> '{subject,actor,id}' = p_filter ->> 'actorId')
+    and (p_filter ->> 'session' is null or a.${body} #>> '{subject,session}' = p_filter ->> 'session')`;
+	const columns = [
+		token,
+		body,
+		...mirror.map(([column]) => quoteIdent(column))
+	];
+	const inserted = populate(table, [
+		[adopt.token ?? "token", "p_request ->> 'token'"],
+		[adopt.body ?? "body", "p_request"],
+		...mirror.map(([column, field]) => [column, MIRRORS[field]("p_request")])
+	]);
+	const insertSql = `-- open a request; a repeated ask keeps the open record and replaces only an expired one
+create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  insert into ${table} as a (${columns.join(", ")})
+  select ${columns.map((column) => `r.${column}`).join(", ")}
+  from ${inserted} r
+  on conflict (${token}) do update
+    set ${columns.filter((column) => column !== token).map((column) => `${column} = excluded.${column}`).join(", ")}
+    where ${status} = 'expired' or ${expires} <= now()
+$$;`;
+	const attachSql = `create or replace function ${fn(APPROVAL_STORE.open)}(p_request jsonb)
+returns void
+language plpgsql
+volatile
+security definer
+set search_path = ''
+as $$
+begin
+  update ${table} a
+  set ${body} = p_request${mirrorSet(table, mirror, "p_request")}
+  where a.${token} = p_request ->> 'token'
+    and (a.${body} is null or ${status} = 'expired' or ${expires} <= now());
+  if not found and not exists (select 1 from ${table} a where a.${token} = p_request ->> 'token') then
+    raise exception using
+      errcode = 'P0002',
+      message = 'permdock: no row of ${adopt.table.replaceAll("'", "''")} holds approval token ' || (p_request ->> 'token'),
+      hint = 'insert the application row with this token before opening the request';
+  end if;
+end;
+$$;`;
+	return `-- approval store adopted onto ${adopt.table}: ApprovalRequest bodies in ${adopt.body ?? "body"}, keyed by ${adopt.token ?? "token"}; supabaseApprovalStore calls the functions below
+alter table ${table} add column if not exists ${token} text;
+alter table ${table} add column if not exists ${body} jsonb;
+create unique index if not exists ${index("token")} on ${table} (${token});
+create index if not exists ${index("page")} on ${table} ((${body} ->> 'createdAt') collate "C", ${token} collate "C");
+create index if not exists ${index("status")} on ${table} ((${body} ->> 'status'));
+${jsonSchema === false ? "" : bodySchemaSql(table, jsonSchema, body, `${base}_permdock_body_schema`)}
+${open === "attach" ? attachSql : insertSql}
+${serverOnly(fn(APPROVAL_STORE.open), "jsonb")}
+
+create or replace function ${fn(APPROVAL_STORE.get)}(p_token text)
+returns jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body} from ${table} a where a.${token} = p_token
+$$;
+${serverOnly(fn(APPROVAL_STORE.get), "text")}
+
+-- write a verdict over the record it was computed from: still pending, unexpired, with p_seen approvals
+create or replace function ${fn(APPROVAL_STORE.resolve)}(p_token text, p_next jsonb, p_seen integer)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = p_next${mirrorSet(table, mirror, "p_next")}
+  where a.${token} = p_token
+    and ${status} = 'pending'
+    and ${expires} > now()
+    and coalesce(jsonb_array_length(a.${body} -> 'approvals'), 0) = p_seen
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.resolve), "text, jsonb, integer")}
+
+-- consume an approved, unexpired, unconsumed request once
+create or replace function ${fn(APPROVAL_STORE.consume)}(p_token text, p_now text)
+returns jsonb
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  update ${table} a
+  set ${body} = a.${body} || jsonb_build_object('consumedAt', p_now)${mirrorSet(table, mirror, `(a.${body} || jsonb_build_object('consumedAt', p_now))`)}
+  where a.${token} = p_token
+    and ${status} = 'approved'
+    and a.${body} ->> 'consumedAt' is null
+    and ${expires} > p_now::timestamptz
+  returning a.${body}
+$$;
+${serverOnly(fn(APPROVAL_STORE.consume), "text, text")}
+
+-- one page in (createdAt, token) order after the cursor position
+create or replace function ${fn(APPROVAL_STORE.list)}(p_filter jsonb, p_after_created text, p_after_token text, p_limit integer)
+returns setof jsonb
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select a.${body}
+  from ${table} a
+  where a.${body} is not null
+    and ${filter}
+    and (p_after_created is null
+      or (${created} collate "C", a.${token} collate "C") > (p_after_created collate "C", p_after_token collate "C"))
+  order by ${created} collate "C", a.${token} collate "C"
+  limit p_limit
+$$;
+${serverOnly(fn(APPROVAL_STORE.list), "jsonb, text, text, integer")}
+
+create or replace function ${fn(APPROVAL_STORE.expire)}(p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with expired as (
+    update ${table} a
+    set ${body} = a.${body} || '{"status":"expired"}'::jsonb${mirrorSet(table, mirror, `(a.${body} || '{"status":"expired"}'::jsonb)`)}
+    where ${status} = 'pending' and ${expires} <= p_now::timestamptz
+    returning 1
+  )
+  select count(*)::integer from expired
+$$;
+${serverOnly(fn(APPROVAL_STORE.expire), "text")}
+
+-- reject every pending request the filter matches, as system:<by>
+create or replace function ${fn(APPROVAL_STORE.cancel)}(p_filter jsonb, p_by text, p_note text, p_now text)
+returns integer
+language sql
+volatile
+security definer
+set search_path = ''
+as $$
+  with cancelled as (
+    update ${table} a
+    set ${body} = (a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object(
+        'status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note
+      ))${mirrorSet(table, mirror, `((a.${body} - 'note') || jsonb_strip_nulls(jsonb_build_object('status', 'rejected', 'resolvedAt', p_now, 'resolvedBy', 'system:' || p_by, 'note', p_note)))`)}
+    where ${status} = 'pending'
+      and ${filter.replaceAll("\n    ", "\n      ")}
+    returning 1
+  )
+  select count(*)::integer from cancelled
+$$;
+${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
+`;
+}
+//#endregion
+//#region src/cli/rls/permission-holders.ts
+/** `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL contract. */
+function permittedUsersHelper(scope) {
+	return checkName(`permitted_${scope}_users`);
+}
+/** The users with a membership row on the instance `p_id`, or `undefined` when the scope's memberships are not all in tables. */
+function candidatesSql(ctx, scope, user) {
+	const mapped = scopeTable(ctx, scope);
+	if (mapped !== void 0) return {
+		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
+    from ${quoteQualified(mapped.table.table)} m
+    where m.${quoteIdent(mapped.column)} = p_id`,
+		keys: []
+	};
+	const sources = holderSources(ctx, scope);
+	if (sources === void 0 || sources === "not-tables") return;
+	return {
+		sql: sources.map((source, index) => `    select h.user_id::${user}
+    from (
+${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
+    ) h`).join("\n    union\n"),
+		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
+	};
+}
+/** `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a `%type` variable. */
+function functionBody(keys, query) {
+	if (keys.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${query}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${keys.map((key) => `  ${key} := p_id;`).join("\n")}
+begin
+  return query
+${query.replaceAll(/^/gmu, "  ")};
+end
+$$;`;
+}
+/**
+* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
+* mode: the users who hold a permission key on one instance, read from the
+* scope's membership rows and the global-roles table and kept when
+* `permitted_<scope>_ids_by_permission_for` lists the instance or
+* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
+* suspension apply as for the user. It names other users, so no client role
+* may execute it, and a backend role needs its own grant.
+*/
+function permissionHoldersSql(ctx) {
+	if (ctx.authorize !== "database") return "";
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const global = globalRoleRows(ctx);
+	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
+	return `${ctx.scopes.map(({ name }) => {
+		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
+		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
+		const fn = qualified(ctx, permittedUsersHelper(name));
+		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
+		const type = scopeTypeOf(ctx, name);
+		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
+create or replace function ${fn}(p_permission text, p_id ${type})
+returns setof ${user}
+${functionBody(candidates.keys, `  select c.user_id
+  from (
+${candidates.sql}
+    union
+    select ${global.userSql}::${user}
+    from ${global.from}
+  ) c(user_id)
+  where c.user_id is not null
+    and (
+      p_id in (select ${ids}(c.user_id, p_permission))
+      or ${hasFor}(c.user_id, p_permission)
+    )
+  order by 1`)}
+revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
+	}).join("\n\n")}\n`;
+}
+//#endregion
 //#region src/cli/supabase-hook/sql.ts
 const MANAGED_TRIGGER = "permdock_protect_managed";
 function hookSql(parts) {
@@ -927,14 +1801,14 @@ function hookSql(parts) {
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
 	const plan = parts.attrs;
-	const fromTable = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
+	const tableMembershipSource = plan === void 0 || plan.columns.length === 0 || plan.table === void 0 ? "" : `
   select jsonb_strip_nulls(jsonb_build_object(${plan.columns.map((column) => `${quoteLiteral(column)}, to_jsonb(p.${quoteIdent(column)})`).join(", ")}))
     into attrs
     from ${quoteQualified(plan.table)} p
     where p.${quoteIdent(plan.id)} = v_attrs_user;`;
 	const fromMeta = plan === void 0 || plan.meta.length === 0 ? "" : `
   attrs := coalesce(attrs, '{}'::jsonb) || jsonb_strip_nulls(jsonb_build_object(${plan.meta.map((key) => `${quoteLiteral(key)}, claims -> 'app_metadata' -> ${quoteLiteral(key)}`).join(", ")}));`;
-	const attrs = plan === void 0 ? "" : `${fromTable}${fromMeta}
+	const attrs = plan === void 0 ? "" : `${tableMembershipSource}${fromMeta}
   if attrs is not null and attrs <> '{}'::jsonb then
     used := octet_length(attrs::text);
     if used > budget then
@@ -1032,7 +1906,7 @@ function extraGrantsSql(extra) {
 }
 function beforeGrantsSql(before, extra) {
 	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
-	return [...[...new Set(before.map((fn) => fn.split(".")[0] ?? ""))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
 }
 /**
 * Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
@@ -1104,7 +1978,7 @@ uri = "${hookUri(schema)}"`;
 const BUDGET_MEASURE = "octet_length(memberships::text) + octet_length(attrs::text)";
 function hookParts(scopes, config, overrides) {
 	const hook = config.supabase?.hook;
-	if (hook === void 0) throw new Error("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
+	if (hook === void 0) throw configError("PermDock CLI: supabase hook generate needs supabase.hook in permdock.config.ts");
 	const root = rootScope(scopes) ?? "tenant";
 	const suspension = checkSuspension(hook.suspension ?? config.rls?.suspension, scopes);
 	const schema = overrides.schema ?? hook.schema ?? config.rls?.schema ?? "permdock";
@@ -1140,8 +2014,8 @@ function hookParts(scopes, config, overrides) {
 			})
 		}
 	};
-	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw new Error(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
-	if (extraPlan.errors.length > 0) throw new Error(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
+	if (parts.attrs !== void 0 && parts.attrs.errors.length > 0) throw configError(`PermDock CLI: ${parts.attrs.errors.join("; ")}`);
+	if (extraPlan.errors.length > 0) throw configError(`PermDock CLI: ${extraPlan.errors.join("; ")}`);
 	quoteIdent(parts.tenantClaim);
 	return parts;
 }
@@ -1453,11 +2327,14 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 	const forUser = database ? [
 		helperEntry(HELPERS.hasFor, "p_user uuid, p_grant text", "boolean", []),
 		...scopeTypes.map(([scope, type]) => helperEntry(permittedForHelper(scope), "p_user uuid, p_grant text", `setof ${type}`, [])),
-		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", []))
+		...scopeTypes.map(([scope, type]) => helperEntry(permissionKeysForHelper(scope), `p_user uuid, p_id ${type}`, "setof text", [])),
+		...scopeTypes.filter(([scope]) => parts.helpers.holders.includes(scope)).map(([scope, type]) => helperEntry(permittedUsersHelper(scope), `p_permission text, p_id ${type}`, "setof uuid", []))
 	] : [];
 	const keyed = [
 		helperEntry(USER_ID_HELPER, "", "uuid", client),
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
+		...!config.rls?.approvals ? [] : [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
@@ -1606,25 +2483,25 @@ function defaultOut(config) {
 //#region src/cli/supabase-hook/supabase-hook.ts
 const SUPABASE_HELP = `permdock supabase hook generate | inspect
 
-  hook generate [--out supabase/permdock-hook.sql] [--check] [--db <url>]
+  hook generate [--out <file>] [--check] [--db-url-stdin] [--schemas pg-delta|migra|migrations]
                 [--active-from app_metadata.active_<scope>|<table>.<column>]
                 [--budget 1024] [--schema public] [--grants-out <file>|-]
   inspect [--json] [--out [permdock.manifest.json]] [--check]
 
-Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction sources the app
+Reads supabase.hook from permdock.config.ts: the tableMembershipSource / junctionMembershipSource sources the app
 passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
-needs (the ones db diff drops in --grants-out, for declarative schemas), the permdock_authz_version table
-and its triggers. Never grants anything to
+needs, the permdock_authz_version table and its triggers. Under pg-delta (the default) --out defaults to
+supabase/schemas/<schema>/functions/custom_access_token_hook.sql and the grants stay in it; under
+--schemas migra, --grants-out takes the privileges supabase db diff drops. Never grants anything to
 service_role unless supabase.hook.api is set, which grants its wrappers to it. inspect prints the manifest: helper schema, names and signatures, tenant claim,
 budget, the claims the hook writes, the membership sources and the columns that decide them.
 --out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
 file differs.
 `;
-const MANIFEST_FILE = "permdock.manifest.json";
-/** `supabase.hook.out`, else pg-delta's per-schema path, else `supabase/permdock-hook.sql`. */
-function hookOut(cwd, config, schema) {
-	const pgDelta = supabaseConfig(cwd).pgDelta;
-	return config.supabase?.hook?.out !== void 0 || pgDelta === void 0 ? defaultOut(config) : pgDeltaPath(pgDelta.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
+/** `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else `supabase/permdock-hook.sql`. */
+function hookOut(cwd, config, schema, flag) {
+	const schemas = resolveSchemas(cwd, config, flag);
+	return config.supabase?.hook?.out !== void 0 || schemas.mode !== "pg-delta" ? defaultOut(config) : pgDeltaPath(schemas.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
 }
 /**
 * The manifest `supabase inspect` prints. With `policy`, `rls.helpers` also
@@ -1632,7 +2509,14 @@ function hookOut(cwd, config, schema) {
 * `assigns`.
 */
 function supabaseHookManifest(scopes, config, overrides = {}, policy) {
-	return manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
+	const manifest = manifestOf(hookParts(scopes, config, overrides), overrides.out ?? defaultOut(config), config, policy);
+	return overrides.schemas === void 0 ? manifest : {
+		...manifest,
+		hook: {
+			...manifest.hook,
+			schemas: overrides.schemas
+		}
+	};
 }
 /**
 * The hook migration. With `grantsOut`, the statements `supabase db diff`
@@ -1697,7 +2581,7 @@ function inspectText(manifest) {
 function manifestFile(cwd, rel, manifest, check) {
 	const path = resolve(cwd, rel);
 	if (!check) {
-		writeFileEnsuringDir(path, `${JSON.stringify(manifest, null, 2)}\n`);
+		writeFileEnsuringDir(path, formatManifestJson(manifest));
 		return {
 			code: 0,
 			output: `wrote ${rel}`
@@ -1734,6 +2618,13 @@ function loadHookPolicy(cwd, config) {
 }
 async function runSupabase(input) {
 	const [area, action] = input.rest;
+	const badSchemas = schemasRefusal("supabase", input.schemas);
+	if (badSchemas !== void 0) return {
+		code: 2,
+		output: badSchemas
+	};
+	const flag = isSupabaseSchemas(input.schemas) ? input.schemas : void 0;
+	const schemas = resolveSchemas(input.cwd, input.config, flag);
 	const overrides = Object.fromEntries(Object.entries({
 		activeFrom: input.activeFrom,
 		budget: input.budget,
@@ -1743,7 +2634,8 @@ async function runSupabase(input) {
 		const policy = await loadHookPolicy(input.cwd, input.config);
 		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
 			...overrides,
-			out: hookOut(input.cwd, input.config, input.schema)
+			out: hookOut(input.cwd, input.config, input.schema, flag),
+			schemas: schemas.mode
 		}, policy);
 		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
 		return {
@@ -1755,8 +2647,12 @@ async function runSupabase(input) {
 		code: 2,
 		output: SUPABASE_HELP
 	};
+	if (input.grantsOut !== void 0 && schemas.mode !== "migra") return {
+		code: 2,
+		output: `supabase hook generate --grants-out is for --schemas migra: ${schemas.mode === "pg-delta" ? "pg-delta keeps the grants in the hook file" : "a hand-written migration keeps its grants"}, so drop --grants-out`
+	};
 	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
-	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema);
+	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema, flag);
 	const outPath = resolve(input.cwd, outRel);
 	const hook = input.config.supabase?.hook;
 	const grantsFile = input.grantsOut === void 0 ? [] : [{
@@ -1806,4 +2702,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { supabaseHookManifest as a, rbacScaffold as c, attrsPlan as d, pd045 as f, runSupabase as i, resolveAuthorize as l, hookOut as n, supabaseHookSql as o, supabaseConfig as p, loadScopes as r, parseRbacAuthorize as s, grantsLabel as t, pd039 as u };
+export { pd045 as _, supabaseHookManifest as a, approvalsSql as c, resolveAuthorize as d, pd039 as f, attrsPlan as g, schemasRefusal as h, runSupabase as i, parseRbacAuthorize as l, resolveSchemas as m, hookOut as n, supabaseHookSql as o, isSupabaseSchemas as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, rbacScaffold as u, readSupabaseConfig as v, supabaseConfig as y };