permdock 0.5.0 → 0.7.0

package/dist/{supabase-hook-DdDQhMlw.js → supabase-hook-Dg0SrQWR.js}

@@ -1,29 +1,896 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
+import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-BHsc-wp-.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
-import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
+import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as requirePolicy } from "./load-DFS_ry0W.js";
-import { r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { t as authorizeSql } from "./supabase-Dxlp8A94.js";
+import { c as requirePolicy } from "./load-DxroEzH1.js";
+import { i as qualifySqlTable } from "./sql-B96movIM.js";
+import { r as scopeColumn } from "./compile-BAEO5bOk.js";
+import { t as authorizeSql } from "./supabase--0aJdLEd.js";
 import "./budget-NbEtbJC_.js";
-import { i as qualifySqlTable } from "./sql-B5T1IL83.js";
-import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-vs5dGOsS.js";
-import { o as readMemberships } from "./postgrest-CW0IqC-U.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-B-zYB4GS.js";
+import { o as readMemberships } from "./postgrest-r5faDIzD.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
-import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-CD11nBbC.js";
-import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
-import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-CO1oOymN.js";
-import { $ as checkSuspension, A as roleNames, C as API_KEY_ALLOWS, G as memberRoleOf, H as memberForSources, K as permittedForHelper, R as hasMemberFor, T as apiKeyFields, U as memberForTable, V as memberForHelper, W as memberIdsHelper, X as scopeTable, Z as activeRowSql, a as guardedTables, b as globalRoleSource, c as PERMISSION_HELPERS, d as permissionKeysForHelper, f as permittedByPermissionHelper, l as checkName, o as ASSIGNMENTS, q as permittedIdsHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, y as globalRoleRows, z as hasPermittedUsers } from "./ownership-BatFgAA4.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-CCMdcFWb.js";
+import { A as quoteQualified, D as qualified, F as scopeTypeOf, L as tenantTypeOf, O as quoteIdent, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-fMKOv8hP.js";
+import { $ as permittedForHelper, A as apiKeyFields, C as globalRoleSource, G as hasMemberFor, I as roleNames, J as memberForHelper, K as hasPermittedUsers, O as API_KEY_ALLOWS, Q as memberRoleOf, S as globalRoleRows, X as memberForTable, Y as memberForSources, Z as memberIdsHelper, c as OWNERSHIP, et as permittedIdsHelper, f as permissionKeysForHelper, i as holderSources, it as activeRowSql, l as PERMISSION_HELPERS, o as guardedTables, ot as checkSuspension, p as permittedByPermissionHelper, rt as scopeTable, s as ASSIGNMENTS, t as ownershipRules, u as checkName, v as TOKEN_SCOPE_ALLOWS } from "./ownership-Z2LpxsGa.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-DRo2QM6E.js";
+import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-B2lZIurj.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
-import { parse } from "smol-toml";
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function getLineColFromPtr(string, ptr) {
+	let lines = string.slice(0, ptr).split(/\r?\n/);
+	return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+	let lines = string.split(/\r?\n/);
+	let codeblock = "";
+	let numberLen = (Math.log10(line + 1) | 0) + 1;
+	for (let i = line - 1; i <= line + 1; i++) {
+		let l = lines[i - 1];
+		if (!l) continue;
+		codeblock += i.toString().padEnd(numberLen, " ");
+		codeblock += ":  ";
+		codeblock += l;
+		codeblock += "\n";
+		if (i === line) {
+			codeblock += " ".repeat(numberLen + column + 2);
+			codeblock += "^\n";
+		}
+	}
+	return codeblock;
+}
+var TomlError = class TomlError extends Error {
+	line;
+	column;
+	codeblock;
+	constructor(message, options) {
+		const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+		const codeblock = makeCodeBlock(options.toml, line, column);
+		super(`Invalid TOML document: ${message}\n\n${codeblock}`, options);
+		this.line = line;
+		this.column = column;
+		this.codeblock = codeblock;
+	}
+	/** @internal */
+	static x(message, ctx, ptr) {
+		throw new TomlError(message, {
+			toml: ctx.s,
+			ptr: ptr ?? ctx.p
+		});
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/primitive.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseString(ctx) {
+	let startPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p++);
+	let first = c;
+	let isLiteral = c === 39;
+	let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+	if (isMultiline) {
+		if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10) ctx.p++;
+		else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) ctx.p += 2;
+	}
+	let parsed = "";
+	let sliceStart = ctx.p;
+	let state = 0;
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		c = ctx.s.charCodeAt(ctx.p);
+		if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) state = state && 3;
+		else if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in strings", ctx);
+		else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+			if (isMultiline) {
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+			}
+			if (!state) {
+				let s = ctx.s.slice(sliceStart, ctx.p);
+				parsed = parsed ? parsed + s : s;
+			}
+			ctx.p += isMultiline ? 3 : 1;
+			return parsed;
+		} else if (!state) {
+			if (!isLiteral && c === 92) {
+				parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+				state = 1;
+			}
+		} else if (state === 1) {
+			if (c === 120 || c === 117 || c === 85) {
+				let errPtr = ctx.p++ - 1;
+				let value = 0;
+				let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+				for (let j = 0; j < len; j++, ctx.p++) {
+					let hex = ctx.s.charCodeAt(ctx.p);
+					let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
+					if (digit < 0) TomlError.x("invalid non-hex character in unicode escape", ctx);
+					value = value << 4 | digit;
+				}
+				if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) TomlError.x("invalid unicode escape", ctx, errPtr);
+				parsed += String.fromCodePoint(value);
+				sliceStart = ctx.p--;
+				state = 0;
+			} else if (isMultiline && (c === 32 || c === 9)) state = 2;
+			else {
+				if (c === 98) parsed += "\b";
+				else if (c === 116) parsed += "	";
+				else if (c === 110) parsed += "\n";
+				else if (c === 102) parsed += "\f";
+				else if (c === 114) parsed += "\r";
+				else if (c === 101) parsed += "\x1B";
+				else if (c === 34) parsed += "\"";
+				else if (c === 92) parsed += "\\";
+				else TomlError.x("unrecognised escape sequence", ctx);
+				sliceStart = ctx.p + 1;
+				state = 0;
+			}
+		} else if (c !== 32 && c !== 9) {
+			if (state === 2) TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+			state = !isLiteral && c === 92 ? 1 : 0;
+			sliceStart = ctx.p;
+		}
+	}
+	TomlError.x("unfinished string", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/date.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class TomlDate extends Date {
+	#hasDate = false;
+	#hasTime = false;
+	#offset = null;
+	constructor(date, fasttype, unsafeDelim) {
+		let hasDate = true;
+		let hasTime = true;
+		let offset = "Z";
+		let c;
+		if (typeof date === "string") {
+			if (fasttype) prep: {
+				if (fasttype < 3) {
+					if (+date.slice(11, 13) > 23) {
+						date = "";
+						break prep;
+					}
+					if (fasttype === 2) {
+						offset = null;
+						date += "Z";
+					} else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) offset = date.slice(date.length - 6);
+					if (unsafeDelim) date = date.slice(0, 10) + "T" + date.slice(11);
+				} else if (fasttype === 4) date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+				hasDate = fasttype !== 4;
+				hasTime = fasttype !== 3;
+			}
+			else {
+				let match = date.match(DATE_TIME_RE);
+				if (match) {
+					if (!match[1]) {
+						hasDate = false;
+						date = `0000-01-01T${date}`;
+					}
+					hasTime = !!match[2];
+					hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+					if (match[2] && +match[2] > 23) date = "";
+					else {
+						offset = match[3] || null;
+						if (!offset && hasTime) date += "Z";
+					}
+				} else date = "";
+			}
+		}
+		super(date);
+		if (!isNaN(this.getTime())) {
+			this.#hasDate = hasDate;
+			this.#hasTime = hasTime;
+			this.#offset = offset;
+		}
+	}
+	isDateTime() {
+		return this.#hasDate && this.#hasTime;
+	}
+	isLocal() {
+		return !this.#hasDate || !this.#hasTime || !this.#offset;
+	}
+	isDate() {
+		return this.#hasDate && !this.#hasTime;
+	}
+	isTime() {
+		return this.#hasTime && !this.#hasDate;
+	}
+	isValid() {
+		return this.#hasDate || this.#hasTime;
+	}
+	toISOString() {
+		let iso = super.toISOString();
+		if (this.isDate()) return iso.slice(0, 10);
+		if (this.isTime()) return iso.slice(11, 23);
+		if (this.#offset === null) return iso.slice(0, -1);
+		if (this.#offset === "Z" || this.#offset === "z") return iso;
+		let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+		offset = this.#offset[0] === "-" ? offset : -offset;
+		return (/* @__PURE__ */ new Date(this.getTime() - offset * 6e4)).toISOString().slice(0, -1) + this.#offset;
+	}
+	static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+		let date = new TomlDate(jsDate);
+		date.#offset = offset;
+		return date;
+	}
+	static wrapAsLocalDateTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalDate(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasTime = false;
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasDate = false;
+		date.#offset = null;
+		return date;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/extract.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function isDigit(char, base = 10) {
+	return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+	return char === 32 || char === 9 || char === 10 || char === 13 || delim && (char === delim || char === 44) || char === 35;
+}
+/** @internal */
+function extractValue(ctx, end) {
+	let errPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p);
+	if (c === 91 || c === 123) {
+		ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+		let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+		ctx.d++;
+		return value;
+	}
+	if (c === 34 || c === 39) return parseString(ctx);
+	if (c === 116) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, true;
+	}
+	if (c === 102) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, false;
+	}
+	if (c === 43 || c === 45) return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+	if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) return parseDate(ctx, c, end);
+	if (ctx.s.charCodeAt(ctx.p + 2) === 58) return parseTime(ctx, c, end);
+	return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+	let c = startChr;
+	let state = 0;
+	let hasUnderscores = false;
+	if (c === 105) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, (sign || 1) / 0;
+	}
+	if (c === 110) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, NaN;
+	}
+	if (c === 48) {
+		if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr)) return ctx.bi === true ? 0n : 0;
+		if (!sign) {
+			if (c === 120) return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+			else if (c === 98) return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+			else if (c === 111) return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+		}
+		if (c === 46) state = 2;
+		else if (c === 101 || c === 69) state = 4;
+		else TomlError.x("illegal leading zero", ctx, startPtr);
+	} else if (!isDigit(c)) TomlError.x("invalid value", ctx, startPtr);
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+		if (!state) state = 1;
+		if (c === 95) {
+			if (!(state & 1)) TomlError.x("illegal underscore", ctx);
+			state += 11;
+			hasUnderscores = true;
+		} else if (state === 1 && c === 46) state = 2;
+		else if ((state === 1 || state === 3) && (c === 101 || c === 69)) state = 4;
+		else if (state === 4 && (c === 43 || c === 45)) state = 6;
+		else if (!isDigit(c)) TomlError.x(`illegal character in numeric literal`, ctx);
+		else if (state > 9) state -= 11;
+		else if (!(state & 1)) state++;
+	}
+	if (!state) {
+		let val = (startChr - 48) * (sign || 1);
+		return ctx.bi === true ? BigInt(val) : val;
+	}
+	if (!(state & 1)) TomlError.x("unfinished numeric value", ctx, startPtr);
+	let str = ctx.s.slice(startPtr, ctx.p);
+	if (hasUnderscores) str = str.replaceAll("_", "");
+	return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+	let c, underscore = 1;
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) if (c === 95) {
+		if (underscore & 1) TomlError.x("illegal underscore", ctx);
+		underscore = 3;
+	} else if (!isDigit(c, base)) TomlError.x(`illegal character in numeric literal`, ctx);
+	else if (underscore & 1) underscore--;
+	if (underscore & 1) TomlError.x("unfinished numeric value", ctx);
+	let str = ctx.s.slice(startPtr + 2, ctx.p);
+	if (underscore) str = str.replaceAll("_", "");
+	return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+	if (ctx.bi !== true) int: {
+		let val = parseInt(str, base);
+		if (!Number.isSafeInteger(val)) {
+			if (ctx.bi) break int;
+			TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+		}
+		return val;
+	}
+	return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+	let startPtr = ctx.p++, unsafeSeparator;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+	ctx.p += 5;
+	if (!isDigit(ctx.s.charCodeAt(ctx.p++))) TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+	if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 3, false, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) !== 58) TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	if (c = ctx.s.charCodeAt(ctx.p)) {
+		if (c === 90 || c === 122) return readDate(ctx, ctx.s.slice(startPtr, ++ctx.p), 1, unsafeSeparator, startPtr, "[+00:00]");
+		if (c === 43 || c === 45) return readDate(ctx, ctx.s.slice(startPtr, ctx.p += 6), 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+	}
+	return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+	let start = ctx.p;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) return parseNumber(ctx, --ctx.p, c, 0, endChr);
+	if (ctx.s.charCodeAt(ctx.p += 4) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	return readDate(ctx, ctx.s.slice(start, ctx.p), 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+	if (ctx.ld) {
+		let date = new TomlDate(str, type, unsafeDelim);
+		if (!date.isValid()) TomlError.x("invalid date", ctx, errPtr);
+		return date;
+	}
+	try {
+		if (temporalSuffix) str += temporalSuffix;
+		switch (type) {
+			case 1: return Temporal.ZonedDateTime.from(str);
+			case 2: return Temporal.PlainDateTime.from(str);
+			case 3: return Temporal.PlainDate.from(str);
+			case 4: return Temporal.PlainTime.from(str);
+		}
+	} catch (e) {
+		TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/util.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function skipComment(ctx) {
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		let c = ctx.s.charCodeAt(ctx.p);
+		if (c === 10) break;
+		if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+			ctx.p++;
+			break;
+		}
+		if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in comments", ctx);
+	}
+}
+/** @internal */
+function skipVoid(ctx, banNewLines, banComments) {
+	let c;
+	while (ctx.p < ctx.s.length) {
+		while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10))) ctx.p++;
+		if (banComments || c !== 35) break;
+		skipComment(ctx);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/struct.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseKey(ctx, end = 61) {
+	let startPtr;
+	let state = 0;
+	let parsed = [];
+	let sliceStart;
+	let c = ctx.s.charCodeAt(startPtr = ctx.p);
+	do
+		if (c === end) {
+			if (!state) TomlError.x("unexpected end of key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			return ctx.p++, parsed;
+		} else if (c === 46) {
+			if (!state) TomlError.x("illegal empty bare key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			state = 0;
+		} else if (!state && (c === 34 || c === 39)) {
+			if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2)) TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+			parsed.push(parseString(ctx));
+			state = 2;
+			ctx.p--;
+		} else if (c === 32 || c === 9) {
+			if (state === 1) {
+				parsed.push(ctx.s.slice(sliceStart, ctx.p));
+				state = 2;
+			}
+		} else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) TomlError.x("illegal character in key", ctx);
+		else if (!state) {
+			state = 1;
+			sliceStart = ctx.p;
+		}
+	while (c = ctx.s.charCodeAt(++ctx.p));
+	TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+/** @internal */
+function parseInlineTable(ctx) {
+	let startPtr = ctx.p++;
+	let res = Object.create(null);
+	let seen = /* @__PURE__ */ new Set();
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+			ctx.p++;
+			return res;
+		}
+		let k;
+		let t = res;
+		let hasOwn = false;
+		let errPtr = ctx.p;
+		let key = parseKey(ctx);
+		for (let i = 0; i < key.length; i++) {
+			if (i) t = hasOwn ? t[k] : t[k] = Object.create(null);
+			k = key[i];
+			if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) {
+				t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+				break;
+			}
+			if (!hasOwn && unsafe) Object.defineProperty(t, k, {
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+		}
+		if (hasOwn) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+		skipVoid(ctx, true, true);
+		let value = extractValue(ctx, 125);
+		if (t && typeof (t[k] = value) === "object") seen.add(value);
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished table", ctx, startPtr);
+}
+/** @internal */
+function parseArray(ctx) {
+	let startPtr = ctx.p++;
+	let res = [];
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+			ctx.p++;
+			return res;
+		}
+		res.push(extractValue(ctx, 93));
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished array", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/parse.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function peekTable(ctx, key, table, meta, type) {
+	let t = table;
+	let m = meta;
+	let k;
+	let hasOwn = false;
+	let state;
+	for (let i = 0; i < key.length; i++) {
+		if (i) {
+			t = hasOwn ? t[k] : t[k] = Object.create(null);
+			m = (state = m[k]).c;
+			if (type === 0 && (state.t === 1 || state.t === 2)) return null;
+			if (state.t === 2) {
+				let l = t.length - 1;
+				t = t[l];
+				m = m[l].c;
+			}
+		}
+		k = key[i];
+		if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) return null;
+		if (!hasOwn) {
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) return false;
+			if (unsafe) {
+				Object.defineProperty(t, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+				Object.defineProperty(m, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+			}
+			m[k] = {
+				t: i < key.length - 1 && type === 2 ? 3 : type,
+				d: false,
+				i: 0,
+				c: Object.create(null)
+			};
+		}
+	}
+	state = m[k];
+	if (state.t !== type && !(type === 1 && state.t === 3)) return null;
+	if (type === 2) {
+		if (!state.d) {
+			state.d = true;
+			t[k] = [];
+		}
+		t[k].push(t = Object.create(null));
+		state.c[state.i++] = state = {
+			t: 1,
+			d: false,
+			i: 0,
+			c: Object.create(null)
+		};
+	}
+	if (state.d) return null;
+	state.d = true;
+	if (type === 1) t = hasOwn ? t[k] : t[k] = Object.create(null);
+	else if (type === 0 && hasOwn) return null;
+	return [
+		k,
+		t,
+		state.c
+	];
+}
+function validateTablePeek(ctx, peek, ptr) {
+	if (peek === null || ctx.uk === 2) TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+	let ctx = {
+		s: toml,
+		p: 0,
+		d: options.maxDepth ?? 1e3,
+		bi: options.integersAsBigInt ?? false,
+		ld: options.useLegacyDate ?? true,
+		uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+	};
+	let res = Object.create(null);
+	let meta = Object.create(null);
+	let tmp;
+	let skipping = false;
+	let tbl = res;
+	let m = meta;
+	if (toml.charCodeAt(0) === 65279) ctx.p++;
+	skipVoid(ctx);
+	while (ctx.p < toml.length) {
+		if (toml.charCodeAt(ctx.p) === 91) {
+			let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+			tmp = ctx.p += +isTableArray;
+			skipping = false;
+			let k = parseKey(ctx, 93);
+			if (isTableArray) {
+				if (toml.charCodeAt(ctx.p) !== 93) TomlError.x("expected end of table array declaration", ctx);
+				ctx.p++;
+			}
+			let p = peekTable(ctx, k, res, meta, isTableArray ? 2 : 1);
+			if (!p) {
+				validateTablePeek(ctx, p, tmp);
+				skipping = true;
+			} else {
+				m = p[2];
+				tbl = p[1];
+			}
+		} else {
+			tmp = ctx.p;
+			let p = peekTable(ctx, parseKey(ctx), tbl, m, 0);
+			if (!p && !skipping) validateTablePeek(ctx, p, tmp);
+			skipVoid(ctx, true, true);
+			let v = extractValue(ctx, void 0);
+			if (p && !skipping) p[1][p[0]] = v;
+		}
+		skipVoid(ctx, true);
+		if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+		skipVoid(ctx);
+	}
+	return res;
+}
+//#endregion
+//#region src/cli/rls/rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+function authAdminRead(table, label) {
+	const t = quoteQualified(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
+* The token hook comes only from `permdock supabase hook generate`, so one
+* function writes the claims. Policies never call `authorize()` per row; they
+* call the helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+//#endregion
 //#region src/cli/supabase-config.ts
 const SUPABASE_CONFIG = "supabase/config.toml";
 function table(value) {
@@ -50,6 +917,9 @@ function readSupabaseConfig(cwd) {
 	const paths = table(table(root["db"])?.["migrations"])?.["schema_paths"];
 	const schemaPaths = strings(paths);
 	const apiSchemas = strings(table(root["api"])?.["schemas"]);
+	const hookTable = table(table(table(root["auth"])?.["hook"])?.["custom_access_token"]);
+	const hookEnabled = hookTable?.["enabled"];
+	const hookUriValue = hookTable?.["uri"];
 	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
 	const schemaPath = pgDelta?.["declarative_schema_path"];
 	const enabled = pgDelta?.["enabled"];
@@ -59,6 +929,10 @@ function readSupabaseConfig(cwd) {
 			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
 			...schemaPaths === void 0 ? {} : { schemaPaths },
 			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...hookTable === void 0 ? {} : { customAccessTokenHook: {
+				...typeof hookEnabled === "boolean" ? { enabled: hookEnabled } : {},
+				...typeof hookUriValue === "string" ? { uri: hookUriValue } : {}
+			} },
 			...pgDelta === void 0 ? {} : { pgDelta: {
 				...typeof enabled === "boolean" ? { enabled } : {},
 				schemaDir: declarativeSchemaDir(schemaPath)
@@ -86,6 +960,32 @@ function pd045(cwd) {
 		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then PermDock assumes Supabase's defaults for jwt_expiry, schema_paths and [experimental.pgdelta], and generates for pg-delta`
 	}];
 }
+/**
+* PD074: `supabase.hook` is configured but `[auth.hook.custom_access_token]`
+* in `supabase/config.toml` does not enable the generated function, so a
+* local stack and every branch push issue tokens without memberships.
+*/
+function pd074(cwd, config) {
+	const hook = config.supabase?.hook;
+	const read = readSupabaseConfig(cwd);
+	if (hook === void 0 || read === void 0 || !read.ok) return [];
+	const expected = hookUri(hook.schema ?? config.rls?.schema ?? "permdock");
+	const found = read.config.customAccessTokenHook;
+	const fix = `add to ${SUPABASE_CONFIG}:\n[auth.hook.custom_access_token]\nenabled = true\nuri = "${expected}"`;
+	if (found?.enabled !== true) return [{
+		code: "PD074",
+		severity: "warning",
+		message: `supabase.hook is configured but ${SUPABASE_CONFIG} does not set [auth.hook.custom_access_token] enabled = true, so Auth never calls the hook`,
+		fix
+	}];
+	if (found.uri !== expected) return [{
+		code: "PD074",
+		severity: "warning",
+		message: `[auth.hook.custom_access_token] uri is ${found.uri ?? "missing"}, but the generated hook is ${expected}`,
+		fix: `set uri = "${expected}" in ${SUPABASE_CONFIG}`
+	}];
+	return [];
+}
 //#endregion
 //#region src/cli/claims-schema.ts
 /**
@@ -123,6 +1023,11 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 					description: "true when the size budget cut memberships or attrs.",
 					type: "boolean"
 				},
+				team_ids: {
+					description: "The uuid of every team the user belongs to (supabase.hook.teams), cut by the memberships budget.",
+					type: "array",
+					items: { type: "string" }
+				},
 				tenant_id: {
 					description: "The active tenant (the default rls.tenantClaim): the canonical text of one instance of the first scope.",
 					type: "string"
@@ -268,6 +1173,7 @@ const RESERVED_CLAIMS = /* @__PURE__ */ new Set([
 	"user_role",
 	"memberships",
 	"memberships_truncated",
+	"team_ids",
 	"attrs",
 	"authz_ver",
 	"sub",
@@ -346,6 +1252,7 @@ function validateSql(parts) {
 		"roles",
 		"memberships",
 		"memberships_truncated",
+		...parts.hook.teams === void 0 ? [] : ["team_ids"],
 		"attrs",
 		"authz_ver",
 		parts.tenantClaim
@@ -398,6 +1305,7 @@ function hookClaims(parts) {
 		permdockClaim("memberships", true),
 		permdockClaim("memberships_truncated"),
 		permdockClaim(parts.tenantClaim),
+		...parts.hook.teams === void 0 ? [] : [permdockClaim("team_ids", true)],
 		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
 		...parts.version ? [permdockClaim("authz_ver")] : [],
 		...parts.extra.map((entry) => ({
@@ -408,6 +1316,18 @@ function hookClaims(parts) {
 	];
 }
 //#endregion
+//#region src/cli/sql/declarative.ts
+/**
+* A migration's SQL as a declarative schema file: pg-delta diffs the file
+* against the database itself, so a `drop trigger if exists` or
+* `drop policy if exists` before its `create` is an error, and a trigger is
+* `create or replace trigger`. A constraint trigger stays `create constraint trigger`, because
+* pg-delta has no `create or replace constraint trigger`. A policy keeps its plain `create policy`.
+*/
+function declarativeSql(sql) {
+	return sql.replaceAll(/^drop (?:trigger|policy) if exists [^;\n]+;\n/gmu, "").replaceAll(/^create trigger /gmu, "create or replace trigger ");
+}
+//#endregion
 //#region src/cli/supabase-schemas.ts
 const MODES = [
 	"pg-delta",
@@ -576,87 +1496,6 @@ function readClaimsFixture(path) {
 	}
 }
 //#endregion
-//#region src/cli/rls/rbac.ts
-/**
-* Where the helpers read roles and memberships: the flag, `rls.authorize`,
-* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
-* `--rbac` or with a mapped memberships table, else `jwt`.
-*/
-function resolveAuthorize(config, flags = {}) {
-	const rls = config.rls;
-	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
-	if (explicit !== void 0) return explicit;
-	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
-	const memberships = flags.memberships ?? rls?.memberships;
-	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
-}
-function parseRbacAuthorize(raw) {
-	if (raw === void 0) return;
-	if (raw === "database" || raw === "jwt") return raw;
-	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
-}
-function hookUri(schema) {
-	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
-}
-function createEnum(schema, name, values) {
-	const list = values.map((value) => quoteLiteral(value)).join(", ");
-	return `do $$ begin
-  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
-exception when duplicate_object then null;
-end $$;`;
-}
-/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
-function authAdminRead(table, label) {
-	const t = quoteQualified(table);
-	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
-	return `grant select on table ${t} to supabase_auth_admin;
-drop policy if exists ${policy} on ${t};
-create policy ${policy} on ${t}
-  as permissive for select
-  to supabase_auth_admin
-  using (true);`;
-}
-/**
-* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
-* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
-* The token hook comes only from `permdock supabase hook generate`, so one
-* function writes the claims. Policies never call `authorize()` per row; they
-* call the helpers. Never grants anything to `service_role`.
-*/
-function rbacScaffold(policy, options) {
-	const schema = options.schema;
-	const q = (name) => quoteTable(`${schema}.${name}`);
-	const s = quoteIdent(schema);
-	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
-	const authorizeFn = authorizeSql({
-		schema,
-		authorize: options.authorize,
-		...options.scope === void 0 ? {} : { scope: options.scope },
-		...options.memberships === void 0 ? {} : { tenant: options.memberships },
-		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
-		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
-	});
-	return {
-		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
--- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
--- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
-${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
-${createEnum(schema, "app_permission", permissions)}
-
-create table if not exists ${q("user_roles")} (
-  user_id uuid not null references auth.users on delete cascade,
-  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
-  primary key (user_id, role)
-);
-
-alter table ${q("user_roles")} enable row level security;
-revoke all on table ${q("user_roles")} from authenticated, anon, public;
-`,
-		tail: authorizeFn,
-		warnings: []
-	};
-}
-//#endregion
 //#region src/cli/supabase-hook/memberships.ts
 function memberForPlan(input) {
 	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
@@ -792,7 +1631,7 @@ function subjectForSql(parts, config) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.${SUBJECT_FOR}`;
 	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}) filter (where ${rows.roleSql} is not null), '[]'::jsonb)
     into held
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
@@ -803,6 +1642,20 @@ function subjectForSql(parts, config) {
 	const version = parts.version ? `
   select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
   ver := coalesce(ver, 0);` : "";
+	const teamsConfig = parts.hook.teams;
+	const teams = teamsConfig === void 0 ? "" : `
+  select coalesce(jsonb_agg(to_jsonb(t.${quoteIdent(teamsConfig.team)}::text) order by t.${quoteIdent(teamsConfig.team)}), '[]'::jsonb)
+    into team_ids
+    from ${quoteQualified(teamsConfig.table)} t
+    where t.${quoteIdent(teamsConfig.user)} = uid;
+  if team_ids <> '[]'::jsonb then
+    claims := jsonb_set(claims, '{team_ids}', team_ids);
+  end if;`;
+	const extra = parts.extra.map((entry) => `
+  extra := ${quoteTable(entry.fn)}(uid);
+  if extra is not null then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
+  end if;`).join("");
 	const custom = customRolesOn(config.rls) && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
 	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
 create or replace function ${fn}(p_user uuid)
@@ -817,7 +1670,8 @@ declare
   held jsonb;
   memberships jsonb;
   custom jsonb := '[]'::jsonb;
-  ver bigint;${typedUsers(parts)}
+  ver bigint;
+  claims jsonb := '{}'::jsonb;${teamsConfig === void 0 ? "" : "\n  team_ids jsonb := '[]'::jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${typedUsers(parts)}
 begin
   if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
     return null;
@@ -827,8 +1681,9 @@ ${roles}
     into memberships
     from (
 ${entriesSql(parts).replaceAll(/^/gmu, "      ")}
-    ) x;${custom}${version}
+    ) x;${custom}${version}${teams}${extra}
   return jsonb_strip_nulls(jsonb_build_object(
+    'claims', case when claims = '{}'::jsonb then null else claims end,
     'id', uid::text,
     'active', true,
     'roles', held,
@@ -841,8 +1696,11 @@ $$;
 revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
 }
 /**
-* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
+* The PostgREST wrappers `supabase.hook.api` asks for: one `security invoker`
 * function per reader, in the API schema, executable by `service_role` only.
+* The `security definer` readers stay in the hook schema, which the Data API
+* does not expose; `service_role` gets `usage` on it and `execute` on each
+* reader, so no definer function sits in an exposed schema.
 */
 function apiWrappersSql(parts) {
 	const api = parts.hook.api;
@@ -857,13 +1715,16 @@ function apiWrappersSql(parts) {
 returns ${returns}
 language sql
 stable
-security definer
+security invoker
 set search_path = ''
 as $$ select ${source}.${inner}(${args}) $$;
 revoke execute on function ${fn}(${types}) from public, anon, authenticated;
-grant execute on function ${fn}(${types}) to service_role;`;
+grant execute on function ${fn}(${types}) to service_role;
+grant execute on function ${source}.${inner}(${types}) to service_role;`;
 	};
-	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
+	return `-- supabase.hook.api: security invoker wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them, and the security definer readers stay in ${source}
+grant usage on schema ${source} to service_role;
+
 ${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
 
 ${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
@@ -935,9 +1796,10 @@ $$;
 revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
 }
 /**
-* The custom roles `p_user` holds: tenant roles named on a membership of the
-* scope (and instance) they live at, and platform roles among the global
-* roles, each with its grants and includes in `CustomRole` form.
+* The custom roles `p_user` holds: tenant and shared roles named on a
+* membership of the scope (and instance) they live at, and platform roles
+* among the global roles, each with its grants and includes in `CustomRole`
+* form. A shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
 */
 function customRolesOfSql(parts) {
 	const helpers = quoteIdent(parts.helpers.schema);
@@ -948,6 +1810,7 @@ function customRolesOfSql(parts) {
 	return `
   select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
       'name', c.role,
+      'shared', case when c.tenant_id is null and c.scope <> 'global' then true end,
       'tenant', c.tenant_id::text,
       'scope', c.scope,
       'id', c.scope_id,
@@ -978,7 +1841,10 @@ function customRolesOfSql(parts) {
         from jsonb_array_elements(memberships) m
         where m -> 'roles' ? c.role
           and m ->> 'scope' = c.scope
-          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (
+            (c.tenant_id is null and c.scope_id is null)
+            or c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          )
           and (c.scope_id is null or c.scope_id = m ->> 'id')
       );`;
 }
@@ -1791,7 +2657,7 @@ function hookSql(parts) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.custom_access_token_hook`;
 	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}) filter (where ${rows.roleSql} is not null), '[]'::jsonb)
     into held
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
@@ -1823,11 +2689,29 @@ function hookSql(parts) {
   if extra is not null then
     claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
   end if;`).join("");
+	const dropTeams = parts.hook.teams === void 0 ? "" : " - 'team_ids'";
 	const suspended = parts.users === void 0 ? "" : `
   if not ${activeRowSql(parts.users, "uid")} then
-    claims := claims - 'memberships_truncated' - 'attrs' - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
+    claims := claims - 'memberships_truncated' - 'attrs'${dropTeams} - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
     claims := claims || jsonb_build_object('user_role', '[]'::jsonb, 'roles', '[]'::jsonb, 'memberships', '[]'::jsonb);${version}
     return jsonb_set(event, '{claims}', claims);
+  end if;`;
+	const teamsConfig = parts.hook.teams;
+	const teams = teamsConfig === void 0 ? "" : `
+  for team in
+    select t.${quoteIdent(teamsConfig.team)}::text as id
+    from ${quoteQualified(teamsConfig.table)} t
+    where t.${quoteIdent(teamsConfig.user)} = uid
+    order by ${teamsConfig.tenant === void 0 ? "" : `(t.${quoteIdent(teamsConfig.tenant)}::text is not distinct from active) desc, `}t.${quoteIdent(teamsConfig.team)}
+  loop
+    if octet_length(kept::text) + used + octet_length((team_ids || to_jsonb(team.id))::text) > budget then
+      truncated := true;
+      exit;
+    end if;
+    team_ids := team_ids || jsonb_build_array(team.id);
+  end loop;
+  if team_ids <> '[]'::jsonb then
+    claims := jsonb_set(claims, '{team_ids}', team_ids);
   end if;`;
 	return `${parts.schema === "public" ? "" : `create schema if not exists ${schema};\nrevoke all on schema ${schema} from public;\n\n`}create or replace function ${fn}(event jsonb)
 returns jsonb
@@ -1845,9 +2729,9 @@ declare
   in_active boolean := false;
   budget integer := ${String(parts.budget)};
   used integer := 0;
-  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
+  item record;${teamsConfig === void 0 ? "" : "\n  team record;\n  team_ids jsonb := '[]'::jsonb;"}${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
 begin${beforeSql(parts.before)}${suspended}
-  claims := claims - 'attrs'${dropExtra};
+  claims := claims - 'attrs'${dropTeams}${dropExtra};
 ${roles}
   claims := jsonb_set(claims, '{roles}', held);
   if jsonb_array_length(held) = 1 then
@@ -1870,7 +2754,7 @@ ${entriesSql(parts).replaceAll(/^/gmu, "      ")}
     kept := kept || jsonb_build_array(item.entry);
     in_active := in_active or (active is not null and item.current);
   end loop;
-  claims := jsonb_set(claims, '{memberships}', kept);
+  claims := jsonb_set(claims, '{memberships}', kept);${teams}
   if truncated then
     claims := jsonb_set(claims, '{memberships_truncated}', 'true'::jsonb);
   else
@@ -1897,11 +2781,11 @@ revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extra
 	].filter((chunk) => chunk !== "").join("\n");
 }
 function extraGrantsSql(extra) {
-	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\nrevoke all on function ${quoteTable(entry.fn)}(uuid) from public, anon, authenticated;\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
 }
 function beforeGrantsSql(before, extra) {
 	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
-	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\nrevoke all on function ${quoteTable(fn)}(jsonb) from public, anon, authenticated;\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
 }
 /**
 * Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
@@ -1928,6 +2812,7 @@ function readsSql(parts) {
 		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
 		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
 	}
+	if (parts.hook.teams !== void 0) reads.set(parts.hook.teams.table, reads.get(parts.hook.teams.table) ?? "teams");
 	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
 	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
 	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
@@ -2005,7 +2890,7 @@ function hookParts(scopes, config, overrides) {
 			...memberForPlan({
 				scopes,
 				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
-				memberSources: config.rls?.membershipSources ?? hook.memberships
+				memberSources: membershipSourcesOf(config)
 			})
 		}
 	};
@@ -2328,6 +3213,7 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 	const keyed = [
 		helperEntry(USER_ID_HELPER, "", "uuid", client),
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...config.rls?.tokenScopes === true ? [helperEntry(TOKEN_SCOPE_ALLOWS, "p_grant text", "boolean", client)] : [],
 		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
 		...!config.rls?.approvals ? [] : [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)],
 		...forUser
@@ -2375,7 +3261,8 @@ function rlsSettings(parts, config) {
 			...suspension.memberships === void 0 ? {} : { memberships: { keep: keptKeys(suspension.memberships) } }
 		} },
 		...assigned === void 0 ? {} : { assignments: { tables: assigned } },
-		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) }
+		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) },
+		...rls?.tokenScopes === true ? { tokenScopes: true } : {}
 	};
 }
 /** The `supabase/sdk` release `requires.capabilities` names features of. */
@@ -2459,7 +3346,7 @@ function manifestOf(parts, out, config, policy) {
 		decidingColumns: decidingColumns(config, parts.attrs === void 0 ? void 0 : {
 			...parts.attrs.table === void 0 ? {} : { table: parts.attrs.table },
 			columns: parts.attrs.columns
-		}),
+		}, parts.hook.teams),
 		markers: {
 			hook: "v1",
 			grants: "v1"
@@ -2467,6 +3354,11 @@ function manifestOf(parts, out, config, policy) {
 		requires: requiredCapabilities(config, policy)
 	};
 }
+/** The manifest without the token hook: what a project with no `supabase.hook` records. */
+function databaseManifestOf(parts, out, config, policy) {
+	const { hook: _hook, budget: _budget, claims: _claims, authzVersion: _authzVersion, authzVersionBump: _authzVersionBump, memberships: _memberships, ...rest } = manifestOf(parts, out, config, policy);
+	return rest;
+}
 /** The first line of the generated hook: fields `--check` compares before the full text. */
 function hookMarker(manifest) {
 	return `${HOOK_MARKER} schema=${manifest.hook.schema} tenant=${manifest.tenantClaim} budget=${String(manifest.budget.bytes)} claims=${manifest.claims.map((claim) => claim.name).join(",")}`;
@@ -2514,6 +3406,24 @@ function supabaseHookManifest(scopes, config, overrides = {}, policy) {
 	};
 }
 /**
+* The manifest of a project in `rls.authorize: 'database'` mode with no
+* `supabase.hook`: the helpers, scopes, membership sources and grants, and no
+* token hook.
+*/
+function supabaseDatabaseManifest(scopes, config, overrides = {}, policy) {
+	return databaseManifestOf(hookParts(scopes, {
+		...config,
+		supabase: {
+			...config.supabase,
+			hook: { memberships: membershipSourcesOf(config) }
+		}
+	}, overrides), overrides.out ?? defaultOut(config), config, policy);
+}
+/** Whether the project is in the one case that has a manifest without a hook. */
+function hooklessDatabase(config) {
+	return config.supabase?.hook === void 0 && resolveAuthorize(config) === "database";
+}
+/**
 * The hook migration. With `grantsOut`, the statements `supabase db diff`
 * drops are left out of `sql` and returned in `grants` for that file.
 */
@@ -2559,14 +3469,33 @@ function markerDrift(onDisk, expected, outRel) {
 	const changed = Object.keys(want).filter((key) => found[key] !== want[key]).map((key) => `${key} ${found[key] ?? "(none)"} -> ${want[key] ?? ""}`);
 	return changed.length === 0 ? "supabase hook drift" : `supabase hook drift: ${changed.join("; ")}`;
 }
-function inspectText(manifest) {
+/** Supabase's default access token lifetime when `[auth] jwt_expiry` is unset. */
+const DEFAULT_JWT_EXPIRY = 3600;
+function managementApi(cwd, manifest) {
+	return {
+		hook_custom_access_token_enabled: true,
+		hook_custom_access_token_uri: hookUri(manifest.hook.schema),
+		jwt_exp: supabaseConfig(cwd).jwtExpiry ?? DEFAULT_JWT_EXPIRY
+	};
+}
+function inspectText(manifest, api) {
 	return [
 		`hook ${manifest.hook.schema}.${manifest.hook.function} (${manifest.hook.out})`,
 		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
 		`tenant claim ${manifest.tenantClaim}`,
 		`budget ${String(manifest.budget.bytes)} bytes of ${manifest.budget.measure}`,
 		`claims ${manifest.claims.map((claim) => `${claim.name}${claim.source === "permdock" ? "" : ` (${claim.source})`}${claim.budget ? " [budget]" : ""}`).join(", ")}`,
-		`authz_ver ${manifest.authzVersion ? "on" : "off"}`
+		`authz_ver ${manifest.authzVersion ? "on" : "off"}`,
+		`hook_custom_access_token_enabled ${String(api.hook_custom_access_token_enabled)}`,
+		`hook_custom_access_token_uri ${api.hook_custom_access_token_uri}`,
+		`jwt_exp ${String(api.jwt_exp)}`
+	].join("\n");
+}
+function databaseInspectText(manifest) {
+	return [
+		"no token hook (rls.authorize: database, no supabase.hook)",
+		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
+		`tenant claim ${manifest.tenantClaim}`
 	].join("\n");
 }
 /**
@@ -2627,15 +3556,30 @@ async function runSupabase(input) {
 	}).filter(([, value]) => value !== void 0));
 	if (area === "inspect" && action === void 0) {
 		const policy = await loadHookPolicy(input.cwd, input.config);
+		if (hooklessDatabase(input.config)) {
+			const bare = supabaseDatabaseManifest(scopeList(policy.scopes), input.config, overrides, policy);
+			if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, bare, input.check);
+			return {
+				code: 0,
+				output: input.json === true ? JSON.stringify(bare, null, 2) : databaseInspectText(bare)
+			};
+		}
 		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
 			...overrides,
 			out: hookOut(input.cwd, input.config, input.schema, flag),
 			schemas: schemas.mode
 		}, policy);
-		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
+		const api = managementApi(input.cwd, manifest);
+		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, {
+			...manifest,
+			managementApi: api
+		}, input.check);
 		return {
 			code: 0,
-			output: input.json === true ? JSON.stringify(manifest, null, 2) : inspectText(manifest)
+			output: input.json === true ? JSON.stringify({
+				...manifest,
+				managementApi: managementApi(input.cwd, manifest)
+			}, null, 2) : inspectText(manifest, api)
 		};
 	}
 	if (area !== "hook" || action !== "generate") return {
@@ -2646,7 +3590,9 @@ async function runSupabase(input) {
 		code: 2,
 		output: `supabase hook generate --grants-out is for --schemas migra: ${schemas.mode === "pg-delta" ? "pg-delta keeps the grants in the hook file" : "a hand-written migration keeps its grants"}, so drop --grants-out`
 	};
-	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const generated = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const { grants, manifest } = generated;
+	const sql = schemas.mode === "pg-delta" && typeof input.out !== "string" && input.config.supabase?.hook?.out === void 0 ? declarativeSql(generated.sql) : generated.sql;
 	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema, flag);
 	const outPath = resolve(input.cwd, outRel);
 	const hook = input.config.supabase?.hook;
@@ -2697,4 +3643,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { pd045 as _, supabaseHookManifest as a, approvalsSql as c, resolveAuthorize as d, pd039 as f, attrsPlan as g, schemasRefusal as h, runSupabase as i, parseRbacAuthorize as l, resolveSchemas as m, hookOut as n, supabaseHookSql as o, isSupabaseSchemas as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, rbacScaffold as u, readSupabaseConfig as v, supabaseConfig as y };
+export { readSupabaseConfig as _, supabaseHookManifest as a, rbacScaffold as b, approvalsSql as c, resolveSchemas as d, schemasRefusal as f, pd074 as g, pd045 as h, runSupabase as i, pd039 as l, attrsPlan as m, hookOut as n, supabaseHookSql as o, declarativeSql as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, isSupabaseSchemas as u, supabaseConfig as v, resolveAuthorize as x, parseRbacAuthorize as y };