permdock 0.6.0 → 0.8.0

package/dist/{supabase-hook-BMoEhZir.js → supabase-hook-B-yXnzUl.js}

@@ -1,29 +1,902 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
-import { c as rootScope, d as scopeList, l as scopeChain, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
-import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
-import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as requirePolicy } from "./load-DFS_ry0W.js";
-import { r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { t as authorizeSql } from "./supabase-x5JtR2tc.js";
-import "./budget-NbEtbJC_.js";
-import { i as qualifySqlTable } from "./sql-B5T1IL83.js";
-import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-vs5dGOsS.js";
-import { o as readMemberships } from "./postgrest-DAjUkF9w.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
+import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import { i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { t as authorizeSql } from "./supabase-BL1qJzzY.js";
+import "./budget-BELja5A9.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-CMAM-2A3.js";
+import { o as readMemberships } from "./postgrest-D4nuPXIQ.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
+import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
-import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
-import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
-import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
-import { B as hasPermittedUsers, E as apiKeyFields, G as memberIdsHelper, H as memberForHelper, J as permittedIdsHelper, K as memberRoleOf, Q as activeRowSql, U as memberForSources, W as memberForTable, Z as scopeTable, a as guardedTables, c as PERMISSION_HELPERS, d as permissionKeysForHelper, et as checkSuspension, f as permittedByPermissionHelper, j as roleNames, l as checkName, o as ASSIGNMENTS, q as permittedForHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, v as globalRoleRows, w as API_KEY_ALLOWS, y as globalRoleSource, z as hasMemberFor } from "./ownership-DqaJNJPn.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
+import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DeMNEy6V.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
+import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
+import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
+import { n as pgConnector } from "./pg-DQTqRrou.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-D0vUI6dq.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
-import { parse } from "smol-toml";
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function getLineColFromPtr(string, ptr) {
+	let lines = string.slice(0, ptr).split(/\r?\n/);
+	return [lines.length, lines.pop().length + 1];
+}
+function makeCodeBlock(string, line, column) {
+	let lines = string.split(/\r?\n/);
+	let codeblock = "";
+	let numberLen = (Math.log10(line + 1) | 0) + 1;
+	for (let i = line - 1; i <= line + 1; i++) {
+		let l = lines[i - 1];
+		if (!l) continue;
+		codeblock += i.toString().padEnd(numberLen, " ");
+		codeblock += ":  ";
+		codeblock += l;
+		codeblock += "\n";
+		if (i === line) {
+			codeblock += " ".repeat(numberLen + column + 2);
+			codeblock += "^\n";
+		}
+	}
+	return codeblock;
+}
+var TomlError = class TomlError extends Error {
+	line;
+	column;
+	codeblock;
+	constructor(message, options) {
+		const [line, column] = getLineColFromPtr(options.toml, options.ptr);
+		const codeblock = makeCodeBlock(options.toml, line, column);
+		super(`Invalid TOML document: ${message}\n\n${codeblock}`, options);
+		this.line = line;
+		this.column = column;
+		this.codeblock = codeblock;
+	}
+	/** @internal */
+	static x(message, ctx, ptr) {
+		throw new TomlError(message, {
+			toml: ctx.s,
+			ptr: ptr ?? ctx.p
+		});
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/primitive.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseString(ctx) {
+	let startPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p++);
+	let first = c;
+	let isLiteral = c === 39;
+	let isMultiline = c === ctx.s.charCodeAt(ctx.p) && c === ctx.s.charCodeAt(ctx.p + 1);
+	if (isMultiline) {
+		if ((c = ctx.s.charCodeAt(ctx.p += 2)) === 10) ctx.p++;
+		else if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) ctx.p += 2;
+	}
+	let parsed = "";
+	let sliceStart = ctx.p;
+	let state = 0;
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		c = ctx.s.charCodeAt(ctx.p);
+		if (isMultiline && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10)) state = state && 3;
+		else if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in strings", ctx);
+		else if ((!state || state === 3) && c === first && (!isMultiline || ctx.s.charCodeAt(ctx.p + 1) === first && ctx.s.charCodeAt(ctx.p + 2) === first)) {
+			if (isMultiline) {
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+				if (ctx.s.charCodeAt(ctx.p + 3) === first) ctx.p++;
+			}
+			if (!state) {
+				let s = ctx.s.slice(sliceStart, ctx.p);
+				parsed = parsed ? parsed + s : s;
+			}
+			ctx.p += isMultiline ? 3 : 1;
+			return parsed;
+		} else if (!state) {
+			if (!isLiteral && c === 92) {
+				parsed += ctx.s.slice(sliceStart, sliceStart = ctx.p);
+				state = 1;
+			}
+		} else if (state === 1) {
+			if (c === 120 || c === 117 || c === 85) {
+				let errPtr = ctx.p++ - 1;
+				let value = 0;
+				let len = c === 120 ? 2 : c === 117 ? 4 : 8;
+				for (let j = 0; j < len; j++, ctx.p++) {
+					let hex = ctx.s.charCodeAt(ctx.p);
+					let digit = hex >= 48 && hex <= 57 ? hex - 48 : hex >= 65 && hex <= 70 ? hex - 65 + 10 : hex >= 97 && hex <= 102 ? hex - 97 + 10 : -1;
+					if (digit < 0) TomlError.x("invalid non-hex character in unicode escape", ctx);
+					value = value << 4 | digit;
+				}
+				if (value < 0 || value > 1114111 || value >= 55296 && value <= 57343) TomlError.x("invalid unicode escape", ctx, errPtr);
+				parsed += String.fromCodePoint(value);
+				sliceStart = ctx.p--;
+				state = 0;
+			} else if (isMultiline && (c === 32 || c === 9)) state = 2;
+			else {
+				if (c === 98) parsed += "\b";
+				else if (c === 116) parsed += "	";
+				else if (c === 110) parsed += "\n";
+				else if (c === 102) parsed += "\f";
+				else if (c === 114) parsed += "\r";
+				else if (c === 101) parsed += "\x1B";
+				else if (c === 34) parsed += "\"";
+				else if (c === 92) parsed += "\\";
+				else TomlError.x("unrecognised escape sequence", ctx);
+				sliceStart = ctx.p + 1;
+				state = 0;
+			}
+		} else if (c !== 32 && c !== 9) {
+			if (state === 2) TomlError.x("invalid escape: only line-ending whitespace may be escaped", ctx, sliceStart);
+			state = !isLiteral && c === 92 ? 1 : 0;
+			sliceStart = ctx.p;
+		}
+	}
+	TomlError.x("unfinished string", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/date.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+let DATE_TIME_RE = /^(\d{4}-\d{2}-\d{2})?[Tt ]?(?:(\d{2}):\d{2}(?::\d{2}(?:\.\d+)?)?)?(Z|z|[-+]\d{2}:\d{2})?$/i;
+var TomlDate = class TomlDate extends Date {
+	#hasDate = false;
+	#hasTime = false;
+	#offset = null;
+	constructor(date, fasttype, unsafeDelim) {
+		let hasDate = true;
+		let hasTime = true;
+		let offset = "Z";
+		let c;
+		if (typeof date === "string") {
+			if (fasttype) prep: {
+				if (fasttype < 3) {
+					if (+date.slice(11, 13) > 23) {
+						date = "";
+						break prep;
+					}
+					if (fasttype === 2) {
+						offset = null;
+						date += "Z";
+					} else if ((c = date.charCodeAt(date.length - 1)) !== 90 && c !== 122) offset = date.slice(date.length - 6);
+					if (unsafeDelim) date = date.slice(0, 10) + "T" + date.slice(11);
+				} else if (fasttype === 4) date = +date.slice(0, 2) > 23 ? "" : `0000-01-01T${date}Z`;
+				hasDate = fasttype !== 4;
+				hasTime = fasttype !== 3;
+			}
+			else {
+				let match = date.match(DATE_TIME_RE);
+				if (match) {
+					if (!match[1]) {
+						hasDate = false;
+						date = `0000-01-01T${date}`;
+					}
+					hasTime = !!match[2];
+					hasTime && date[10] === " " && (date = date.replace(" ", "T"));
+					if (match[2] && +match[2] > 23) date = "";
+					else {
+						offset = match[3] || null;
+						if (!offset && hasTime) date += "Z";
+					}
+				} else date = "";
+			}
+		}
+		super(date);
+		if (!isNaN(this.getTime())) {
+			this.#hasDate = hasDate;
+			this.#hasTime = hasTime;
+			this.#offset = offset;
+		}
+	}
+	isDateTime() {
+		return this.#hasDate && this.#hasTime;
+	}
+	isLocal() {
+		return !this.#hasDate || !this.#hasTime || !this.#offset;
+	}
+	isDate() {
+		return this.#hasDate && !this.#hasTime;
+	}
+	isTime() {
+		return this.#hasTime && !this.#hasDate;
+	}
+	isValid() {
+		return this.#hasDate || this.#hasTime;
+	}
+	toISOString() {
+		let iso = super.toISOString();
+		if (this.isDate()) return iso.slice(0, 10);
+		if (this.isTime()) return iso.slice(11, 23);
+		if (this.#offset === null) return iso.slice(0, -1);
+		if (this.#offset === "Z" || this.#offset === "z") return iso;
+		let offset = +this.#offset.slice(1, 3) * 60 + +this.#offset.slice(4, 6);
+		offset = this.#offset[0] === "-" ? offset : -offset;
+		return (/* @__PURE__ */ new Date(this.getTime() - offset * 6e4)).toISOString().slice(0, -1) + this.#offset;
+	}
+	static wrapAsOffsetDateTime(jsDate, offset = "Z") {
+		let date = new TomlDate(jsDate);
+		date.#offset = offset;
+		return date;
+	}
+	static wrapAsLocalDateTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalDate(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasTime = false;
+		date.#offset = null;
+		return date;
+	}
+	static wrapAsLocalTime(jsDate) {
+		let date = new TomlDate(jsDate);
+		date.#hasDate = false;
+		date.#offset = null;
+		return date;
+	}
+};
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/extract.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function isDigit(char, base = 10) {
+	return base === 16 ? char > 47 && char < 58 || char > 64 && char < 71 || char > 96 && char < 103 : char > 47 && char < 48 + base;
+}
+function isEndOfValue(char, delim) {
+	return char === 32 || char === 9 || char === 10 || char === 13 || delim && (char === delim || char === 44) || char === 35;
+}
+/** @internal */
+function extractValue(ctx, end) {
+	let errPtr = ctx.p;
+	let c = ctx.s.charCodeAt(ctx.p);
+	if (c === 91 || c === 123) {
+		ctx.d-- || TomlError.x("document contains excessively nested structures. aborting.", ctx);
+		let value = c === 91 ? parseArray(ctx) : parseInlineTable(ctx);
+		ctx.d++;
+		return value;
+	}
+	if (c === 34 || c === 39) return parseString(ctx);
+	if (c === 116) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 114 || ctx.s.charCodeAt(++ctx.p) !== 117 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, true;
+	}
+	if (c === 102) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 108 || ctx.s.charCodeAt(++ctx.p) !== 115 || ctx.s.charCodeAt(++ctx.p) !== 101) TomlError.x("invalid value", ctx, errPtr);
+		return ctx.p++, false;
+	}
+	if (c === 43 || c === 45) return parseNumber(ctx, ctx.p, ctx.s.charCodeAt(++ctx.p), 44 - c, end);
+	if (ctx.s.charCodeAt(ctx.p + 4) === 45 && ctx.s.charCodeAt(ctx.p + 7) === 45) return parseDate(ctx, c, end);
+	if (ctx.s.charCodeAt(ctx.p + 2) === 58) return parseTime(ctx, c, end);
+	return parseNumber(ctx, ctx.p, c, 0, end);
+}
+function parseNumber(ctx, startPtr, startChr, sign, endChr) {
+	let c = startChr;
+	let state = 0;
+	let hasUnderscores = false;
+	if (c === 105) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 110 || ctx.s.charCodeAt(++ctx.p) !== 102) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, (sign || 1) / 0;
+	}
+	if (c === 110) {
+		if (ctx.s.charCodeAt(++ctx.p) !== 97 || ctx.s.charCodeAt(++ctx.p) !== 110) TomlError.x("invalid value", ctx, startPtr);
+		return ctx.p++, NaN;
+	}
+	if (c === 48) {
+		if (++ctx.p >= ctx.s.length || isEndOfValue(c = ctx.s.charCodeAt(ctx.p), endChr)) return ctx.bi === true ? 0n : 0;
+		if (!sign) {
+			if (c === 120) return parseIntegerBaseN(ctx, startPtr, 16, endChr);
+			else if (c === 98) return parseIntegerBaseN(ctx, startPtr, 2, endChr);
+			else if (c === 111) return parseIntegerBaseN(ctx, startPtr, 8, endChr);
+		}
+		if (c === 46) state = 2;
+		else if (c === 101 || c === 69) state = 4;
+		else TomlError.x("illegal leading zero", ctx, startPtr);
+	} else if (!isDigit(c)) TomlError.x("invalid value", ctx, startPtr);
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) {
+		if (!state) state = 1;
+		if (c === 95) {
+			if (!(state & 1)) TomlError.x("illegal underscore", ctx);
+			state += 11;
+			hasUnderscores = true;
+		} else if (state === 1 && c === 46) state = 2;
+		else if ((state === 1 || state === 3) && (c === 101 || c === 69)) state = 4;
+		else if (state === 4 && (c === 43 || c === 45)) state = 6;
+		else if (!isDigit(c)) TomlError.x(`illegal character in numeric literal`, ctx);
+		else if (state > 9) state -= 11;
+		else if (!(state & 1)) state++;
+	}
+	if (!state) {
+		let val = (startChr - 48) * (sign || 1);
+		return ctx.bi === true ? BigInt(val) : val;
+	}
+	if (!(state & 1)) TomlError.x("unfinished numeric value", ctx, startPtr);
+	let str = ctx.s.slice(startPtr, ctx.p);
+	if (hasUnderscores) str = str.replaceAll("_", "");
+	return state > 1 ? parseFloat(str) : parseInteger(ctx, str, 10, startPtr);
+}
+function parseIntegerBaseN(ctx, startPtr, base, endChr) {
+	let c, underscore = 1;
+	while (++ctx.p < ctx.s.length && (c = ctx.s.charCodeAt(ctx.p), !isEndOfValue(c, endChr))) if (c === 95) {
+		if (underscore & 1) TomlError.x("illegal underscore", ctx);
+		underscore = 3;
+	} else if (!isDigit(c, base)) TomlError.x(`illegal character in numeric literal`, ctx);
+	else if (underscore & 1) underscore--;
+	if (underscore & 1) TomlError.x("unfinished numeric value", ctx);
+	let str = ctx.s.slice(startPtr + 2, ctx.p);
+	if (underscore) str = str.replaceAll("_", "");
+	return parseInteger(ctx, str, base, startPtr);
+}
+function parseInteger(ctx, str, base, startPtr) {
+	if (ctx.bi !== true) int: {
+		let val = parseInt(str, base);
+		if (!Number.isSafeInteger(val)) {
+			if (ctx.bi) break int;
+			TomlError.x("integer value cannot be represented losslessly", ctx, startPtr);
+		}
+		return val;
+	}
+	return base === 10 ? BigInt(str) : BigInt((base === 2 ? "0b" : base === 8 ? "0o" : "0x") + str);
+}
+function parseDate(ctx, c, endChr) {
+	let startPtr = ctx.p++, unsafeSeparator;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++)) || !isDigit(ctx.s.charCodeAt(ctx.p++))) return parseNumber(ctx, ctx.p = startPtr, c, 0, endChr);
+	ctx.p += 5;
+	if (!isDigit(ctx.s.charCodeAt(ctx.p++))) TomlError.x("invalid date-time: date part is malformed", ctx, startPtr);
+	if (ctx.p >= ctx.s.length || ((c = ctx.s.charCodeAt(ctx.p)) !== 32 || (unsafeSeparator = true, !isDigit(ctx.s.charCodeAt(ctx.p + 1)))) && c !== 84 && c !== 116) return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 3, false, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) !== 58) TomlError.x("invalid date-time: time part is malformed", ctx, startPtr);
+	if (ctx.s.charCodeAt(ctx.p += 3) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	if (c = ctx.s.charCodeAt(ctx.p)) {
+		if (c === 90 || c === 122) return readDate(ctx, ctx.s.slice(startPtr, ++ctx.p), 1, unsafeSeparator, startPtr, "[+00:00]");
+		if (c === 43 || c === 45) return readDate(ctx, ctx.s.slice(startPtr, ctx.p += 6), 1, unsafeSeparator, startPtr, !ctx.ld && "[" + ctx.s.slice(ctx.p - 6, ctx.p) + "]");
+	}
+	return readDate(ctx, ctx.s.slice(startPtr, ctx.p), 2, unsafeSeparator, startPtr);
+}
+function parseTime(ctx, c, endChr) {
+	let start = ctx.p;
+	if (!isDigit(c) || !isDigit(ctx.s.charCodeAt(++ctx.p))) return parseNumber(ctx, --ctx.p, c, 0, endChr);
+	if (ctx.s.charCodeAt(ctx.p += 4) === 58) ctx.p += 3;
+	if (ctx.s.charCodeAt(ctx.p) === 46) while (isDigit(ctx.s.charCodeAt(++ctx.p)));
+	return readDate(ctx, ctx.s.slice(start, ctx.p), 4, false, start);
+}
+function readDate(ctx, str, type, unsafeDelim, errPtr, temporalSuffix) {
+	if (ctx.ld) {
+		let date = new TomlDate(str, type, unsafeDelim);
+		if (!date.isValid()) TomlError.x("invalid date", ctx, errPtr);
+		return date;
+	}
+	try {
+		if (temporalSuffix) str += temporalSuffix;
+		switch (type) {
+			case 1: return Temporal.ZonedDateTime.from(str);
+			case 2: return Temporal.PlainDateTime.from(str);
+			case 3: return Temporal.PlainDate.from(str);
+			case 4: return Temporal.PlainTime.from(str);
+		}
+	} catch (e) {
+		TomlError.x(e instanceof Error ? e.message : "" + e, ctx, errPtr);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/util.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function skipComment(ctx) {
+	for (; ctx.p < ctx.s.length; ctx.p++) {
+		let c = ctx.s.charCodeAt(ctx.p);
+		if (c === 10) break;
+		if (c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10) {
+			ctx.p++;
+			break;
+		}
+		if (c < 32 && c !== 9 || c === 127) TomlError.x("control characters are not allowed in comments", ctx);
+	}
+}
+/** @internal */
+function skipVoid(ctx, banNewLines, banComments) {
+	let c;
+	while (ctx.p < ctx.s.length) {
+		while (ctx.p < ctx.s.length && ((c = ctx.s.charCodeAt(ctx.p)) === 32 || c === 9 || !banNewLines && (c === 10 || c === 13 && ctx.s.charCodeAt(ctx.p + 1) === 10))) ctx.p++;
+		if (banComments || c !== 35) break;
+		skipComment(ctx);
+	}
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/struct.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+/** @internal */
+function parseKey(ctx, end = 61) {
+	let startPtr;
+	let state = 0;
+	let parsed = [];
+	let sliceStart;
+	let c = ctx.s.charCodeAt(startPtr = ctx.p);
+	do
+		if (c === end) {
+			if (!state) TomlError.x("unexpected end of key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			return ctx.p++, parsed;
+		} else if (c === 46) {
+			if (!state) TomlError.x("illegal empty bare key", ctx);
+			if (state === 1) parsed.push(ctx.s.slice(sliceStart, ctx.p));
+			state = 0;
+		} else if (!state && (c === 34 || c === 39)) {
+			if (c === ctx.s.charCodeAt(ctx.p + 1) && c === ctx.s.charCodeAt(ctx.p + 2)) TomlError.x("illegal quoted key: multiline strings are not allowed", ctx);
+			parsed.push(parseString(ctx));
+			state = 2;
+			ctx.p--;
+		} else if (c === 32 || c === 9) {
+			if (state === 1) {
+				parsed.push(ctx.s.slice(sliceStart, ctx.p));
+				state = 2;
+			}
+		} else if (state === 2 || c < 48 && c !== 45 || c > 57 && c < 65 || c > 90 && c < 97 && c !== 95 || c > 122) TomlError.x("illegal character in key", ctx);
+		else if (!state) {
+			state = 1;
+			sliceStart = ctx.p;
+		}
+	while (c = ctx.s.charCodeAt(++ctx.p));
+	TomlError.x("incomplete key-value: cannot find end of key", ctx, startPtr);
+}
+/** @internal */
+function parseInlineTable(ctx) {
+	let startPtr = ctx.p++;
+	let res = Object.create(null);
+	let seen = /* @__PURE__ */ new Set();
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 125) {
+			ctx.p++;
+			return res;
+		}
+		let k;
+		let t = res;
+		let hasOwn = false;
+		let errPtr = ctx.p;
+		let key = parseKey(ctx);
+		for (let i = 0; i < key.length; i++) {
+			if (i) t = hasOwn ? t[k] : t[k] = Object.create(null);
+			k = key[i];
+			if ((hasOwn = Object.hasOwn(t, k)) && (typeof t[k] !== "object" || seen.has(t[k]))) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) {
+				t = ctx.uk !== 1 && TomlError.x("document contains an unsafe property", ctx, errPtr);
+				break;
+			}
+			if (!hasOwn && unsafe) Object.defineProperty(t, k, {
+				enumerable: true,
+				configurable: true,
+				writable: true
+			});
+		}
+		if (hasOwn) TomlError.x("trying to redefine an already defined value", ctx, errPtr);
+		skipVoid(ctx, true, true);
+		let value = extractValue(ctx, 125);
+		if (t && typeof (t[k] = value) === "object") seen.add(value);
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 125) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished table", ctx, startPtr);
+}
+/** @internal */
+function parseArray(ctx) {
+	let startPtr = ctx.p++;
+	let res = [];
+	let c;
+	while (ctx.p < ctx.s.length) {
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p)) === 93) {
+			ctx.p++;
+			return res;
+		}
+		res.push(extractValue(ctx, 93));
+		skipVoid(ctx);
+		if ((c = ctx.s.charCodeAt(ctx.p++)) === 93) return res;
+		if (c !== 44) TomlError.x("expected comma or end of structure", ctx, ctx.p - 1);
+	}
+	TomlError.x("unfinished array", ctx, startPtr);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/parse.js
+/*!
+* Copyright (c) Squirrel Chat et al., All rights reserved.
+* SPDX-License-Identifier: BSD-3-Clause
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are met:
+*
+* 1. Redistributions of source code must retain the above copyright notice, this
+*    list of conditions and the following disclaimer.
+* 2. Redistributions in binary form must reproduce the above copyright notice,
+*    this list of conditions and the following disclaimer in the
+*    documentation and/or other materials provided with the distribution.
+* 3. Neither the name of the copyright holder nor the names of its contributors
+*    may be used to endorse or promote products derived from this software without
+*    specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+function peekTable(ctx, key, table, meta, type) {
+	let t = table;
+	let m = meta;
+	let k;
+	let hasOwn = false;
+	let state;
+	for (let i = 0; i < key.length; i++) {
+		if (i) {
+			t = hasOwn ? t[k] : t[k] = Object.create(null);
+			m = (state = m[k]).c;
+			if (type === 0 && (state.t === 1 || state.t === 2)) return null;
+			if (state.t === 2) {
+				let l = t.length - 1;
+				t = t[l];
+				m = m[l].c;
+			}
+		}
+		k = key[i];
+		if ((hasOwn = Object.hasOwn(t, k)) && m[k]?.t === 0 && m[k]?.d) return null;
+		if (!hasOwn) {
+			let unsafe = k === "__proto__";
+			if (ctx.uk && (unsafe || k === "constructor")) return false;
+			if (unsafe) {
+				Object.defineProperty(t, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+				Object.defineProperty(m, k, {
+					enumerable: true,
+					configurable: true,
+					writable: true
+				});
+			}
+			m[k] = {
+				t: i < key.length - 1 && type === 2 ? 3 : type,
+				d: false,
+				i: 0,
+				c: Object.create(null)
+			};
+		}
+	}
+	state = m[k];
+	if (state.t !== type && !(type === 1 && state.t === 3)) return null;
+	if (type === 2) {
+		if (!state.d) {
+			state.d = true;
+			t[k] = [];
+		}
+		t[k].push(t = Object.create(null));
+		state.c[state.i++] = state = {
+			t: 1,
+			d: false,
+			i: 0,
+			c: Object.create(null)
+		};
+	}
+	if (state.d) return null;
+	state.d = true;
+	if (type === 1) t = hasOwn ? t[k] : t[k] = Object.create(null);
+	else if (type === 0 && hasOwn) return null;
+	return [
+		k,
+		t,
+		state.c
+	];
+}
+function validateTablePeek(ctx, peek, ptr) {
+	if (peek === null || ctx.uk === 2) TomlError.x(peek === null ? "trying to redefine an already defined table or value" : "document contains an unsafe property", ctx, ptr);
+}
+function parse(toml, options = {}) {
+	let ctx = {
+		s: toml,
+		p: 0,
+		d: options.maxDepth ?? 1e3,
+		bi: options.integersAsBigInt ?? false,
+		ld: options.useLegacyDate ?? true,
+		uk: options.unsafeKeyBehaviour === "throw" ? 2 : options.unsafeKeyBehaviour === "drop" ? 1 : 0
+	};
+	let res = Object.create(null);
+	let meta = Object.create(null);
+	let tmp;
+	let skipping = false;
+	let tbl = res;
+	let m = meta;
+	if (toml.charCodeAt(0) === 65279) ctx.p++;
+	skipVoid(ctx);
+	while (ctx.p < toml.length) {
+		if (toml.charCodeAt(ctx.p) === 91) {
+			let isTableArray = toml.charCodeAt(++ctx.p) === 91;
+			tmp = ctx.p += +isTableArray;
+			skipping = false;
+			let k = parseKey(ctx, 93);
+			if (isTableArray) {
+				if (toml.charCodeAt(ctx.p) !== 93) TomlError.x("expected end of table array declaration", ctx);
+				ctx.p++;
+			}
+			let p = peekTable(ctx, k, res, meta, isTableArray ? 2 : 1);
+			if (!p) {
+				validateTablePeek(ctx, p, tmp);
+				skipping = true;
+			} else {
+				m = p[2];
+				tbl = p[1];
+			}
+		} else {
+			tmp = ctx.p;
+			let p = peekTable(ctx, parseKey(ctx), tbl, m, 0);
+			if (!p && !skipping) validateTablePeek(ctx, p, tmp);
+			skipVoid(ctx, true, true);
+			let v = extractValue(ctx, void 0);
+			if (p && !skipping) p[1][p[0]] = v;
+		}
+		skipVoid(ctx, true);
+		if (ctx.p < toml.length && (tmp = toml.charCodeAt(ctx.p)) !== 10 && (tmp !== 13 || toml.charCodeAt(ctx.p + 1) !== 10)) TomlError.x("each key-value declaration must be followed by an end-of-line", ctx);
+		skipVoid(ctx);
+	}
+	return res;
+}
+//#endregion
+//#region src/cli/rls/rbac.ts
+/**
+* Where the helpers read roles and memberships: the flag, `rls.authorize`,
+* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
+* `--rbac` or with a mapped memberships table, else `jwt`.
+*/
+function resolveAuthorize(config, flags = {}) {
+	const rls = config.rls;
+	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
+	if (explicit !== void 0) return explicit;
+	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
+	const memberships = flags.memberships ?? rls?.memberships;
+	return Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+}
+function parseRbacAuthorize(raw) {
+	if (raw === void 0) return;
+	if (raw === "database" || raw === "jwt") return raw;
+	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
+}
+function hookUri(schema) {
+	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
+}
+function createEnum(schema, name, values) {
+	const list = values.map((value) => quoteLiteral(value)).join(", ");
+	return `do $$ begin
+  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
+exception when duplicate_object then null;
+end $$;`;
+}
+/**
+* A read policy and `select` grant for `supabase_auth_admin` on a table the
+* hook reads.
+*/
+function authAdminRead(table, label) {
+	const t = quoteQualified(table);
+	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
+	return `grant select on table ${t} to supabase_auth_admin;
+drop policy if exists ${policy} on ${t};
+create policy ${policy} on ${t}
+  as permissive for select
+  to supabase_auth_admin
+  using (true);`;
+}
+/**
+* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`. The
+* token hook comes only from `permdock supabase hook generate`, so one function
+* writes the claims. Policies never call `authorize()` per row; they call the
+* helpers. Never grants anything to `service_role`.
+*/
+function rbacScaffold(policy, options) {
+	const schema = options.schema;
+	const q = (name) => quoteTable(`${schema}.${name}`);
+	const s = quoteIdent(schema);
+	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
+	const authorizeFn = authorizeSql({
+		schema,
+		authorize: options.authorize,
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		...options.memberships === void 0 ? {} : { tenant: options.memberships },
+		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
+		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
+	});
+	return {
+		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
+-- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
+-- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
+${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
+${createEnum(schema, "app_permission", permissions)}
+
+create table if not exists ${q("user_roles")} (
+  user_id uuid not null references auth.users on delete cascade,
+  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
+  primary key (user_id, role)
+);
+
+alter table ${q("user_roles")} enable row level security;
+revoke all on table ${q("user_roles")} from authenticated, anon, public;
+`,
+		tail: authorizeFn,
+		warnings: []
+	};
+}
+//#endregion
 //#region src/cli/supabase-config.ts
 const SUPABASE_CONFIG = "supabase/config.toml";
 function table(value) {
@@ -50,6 +923,9 @@ function readSupabaseConfig(cwd) {
 	const paths = table(table(root["db"])?.["migrations"])?.["schema_paths"];
 	const schemaPaths = strings(paths);
 	const apiSchemas = strings(table(root["api"])?.["schemas"]);
+	const hookTable = table(table(table(root["auth"])?.["hook"])?.["custom_access_token"]);
+	const hookEnabled = hookTable?.["enabled"];
+	const hookUriValue = hookTable?.["uri"];
 	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
 	const schemaPath = pgDelta?.["declarative_schema_path"];
 	const enabled = pgDelta?.["enabled"];
@@ -59,6 +935,10 @@ function readSupabaseConfig(cwd) {
 			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
 			...schemaPaths === void 0 ? {} : { schemaPaths },
 			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...hookTable === void 0 ? {} : { customAccessTokenHook: {
+				...typeof hookEnabled === "boolean" ? { enabled: hookEnabled } : {},
+				...typeof hookUriValue === "string" ? { uri: hookUriValue } : {}
+			} },
 			...pgDelta === void 0 ? {} : { pgDelta: {
 				...typeof enabled === "boolean" ? { enabled } : {},
 				schemaDir: declarativeSchemaDir(schemaPath)
@@ -66,16 +946,25 @@ function readSupabaseConfig(cwd) {
 		}
 	};
 }
-/** `supabase/` joined with `declarative_schema_path`, which defaults to `schemas`. */
+/**
+* `supabase/` joined with `declarative_schema_path`, which defaults to
+* `schemas`.
+*/
 function declarativeSchemaDir(schemaPath) {
 	return posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "");
 }
-/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+/**
+* The parsed config, or `{}` when it is missing or does not parse (PD045
+* reports that).
+*/
 function supabaseConfig(cwd) {
 	const read = readSupabaseConfig(cwd);
 	return read?.ok === true ? read.config : {};
 }
-/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+/**
+* PD045: a `supabase/config.toml` the CLI cannot parse, so every check that
+* reads it falls back to defaults.
+*/
 function pd045(cwd) {
 	const read = readSupabaseConfig(cwd);
 	if (read === void 0 || read.ok) return [];
@@ -86,6 +975,32 @@ function pd045(cwd) {
 		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then PermDock assumes Supabase's defaults for jwt_expiry, schema_paths and [experimental.pgdelta], and generates for pg-delta`
 	}];
 }
+/**
+* PD074: `supabase.hook` is configured but `[auth.hook.custom_access_token]` in
+* `supabase/config.toml` does not enable the generated function, so a local
+* stack and every branch push issue tokens without memberships.
+*/
+function pd074(cwd, config) {
+	const hook = config.supabase?.hook;
+	const read = readSupabaseConfig(cwd);
+	if (hook === void 0 || read === void 0 || !read.ok) return [];
+	const expected = hookUri(hook.schema ?? config.rls?.schema ?? "permdock");
+	const found = read.config.customAccessTokenHook;
+	const fix = `add to ${SUPABASE_CONFIG}:\n[auth.hook.custom_access_token]\nenabled = true\nuri = "${expected}"`;
+	if (found?.enabled !== true) return [{
+		code: "PD074",
+		severity: "warning",
+		message: `supabase.hook is configured but ${SUPABASE_CONFIG} does not set [auth.hook.custom_access_token] enabled = true, so Auth never calls the hook`,
+		fix
+	}];
+	if (found.uri !== expected) return [{
+		code: "PD074",
+		severity: "warning",
+		message: `[auth.hook.custom_access_token] uri is ${found.uri ?? "missing"}, but the generated hook is ${expected}`,
+		fix: `set uri = "${expected}" in ${SUPABASE_CONFIG}`
+	}];
+	return [];
+}
 //#endregion
 //#region src/cli/claims-schema.ts
 /**
@@ -123,6 +1038,11 @@ const PERMDOCK_CLAIMS_SCHEMA = {
 					description: "true when the size budget cut memberships or attrs.",
 					type: "boolean"
 				},
+				team_ids: {
+					description: "The uuid of every team the user belongs to (supabase.hook.teams), cut by the memberships budget.",
+					type: "array",
+					items: { type: "string" }
+				},
 				tenant_id: {
 					description: "The active tenant (the default rls.tenantClaim): the canonical text of one instance of the first scope.",
 					type: "string"
@@ -221,8 +1141,8 @@ const USER_EDITABLE = /^(raw_)?user_meta(_)?data$/iu;
 /**
 * Splits `supabase.hook.attrs` into table columns and `app_metadata` keys and
 * lists what cannot be compiled: `user_metadata` (the user can edit it), a
-* direct `auth.users` column, an unsafe or prototype key, a duplicate key,
-* or a table column without a table.
+* direct `auth.users` column, an unsafe or prototype key, a duplicate key, or a
+* table column without a table.
 */
 function attrsPlan(attrs) {
 	const errors = [];
@@ -268,6 +1188,7 @@ const RESERVED_CLAIMS = /* @__PURE__ */ new Set([
 	"user_role",
 	"memberships",
 	"memberships_truncated",
+	"team_ids",
 	"attrs",
 	"authz_ver",
 	"sub",
@@ -336,8 +1257,8 @@ function beforeSql(before) {
 }
 /**
 * `hook.validate`: the claims the hook writes, dropped together when they do
-* not match `supabase-claims-v1.json`, so a bad claim denies instead of
-* failing sign-in. `hook.claims` entries belong to other packages and stay.
+* not match `supabase-claims-v1.json`, so a bad claim denies instead of failing
+* sign-in. `hook.claims` entries belong to other packages and stay.
 */
 function validateSql(parts) {
 	if (parts.hook.validate !== true) return "";
@@ -346,6 +1267,7 @@ function validateSql(parts) {
 		"roles",
 		"memberships",
 		"memberships_truncated",
+		...parts.hook.teams === void 0 ? [] : ["team_ids"],
 		"attrs",
 		"authz_ver",
 		parts.tenantClaim
@@ -362,8 +1284,8 @@ grant usage on schema extensions to supabase_auth_admin;
 grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
 }
 /**
-* Fails the migration when a client role can write an `attrs` column: a
-* claim the user can set is not a server-owned attribute.
+* Fails the migration when a client role can write an `attrs` column: a claim
+* the user can set is not a server-owned attribute.
 */
 function attrsGuardSql(plan) {
 	if (plan?.table === void 0 || plan.columns.length === 0) return "";
@@ -398,6 +1320,7 @@ function hookClaims(parts) {
 		permdockClaim("memberships", true),
 		permdockClaim("memberships_truncated"),
 		permdockClaim(parts.tenantClaim),
+		...parts.hook.teams === void 0 ? [] : [permdockClaim("team_ids", true)],
 		...parts.attrs === void 0 ? [] : [permdockClaim("attrs", true)],
 		...parts.version ? [permdockClaim("authz_ver")] : [],
 		...parts.extra.map((entry) => ({
@@ -408,6 +1331,19 @@ function hookClaims(parts) {
 	];
 }
 //#endregion
+//#region src/cli/sql/declarative.ts
+/**
+* A migration's SQL as a declarative schema file: pg-delta diffs the file
+* against the database itself, so a `drop trigger if exists` or `drop policy if
+* exists` before its `create` is an error, and a trigger is `create or replace
+* trigger`. A constraint trigger stays `create constraint trigger`, because
+* pg-delta has no `create or replace constraint trigger`. A policy keeps its
+* plain `create policy`.
+*/
+function declarativeSql(sql) {
+	return sql.replaceAll(/^drop (?:trigger|policy) if exists [^;\n]+;\n/gmu, "").replaceAll(/^create trigger /gmu, "create or replace trigger ");
+}
+//#endregion
 //#region src/cli/supabase-schemas.ts
 const MODES = [
 	"pg-delta",
@@ -422,9 +1358,9 @@ function schemasRefusal(command, value) {
 	return value === void 0 || isSupabaseSchemas(value) ? void 0 : `${command} --schemas must be ${MODES.join(", ")} (got ${value})`;
 }
 /**
-* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml`
-* sets `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default
-* of new Supabase projects and of the next Supabase CLI major.
+* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml` sets
+* `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default of new
+* Supabase projects and of the next Supabase CLI major.
 */
 function resolveSchemas(cwd, config, flag) {
 	const toml = supabaseConfig(cwd).pgDelta;
@@ -445,7 +1381,10 @@ const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z]
 function escape(text) {
 	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
 }
-/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+/**
+* The helper functions `sql` creates in `schema`; unqualified names count for
+* `public`.
+*/
 function helpersDefined(sql, schema) {
 	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
 	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
@@ -457,9 +1396,9 @@ function helpersDefined(sql, schema) {
 	return names;
 }
 /**
-* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
-* its `helpers` part when it has `{part}`), the SQL files next to the hook,
-* and the migration folders, not the hook itself.
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`; its
+* `helpers` part when it has `{part}`), the SQL files next to the hook, and the
+* migration folders, not the hook itself.
 */
 function helperSources(cwd, config, hookOut) {
 	const hook = resolve(cwd, hookOut);
@@ -492,7 +1431,10 @@ where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema,
 function missingHelpersMessage(manifest, missing) {
 	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
 }
-/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+/**
+* Bytes of JSON of each extra claim in the largest sample, for claims that pass
+* the budget.
+*/
 function oversizedClaims(samples, manifest) {
 	const encoder = new TextEncoder();
 	const oversized = [];
@@ -576,87 +1518,6 @@ function readClaimsFixture(path) {
 	}
 }
 //#endregion
-//#region src/cli/rls/rbac.ts
-/**
-* Where the helpers read roles and memberships: the flag, `rls.authorize`,
-* `rls.rbac.authorize`, then `database` with `rls.membershipSources`, with
-* `--rbac` or with a mapped memberships table, else `jwt`.
-*/
-function resolveAuthorize(config, flags = {}) {
-	const rls = config.rls;
-	const explicit = flags.authorize ?? rls?.authorize ?? rls?.rbac?.authorize;
-	if (explicit !== void 0) return explicit;
-	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
-	const memberships = flags.memberships ?? rls?.memberships;
-	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
-}
-function parseRbacAuthorize(raw) {
-	if (raw === void 0) return;
-	if (raw === "database" || raw === "jwt") return raw;
-	throw configError(`PermDock CLI: --authorize must be database or jwt, got '${raw}'`);
-}
-function hookUri(schema) {
-	return `pg-functions://postgres/${schema}/custom_access_token_hook`;
-}
-function createEnum(schema, name, values) {
-	const list = values.map((value) => quoteLiteral(value)).join(", ");
-	return `do $$ begin
-  create type ${quoteTable(`${schema}.${name}`)} as enum (${list});
-exception when duplicate_object then null;
-end $$;`;
-}
-/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
-function authAdminRead(table, label) {
-	const t = quoteQualified(table);
-	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
-	return `grant select on table ${t} to supabase_auth_admin;
-drop policy if exists ${policy} on ${t};
-create policy ${policy} on ${t}
-  as permissive for select
-  to supabase_auth_admin
-  using (true);`;
-}
-/**
-* Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
-* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
-* The token hook comes only from `permdock supabase hook generate`, so one
-* function writes the claims. Policies never call `authorize()` per row; they
-* call the helpers. Never grants anything to `service_role`.
-*/
-function rbacScaffold(policy, options) {
-	const schema = options.schema;
-	const q = (name) => quoteTable(`${schema}.${name}`);
-	const s = quoteIdent(schema);
-	const permissions = [...new Set(policy.grants.map((grant) => grant.permission.key))];
-	const authorizeFn = authorizeSql({
-		schema,
-		authorize: options.authorize,
-		...options.scope === void 0 ? {} : { scope: options.scope },
-		...options.memberships === void 0 ? {} : { tenant: options.memberships },
-		...options.customRoles === void 0 ? {} : { customRoles: options.customRoles },
-		...options.context?.suspension === void 0 ? {} : { suspension: options.context.suspension }
-	});
-	return {
-		head: `-- rbac scaffold (Supabase Custom Claims and RBAC)
--- authorize: ${options.authorize}${options.authorize === "jwt" ? " (reads the hook claims; stale until the token refreshes)" : " (reads user_roles on every statement)"}
--- the custom access token hook that writes user_role${options.authorize === "jwt" ? " and memberships" : ""}: permdock supabase hook generate
-${schema === "public" ? "" : `create schema if not exists ${s};\n`}${createEnum(schema, "app_role", roleNames(policy))}
-${createEnum(schema, "app_permission", permissions)}
-
-create table if not exists ${q("user_roles")} (
-  user_id uuid not null references auth.users on delete cascade,
-  role ${options.customRoles === void 0 ? q("app_role") : "text"} not null,
-  primary key (user_id, role)
-);
-
-alter table ${q("user_roles")} enable row level security;
-revoke all on table ${q("user_roles")} from authenticated, anon, public;
-`,
-		tail: authorizeFn,
-		warnings: []
-	};
-}
-//#endregion
 //#region src/cli/supabase-hook/memberships.ts
 function memberForPlan(input) {
 	const memberFor = input.scopes.map((scope) => scope.name).filter((name) => hasMemberFor({
@@ -676,7 +1537,10 @@ function memberForPlan(input) {
 		memberships: [...entries.values()]
 	};
 }
-/** An `rls.memberships` table in the manifest's `tableMembershipSource` / `junctionMembershipSource` shape, for scope `name`. */
+/**
+* An `rls.memberships` table in the manifest's `tableMembershipSource` /
+* `junctionMembershipSource` shape, for scope `name`.
+*/
 function mappedMembership(mapped, scopes, name) {
 	const id = scopeColumn(mapped, scopes, name) ?? "";
 	const within = {};
@@ -781,18 +1645,18 @@ ${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
 //#region src/cli/supabase-hook/api.ts
 const SUBJECT_FOR = "subject_for";
 /**
-* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
-* token for `p_user`, from the same membership, role, suspension and version
-* reads, plus the custom roles the user holds when `database` mode keeps them
-* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
-* subject for an acting user or a job from it. Naming the user is why no
-* client role may execute it.
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a token
+* for `p_user`, from the same membership, role, suspension and version reads,
+* plus the custom roles the user holds when `database` mode keeps them in
+* tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no client
+* role may execute it.
 */
 function subjectForSql(parts, config) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.${SUBJECT_FOR}`;
 	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}) filter (where ${rows.roleSql} is not null), '[]'::jsonb)
     into held
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
@@ -803,6 +1667,20 @@ function subjectForSql(parts, config) {
 	const version = parts.version ? `
   select v.version into ver from ${schema}.${quoteIdent(AUTHZ_VERSION_TABLE)} v where v.user_id = uid;
   ver := coalesce(ver, 0);` : "";
+	const teamsConfig = parts.hook.teams;
+	const teams = teamsConfig === void 0 ? "" : `
+  select coalesce(jsonb_agg(to_jsonb(t.${quoteIdent(teamsConfig.team)}::text) order by t.${quoteIdent(teamsConfig.team)}), '[]'::jsonb)
+    into team_ids
+    from ${quoteQualified(teamsConfig.table)} t
+    where t.${quoteIdent(teamsConfig.user)} = uid;
+  if team_ids <> '[]'::jsonb then
+    claims := jsonb_set(claims, '{team_ids}', team_ids);
+  end if;`;
+	const extra = parts.extra.map((entry) => `
+  extra := ${quoteTable(entry.fn)}(uid);
+  if extra is not null then
+    claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
+  end if;`).join("");
 	const custom = customRolesOn(config.rls) && resolveAuthorize(config) === "database" ? customRolesOfSql(parts) : "";
 	return `-- the subject the hook would mint for p_user, for a backend acting for a stored user; no client role may execute it
 create or replace function ${fn}(p_user uuid)
@@ -817,7 +1695,8 @@ declare
   held jsonb;
   memberships jsonb;
   custom jsonb := '[]'::jsonb;
-  ver bigint;${typedUsers(parts)}
+  ver bigint;
+  claims jsonb := '{}'::jsonb;${teamsConfig === void 0 ? "" : "\n  team_ids jsonb := '[]'::jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${typedUsers(parts)}
 begin
   if uid is null or not exists (select 1 from auth.users u where u.id = uid) then
     return null;
@@ -827,8 +1706,9 @@ ${roles}
     into memberships
     from (
 ${entriesSql(parts).replaceAll(/^/gmu, "      ")}
-    ) x;${custom}${version}
+    ) x;${custom}${version}${teams}${extra}
   return jsonb_strip_nulls(jsonb_build_object(
+    'claims', case when claims = '{}'::jsonb then null else claims end,
     'id', uid::text,
     'active', true,
     'roles', held,
@@ -841,8 +1721,11 @@ $$;
 revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
 }
 /**
-* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
+* The PostgREST wrappers `supabase.hook.api` asks for: one `security invoker`
 * function per reader, in the API schema, executable by `service_role` only.
+* The `security definer` readers stay in the hook schema, which the Data API
+* does not expose; `service_role` gets `usage` on it and `execute` on each
+* reader, so no definer function sits in an exposed schema.
 */
 function apiWrappersSql(parts) {
 	const api = parts.hook.api;
@@ -857,13 +1740,16 @@ function apiWrappersSql(parts) {
 returns ${returns}
 language sql
 stable
-security definer
+security invoker
 set search_path = ''
 as $$ select ${source}.${inner}(${args}) $$;
 revoke execute on function ${fn}(${types}) from public, anon, authenticated;
-grant execute on function ${fn}(${types}) to service_role;`;
+grant execute on function ${fn}(${types}) to service_role;
+grant execute on function ${source}.${inner}(${types}) to service_role;`;
 	};
-	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
+	return `-- supabase.hook.api: security invoker wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them, and the security definer readers stay in ${source}
+grant usage on schema ${source} to service_role;
+
 ${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
 
 ${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
@@ -936,9 +1822,9 @@ revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
 }
 /**
 * The custom roles `p_user` holds: tenant and shared roles named on a
-* membership of the scope (and instance) they live at, and platform roles
-* among the global roles, each with its grants and includes in `CustomRole`
-* form. A shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
+* membership of the scope (and instance) they live at, and platform roles among
+* the global roles, each with its grants and includes in `CustomRole` form. A
+* shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
 */
 function customRolesOfSql(parts) {
 	const helpers = quoteIdent(parts.helpers.schema);
@@ -989,9 +1875,15 @@ function customRolesOfSql(parts) {
 }
 //#endregion
 //#region src/cli/rls/approvals.ts
-/** `rls.approvals`' approver check; better-supabase's `isApprover` template calls it. */
+/**
+* `rls.approvals`' approver check; better-supabase's `isApprover` template
+* calls it.
+*/
 const IS_APPROVER = "permdock_is_approver";
-/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
+/**
+* The objects `rls.approvals` adds. Names are part of the SQL contract
+* `supabaseApprovalStore` calls.
+*/
 const APPROVAL_STORE = {
 	table: "approval_requests",
 	open: "permdock_approval_open",
@@ -1027,8 +1919,8 @@ function serverOnly(fn, args) {
 const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
 /**
 * `rls.jsonSchema`: a pg_jsonschema check that `body` matches
-* `approval-request-v1.json`, added `not valid` and then validated. `auto`
-* adds it only where the extension is available.
+* `approval-request-v1.json`, added `not valid` and then validated. `auto` adds
+* it only where the extension is available.
 */
 function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
 	const statements = [
@@ -1050,11 +1942,11 @@ end
 $permdock$;\n`;
 }
 /**
-* The approval store (`rls.approvals`): one table of `ApprovalRequest`
-* bodies with the columns a list filters on, and one `security definer`
-* function per `ApprovalStore` method, each one atomic statement. No client
-* role may read the table or execute the functions: approvals are opened and
-* resolved by the server, which grants its own role.
+* The approval store (`rls.approvals`): one table of `ApprovalRequest` bodies
+* with the columns a list filters on, and one `security definer` function per
+* `ApprovalStore` method, each one atomic statement. No client role may read
+* the table or execute the functions: approvals are opened and resolved by the
+* server, which grants its own role.
 */
 function approvalStoreSql(ctx, jsonSchema = false) {
 	const table = qualified(ctx, APPROVAL_STORE.table);
@@ -1211,8 +2103,8 @@ ${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
 /**
 * `permdock_is_approver(p_approvers jsonb, p_tenant text default null)`: true
 * when the signed-in user matches the serialised approvers of a request
-* (`approvers.by`), for policies on the app's own approval views. A list
-* needs every item and `any-of` one of them; `user` compares the user id and
+* (`approvers.by`), for policies on the app's own approval views. A list needs
+* every item and `any-of` one of them; `user` compares the user id and
 * `holder(permission)` reads `permitted_<root>_ids_by_permission` in
 * `p_tenant`, or `permdock_has_permission` without one. Role, relation and
 * other grantee approvers need facts the database does not hold for every
@@ -1309,19 +2201,22 @@ function approvalsSql(ctx, approvals, jsonSchema) {
 	}, jsonSchema);
 	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx) : "");
 }
-/** The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource` reads the table. */
+/**
+* The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
+* reads the table.
+*/
 const DELEGATIONS = {
 	table: "approval_delegations",
 	covers: "permdock_cover_approves"
 };
 /**
-* `rls.approvals.delegations`: one table of out-of-office covers that a
-* user writes for themselves, and a four-argument `permdock_is_approver`
-* that also answers for a delegate inside an active cover. One hop: a cover
-* is checked against the delegator's own approver rights, never the
-* delegator's covers. A delegator who is the requester never counts. A
-* `holder()` approver through a cover needs `rls.mode: "database"`, where
-* the `_for` helpers exist; in `jwt` mode only `user()` approvers pass.
+* `rls.approvals.delegations`: one table of out-of-office covers that a user
+* writes for themselves, and a four-argument `permdock_is_approver` that also
+* answers for a delegate inside an active cover. One hop: a cover is checked
+* against the delegator's own approver rights, never the delegator's covers. A
+* delegator who is the requester never counts. A `holder()` approver through a
+* cover needs `rls.mode: "database"`, where the `_for` helpers exist; in `jwt`
+* mode only `user()` approvers pass.
 */
 function approvalDelegationsSql(ctx) {
 	const table = qualified(ctx, DELEGATIONS.table);
@@ -1475,7 +2370,10 @@ revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
 grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
 `;
 }
-/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
+/**
+* The request fields an adopted table may mirror into its own columns, as SQL
+* over a body.
+*/
 const MIRRORS = {
 	status: (body) => `${body} ->> 'status'`,
 	permission: (body) => `${body} ->> 'permission'`,
@@ -1499,7 +2397,10 @@ function mirrorsOf(adopt) {
 	}
 	return out;
 }
-/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
+/**
+* One row of `table` from `values` (column, SQL), each converted to the
+* column's own type.
+*/
 function populate(table, values) {
 	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
 }
@@ -1507,7 +2408,10 @@ function populate(table, values) {
 function mirrorRow(table, mirror, body) {
 	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
 }
-/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
+/**
+* `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty
+* without mirrors.
+*/
 function mirrorSet(table, mirror, body) {
 	if (mirror.length === 0) return "";
 	const columns = mirror.map(([column]) => quoteIdent(column));
@@ -1515,12 +2419,12 @@ function mirrorSet(table, mirror, body) {
 	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
 }
 /**
-* The approval store over a table the app already has (`rls.approvals:
-* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
-* functions, reading every field from the request body in `body`, keyed by
-* the text column `token`, and copying the fields `mirror` names into the
-* app's own columns, converted to their types, on every write. The table's
-* grants and policies stay the app's.
+* The approval store over a table the app already has (`rls.approvals: { table,
+* token?, body?, mirror? }`): the same `permdock_approval_*` functions, reading
+* every field from the request body in `body`, keyed by the text column
+* `token`, and copying the fields `mirror` names into the app's own columns,
+* converted to their types, on every write. The table's grants and policies
+* stay the app's.
 */
 function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
 	const table = quoteQualified(adopt.table);
@@ -1704,99 +2608,13 @@ ${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
 `;
 }
 //#endregion
-//#region src/cli/rls/permission-holders.ts
-/** `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL contract. */
-function permittedUsersHelper(scope) {
-	return checkName(`permitted_${scope}_users`);
-}
-/** The users with a membership row on the instance `p_id`, or `undefined` when the scope's memberships are not all in tables. */
-function candidatesSql(ctx, scope, user) {
-	const mapped = scopeTable(ctx, scope);
-	if (mapped !== void 0) return {
-		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
-    from ${quoteQualified(mapped.table.table)} m
-    where m.${quoteIdent(mapped.column)} = p_id`,
-		keys: []
-	};
-	const sources = holderSources(ctx, scope);
-	if (sources === void 0 || sources === "not-tables") return;
-	return {
-		sql: sources.map((source, index) => `    select h.user_id::${user}
-    from (
-${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
-    ) h`).join("\n    union\n"),
-		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
-	};
-}
-/** `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a `%type` variable. */
-function functionBody(keys, query) {
-	if (keys.length === 0) return `language sql
-stable
-security definer
-set search_path = ''
-as $$
-${query}
-$$;`;
-	return `language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-${keys.map((key) => `  ${key} := p_id;`).join("\n")}
-begin
-  return query
-${query.replaceAll(/^/gmu, "  ")};
-end
-$$;`;
-}
-/**
-* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
-* mode: the users who hold a permission key on one instance, read from the
-* scope's membership rows and the global-roles table and kept when
-* `permitted_<scope>_ids_by_permission_for` lists the instance or
-* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
-* suspension apply as for the user. It names other users, so no client role
-* may execute it, and a backend role needs its own grant.
-*/
-function permissionHoldersSql(ctx) {
-	if (ctx.authorize !== "database") return "";
-	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const global = globalRoleRows(ctx);
-	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
-	return `${ctx.scopes.map(({ name }) => {
-		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
-		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
-		const fn = qualified(ctx, permittedUsersHelper(name));
-		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
-		const type = scopeTypeOf(ctx, name);
-		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
-create or replace function ${fn}(p_permission text, p_id ${type})
-returns setof ${user}
-${functionBody(candidates.keys, `  select c.user_id
-  from (
-${candidates.sql}
-    union
-    select ${global.userSql}::${user}
-    from ${global.from}
-  ) c(user_id)
-  where c.user_id is not null
-    and (
-      p_id in (select ${ids}(c.user_id, p_permission))
-      or ${hasFor}(c.user_id, p_permission)
-    )
-  order by 1`)}
-revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
-	}).join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/supabase-hook/sql.ts
 const MANAGED_TRIGGER = "permdock_protect_managed";
 function hookSql(parts) {
 	const schema = quoteIdent(parts.schema);
 	const fn = `${schema}.custom_access_token_hook`;
 	const rows = parts.roles;
-	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}), '[]'::jsonb)
+	const roles = rows === void 0 ? `  held := '[]'::jsonb;` : `  select coalesce(jsonb_agg(distinct ${rows.roleSql} order by ${rows.roleSql}) filter (where ${rows.roleSql} is not null), '[]'::jsonb)
     into held
     from ${rows.from}
     where ${rows.userSql} = v_roles_user;`;
@@ -1828,11 +2646,29 @@ function hookSql(parts) {
   if extra is not null then
     claims := jsonb_set(claims, ${quoteLiteral(`{${entry.claim}}`)}, extra);
   end if;`).join("");
+	const dropTeams = parts.hook.teams === void 0 ? "" : " - 'team_ids'";
 	const suspended = parts.users === void 0 ? "" : `
   if not ${activeRowSql(parts.users, "uid")} then
-    claims := claims - 'memberships_truncated' - 'attrs' - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
+    claims := claims - 'memberships_truncated' - 'attrs'${dropTeams} - ${quoteLiteral(parts.tenantClaim)}${dropExtra};
     claims := claims || jsonb_build_object('user_role', '[]'::jsonb, 'roles', '[]'::jsonb, 'memberships', '[]'::jsonb);${version}
     return jsonb_set(event, '{claims}', claims);
+  end if;`;
+	const teamsConfig = parts.hook.teams;
+	const teams = teamsConfig === void 0 ? "" : `
+  for team in
+    select t.${quoteIdent(teamsConfig.team)}::text as id
+    from ${quoteQualified(teamsConfig.table)} t
+    where t.${quoteIdent(teamsConfig.user)} = uid
+    order by ${teamsConfig.tenant === void 0 ? "" : `(t.${quoteIdent(teamsConfig.tenant)}::text is not distinct from active) desc, `}t.${quoteIdent(teamsConfig.team)}
+  loop
+    if octet_length(kept::text) + used + octet_length((team_ids || to_jsonb(team.id))::text) > budget then
+      truncated := true;
+      exit;
+    end if;
+    team_ids := team_ids || jsonb_build_array(team.id);
+  end loop;
+  if team_ids <> '[]'::jsonb then
+    claims := jsonb_set(claims, '{team_ids}', team_ids);
   end if;`;
 	return `${parts.schema === "public" ? "" : `create schema if not exists ${schema};\nrevoke all on schema ${schema} from public;\n\n`}create or replace function ${fn}(event jsonb)
 returns jsonb
@@ -1850,9 +2686,9 @@ declare
   in_active boolean := false;
   budget integer := ${String(parts.budget)};
   used integer := 0;
-  item record;${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
+  item record;${teamsConfig === void 0 ? "" : "\n  team record;\n  team_ids jsonb := '[]'::jsonb;"}${typedUsers(parts)}${plan === void 0 ? "" : "\n  attrs jsonb;"}${parts.extra.length === 0 ? "" : "\n  extra jsonb;"}${parts.version ? "\n  ver bigint;" : ""}${parts.before.length === 0 ? "" : "\n  checked jsonb;"}
 begin${beforeSql(parts.before)}${suspended}
-  claims := claims - 'attrs'${dropExtra};
+  claims := claims - 'attrs'${dropTeams}${dropExtra};
 ${roles}
   claims := jsonb_set(claims, '{roles}', held);
   if jsonb_array_length(held) = 1 then
@@ -1875,7 +2711,7 @@ ${entriesSql(parts).replaceAll(/^/gmu, "      ")}
     kept := kept || jsonb_build_array(item.entry);
     in_active := in_active or (active is not null and item.current);
   end loop;
-  claims := jsonb_set(claims, '{memberships}', kept);
+  claims := jsonb_set(claims, '{memberships}', kept);${teams}
   if truncated then
     claims := jsonb_set(claims, '{memberships_truncated}', 'true'::jsonb);
   else
@@ -1902,11 +2738,11 @@ revoke execute on function ${fn}(jsonb) from authenticated, anon, public;${extra
 	].filter((chunk) => chunk !== "").join("\n");
 }
 function extraGrantsSql(extra) {
-	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(extra.map((entry) => entry.fn.split(".")[0]))].map((name) => `\ngrant usage on schema ${quoteIdent(name ?? "")} to supabase_auth_admin;`), ...extra.map((entry) => `\nrevoke all on function ${quoteTable(entry.fn)}(uuid) from public, anon, authenticated;\ngrant execute on function ${quoteTable(entry.fn)}(uuid) to supabase_auth_admin;`)].join("");
 }
 function beforeGrantsSql(before, extra) {
 	const granted = new Set(extra.map((entry) => entry.fn.split(".")[0]));
-	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
+	return [...[...new Set(before.map((fn) => beforeFirst(fn, ".")))].filter((name) => !granted.has(name)).map((name) => `\ngrant usage on schema ${quoteIdent(name)} to supabase_auth_admin;`), ...before.map((fn) => `\nrevoke all on function ${quoteTable(fn)}(jsonb) from public, anon, authenticated;\ngrant execute on function ${quoteTable(fn)}(jsonb) to supabase_auth_admin;`)].join("");
 }
 /**
 * Execute on each `member_<scope>_ids_for(uuid)` for the `hook.claims`
@@ -1933,6 +2769,7 @@ function readsSql(parts) {
 		reads.set(rolesTable, reads.get(rolesTable) ?? "roles");
 		if (through !== void 0) reads.set(through.table, reads.get(through.table) ?? "role_keys");
 	}
+	if (parts.hook.teams !== void 0) reads.set(parts.hook.teams.table, reads.get(parts.hook.teams.table) ?? "teams");
 	if (parts.attrs?.table !== void 0 && parts.attrs.columns.length > 0) reads.set(parts.attrs.table, reads.get(parts.attrs.table) ?? "attrs");
 	if (parts.users !== void 0) reads.set(parts.users.table, reads.get(parts.users.table) ?? "status_users");
 	return [...[...new Set([...reads.keys()].map((name) => name.includes(".") ? name.split(".")[0] : "public").filter((schema) => schema !== void 0 && schema !== parts.schema && schema !== "auth"))].map((schema) => `grant usage on schema ${quoteIdent(schema)} to supabase_auth_admin;`), ...[...reads].map(([name, label]) => authAdminRead(name, label))].join("\n");
@@ -2010,7 +2847,7 @@ function hookParts(scopes, config, overrides) {
 			...memberForPlan({
 				scopes,
 				...config.rls?.memberships === void 0 ? {} : { memberships: config.rls.memberships },
-				memberSources: config.rls?.membershipSources ?? hook.memberships
+				memberSources: membershipSourcesOf(config)
 			})
 		}
 	};
@@ -2079,10 +2916,10 @@ function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;
 }
 /**
-* Every membership source whose user id lives in another table: a row of
-* the source bumps the users its old and new references hold, and a change
-* of that table's user id (a contact re-linked to another login) bumps the
-* old and the new user.
+* Every membership source whose user id lives in another table: a row of the
+* source bumps the users its old and new references hold, and a change of that
+* table's user id (a contact re-linked to another login) bumps the old and the
+* new user.
 */
 function memberUsersVersionSql(parts, bumpFor) {
 	const holders = /* @__PURE__ */ new Map();
@@ -2194,7 +3031,10 @@ $$;
 revoke execute on function ${linkedBump}() from public, anon, authenticated;
 ${userTriggers}`;
 }
-/** Every table whose role column references a roles table: the global roles and the membership sources. */
+/**
+* Every table whose role column references a roles table: the global roles and
+* the membership sources.
+*/
 function roleKeyHolders(parts) {
 	const holders = [];
 	if (parts.roles?.through !== void 0) holders.push({
@@ -2228,7 +3068,10 @@ function roleKeyHolders(parts) {
 		return true;
 	});
 }
-/** The bump for one roles table: unchanged keys and ids return early, else every holder of `old` is bumped. */
+/**
+* The bump for one roles table: unchanged keys and ids return early, else every
+* holder of `old` is bumped.
+*/
 function roleKeysBumpSql(holders, versionTable, indent) {
 	return `${indent}if tg_op = 'UPDATE'
 ${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, holder.through.id]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
@@ -2244,9 +3087,9 @@ ${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
 ${indent}on conflict (user_id) do update set version = v.version + 1;`;
 }
 /**
-* A renamed role key changes the `roles` claim of everyone who holds it and
-* the `roles` of every membership that references it, so updates to a roles
-* table bump each holder.
+* A renamed role key changes the `roles` claim of everyone who holds it and the
+* `roles` of every membership that references it, so updates to a roles table
+* bump each holder.
 */
 function roleKeysVersionSql(parts, versionTable) {
 	const holders = roleKeyHolders(parts);
@@ -2301,7 +3144,8 @@ function helperList(parts, types) {
 		return [
 			helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
 			helperEntry(memberIdsHelper(scope.name), "", returns, client),
-			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : []
+			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : [],
+			...parts.helpers.memberFor.includes(scope.name) && isTeamScope(scope.name) ? [helperEntry(memberOfHelper(scope.name), "p_user uuid", returns, client)] : []
 		];
 	})];
 }
@@ -2314,8 +3158,8 @@ function helperEntry(name, args, returns, execute) {
 	};
 }
 /**
-* The helpers `rls generate` writes beyond the ones the hook's claims feed:
-* the `_for` forms in `database` mode, and the assignment checks when a role
+* The helpers `rls generate` writes beyond the ones the hook's claims feed: the
+* `_for` forms in `database` mode, and the assignment checks when a role
 * declares `assigns` (known only with the policy).
 */
 function trustedHelpers(parts, config, types, tenantType, policy) {
@@ -2333,8 +3177,9 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 	const keyed = [
 		helperEntry(USER_ID_HELPER, "", "uuid", client),
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
+		...config.rls?.tokenScopes === true ? [helperEntry(TOKEN_SCOPE_ALLOWS, "p_grant text", "boolean", client)] : [],
 		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
-		...!config.rls?.approvals ? [] : [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)],
+		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
@@ -2361,7 +3206,10 @@ function activeRowManifest(row) {
 		...keep.length === 0 ? {} : { keep }
 	};
 }
-/** The `rls` settings a package writing SQL next to the helpers reads: custom roles, global roles, suspension and assignment triggers. */
+/**
+* The `rls` settings a package writing SQL next to the helpers reads: custom
+* roles, global roles, suspension and assignment triggers.
+*/
 function rlsSettings(parts, config) {
 	const rls = config.rls;
 	const suspension = checkSuspension(rls?.suspension, parts.scopes);
@@ -2380,7 +3228,8 @@ function rlsSettings(parts, config) {
 			...suspension.memberships === void 0 ? {} : { memberships: { keep: keptKeys(suspension.memberships) } }
 		} },
 		...assigned === void 0 ? {} : { assignments: { tables: assigned } },
-		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) }
+		...rls?.apiKeys === void 0 ? {} : { apiKeys: apiKeyFields(rls.apiKeys) },
+		...rls?.tokenScopes === true ? { tokenScopes: true } : {}
 	};
 }
 /** The `supabase/sdk` release `requires.capabilities` names features of. */
@@ -2416,8 +3265,7 @@ function manifestOf(parts, out, config, policy) {
 		scopes: parts.scopes,
 		tenantClaim: parts.tenantClaim,
 		gucPrefix: rls?.gucPrefix ?? "app",
-		tenantType: rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		tenantType: firstScopeType(rls?.scopeTypes, parts.scopes),
 		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes }
 	};
 	const types = new Map(parts.scopes.map((scope) => [scope.name, scopeTypeOf(ctx, scope.name)]));
@@ -2464,15 +3312,30 @@ function manifestOf(parts, out, config, policy) {
 		decidingColumns: decidingColumns(config, parts.attrs === void 0 ? void 0 : {
 			...parts.attrs.table === void 0 ? {} : { table: parts.attrs.table },
 			columns: parts.attrs.columns
-		}),
+		}, parts.hook.teams),
 		markers: {
 			hook: "v1",
 			grants: "v1"
 		},
-		requires: requiredCapabilities(config, policy)
+		requires: requiredCapabilities(config, policy),
+		...policy === void 0 ? {} : { names: resolveNames(policy, config, {
+			schema: parts.helpers.schema,
+			tenantClaim: parts.tenantClaim
+		}) }
 	};
 }
-/** The first line of the generated hook: fields `--check` compares before the full text. */
+/**
+* The manifest without the token hook: what a project with no `supabase.hook`
+* records.
+*/
+function databaseManifestOf(parts, out, config, policy) {
+	const { hook: _hook, budget: _budget, claims: _claims, authzVersion: _authzVersion, authzVersionBump: _authzVersionBump, memberships: _memberships, ...rest } = manifestOf(parts, out, config, policy);
+	return rest;
+}
+/**
+* The first line of the generated hook: fields `--check` compares before the
+* full text.
+*/
 function hookMarker(manifest) {
 	return `${HOOK_MARKER} schema=${manifest.hook.schema} tenant=${manifest.tenantClaim} budget=${String(manifest.budget.bytes)} claims=${manifest.claims.map((claim) => claim.name).join(",")}`;
 }
@@ -2498,7 +3361,10 @@ budget, the claims the hook writes, the membership sources and the columns that
 --out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
 file differs.
 `;
-/** `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else `supabase/permdock-hook.sql`. */
+/**
+* `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else
+* `supabase/permdock-hook.sql`.
+*/
 function hookOut(cwd, config, schema, flag) {
 	const schemas = resolveSchemas(cwd, config, flag);
 	return config.supabase?.hook?.out !== void 0 || schemas.mode !== "pg-delta" ? defaultOut(config) : pgDeltaPath(schemas.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
@@ -2519,8 +3385,26 @@ function supabaseHookManifest(scopes, config, overrides = {}, policy) {
 	};
 }
 /**
-* The hook migration. With `grantsOut`, the statements `supabase db diff`
-* drops are left out of `sql` and returned in `grants` for that file.
+* The manifest of a project in `rls.authorize: 'database'` mode with no
+* `supabase.hook`: the helpers, scopes, membership sources and grants, and no
+* token hook.
+*/
+function supabaseDatabaseManifest(scopes, config, overrides = {}, policy) {
+	return databaseManifestOf(hookParts(scopes, {
+		...config,
+		supabase: {
+			...config.supabase,
+			hook: { memberships: membershipSourcesOf(config) }
+		}
+	}, overrides), overrides.out ?? defaultOut(config), config, policy);
+}
+/** Whether the project is in the one case that has a manifest without a hook. */
+function hooklessDatabase(config) {
+	return config.supabase?.hook === void 0 && resolveAuthorize(config) === "database";
+}
+/**
+* The hook migration. With `grantsOut`, the statements `supabase db diff` drops
+* are left out of `sql` and returned in `grants` for that file.
 */
 function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
 	const parts = hookParts(scopes, config, overrides);
@@ -2564,14 +3448,33 @@ function markerDrift(onDisk, expected, outRel) {
 	const changed = Object.keys(want).filter((key) => found[key] !== want[key]).map((key) => `${key} ${found[key] ?? "(none)"} -> ${want[key] ?? ""}`);
 	return changed.length === 0 ? "supabase hook drift" : `supabase hook drift: ${changed.join("; ")}`;
 }
-function inspectText(manifest) {
+/** Supabase's default access token lifetime when `[auth] jwt_expiry` is unset. */
+const DEFAULT_JWT_EXPIRY = 3600;
+function managementApi(cwd, manifest) {
+	return {
+		hook_custom_access_token_enabled: true,
+		hook_custom_access_token_uri: hookUri(manifest.hook.schema),
+		jwt_exp: supabaseConfig(cwd).jwtExpiry ?? DEFAULT_JWT_EXPIRY
+	};
+}
+function inspectText(manifest, api) {
 	return [
 		`hook ${manifest.hook.schema}.${manifest.hook.function} (${manifest.hook.out})`,
 		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
 		`tenant claim ${manifest.tenantClaim}`,
 		`budget ${String(manifest.budget.bytes)} bytes of ${manifest.budget.measure}`,
 		`claims ${manifest.claims.map((claim) => `${claim.name}${claim.source === "permdock" ? "" : ` (${claim.source})`}${claim.budget ? " [budget]" : ""}`).join(", ")}`,
-		`authz_ver ${manifest.authzVersion ? "on" : "off"}`
+		`authz_ver ${manifest.authzVersion ? "on" : "off"}`,
+		`hook_custom_access_token_enabled ${String(api.hook_custom_access_token_enabled)}`,
+		`hook_custom_access_token_uri ${api.hook_custom_access_token_uri}`,
+		`jwt_exp ${String(api.jwt_exp)}`
+	].join("\n");
+}
+function databaseInspectText(manifest) {
+	return [
+		"no token hook (rls.authorize: database, no supabase.hook)",
+		`helpers ${manifest.helpers.functions.map((fn) => `${manifest.helpers.schema}.${fn}`).join(", ")}`,
+		`tenant claim ${manifest.tenantClaim}`
 	].join("\n");
 }
 /**
@@ -2632,15 +3535,30 @@ async function runSupabase(input) {
 	}).filter(([, value]) => value !== void 0));
 	if (area === "inspect" && action === void 0) {
 		const policy = await loadHookPolicy(input.cwd, input.config);
+		if (hooklessDatabase(input.config)) {
+			const bare = supabaseDatabaseManifest(scopeList(policy.scopes), input.config, overrides, policy);
+			if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, bare, input.check);
+			return {
+				code: 0,
+				output: input.json === true ? JSON.stringify(bare, null, 2) : databaseInspectText(bare)
+			};
+		}
 		const manifest = supabaseHookManifest(scopeList(policy.scopes), input.config, {
 			...overrides,
 			out: hookOut(input.cwd, input.config, input.schema, flag),
 			schemas: schemas.mode
 		}, policy);
-		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, manifest, input.check);
+		const api = managementApi(input.cwd, manifest);
+		if (input.out !== void 0 || input.check) return manifestFile(input.cwd, typeof input.out === "string" ? input.out : MANIFEST_FILE, {
+			...manifest,
+			managementApi: api
+		}, input.check);
 		return {
 			code: 0,
-			output: input.json === true ? JSON.stringify(manifest, null, 2) : inspectText(manifest)
+			output: input.json === true ? JSON.stringify({
+				...manifest,
+				managementApi: managementApi(input.cwd, manifest)
+			}, null, 2) : inspectText(manifest, api)
 		};
 	}
 	if (area !== "hook" || action !== "generate") return {
@@ -2651,7 +3569,9 @@ async function runSupabase(input) {
 		code: 2,
 		output: `supabase hook generate --grants-out is for --schemas migra: ${schemas.mode === "pg-delta" ? "pg-delta keeps the grants in the hook file" : "a hand-written migration keeps its grants"}, so drop --grants-out`
 	};
-	const { sql, grants, manifest } = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const generated = supabaseHookSql(await loadScopes(input.cwd, input.config), input.config, overrides, grantsLabel(input.grantsOut));
+	const { grants, manifest } = generated;
+	const sql = schemas.mode === "pg-delta" && typeof input.out !== "string" && input.config.supabase?.hook?.out === void 0 ? declarativeSql(generated.sql) : generated.sql;
 	const outRel = typeof input.out === "string" ? input.out : hookOut(input.cwd, input.config, input.schema, flag);
 	const outPath = resolve(input.cwd, outRel);
 	const hook = input.config.supabase?.hook;
@@ -2702,4 +3622,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { pd045 as _, supabaseHookManifest as a, approvalsSql as c, resolveAuthorize as d, pd039 as f, attrsPlan as g, schemasRefusal as h, runSupabase as i, parseRbacAuthorize as l, resolveSchemas as m, hookOut as n, supabaseHookSql as o, isSupabaseSchemas as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, rbacScaffold as u, readSupabaseConfig as v, supabaseConfig as y };
+export { supabaseConfig as _, supabaseHookManifest as a, resolveAuthorize as b, pd039 as c, schemasRefusal as d, declarativeSql as f, readSupabaseConfig as g, pd074 as h, runSupabase as i, isSupabaseSchemas as l, pd045 as m, hookOut as n, supabaseHookSql as o, attrsPlan as p, loadScopes as r, approvalsSql as s, grantsLabel as t, resolveSchemas as u, parseRbacAuthorize as v, rbacScaffold as y };