permdock 0.7.0 → 0.8.0

package/dist/{supabase-hook-Dg0SrQWR.js → supabase-hook-B-yXnzUl.js}

@@ -1,27 +1,30 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { o as hasConditionOp } from "./refs-CNJBiTFo.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-BHsc-wp-.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
-import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
-import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as requirePolicy } from "./load-DxroEzH1.js";
-import { i as qualifySqlTable } from "./sql-B96movIM.js";
-import { r as scopeColumn } from "./compile-BAEO5bOk.js";
-import { t as authorizeSql } from "./supabase--0aJdLEd.js";
-import "./budget-NbEtbJC_.js";
-import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-B-zYB4GS.js";
-import { o as readMemberships } from "./postgrest-r5faDIzD.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
+import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+import { i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { t as authorizeSql } from "./supabase-BL1qJzzY.js";
+import "./budget-BELja5A9.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-CMAM-2A3.js";
+import { o as readMemberships } from "./postgrest-D4nuPXIQ.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
+import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-CCMdcFWb.js";
-import { A as quoteQualified, D as qualified, F as scopeTypeOf, L as tenantTypeOf, O as quoteIdent, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-fMKOv8hP.js";
-import { $ as permittedForHelper, A as apiKeyFields, C as globalRoleSource, G as hasMemberFor, I as roleNames, J as memberForHelper, K as hasPermittedUsers, O as API_KEY_ALLOWS, Q as memberRoleOf, S as globalRoleRows, X as memberForTable, Y as memberForSources, Z as memberIdsHelper, c as OWNERSHIP, et as permittedIdsHelper, f as permissionKeysForHelper, i as holderSources, it as activeRowSql, l as PERMISSION_HELPERS, o as guardedTables, ot as checkSuspension, p as permittedByPermissionHelper, rt as scopeTable, s as ASSIGNMENTS, t as ownershipRules, u as checkName, v as TOKEN_SCOPE_ALLOWS } from "./ownership-Z2LpxsGa.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
+import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DeMNEy6V.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-DRo2QM6E.js";
-import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-B2lZIurj.js";
+import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
+import { n as pgConnector } from "./pg-DQTqRrou.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-D0vUI6dq.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
@@ -822,7 +825,7 @@ function resolveAuthorize(config, flags = {}) {
 	if (explicit !== void 0) return explicit;
 	if (rls?.membershipSources !== void 0 || flags.rbac === true) return "database";
 	const memberships = flags.memberships ?? rls?.memberships;
-	return memberships?.tenant !== void 0 || memberships?.team !== void 0 || Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
+	return Object.keys(memberships?.scopes ?? {}).length > 0 ? "database" : "jwt";
 }
 function parseRbacAuthorize(raw) {
 	if (raw === void 0) return;
@@ -839,7 +842,10 @@ function createEnum(schema, name, values) {
 exception when duplicate_object then null;
 end $$;`;
 }
-/** A read policy and `select` grant for `supabase_auth_admin` on a table the hook reads. */
+/**
+* A read policy and `select` grant for `supabase_auth_admin` on a table the
+* hook reads.
+*/
 function authAdminRead(table, label) {
 	const t = quoteQualified(table);
 	const policy = quoteIdent(`permdock_auth_admin_read_${label}`);
@@ -852,10 +858,10 @@ create policy ${policy} on ${t}
 }
 /**
 * Supabase's Custom Claims and RBAC scaffold on top of the PermDock helpers:
-* enums, `user_roles` and `authorize()` over the shared `role_permissions`.
-* The token hook comes only from `permdock supabase hook generate`, so one
-* function writes the claims. Policies never call `authorize()` per row; they
-* call the helpers. Never grants anything to `service_role`.
+* enums, `user_roles` and `authorize()` over the shared `role_permissions`. The
+* token hook comes only from `permdock supabase hook generate`, so one function
+* writes the claims. Policies never call `authorize()` per row; they call the
+* helpers. Never grants anything to `service_role`.
 */
 function rbacScaffold(policy, options) {
 	const schema = options.schema;
@@ -940,16 +946,25 @@ function readSupabaseConfig(cwd) {
 		}
 	};
 }
-/** `supabase/` joined with `declarative_schema_path`, which defaults to `schemas`. */
+/**
+* `supabase/` joined with `declarative_schema_path`, which defaults to
+* `schemas`.
+*/
 function declarativeSchemaDir(schemaPath) {
 	return posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "");
 }
-/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+/**
+* The parsed config, or `{}` when it is missing or does not parse (PD045
+* reports that).
+*/
 function supabaseConfig(cwd) {
 	const read = readSupabaseConfig(cwd);
 	return read?.ok === true ? read.config : {};
 }
-/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+/**
+* PD045: a `supabase/config.toml` the CLI cannot parse, so every check that
+* reads it falls back to defaults.
+*/
 function pd045(cwd) {
 	const read = readSupabaseConfig(cwd);
 	if (read === void 0 || read.ok) return [];
@@ -961,9 +976,9 @@ function pd045(cwd) {
 	}];
 }
 /**
-* PD074: `supabase.hook` is configured but `[auth.hook.custom_access_token]`
-* in `supabase/config.toml` does not enable the generated function, so a
-* local stack and every branch push issue tokens without memberships.
+* PD074: `supabase.hook` is configured but `[auth.hook.custom_access_token]` in
+* `supabase/config.toml` does not enable the generated function, so a local
+* stack and every branch push issue tokens without memberships.
 */
 function pd074(cwd, config) {
 	const hook = config.supabase?.hook;
@@ -1126,8 +1141,8 @@ const USER_EDITABLE = /^(raw_)?user_meta(_)?data$/iu;
 /**
 * Splits `supabase.hook.attrs` into table columns and `app_metadata` keys and
 * lists what cannot be compiled: `user_metadata` (the user can edit it), a
-* direct `auth.users` column, an unsafe or prototype key, a duplicate key,
-* or a table column without a table.
+* direct `auth.users` column, an unsafe or prototype key, a duplicate key, or a
+* table column without a table.
 */
 function attrsPlan(attrs) {
 	const errors = [];
@@ -1242,8 +1257,8 @@ function beforeSql(before) {
 }
 /**
 * `hook.validate`: the claims the hook writes, dropped together when they do
-* not match `supabase-claims-v1.json`, so a bad claim denies instead of
-* failing sign-in. `hook.claims` entries belong to other packages and stay.
+* not match `supabase-claims-v1.json`, so a bad claim denies instead of failing
+* sign-in. `hook.claims` entries belong to other packages and stay.
 */
 function validateSql(parts) {
 	if (parts.hook.validate !== true) return "";
@@ -1269,8 +1284,8 @@ grant usage on schema extensions to supabase_auth_admin;
 grant execute on function extensions.jsonb_matches_schema(json, jsonb) to supabase_auth_admin;` : "";
 }
 /**
-* Fails the migration when a client role can write an `attrs` column: a
-* claim the user can set is not a server-owned attribute.
+* Fails the migration when a client role can write an `attrs` column: a claim
+* the user can set is not a server-owned attribute.
 */
 function attrsGuardSql(plan) {
 	if (plan?.table === void 0 || plan.columns.length === 0) return "";
@@ -1319,10 +1334,11 @@ function hookClaims(parts) {
 //#region src/cli/sql/declarative.ts
 /**
 * A migration's SQL as a declarative schema file: pg-delta diffs the file
-* against the database itself, so a `drop trigger if exists` or
-* `drop policy if exists` before its `create` is an error, and a trigger is
-* `create or replace trigger`. A constraint trigger stays `create constraint trigger`, because
-* pg-delta has no `create or replace constraint trigger`. A policy keeps its plain `create policy`.
+* against the database itself, so a `drop trigger if exists` or `drop policy if
+* exists` before its `create` is an error, and a trigger is `create or replace
+* trigger`. A constraint trigger stays `create constraint trigger`, because
+* pg-delta has no `create or replace constraint trigger`. A policy keeps its
+* plain `create policy`.
 */
 function declarativeSql(sql) {
 	return sql.replaceAll(/^drop (?:trigger|policy) if exists [^;\n]+;\n/gmu, "").replaceAll(/^create trigger /gmu, "create or replace trigger ");
@@ -1342,9 +1358,9 @@ function schemasRefusal(command, value) {
 	return value === void 0 || isSupabaseSchemas(value) ? void 0 : `${command} --schemas must be ${MODES.join(", ")} (got ${value})`;
 }
 /**
-* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml`
-* sets `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default
-* of new Supabase projects and of the next Supabase CLI major.
+* `--schemas`, else `supabase.schemas`, else `migra` when `config.toml` sets
+* `[experimental.pgdelta] enabled = false`, else `pg-delta`: the default of new
+* Supabase projects and of the next Supabase CLI major.
 */
 function resolveSchemas(cwd, config, flag) {
 	const toml = supabaseConfig(cwd).pgDelta;
@@ -1365,7 +1381,10 @@ const HELPER_NAME = /^(?:permdock_has|permitted_[a-z][a-z0-9_]*_ids|member_[a-z]
 function escape(text) {
 	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
 }
-/** The helper functions `sql` creates in `schema`; unqualified names count for `public`. */
+/**
+* The helper functions `sql` creates in `schema`; unqualified names count for
+* `public`.
+*/
 function helpersDefined(sql, schema) {
 	const qualifier = schema === "public" ? String.raw`(?:(?:"public"|public)\.)?` : String.raw`(?:"${escape(schema)}"|${escape(schema)})\.`;
 	const create = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?function\s+${qualifier}"?([a-z_][a-z0-9_]*)"?\s*\(`, "giu");
@@ -1377,9 +1396,9 @@ function helpersDefined(sql, schema) {
 	return names;
 }
 /**
-* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`;
-* its `helpers` part when it has `{part}`), the SQL files next to the hook,
-* and the migration folders, not the hook itself.
+* SQL files that may hold the generated helpers: `rls.out` (else `rls.sql`; its
+* `helpers` part when it has `{part}`), the SQL files next to the hook, and the
+* migration folders, not the hook itself.
 */
 function helperSources(cwd, config, hookOut) {
 	const hook = resolve(cwd, hookOut);
@@ -1412,7 +1431,10 @@ where n.nspname = $1 and p.proname = any($2::text[])`, [manifest.helpers.schema,
 function missingHelpersMessage(manifest, missing) {
 	return `PD039 schema ${manifest.helpers.schema} has no ${missing.join(", ")}: the hook's claims are read by these helpers; run permdock rls generate and apply its migration`;
 }
-/** Bytes of JSON of each extra claim in the largest sample, for claims that pass the budget. */
+/**
+* Bytes of JSON of each extra claim in the largest sample, for claims that pass
+* the budget.
+*/
 function oversizedClaims(samples, manifest) {
 	const encoder = new TextEncoder();
 	const oversized = [];
@@ -1515,7 +1537,10 @@ function memberForPlan(input) {
 		memberships: [...entries.values()]
 	};
 }
-/** An `rls.memberships` table in the manifest's `tableMembershipSource` / `junctionMembershipSource` shape, for scope `name`. */
+/**
+* An `rls.memberships` table in the manifest's `tableMembershipSource` /
+* `junctionMembershipSource` shape, for scope `name`.
+*/
 function mappedMembership(mapped, scopes, name) {
 	const id = scopeColumn(mapped, scopes, name) ?? "";
 	const within = {};
@@ -1620,12 +1645,12 @@ ${source.sql.select(`v_user_${String(index)}`).replaceAll(/^/gmu, "  ")}
 //#region src/cli/supabase-hook/api.ts
 const SUBJECT_FOR = "subject_for";
 /**
-* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a
-* token for `p_user`, from the same membership, role, suspension and version
-* reads, plus the custom roles the user holds when `database` mode keeps them
-* in tables. A backend that only has PostgREST (`postgrestSources`) builds a
-* subject for an acting user or a job from it. Naming the user is why no
-* client role may execute it.
+* `subject_for(p_user uuid) returns jsonb`: what the hook would put in a token
+* for `p_user`, from the same membership, role, suspension and version reads,
+* plus the custom roles the user holds when `database` mode keeps them in
+* tables. A backend that only has PostgREST (`postgrestSources`) builds a
+* subject for an acting user or a job from it. Naming the user is why no client
+* role may execute it.
 */
 function subjectForSql(parts, config) {
 	const schema = quoteIdent(parts.schema);
@@ -1797,9 +1822,9 @@ revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
 }
 /**
 * The custom roles `p_user` holds: tenant and shared roles named on a
-* membership of the scope (and instance) they live at, and platform roles
-* among the global roles, each with its grants and includes in `CustomRole`
-* form. A shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
+* membership of the scope (and instance) they live at, and platform roles among
+* the global roles, each with its grants and includes in `CustomRole` form. A
+* shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
 */
 function customRolesOfSql(parts) {
 	const helpers = quoteIdent(parts.helpers.schema);
@@ -1850,9 +1875,15 @@ function customRolesOfSql(parts) {
 }
 //#endregion
 //#region src/cli/rls/approvals.ts
-/** `rls.approvals`' approver check; better-supabase's `isApprover` template calls it. */
+/**
+* `rls.approvals`' approver check; better-supabase's `isApprover` template
+* calls it.
+*/
 const IS_APPROVER = "permdock_is_approver";
-/** The objects `rls.approvals` adds. Names are part of the SQL contract `supabaseApprovalStore` calls. */
+/**
+* The objects `rls.approvals` adds. Names are part of the SQL contract
+* `supabaseApprovalStore` calls.
+*/
 const APPROVAL_STORE = {
 	table: "approval_requests",
 	open: "permdock_approval_open",
@@ -1888,8 +1919,8 @@ function serverOnly(fn, args) {
 const BODY_CHECK = `${APPROVAL_STORE.table}_body_schema`;
 /**
 * `rls.jsonSchema`: a pg_jsonschema check that `body` matches
-* `approval-request-v1.json`, added `not valid` and then validated. `auto`
-* adds it only where the extension is available.
+* `approval-request-v1.json`, added `not valid` and then validated. `auto` adds
+* it only where the extension is available.
 */
 function bodySchemaSql(table, mode, body = "body", check = BODY_CHECK) {
 	const statements = [
@@ -1911,11 +1942,11 @@ end
 $permdock$;\n`;
 }
 /**
-* The approval store (`rls.approvals`): one table of `ApprovalRequest`
-* bodies with the columns a list filters on, and one `security definer`
-* function per `ApprovalStore` method, each one atomic statement. No client
-* role may read the table or execute the functions: approvals are opened and
-* resolved by the server, which grants its own role.
+* The approval store (`rls.approvals`): one table of `ApprovalRequest` bodies
+* with the columns a list filters on, and one `security definer` function per
+* `ApprovalStore` method, each one atomic statement. No client role may read
+* the table or execute the functions: approvals are opened and resolved by the
+* server, which grants its own role.
 */
 function approvalStoreSql(ctx, jsonSchema = false) {
 	const table = qualified(ctx, APPROVAL_STORE.table);
@@ -2072,8 +2103,8 @@ ${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
 /**
 * `permdock_is_approver(p_approvers jsonb, p_tenant text default null)`: true
 * when the signed-in user matches the serialised approvers of a request
-* (`approvers.by`), for policies on the app's own approval views. A list
-* needs every item and `any-of` one of them; `user` compares the user id and
+* (`approvers.by`), for policies on the app's own approval views. A list needs
+* every item and `any-of` one of them; `user` compares the user id and
 * `holder(permission)` reads `permitted_<root>_ids_by_permission` in
 * `p_tenant`, or `permdock_has_permission` without one. Role, relation and
 * other grantee approvers need facts the database does not hold for every
@@ -2170,19 +2201,22 @@ function approvalsSql(ctx, approvals, jsonSchema) {
 	}, jsonSchema);
 	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx) : "");
 }
-/** The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource` reads the table. */
+/**
+* The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
+* reads the table.
+*/
 const DELEGATIONS = {
 	table: "approval_delegations",
 	covers: "permdock_cover_approves"
 };
 /**
-* `rls.approvals.delegations`: one table of out-of-office covers that a
-* user writes for themselves, and a four-argument `permdock_is_approver`
-* that also answers for a delegate inside an active cover. One hop: a cover
-* is checked against the delegator's own approver rights, never the
-* delegator's covers. A delegator who is the requester never counts. A
-* `holder()` approver through a cover needs `rls.mode: "database"`, where
-* the `_for` helpers exist; in `jwt` mode only `user()` approvers pass.
+* `rls.approvals.delegations`: one table of out-of-office covers that a user
+* writes for themselves, and a four-argument `permdock_is_approver` that also
+* answers for a delegate inside an active cover. One hop: a cover is checked
+* against the delegator's own approver rights, never the delegator's covers. A
+* delegator who is the requester never counts. A `holder()` approver through a
+* cover needs `rls.mode: "database"`, where the `_for` helpers exist; in `jwt`
+* mode only `user()` approvers pass.
 */
 function approvalDelegationsSql(ctx) {
 	const table = qualified(ctx, DELEGATIONS.table);
@@ -2336,7 +2370,10 @@ revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
 grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
 `;
 }
-/** The request fields an adopted table may mirror into its own columns, as SQL over a body. */
+/**
+* The request fields an adopted table may mirror into its own columns, as SQL
+* over a body.
+*/
 const MIRRORS = {
 	status: (body) => `${body} ->> 'status'`,
 	permission: (body) => `${body} ->> 'permission'`,
@@ -2360,7 +2397,10 @@ function mirrorsOf(adopt) {
 	}
 	return out;
 }
-/** One row of `table` from `values` (column, SQL), each converted to the column's own type. */
+/**
+* One row of `table` from `values` (column, SQL), each converted to the
+* column's own type.
+*/
 function populate(table, values) {
 	return `pg_catalog.jsonb_populate_record(null::${table}, pg_catalog.jsonb_build_object(${values.map(([column, sql]) => `${quoteLiteral(column)}, ${sql}`).join(", ")}))`;
 }
@@ -2368,7 +2408,10 @@ function populate(table, values) {
 function mirrorRow(table, mirror, body) {
 	return populate(table, mirror.map(([column, field]) => [column, MIRRORS[field](body)]));
 }
-/** `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty without mirrors. */
+/**
+* `, (<mirrored columns>) = (select …)` for an update that writes `body`; empty
+* without mirrors.
+*/
 function mirrorSet(table, mirror, body) {
 	if (mirror.length === 0) return "";
 	const columns = mirror.map(([column]) => quoteIdent(column));
@@ -2376,12 +2419,12 @@ function mirrorSet(table, mirror, body) {
 	return `,\n    ${columns.length === 1 ? columns[0] ?? "" : `(${columns.join(", ")})`} = (select ${picked} from ${mirrorRow(table, mirror, body)} r)`;
 }
 /**
-* The approval store over a table the app already has (`rls.approvals:
-* { table, token?, body?, mirror? }`): the same `permdock_approval_*`
-* functions, reading every field from the request body in `body`, keyed by
-* the text column `token`, and copying the fields `mirror` names into the
-* app's own columns, converted to their types, on every write. The table's
-* grants and policies stay the app's.
+* The approval store over a table the app already has (`rls.approvals: { table,
+* token?, body?, mirror? }`): the same `permdock_approval_*` functions, reading
+* every field from the request body in `body`, keyed by the text column
+* `token`, and copying the fields `mirror` names into the app's own columns,
+* converted to their types, on every write. The table's grants and policies
+* stay the app's.
 */
 function adoptedApprovalStoreSql(ctx, adopt, jsonSchema = false) {
 	const table = quoteQualified(adopt.table);
@@ -2565,92 +2608,6 @@ ${serverOnly(fn(APPROVAL_STORE.cancel), "jsonb, text, text, text")}
 `;
 }
 //#endregion
-//#region src/cli/rls/permission-holders.ts
-/** `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL contract. */
-function permittedUsersHelper(scope) {
-	return checkName(`permitted_${scope}_users`);
-}
-/** The users with a membership row on the instance `p_id`, or `undefined` when the scope's memberships are not all in tables. */
-function candidatesSql(ctx, scope, user) {
-	const mapped = scopeTable(ctx, scope);
-	if (mapped !== void 0) return {
-		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
-    from ${quoteQualified(mapped.table.table)} m
-    where m.${quoteIdent(mapped.column)} = p_id`,
-		keys: []
-	};
-	const sources = holderSources(ctx, scope);
-	if (sources === void 0 || sources === "not-tables") return;
-	return {
-		sql: sources.map((source, index) => `    select h.user_id::${user}
-    from (
-${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
-    ) h`).join("\n    union\n"),
-		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
-	};
-}
-/** `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a `%type` variable. */
-function functionBody(keys, query) {
-	if (keys.length === 0) return `language sql
-stable
-security definer
-set search_path = ''
-as $$
-${query}
-$$;`;
-	return `language plpgsql
-stable
-security definer
-set search_path = ''
-as $$
-declare
-${keys.map((key) => `  ${key} := p_id;`).join("\n")}
-begin
-  return query
-${query.replaceAll(/^/gmu, "  ")};
-end
-$$;`;
-}
-/**
-* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
-* mode: the users who hold a permission key on one instance, read from the
-* scope's membership rows and the global-roles table and kept when
-* `permitted_<scope>_ids_by_permission_for` lists the instance or
-* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
-* suspension apply as for the user. It names other users, so no client role
-* may execute it, and a backend role needs its own grant.
-*/
-function permissionHoldersSql(ctx) {
-	if (ctx.authorize !== "database") return "";
-	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const global = globalRoleRows(ctx);
-	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
-	return `${ctx.scopes.map(({ name }) => {
-		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
-		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
-		const fn = qualified(ctx, permittedUsersHelper(name));
-		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
-		const type = scopeTypeOf(ctx, name);
-		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
-create or replace function ${fn}(p_permission text, p_id ${type})
-returns setof ${user}
-${functionBody(candidates.keys, `  select c.user_id
-  from (
-${candidates.sql}
-    union
-    select ${global.userSql}::${user}
-    from ${global.from}
-  ) c(user_id)
-  where c.user_id is not null
-    and (
-      p_id in (select ${ids}(c.user_id, p_permission))
-      or ${hasFor}(c.user_id, p_permission)
-    )
-  order by 1`)}
-revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
-	}).join("\n\n")}\n`;
-}
-//#endregion
 //#region src/cli/supabase-hook/sql.ts
 const MANAGED_TRIGGER = "permdock_protect_managed";
 function hookSql(parts) {
@@ -2959,10 +2916,10 @@ function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;
 }
 /**
-* Every membership source whose user id lives in another table: a row of
-* the source bumps the users its old and new references hold, and a change
-* of that table's user id (a contact re-linked to another login) bumps the
-* old and the new user.
+* Every membership source whose user id lives in another table: a row of the
+* source bumps the users its old and new references hold, and a change of that
+* table's user id (a contact re-linked to another login) bumps the old and the
+* new user.
 */
 function memberUsersVersionSql(parts, bumpFor) {
 	const holders = /* @__PURE__ */ new Map();
@@ -3074,7 +3031,10 @@ $$;
 revoke execute on function ${linkedBump}() from public, anon, authenticated;
 ${userTriggers}`;
 }
-/** Every table whose role column references a roles table: the global roles and the membership sources. */
+/**
+* Every table whose role column references a roles table: the global roles and
+* the membership sources.
+*/
 function roleKeyHolders(parts) {
 	const holders = [];
 	if (parts.roles?.through !== void 0) holders.push({
@@ -3108,7 +3068,10 @@ function roleKeyHolders(parts) {
 		return true;
 	});
 }
-/** The bump for one roles table: unchanged keys and ids return early, else every holder of `old` is bumped. */
+/**
+* The bump for one roles table: unchanged keys and ids return early, else every
+* holder of `old` is bumped.
+*/
 function roleKeysBumpSql(holders, versionTable, indent) {
 	return `${indent}if tg_op = 'UPDATE'
 ${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, holder.through.id]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
@@ -3124,9 +3087,9 @@ ${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
 ${indent}on conflict (user_id) do update set version = v.version + 1;`;
 }
 /**
-* A renamed role key changes the `roles` claim of everyone who holds it and
-* the `roles` of every membership that references it, so updates to a roles
-* table bump each holder.
+* A renamed role key changes the `roles` claim of everyone who holds it and the
+* `roles` of every membership that references it, so updates to a roles table
+* bump each holder.
 */
 function roleKeysVersionSql(parts, versionTable) {
 	const holders = roleKeyHolders(parts);
@@ -3181,7 +3144,8 @@ function helperList(parts, types) {
 		return [
 			helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
 			helperEntry(memberIdsHelper(scope.name), "", returns, client),
-			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : []
+			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : [],
+			...parts.helpers.memberFor.includes(scope.name) && isTeamScope(scope.name) ? [helperEntry(memberOfHelper(scope.name), "p_user uuid", returns, client)] : []
 		];
 	})];
 }
@@ -3194,8 +3158,8 @@ function helperEntry(name, args, returns, execute) {
 	};
 }
 /**
-* The helpers `rls generate` writes beyond the ones the hook's claims feed:
-* the `_for` forms in `database` mode, and the assignment checks when a role
+* The helpers `rls generate` writes beyond the ones the hook's claims feed: the
+* `_for` forms in `database` mode, and the assignment checks when a role
 * declares `assigns` (known only with the policy).
 */
 function trustedHelpers(parts, config, types, tenantType, policy) {
@@ -3215,7 +3179,7 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
 		...config.rls?.tokenScopes === true ? [helperEntry(TOKEN_SCOPE_ALLOWS, "p_grant text", "boolean", client)] : [],
 		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
-		...!config.rls?.approvals ? [] : [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)],
+		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;
@@ -3242,7 +3206,10 @@ function activeRowManifest(row) {
 		...keep.length === 0 ? {} : { keep }
 	};
 }
-/** The `rls` settings a package writing SQL next to the helpers reads: custom roles, global roles, suspension and assignment triggers. */
+/**
+* The `rls` settings a package writing SQL next to the helpers reads: custom
+* roles, global roles, suspension and assignment triggers.
+*/
 function rlsSettings(parts, config) {
 	const rls = config.rls;
 	const suspension = checkSuspension(rls?.suspension, parts.scopes);
@@ -3298,8 +3265,7 @@ function manifestOf(parts, out, config, policy) {
 		scopes: parts.scopes,
 		tenantClaim: parts.tenantClaim,
 		gucPrefix: rls?.gucPrefix ?? "app",
-		tenantType: rls?.tenantType ?? "uuid",
-		...rls?.teamType === void 0 ? {} : { teamType: rls.teamType },
+		tenantType: firstScopeType(rls?.scopeTypes, parts.scopes),
 		...rls?.scopeTypes === void 0 ? {} : { scopeTypes: rls.scopeTypes }
 	};
 	const types = new Map(parts.scopes.map((scope) => [scope.name, scopeTypeOf(ctx, scope.name)]));
@@ -3351,15 +3317,25 @@ function manifestOf(parts, out, config, policy) {
 			hook: "v1",
 			grants: "v1"
 		},
-		requires: requiredCapabilities(config, policy)
+		requires: requiredCapabilities(config, policy),
+		...policy === void 0 ? {} : { names: resolveNames(policy, config, {
+			schema: parts.helpers.schema,
+			tenantClaim: parts.tenantClaim
+		}) }
 	};
 }
-/** The manifest without the token hook: what a project with no `supabase.hook` records. */
+/**
+* The manifest without the token hook: what a project with no `supabase.hook`
+* records.
+*/
 function databaseManifestOf(parts, out, config, policy) {
 	const { hook: _hook, budget: _budget, claims: _claims, authzVersion: _authzVersion, authzVersionBump: _authzVersionBump, memberships: _memberships, ...rest } = manifestOf(parts, out, config, policy);
 	return rest;
 }
-/** The first line of the generated hook: fields `--check` compares before the full text. */
+/**
+* The first line of the generated hook: fields `--check` compares before the
+* full text.
+*/
 function hookMarker(manifest) {
 	return `${HOOK_MARKER} schema=${manifest.hook.schema} tenant=${manifest.tenantClaim} budget=${String(manifest.budget.bytes)} claims=${manifest.claims.map((claim) => claim.name).join(",")}`;
 }
@@ -3385,7 +3361,10 @@ budget, the claims the hook writes, the membership sources and the columns that
 --out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
 file differs.
 `;
-/** `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else `supabase/permdock-hook.sql`. */
+/**
+* `supabase.hook.out`, else pg-delta's per-schema path under pg-delta, else
+* `supabase/permdock-hook.sql`.
+*/
 function hookOut(cwd, config, schema, flag) {
 	const schemas = resolveSchemas(cwd, config, flag);
 	return config.supabase?.hook?.out !== void 0 || schemas.mode !== "pg-delta" ? defaultOut(config) : pgDeltaPath(schemas.schemaDir, "hook", schema ?? config.supabase?.hook?.schema ?? config.rls?.schema ?? "permdock");
@@ -3424,8 +3403,8 @@ function hooklessDatabase(config) {
 	return config.supabase?.hook === void 0 && resolveAuthorize(config) === "database";
 }
 /**
-* The hook migration. With `grantsOut`, the statements `supabase db diff`
-* drops are left out of `sql` and returned in `grants` for that file.
+* The hook migration. With `grantsOut`, the statements `supabase db diff` drops
+* are left out of `sql` and returned in `grants` for that file.
 */
 function supabaseHookSql(scopes, config, overrides = {}, grantsOut) {
 	const parts = hookParts(scopes, config, overrides);
@@ -3643,4 +3622,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { readSupabaseConfig as _, supabaseHookManifest as a, rbacScaffold as b, approvalsSql as c, resolveSchemas as d, schemasRefusal as f, pd074 as g, pd045 as h, runSupabase as i, pd039 as l, attrsPlan as m, hookOut as n, supabaseHookSql as o, declarativeSql as p, loadScopes as r, permissionHoldersSql as s, grantsLabel as t, isSupabaseSchemas as u, supabaseConfig as v, resolveAuthorize as x, parseRbacAuthorize as y };
+export { supabaseConfig as _, supabaseHookManifest as a, resolveAuthorize as b, pd039 as c, schemasRefusal as d, declarativeSql as f, readSupabaseConfig as g, pd074 as h, runSupabase as i, isSupabaseSchemas as l, pd045 as m, hookOut as n, supabaseHookSql as o, attrsPlan as p, loadScopes as r, approvalsSql as s, grantsLabel as t, resolveSchemas as u, parseRbacAuthorize as v, rbacScaffold as y };