better-supabase 0.5.0 → 0.5.1

package/dist/cli/{read-sets-BfMQcKy8.js → read-sets-VQcPgxU9.js}

@@ -2,7 +2,7 @@ import { i as importModule } from "./config-CPVpXP5I.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { KIT_ID_TYPES, compileReadSets, kitIdType } from "better-supabase/sql";
+import { KIT_ID_TYPES, compileReadSets, kitIdType, permdockKeyStatus } from "better-supabase/sql";
 import { isReadSet } from "better-supabase";
 //#region src/cli/permdock.ts
 const PERMDOCK_CONFIGS = [
@@ -81,7 +81,11 @@ function parseManifest(json) {
 				args: helper["args"],
 				returns: helper["returns"],
 				execute: strings(helper["execute"])
-			}] : [])
+			}] : []),
+			...Array.isArray(rls["memberships"]) ? { memberships: rls["memberships"].flatMap((entry) => {
+				const parsed = membership(entry);
+				return parsed ? [parsed] : [];
+			}) } : {}
 		} } : {},
 		decidingColumns: strings(json["decidingColumns"])
 	};
@@ -186,17 +190,13 @@ function parseGrantsMarker(sql) {
 	};
 }
 /**
-* PermDock mode, when the project uses PermDock and `entitlements.permdock`
-* is not `false`. The scope is `entitlements.permdock.scope`, which must be
-* one of the manifest's `rls.scopes`, else the one scope without `within`.
-* No root scope, or more than one, is invalid rather than a guess. A
-* PermDock project without a readable manifest or without its `rls` block
-* is invalid too, so the module never falls back to `tenant` on its own.
+* The PermDock scope tenants are: `explicit`, which must be one of the
+* manifest's `rls.scopes`, else the one scope without `within`. A missing or
+* unreadable manifest, no `rls` block, no root scope or several, and a scope
+* without a type this kit renders are invalid rather than a guess.
 */
-function entitlementsMode(config, project) {
-	const setting = config.entitlements.permdock;
-	if (setting === false || !project) return { kind: "tenant" };
-	const optOut = "or set entitlements.permdock: false to keep the tenant module's memberships.";
+function manifestScope(project, explicit, reader) {
+	const { subject, helpers, setting, optOut } = reader;
 	if (!project.manifest) {
 		const problem = project.problems.find((entry) => entry.startsWith(project.manifestPath));
 		return {
@@ -207,41 +207,82 @@ function entitlementsMode(config, project) {
 	const rls = project.manifest.rls;
 	if (!rls) return {
 		kind: "invalid",
-		problem: `${project.manifestPath} has no rls block, so the entitlements module can't find PermDock's membership helpers. Run \`permdock rls generate\`, then \`permdock supabase inspect --out\`, ${optOut}`
+		problem: `${project.manifestPath} has no rls block, so ${subject} can't find PermDock's ${helpers}. Run \`permdock rls generate\`, then \`permdock supabase inspect --out\`, ${optOut}`
 	};
 	const names = rls.scopes.map((scope) => scope.name).join(", ") || "none";
 	let scope;
-	if (setting.scope === void 0) {
+	if (explicit === void 0) {
 		const roots = rls.scopes.filter((entry) => entry.within === void 0);
 		if (roots.length !== 1) return {
 			kind: "invalid",
-			problem: `${project.manifestPath} has no single root scope (${roots.map((entry) => entry.name).join(", ") || "none"}), so the entitlements module can't tell which scope tenants are. Set entitlements.permdock: { scope } to one of ${names}.`
+			problem: `${project.manifestPath} has no single root scope (${roots.map((entry) => entry.name).join(", ") || "none"}), so ${subject} can't tell which scope tenants are. Set ${setting}: { scope } to one of ${names}.`
 		};
 		scope = roots[0].name;
 	} else {
-		scope = setting.scope;
+		scope = explicit;
 		if (!rls.scopes.some((entry) => entry.name === scope)) return {
 			kind: "invalid",
-			problem: `entitlements.permdock.scope is "${scope}", but ${project.manifestPath} has the scopes ${names}. Set entitlements.permdock: { scope } to one of them, or remove it to use the root scope.`
+			problem: `${setting}.scope is "${scope}", but ${project.manifestPath} has the scopes ${names}. Set ${setting}: { scope } to one of them, or remove it to use the root scope.`
 		};
 	}
 	const declared = rls.scopes.find((entry) => entry.name === scope)?.type;
 	if (declared === void 0) return {
 		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" no type, so the entitlements module can't tell its id type. Run \`permdock supabase inspect --out\` with a current PermDock.`
+		problem: `${project.manifestPath} gives scope "${scope}" no type, so ${subject} can't tell its id type. Run \`permdock supabase inspect --out\` with a current PermDock.`
 	};
-	const type = kitIdType(declared);
-	if (type === void 0) return {
+	const idType = kitIdType(declared);
+	if (idType === void 0) return {
 		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" the type ${declared}, but the entitlements module renders only ${KIT_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
+		problem: `${project.manifestPath} gives scope "${scope}" the type ${declared}, but ${subject} renders only ${KIT_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
+	};
+	return {
+		kind: "ok",
+		manifest: project.manifest,
+		rls,
+		scope,
+		idType
 	};
+}
+/**
+* The membership tables PermDock's `member_<scope>_ids_for` reads for
+* `scope`: the manifest's `rls.memberships` that can cover it (a scope
+* column, or a fixed scope equal to `scope`). A manifest from a PermDock
+* without `rls.memberships` falls back to the hook's sources.
+*/
+function scopeMemberships(manifest, scope) {
+	const rls = manifest.rls?.memberships;
+	return {
+		sources: (rls ?? manifest.memberships).filter((source) => !("value" in source.scope) || source.scope.value === scope),
+		from: rls === void 0 ? "hook" : "rls"
+	};
+}
+/**
+* PermDock mode, when the project uses PermDock and `entitlements.permdock`
+* is not `false`. The scope is `entitlements.permdock.scope`, which must be
+* one of the manifest's `rls.scopes`, else the one scope without `within`.
+* No root scope, or more than one, is invalid rather than a guess. A
+* PermDock project without a readable manifest or without its `rls` block
+* is invalid too, so the module never falls back to `tenant` on its own.
+* Memberships come from `rls.memberships`, the tables PermDock's helpers
+* read, and from the hook's sources only when the manifest has none.
+*/
+function entitlementsMode(config, project) {
+	const setting = config.entitlements.permdock;
+	if (setting === false || !project) return { kind: "tenant" };
+	const chosen = manifestScope(project, setting.scope, {
+		subject: "the entitlements module",
+		helpers: "membership helpers",
+		setting: "entitlements.permdock",
+		optOut: "or set entitlements.permdock: false to keep the tenant module's memberships."
+	});
+	if (chosen.kind === "invalid") return chosen;
 	return {
 		kind: "permdock",
 		permdock: {
-			schema: rls.schema,
-			scope,
-			idType: type,
-			memberships: project.manifest.memberships.map((source) => ({
+			schema: chosen.rls.schema,
+			scope: chosen.scope,
+			idType: chosen.idType,
+			memberships: scopeMemberships(chosen.manifest, chosen.scope).sources.map((source) => ({
 				table: source.table,
 				userColumn: source.user.column,
 				scope: source.scope,
@@ -251,6 +292,112 @@ function entitlementsMode(config, project) {
 	};
 }
 /**
+* The `permdock` access model's helpers, read from the manifest whatever
+* `entitlements` says: `rls.schema`, the root scope (or
+* `kits.access.permdock.scope`, which the manifest must declare) and that
+* scope's id type. `off` when another model is chosen. Without a PermDock
+* project or a usable manifest the model is invalid, never a default.
+*/
+function accessPermdockMode(config, project) {
+	const access = config.kits.access;
+	if (access?.model !== "permdock") return { kind: "off" };
+	const optOut = "or choose another kits.access.model.";
+	if (!project) return {
+		kind: "invalid",
+		problem: `kits.access.model is "permdock", but there is no PermDock project here (no permdock.config.ts and no manifest). Run \`permdock supabase inspect --out\` to write the manifest, ${optOut}`
+	};
+	const chosen = manifestScope(project, access.permdock?.scope, {
+		subject: "the permdock access model",
+		helpers: "permission helpers",
+		setting: "kits.access.permdock",
+		optOut
+	});
+	if (chosen.kind === "invalid") return chosen;
+	const schema = access.permdock?.schema;
+	if (schema !== void 0 && schema !== chosen.rls.schema) return {
+		kind: "invalid",
+		problem: `kits.access.permdock.schema is "${schema}", but ${project.manifestPath} puts PermDock's helpers in "${chosen.rls.schema}". Set it to "${chosen.rls.schema}", or remove it to use the manifest's.`
+	};
+	const idType = access.idType === void 0 ? void 0 : kitIdType(access.idType);
+	if (idType !== void 0 && idType !== chosen.idType) return {
+		kind: "invalid",
+		problem: `kits.access.idType is "${access.idType}", but ${project.manifestPath} gives scope "${chosen.scope}" the type ${chosen.idType}. Set kits.access.idType to "${chosen.idType}", or remove it to use the manifest's.`
+	};
+	return {
+		kind: "permdock",
+		access: {
+			schema: chosen.rls.schema,
+			scope: chosen.scope,
+			idType: chosen.idType
+		}
+	};
+}
+const ROW_CONDITIONS_FIX = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
+const REGENERATE_FIX = "Regenerate it with a current `permdock catalog`, which writes rowConditions for every permission.";
+/**
+* Why the SQL helpers can't be trusted with `key`, or `undefined` when the
+* catalog marks it `rowConditions: false`. An entry without the flag and a
+* key the catalog doesn't list are unknown, so they count as unsafe.
+*/
+function unsafeKey(catalog, key, catalogPath) {
+	const status = permdockKeyStatus(catalog, key);
+	switch (status) {
+		case "scope-only": return;
+		case "row-conditions": return {
+			status,
+			reason: `has row conditions in ${catalogPath}`,
+			fix: ROW_CONDITIONS_FIX
+		};
+		case "no-flag": return {
+			status,
+			reason: `has no rowConditions flag in ${catalogPath}, so whether it has row conditions is unknown`,
+			fix: REGENERATE_FIX
+		};
+		case "missing": return {
+			status,
+			reason: `is not in ${catalogPath}`,
+			fix: REGENERATE_FIX
+		};
+		default: return status;
+	}
+}
+/**
+* Checks the keys the kit modules pass to PermDock's helpers against
+* `permissions.catalog.json`, with the statuses bucket policies use: only
+* `rowConditions: false` passes. A missing or unreadable catalog is a
+* problem too, since every key is then unknown.
+*/
+function kitKeyProblems(project, keys, access) {
+	if (keys.length === 0) return [];
+	const catalog = project.catalog;
+	if (!catalog) {
+		const unreadable = project.problems.find((problem) => problem.startsWith(project.catalogPath));
+		return [{
+			target: project.catalogPath,
+			message: unreadable ? `Could not read PermDock's catalog: ${unreadable}. The permdock access model passes ${keys.length} kit permission keys to PermDock's helpers, so whether they have row conditions is unknown. Run \`permdock catalog\` with a current PermDock.` : `The permdock access model passes ${keys.length} kit permission keys to PermDock's helpers, but there is no ${project.catalogPath}, so whether they have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`
+		}];
+	}
+	return keys.flatMap((entry) => {
+		const problem = unsafeKey(catalog, entry.key, project.catalogPath);
+		if (!problem) return [];
+		const helper = entry.scope === "platform" ? `${access.schema}.permdock_has` : `${access.schema}.permitted_${access.scope}_ids`;
+		const setting = `kits.${entry.module}.permissions.${entry.action}`;
+		const fix = problem.status === "row-conditions" ? `PermDock's SQL helpers check role and scope, not row conditions, so the module would grant it everywhere in the scope. Set ${setting} to a permission whose catalog entry has rowConditions: false.` : `${problem.fix} If PermDock doesn't define it, set ${setting} to a key the catalog lists.`;
+		return [{
+			target: setting,
+			message: `The ${entry.module} module checks "${entry.key}" (${entry.action}) with ${helper}, but it ${problem.reason}. ${fix}`
+		}];
+	});
+}
+/** A helper the `permdock` access model calls, as `schema.name`, and the role it runs as. */
+const accessRequirements = (access) => [{
+	helper: `${access.schema}.permitted_${access.scope}_ids`,
+	role: "authenticated"
+}, {
+	helper: `${access.schema}.permdock_has`,
+	role: "authenticated"
+}];
+/**
 * The helpers the `entitlements` module calls for the chosen scope:
 * `member_<scope>_ids` from `has_entitlement` as `authenticated`, and
 * `member_<scope>_ids_for` from `feature_claims`, which PermDock's hook runs
@@ -286,4 +433,4 @@ async function compiledReadSets(config) {
 	return compileReadSets(await loadReadSets(config));
 }
 //#endregion
-export { parseHookMarker as a, parseGrantsMarker as i, entitlementRequirements as n, permdockSource as o, entitlementsMode as r, readPermdock as s, compiledReadSets as t };
+export { entitlementsMode as a, parseHookMarker as c, scopeMemberships as d, unsafeKey as f, entitlementRequirements as i, permdockSource as l, accessPermdockMode as n, kitKeyProblems as o, accessRequirements as r, parseGrantsMarker as s, compiledReadSets as t, readPermdock as u };

package/dist/cli/{run-BKR2W_79.js → run-Bo_NLT5n.js}

@@ -2,7 +2,7 @@ import { n as __toESM } from "./rolldown-runtime-BPOCksWG.js";
 import { c as parseArgs$2, i as joinRepeated, l as renderUsage, n as cliContext, o as listArgs, s as defineCommand, t as GLOBAL_ARGS, u as runCommand } from "./command-CK14fP91.js";
 import { n as CliError, r as toCliError } from "./errors-4v4DTtda.js";
 import { n as highlight, r as painter } from "./style-C0NFdJRL.js";
-import { t as VERSION } from "./version-BDJuO0UR.js";
+import { t as VERSION } from "./version-BCtlgDQx.js";
 import { stripVTControlCharacters } from "node:util";
 import { resolve } from "node:path";
 //#region src/cli/legacy.ts
@@ -134,11 +134,11 @@ function renderError(error, options) {
 //#region src/cli/run.ts
 const COMMANDS = /* @__PURE__ */ new Map([
 	["init", {
-		load: () => import("./init-Saf5-R9T.js").then((m) => m.initCommand),
+		load: () => import("./init-DMa6M7hV.js").then((m) => m.initCommand),
 		description: "Writes better-supabase.config.ts, src/lib/supabase/index.ts and glue for the frameworks in package.json"
 	}],
 	["add", {
-		load: () => import("./init-Saf5-R9T.js").then((m) => m.addCommand),
+		load: () => import("./init-DMa6M7hV.js").then((m) => m.addCommand),
 		description: "Adds glue for an integration to an existing project"
 	}],
 	["env", {
@@ -154,11 +154,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Installs the Agent Skills that ship with this version of better-supabase"
 	}],
 	["gen", {
-		load: () => import("./gen-BJc9vdyu.js").then((m) => m.genCommand),
+		load: () => import("./gen-CIdSQZad.js").then((m) => m.genCommand),
 		description: "Writes database.types.ts, generated.ts and its metadata module from the database"
 	}],
 	["introspect", {
-		load: () => import("./introspect--H7oGmcd.js").then((m) => m.introspectCommand),
+		load: () => import("./introspect-BKlaIu_M.js").then((m) => m.introspectCommand),
 		description: "Saves the database schema as a snapshot for offline gen"
 	}],
 	["openapi", {
@@ -170,11 +170,11 @@ const COMMANDS = /* @__PURE__ */ new Map([
 		description: "Renders the fixtures from defineSeed() (better-supabase/testing) to SQL"
 	}],
 	["doctor", {
-		load: () => import("./doctor-L7Z8mYTx.js").then((m) => m.doctorCommand),
+		load: () => import("./doctor-C_A-KEAz.js").then((m) => m.doctorCommand),
 		description: "Checks RLS, indexes, drift, auth config and env files; exits 1 on errors, or on warnings with --strict"
 	}],
 	["sql", {
-		load: () => import("./sql-DzPbfngx.js").then((m) => m.sqlCommand),
+		load: () => import("./sql-CVx-1O8G.js").then((m) => m.sqlCommand),
 		description: "Lists, adds, syncs, upgrades and prints SQL kit modules"
 	}],
 	["codemod", {

package/dist/cli/{sql-DzPbfngx.js → sql-CVx-1O8G.js}

@@ -3,11 +3,11 @@ import { r as writeIfChanged, t as display } from "./io-k41_z-jT.js";
 import { i as plain, r as painter } from "./style-C0NFdJRL.js";
 import { f as readSupabaseToml, p as schemaPaths, u as migrationCommand } from "./config-CPVpXP5I.js";
 import { t as fileDiff } from "./diff-SjkO5rNr.js";
-import { o as permdockSource, r as entitlementsMode, s as readPermdock, t as compiledReadSets } from "./read-sets-BfMQcKy8.js";
+import { a as entitlementsMode, l as permdockSource, n as accessPermdockMode, o as kitKeyProblems, t as compiledReadSets, u as readPermdock } from "./read-sets-VQcPgxU9.js";
 import { dirname, join, relative, resolve, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { readFile, readdir } from "node:fs/promises";
-import { SQL_MODULES, contractSignature, customContracts, kitFileVersion, kitLayout, moduleBody, renderKit, resolveModules, sameKitFile, upgradePlan } from "better-supabase/sql";
+import { SQL_MODULES, contractSignature, customContracts, kitFilePaths, kitFileVersion, kitLayout, kitPermissionKeys, moduleBody, renderKit, resolveModules, sameKitFile, upgradePlan } from "better-supabase/sql";
 //#region src/cli/commands/sql.ts
 const SQL_ARGS = {
 	action: {
@@ -53,14 +53,39 @@ async function permdockFor(config, names) {
 		default: return mode;
 	}
 }
+/**
+* PermDock's helpers for the `access` module's `permdock` model, read from
+* the manifest whatever `entitlements` says. When `names` resolve to
+* `access`, an invalid mode throws, and so does a kit permission key the
+* catalog doesn't mark `rowConditions: false`. `sql list` (no `names`)
+* doesn't render, so it doesn't throw.
+*/
+async function accessPermdockFor(config, names) {
+	const project = await readPermdock(config.root, config.permdock);
+	const mode = accessPermdockMode(config, project);
+	const renders = names !== void 0 && resolveModules(names, {}).some((module) => module.name === "access");
+	switch (mode.kind) {
+		case "off": return;
+		case "permdock": {
+			if (!renders || !project) return mode.access;
+			const problems = kitKeyProblems(project, kitPermissionKeys(config.kits, names), mode.access);
+			if (problems.length > 0) throw new TypeError(problems.map((problem) => problem.message).join("\n"));
+			return mode.access;
+		}
+		case "invalid":
+			if (!renders) return void 0;
+			throw new TypeError(mode.problem);
+		default: return mode;
+	}
+}
 async function layout(config, args, names) {
-	return kitLayout(config, args["tests-dir"], [], await permdockFor(config, names));
+	return kitLayout(config, args["tests-dir"], [], await permdockFor(config, names), await accessPermdockFor(config, names));
 }
 /** The layout, with `config.readSets` compiled when `names` includes `read-sets`. */
 async function layoutFor(config, args, names) {
 	const permdock = await permdockFor(config, names);
 	const needsReadSets = resolveModules(names, { ...permdock ? { permdock } : {} }).some((module) => module.name === "read-sets");
-	return kitLayout(config, args["tests-dir"], needsReadSets ? await compiledReadSets(config) : [], permdock);
+	return kitLayout(config, args["tests-dir"], needsReadSets ? await compiledReadSets(config) : [], permdock, await accessPermdockFor(config, names));
 }
 /**
 * The migrations folder next to the `config.toml` found walking up from
@@ -231,7 +256,7 @@ async function runSql(config, args, paint = plain) {
 	switch (action) {
 		case "list": {
 			const kit = await layout(config, args);
-			const files = new Map(renderKit(Object.keys(SQL_MODULES), kit).filter((file) => file.kind !== "data").map((file) => [file.module, file.path]));
+			const files = kitFilePaths(Object.keys(SQL_MODULES), kit);
 			return {
 				code: 0,
 				output: `${Object.values(SQL_MODULES).map((module) => {

package/dist/cli/{version-BDJuO0UR.js → version-BCtlgDQx.js}

@@ -1,4 +1,4 @@
 //#region src/cli/version.ts
-const VERSION = "0.5.0";
+const VERSION = "0.5.1";
 //#endregion
 export { VERSION as t };

package/dist/client/index.js

@@ -1,5 +1,5 @@
 import { n as decodeJwtPayload } from "../base64-D2gsioCY.js";
-import { r as userContext } from "../impersonation-VfaGc4Q_.js";
+import { r as userContext } from "../impersonation-BgSHAYLf.js";
 import { EnvValidationError, parseEnv } from "../env/index.js";
 import { t as createQueries } from "../query-CCbo44lG.js";
 import { createBrowserClient } from "@supabase/ssr";

package/dist/config/index.d.ts

@@ -1,4 +1,4 @@
 import { o as Casing } from "../types-Dnf_wRDz.js";
-import { $ as GeneratorMetadata, A as VectorSearchConfig, B as CatalogFunction, C as SoftDeleteConfig, D as TenantConfig, E as TableConfig, F as CatalogCheck, G as CatalogTable, H as CatalogGrant, I as CatalogColumn, J as ExtrasFunction, K as CatalogTrigger, L as CatalogColumnGrant, M as resolveConfig, N as resolveJsonSchema, O as TimestampsConfig, P as Catalog, Q as ForeignKeyAction, R as CatalogEnum, S as SeedConfig, T as SqlConfig, U as CatalogIndex, V as CatalogFunctionArg, W as CatalogPolicy, X as ExtrasHookFunction, Y as ExtrasHook, Z as ExtrasTable, _ as PluginFlagsConfig, a as ClaimsConfig, at as DEFAULT_ACTIVE_TENANT, b as ResolvedConfig, c as EntitlementsConfig, ct as KitsConfig, d as Generator, et as Snapshot, f as GeneratorInput, g as PermdockPathsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, it as ActiveTenantSource, j as defineConfig, k as VectorDistance, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, nt as SnapshotExtras, o as CodecsConfig, ot as KitMode, p as JsonSchemaSource, q as CatalogUnique, r as BucketConfig, rt as AccessKitConfig, s as DoctorConfig, st as KitModuleConfig, t as ActorConfig, tt as SnapshotBucket, u as GeneratedFile, v as Privilege, w as SourceConfig, x as ResolvedExpose, y as RealtimeConfig, z as CatalogForeignKey } from "../config-T_ejwyd3.js";
-import { a as JsonSchemaGeneratorOptions, c as DEFAULT_CLAIMS, i as valibot, l as tenantClaimPaths, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions } from "../index-Dxn2a5cw.js";
+import { $ as GeneratorMetadata, A as VectorSearchConfig, B as CatalogFunction, C as SoftDeleteConfig, D as TenantConfig, E as TableConfig, F as CatalogCheck, G as CatalogTable, H as CatalogGrant, I as CatalogColumn, J as ExtrasFunction, K as CatalogTrigger, L as CatalogColumnGrant, M as resolveConfig, N as resolveJsonSchema, O as TimestampsConfig, P as Catalog, Q as ForeignKeyAction, R as CatalogEnum, S as SeedConfig, T as SqlConfig, U as CatalogIndex, V as CatalogFunctionArg, W as CatalogPolicy, X as ExtrasHookFunction, Y as ExtrasHook, Z as ExtrasTable, _ as PluginFlagsConfig, a as ClaimsConfig, at as DEFAULT_ACTIVE_TENANT, b as ResolvedConfig, c as EntitlementsConfig, ct as KitsConfig, d as Generator, et as Snapshot, f as GeneratorInput, g as PermdockPathsConfig, h as OpenApiConfig, i as CONFIG_SCHEMA_URL, it as ActiveTenantSource, j as defineConfig, k as VectorDistance, l as ExposeConfig, m as JsonTypeConfig, n as BetterSupabaseConfig, nt as SnapshotExtras, o as CodecsConfig, ot as KitMode, p as JsonSchemaSource, q as CatalogUnique, r as BucketConfig, rt as AccessKitConfig, s as DoctorConfig, st as KitModuleConfig, t as ActorConfig, tt as SnapshotBucket, u as GeneratedFile, v as Privilege, w as SourceConfig, x as ResolvedExpose, y as RealtimeConfig, z as CatalogForeignKey } from "../config-Bv7gvfzC.js";
+import { a as JsonSchemaGeneratorOptions, c as DEFAULT_CLAIMS, i as valibot, l as tenantClaimPaths, n as zod, o as buildJsonSchema, r as ValibotGeneratorOptions, s as jsonSchema, t as ZodGeneratorOptions } from "../index-CWMDdEr4.js";
 export { type AccessKitConfig, type ActiveTenantSource, type ActorConfig, type BetterSupabaseConfig, type BucketConfig, CONFIG_SCHEMA_URL, type Casing, type Catalog, type CatalogCheck, type CatalogColumn, type CatalogColumnGrant, type CatalogEnum, type CatalogForeignKey, type CatalogFunction, type CatalogFunctionArg, type CatalogGrant, type CatalogIndex, type CatalogPolicy, type CatalogTable, type CatalogTrigger, type CatalogUnique, type ClaimsConfig, type CodecsConfig, DEFAULT_ACTIVE_TENANT, DEFAULT_CLAIMS, type DoctorConfig, type EntitlementsConfig, type ExposeConfig, type ExtrasFunction, type ExtrasHook, type ExtrasHookFunction, type ExtrasTable, type ForeignKeyAction, type GeneratedFile, type Generator, type GeneratorInput, type GeneratorMetadata, type JsonSchemaGeneratorOptions, type JsonSchemaSource, type JsonTypeConfig, type KitMode, type KitModuleConfig, type KitsConfig, type OpenApiConfig, type PermdockPathsConfig, type PluginFlagsConfig, type Privilege, type RealtimeConfig, type ResolvedConfig, type ResolvedExpose, type SeedConfig, type Snapshot, type SnapshotBucket, type SnapshotExtras, type SoftDeleteConfig, type SourceConfig, type SqlConfig, type TableConfig, type TenantConfig, type TimestampsConfig, type ValibotGeneratorOptions, type VectorDistance, type VectorSearchConfig, type ZodGeneratorOptions, buildJsonSchema, defineConfig, jsonSchema, resolveConfig, resolveJsonSchema, tenantClaimPaths, valibot, zod };

package/dist/{config-T_ejwyd3.d.ts → config-Bv7gvfzC.d.ts}

@@ -96,7 +96,16 @@ interface AccessKitConfig extends KitModuleConfig {
     readonly tenantIdsWith?: string;
     readonly isPlatform?: string;
     readonly canUser?: string;
-    /** `{tenant}` and `{role}`: whether the caller may assign the role. Defaults to true. */
+    /**
+     * `{tenant}` and `{role}`: whether the caller may assign the role.
+     * Required by the `custom` model. For the `permdock` model, use
+     * PermDock's assignment rule:
+     * `'permdock.permdock_can_assign({role}, {tenant}::text)'` (with the
+     * manifest's `rls.schema`). Without it, the `permdock` model lets only
+     * the service role assign roles: PermDock projects don't install the
+     * `tenant` module (doctor BS407), whose owner-role fallback is the only
+     * other rule, and doctor BS411 warns.
+     */
     readonly canAssign?: string;
     /** `{user}`: the permission claim for the access token hook. */
     readonly permissionClaims?: string;

package/dist/edge/index.d.ts

@@ -1,7 +1,7 @@
 import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-D2OQl62-.js";
-import { a as ResourceRouteOptions } from "../resource-D8iqWMr-.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
+import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
 //#region src/edge/index.d.ts
 export interface CorsOptions {
   /** Allowed origins, or `*`. Defaults to `*`. */

package/dist/edge/index.js

@@ -1,7 +1,7 @@
 import { n as dbError } from "../errors-DtwXa6b8.js";
 import { a as problemResponse } from "../problem-BW1KhzSG.js";
-import { d as guard, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-Csx2sRjg.js";
-import { t as defineResource } from "../resource-CRxxwkQq.js";
+import { d as guard, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 //#region src/edge/index.ts
 const SUPABASE_CORS_HEADERS = [
 	"authorization",

package/dist/{entitlements-DUxU4oHe.d.ts → entitlements-BiJZ4t49.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-BEf0diC5.js";
+import { t as AuthSession } from "./view-CbgObAeb.js";
 //#region src/auth/entitlements.d.ts
 /**
  * One entry of the `memberships` claim, in PermDock's shape. PermDock strips

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
 import { P as TableKey, n as AnyFunctions, r as AnyModels } from "../types-Dnf_wRDz.js";
 import { t as BetterSupabase } from "../define-Bp_BZa5h.js";
-import { r as AuthState } from "../resolve-C15TJq77.js";
-import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-D2OQl62-.js";
-import { a as ResourceRouteOptions } from "../resource-D8iqWMr-.js";
+import { o as AuthState } from "../impersonation-BmePsuxz.js";
+import { f as ServerContext, n as GuardOptions, p as ServerOptions, r as MiddlewareOptions, u as BetterServer } from "../respond-BR1fJWOB.js";
+import { a as ResourceRouteOptions } from "../resource-DNRFP7KR.js";
 import { Context, ErrorHandler, Hono, MiddlewareHandler } from "hono";
 //#region src/hono/index.d.ts
 /** Hono `Env` with the request's better-supabase context in `c.var`. */

package/dist/hono/index.js

@@ -1,7 +1,7 @@
 import { n as dbError, r as dbErrorOf } from "../errors-DtwXa6b8.js";
 import { a as problemResponse } from "../problem-BW1KhzSG.js";
-import { d as guard, i as rememberVerifiedFor, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-Csx2sRjg.js";
-import { t as defineResource } from "../resource-CRxxwkQq.js";
+import { d as guard, i as rememberVerifiedFor, n as createServer, p as respond, r as extendServer, u as defaultExpose } from "../server-B1mZ7CgQ.js";
+import { t as defineResource } from "../resource-mqfJW4YF.js";
 import { Hono } from "hono";
 import { HTTPException } from "hono/http-exception";
 //#region src/hono/index.ts

package/dist/impersonation-BgSHAYLf.js

@@ -0,0 +1,133 @@
+//#region src/auth/actor.ts
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+const INVALID = {
+	ok: false,
+	reason: "invalid-chain"
+};
+function actorAt(outer, id) {
+	const kind = outer["kind"];
+	const sessionId = outer["session_id"];
+	const readOnly = outer["read_only"];
+	const reason = outer["reason"];
+	if (kind === "support" || kind === void 0 && sessionId !== void 0) {
+		if (typeof sessionId !== "string" || sessionId === "") return INVALID;
+		if (readOnly !== void 0 && typeof readOnly !== "boolean") return INVALID;
+		return {
+			ok: true,
+			actor: {
+				kind: "support",
+				id,
+				sessionId,
+				readOnly: readOnly ?? true,
+				...typeof reason === "string" ? { reason } : {}
+			}
+		};
+	}
+	if (kind === "impersonation") return {
+		ok: true,
+		actor: {
+			kind: "impersonation",
+			id,
+			...typeof reason === "string" ? { reason } : {}
+		}
+	};
+	if (kind !== void 0) return INVALID;
+	return {
+		ok: true,
+		actor: {
+			kind: "oauth-client",
+			id,
+			chain: copyAct(outer)
+		}
+	};
+}
+/**
+* Reads only `act` and `client_id`, the way PermDock's `actorOf` does. An
+* `act` that is not a chain of objects each with a non-empty `sub`, a
+* `kind` other than `support` or `impersonation`, or a support level without
+* a `session_id` is `{ ok: false }`: the session must not pass as the user
+* alone.
+*/
+function actorOf(claims) {
+	const outer = claims["act"];
+	if (outer !== void 0) {
+		if (!isRecord(outer)) return INVALID;
+		const id = outer["sub"];
+		if (typeof id !== "string" || id === "") return INVALID;
+		let level = outer["act"];
+		while (level !== void 0) {
+			if (!isRecord(level)) return INVALID;
+			const sub = level["sub"];
+			if (typeof sub !== "string" || sub === "") return INVALID;
+			level = level["act"];
+		}
+		return actorAt(outer, id);
+	}
+	const client = claims["client_id"];
+	if (typeof client === "string" && client !== "") return {
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	};
+	return { ok: true };
+}
+/** The OAuth `scope` claim (a space-separated string or a list); `undefined` when empty. */
+function delegationOf(claims) {
+	const scope = claims["scope"];
+	const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : Array.isArray(scope) ? scope.filter((item) => typeof item === "string") : [];
+	return scopes.length > 0 ? { scopes } : void 0;
+}
+//#endregion
+//#region src/auth/impersonation.ts
+/** The `act` claim for an impersonated session. */
+function actClaim(options) {
+	return {
+		kind: "impersonation",
+		sub: options.actor,
+		reason: options.reason
+	};
+}
+/**
+* The admin in `claims.act`: a support session or an impersonated session
+* (`actorOf` reads the same level, so the two always agree). `undefined`
+* for a normal session, an OAuth client or agent chain, and an invalid `act`.
+*/
+function impersonatorOf(claims) {
+	const outcome = actorOf(claims);
+	const actor = outcome.ok ? outcome.actor : void 0;
+	if (actor === void 0) return void 0;
+	switch (actor.kind) {
+		case "oauth-client": return;
+		case "support":
+		case "impersonation": return { ...actor };
+		default: return actor;
+	}
+}
+/**
+* The repository context of a signed-in user: the actor, with the
+* impersonator from `act`, and the claims. Every adapter builds it here, so
+* plugins see the same actor on the server, in middleware and in the browser.
+*/
+function userContext(user, claims) {
+	const impersonator = impersonatorOf(claims);
+	return {
+		actor: {
+			id: user.id,
+			kind: "user",
+			...user.role ? { role: user.role } : {},
+			...user.email ? { email: user.email } : {},
+			...impersonator ? { impersonator: impersonator.id } : {}
+		},
+		claims
+	};
+}
+//#endregion
+export { delegationOf as a, actorOf as i, impersonatorOf as n, userContext as r, actClaim as t };

package/dist/{resolve-C15TJq77.d.ts → impersonation-BmePsuxz.d.ts}

@@ -179,4 +179,28 @@ declare function resolveAuth(request: Request, options: ResolveAuthOptions): Pro
 /** The repository context (`actor`, `claims`) for an auth state. */
 declare function authContext(auth: AuthState): RequestContext;
 //#endregion
-export { readSession as _, ResolveAuthOptions as a, writeSession as b, clientIp as c, CookieOptions as d, CookieRecord as f, parseCookies as g, applyCookieWrites as h, InvalidReason as i, resolveAuth as l, StoredSession as m, AuthResolver as n, ResolvedState as o, CookieWrite as p, AuthState as r, authContext as s, AuthResolution as t, AUTH_CACHE_HEADERS as u, serializeCookie as v, sessionCookieName as y };
+//#region src/auth/impersonation.d.ts
+/** The admin acting as the user, from the RFC 8693 `act` claim. */
+interface Impersonator {
+  /** `act.kind`: a support session or an impersonated session. */
+  readonly kind: "support" | "impersonation";
+  readonly id: string;
+  readonly reason?: string;
+  /** The support session, when the admin started one (`act.session_id`). */
+  readonly sessionId?: string;
+  /** Whether the support session blocks writes (`act.read_only`). */
+  readonly readOnly?: boolean;
+}
+/** `actingAs(userId, claims, { actor, reason })`: who acts, and why (recorded by the audit module). */
+interface ImpersonationOptions {
+  readonly actor: string;
+  readonly reason: string;
+}
+/**
+ * The admin in `claims.act`: a support session or an impersonated session
+ * (`actorOf` reads the same level, so the two always agree). `undefined`
+ * for a normal session, an OAuth client or agent chain, and an invalid `act`.
+ */
+declare function impersonatorOf(claims: Readonly<Record<string, unknown>>): Impersonator | undefined;
+//#endregion
+export { writeSession as C, sessionCookieName as S, StoredSession as _, AuthResolver as a, readSession as b, ResolveAuthOptions as c, clientIp as d, resolveAuth as f, CookieWrite as g, CookieRecord as h, AuthResolution as i, ResolvedState as l, CookieOptions as m, Impersonator as n, AuthState as o, AUTH_CACHE_HEADERS as p, impersonatorOf as r, InvalidReason as s, ImpersonationOptions as t, authContext as u, applyCookieWrites as v, serializeCookie as x, parseCookies as y };