better-supabase 0.5.0 → 0.5.1

package/dist/sql/index.js

@@ -6,7 +6,7 @@ import { n as resolveKitModule, o as resolveJsonSchema } from "../kits-CGLLrNPd.
 import { i as sqlString, r as sqlIdent } from "../template-TxrGI5jR.js";
 import { t as compileSql } from "../sql-Coh6n4cC.js";
 import { i as permdockKeys, r as permdockKeyStatus, t as PERMDOCK_SCHEMA } from "../permdock-sql-DgOfeixi.js";
-import { t as VERSION } from "../version-DM_Roffb.js";
+import { t as VERSION } from "../version-DOYTYwHP.js";
 //#region src/sql/context.ts
 /** The scope id types kit modules render. */
 const KIT_ID_TYPES = [
@@ -249,6 +249,135 @@ function migrationOptionUses(kits = {}) {
 	});
 }
 //#endregion
+//#region src/sql/modules/access-model.ts
+/**
+* The `roles` model's defaults. Kit actions name these keys (see
+* `KIT_PERMISSIONS`); `*` grants everything and `prefix.*` a prefix.
+*/
+const DEFAULT_ROLES = {
+	owner: ["*"],
+	admin: [
+		"organization.read",
+		"organization.update",
+		"members.*",
+		"audit.read",
+		"webhooks.*",
+		"notifications.*",
+		"billing.*"
+	],
+	member: [
+		"organization.read",
+		"members.read",
+		"notifications.read"
+	],
+	viewer: ["organization.read"]
+};
+/**
+* The permission key each kit action checks by default, overridable per
+* module in `kits.<name>.permissions`. Keys are `<area>.<verb>`, with `read`
+* for viewing; platform-wide actions use the `platform` area or a key that
+* `is_platform()` checks.
+*/
+const KIT_PERMISSIONS = {
+	organizations: {
+		update: "organization.update",
+		delete: "organization.delete",
+		removeMember: "members.remove",
+		updateRole: "members.update_role",
+		transferOwnership: "organization.transfer_ownership"
+	},
+	invitations: {
+		invite: "members.invite",
+		revoke: "members.invite",
+		view: "members.invite",
+		invitePlatform: "platform.invite"
+	},
+	audit: {
+		view: "audit.read",
+		viewAll: "audit.read"
+	},
+	"support-sessions": {
+		start: "support.start",
+		view: "support.read",
+		revoke: "support.revoke"
+	},
+	notifications: {
+		send: "notifications.send",
+		read: "notifications.read"
+	},
+	"webhooks-out": {
+		manage: "webhooks.manage",
+		view: "webhooks.read"
+	}
+};
+/**
+* Where each kit action checks its key: `tenant` through `member_can`,
+* `can` or `tenant_ids_with` (PermDock's `permitted_<scope>_ids`), and
+* `platform` through `is_platform` or `platform_can` (`permdock_has`).
+*/
+const KIT_PERMISSION_SCOPES = {
+	organizations: {
+		update: "tenant",
+		delete: "tenant",
+		removeMember: "tenant",
+		updateRole: "tenant",
+		transferOwnership: "tenant"
+	},
+	invitations: {
+		invite: "tenant",
+		revoke: "tenant",
+		view: "tenant",
+		invitePlatform: "platform"
+	},
+	audit: {
+		view: "tenant",
+		viewAll: "platform"
+	},
+	"support-sessions": {
+		start: "platform",
+		view: "platform",
+		revoke: "platform"
+	},
+	notifications: {
+		send: "tenant",
+		read: "tenant"
+	},
+	"webhooks-out": {
+		manage: "tenant",
+		view: "tenant"
+	}
+};
+function accessModel(ctx) {
+	return ctx.kits.access?.model ?? "roles";
+}
+function rolesOf(ctx) {
+	return ctx.kits.access?.roles ?? DEFAULT_ROLES;
+}
+const roleNames = (ctx) => Object.keys(rolesOf(ctx));
+/**
+* The scope name tenants use in `can(scope, id, permission)`
+* (`kits.access.options.scope`, default `organization`). `tenant` is
+* accepted too.
+*/
+const tenantScope = (ctx) => ctx.of("access").text("scope", "organization");
+/** Whether the catalog has platform roles, and so platform invitations. */
+function hasPlatformRoles(ctx) {
+	return accessModel(ctx) === "catalog" && ctx.of("access").hasTable("platformAssignments");
+}
+/**
+* Whether catalog role row `alias` is a tenant or a platform role, or
+* `undefined` when roles carry no scope. Managed catalogs have a `scope`
+* column; an adopted one maps `roles.scope` and names its values in
+* `kits.access.options.tenantRoleScope` and `platformRoleScope`.
+*/
+function roleScopeIs(ctx, alias, scope) {
+	if (accessModel(ctx) !== "catalog") return void 0;
+	const access = ctx.of("access");
+	if (!access.manages && access.config.columns["roles"]?.["scope"] == null) return;
+	const value = scope === "tenant" ? access.text("tenantRoleScope", "tenant") : access.text("platformRoleScope", "platform");
+	return `${alias}.${access.col("roles", "scope")}::text = ${sqlString(value)}`;
+}
+//#endregion
 //#region src/sql/shared.ts
 const SCHEMA = `create schema if not exists better_supabase;
 grant usage on schema better_supabase to anon, authenticated, service_role;`;
@@ -459,98 +588,6 @@ end;
 $$;
 revoke execute on function better_supabase.replace_equivalent_triggers(regclass, text, text, boolean) from public, anon, authenticated;`;
 //#endregion
-//#region src/sql/modules/access-model.ts
-/**
-* The `roles` model's defaults. Kit actions name these keys (see
-* `KIT_PERMISSIONS`); `*` grants everything and `prefix.*` a prefix.
-*/
-const DEFAULT_ROLES = {
-	owner: ["*"],
-	admin: [
-		"organization.read",
-		"organization.update",
-		"members.*",
-		"audit.read",
-		"webhooks.*",
-		"notifications.*",
-		"billing.*"
-	],
-	member: [
-		"organization.read",
-		"members.read",
-		"notifications.read"
-	],
-	viewer: ["organization.read"]
-};
-/**
-* The permission key each kit action checks by default, overridable per
-* module in `kits.<name>.permissions`. Keys are `<area>.<verb>`, with `read`
-* for viewing; platform-wide actions use the `platform` area or a key that
-* `is_platform()` checks.
-*/
-const KIT_PERMISSIONS = {
-	organizations: {
-		update: "organization.update",
-		delete: "organization.delete",
-		removeMember: "members.remove",
-		updateRole: "members.update_role",
-		transferOwnership: "organization.transfer_ownership"
-	},
-	invitations: {
-		invite: "members.invite",
-		revoke: "members.invite",
-		view: "members.invite",
-		invitePlatform: "platform.invite"
-	},
-	audit: {
-		view: "audit.read",
-		viewAll: "audit.read"
-	},
-	"support-sessions": {
-		start: "support.start",
-		view: "support.read",
-		revoke: "support.revoke"
-	},
-	notifications: {
-		send: "notifications.send",
-		read: "notifications.read"
-	},
-	"webhooks-out": {
-		manage: "webhooks.manage",
-		view: "webhooks.read"
-	}
-};
-function accessModel(ctx) {
-	return ctx.kits.access?.model ?? "roles";
-}
-function rolesOf(ctx) {
-	return ctx.kits.access?.roles ?? DEFAULT_ROLES;
-}
-const roleNames = (ctx) => Object.keys(rolesOf(ctx));
-/**
-* The scope name tenants use in `can(scope, id, permission)`
-* (`kits.access.options.scope`, default `organization`). `tenant` is
-* accepted too.
-*/
-const tenantScope = (ctx) => ctx.of("access").text("scope", "organization");
-/** Whether the catalog has platform roles, and so platform invitations. */
-function hasPlatformRoles(ctx) {
-	return accessModel(ctx) === "catalog" && ctx.of("access").hasTable("platformAssignments");
-}
-/**
-* Whether catalog role row `alias` is a tenant or a platform role, or
-* `undefined` when roles carry no scope. Managed catalogs have a `scope`
-* column; an adopted one maps `roles.scope` and names its values in
-* `kits.access.options.tenantRoleScope` and `platformRoleScope`.
-*/
-function roleScopeIs(ctx, alias, scope) {
-	if (accessModel(ctx) !== "catalog") return void 0;
-	const access = ctx.of("access");
-	if (!access.manages && access.config.columns["roles"]?.["scope"] == null) return;
-	const value = scope === "tenant" ? access.text("tenantRoleScope", "tenant") : access.text("platformRoleScope", "platform");
-	return `${alias}.${access.col("roles", "scope")}::text = ${sqlString(value)}`;
-}
-//#endregion
 //#region src/sql/modules/access.ts
 const SERVICE = `coalesce(auth.jwt() ->> 'role', '') = 'service_role'`;
 const NOT_ACTING = `(platform_can.member is distinct from auth.uid() or auth.jwt() -> 'act' is null)`;
@@ -888,27 +925,53 @@ function permdockCanAssign(ctx) {
 	const owner = sqlString(ctx.of("organizations").text("ownerRole", "owner"));
 	return `can_assign.role <> ${owner} or better_supabase.has_org_role(can_assign.tenant, array[${owner}])`;
 }
+/**
+* PermDock's schema and scope for the `permdock` model: from the manifest
+* (`layout.accessPermdock`, which `sql add` reads), else both set in
+* `kits.access.permdock`. Never a default, so a project whose helpers live
+* elsewhere never gets functions that call helpers that don't exist.
+*/
+function permdockTarget(ctx, layout) {
+	const configured = ctx.kits.access?.permdock;
+	const manifest = layout.accessPermdock;
+	if (manifest) {
+		if (manifest.idType !== ctx.idType) throw new TypeError(`kits.access: PermDock's manifest gives scope "${manifest.scope}" the type ${manifest.idType}, but the access module renders ${ctx.idType} ids. Set kits.access.idType to "${manifest.idType}".`);
+		return {
+			schema: manifest.schema,
+			scope: manifest.scope
+		};
+	}
+	if (configured?.schema === void 0 || configured.scope === void 0) throw new TypeError("kits.access.model 'permdock' needs PermDock's manifest (`permdock supabase inspect --out`), which `better-supabase sql add` reads, or both kits.access.permdock.schema and kits.access.permdock.scope.");
+	return {
+		schema: configured.schema,
+		scope: configured.scope
+	};
+}
 function permdockFunctions(ctx, layout) {
 	const id = ctx.idType;
-	const permdock = ctx.kits.access?.permdock ?? {};
-	const schema = sqlIdent(permdock.schema ?? layout.permdock?.schema ?? "permdock");
-	const scope = permdock.scope ?? layout.permdock?.scope ?? "organization";
-	const permitted = `${schema}.${sqlIdent(`permitted_${scope}_ids`)}`;
+	const target = permdockTarget(ctx, layout);
+	const schema = sqlIdent(target.schema);
+	const permitted = `${schema}.${sqlIdent(`permitted_${target.scope}_ids`)}`;
 	return `
 -- The permdock model: PermDock's ${permitted}() and ${schema}.permdock_has(),
--- from \`permdock rls generate\`. They answer for the caller only.
+-- from \`permdock rls generate\`. They read auth.uid(), so member_can() and
+-- can_user() answer for the caller only and raise 0A000 for anyone else.
 create or replace function better_supabase.member_can(member uuid, tenant ${id}, permission text)
 returns boolean
-language sql
+language plpgsql
 stable
 security definer
 set search_path = ''
 as $$
-  select case when member is distinct from auth.uid() then null::boolean
-    else not better_supabase.user_disabled(member)
-      and not better_supabase.tenant_disabled(tenant)
-      and tenant::text in (select t.id::text from ${permitted}(permission) as t(id))
-  end
+begin
+  if member is distinct from auth.uid() then
+    raise exception 'The permdock access model answers for the caller only (kits.access.model)'
+      using errcode = '0A000', hint = 'ACCESS_CALLER_ONLY';
+  end if;
+  return not better_supabase.user_disabled(member)
+    and not better_supabase.tenant_disabled(tenant)
+    and tenant::text in (select t.id::text from ${permitted}(permission) as t(id));
+end;
 $$;
 
 create or replace function better_supabase.member_permissions(member uuid, tenant ${id})
@@ -942,8 +1005,10 @@ as $$
     and not better_supabase.tenant_disabled(t.id::${id})
 $$;
 
--- kits.access.functions.canAssign decides who assigns which role. Without
--- it, only owners assign the owner role, and only with the tenant module.
+-- kits.access.functions.canAssign decides who assigns which role, usually
+-- ${schema}.permdock_can_assign({role}, {tenant}::text). Without it, only the
+-- service role assigns roles, unless the tenant module is installed: then
+-- only owners assign the owner role and this check passes other roles.
 create or replace function better_supabase.can_assign(tenant ${id}, role text)
 returns boolean
 language sql
@@ -1115,19 +1180,25 @@ as $$
 $$;
 
 -- The same question for another user, for checks such as an inviter's
--- authority at accept time. Null when the model can't answer for others.
+-- authority at accept time. ${model === "permdock" ? "The permdock model can't answer for others." : "Null when the model can't answer for others."}
 create or replace function better_supabase.can_user(member uuid, scope text, scope_id ${id}, permission text)
 returns boolean
-language sql
+language ${model === "permdock" ? "plpgsql" : "sql"}
 stable
 security definer
 set search_path = ''
-as $$
-  select case
+as $$${model === "permdock" ? `
+begin
+  if member is distinct from auth.uid() then
+    raise exception 'The permdock access model answers for the caller only (kits.access.model)'
+      using errcode = '0A000', hint = 'ACCESS_CALLER_ONLY';
+  end if;
+  return case` : `
+  select case`}
     when can_user.scope = 'platform' then better_supabase.platform_can(can_user.member, can_user.permission)
     when can_user.scope in (${scope}, 'tenant') then better_supabase.member_can(can_user.member, can_user.scope_id, can_user.permission)
     else false
-  end
+  end${model === "permdock" ? ";\nend;" : ""}
 $$;
 
 create or replace function better_supabase.is_platform(permission text)
@@ -3582,7 +3653,9 @@ function accept(ctx) {
       and not better_supabase.can_assign_as(${inviter}, invite.${c("tenant")}, invite.${c("role")}::text) then
       ${fail("INVITATION_INVITER_REVOKED", "The person who invited you can no longer assign that role")}
     end if;` : "";
-	const recheck = inviter ? `
+	const recheck = inviter && model === "permdock" ? `
+    -- The permdock model answers for the caller only, so the inviter's
+    -- authority was checked when they invited, not here.` : inviter ? `
     if ${inviter} is not null
       and better_supabase.can_user(${inviter}, ${sqlString(tenantScope(ctx))}, invite.${c("tenant")}, ${invitePermission}) is false then
       ${fail("INVITATION_INVITER_REVOKED", "The person who invited you can no longer invite members")}
@@ -4610,13 +4683,17 @@ function notify(ctx, n) {
       )
     );
   end if;` : "";
-	const members = access ? `
+	const readFilter = accessModel(ctx) === "permdock" ? `
+  -- The permdock model answers for the caller only, so recipients are not
+  -- filtered by their read permission: the sender and notification_audience
+  -- decide who gets it.` : `
   if v_tenant is not null then
     v_recipients := array(
       select x from unnest(v_recipients) x
       where coalesce(better_supabase.member_can(x, v_tenant, ${n.readPermission}), false)
     );
-  end if;` : "";
+  end if;`;
+	const members = access ? readFilter : "";
 	const authorize = access ? `
   if not (${SERVICE_CALLER}) then
     if v_tenant is null or not coalesce(better_supabase.member_can(auth.uid(), v_tenant, ${n.sendPermission}), false) then
@@ -9452,9 +9529,14 @@ function kitContext(name, layout = {}, installed) {
 		...layout.kits ? { kits: layout.kits } : {},
 		...layout.claims ? { claims: layout.claims } : {},
 		...installed ? { installed } : {},
-		...layout.permdock ? { permdockIdType: layout.permdock.idType } : {}
+		...permdockIdType(layout)
 	});
 }
+/** The tenant id type PermDock's manifest gives, preferring the access model's scope. */
+function permdockIdType(layout) {
+	const idType = layout.accessPermdock?.idType ?? layout.permdock?.idType;
+	return idType ? { permdockIdType: idType } : {};
+}
 /** Throws on a `kits` key that names no module, or a mode a module doesn't support. */
 function checkKits(kits = {}, modules = SQL_MODULES) {
 	for (const [name, entry] of Object.entries(kits)) {
@@ -9496,6 +9578,42 @@ function kitPath(module, layout) {
 	const slug = module.name.replaceAll("-", "_");
 	return module.target === "test" ? `${testsDir}/000_better_supabase_${slug}.test.sql` : `${dir}/${prefix}_${String(ORDER.indexOf(module.name) + 1).padStart(2, "0")}_${slug}.sql`;
 }
+/**
+* The schema or test file `renderKit` writes for each of `names` and the
+* modules they pull in, without rendering: modules in custom mode have none.
+*/
+function kitFilePaths(names, layout = {}) {
+	checkKits(layout.kits);
+	const modules = resolveModules(names, layout);
+	const installed = modules.map((module) => module.name);
+	return new Map(modules.filter((module) => kitContext(module.name, layout, installed).mode !== "custom").map((module) => [module.name, kitPath(module, layout)]));
+}
+const isPermissionModule = (name) => Object.hasOwn(KIT_PERMISSIONS, name);
+/**
+* Every permission key the modules `names` install (with what they pull
+* in) check, after `kits.<module>.permissions` overrides. Modules in custom
+* mode are skipped, and so is `invitations.invitePlatform` without platform
+* roles. PermDock's doctor runs the same catalog check from its side.
+*/
+function kitPermissionKeys(kits, names) {
+	const layout = { kits };
+	checkKits(kits);
+	const modules = resolveModules(names, layout);
+	const installed = modules.map((module) => module.name);
+	return modules.flatMap((module) => {
+		const name = module.name;
+		if (!isPermissionModule(name)) return [];
+		const ctx = kitContext(name, layout, installed);
+		if (ctx.mode === "custom") return [];
+		const scopes = KIT_PERMISSION_SCOPES[name];
+		return Object.entries(KIT_PERMISSIONS[name]).flatMap(([action, fallback]) => action === "invitePlatform" && !hasPlatformRoles(ctx) ? [] : [{
+			module: name,
+			action,
+			key: ctx.permissionKey(action, fallback),
+			scope: scopes[action]
+		}]);
+	});
+}
 /** The table `kitModuleRow` writes to, created by every schema module's file. */
 const KIT_MODULES_TABLE = `
 create schema if not exists better_supabase;
@@ -9600,7 +9718,7 @@ function upgradePlan(installed, layout = {}, modules = SQL_MODULES) {
 			...layout.kits ? { kits: layout.kits } : {},
 			...layout.claims ? { claims: layout.claims } : {},
 			installed: names,
-			...layout.permdock ? { permdockIdType: layout.permdock.idType } : {}
+			...permdockIdType(layout)
 		});
 		if (ctx.mode === "custom") return [];
 		const steps = (module.upgrades ?? []).filter((step) => step.from >= entry.version && step.from < to).toSorted((a, b) => a.from - b.from).map((step) => ({
@@ -9651,9 +9769,10 @@ function realtimeRegistrations(tables, global, tenantColumn) {
 //#endregion
 //#region src/sql/layout.ts
 /** Where and how `sql add` writes kit files for this config. */
-function kitLayout(config, testsDir = config.sql.testsDir, readSets = [], permdock) {
+function kitLayout(config, testsDir = config.sql.testsDir, readSets = [], permdock, accessPermdock) {
 	return {
 		...permdock ? { permdock } : {},
+		...accessPermdock ? { accessPermdock } : {},
 		dir: config.sql.dir,
 		prefix: config.sql.prefix,
 		testsDir,
@@ -9791,4 +9910,4 @@ async function compileReadSets(sets) {
 	return Promise.all(names.map((name) => compileReadSet(byName.get(name))));
 }
 //#endregion
-export { KIT_ID_TYPES, PERMDOCK_SCHEMA, SQL_MODULES, compileReadSet, compileReadSets, contractSignature, customContracts, isKitIdType, kitDeprecations, kitFileVersion, kitIdType, kitLayout, migrationOptionUses, moduleBody, moduleVersion, permdockKeyStatus, permdockKeys, renderKit, resolveModules, sameKitFile, upgradePlan };
+export { KIT_ID_TYPES, PERMDOCK_SCHEMA, SQL_MODULES, compileReadSet, compileReadSets, contractSignature, customContracts, isKitIdType, kitDeprecations, kitFilePaths, kitFileVersion, kitIdType, kitLayout, kitPermissionKeys, migrationOptionUses, moduleBody, moduleVersion, permdockKeyStatus, permdockKeys, renderKit, resolveModules, sameKitFile, upgradePlan };

package/dist/ssr/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as readSession, a as ResolveAuthOptions, b as writeSession, d as CookieOptions, f as CookieRecord, g as parseCookies, h as applyCookieWrites, l as resolveAuth, m as StoredSession, n as AuthResolver, p as CookieWrite, r as AuthState, s as authContext, t as AuthResolution, u as AUTH_CACHE_HEADERS, v as serializeCookie, y as sessionCookieName } from "../resolve-C15TJq77.js";
-import { n as toSession, t as AuthSession } from "../view-BEf0diC5.js";
-import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-DUxU4oHe.js";
-import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-BTrQ_ZTp.js";
+import { C as writeSession, S as sessionCookieName, _ as StoredSession, a as AuthResolver, b as readSession, c as ResolveAuthOptions, f as resolveAuth, g as CookieWrite, h as CookieRecord, i as AuthResolution, m as CookieOptions, o as AuthState, p as AUTH_CACHE_HEADERS, u as authContext, v as applyCookieWrites, x as serializeCookie, y as parseCookies } from "../impersonation-BmePsuxz.js";
+import { n as toSession, t as AuthSession } from "../view-CbgObAeb.js";
+import { n as MembershipClaim, r as hasEntitlement, t as EntitlementKey } from "../entitlements-BiJZ4t49.js";
+import { n as RefreshOutcome, r as refreshSession, t as RefreshOptions } from "../refresh-CFPX0Qft.js";
 export { AUTH_CACHE_HEADERS, type AuthResolution, type AuthResolver, type AuthSession, type AuthState, type CookieOptions, type CookieRecord, type CookieWrite, type EntitlementKey, type MembershipClaim, type RefreshOptions, type RefreshOutcome, type ResolveAuthOptions, type StoredSession, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/ssr/index.js

@@ -1,3 +1,3 @@
 import { t as hasEntitlement } from "../entitlements-CTEBm7IB.js";
-import { _ as writeSession, d as AUTH_CACHE_HEADERS, f as applyCookieWrites, g as sessionCookieName, h as serializeCookie, m as readSession, n as toSession, o as authContext, p as parseCookies, u as resolveAuth, v as refreshSession } from "../view-Bq64ki8-.js";
+import { _ as writeSession, d as AUTH_CACHE_HEADERS, f as applyCookieWrites, g as sessionCookieName, h as serializeCookie, m as readSession, n as toSession, o as authContext, p as parseCookies, u as resolveAuth, v as refreshSession } from "../view-Bn6HNKUe.js";
 export { AUTH_CACHE_HEADERS, applyCookieWrites, authContext, hasEntitlement, parseCookies, readSession, refreshSession, resolveAuth, serializeCookie, sessionCookieName, toSession, writeSession };

package/dist/{support-DT-OhSxD.d.ts → support-CEPwlw2G.d.ts}

@@ -80,7 +80,8 @@ interface SqlSupportStoreOptions {
 declare function sqlSupportStore(postgres: Pick<BetterPostgres, "admin" | "asUser">, options?: SqlSupportStoreOptions): SupportSessionStore;
 /**
  * The claims a support session runs with: the target's, plus `act` naming
- * the admin, the reason and the session (the audit module records all three).
+ * the admin, the reason and the session (the audit module records all three),
+ * marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
  * `role` falls back to `authenticated`; the admin's claims never leak in.
  */
 declare function supportClaims(session: Pick<SupportSession, "id" | "adminId" | "targetUserId" | "reason" | "readOnly">, target: Readonly<Record<string, unknown>>): Record<string, unknown>;

package/dist/{support-view-Da5peKFg.d.ts → support-view-B8SlToQX.d.ts}

@@ -1,4 +1,4 @@
-import { t as AuthSession } from "./view-BEf0diC5.js";
+import { t as AuthSession } from "./view-CbgObAeb.js";
 //#region src/auth/support-view.d.ts
 /** A running support session as the target's view shows it, for a banner. */
 interface SupportView {

package/dist/{support-Dk6vdmEw.js → support-wHnK6zp-.js}

@@ -2,7 +2,7 @@ import { c as mapDbError, n as dbError } from "./errors-DtwXa6b8.js";
 import { t as temporal } from "./temporal-required-CAt4Dc9Z.js";
 import { i as ok, n as err, o as toDbError, t as AsyncResult } from "./result-BKiliPY7.js";
 import { t as validate } from "./standard-D7r6dMUu.js";
-import { c as supportCookie, l as supportCookieValue, s as clearSupportCookie } from "./server-Csx2sRjg.js";
+import { c as supportCookie, l as supportCookieValue, s as clearSupportCookie } from "./server-B1mZ7CgQ.js";
 import { r as sqlIdent } from "./template-TxrGI5jR.js";
 import { n as emitKitEvent } from "./kit-events-CTFDfSwb.js";
 import { t as fromPgError } from "./executor-XycESQPH.js";
@@ -76,7 +76,8 @@ function sqlSupportStore(postgres, options = {}) {
 }
 /**
 * The claims a support session runs with: the target's, plus `act` naming
-* the admin, the reason and the session (the audit module records all three).
+* the admin, the reason and the session (the audit module records all three),
+* marked `kind: "support"` so `actorOf` never reads it as an OAuth client.
 * `role` falls back to `authenticated`; the admin's claims never leak in.
 */
 function supportClaims(session, target) {
@@ -86,6 +87,7 @@ function supportClaims(session, target) {
 		sub: session.targetUserId,
 		role: typeof role === "string" && role !== "" ? role : "authenticated",
 		act: {
+			kind: "support",
 			sub: session.adminId,
 			reason: session.reason,
 			session_id: session.id,

package/dist/testing/index.d.ts

@@ -2,13 +2,14 @@ import { P as TableKey, _ as Insert, j as SchemaMeta, n as AnyFunctions, r as An
 import { r as Executor } from "../executor-BunPOO-k.js";
 import { P as DbStats, l as CacheAdapter, t as BetterSupabase, y as Db } from "../define-Bp_BZa5h.js";
 import { g as RequestContext, n as AnyPlugin } from "../plugin-o144f322.js";
-import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-T_ejwyd3.js";
+import { b as ResolvedConfig, d as Generator, f as GeneratorInput } from "../config-Bv7gvfzC.js";
 import { t as SqlClient } from "../executor-Cghdstwu.js";
 import { t as BetterPostgres } from "../pool-C9voM4Kw.js";
-import { n as AuthResolver } from "../resolve-C15TJq77.js";
-import { o as SupportSessionStore } from "../support-DT-OhSxD.js";
+import { a as AuthResolver, n as Impersonator } from "../impersonation-BmePsuxz.js";
+import { o as SupportSessionStore } from "../support-CEPwlw2G.js";
 import { r as EventSink, t as CloudEvent } from "../index-DOESKG27.js";
 import { p as QueueBackend } from "../queue-BYUCjr59.js";
+import { n as SessionActor, r as SessionDelegation } from "../actor-DaJjqD5R.js";
 import { t as NotificationChannel } from "../channel-FQW-CnGR.js";
 import { c as WebhookSecretStore, i as WebhookSigner, m as WebhookTransport } from "../signers-Cc6r98SW.js";
 import { SupabaseClient } from "@supabase/supabase-js";
@@ -326,6 +327,37 @@ interface TenantIsolationOptions<M extends AnyModels> {
  */
 export declare function expectTenantIsolation<M extends AnyModels, D, F extends AnyFunctions, E>(betterSupabase: BetterSupabase<M, D, F, E>, options: TenantIsolationOptions<M>): Promise<ConformanceReport>;
 //#endregion
+//#region src/testing/claims-fixtures.d.ts
+/**
+ * Claims of a Supabase access token where someone acts for the user, with
+ * what `toSession` reads from them: `actor`, `impersonator` and
+ * `delegation`. Plain data in the shape of PermDock's `supabaseClaimFixtures`
+ * (`permdock/testing`), so both packages test the same `act` contract: every
+ * fixture passes PermDock's `schemas/supabase-claims-v1.json`.
+ */
+interface SupabaseClaimFixture {
+  /** Without `iat` and `exp`, so a test signer sets them. */
+  readonly claims: {
+    readonly sub: string;
+    readonly [claim: string]: unknown;
+  };
+  readonly expect: {
+    readonly actor: SessionActor;
+    /** Set for support and impersonated sessions only. */
+    readonly impersonator?: Impersonator;
+    /** Set for an `oauth-client` actor only. */
+    readonly delegation?: SessionDelegation;
+  };
+}
+type SupabaseClaimFixtureName = "supportSession" | "supportSessionReadOnly" | "impersonation" | "oauthClient" | "agentChain";
+/**
+ * `supportSession` and `supportSessionReadOnly` are what `supportClaims`
+ * mints (`act.kind: "support"`), `impersonation` what `actingAs` mints
+ * (`act.kind: "impersonation"`), `oauthClient` a Supabase OAuth server token
+ * and `agentChain` an RFC 8693 chain without `kind`.
+ */
+export declare const supabaseClaimFixtures: Readonly<Record<SupabaseClaimFixtureName, SupabaseClaimFixture>>;
+//#endregion
 //#region src/testing/seed.d.ts
 /** Named rows per table, in app casing: `{ customers: { acme: { ... } } }`. */
 type SeedFixtures<M extends AnyModels> = { readonly [K in keyof M]?: Readonly<Record<string, M[K]["Insert"]>>; };
@@ -413,4 +445,4 @@ interface TestWebhookSecretStoreOptions {
  */
 export declare function testWebhookSecretStore(store: WebhookSecretStore, options: TestWebhookSecretStoreOptions): Promise<ConformanceReport>;
 //#endregion
-export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };
+export type { BudgetPage, BudgetResponse, ConformanceCheck, ConformanceReport, DbBudgetExpectation, ExactSeed, IsolationTable, IsolationTables, IsolationTenant, LocalStack, MeasuredRender, Seed, SeedFixtures, SigningJwk, SupabaseClaimFixture, SupabaseClaimFixtureName, TenantIsolationOptions, TestAuthResolverOptions, TestEventSinkOptions, TestExecutorOptions, TestGeneratorOptions, TestJwtClaims, TestNotificationChannelOptions, TestPluginOptions, TestQueueBackendOptions, TestSigner, TestSupportSessionStoreOptions, TestUser, TestWebhookSecretStoreOptions, TestWebhookSignerOptions, TestWebhookTransportOptions };