permdock 0.0.0 → 0.1.0

package/dist/supabase-DTxGtYdi.js

@@ -0,0 +1,796 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { o as parseCapability } from "./capability-B68OFnZx.js";
+import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import "./budget-NbEtbJC_.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-Bll1d7y0.js";
+import "./sources-DVHM3Mwq.js";
+//#region src/supabase/capability.ts
+const DEFAULT_TTL = 300;
+const MAX_TTL = 3600;
+function isSecret(key) {
+	return typeof key.secret === "string";
+}
+/**
+* Exchanges a verified link subject (from `subjectFromCapability`) for a
+* short-lived Supabase access token with role `anon` and the capability in a
+* `capability` claim, which `permdock rls generate --capabilities` policies
+* read. `undefined` for any subject that is not a live link.
+*/
+async function exchangeCapability(subject, options) {
+	const alg = options.alg ?? "ES256";
+	const secret = isSecret(options.key);
+	if (secret !== (alg === "HS256")) throw new Error("PermDock: exchangeCapability signs HS256 with { secret } only, and ES256 / RS256 with a private JWK only.");
+	if (!secret && (options.kid === void 0 || options.kid.length === 0)) throw new Error("PermDock: exchangeCapability needs the kid of the imported signing key.");
+	const principal = subject.principal;
+	if (principal === null || principal.kind !== "link") return;
+	const capability = parseCapability(principal["capability"]);
+	if (capability?.holder !== "link" || capability.id !== principal.id) return;
+	const now = Math.floor(options.now ?? Date.now() / 1e3);
+	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
+	const exp = Math.min(now + ttl, Math.floor(capability.expiresAt));
+	if (exp <= now) return;
+	const jose = await loadJose();
+	const key = isSecret(options.key) ? new TextEncoder().encode(options.key.secret) : await jose.importJWK(options.key, alg);
+	const jwt = new jose.SignJWT({
+		role: "anon",
+		capability
+	}).setProtectedHeader(secret ? {
+		alg: "HS256",
+		typ: "JWT"
+	} : {
+		alg,
+		...options.kid === void 0 ? {} : { kid: options.kid },
+		typ: "JWT"
+	}).setIssuedAt(now).setExpirationTime(exp);
+	if (options.issuer !== void 0) jwt.setIssuer(options.issuer);
+	return jwt.sign(key);
+}
+//#endregion
+//#region src/supabase/claims.ts
+const KNOWN = /* @__PURE__ */ new Set([
+	"user_role",
+	"roles",
+	"memberships",
+	"memberships_truncated",
+	"attrs",
+	"authz_ver",
+	"client_id",
+	"scope",
+	"act",
+	"app_metadata"
+]);
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function own(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
+function issue(issues, path, message) {
+	issues.push({
+		message,
+		path: [...path]
+	});
+}
+function isStrings(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function optional(record, key, path, issues, check, expected) {
+	const value = own(record, key);
+	if (value !== void 0 && !check(value)) issue(issues, [...path, key], `Expected ${expected}`);
+}
+const isString = (value) => typeof value === "string";
+function checkMembership(item, path, issues) {
+	if (!isRecord$1(item)) {
+		issue(issues, path, "Expected a membership object");
+		return;
+	}
+	const roles = own(item, "roles");
+	if (!isStrings(roles) || roles.length === 0) issue(issues, [...path, "roles"], "Expected a non-empty array of strings");
+	for (const key of [
+		"scope",
+		"id",
+		"tenant",
+		"team",
+		"via",
+		"grantedBy",
+		"reason"
+	]) optional(item, key, path, issues, isString, "a string");
+	optional(item, "within", path, issues, (value) => isRecord$1(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
+	optional(item, "on", path, issues, (value) => isRecord$1(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
+	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
+	optional(item, "member", path, issues, (value) => isRecord$1(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
+	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
+	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
+	optional(item, "grants", path, issues, isRecord$1, "an object");
+	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
+}
+function checkPermDockClaims(record, tenantClaim, path, issues) {
+	optional(record, "user_role", path, issues, (value) => value === null || typeof value === "string" || isStrings(value), "a string, an array of strings or null");
+	optional(record, "roles", path, issues, isStrings, "an array of strings");
+	const memberships = own(record, "memberships");
+	if (memberships !== void 0) {
+		if (Array.isArray(memberships)) for (const [index, item] of memberships.entries()) checkMembership(item, [
+			...path,
+			"memberships",
+			index
+		], issues);
+		else issue(issues, [...path, "memberships"], "Expected an array");
+	}
+	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
+	optional(record, tenantClaim, path, issues, isString, "a string");
+	optional(record, "attrs", path, issues, isRecord$1, "an object");
+	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
+}
+/** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
+function checkActKind(level, path, issues) {
+	const marked = own(level, "kind");
+	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
+	optional(level, "reason", path, issues, isString, "a string");
+	if (kind === void 0 || kind === "impersonation") return;
+	if (kind !== "support") {
+		issue(issues, [...path, "kind"], "Expected 'support' or 'impersonation'");
+		return;
+	}
+	const session = own(level, "session_id");
+	if (typeof session !== "string" || session === "") issue(issues, [...path, "session_id"], "Expected a non-empty string");
+	optional(level, "read_only", path, issues, (value) => typeof value === "boolean", "a boolean");
+}
+function checkAct(value, issues) {
+	let current = value;
+	const path = ["act"];
+	while (current !== void 0) {
+		if (!isRecord$1(current)) {
+			issue(issues, path, "Expected an object");
+			return;
+		}
+		const sub = own(current, "sub");
+		if (typeof sub !== "string" || sub === "") issue(issues, [...path, "sub"], "Expected a non-empty string");
+		if (path.length === 1) checkActKind(current, path, issues);
+		current = own(current, "act");
+		path.push("act");
+	}
+}
+function checkClaims(value, tenantClaim) {
+	const issues = [];
+	if (!isRecord$1(value)) {
+		issue(issues, [], "Expected a claims object");
+		return issues;
+	}
+	checkPermDockClaims(value, tenantClaim, [], issues);
+	optional(value, "client_id", [], issues, isString, "a string");
+	optional(value, "scope", [], issues, (scope) => typeof scope === "string" || isStrings(scope), "a string or an array of strings");
+	const act = own(value, "act");
+	if (act !== void 0) checkAct(act, issues);
+	const meta = own(value, "app_metadata");
+	if (meta !== void 0) {
+		if (isRecord$1(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
+		else issue(issues, ["app_metadata"], "Expected an object");
+	}
+	return issues;
+}
+function merge(base, app) {
+	const issues = [...base.issues ?? [], ...app.issues ?? []];
+	if (issues.length > 0) return { issues };
+	const baseValue = base.value;
+	const appValue = app.value;
+	if (!isRecord$1(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
+	return { value: isRecord$1(baseValue) ? {
+		...baseValue,
+		...appValue
+	} : appValue };
+}
+function schemaOf(validate) {
+	const schema = {
+		"~standard": Object.freeze({
+			version: 1,
+			vendor: "permdock",
+			validate
+		}),
+		extend(app) {
+			if (!isRecord$1(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			const props = Reflect.get(app, "~standard");
+			if (!isRecord$1(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			const run = app["~standard"].validate.bind(app["~standard"]);
+			return schemaOf((value) => {
+				const base = validate(value);
+				const extra = run(value);
+				if (base instanceof Promise || extra instanceof Promise) return Promise.all([base, extra]).then(([b, e]) => merge(b, e));
+				return merge(base, extra);
+			});
+		}
+	};
+	return Object.freeze(schema);
+}
+/**
+* A Standard Schema v1 for PermDock's Supabase claims. Unknown claims pass
+* through unchanged; a known claim with the wrong shape is an issue, so the
+* whole token is rejected as `schemas/supabase-claims-v1.json` rejects it.
+* Needs no validation library.
+*
+* ```ts
+* sb.claims(supabaseClaims().extend(z.object({ datetime_preferences: Prefs })))
+* ```
+*/
+function supabaseClaims(options = {}) {
+	const tenantClaim = options.tenantClaim ?? "tenant_id";
+	if (typeof tenantClaim !== "string" || tenantClaim === "" || KNOWN.has(tenantClaim)) throw new TypeError(`PermDock: supabaseClaims tenantClaim must be a claim name other than ${[...KNOWN].join(", ")}`);
+	return schemaOf((value) => {
+		const issues = checkClaims(value, tenantClaim);
+		return issues.length > 0 ? { issues } : { value };
+	});
+}
+//#endregion
+//#region src/supabase/rls.ts
+function isTable(value) {
+	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
+}
+function supabaseRls(options = {}) {
+	const raw = options.memberships;
+	const memberships = raw === void 0 ? void 0 : isTable(raw) ? { tenant: raw } : raw;
+	return compact({
+		dialect: "supabase",
+		roleClaim: options.roleClaim ?? "user_role",
+		tenantClaim: options.tenantClaim ?? "tenant_id",
+		tenantType: options.tenantType,
+		memberships,
+		suspension: options.suspension
+	});
+}
+const ident = (name) => quoteSqlIdent(name);
+const table = (name) => quoteSqlTable(name);
+const literal = quoteSqlLiteral;
+function qualifiedTable(name) {
+	return table(name.includes(".") ? name : `public.${name}`);
+}
+function textArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(literal).join(", ")}]::text[]`;
+}
+function activeRow(row, id, text = false) {
+	const parts = [`s.${ident(row.id)}${text ? "::text" : ""} = ${id}`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		if (row.active === void 0 || row.active.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
+		parts.push(`s.${ident(row.status)}::text = any(${textArray(row.active)})`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
+	return `exists (select 1 from ${qualifiedTable(row.table)} s where ${parts.join(" and ")})`;
+}
+/** Early `return false` for a suspended user, or a tenant request for a suspended instance. */
+function suspendedGuards(suspension, scope, uid) {
+	const lines = [];
+	const users = suspension?.users;
+	if (users !== void 0) lines.push(`  if not ${activeRow(users, uid)} then
+    return false; -- suspended user
+  end if;`);
+	const tenant = suspension?.scopes?.[scope];
+	if (tenant !== void 0) lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)} then
+    return false; -- suspended ${scope}
+  end if;`);
+	return lines.map((line) => `\n${line}`).join("");
+}
+function claimEntries(where, value) {
+	return `array(select ${value} from jsonb_array_elements_text(cg.g) e where ${where})`;
+}
+/** A custom role's keys hold `requested_permission` in the first scope. */
+function customHolds(q, scope, allows, denies, includes) {
+	return `exists (
+          select 1 from ${q("role_permissions")} rp
+          where rp.permission = requested_permission::text
+            and rp.scope = ${literal(scope)}
+            and rp.effect = 'allow'
+            and rp.grant_key in (select ${q("permdock_custom_keys")}(
+              ${allows},
+              ${denies},
+              ${includes},
+              ${literal(scope)}
+            ))
+        )`;
+}
+function customDatabaseBranch(q, scope, memberships, declared) {
+	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = m.${ident(memberships.role)}::text`;
+	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
+	return ` or exists (
+      select 1
+      from ${qualifiedTable(memberships.table)} m
+      where m.${ident(memberships.user)} = v_member_user
+        and m.${ident(memberships.tenant)} = v_member_tenant
+        and not (m.${ident(memberships.role)}::text = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}
+        and ${customHolds(q, scope, rows("custom_role_permissions", "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
+    )`;
+}
+/**
+* The `role_permissions` match for one effect. An allow counts only without
+* row conditions (`grant_key = permission`): `authorize()` never sees the row.
+* A deny counts with or without them, so a conditional deny still denies.
+*/
+function effectMatch(scope, effect) {
+	return `rp.permission = requested_permission::text
+        and rp.scope = ${scope}
+        and rp.effect = '${effect}'${effect === "allow" ? "\n        and rp.grant_key = rp.permission" : ""}`;
+}
+function databaseBody(q, scope, memberships, custom, suspension) {
+	const global = (effect) => `exists (
+      select 1
+      from ${q("user_roles")} ur
+      join ${q("role_permissions")} rp on rp.role = ur.role::text
+      where ur.user_id = uid
+        and ${effectMatch(`'global'`, effect)}
+    )`;
+	const tenantColumn = memberships?.tenant;
+	let tenantBranch = `  if requested_tenant is not null then
+    return false; -- no memberships table configured
+  end if;`;
+	if (memberships !== void 0 && tenantColumn !== void 0) {
+		const held = (effect) => `exists (
+      select 1
+      from ${qualifiedTable(memberships.table)} m
+      join ${q("role_permissions")} rp on rp.role = m.${ident(memberships.role)}::text
+      where m.${ident(memberships.user)} = v_member_user
+        and m.${ident(tenantColumn)} = v_member_tenant
+        and ${effectMatch(literal(scope), effect)}${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}
+    )`;
+		tenantBranch = `  if requested_tenant is not null then
+    begin
+      v_member_user := uid;
+      v_member_tenant := requested_tenant;
+    exception when invalid_text_representation or numeric_value_out_of_range then
+      return false; -- not an id of the memberships table
+    end;
+    return (${held("allow")}${custom === void 0 ? "" : customDatabaseBranch(q, scope, {
+			...memberships,
+			tenant: tenantColumn
+		}, custom.declared)})
+    and not ${held("deny")}
+    and not ${global("deny")};
+  end if;`;
+	}
+	return `declare
+  uid uuid := (select auth.uid());${memberships !== void 0 && tenantColumn !== void 0 ? `
+  v_member_user ${qualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
+  v_member_tenant ${qualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
+begin
+  if uid is null then
+    return false;
+  end if;${suspendedGuards(suspension, scope, "uid")}
+${tenantBranch}
+  return ${global("allow")}
+    and not ${global("deny")};
+end;`;
+}
+/** A claim membership whose `expiresAt` (epoch seconds) has passed no longer holds its roles. */
+const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expiresAt')
+          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+          else true
+        end`;
+function jwtBody(q, scope, custom, suspension) {
+	const memberships = `jsonb_array_elements(
+        case jsonb_typeof(coalesce(claims -> 'memberships', claims -> 'app_metadata' -> 'memberships'))
+          when 'array' then coalesce(claims -> 'memberships', claims -> 'app_metadata' -> 'memberships')
+          else '[]'::jsonb
+        end
+      ) m
+      cross join lateral jsonb_array_elements_text(
+        case jsonb_typeof(m -> 'roles') when 'array' then m -> 'roles' else '[]'::jsonb end
+      ) r(role)`;
+	const customBranch = custom === void 0 ? "" : ` or exists (
+      select 1
+      from ${memberships}
+      cross join lateral (select m -> 'grants' -> r.role as g) cg
+      where m ->> 'scope' = ${literal(scope)}
+        and m ->> 'id' = requested_tenant
+        and ${CLAIM_UNEXPIRED}
+        and jsonb_typeof(cg.g) = 'array'
+        and not (r.role = any(${textArray(custom.declared)}))
+        and ${customHolds(q, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
+    )`;
+	const held = (effect) => `exists (
+      select 1
+      from ${memberships}
+      join ${q("role_permissions")} rp on rp.role = r.role
+      where m ->> 'scope' = ${literal(scope)}
+        and m ->> 'id' = requested_tenant
+        and ${CLAIM_UNEXPIRED}
+        and ${effectMatch(literal(scope), effect)}
+    )`;
+	const global = (effect) => `exists (
+      select 1
+      from jsonb_array_elements_text(
+        case jsonb_typeof(role_claim)
+          when 'array' then role_claim
+          when 'string' then jsonb_build_array(role_claim)
+          else '[]'::jsonb
+        end
+      ) r(role)
+      join ${q("role_permissions")} rp on rp.role = r.role
+      where ${effectMatch(`'global'`, effect)}
+    )`;
+	return `declare
+  claims jsonb := (select auth.jwt());
+  role_claim jsonb;
+begin
+  if claims is null or (select auth.uid()) is null then
+    return false;
+  end if;${suspendedGuards(suspension, scope, "(select auth.uid())")}
+  -- a top-level null (no role row) falls back to app_metadata, like subjectFromSupabase
+  role_claim := coalesce(nullif(claims -> 'user_role', 'null'::jsonb), claims -> 'app_metadata' -> 'user_role');
+  if requested_tenant is not null then
+    return (${held("allow")}${customBranch})
+    and not ${held("deny")}
+    and not ${global("deny")};
+  end if;
+  return ${global("allow")}
+    and not ${global("deny")};
+end;`;
+}
+/**
+* `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
+* scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
+* `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
+* tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
+* tenant request with no memberships source is denied, never answered from global roles. It
+* answers "does a role hold this permission" without seeing a row: an allow with row conditions
+* does not count, and a deny the user's tenant or global roles hold overrides every allow.
+* Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+* instead. Only `authenticated` may execute it.
+*/
+function authorizeSql(options = {}) {
+	const schema = options.schema ?? "permdock";
+	const q = (name) => table(`${schema}.${name}`);
+	const memberships = typeof options.tenant === "object" ? options.tenant : void 0;
+	const scope = options.scope ?? "tenant";
+	if (!/^[a-z][a-z0-9_]*$/u.test(scope)) throw new TypeError(`PermDock: unsafe scope name '${scope}'`);
+	const body = options.authorize === "jwt" ? jwtBody(q, scope, options.customRoles, options.suspension) : databaseBody(q, scope, memberships, options.customRoles, options.suspension);
+	const signature = `${q("authorize")}(${q("app_permission")}, text)`;
+	return `create or replace function ${q("authorize")}(
+  requested_permission ${q("app_permission")},
+  requested_tenant text default null
+)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+${body}
+$$;
+revoke execute on function ${signature} from public, anon;
+grant execute on function ${signature} to authenticated;
+`;
+}
+//#endregion
+//#region src/supabase/subject.ts
+const REGISTERED = /* @__PURE__ */ new Set([
+	"sub",
+	"role",
+	"iss",
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"aal",
+	"amr",
+	"acr",
+	"session_id",
+	"email",
+	"phone",
+	"is_anonymous",
+	"app_metadata",
+	"user_metadata",
+	"act",
+	"client_id",
+	"scope"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+function readClaim(claims, name) {
+	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
+	if (top !== void 0 && top !== null) return top;
+	const meta = claims["app_metadata"];
+	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
+}
+function asRoles(value, declared) {
+	const raw = typeof value === "string" ? value === "" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+	if (declared === void 0) return raw;
+	const allowed = new Set(declared);
+	return raw.filter((role) => allowed.has(role));
+}
+/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+function readMemberships(value) {
+	if (!Array.isArray(value)) return {
+		memberships: [],
+		dropped: []
+	};
+	const out = [];
+	const dropped = [];
+	for (const [index, item] of value.entries()) {
+		const membership = asMembership(item);
+		if (membership === void 0) dropped.push(index);
+		else out.push(membership);
+	}
+	return {
+		memberships: out,
+		dropped
+	};
+}
+function asMembership(item) {
+	if (!isRecord(item) || !Array.isArray(item["roles"])) return;
+	const roles = item["roles"].filter((role) => typeof role === "string");
+	if (roles.length === 0) return;
+	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
+	const id = typeof item["id"] === "string" ? item["id"] : void 0;
+	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
+	const team = typeof item["team"] === "string" ? item["team"] : void 0;
+	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
+	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
+		resource: onRecord["resource"],
+		id: onRecord["id"]
+	} : void 0;
+	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
+	return compact({
+		roles,
+		scope,
+		id,
+		within,
+		tenant,
+		team,
+		on,
+		via: typeof item["via"] === "string" ? item["via"] : void 0,
+		expiresAt: typeof item["expiresAt"] === "number" ? item["expiresAt"] : void 0,
+		grantedBy: typeof item["grantedBy"] === "string" ? item["grantedBy"] : void 0,
+		reason: typeof item["reason"] === "string" ? item["reason"] : void 0,
+		member: memberOf(item["member"]),
+		managedBy: item["managedBy"] === "idp" ? "idp" : void 0,
+		entitlements: Array.isArray(item["entitlements"]) ? item["entitlements"].filter((seat) => typeof seat === "string") : void 0
+	});
+}
+function memberOf(value) {
+	if (value === null || typeof value !== "object" || !Object.hasOwn(value, "group")) return;
+	const group = value.group;
+	return typeof group === "string" && group !== "" ? { group } : void 0;
+}
+function asStrings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+function plansFor(claims, name, tenant) {
+	if (name === void 0 || tenant === void 0) return [];
+	const byTenant = readClaim(claims, name);
+	if (!isRecord(byTenant) || !Object.hasOwn(byTenant, tenant)) return [];
+	return asStrings(byTenant[tenant]);
+}
+const INVALID_CHAIN = Object.freeze({
+	ok: false,
+	reason: "invalid-chain"
+});
+const NO_ACTOR = Object.freeze({ ok: true });
+/** Own entries of one `act` level, with the nested `act` copied the same way. */
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+/**
+* The outer `act` level by its `kind`, the marker better-supabase writes: none is an OAuth client
+* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
+* as the user. Any other `kind`, or a support level without `session_id`, is invalid.
+*/
+function actingParty(outer, id) {
+	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
+	const kind = marked === void 0 && Object.hasOwn(outer, "session_id") ? "support" : marked;
+	const chain = copyAct(outer);
+	const reason = typeof outer["reason"] === "string" ? outer["reason"] : void 0;
+	switch (kind) {
+		case void 0: return freezeDeep({
+			ok: true,
+			actor: {
+				id,
+				kind: "oauth-client",
+				chain
+			}
+		});
+		case "support": {
+			const session = outer["session_id"];
+			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : false;
+			if (typeof session !== "string" || session === "" || typeof readOnly !== "boolean") return INVALID_CHAIN;
+			return freezeDeep({
+				ok: true,
+				actor: compact({
+					id,
+					kind: "support",
+					sessionId: session,
+					readOnly,
+					reason,
+					chain
+				})
+			});
+		}
+		case "impersonation": return freezeDeep({
+			ok: true,
+			actor: compact({
+				id,
+				kind: "impersonation",
+				reason,
+				chain
+			})
+		});
+		default: return INVALID_CHAIN;
+	}
+}
+function readActor(claims) {
+	if (Object.hasOwn(claims, "act") && claims["act"] !== void 0) {
+		let current = claims["act"];
+		while (current !== void 0) {
+			const level = isRecord(current) ? current["sub"] : void 0;
+			if (!isRecord(current) || typeof level !== "string" || level === "") return INVALID_CHAIN;
+			current = Object.hasOwn(current, "act") ? current["act"] : void 0;
+		}
+		const outer = claims["act"];
+		const sub = isRecord(outer) ? outer["sub"] : void 0;
+		if (!isRecord(outer) || typeof sub !== "string") return INVALID_CHAIN;
+		return actingParty(outer, sub);
+	}
+	const client = Object.hasOwn(claims, "client_id") ? claims["client_id"] : void 0;
+	if (typeof client === "string" && client !== "") return freezeDeep({
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	});
+	return NO_ACTOR;
+}
+/**
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
+* actor; nested levels are prior actors, kept on `chain` for audit), else the
+* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
+* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
+* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
+* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
+* is `{ ok: false }` and must deny.
+*/
+function actorOf(claims) {
+	try {
+		return isRecord(claims) ? readActor(claims) : NO_ACTOR;
+	} catch {
+		return INVALID_CHAIN;
+	}
+}
+/** The OAuth `scope` claim (a space-separated string or a list) as `scopes`; `undefined` when empty. */
+function delegationOf(claims) {
+	try {
+		if (!isRecord(claims) || !Object.hasOwn(claims, "scope")) return;
+		const scope = claims["scope"];
+		const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : asStrings(scope);
+		return scopes.length > 0 ? freezeDeep({ scopes }) : void 0;
+	} catch {
+		return;
+	}
+}
+function subjectDelegation(claims, chain) {
+	const delegation = compact({
+		scopes: delegationOf(claims)?.scopes,
+		chain
+	});
+	return Object.keys(delegation).length === 0 ? void 0 : delegation;
+}
+function emit(options, reason, cause) {
+	try {
+		options.onAuth?.({
+			reason,
+			cause,
+			source: "supabase"
+		});
+	} catch {}
+}
+function validateClaims(extra, schema) {
+	const result = schema["~standard"].validate(extra);
+	if (result instanceof Promise) {
+		ignoreRejection(result);
+		return;
+	}
+	if ("issues" in result && result.issues !== void 0) return;
+	const value = result.value;
+	return isRecord(value) ? value : void 0;
+}
+function extraClaims(claims) {
+	const extra = {};
+	const meta = claims["app_metadata"];
+	if (isRecord(meta)) for (const [key, value] of Object.entries(meta)) extra[key] = value;
+	for (const [key, value] of Object.entries(claims)) {
+		if (REGISTERED.has(key) || key === "user_metadata") continue;
+		extra[key] = value;
+	}
+	return extra;
+}
+function mapClaims(claims, options) {
+	const role = claims["role"];
+	if (role === "anon" || role === "service_role") return anonymousSubject();
+	const id = claims["sub"];
+	if (typeof id !== "string" || id === "") return anonymousSubject();
+	const act = readActor(claims);
+	if (!act.ok) {
+		emit(options, "invalid-token", act.reason);
+		return anonymousSubject();
+	}
+	if (options.anonymousSignIns === "deny" && claims["is_anonymous"] === true) return anonymousSubject();
+	const actor = act.actor === void 0 ? void 0 : act.actor.kind === "support" ? {
+		id: act.actor.id,
+		kind: act.actor.kind,
+		sessionId: act.actor.sessionId,
+		readOnly: act.actor.readOnly
+	} : {
+		id: act.actor.id,
+		kind: act.actor.kind
+	};
+	const roleClaim = options.roles ?? "user_role";
+	const tenantClaim = options.tenant ?? "tenant_id";
+	const membershipsClaim = options.memberships ?? "memberships";
+	let extra = extraClaims(claims);
+	if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
+	const include = new Set(options.include ?? []);
+	const tenantValue = readClaim(claims, tenantClaim);
+	const version = readClaim(claims, "authz_ver");
+	const tenant = typeof tenantValue === "string" ? tenantValue : void 0;
+	const { memberships, dropped } = readMemberships(readClaim(claims, membershipsClaim));
+	if (dropped.length > 0) emit(options, "schema", "membership-dropped");
+	const plans = plansFor(claims, options.plans, tenant);
+	const principal = compact({
+		id,
+		kind: "user",
+		roles: asRoles(readClaim(claims, roleClaim), options.declared),
+		tenant,
+		plans: plans.length > 0 ? plans : void 0,
+		memberships,
+		membershipsTruncated: readClaim(claims, "memberships_truncated") === true ? true : void 0,
+		authzVersion: typeof version === "number" && Number.isInteger(version) ? version : void 0,
+		issuer: typeof claims["iss"] === "string" ? claims["iss"] : void 0,
+		assurance: typeof claims["aal"] === "string" ? { acr: claims["aal"] } : void 0,
+		claims: Object.keys(extra).length === 0 ? void 0 : extra,
+		email: include.has("email") && typeof claims["email"] === "string" ? claims["email"] : void 0,
+		phone: include.has("phone") && typeof claims["phone"] === "string" ? claims["phone"] : void 0,
+		is_anonymous: include.has("is_anonymous") && typeof claims["is_anonymous"] === "boolean" ? claims["is_anonymous"] : void 0
+	});
+	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
+	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+	return freezeDeep(compact({
+		principal,
+		actor,
+		delegation: act.actor?.kind === "oauth-client" ? subjectDelegation(claims, act.actor.chain) : void 0,
+		context: {},
+		session,
+		expiresAt
+	}));
+}
+function subjectFromSupabase(claims, options = {}) {
+	try {
+		if (!isRecord(claims)) return anonymousSubject();
+		const rest = {};
+		for (const [key, value] of Object.entries(claims)) {
+			if (key === "user_metadata") continue;
+			rest[key] = value;
+		}
+		return mapClaims(rest, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+/**
+* A verified session object (for example better-supabase's `AuthSession`) in, `Subject` out.
+* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+*/
+function subjectFromSupabaseSession(session, options = {}) {
+	try {
+		if (session === null || session === void 0 || session.kind !== "user") return anonymousSubject();
+		return subjectFromSupabase(session.claims, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+export { subjectFromSupabaseSession as a, supabaseClaims as c, subjectFromSupabase as i, exchangeCapability as l, delegationOf as n, authorizeSql as o, readMemberships as r, supabaseRls as s, actorOf as t };