permdock 0.0.0 → 0.2.0

package/dist/supabase-DTBaC20O.js

@@ -0,0 +1,774 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { o as parseCapability } from "./capability-4qPdO9gk.js";
+import { t as ApprovalError } from "./errors-DRnGZHzF.js";
+import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-DMAWwAJV.js";
+import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import "./budget-NbEtbJC_.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
+import { l as keptKeys, s as roleColumn } from "./sources-B0UvrJ21.js";
+import { i as readMemberships } from "./manifest-iaoBXHKc.js";
+//#region src/supabase/capability.ts
+const DEFAULT_TTL = 300;
+const MAX_TTL = 3600;
+function isSecret(key) {
+	return typeof key.secret === "string";
+}
+/**
+* Exchanges a verified link subject (from `subjectFromCapability`) for a
+* short-lived Supabase access token with role `anon` and the capability in a
+* `capability` claim, which `permdock rls generate --capabilities` policies
+* read. `undefined` for any subject that is not a live link.
+*/
+async function exchangeCapability(subject, options) {
+	const alg = options.alg ?? "ES256";
+	const secret = isSecret(options.key);
+	if (secret !== (alg === "HS256")) throw new Error("PermDock: exchangeCapability signs HS256 with { secret } only, and ES256 / RS256 with a private JWK only.");
+	if (!secret && (options.kid === void 0 || options.kid.length === 0)) throw new Error("PermDock: exchangeCapability needs the kid of the imported signing key.");
+	const principal = subject.principal;
+	if (principal === null || principal.kind !== "link") return;
+	const capability = parseCapability(principal["capability"]);
+	if (capability?.holder !== "link" || capability.id !== principal.id) return;
+	const now = Math.floor(options.now ?? Date.now() / 1e3);
+	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
+	const exp = Math.min(now + ttl, Math.floor(capability.expiresAt));
+	if (exp <= now) return;
+	const jose = await loadJose();
+	const key = isSecret(options.key) ? new TextEncoder().encode(options.key.secret) : await jose.importJWK(options.key, alg);
+	const jwt = new jose.SignJWT({
+		role: "anon",
+		capability
+	}).setProtectedHeader(secret ? {
+		alg: "HS256",
+		typ: "JWT"
+	} : {
+		alg,
+		...options.kid === void 0 ? {} : { kid: options.kid },
+		typ: "JWT"
+	}).setIssuedAt(now).setExpirationTime(exp);
+	if (options.issuer !== void 0) jwt.setIssuer(options.issuer);
+	return jwt.sign(key);
+}
+//#endregion
+//#region src/supabase/claims.ts
+const KNOWN = /* @__PURE__ */ new Set([
+	"user_role",
+	"roles",
+	"memberships",
+	"memberships_truncated",
+	"attrs",
+	"authz_ver",
+	"client_id",
+	"scope",
+	"act",
+	"app_metadata"
+]);
+function isRecord$2(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function own(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
+}
+function issue(issues, path, message) {
+	issues.push({
+		message,
+		path: [...path]
+	});
+}
+function isStrings(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function optional(record, key, path, issues, check, expected) {
+	const value = own(record, key);
+	if (value !== void 0 && !check(value)) issue(issues, [...path, key], `Expected ${expected}`);
+}
+const isString = (value) => typeof value === "string";
+function checkMembership(item, path, issues) {
+	if (!isRecord$2(item)) {
+		issue(issues, path, "Expected a membership object");
+		return;
+	}
+	const roles = own(item, "roles");
+	if (!isStrings(roles) || roles.length === 0) issue(issues, [...path, "roles"], "Expected a non-empty array of strings");
+	for (const key of [
+		"scope",
+		"id",
+		"tenant",
+		"team",
+		"via",
+		"grantedBy",
+		"reason"
+	]) optional(item, key, path, issues, isString, "a string");
+	optional(item, "within", path, issues, (value) => isRecord$2(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
+	optional(item, "on", path, issues, (value) => isRecord$2(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
+	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
+	optional(item, "member", path, issues, (value) => isRecord$2(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
+	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
+	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
+	optional(item, "keep", path, issues, isStrings, "an array of strings");
+	optional(item, "grants", path, issues, isRecord$2, "an object");
+	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
+}
+function checkPermDockClaims(record, tenantClaim, path, issues) {
+	optional(record, "user_role", path, issues, (value) => value === null || typeof value === "string" || isStrings(value), "a string, an array of strings or null");
+	optional(record, "roles", path, issues, isStrings, "an array of strings");
+	const memberships = own(record, "memberships");
+	if (memberships !== void 0) {
+		if (Array.isArray(memberships)) for (const [index, item] of memberships.entries()) checkMembership(item, [
+			...path,
+			"memberships",
+			index
+		], issues);
+		else issue(issues, [...path, "memberships"], "Expected an array");
+	}
+	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
+	optional(record, tenantClaim, path, issues, isString, "a string");
+	optional(record, "attrs", path, issues, isRecord$2, "an object");
+	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
+}
+/** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
+function checkActKind(level, path, issues) {
+	const marked = own(level, "kind");
+	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
+	optional(level, "reason", path, issues, isString, "a string");
+	if (kind === void 0 || kind === "impersonation") return;
+	if (kind !== "support") {
+		issue(issues, [...path, "kind"], "Expected 'support' or 'impersonation'");
+		return;
+	}
+	const session = own(level, "session_id");
+	if (typeof session !== "string" || session === "") issue(issues, [...path, "session_id"], "Expected a non-empty string");
+	optional(level, "read_only", path, issues, (value) => typeof value === "boolean", "a boolean");
+}
+function checkAct(value, issues) {
+	let current = value;
+	const path = ["act"];
+	while (current !== void 0) {
+		if (!isRecord$2(current)) {
+			issue(issues, path, "Expected an object");
+			return;
+		}
+		const sub = own(current, "sub");
+		if (typeof sub !== "string" || sub === "") issue(issues, [...path, "sub"], "Expected a non-empty string");
+		if (path.length === 1) checkActKind(current, path, issues);
+		current = own(current, "act");
+		path.push("act");
+	}
+}
+function checkClaims(value, tenantClaim) {
+	const issues = [];
+	if (!isRecord$2(value)) {
+		issue(issues, [], "Expected a claims object");
+		return issues;
+	}
+	checkPermDockClaims(value, tenantClaim, [], issues);
+	optional(value, "client_id", [], issues, isString, "a string");
+	optional(value, "scope", [], issues, (scope) => typeof scope === "string" || isStrings(scope), "a string or an array of strings");
+	const act = own(value, "act");
+	if (act !== void 0) checkAct(act, issues);
+	const meta = own(value, "app_metadata");
+	if (meta !== void 0) {
+		if (isRecord$2(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
+		else issue(issues, ["app_metadata"], "Expected an object");
+	}
+	return issues;
+}
+function merge(base, app) {
+	const issues = [...base.issues ?? [], ...app.issues ?? []];
+	if (issues.length > 0) return { issues };
+	const baseValue = base.value;
+	const appValue = app.value;
+	if (!isRecord$2(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
+	return { value: isRecord$2(baseValue) ? {
+		...baseValue,
+		...appValue
+	} : appValue };
+}
+function schemaOf(validate) {
+	const schema = {
+		"~standard": Object.freeze({
+			version: 1,
+			vendor: "permdock",
+			validate
+		}),
+		extend(app) {
+			if (!isRecord$2(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			const props = Reflect.get(app, "~standard");
+			if (!isRecord$2(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			const run = app["~standard"].validate.bind(app["~standard"]);
+			return schemaOf((value) => {
+				const base = validate(value);
+				const extra = run(value);
+				if (base instanceof Promise || extra instanceof Promise) return Promise.all([base, extra]).then(([b, e]) => merge(b, e));
+				return merge(base, extra);
+			});
+		}
+	};
+	return Object.freeze(schema);
+}
+/**
+* A Standard Schema v1 for PermDock's Supabase claims. Unknown claims pass
+* through unchanged; a known claim with the wrong shape is an issue, so the
+* whole token is rejected as `schemas/supabase-claims-v1.json` rejects it.
+* Needs no validation library.
+*
+* ```ts
+* sb.claims(supabaseClaims().extend(z.object({ datetime_preferences: Prefs })))
+* ```
+*/
+function supabaseClaims(options = {}) {
+	const tenantClaim = options.tenantClaim ?? "tenant_id";
+	if (typeof tenantClaim !== "string" || tenantClaim === "" || KNOWN.has(tenantClaim)) throw new TypeError(`PermDock: supabaseClaims tenantClaim must be a claim name other than ${[...KNOWN].join(", ")}`);
+	return schemaOf((value) => {
+		const issues = checkClaims(value, tenantClaim);
+		return issues.length > 0 ? { issues } : { value };
+	});
+}
+//#endregion
+//#region src/supabase/postgrest.ts
+function callRpc(client, schema, fn, args) {
+	return client.schema(schema).rpc(fn, args);
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function grantOf(value) {
+	if (!isRecord$1(value) || typeof value["permission"] !== "string") return;
+	return compact({
+		permission: value["permission"],
+		effect: value["effect"] === "deny" ? "deny" : "allow",
+		level: typeof value["level"] === "string" ? value["level"] : void 0
+	});
+}
+function customRoleOf(value) {
+	if (!isRecord$1(value) || typeof value["name"] !== "string") return;
+	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
+		const grant = grantOf(item);
+		return grant === void 0 ? [] : [grant];
+	}) : [];
+	const includes = strings(value["includes"]);
+	const body = {
+		name: value["name"],
+		grants,
+		...includes.length === 0 ? {} : { includes }
+	};
+	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
+		...body,
+		scope: "global"
+	} : void 0;
+	if (typeof value["tenant"] !== "string") return;
+	return compact({
+		...body,
+		tenant: value["tenant"],
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
+		id: typeof value["id"] === "string" ? value["id"] : void 0
+	});
+}
+function readMemberEntries(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		if (!isRecord$1(item) || !isRecord$1(item["principal"])) return [];
+		const id = item["principal"]["id"];
+		const [membership] = readMemberships([item["membership"]]).memberships;
+		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
+			principal: { id },
+			membership
+		}] : [];
+	});
+}
+function versionOf(value) {
+	const version = typeof value === "string" ? Number(value) : value;
+	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
+}
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+function readSubjectRecord(value) {
+	if (!isRecord$1(value) || typeof value["id"] !== "string") return;
+	if (value["active"] !== true) return {
+		id: value["id"],
+		active: false,
+		roles: [],
+		memberships: [],
+		customRoles: []
+	};
+	const version = value["authzVersion"];
+	return compact({
+		id: value["id"],
+		active: true,
+		roles: strings(value["roles"]),
+		memberships: readMemberships(value["memberships"]).memberships,
+		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
+			const role = customRoleOf(item);
+			return role === void 0 ? [] : [role];
+		}) : [],
+		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
+	});
+}
+/**
+* Membership, custom-role and subject sources over the `subject_for(p_user)`,
+* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+* `permdock supabase hook generate` writes, for a backend that reaches
+* Postgres only through PostgREST. `memberships.version` reads only the
+* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+* only for a stale token; when the version function is missing it falls back
+* to `subject_for`. With `policy`, a token that claims a custom role has its
+* subject read in one `subject_for` call instead, and custom roles are read
+* only for a subject that holds one. Each user and each instance is read once per
+* `postgrestSources` call, so create it per request or per job.
+*/
+function postgrestSources(client, options = {}) {
+	const schema = options.schema ?? "permdock";
+	const fn = options.fn ?? "subject_for";
+	const membersFn = options.membersFn ?? "members_of";
+	const versionFn = options.versionFn ?? "authz_version_for";
+	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
+	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
+	const loaded = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	const listed = /* @__PURE__ */ new Map();
+	const list = (query) => {
+		const key = JSON.stringify([query.scope, query.id]);
+		const cached = listed.get(key);
+		if (cached !== void 0) return cached.then((entries) => [...entries]);
+		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
+			p_scope: query.scope,
+			p_id: query.id
+		})).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
+			return readMemberEntries(result.data);
+		});
+		listed.set(key, pending);
+		return pending.then((entries) => [...entries]);
+	};
+	const record = (userId) => {
+		const cached = loaded.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+			return readSubjectRecord(result.data);
+		});
+		loaded.set(userId, pending);
+		return pending;
+	};
+	const version = (userId) => {
+		const read = loaded.get(userId);
+		if (read !== void 0) return read.then((found) => found?.authzVersion);
+		const cached = versions.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
+		versions.set(userId, pending);
+		return pending;
+	};
+	const live = async (userId) => {
+		const found = await record(userId);
+		return found?.active === true ? found : void 0;
+	};
+	return {
+		memberships: {
+			async membershipsFor(principal) {
+				return [...(await live(principal.id))?.memberships ?? []];
+			},
+			version(principal) {
+				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
+			},
+			list
+		},
+		customRoles(principal) {
+			return {
+				async rolesFor(tenant, context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
+				},
+				async globalRoles(context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
+				}
+			};
+		},
+		async subject(userId) {
+			const found = await live(userId);
+			if (found === void 0) return {
+				principal: null,
+				context: {}
+			};
+			return {
+				principal: compact({
+					id: found.id,
+					roles: found.roles,
+					memberships: found.memberships,
+					authzVersion: found.authzVersion
+				}),
+				context: {}
+			};
+		},
+		record
+	};
+}
+//#endregion
+//#region src/supabase/approval-store.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
+function requestOf(value) {
+	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
+	return value;
+}
+function filterOf(filter) {
+	return compact({
+		status: filter.status,
+		tenant: filter.tenant,
+		principalId: filter.principalId,
+		actorId: filter.actorId,
+		session: filter.session
+	});
+}
+/**
+* An `ApprovalStore` over the table and functions `rls.approvals` generates,
+* called through supabase-js (`client.schema(schema).rpc(...)`) with a
+* client that may execute them, such as a `service_role` client. Each method
+* is one atomic statement in the database: a repeated ask keeps the open
+* request, two racing approvers both count towards a quorum, and two racing
+* resumes never both consume an approval.
+*/
+function supabaseApprovalStore(client, options = {}) {
+	const schema = options.schema ?? "permdock";
+	const call = async (fn, args) => {
+		const result = await callRpc(client, schema, fn, args);
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+		return result.data;
+	};
+	const get = async (token) => requestOf(await call("permdock_approval_get", { p_token: token }));
+	return {
+		...options.ttl === void 0 ? {} : { ttl: options.ttl },
+		async create(request) {
+			await call("permdock_approval_open", { p_request: request });
+			if (options.onOpen !== void 0) {
+				const stored = await get(request.token);
+				if (stored !== null && canonicalJson(stored) === canonicalJson(request)) await options.onOpen(stored);
+			}
+		},
+		get,
+		async resolve(token, verdict) {
+			const current = await get(token);
+			if (current === null) throw new ApprovalError("approval-not-found", "approval was not found");
+			const next = applyApprovalVerdict(current, verdict);
+			const written = requestOf(await call("permdock_approval_resolve", {
+				p_token: token,
+				p_next: next,
+				p_seen: current.approvals?.length ?? 0
+			}));
+			if (written === null) throw new ApprovalError("approval-not-pending", "approval is not pending");
+			return written;
+		},
+		async consume(token, now = /* @__PURE__ */ new Date()) {
+			return requestOf(await call("permdock_approval_consume", {
+				p_token: token,
+				p_now: now.toISOString()
+			}));
+		},
+		async list(query) {
+			const after = query.cursor === void 0 ? void 0 : decodeApprovalCursor(query.cursor);
+			if (after === null) return { items: [] };
+			const size = approvalPageSize(query.limit);
+			const data = await call("permdock_approval_list", {
+				p_filter: filterOf(query),
+				p_after_created: after?.[0] ?? null,
+				p_after_token: after?.[1] ?? null,
+				p_limit: size + 1
+			});
+			const rows = Array.isArray(data) ? data.flatMap((row) => {
+				const request = requestOf(row);
+				return request === null ? [] : [request];
+			}) : [];
+			const items = rows.slice(0, size);
+			const last = items.at(-1);
+			return rows.length > size && last !== void 0 ? {
+				items,
+				next: encodeApprovalCursor(last)
+			} : { items };
+		},
+		async expire(now = /* @__PURE__ */ new Date()) {
+			const count = await call("permdock_approval_expire", { p_now: now.toISOString() });
+			return typeof count === "number" ? count : 0;
+		},
+		async cancel(filter, meta) {
+			const count = await call("permdock_approval_cancel", {
+				p_filter: filterOf(filter),
+				p_by: meta.by,
+				p_note: meta.note ?? null,
+				p_now: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return typeof count === "number" ? count : 0;
+		}
+	};
+}
+//#endregion
+//#region src/supabase/rls.ts
+function isTable(value) {
+	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
+}
+function supabaseRls(options = {}) {
+	const raw = options.memberships;
+	const memberships = raw === void 0 ? void 0 : isTable(raw) ? { tenant: raw } : raw;
+	return compact({
+		dialect: "supabase",
+		roleClaim: options.roleClaim ?? "user_role",
+		tenantClaim: options.tenantClaim ?? "tenant_id",
+		tenantType: options.tenantType,
+		memberships,
+		suspension: options.suspension,
+		realtime: options.realtime,
+		storage: options.storage
+	});
+}
+const ident = (name) => quoteSqlIdent(name);
+const table = (name) => quoteSqlTable(name);
+const literal = quoteSqlLiteral;
+function qualifiedTable(name) {
+	return table(name.includes(".") ? name : `public.${name}`);
+}
+/** The memberships table's role key over alias `m`, joined to its roles table when it holds a reference. */
+function tenantRole(memberships) {
+	return roleColumn(memberships.role, memberships.table.includes(".") ? memberships.table : `public.${memberships.table}`, "m", {
+		label: "authorizeSql tenant.role",
+		indent: "      "
+	});
+}
+function textArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(literal).join(", ")}]::text[]`;
+}
+function activeRow(row, id, text = false) {
+	const parts = [`s.${ident(row.id)}${text ? "::text" : ""} = ${id}`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		if (row.active === void 0 || row.active.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
+		parts.push(`s.${ident(row.status)}::text = any(${textArray(row.active)})`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
+	return `exists (select 1 from ${qualifiedTable(row.table)} s where ${parts.join(" and ")})`;
+}
+/**
+* Early `return false` for a suspended user, or a tenant request for a
+* suspended instance unless its scope keeps the requested permission.
+*/
+function suspendedGuards(suspension, scope, uid) {
+	const lines = [];
+	const users = suspension?.users;
+	if (users !== void 0) lines.push(`  if not ${activeRow(users, uid)} then
+    return false; -- suspended user
+  end if;`);
+	const tenant = suspension?.scopes?.[scope];
+	if (tenant !== void 0) {
+		const keep = keptKeys(tenant);
+		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${textArray(keep)}))`;
+		lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)}${kept} then
+    return false; -- suspended ${scope}
+  end if;`);
+	}
+	return lines.map((line) => `\n${line}`).join("");
+}
+function claimEntries(where, value) {
+	return `array(select ${value} from jsonb_array_elements_text(cg.g) e where ${where})`;
+}
+/** A custom role's keys hold `requested_permission` in the first scope. */
+function customHolds(q, scope, allows, denies, includes) {
+	return `exists (
+          select 1 from ${q("role_permissions")} rp
+          where rp.permission = requested_permission::text
+            and rp.scope = ${literal(scope)}
+            and rp.effect = 'allow'
+            and rp.grant_key in (select ${q("permdock_custom_keys")}(
+              ${allows},
+              ${denies},
+              ${includes},
+              ${literal(scope)}
+            ))
+        )`;
+}
+function disabledLine(memberships, suspension) {
+	if (memberships.disabledAt === void 0) return "";
+	const column = `m.${ident(memberships.disabledAt)}`;
+	const keep = keptKeys(suspension?.memberships);
+	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${textArray(keep)}))`;
+}
+function claimKept(suspension) {
+	return keptKeys(suspension?.memberships).length === 0 ? "" : `\n        and case coalesce(jsonb_typeof(m -> 'keep'), 'null') when 'null' then true when 'array' then m -> 'keep' @> jsonb_build_array(requested_permission::text) else false end`;
+}
+function customDatabaseBranch(q, scope, memberships, declared, levels, suspension) {
+	const role = tenantRole(memberships);
+	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
+	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
+	return ` or exists (
+      select 1
+      from ${qualifiedTable(memberships.table)} m${role.join}
+      where m.${ident(memberships.user)} = v_member_user
+        and m.${ident(memberships.tenant)} = v_member_tenant
+        and not (${role.sql} = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
+        and ${customHolds(q, scope, rows("custom_role_permissions", levels ? "permission || coalesce('@' || c.level, '')" : "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
+    )`;
+}
+/**
+* The `role_permissions` match for one effect. An allow counts only without
+* row conditions (`grant_key = permission`): `authorize()` never sees the row.
+* A deny counts with or without them, so a conditional deny still denies.
+*/
+function effectMatch(scope, effect) {
+	return `rp.permission = requested_permission::text
+        and rp.scope = ${scope}
+        and rp.effect = '${effect}'${effect === "allow" ? "\n        and rp.grant_key = rp.permission" : ""}`;
+}
+function databaseBody(q, scope, memberships, custom, suspension) {
+	const global = (effect) => `exists (
+      select 1
+      from ${q("user_roles")} ur
+      join ${q("role_permissions")} rp on rp.role = ur.role::text
+      where ur.user_id = uid
+        and ${effectMatch(`'global'`, effect)}
+    )`;
+	const tenantColumn = memberships?.tenant;
+	let tenantBranch = `  if requested_tenant is not null then
+    return false; -- no memberships table configured
+  end if;`;
+	if (memberships !== void 0 && tenantColumn !== void 0) {
+		const role = tenantRole(memberships);
+		const held = (effect) => `exists (
+      select 1
+      from ${qualifiedTable(memberships.table)} m${role.join}
+      join ${q("role_permissions")} rp on rp.role = ${role.sql}
+      where m.${ident(memberships.user)} = v_member_user
+        and m.${ident(tenantColumn)} = v_member_tenant
+        and ${effectMatch(literal(scope), effect)}${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
+    )`;
+		tenantBranch = `  if requested_tenant is not null then
+    begin
+      v_member_user := uid;
+      v_member_tenant := requested_tenant;
+    exception when invalid_text_representation or numeric_value_out_of_range then
+      return false; -- not an id of the memberships table
+    end;
+    return (${held("allow")}${custom === void 0 ? "" : customDatabaseBranch(q, scope, {
+			...memberships,
+			tenant: tenantColumn
+		}, custom.declared, custom.levels === true, suspension)})
+    and not ${held("deny")}
+    and not ${global("deny")};
+  end if;`;
+	}
+	return `declare
+  uid uuid := (select auth.uid());${memberships !== void 0 && tenantColumn !== void 0 ? `
+  v_member_user ${qualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
+  v_member_tenant ${qualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
+begin
+  if uid is null then
+    return false;
+  end if;${suspendedGuards(suspension, scope, "uid")}
+${tenantBranch}
+  return ${global("allow")}
+    and not ${global("deny")};
+end;`;
+}
+/** A claim membership whose `expiresAt` (epoch seconds) has passed no longer holds its roles. */
+const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expiresAt')
+          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+          else true
+        end`;
+function jwtBody(q, scope, custom, suspension) {
+	const memberships = `jsonb_array_elements(
+        case jsonb_typeof(coalesce(claims -> 'memberships', claims -> 'app_metadata' -> 'memberships'))
+          when 'array' then coalesce(claims -> 'memberships', claims -> 'app_metadata' -> 'memberships')
+          else '[]'::jsonb
+        end
+      ) m
+      cross join lateral jsonb_array_elements_text(
+        case jsonb_typeof(m -> 'roles') when 'array' then m -> 'roles' else '[]'::jsonb end
+      ) r(role)`;
+	const customBranch = custom === void 0 ? "" : ` or exists (
+      select 1
+      from ${memberships}
+      cross join lateral (select m -> 'grants' -> r.role as g) cg
+      where m ->> 'scope' = ${literal(scope)}
+        and m ->> 'id' = requested_tenant
+        and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
+        and jsonb_typeof(cg.g) = 'array'
+        and not (r.role = any(${textArray(custom.declared)}))
+        and ${customHolds(q, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
+    )`;
+	const held = (effect) => `exists (
+      select 1
+      from ${memberships}
+      join ${q("role_permissions")} rp on rp.role = r.role
+      where m ->> 'scope' = ${literal(scope)}
+        and m ->> 'id' = requested_tenant
+        and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
+        and ${effectMatch(literal(scope), effect)}
+    )`;
+	const global = (effect) => `exists (
+      select 1
+      from jsonb_array_elements_text(
+        case jsonb_typeof(role_claim)
+          when 'array' then role_claim
+          when 'string' then jsonb_build_array(role_claim)
+          else '[]'::jsonb
+        end
+      ) r(role)
+      join ${q("role_permissions")} rp on rp.role = r.role
+      where ${effectMatch(`'global'`, effect)}
+    )`;
+	return `declare
+  claims jsonb := (select auth.jwt());
+  role_claim jsonb;
+begin
+  if claims is null or (select auth.uid()) is null then
+    return false;
+  end if;${suspendedGuards(suspension, scope, "(select auth.uid())")}
+  -- a top-level null (no role row) falls back to app_metadata, like subjectFromSupabase
+  role_claim := coalesce(nullif(claims -> 'user_role', 'null'::jsonb), claims -> 'app_metadata' -> 'user_role');
+  if requested_tenant is not null then
+    return (${held("allow")}${customBranch})
+    and not ${held("deny")}
+    and not ${global("deny")};
+  end if;
+  return ${global("allow")}
+    and not ${global("deny")};
+end;`;
+}
+/**
+* `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
+* scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
+* `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
+* tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
+* tenant request with no memberships source is denied, never answered from global roles. It
+* answers "does a role hold this permission" without seeing a row: an allow with row conditions
+* does not count, and a deny the user's tenant or global roles hold overrides every allow.
+* Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+* instead. Only `authenticated` may execute it.
+*/
+function authorizeSql(options = {}) {
+	const schema = options.schema ?? "permdock";
+	const q = (name) => table(`${schema}.${name}`);
+	const memberships = typeof options.tenant === "object" ? options.tenant : void 0;
+	const scope = options.scope ?? "tenant";
+	if (!/^[a-z][a-z0-9_]*$/u.test(scope)) throw new TypeError(`PermDock: unsafe scope name '${scope}'`);
+	const body = options.authorize === "jwt" ? jwtBody(q, scope, options.customRoles, options.suspension) : databaseBody(q, scope, memberships, options.customRoles, options.suspension);
+	const signature = `${q("authorize")}(${q("app_permission")}, text)`;
+	return `create or replace function ${q("authorize")}(
+  requested_permission ${q("app_permission")},
+  requested_tenant text default null
+)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+${body}
+$$;
+revoke execute on function ${signature} from public, anon;
+grant execute on function ${signature} to authenticated;
+`;
+}
+//#endregion
+export { readSubjectRecord as a, postgrestSources as i, supabaseRls as n, supabaseClaims as o, supabaseApprovalStore as r, exchangeCapability as s, authorizeSql as t };