permdock 0.1.0 → 0.2.0

package/dist/{stores-CkG2HrSg.js → stores-4_sqiOA1.js}

@@ -1,4 +1,5 @@
-import { n as providePermDock, t as getStore } from "./context-CKEAabd7.js";
+import { c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, t as approvalHandle } from "./views-Soe7bGSC.js";
+import { n as providePermDock, t as getStore } from "./context-Ttp0ekMT.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {
@@ -14,9 +15,7 @@ function fromStore(store, compute) {
 	});
 }
 function sveltePermDock(store) {
-	return new Proxy({}, { get(_target, prop, _receiver) {
-		return Reflect.get(store.get(), prop);
-	} });
+	return livePermDock(() => store.get());
 }
 function setPermDock(options) {
 	return sveltePermDock(providePermDock(options));
@@ -34,49 +33,19 @@ function permissions(references, data) {
 	return permissionsFor(getStore(), references, data);
 }
 function permissionsFor(store, references, data) {
-	return fromStore(store, () => {
-		const granted = [];
-		const byKey = {};
-		for (const reference of references()) {
-			const next = store.permissionState(reference, data?.());
-			byKey[reference.key] = next;
-			if (next.allowed) granted.push(reference);
-		}
-		return new Proxy({
-			granted,
-			get(reference) {
-				return byKey[reference.key];
-			}
-		}, { get(target, prop, receiver) {
-			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
-			return Reflect.get(target, prop, receiver);
-		} });
-	});
+	return fromStore(store, () => permissionSet(store, references(), data?.()));
 }
 function filtered(reference, rows) {
 	return filteredFor(getStore(), reference, rows);
 }
 function filteredFor(store, reference, rows) {
-	return fromStore(store, () => {
-		const permdock = store.get();
-		const next = permdock.filter(reference, rows());
-		next.partial = permdock.where(reference).partial;
-		return next;
-	});
+	return fromStore(store, () => filterResult(store.get(), reference, rows()));
 }
 function tenant() {
 	return tenantFor(getStore());
 }
 function tenantFor(store) {
-	return fromStore(store, () => {
-		const permdock = store.get();
-		return {
-			tenant: permdock.subject.principal?.tenant ?? null,
-			tenants: permdock.tenants(),
-			switchTo: (id) => permdock.refresh({ tenant: id }),
-			status: permdock.status()
-		};
-	});
+	return fromStore(store, () => tenantView(store.get()));
 }
 function memberships() {
 	return membershipsFor(getStore());
@@ -88,11 +57,7 @@ function roles(options = () => ({})) {
 	return rolesFor(getStore(), options);
 }
 function rolesFor(store, options = () => ({})) {
-	return fromStore(store, () => {
-		const next = options();
-		const permdock = store.get();
-		return { roles: (next.team === void 0 ? permdock : permdock.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
-	});
+	return fromStore(store, () => rolesView(store.get(), options()));
 }
 function assignable() {
 	return assignableFor(getStore());
@@ -104,37 +69,19 @@ function assignablePermissions(options = {}) {
 	return assignablePermissionsFor(getStore(), options);
 }
 function assignablePermissionsFor(store, options = {}) {
-	return fromStore(store, () => store.get().assignablePermissions(options));
+	return fromStore(store, () => store.get().assignablePermissions(typeof options === "function" ? options() : options));
 }
 function subject() {
 	return subjectFor(getStore());
 }
 function subjectFor(store) {
-	return fromStore(store, () => {
-		const permdock = store.get();
-		const snapshot = permdock.snapshot();
-		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
-		return {
-			principal: permdock.subject.principal,
-			actor: permdock.subject.actor,
-			delegation: permdock.subject.delegation,
-			expiresAt: permdock.subject.expiresAt,
-			simulated
-		};
-	});
+	return fromStore(store, () => subjectView(store.get()));
 }
 function approval(decision) {
 	return approvalFor(getStore(), decision);
 }
 function approvalFor(store, decision) {
-	return fromStore(store, () => {
-		const next = decision();
-		return {
-			state: store.approvalState(next),
-			token: next.outcome === "approval-required" ? next.token : void 0,
-			request: (note) => store.requestApproval(next, note)
-		};
-	});
+	return fromStore(store, () => approvalHandle(store, decision()));
 }
 //#endregion
 export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, assignablePermissions as r, permission as s, approval as t, setPermDock as u };

package/dist/{stores-CvOnu_2T.d.ts → stores-DVR5NHLE.d.ts}

@@ -1,7 +1,7 @@
-import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "./policy-CInmNGkM.js";
-import { d as Permission } from "./permissions-B4apnahQ.js";
-import { r as Role } from "./vocabulary-Dk0fs-Jk.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "./types-DbWdEfcm.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { r as Role } from "./vocabulary-DA8a8zif.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/types.d.ts
 type PermDockSvelteOptions = {
@@ -11,11 +11,19 @@ type PermDockSvelteOptions = {
    * settles (render the same promise with `{#await}`).
    */
   readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
-  readonly endpoint?: string;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
   readonly approvals?: string;
-  readonly tenant?: string;
+  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: string | (() => string | undefined);
   readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
+  /** A getter is read on every request, so a rotated token applies without a new store. */
+  readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
   readonly maxAge?: number;
   readonly verifier?: TokenVerifier;
 };
@@ -32,9 +40,12 @@ declare function roles(options?: () => UseRolesOptions): Readable<{
   readonly roles: readonly Role[];
 }>;
 declare function assignable(): Readable<readonly Role[]>;
-declare function assignablePermissions(options?: {
+type AssignableOptions = {
+  readonly tenant?: string;
+} | (() => {
   readonly tenant?: string;
-}): Readable<readonly Permission[]>;
+});
+declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
 declare function subject(): Readable<SubjectView>;
 declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
 //#endregion

package/dist/{stream-Q_xlB6Ko.js → stream-DDpvynSB.js}

@@ -1,4 +1,4 @@
-import { r as PermDockRevokedError } from "./errors-Iy71s7Oj.js";
+import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
 //#region src/server/stream.ts
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
@@ -33,6 +33,20 @@ async function* guardIterable(source, connection, options) {
 		if (closing !== void 0) Promise.resolve(closing).catch(() => void 0);
 	}
 }
+/**
+* The connection loader for a stream `protect` already admitted: the first
+* read returns the row `protect` loaded, and each revalidation reloads it.
+*/
+function reloadAfter(loaded, load) {
+	let first = true;
+	return () => {
+		if (first) {
+			first = false;
+			return loaded;
+		}
+		return load();
+	};
+}
 /** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
 const POLICY_VIOLATION = 1008;
 /** The Problem Details for an aborted connection signal. */
@@ -49,4 +63,4 @@ function onRevoked(connection, end) {
 	else connection.signal.addEventListener("abort", fire, { once: true });
 }
 //#endregion
-export { onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };
+export { reloadAfter as a, onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };

package/dist/{stream-BhMfZOwr.d.ts → stream-DlvG2hs-.d.ts}

@@ -1,5 +1,5 @@
-import { d as Permission } from "./permissions-B4apnahQ.js";
-import { r as ProtectOptions } from "./create-BKF3dgFk.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { i as ProtectOptions } from "./create-BWyx3jua.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/subject-settings-BwBmCdTR.js

@@ -0,0 +1,128 @@
+//#region src/conditions/row-check.ts
+const MISSING = Object.freeze({ found: false });
+const GRANTED = Object.freeze({
+	found: true,
+	granted: true
+});
+const DENIED = Object.freeze({
+	found: true,
+	granted: false
+});
+function rowCheckOf(found, granted) {
+	return found ? granted ? GRANTED : DENIED : MISSING;
+}
+/** Reads `select <filter> as granted ... where <key> limit 2`; only a boolean `true` or `1` grants. */
+function rowCheckFrom(rows) {
+	if (rows.length > 1) throw new Error("PermDock: checkRow key matches more than one row");
+	const [row] = rows;
+	return rowCheckOf(row !== void 0, row?.granted === true || row?.granted === 1);
+}
+//#endregion
+//#region src/conditions/subject-settings.ts
+const NAME = /^[a-z_][a-z0-9_]*$/u;
+function settingName(name, what) {
+	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
+	return name;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+* The credential a principal acts through. Entries limited to `ids` are left
+* out of `scopes`: the claim has no per-row form, so the database allows less.
+*/
+function heldCredential(principal) {
+	const credential = Reflect.get(principal, "credential");
+	if (!isRecord(credential) || typeof credential["id"] !== "string" || credential["kind"] !== "user" && credential["kind"] !== "service" || !Array.isArray(credential["permissions"])) return;
+	const scopes = credential["permissions"].flatMap((entry) => isRecord(entry) && typeof entry["permission"] === "string" && entry["ids"] === void 0 ? [entry["permission"]] : []);
+	const tenant = credential["tenant"];
+	return {
+		id: credential["id"],
+		kind: credential["kind"],
+		tenant: typeof tenant === "string" && tenant !== "" ? tenant : void 0,
+		roles: strings(credential["roles"]),
+		scopes
+	};
+}
+function field(name, fallback) {
+	return settingName(name ?? fallback, "API-key claim field");
+}
+function apiKeyClaim(held, options = {}) {
+	const claim = {
+		id: held.id,
+		[field(options.scopes, "scopes")]: held.scopes
+	};
+	if (held.tenant !== void 0) claim[field(options.tenant, "tenant")] = held.tenant;
+	if (held.kind === "service") claim[field(options.roles, "roles")] = held.roles;
+	return [field(options.claim, "api_key"), claim];
+}
+function setConfigs(settings) {
+	if (settings.length === 0) return [];
+	const parts = [];
+	let open = "select ";
+	for (const [name] of settings) {
+		parts.push(`${open}set_config('${name}', `);
+		open = ", true), ";
+	}
+	parts.push(", true)");
+	return [{
+		strings: parts,
+		values: settings.map(([, value]) => value)
+	}];
+}
+/**
+* The transaction preamble that makes Postgres see `permdock.subject`: one `select set_config(…)`
+* that sets the role, then the claims the generated policies read. Runs inside the caller's
+* transaction, so every setting is local to it.
+*/
+function subjectStatements(permdock, options = {}) {
+	const principal = permdock.subject.principal;
+	const role = options.role ?? (principal === null ? "anon" : "authenticated");
+	if (role !== false && role !== "authenticated" && role !== "anon") throw new Error(`PermDock: withSubject sets role authenticated or anon, not '${String(role)}'`);
+	const tenantClaim = settingName(options.tenantClaim ?? "tenant_id", "tenant claim");
+	const claims = Object.fromEntries(Object.entries(options.claims ?? {}).filter(([name]) => name !== "sub" && name !== "role" && name !== tenantClaim));
+	if (principal !== null) {
+		const held = heldCredential(principal);
+		claims["sub"] = held?.kind === "service" ? "" : principal.id;
+		if (principal.tenant !== void 0) claims[tenantClaim] = principal.tenant;
+		if (held !== void 0) {
+			const [name, value] = apiKeyClaim(held, options.apiKeys);
+			claims[name] = value;
+		}
+	}
+	if (role !== false) claims["role"] = role;
+	const subjectId = typeof claims["sub"] === "string" ? claims["sub"] : "";
+	const settings = role === false ? [] : [["role", role]];
+	const dialect = options.dialect ?? "supabase";
+	switch (dialect) {
+		case "supabase":
+		case "neon":
+			settings.push(["request.jwt.claims", JSON.stringify(claims)]);
+			return setConfigs(settings);
+		case "guc": {
+			const prefix = settingName(options.gucPrefix ?? "app", "setting prefix");
+			settings.push([`${prefix}.user_id`, subjectId]);
+			for (const [name, value] of Object.entries(claims)) {
+				if (name === "sub") continue;
+				settings.push([`${prefix}.${settingName(name, "claim name")}`, typeof value === "string" ? value : JSON.stringify(value)]);
+			}
+			return setConfigs(settings);
+		}
+		default: return dialect;
+	}
+}
+/** A statement as text with `$1`, `$2` placeholders, for raw executors. */
+function statementText(statement) {
+	let text = "";
+	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
+	return text;
+}
+/** A statement as a template-strings array, for `sql` tags. */
+function statementTemplate(statement) {
+	return Object.assign([...statement.strings], { raw: [...statement.strings] });
+}
+//#endregion
+export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };

package/dist/supabase/index.d.ts

@@ -1,6 +1,8 @@
-import { hr as Subject } from "../policy-CInmNGkM.js";
-import { a as SupabaseManifestMembership, i as SupabaseManifestHelper, n as SupabaseHookManifest, o as SupabaseManifestRls, r as SupabaseManifestColumn, s as SupabaseManifestValue, t as SupabaseHookClaim } from "../manifest-DDQbC6K0.js";
-import { C as SupabaseActClaim, D as SupabaseMembershipClaim, E as SupabaseClaimsSchema, O as SupabasePermDockClaims, S as SupabaseSuspension, T as SupabaseClaimsOptions, _ as SupabasePrincipal, a as SqlMembershipSource, b as SupabaseSessionLike, c as fromJunction, d as SupabaseActiveRow, f as SupabaseActor, g as SupabaseMembershipTable, h as SupabaseInclude, i as MembershipTableOptions, k as supabaseClaims, l as fromTable, m as SupabaseDelegation, n as MembershipJunctionOptions, o as SqlQuery, p as SupabaseActorResult, r as MembershipSql, s as authzVersion, t as AUTHZ_VERSION_TABLE, u as AuthorizeSqlOptions, v as SupabaseRlsConfig, w as SupabaseClaims, x as SupabaseSubjectOptions, y as SupabaseRlsOptions } from "../sources-DOpW5Ila.js";
+import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-yF5LmQVD.js";
+import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BcJgw0lt.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
@@ -28,6 +30,117 @@ type ExchangeCapabilityOptions = {
  */
 export declare function exchangeCapability(subject: Subject, options: ExchangeCapabilityOptions): Promise<string | undefined>;
 //#endregion
+//#region src/supabase/postgrest.d.ts
+/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+type SupabaseRpcResult = {
+  readonly data: unknown;
+  readonly error: {
+    readonly message: string;
+  } | null;
+};
+/**
+ * The part of a supabase-js client `postgrestSources` calls:
+ * `client.schema(name).rpc(fn, args)`. Pass a client that may execute the
+ * function, such as a `service_role` client after the grant the docs show.
+ */
+type SupabaseRpcClient = {
+  schema(name: string): {
+    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type SupabaseRpcCaller = {
+  schema(name: never): {
+    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type PostgrestSourcesOptions = {
+  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  readonly schema?: string;
+  /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
+  readonly fn?: string;
+  readonly membersFn?: string;
+  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  readonly versionFn?: string;
+  /**
+   * The policy whose declared roles tell custom roles apart. With it,
+   * `customRoles` reads nothing while every role the subject holds is
+   * declared, and `memberships.version` reads the whole subject in one call
+   * when the token claims a custom role, which the custom roles need anyway.
+   */
+  readonly policy?: Policy;
+};
+/** One user as `subject_for(p_user)` returns it. */
+type SubjectRecord = {
+  readonly id: string;
+  /** `false` for a suspended user, who holds no roles or memberships. */
+  readonly active: boolean;
+  readonly roles: readonly string[];
+  readonly memberships: readonly Membership[];
+  readonly customRoles: readonly CustomRole[];
+  readonly authzVersion?: number;
+};
+type PostgrestSources = {
+  /**
+   * Memberships and the authorization version of any principal, and `list`,
+   * the live members of one scope instance through `members_of`, for
+   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
+   * the token was truncated.
+   */
+  readonly memberships: MembershipSource & {
+    list(query: {
+      readonly scope: string;
+      readonly id: string;
+    }): Promise<MemberEntry[]>;
+  };
+  /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
+  customRoles(principal: {
+    readonly id: string;
+  }): RoleSource;
+  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
+  subject(userId: string): Promise<Subject>;
+  /** The raw record, `undefined` for an unknown user. */
+  record(userId: string): Promise<SubjectRecord | undefined>;
+};
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+export declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
+/**
+ * Membership, custom-role and subject sources over the `subject_for(p_user)`,
+ * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+ * `permdock supabase hook generate` writes, for a backend that reaches
+ * Postgres only through PostgREST. `memberships.version` reads only the
+ * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+ * only for a stale token; when the version function is missing it falls back
+ * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * subject read in one `subject_for` call instead, and custom roles are read
+ * only for a subject that holds one. Each user and each instance is read once per
+ * `postgrestSources` call, so create it per request or per job.
+ */
+export declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
+//#endregion
+//#region src/supabase/approval-store.d.ts
+type SupabaseApprovalStoreOptions = {
+  /** Schema of the generated store functions (`rls.schema`). Default `permdock`. */
+  readonly schema?: string;
+  /** How long a request stays open when the caller sets no `ttl`, in milliseconds. */
+  readonly ttl?: number;
+  /**
+   * Runs once per stored request, after the call that stored it, with the
+   * stored request: notify the approvers, or cancel the requests this one
+   * replaces. A repeated ask that finds the request still open does not run
+   * it again. A throw fails the open, so the caller does not run the action.
+   */
+  readonly onOpen?: (request: ApprovalRequest) => void | Promise<void>;
+};
+/**
+ * An `ApprovalStore` over the table and functions `rls.approvals` generates,
+ * called through supabase-js (`client.schema(schema).rpc(...)`) with a
+ * client that may execute them, such as a `service_role` client. Each method
+ * is one atomic statement in the database: a repeated ask keeps the open
+ * request, two racing approvers both count towards a quorum, and two racing
+ * resumes never both consume an approval.
+ */
+export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
+//#endregion
 //#region src/supabase/rls.d.ts
 export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
 /**
@@ -55,13 +168,16 @@ export declare function authorizeSql(options?: AuthorizeSqlOptions): string;
  * is `{ ok: false }` and must deny.
  */
 export declare function actorOf(claims: unknown): SupabaseActorResult;
-/** The OAuth `scope` claim (a space-separated string or a list) as `scopes`; `undefined` when empty. */
+/**
+ * The OAuth `scope` claim (a space-separated string or a list) as `scopes`,
+ * without the OpenID Connect identity scopes; `undefined` when none is left.
+ */
 export declare function delegationOf(claims: unknown): SupabaseDelegation | undefined;
 export declare function subjectFromSupabase(claims: unknown, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 /**
- * A verified session object (for example better-supabase's `AuthSession`) in, `Subject` out.
+ * A verified session object (`{ kind, claims }`) in, `Subject` out.
  * Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type SqlMembershipSource, type SqlQuery, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRls, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePrincipal, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseSessionLike, type SupabaseSubjectOptions, type SupabaseSuspension, authzVersion, fromJunction, fromTable, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, authzVersion, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };

package/dist/supabase/index.js

@@ -1,4 +1,5 @@
-import { a as subjectFromSupabaseSession, c as supabaseClaims, i as subjectFromSupabase, l as exchangeCapability, n as delegationOf, o as authorizeSql, s as supabaseRls, t as actorOf } from "../supabase-DTxGtYdi.js";
+import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-DTBaC20O.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as fromTable, i as fromJunction, r as authzVersion, t as AUTHZ_VERSION_TABLE } from "../sources-DVHM3Mwq.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromTable, subjectFromSupabase, subjectFromSupabaseSession, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };
+import { a as fromSupabasePostgres, i as fromJunction, o as fromTable, r as authzVersion, t as AUTHZ_VERSION_TABLE } from "../sources-B0UvrJ21.js";
+import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };

package/dist/supabase/middleware.d.ts

@@ -1,9 +1,8 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, hr as Subject, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { o as OtelWrap } from "../types-B9dmiiab.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { h as WebBotAuthVerifier, n as OpenApiHooks } from "../create-BKF3dgFk.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { n as OpenApiHooks } from "../create-BWyx3jua.js";
+import { n as ServerAdapterServices } from "../bind-CVy3Espv.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
@@ -26,37 +25,43 @@ export type SupabaseJwtClaims = {
 /**
  * What `withPermDock` requires upstream: a `jwtClaims` contribution. Supabase's
  * `withClaims`, `withRequiredClaims` and `withSupabase` all provide it; `null`
- * is the anonymous caller (no bearer token, an `sb_*` API key, or the `secret`
- * auth mode).
+ * is the anonymous caller (no bearer token or an `sb_*` API key), unless
+ * `secretKeys` names the secret key `withSupabase` matched.
  */
 export type SupabaseMiddlewareContext = {
   readonly jwtClaims: SupabaseJwtClaims | null;
 };
-export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = {
+/**
+ * A Supabase secret key that acts as a tenant service principal. `id` is the
+ * principal id, `roles` are held in `tenant` only, and `permissions` caps
+ * what the key may do, as a `service` credential does.
+ */
+export type SupabaseSecretKey = {
+  readonly id: string;
+  readonly tenant: string;
+  readonly roles: readonly string[];
+  readonly permissions: readonly Permission[];
+};
+export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = InstanceOptions & ServerAdapterServices & {
+  /**
+   * Named secret keys (`SUPABASE_SECRET_KEYS`) that act as service
+   * principals when `withSupabase` matched one (`authMode: 'secret'` with
+   * that `authKeyName`). Any other key, an unnamed `secret` and every
+   * `publishable` key stay anonymous.
+   */
+  readonly secretKeys?: Readonly<Record<string, SupabaseSecretKey>>;
   readonly subject: (ctx: SupabaseMiddlewareContext, request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly tenant?: string | ((ctx: SupabaseMiddlewareContext, request: Request) => string | undefined | Promise<string | undefined>);
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
 };
 export type WithPermDockConfig = {
   /** Run `protect` before the handler; a denial short-circuits with Problem Details. */
   readonly protect?: Permission;
+  /**
+   * The OAuth scopes that reach the handler: a delegated token holding none
+   * of them is refused with `insufficient_scope`. Without `protect`, the
+   * handler needs a signed-in principal and checks no permission.
+   */
+  readonly oauthScopes?: readonly string[];
   /** Load the row `protect` decides on; `null` or `undefined` yields 404. */
   readonly data?: (ctx: SupabaseMiddlewareContext, request: Request) => unknown;
   /** `true` when `data` returns a row the server loaded; anything else is validated before the check. */