permdock 0.1.0 → 0.2.0

package/dist/{supabase-DTxGtYdi.js → supabase-DTBaC20O.js}

@@ -1,12 +1,13 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { o as parseCapability } from "./capability-B68OFnZx.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { o as parseCapability } from "./capability-4qPdO9gk.js";
+import { t as ApprovalError } from "./errors-DRnGZHzF.js";
+import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-DMAWwAJV.js";
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-Bll1d7y0.js";
-import "./sources-DVHM3Mwq.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
+import { l as keptKeys, s as roleColumn } from "./sources-B0UvrJ21.js";
+import { i as readMemberships } from "./manifest-iaoBXHKc.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -62,7 +63,7 @@ const KNOWN = /* @__PURE__ */ new Set([
 	"act",
 	"app_metadata"
 ]);
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function own(record, key) {
@@ -83,7 +84,7 @@ function optional(record, key, path, issues, check, expected) {
 }
 const isString = (value) => typeof value === "string";
 function checkMembership(item, path, issues) {
-	if (!isRecord$1(item)) {
+	if (!isRecord$2(item)) {
 		issue(issues, path, "Expected a membership object");
 		return;
 	}
@@ -98,13 +99,14 @@ function checkMembership(item, path, issues) {
 		"grantedBy",
 		"reason"
 	]) optional(item, key, path, issues, isString, "a string");
-	optional(item, "within", path, issues, (value) => isRecord$1(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
-	optional(item, "on", path, issues, (value) => isRecord$1(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
+	optional(item, "within", path, issues, (value) => isRecord$2(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
+	optional(item, "on", path, issues, (value) => isRecord$2(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
 	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
-	optional(item, "member", path, issues, (value) => isRecord$1(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
+	optional(item, "member", path, issues, (value) => isRecord$2(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
 	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
-	optional(item, "grants", path, issues, isRecord$1, "an object");
+	optional(item, "keep", path, issues, isStrings, "an array of strings");
+	optional(item, "grants", path, issues, isRecord$2, "an object");
 	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
 }
 function checkPermDockClaims(record, tenantClaim, path, issues) {
@@ -121,7 +123,7 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 	}
 	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
 	optional(record, tenantClaim, path, issues, isString, "a string");
-	optional(record, "attrs", path, issues, isRecord$1, "an object");
+	optional(record, "attrs", path, issues, isRecord$2, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
 /** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
@@ -142,7 +144,7 @@ function checkAct(value, issues) {
 	let current = value;
 	const path = ["act"];
 	while (current !== void 0) {
-		if (!isRecord$1(current)) {
+		if (!isRecord$2(current)) {
 			issue(issues, path, "Expected an object");
 			return;
 		}
@@ -155,7 +157,7 @@ function checkAct(value, issues) {
 }
 function checkClaims(value, tenantClaim) {
 	const issues = [];
-	if (!isRecord$1(value)) {
+	if (!isRecord$2(value)) {
 		issue(issues, [], "Expected a claims object");
 		return issues;
 	}
@@ -166,7 +168,7 @@ function checkClaims(value, tenantClaim) {
 	if (act !== void 0) checkAct(act, issues);
 	const meta = own(value, "app_metadata");
 	if (meta !== void 0) {
-		if (isRecord$1(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
+		if (isRecord$2(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
 		else issue(issues, ["app_metadata"], "Expected an object");
 	}
 	return issues;
@@ -176,8 +178,8 @@ function merge(base, app) {
 	if (issues.length > 0) return { issues };
 	const baseValue = base.value;
 	const appValue = app.value;
-	if (!isRecord$1(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
-	return { value: isRecord$1(baseValue) ? {
+	if (!isRecord$2(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
+	return { value: isRecord$2(baseValue) ? {
 		...baseValue,
 		...appValue
 	} : appValue };
@@ -190,9 +192,9 @@ function schemaOf(validate) {
 			validate
 		}),
 		extend(app) {
-			if (!isRecord$1(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord$2(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const props = Reflect.get(app, "~standard");
-			if (!isRecord$1(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord$2(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const run = app["~standard"].validate.bind(app["~standard"]);
 			return schemaOf((value) => {
 				const base = validate(value);
@@ -223,6 +225,287 @@ function supabaseClaims(options = {}) {
 	});
 }
 //#endregion
+//#region src/supabase/postgrest.ts
+function callRpc(client, schema, fn, args) {
+	return client.schema(schema).rpc(fn, args);
+}
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function grantOf(value) {
+	if (!isRecord$1(value) || typeof value["permission"] !== "string") return;
+	return compact({
+		permission: value["permission"],
+		effect: value["effect"] === "deny" ? "deny" : "allow",
+		level: typeof value["level"] === "string" ? value["level"] : void 0
+	});
+}
+function customRoleOf(value) {
+	if (!isRecord$1(value) || typeof value["name"] !== "string") return;
+	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
+		const grant = grantOf(item);
+		return grant === void 0 ? [] : [grant];
+	}) : [];
+	const includes = strings(value["includes"]);
+	const body = {
+		name: value["name"],
+		grants,
+		...includes.length === 0 ? {} : { includes }
+	};
+	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
+		...body,
+		scope: "global"
+	} : void 0;
+	if (typeof value["tenant"] !== "string") return;
+	return compact({
+		...body,
+		tenant: value["tenant"],
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
+		id: typeof value["id"] === "string" ? value["id"] : void 0
+	});
+}
+function readMemberEntries(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		if (!isRecord$1(item) || !isRecord$1(item["principal"])) return [];
+		const id = item["principal"]["id"];
+		const [membership] = readMemberships([item["membership"]]).memberships;
+		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
+			principal: { id },
+			membership
+		}] : [];
+	});
+}
+function versionOf(value) {
+	const version = typeof value === "string" ? Number(value) : value;
+	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
+}
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+function readSubjectRecord(value) {
+	if (!isRecord$1(value) || typeof value["id"] !== "string") return;
+	if (value["active"] !== true) return {
+		id: value["id"],
+		active: false,
+		roles: [],
+		memberships: [],
+		customRoles: []
+	};
+	const version = value["authzVersion"];
+	return compact({
+		id: value["id"],
+		active: true,
+		roles: strings(value["roles"]),
+		memberships: readMemberships(value["memberships"]).memberships,
+		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
+			const role = customRoleOf(item);
+			return role === void 0 ? [] : [role];
+		}) : [],
+		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
+	});
+}
+/**
+* Membership, custom-role and subject sources over the `subject_for(p_user)`,
+* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+* `permdock supabase hook generate` writes, for a backend that reaches
+* Postgres only through PostgREST. `memberships.version` reads only the
+* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+* only for a stale token; when the version function is missing it falls back
+* to `subject_for`. With `policy`, a token that claims a custom role has its
+* subject read in one `subject_for` call instead, and custom roles are read
+* only for a subject that holds one. Each user and each instance is read once per
+* `postgrestSources` call, so create it per request or per job.
+*/
+function postgrestSources(client, options = {}) {
+	const schema = options.schema ?? "permdock";
+	const fn = options.fn ?? "subject_for";
+	const membersFn = options.membersFn ?? "members_of";
+	const versionFn = options.versionFn ?? "authz_version_for";
+	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
+	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
+	const loaded = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	const listed = /* @__PURE__ */ new Map();
+	const list = (query) => {
+		const key = JSON.stringify([query.scope, query.id]);
+		const cached = listed.get(key);
+		if (cached !== void 0) return cached.then((entries) => [...entries]);
+		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
+			p_scope: query.scope,
+			p_id: query.id
+		})).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
+			return readMemberEntries(result.data);
+		});
+		listed.set(key, pending);
+		return pending.then((entries) => [...entries]);
+	};
+	const record = (userId) => {
+		const cached = loaded.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+			return readSubjectRecord(result.data);
+		});
+		loaded.set(userId, pending);
+		return pending;
+	};
+	const version = (userId) => {
+		const read = loaded.get(userId);
+		if (read !== void 0) return read.then((found) => found?.authzVersion);
+		const cached = versions.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
+		versions.set(userId, pending);
+		return pending;
+	};
+	const live = async (userId) => {
+		const found = await record(userId);
+		return found?.active === true ? found : void 0;
+	};
+	return {
+		memberships: {
+			async membershipsFor(principal) {
+				return [...(await live(principal.id))?.memberships ?? []];
+			},
+			version(principal) {
+				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
+			},
+			list
+		},
+		customRoles(principal) {
+			return {
+				async rolesFor(tenant, context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
+				},
+				async globalRoles(context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
+				}
+			};
+		},
+		async subject(userId) {
+			const found = await live(userId);
+			if (found === void 0) return {
+				principal: null,
+				context: {}
+			};
+			return {
+				principal: compact({
+					id: found.id,
+					roles: found.roles,
+					memberships: found.memberships,
+					authzVersion: found.authzVersion
+				}),
+				context: {}
+			};
+		},
+		record
+	};
+}
+//#endregion
+//#region src/supabase/approval-store.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
+function requestOf(value) {
+	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
+	return value;
+}
+function filterOf(filter) {
+	return compact({
+		status: filter.status,
+		tenant: filter.tenant,
+		principalId: filter.principalId,
+		actorId: filter.actorId,
+		session: filter.session
+	});
+}
+/**
+* An `ApprovalStore` over the table and functions `rls.approvals` generates,
+* called through supabase-js (`client.schema(schema).rpc(...)`) with a
+* client that may execute them, such as a `service_role` client. Each method
+* is one atomic statement in the database: a repeated ask keeps the open
+* request, two racing approvers both count towards a quorum, and two racing
+* resumes never both consume an approval.
+*/
+function supabaseApprovalStore(client, options = {}) {
+	const schema = options.schema ?? "permdock";
+	const call = async (fn, args) => {
+		const result = await callRpc(client, schema, fn, args);
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+		return result.data;
+	};
+	const get = async (token) => requestOf(await call("permdock_approval_get", { p_token: token }));
+	return {
+		...options.ttl === void 0 ? {} : { ttl: options.ttl },
+		async create(request) {
+			await call("permdock_approval_open", { p_request: request });
+			if (options.onOpen !== void 0) {
+				const stored = await get(request.token);
+				if (stored !== null && canonicalJson(stored) === canonicalJson(request)) await options.onOpen(stored);
+			}
+		},
+		get,
+		async resolve(token, verdict) {
+			const current = await get(token);
+			if (current === null) throw new ApprovalError("approval-not-found", "approval was not found");
+			const next = applyApprovalVerdict(current, verdict);
+			const written = requestOf(await call("permdock_approval_resolve", {
+				p_token: token,
+				p_next: next,
+				p_seen: current.approvals?.length ?? 0
+			}));
+			if (written === null) throw new ApprovalError("approval-not-pending", "approval is not pending");
+			return written;
+		},
+		async consume(token, now = /* @__PURE__ */ new Date()) {
+			return requestOf(await call("permdock_approval_consume", {
+				p_token: token,
+				p_now: now.toISOString()
+			}));
+		},
+		async list(query) {
+			const after = query.cursor === void 0 ? void 0 : decodeApprovalCursor(query.cursor);
+			if (after === null) return { items: [] };
+			const size = approvalPageSize(query.limit);
+			const data = await call("permdock_approval_list", {
+				p_filter: filterOf(query),
+				p_after_created: after?.[0] ?? null,
+				p_after_token: after?.[1] ?? null,
+				p_limit: size + 1
+			});
+			const rows = Array.isArray(data) ? data.flatMap((row) => {
+				const request = requestOf(row);
+				return request === null ? [] : [request];
+			}) : [];
+			const items = rows.slice(0, size);
+			const last = items.at(-1);
+			return rows.length > size && last !== void 0 ? {
+				items,
+				next: encodeApprovalCursor(last)
+			} : { items };
+		},
+		async expire(now = /* @__PURE__ */ new Date()) {
+			const count = await call("permdock_approval_expire", { p_now: now.toISOString() });
+			return typeof count === "number" ? count : 0;
+		},
+		async cancel(filter, meta) {
+			const count = await call("permdock_approval_cancel", {
+				p_filter: filterOf(filter),
+				p_by: meta.by,
+				p_note: meta.note ?? null,
+				p_now: (/* @__PURE__ */ new Date()).toISOString()
+			});
+			return typeof count === "number" ? count : 0;
+		}
+	};
+}
+//#endregion
 //#region src/supabase/rls.ts
 function isTable(value) {
 	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
@@ -236,7 +519,9 @@ function supabaseRls(options = {}) {
 		tenantClaim: options.tenantClaim ?? "tenant_id",
 		tenantType: options.tenantType,
 		memberships,
-		suspension: options.suspension
+		suspension: options.suspension,
+		realtime: options.realtime,
+		storage: options.storage
 	});
 }
 const ident = (name) => quoteSqlIdent(name);
@@ -245,6 +530,13 @@ const literal = quoteSqlLiteral;
 function qualifiedTable(name) {
 	return table(name.includes(".") ? name : `public.${name}`);
 }
+/** The memberships table's role key over alias `m`, joined to its roles table when it holds a reference. */
+function tenantRole(memberships) {
+	return roleColumn(memberships.role, memberships.table.includes(".") ? memberships.table : `public.${memberships.table}`, "m", {
+		label: "authorizeSql tenant.role",
+		indent: "      "
+	});
+}
 function textArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(literal).join(", ")}]::text[]`;
 }
@@ -258,7 +550,10 @@ function activeRow(row, id, text = false) {
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
 	return `exists (select 1 from ${qualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
-/** Early `return false` for a suspended user, or a tenant request for a suspended instance. */
+/**
+* Early `return false` for a suspended user, or a tenant request for a
+* suspended instance unless its scope keeps the requested permission.
+*/
 function suspendedGuards(suspension, scope, uid) {
 	const lines = [];
 	const users = suspension?.users;
@@ -266,9 +561,13 @@ function suspendedGuards(suspension, scope, uid) {
     return false; -- suspended user
   end if;`);
 	const tenant = suspension?.scopes?.[scope];
-	if (tenant !== void 0) lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)} then
+	if (tenant !== void 0) {
+		const keep = keptKeys(tenant);
+		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${textArray(keep)}))`;
+		lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)}${kept} then
     return false; -- suspended ${scope}
   end if;`);
+	}
 	return lines.map((line) => `\n${line}`).join("");
 }
 function claimEntries(where, value) {
@@ -289,16 +588,26 @@ function customHolds(q, scope, allows, denies, includes) {
             ))
         )`;
 }
-function customDatabaseBranch(q, scope, memberships, declared) {
-	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = m.${ident(memberships.role)}::text`;
+function disabledLine(memberships, suspension) {
+	if (memberships.disabledAt === void 0) return "";
+	const column = `m.${ident(memberships.disabledAt)}`;
+	const keep = keptKeys(suspension?.memberships);
+	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${textArray(keep)}))`;
+}
+function claimKept(suspension) {
+	return keptKeys(suspension?.memberships).length === 0 ? "" : `\n        and case coalesce(jsonb_typeof(m -> 'keep'), 'null') when 'null' then true when 'array' then m -> 'keep' @> jsonb_build_array(requested_permission::text) else false end`;
+}
+function customDatabaseBranch(q, scope, memberships, declared, levels, suspension) {
+	const role = tenantRole(memberships);
+	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m
+      from ${qualifiedTable(memberships.table)} m${role.join}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(memberships.tenant)} = v_member_tenant
-        and not (m.${ident(memberships.role)}::text = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}
-        and ${customHolds(q, scope, rows("custom_role_permissions", "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
+        and not (${role.sql} = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
+        and ${customHolds(q, scope, rows("custom_role_permissions", levels ? "permission || coalesce('@' || c.level, '')" : "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
     )`;
 }
 /**
@@ -324,13 +633,14 @@ function databaseBody(q, scope, memberships, custom, suspension) {
     return false; -- no memberships table configured
   end if;`;
 	if (memberships !== void 0 && tenantColumn !== void 0) {
+		const role = tenantRole(memberships);
 		const held = (effect) => `exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m
-      join ${q("role_permissions")} rp on rp.role = m.${ident(memberships.role)}::text
+      from ${qualifiedTable(memberships.table)} m${role.join}
+      join ${q("role_permissions")} rp on rp.role = ${role.sql}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(tenantColumn)} = v_member_tenant
-        and ${effectMatch(literal(scope), effect)}${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}
+        and ${effectMatch(literal(scope), effect)}${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
     )`;
 		tenantBranch = `  if requested_tenant is not null then
     begin
@@ -342,7 +652,7 @@ function databaseBody(q, scope, memberships, custom, suspension) {
     return (${held("allow")}${custom === void 0 ? "" : customDatabaseBranch(q, scope, {
 			...memberships,
 			tenant: tenantColumn
-		}, custom.declared)})
+		}, custom.declared, custom.levels === true, suspension)})
     and not ${held("deny")}
     and not ${global("deny")};
   end if;`;
@@ -381,7 +691,7 @@ function jwtBody(q, scope, custom, suspension) {
       cross join lateral (select m -> 'grants' -> r.role as g) cg
       where m ->> 'scope' = ${literal(scope)}
         and m ->> 'id' = requested_tenant
-        and ${CLAIM_UNEXPIRED}
+        and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
         and jsonb_typeof(cg.g) = 'array'
         and not (r.role = any(${textArray(custom.declared)}))
         and ${customHolds(q, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
@@ -392,7 +702,7 @@ function jwtBody(q, scope, custom, suspension) {
       join ${q("role_permissions")} rp on rp.role = r.role
       where m ->> 'scope' = ${literal(scope)}
         and m ->> 'id' = requested_tenant
-        and ${CLAIM_UNEXPIRED}
+        and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
         and ${effectMatch(literal(scope), effect)}
     )`;
 	const global = (effect) => `exists (
@@ -461,336 +771,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-//#region src/supabase/subject.ts
-const REGISTERED = /* @__PURE__ */ new Set([
-	"sub",
-	"role",
-	"iss",
-	"aud",
-	"exp",
-	"iat",
-	"nbf",
-	"aal",
-	"amr",
-	"acr",
-	"session_id",
-	"email",
-	"phone",
-	"is_anonymous",
-	"app_metadata",
-	"user_metadata",
-	"act",
-	"client_id",
-	"scope"
-]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
-function readClaim(claims, name) {
-	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
-	if (top !== void 0 && top !== null) return top;
-	const meta = claims["app_metadata"];
-	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
-}
-function asRoles(value, declared) {
-	const raw = typeof value === "string" ? value === "" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-	if (declared === void 0) return raw;
-	const allowed = new Set(declared);
-	return raw.filter((role) => allowed.has(role));
-}
-/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
-function readMemberships(value) {
-	if (!Array.isArray(value)) return {
-		memberships: [],
-		dropped: []
-	};
-	const out = [];
-	const dropped = [];
-	for (const [index, item] of value.entries()) {
-		const membership = asMembership(item);
-		if (membership === void 0) dropped.push(index);
-		else out.push(membership);
-	}
-	return {
-		memberships: out,
-		dropped
-	};
-}
-function asMembership(item) {
-	if (!isRecord(item) || !Array.isArray(item["roles"])) return;
-	const roles = item["roles"].filter((role) => typeof role === "string");
-	if (roles.length === 0) return;
-	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
-	const id = typeof item["id"] === "string" ? item["id"] : void 0;
-	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
-	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
-	const team = typeof item["team"] === "string" ? item["team"] : void 0;
-	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
-	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
-		resource: onRecord["resource"],
-		id: onRecord["id"]
-	} : void 0;
-	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
-	return compact({
-		roles,
-		scope,
-		id,
-		within,
-		tenant,
-		team,
-		on,
-		via: typeof item["via"] === "string" ? item["via"] : void 0,
-		expiresAt: typeof item["expiresAt"] === "number" ? item["expiresAt"] : void 0,
-		grantedBy: typeof item["grantedBy"] === "string" ? item["grantedBy"] : void 0,
-		reason: typeof item["reason"] === "string" ? item["reason"] : void 0,
-		member: memberOf(item["member"]),
-		managedBy: item["managedBy"] === "idp" ? "idp" : void 0,
-		entitlements: Array.isArray(item["entitlements"]) ? item["entitlements"].filter((seat) => typeof seat === "string") : void 0
-	});
-}
-function memberOf(value) {
-	if (value === null || typeof value !== "object" || !Object.hasOwn(value, "group")) return;
-	const group = value.group;
-	return typeof group === "string" && group !== "" ? { group } : void 0;
-}
-function asStrings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
-function plansFor(claims, name, tenant) {
-	if (name === void 0 || tenant === void 0) return [];
-	const byTenant = readClaim(claims, name);
-	if (!isRecord(byTenant) || !Object.hasOwn(byTenant, tenant)) return [];
-	return asStrings(byTenant[tenant]);
-}
-const INVALID_CHAIN = Object.freeze({
-	ok: false,
-	reason: "invalid-chain"
-});
-const NO_ACTOR = Object.freeze({ ok: true });
-/** Own entries of one `act` level, with the nested `act` copied the same way. */
-function copyAct(level) {
-	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
-	return Object.fromEntries(entries);
-}
-/**
-* The outer `act` level by its `kind`, the marker better-supabase writes: none is an OAuth client
-* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
-* as the user. Any other `kind`, or a support level without `session_id`, is invalid.
-*/
-function actingParty(outer, id) {
-	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
-	const kind = marked === void 0 && Object.hasOwn(outer, "session_id") ? "support" : marked;
-	const chain = copyAct(outer);
-	const reason = typeof outer["reason"] === "string" ? outer["reason"] : void 0;
-	switch (kind) {
-		case void 0: return freezeDeep({
-			ok: true,
-			actor: {
-				id,
-				kind: "oauth-client",
-				chain
-			}
-		});
-		case "support": {
-			const session = outer["session_id"];
-			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : false;
-			if (typeof session !== "string" || session === "" || typeof readOnly !== "boolean") return INVALID_CHAIN;
-			return freezeDeep({
-				ok: true,
-				actor: compact({
-					id,
-					kind: "support",
-					sessionId: session,
-					readOnly,
-					reason,
-					chain
-				})
-			});
-		}
-		case "impersonation": return freezeDeep({
-			ok: true,
-			actor: compact({
-				id,
-				kind: "impersonation",
-				reason,
-				chain
-			})
-		});
-		default: return INVALID_CHAIN;
-	}
-}
-function readActor(claims) {
-	if (Object.hasOwn(claims, "act") && claims["act"] !== void 0) {
-		let current = claims["act"];
-		while (current !== void 0) {
-			const level = isRecord(current) ? current["sub"] : void 0;
-			if (!isRecord(current) || typeof level !== "string" || level === "") return INVALID_CHAIN;
-			current = Object.hasOwn(current, "act") ? current["act"] : void 0;
-		}
-		const outer = claims["act"];
-		const sub = isRecord(outer) ? outer["sub"] : void 0;
-		if (!isRecord(outer) || typeof sub !== "string") return INVALID_CHAIN;
-		return actingParty(outer, sub);
-	}
-	const client = Object.hasOwn(claims, "client_id") ? claims["client_id"] : void 0;
-	if (typeof client === "string" && client !== "") return freezeDeep({
-		ok: true,
-		actor: {
-			id: client,
-			kind: "oauth-client"
-		}
-	});
-	return NO_ACTOR;
-}
-/**
-* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
-* actor; nested levels are prior actors, kept on `chain` for audit), else the
-* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
-* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
-* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
-* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
-* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
-* is `{ ok: false }` and must deny.
-*/
-function actorOf(claims) {
-	try {
-		return isRecord(claims) ? readActor(claims) : NO_ACTOR;
-	} catch {
-		return INVALID_CHAIN;
-	}
-}
-/** The OAuth `scope` claim (a space-separated string or a list) as `scopes`; `undefined` when empty. */
-function delegationOf(claims) {
-	try {
-		if (!isRecord(claims) || !Object.hasOwn(claims, "scope")) return;
-		const scope = claims["scope"];
-		const scopes = typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : asStrings(scope);
-		return scopes.length > 0 ? freezeDeep({ scopes }) : void 0;
-	} catch {
-		return;
-	}
-}
-function subjectDelegation(claims, chain) {
-	const delegation = compact({
-		scopes: delegationOf(claims)?.scopes,
-		chain
-	});
-	return Object.keys(delegation).length === 0 ? void 0 : delegation;
-}
-function emit(options, reason, cause) {
-	try {
-		options.onAuth?.({
-			reason,
-			cause,
-			source: "supabase"
-		});
-	} catch {}
-}
-function validateClaims(extra, schema) {
-	const result = schema["~standard"].validate(extra);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return;
-	}
-	if ("issues" in result && result.issues !== void 0) return;
-	const value = result.value;
-	return isRecord(value) ? value : void 0;
-}
-function extraClaims(claims) {
-	const extra = {};
-	const meta = claims["app_metadata"];
-	if (isRecord(meta)) for (const [key, value] of Object.entries(meta)) extra[key] = value;
-	for (const [key, value] of Object.entries(claims)) {
-		if (REGISTERED.has(key) || key === "user_metadata") continue;
-		extra[key] = value;
-	}
-	return extra;
-}
-function mapClaims(claims, options) {
-	const role = claims["role"];
-	if (role === "anon" || role === "service_role") return anonymousSubject();
-	const id = claims["sub"];
-	if (typeof id !== "string" || id === "") return anonymousSubject();
-	const act = readActor(claims);
-	if (!act.ok) {
-		emit(options, "invalid-token", act.reason);
-		return anonymousSubject();
-	}
-	if (options.anonymousSignIns === "deny" && claims["is_anonymous"] === true) return anonymousSubject();
-	const actor = act.actor === void 0 ? void 0 : act.actor.kind === "support" ? {
-		id: act.actor.id,
-		kind: act.actor.kind,
-		sessionId: act.actor.sessionId,
-		readOnly: act.actor.readOnly
-	} : {
-		id: act.actor.id,
-		kind: act.actor.kind
-	};
-	const roleClaim = options.roles ?? "user_role";
-	const tenantClaim = options.tenant ?? "tenant_id";
-	const membershipsClaim = options.memberships ?? "memberships";
-	let extra = extraClaims(claims);
-	if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
-	const include = new Set(options.include ?? []);
-	const tenantValue = readClaim(claims, tenantClaim);
-	const version = readClaim(claims, "authz_ver");
-	const tenant = typeof tenantValue === "string" ? tenantValue : void 0;
-	const { memberships, dropped } = readMemberships(readClaim(claims, membershipsClaim));
-	if (dropped.length > 0) emit(options, "schema", "membership-dropped");
-	const plans = plansFor(claims, options.plans, tenant);
-	const principal = compact({
-		id,
-		kind: "user",
-		roles: asRoles(readClaim(claims, roleClaim), options.declared),
-		tenant,
-		plans: plans.length > 0 ? plans : void 0,
-		memberships,
-		membershipsTruncated: readClaim(claims, "memberships_truncated") === true ? true : void 0,
-		authzVersion: typeof version === "number" && Number.isInteger(version) ? version : void 0,
-		issuer: typeof claims["iss"] === "string" ? claims["iss"] : void 0,
-		assurance: typeof claims["aal"] === "string" ? { acr: claims["aal"] } : void 0,
-		claims: Object.keys(extra).length === 0 ? void 0 : extra,
-		email: include.has("email") && typeof claims["email"] === "string" ? claims["email"] : void 0,
-		phone: include.has("phone") && typeof claims["phone"] === "string" ? claims["phone"] : void 0,
-		is_anonymous: include.has("is_anonymous") && typeof claims["is_anonymous"] === "boolean" ? claims["is_anonymous"] : void 0
-	});
-	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
-	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
-	return freezeDeep(compact({
-		principal,
-		actor,
-		delegation: act.actor?.kind === "oauth-client" ? subjectDelegation(claims, act.actor.chain) : void 0,
-		context: {},
-		session,
-		expiresAt
-	}));
-}
-function subjectFromSupabase(claims, options = {}) {
-	try {
-		if (!isRecord(claims)) return anonymousSubject();
-		const rest = {};
-		for (const [key, value] of Object.entries(claims)) {
-			if (key === "user_metadata") continue;
-			rest[key] = value;
-		}
-		return mapClaims(rest, options);
-	} catch {
-		return anonymousSubject();
-	}
-}
-/**
-* A verified session object (for example better-supabase's `AuthSession`) in, `Subject` out.
-* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
-*/
-function subjectFromSupabaseSession(session, options = {}) {
-	try {
-		if (session === null || session === void 0 || session.kind !== "user") return anonymousSubject();
-		return subjectFromSupabase(session.claims, options);
-	} catch {
-		return anonymousSubject();
-	}
-}
-//#endregion
-export { subjectFromSupabaseSession as a, supabaseClaims as c, subjectFromSupabase as i, exchangeCapability as l, delegationOf as n, authorizeSql as o, readMemberships as r, supabaseRls as s, actorOf as t };
+export { readSubjectRecord as a, postgrestSources as i, supabaseRls as n, supabaseClaims as o, supabaseApprovalStore as r, exchangeCapability as s, authorizeSql as t };