permdock 0.15.0 → 0.17.0

package/dist/better-supabase/index.js

@@ -1,7 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
-import { l as asApprover } from "../role-builder-BK2-T6oD.js";
-import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-B4r0N_Uz.js";
+import { a as flattenApprovers, o as holder, r as approverLeaves } from "../approvers-CNtl4Vc5.js";
 import { t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { a as isId, r as idList } from "../expiry-6XByK0dm.js";
 import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-B8tYxPIt.js";
@@ -9,21 +8,30 @@ import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-
 import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "../sha256-C-4WXKIu.js";
 import { t as decideSupportSession } from "../support-session-BsmPCbz8.js";
-import { f as scopeList } from "../scopes-0Up_UA2t.js";
+import { d as scopeList } from "../scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
-import { _ as claimsFirst } from "../instance-snapshot-DuWf1cT3.js";
-import { a as delegatedScopeMap, s as scopesReaching, t as getPermDock } from "../permdock-BvjivVb9.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-BqX94r07.js";
-import { r as credentialSubject, s as parseCredential } from "../credential-CyyyvCsL.js";
+import { n as asApprover } from "../approval-normalize-4KxMRdJC.js";
+import { r as isSubject, t as anonymousSubject } from "../subject-C7RddW0G.js";
+import { I as decisionTenant } from "../evaluate-CsjXeLRo.js";
+import { _ as claimsFirst } from "../instance-snapshot-BgOGtyCy.js";
+import { a as permissionStates } from "../checks-fyDOhcz0.js";
+import { a as delegatedScopeMap, s as scopesReaching } from "../permdock-DdzMv5-F.js";
+import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-zN6T9fxe.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-B3Hj4puZ.js";
+import { s as resumeDecision } from "../helpers-DNnZffrI.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
+import { t as parseApprovalRequest } from "../parse-request-DOBVaeiQ.js";
+import { n as parseApprovalHeader } from "../approval-header-8QV6MU4H.js";
+import { i as snapshotTag } from "../snapshot-cache-B66h7FBK.js";
+import { t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { n as NO_GRANT } from "../decision-CaG5_eNJ.js";
 import { t as policyRowConditionKeys } from "../row-conditions-BAGHOmVq.js";
-import { n as subscribersFor } from "../audience-DTjR8xet.js";
+import { n as subscribersFor } from "../audience-jRO819i3.js";
 import { i as qualifySqlTable, l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
 import { o as junctionMembershipSource } from "../sources-C4vkzZJV.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-DAxFltvO.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-BrjrckDG.js";
 import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "../parse-1_ZheTW5.js";
+import { t as parseCatalog } from "../parse-UTC-sDrt.js";
 import { n as activeTenantMismatch, t as activeOrganizationFrom } from "../active-tenant-DVee32-T.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/access-reviews.ts
@@ -155,6 +163,218 @@ function accessReviewApplier(options) {
 	};
 }
 //#endregion
+//#region src/better-supabase/approvals-block.ts
+const PAGE = 100;
+const MAX_SCANNED = 2e3;
+function statusOf(status) {
+	switch (status) {
+		case "pending":
+		case "approved":
+		case "rejected":
+		case "expired": return status;
+		case "cancelled": return "rejected";
+		default: return status;
+	}
+}
+function instantOf(value) {
+	if (value === void 0) return;
+	const ms = Date.parse(value.toJSON());
+	return Number.isNaN(ms) ? void 0 : isoAt(ms);
+}
+/** The PermDock request a block record carries, with the block's state. */
+function requestOf(record) {
+	const stored = parseApprovalRequest(record.payload["permdock"]);
+	if (stored === null) return null;
+	const status = statusOf(record.status);
+	return freezeDeep(compact({
+		...stored,
+		status,
+		expiresAt: instantOf(record.expiresAt) ?? stored.expiresAt,
+		resolvedAt: status === "pending" ? void 0 : instantOf(record.decidedAt),
+		consumedAt: instantOf(record.consumedAt),
+		fingerprint: record.fingerprint ?? stored.fingerprint
+	}));
+}
+async function unwrap(result, call) {
+	const awaited = await result;
+	if (!awaited.ok) throw new Error(`PermDock: the approvals block's ${call} failed`, { cause: awaited.error });
+	return awaited.data;
+}
+/** Every block record carrying a PermDock request, newest first, capped. */
+async function scan(approvals, found) {
+	const out = [];
+	let before;
+	for (let scanned = 0; scanned < MAX_SCANNED; scanned += PAGE) {
+		const page = await unwrap(approvals.list({
+			status: null,
+			pageSize: PAGE,
+			...before === void 0 ? {} : { before }
+		}), "list");
+		for (const record of page) {
+			const request = requestOf(record);
+			if (request !== null) {
+				const pair = {
+					record,
+					request
+				};
+				out.push(pair);
+				if (found(pair)) return out;
+			}
+		}
+		const last = page.at(-1);
+		if (page.length < PAGE || last === void 0) break;
+		before = last.createdAt;
+	}
+	return out;
+}
+function actionOf(permission) {
+	const dot = permission.lastIndexOf(".");
+	return dot === -1 ? permission : permission.slice(dot + 1);
+}
+function matchesQuery(request, query) {
+	return (query.status === void 0 || request.status === query.status) && (query.principalId === void 0 || request.subject.principal?.id === query.principalId) && (query.actorId === void 0 || request.subject.actor?.id === query.actorId) && (query.tenant === void 0 || decisionTenant(request.subject, request.membership) === query.tenant) && (query.session === void 0 || request.subject.session === query.session);
+}
+/**
+* An `ApprovalStore` over better-supabase's approvals block, so a PermDock
+* `approval-required` decision files a block request and is decided in the
+* block's own approve and reject flow. `create` files the request on the
+* resource under the permission's action, with the PermDock request in
+* `payload.permdock` and its `fingerprint`. `get`, `getById` and `list` read
+* the block's latest 2,000 requests in the block's tenant. `consume` calls the
+* block's `consume`, which refuses a second use and another fingerprint.
+* `resolve` throws: approvers decide through the block, never through
+* `approvalsHandler`. `expire` answers 0, since the block expires requests
+* itself.
+*/
+function blockApprovalStore(approvals) {
+	const byToken = async (token) => (await scan(approvals, ({ request }) => request.token === token)).find(({ request }) => request.token === token);
+	return Object.freeze({
+		name: "better-supabase-approvals",
+		async create(request) {
+			await unwrap(approvals.request({
+				type: request.resource.type,
+				id: request.resource.id ?? request.id
+			}, compact({
+				action: actionOf(request.permission),
+				reason: request.detail,
+				payload: { permdock: request },
+				fingerprint: request.fingerprint
+			})), "request");
+		},
+		async get(token) {
+			return (await byToken(token))?.request ?? null;
+		},
+		async getById(id) {
+			return (await scan(approvals, ({ request }) => request.id === id)).find(({ request }) => request.id === id)?.request ?? null;
+		},
+		resolve() {
+			throw new Error("PermDock: blockApprovalStore requests are decided through the approvals block's approve and reject, not resolve");
+		},
+		async list(query) {
+			const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);
+			const offset = query.cursor === void 0 ? 0 : Number(query.cursor);
+			if (!Number.isSafeInteger(offset) || offset < 0) return { items: [] };
+			const all = (await scan(approvals, () => false)).map(({ request }) => request).filter((request) => matchesQuery(request, query)).toReversed().toSorted((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
+			const items = all.slice(offset, offset + limit);
+			return offset + limit < all.length ? {
+				items,
+				next: String(offset + limit)
+			} : { items };
+		},
+		expire() {
+			return 0;
+		},
+		async consume(token) {
+			const found = await byToken(token);
+			if (found === void 0) return null;
+			const consumed = await approvals.consume(found.record.id, found.request.fingerprint);
+			return consumed.ok ? requestOf(consumed.data) : null;
+		}
+	});
+}
+const INTERVAL_UNITS = {
+	second: 1,
+	minute: 60,
+	hour: 3600,
+	day: 86400,
+	week: 604800
+};
+/** Seconds in a Postgres interval such as `3 days` or `1 day 2 hours`. */
+function intervalSeconds(interval) {
+	const parts = interval.trim().toLowerCase().split(/\s+/u);
+	let seconds = 0;
+	for (let index = 0; index < parts.length; index += 2) {
+		const amount = Number(parts[index]);
+		const unit = parts[index + 1]?.replace(/s$/u, "");
+		const size = unit === void 0 ? void 0 : INTERVAL_UNITS[unit];
+		if (!Number.isSafeInteger(amount) || amount < 0 || size === void 0) throw new TypeError(`PermDock: the approval policy interval '${interval}' is not whole seconds, minutes, hours, days or weeks`);
+		seconds += amount * size;
+	}
+	if (seconds === 0) throw new TypeError(`PermDock: the approval policy interval '${interval}' is empty`);
+	return seconds;
+}
+function stageApprovers(approvers, roleScope) {
+	const leaves = [
+		...approvers.permission === void 0 ? [] : [{
+			kind: "permission",
+			permission: approvers.permission
+		}],
+		...approvers.role === void 0 ? [] : [{
+			kind: "role",
+			role: approvers.role,
+			scope: roleScope
+		}],
+		...(approvers.users ?? []).map((id) => ({
+			kind: "user",
+			id
+		})),
+		...approvers.manager === true ? [{ kind: "manager" }] : []
+	];
+	if (leaves.length === 0) throw new TypeError("PermDock: an approval policy step names no approver PermDock can check (team approvers are not supported)");
+	return {
+		kind: "any-of",
+		of: leaves
+	};
+}
+function policyOf(entry, roleScope) {
+	const approval = compact({
+		stages: entry.steps.length === 0 ? void 0 : entry.steps.map((step) => ({
+			by: stageApprovers(step.approvers, roleScope),
+			quorum: step.required
+		})),
+		combine: entry.steps.length > 1 ? "sequential" : void 0,
+		mode: entry.mode === "confirm" && entry.selfApproval ? "confirm" : void 0,
+		ttl: entry.expiresIn === void 0 ? void 0 : intervalSeconds(entry.expiresIn)
+	});
+	return {
+		permission: `${entry.subjectType}.${entry.action}`,
+		tenant: entry.organizationId,
+		approval
+	};
+}
+/**
+* An `ApprovalPolicySource` over the approvals block's tenant policies, so a
+* PermDock decision asks for approval wherever the block would. A policy keys
+* the permission `<subjectType>.<action>`; its steps become sequential stages
+* whose approvers are any of the step's permission, role, users and manager;
+* `confirm` with `selfApproval` lets the principal approve; `expiresIn` caps
+* the request's `ttl`. `conditions` are not read, so a conditional policy
+* applies to every call: stricter, never looser. A step with only a `team`
+* approver, an interval it cannot read or a failed read makes the source fail,
+* and every call an allow would grant denies.
+*/
+function blockApprovalPolicySource(approvals, options = {}) {
+	const roleScope = options.roleScope ?? "tenant";
+	return Object.freeze({
+		name: "better-supabase-approvals",
+		async approvalPoliciesFor(query) {
+			const entries = await unwrap(approvals.listPolicies({ pageSize: 200 }), "listPolicies");
+			if (!Array.isArray(entries)) throw new TypeError("PermDock: listPolicies answered no list");
+			return entries.filter((entry) => isRecord(entry) && entry["enabled"] === true && typeof entry["organizationId"] === "string" && query.tenants.includes(entry["organizationId"])).map((entry) => policyOf(entry, roleScope));
+		}
+	});
+}
+//#endregion
 //#region src/better-supabase/api-keys.ts
 const EPOCH = "1970-01-01T00:00:00.000Z";
 const rfc3339Of = (instant) => isoAt(instant.epochMilliseconds);
@@ -341,6 +561,98 @@ function subjectFromBetterSupabase(session, options = {}) {
 	});
 }
 //#endregion
+//#region src/better-supabase/permdock-for.ts
+function isResult(source) {
+	return isRecord(source) && Object.hasOwn(source, "session") && Object.hasOwn(source, "authzVersion") && !Object.hasOwn(source, "kind");
+}
+function knownVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function subjectOf(source, result, signedOut, options) {
+	if (isSubject(source)) return source;
+	if (result !== void 0) return subjectFromBetterSupabase(signedOut ? null : result.session, options);
+	return subjectFromBetterSupabase(source, options);
+}
+/**
+* The resolver behind `permdockFor`, the authorizer and the hooks: one sources
+* object per version cache, so every instance of one subject at one version
+* shares an `instances` entry.
+*/
+function permdockResolver(options) {
+	const byCache = /* @__PURE__ */ new WeakMap();
+	let uncached;
+	const sourcesOf = (versions) => ({
+		...options.options,
+		...options.instances === void 0 ? {} : { instances: options.instances },
+		...options.memberships === void 0 ? {} : { memberships: claimsFirst(options.memberships, {
+			onStale: "reread",
+			...options.version === void 0 ? {} : { version: options.version },
+			...versions === void 0 ? {} : { versions }
+		}) }
+	});
+	const sourcesFor = (versions) => {
+		if (versions === void 0) {
+			uncached ??= sourcesOf(void 0);
+			return uncached;
+		}
+		const known = byCache.get(versions);
+		if (known !== void 0) return known;
+		const created = sourcesOf(versions);
+		byCache.set(versions, created);
+		return created;
+	};
+	return async (source, query, runtimeVersions) => {
+		const result = isResult(source) ? source : void 0;
+		const signedOut = result?.sessionActive === false;
+		const user = subjectOf(source, result, signedOut, options.subject);
+		const tenant = query.tenant ?? result?.tenant ?? void 0;
+		const known = signedOut ? void 0 : knownVersion(result?.authzVersion);
+		const sources = sourcesFor(runtimeVersions ?? options.versions);
+		const { permdock } = await buildInstance({
+			policy: options.policy,
+			user,
+			sources,
+			scope: {
+				...options.options,
+				memberships: sources.memberships,
+				intent: query.intent ?? "read",
+				tenant: tenant ?? void 0,
+				version: known === void 0 ? void 0 : { known }
+			}
+		});
+		return permdock;
+	};
+}
+/**
+* One resolver for every instance of the app: `permdockFor(await
+* bsb.claims())`, `permdockFor(await bsb.bootstrap(...))` or `permdockFor(await
+* bsb.getAccess(...))`. A bootstrap or access result passes its `authzVersion`
+* as `version.known`, so the instance reads no version, and a `sessionActive:
+* false` bootstrap is anonymous. With `instances`, a subject at an unchanged
+* version reuses its instance across requests.
+*/
+function permdockFor(options) {
+	const resolve = permdockResolver(options);
+	return (source, query) => resolve(source, typeof query === "string" || query === null ? { tenant: query } : query ?? {});
+}
+/**
+* One `{ allowed, outcome, reason? }` per named check for `input`, from one
+* `permdockFor` instance: frozen plain JSON an island returns from `'use cache:
+* private'`. A check that throws denies its entry; an instance that cannot be
+* built denies them all.
+*/
+async function getPermissions(resolve, input, checks, query) {
+	let permdock;
+	try {
+		permdock = await resolve(input, query);
+	} catch {
+		permdock = void 0;
+	}
+	if (permdock === void 0) return permissionStates(() => NO_GRANT, checks);
+	const decide = permdock.decide;
+	return permissionStates(decide, checks);
+}
+//#endregion
 //#region src/better-supabase/subscribers.ts
 function permissionFor(events, type) {
 	if (Object.hasOwn(events, type)) return events[type];
@@ -356,6 +668,14 @@ function permissionFor(events, type) {
 * tenant and a throw reach no one.
 */
 function subscriberPolicy(options) {
+	const resolve = permdockFor({
+		policy: options.policy,
+		options: {
+			...options.options,
+			principals: options.principals
+		},
+		...options.instances === void 0 ? {} : { instances: options.instances }
+	});
 	return async (event, subscribers) => {
 		try {
 			const permission = permissionFor(options.events, event.type);
@@ -364,14 +684,10 @@ function subscriberPolicy(options) {
 			if (permission === void 0 || tenant === null || senderId === null || senderId === void 0) return [];
 			const sender = await loadPrincipal(options.principals, senderId, tenant);
 			if (sender === null) return [];
-			const permdock = await getPermDock(options.policy, {
+			const permdock = await resolve({
 				principal: sender,
 				context: {}
-			}, {
-				...options.options,
-				principals: options.principals,
-				tenant
-			});
+			}, tenant);
 			if (permdock.subject.principal?.tenant !== tenant) return [];
 			return await subscribersFor(permdock, {
 				permission,
@@ -407,12 +723,13 @@ function requestId(input) {
 * is `false`.
 */
 function supportPolicy(options) {
+	const resolve = permdockFor(options);
 	return async (input) => {
 		try {
-			const base = await getPermDock(options.policy, subjectFromBetterSupabase({
+			const base = await resolve({
 				kind: "user",
 				claims: input.admin.claims
-			}, options.subject), options.options);
+			});
 			if (base.subject.principal?.id !== input.admin.user.id) return false;
 			if (!input.readOnly && options.writable === void 0) return false;
 			const permdock = input.tenant === void 0 ? base : base.tenant(input.tenant);
@@ -483,6 +800,7 @@ function matches(approvers, userId, permdock) {
 			case "assurance":
 			case "authenticated":
 			case "inherit":
+			case "manager":
 			case "plan":
 			case "relation":
 			case "role": return false;
@@ -495,25 +813,23 @@ function matches(approvers, userId, permdock) {
 * authorization })`), decided by `policy`. Every hook builds the principal's
 * instance from the claims `claims` loads now, never from the request, and
 * fails closed: a throw, an unknown key and `approval-required` refuse.
-* `automation` and `delegation` are always set; `identities`, `delivery`,
-* `approverOf`, `support` and `tickets` only with the options they read.
-* `delegation.permissions` maps each scope to the keys whose `.scope` it is,
-* was renamed from, or that a policy `oauthScopes` entry covers, and reads no
-* `authorization_details`.
+* `automation`, `delegation` and `sessionTags` (`snapshotTag(userId)`, so
+* `evictSession` and sign-out clear PermDock snapshots) are always set;
+* `identities`, `delivery`, `approverOf`, `support` and `tickets` only with the
+* options they read. `delegation.permissions` maps each scope to the keys whose
+* `.scope` it is, was renamed from, or that a policy `oauthScopes` entry
+* covers, and reads no `authorization_details`.
 */
 function authorizationHooks(options) {
 	const { policy } = options;
+	const resolve = permdockFor(options);
 	const instance = async (claims, tenant) => {
-		const subject = subjectFromBetterSupabase({
+		const permdock = await resolve({
 			kind: "user",
 			claims
-		}, options.subject);
-		if (subject.principal === null) return null;
-		const permdock = await getPermDock(policy, subject, {
-			...options.options,
-			...tenant === null || tenant === void 0 ? {} : { tenant }
-		});
-		return tenant === null || tenant === void 0 || permdock.subject.principal?.tenant === tenant ? permdock : null;
+		}, tenant);
+		if (permdock.subject.principal === null) return null;
+		return tenant === null || tenant === void 0 || permdock.subject.principal.tenant === tenant ? permdock : null;
 	};
 	const holdsAll = async (claims, automation) => {
 		const permdock = await instance(claims, automation.tenant);
@@ -589,6 +905,7 @@ function authorizationHooks(options) {
 	return Object.freeze({
 		apiVersion: 1,
 		name: "PermDock",
+		sessionTags: (userId) => [snapshotTag(userId)],
 		automation: Object.freeze(automation),
 		delegation: Object.freeze(delegation),
 		...approverOf === void 0 ? {} : { approverOf },
@@ -879,12 +1196,14 @@ function tokenHookOf(manifest, activeTenant) {
 	const owned = manifest.claims.filter((claim) => claim.source === "permdock");
 	const registered = manifest.claims.filter((claim) => claim.source !== "permdock");
 	const budgeted = manifest.claims.filter((claim) => claim.budget);
+	const truncated = owned.some((claim) => claim.name === "memberships_truncated") ? "memberships_truncated" : void 0;
 	const activeFrom = activeTenant === "resolver" || manifest.hook.activeFrom === void 0 ? void 0 : activeOrganizationFrom(manifest.hook.activeFrom, manifest.tenantClaim);
 	return {
 		function: `${manifest.hook.schema}.${manifest.hook.function}`,
 		tenantClaim: manifest.tenantClaim,
 		...activeFrom === void 0 ? {} : { activeOrganizationFrom: activeFrom },
 		ownedClaims: owned.map((claim) => claim.name),
+		...truncated === void 0 ? {} : { truncatedClaim: truncated },
 		...registered.length > 0 ? { registeredClaims: registered.map((claim) => ({
 			name: claim.name,
 			function: claim.source
@@ -892,7 +1211,7 @@ function tokenHookOf(manifest, activeTenant) {
 		budget: {
 			claims: budgeted.map((claim) => claim.name),
 			bytes: manifest.budget.bytes,
-			...owned.some((claim) => claim.name === "memberships_truncated") ? { truncatedClaim: "memberships_truncated" } : {}
+			...truncated === void 0 ? {} : { truncatedClaim: truncated }
 		},
 		markers: {
 			hook: `-- permdock:hook ${manifest.markers.hook}`,
@@ -1197,9 +1516,6 @@ const denied = (reason) => ({
 	outcome: "denied",
 	reason
 });
-function isVersionCache(value) {
-	return isRecord(value) && typeof value["maxStaleMs"] === "number" && typeof value["current"] === "function" && typeof value["evict"] === "function";
-}
 function outcomeOf(decision, key) {
 	switch (decision.outcome) {
 		case "granted": return { outcome: "granted" };
@@ -1211,10 +1527,31 @@ function outcomeOf(decision, key) {
 		default: return decision;
 	}
 }
-function decideWith(permdock, request) {
-	const { action } = request;
-	if (!isPermission(action)) return denied("Unknown permission.");
-	return outcomeOf(permdock.decide(action, request.resource.properties), action.key);
+/**
+* The row a check decides on. A write is `change`: a create checks the new
+* values, an update the stored row against the stored row with the new values
+* over it. Only a row better-supabase loaded itself, with no change, skips
+* schema validation.
+*/
+function dataOf(resource) {
+	const { change } = resource;
+	if (change !== void 0) return change.current === void 0 ? {
+		data: change.next,
+		trusted: false
+	} : {
+		data: {
+			current: change.current,
+			next: {
+				...change.current,
+				...change.next
+			}
+		},
+		trusted: false
+	};
+	return {
+		data: resource.properties,
+		trusted: resource.source === "loaded"
+	};
 }
 /**
 * The verified claims better-supabase passes in `subject.properties.claims`,
@@ -1227,7 +1564,7 @@ function claimsOf(request) {
 	return isRecord(claims) ? claims : void 0;
 }
 const tenantOf = (request) => {
-	const tenant = request.context["tenant"];
+	const { tenant } = request.context;
 	return typeof tenant === "string" ? tenant : null;
 };
 const keyOf = (request) => isPermission(request.action) ? request.action.key : null;
@@ -1241,38 +1578,61 @@ const keyOf = (request) => isPermission(request.action) ? request.action.key : n
 * request scope share an instance per claims, tenant and intent.
 */
 function authorizer(options) {
-	const { operations } = options;
+	const { operations, store } = options;
 	const intentOf = (request, batch) => {
 		if (options.intent !== void 0) return options.intent(request);
+		const { intent } = request.context;
+		if (intent === "read" || intent === "write") return intent;
 		if (batch) return "read";
 		return isPermission(request.action) && READ_ACTIONS.has(request.action.action) ? "read" : "write";
 	};
-	const membershipsFor = (runtime) => {
-		if (options.memberships === void 0) return {};
-		const versions = isVersionCache(runtime?.versions) ? runtime.versions : options.versions;
-		return { memberships: claimsFirst(options.memberships, {
-			onStale: "reread",
-			...options.version === void 0 ? {} : { version: options.version },
-			...versions === void 0 ? {} : { versions }
-		}) };
-	};
-	const instanceFor = async (claims, tenant, intent, runtime) => {
-		const session = claims === void 0 ? null : {
-			kind: "user",
-			claims
-		};
-		const base = await getPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), {
-			...options.options,
-			...membershipsFor(runtime),
+	const resolve = permdockResolver(options);
+	const instanceFor = (claims, tenant, intent, runtime) => resolve(claims === void 0 ? null : {
+		kind: "user",
+		claims
+	}, {
+		tenant,
+		intent
+	}, runtime?.versions);
+	const scoped = (claims, tenant, intent, runtime, batch) => {
+		const key = `permdock:authorizer:${canonicalJson([
+			claims ?? null,
+			tenant,
 			intent
+		])}`;
+		const build = () => instanceFor(claims, tenant, intent, runtime);
+		if (runtime?.memo !== void 0) return runtime.memo.once(key, build);
+		if (batch === void 0) return build();
+		const known = batch.get(key);
+		if (known !== void 0) return known;
+		const created = build();
+		batch.set(key, created);
+		return created;
+	};
+	const decideWith = async (permdock, request, consume) => {
+		const { action } = request;
+		if (!isPermission(action)) return denied("Unknown permission.");
+		const { data, trusted } = dataOf(request.resource);
+		const decision = permdock.decide(action, data, {
+			trusted,
+			adapter: "better-supabase"
 		});
-		return tenant === null ? base : base.tenant(tenant);
+		if (store === void 0 || decision.outcome !== "approval-required") return outcomeOf(decision, action.key);
+		const { id } = request.resource;
+		return outcomeOf(await resumeDecision({
+			decision,
+			permission: action,
+			subject: permdock.subject,
+			store,
+			resource: id === void 0 ? { type: action.resource } : {
+				type: action.resource,
+				id
+			},
+			adapter: "better-supabase",
+			token: parseApprovalHeader(request.context.approval ?? null),
+			consume
+		}), action.key);
 	};
-	const scoped = (claims, tenant, intent, runtime) => runtime?.memo === void 0 ? instanceFor(claims, tenant, intent, runtime) : runtime.memo.once(`permdock:authorizer:${JSON.stringify([
-		claims ?? null,
-		tenant,
-		intent
-	])}`, () => instanceFor(claims, tenant, intent, runtime));
 	const failed = (error, request) => {
 		report(options.onError, error, {
 			permission: keyOf(request),
@@ -1293,33 +1653,17 @@ function authorizer(options) {
 		} },
 		async evaluate(request, runtime) {
 			try {
-				return decideWith(await scoped(claimsOf(request), tenantOf(request), intentOf(request, false), runtime), request);
+				return await decideWith(await scoped(claimsOf(request), tenantOf(request), intentOf(request, false), runtime), request, true);
 			} catch (error) {
 				return failed(error, request);
 			}
 		},
 		evaluations(requests, runtime) {
-			const cache = /* @__PURE__ */ new Map();
-			const shared = (request) => {
-				const claims = claimsOf(request);
-				const tenant = tenantOf(request);
-				const intent = intentOf(request, true);
-				let byKey = cache.get(claims);
-				if (byKey === void 0) {
-					byKey = /* @__PURE__ */ new Map();
-					cache.set(claims, byKey);
-				}
-				const key = JSON.stringify([tenant, intent]);
-				let instance = byKey.get(key);
-				if (instance === void 0) {
-					instance = scoped(claims, tenant, intent, runtime);
-					byKey.set(key, instance);
-				}
-				return instance;
-			};
+			const batch = /* @__PURE__ */ new Map();
+			const shared = (request) => scoped(claimsOf(request), tenantOf(request), intentOf(request, true), runtime, batch);
 			return Promise.all(requests.map(async (request) => {
 				try {
-					return decideWith(await shared(request), request);
+					return await decideWith(await shared(request), request, false);
 				} catch (error) {
 					return failed(error, request);
 				}
@@ -1332,14 +1676,17 @@ function authorizer(options) {
 function roleOf(options, columns) {
 	const column = columns.role;
 	if (options.roles !== void 0 && options.roleThrough !== void 0) throw new TypeError("PermDock: blockMembershipSource takes roles or roleThrough, not both; a junction holds role keys");
-	if (options.roles === "many") return {
-		through: `${qualifySqlTable(columns.table).split(".")[0] ?? "better_supabase"}.membership_roles`,
-		on: {
-			[columns.tenant]: columns.tenant,
-			[columns.user]: columns.user
-		},
-		column: "role"
-	};
+	if (options.roles === "many") {
+		const junction = options.tables?.membershipRoles;
+		return {
+			through: junction?.table ?? `${qualifySqlTable(columns.table).split(".")[0] ?? "better_supabase"}.membership_roles`,
+			on: {
+				[columns.tenant]: junction?.columns.tenant ?? columns.tenant,
+				[columns.user]: junction?.columns.user ?? columns.user
+			},
+			column: junction?.columns.role ?? "role"
+		};
+	}
 	if (options.roles !== void 0) return {
 		through: options.roles.table,
 		on: { [options.roles.id ?? "id"]: options.roles.membership },
@@ -1361,11 +1708,14 @@ function roleOf(options, columns) {
 */
 function blockMembershipSource(options = {}) {
 	const c = options.columns ?? {};
+	const block = options.tables?.memberships;
 	const scope = options.scope ?? "organization";
-	const disabledAt = c.disabledAt === null ? void 0 : c.disabledAt ?? "disabled_at";
-	const table = options.table ?? "better_supabase.memberships";
-	const tenant = c.tenant ?? "organization_id";
-	const user = c.user ?? "user_id";
+	const disabled = c.disabledAt === void 0 ? block?.columns.disabledAt : c.disabledAt;
+	const disabledAt = disabled === null ? void 0 : disabled ?? "disabled_at";
+	const table = options.table ?? block?.table ?? "better_supabase.memberships";
+	const tenant = c.tenant ?? block?.columns.tenant ?? "organization_id";
+	const user = c.user ?? block?.columns.user ?? "user_id";
+	const role = c.role ?? block?.columns.role ?? "role";
 	return junctionMembershipSource({
 		table,
 		scope,
@@ -1373,7 +1723,7 @@ function blockMembershipSource(options = {}) {
 		user,
 		roles: roleOf(options, {
 			table,
-			role: c.role ?? "role",
+			role,
 			tenant,
 			user
 		}),
@@ -1515,9 +1865,10 @@ const refused = (reason) => ({
 * The `authorize` and `visible` hooks of better-supabase's `createMcp`, for
 * tools whose `meta` is a PermDock permission. A tool without a permission is
 * hidden and refused. `authorize` grants only a `granted` decision: an
-* approval-required call is refused, because `createMcp` has no approval flow.
-* A denial's text names the first denial reason. A throw anywhere refuses and
-* reaches `onError`.
+* approval-required call is refused, because `authorize` has no approval
+* outcome. A tool whose `permission` goes through `authorizer` with a `store`
+* returns the approval id and resumes it instead. A denial's text names the
+* first denial reason. A throw anywhere refuses and reaches `onError`.
 */
 function toolPolicy(options) {
 	return Object.freeze({
@@ -1828,4 +2179,44 @@ function handlerCan(source, options = {}) {
 	};
 }
 //#endregion
-export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, blockMembershipSource, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };
+//#region src/better-supabase/workflow-resource.ts
+const MAX_ID_LENGTH = 256;
+function invalid(detail) {
+	return freezeDeep({
+		ok: false,
+		cause: "validation",
+		decision: {
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "validation",
+				detail
+			}],
+			alternatives: []
+		}
+	});
+}
+/**
+* The resource a `workflow.start` check decides on for a run started on
+* `subject`: `{ type, id }`, with the type `types` maps the subject type to. A
+* subject type `types` does not name, a missing or empty id, or an id over 256
+* characters is `{ ok: false, cause: 'validation' }` with the denial to
+* return.
+*/
+function workflowResource(subject, types) {
+	if (!isRecord(subject)) return invalid("subject is not a { type, id } record");
+	const { type, id } = subject;
+	if (typeof type !== "string" || !Object.hasOwn(types, type)) return invalid(`unknown subject type ${JSON.stringify(type) ?? "undefined"}`);
+	if (typeof id !== "string" || id === "" || id.length > MAX_ID_LENGTH) return invalid("subject id is not a non-empty string of at most 256 characters");
+	const resource = types[type];
+	if (typeof resource !== "string" || resource === "") return invalid(`subject type ${type} maps to no resource`);
+	return freezeDeep({
+		ok: true,
+		resource: {
+			type: resource,
+			id
+		}
+	});
+}
+//#endregion
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, blockApprovalPolicySource, blockApprovalStore, blockMembershipSource, bucketPolicy, credentialGuard, getPermissions, handlerCan, hookCan, permdockFor, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy, workflowResource };