permdock 0.16.0 → 0.18.0

package/dist/authz-topic-Dbc-HDOS.js

@@ -0,0 +1,15 @@
+//#region src/supabase/authz-topic.ts
+/**
+* The server topic the generated version trigger broadcasts on without
+* better-supabase; no user may join it. With better-supabase it is
+* `better_supabase:authz`.
+*/
+const AUTHZ_TOPIC = "permdock:authz";
+/** The broadcast event of a version bump, as better-supabase names it. */
+const AUTHZ_EVENT = "changed";
+/** The private topic one user receives their own version bumps on. */
+function authzUserTopic(userId) {
+	return `authz:${userId}`;
+}
+//#endregion
+export { AUTHZ_TOPIC as n, authzUserTopic as r, AUTHZ_EVENT as t };

package/dist/authzen/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, lr as Delegation, pr as Principal, rr as Actor } from "../policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
-import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-DOWuBpWv.js";
+import { E as Policy, _r as Principal, pr as Delegation, sr as Actor } from "../policy-types-D-GwfQTc.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { a as ProblemDetails } from "../errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
+import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-CisTTURl.js";
 //#region src/authzen/map.d.ts
 type AuthzenEntity = {
   readonly type?: unknown;

package/dist/authzen/index.js

@@ -7,8 +7,8 @@ import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { n as readBodyText, t as MAX_BODY_BYTES } from "../body-text-DQhcmqdY.js";
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
 import { d as unauthenticatedProblem, l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
-import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-IBceAeKT.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BFMFQdE_.js";
+import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-h3KoJAPa.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {
 	outcome: "denied",

package/dist/{automation-C6Jg75xq.d.ts → automation-Bfa_wD1h.d.ts}

@@ -1,4 +1,4 @@
-import { Ut as InstanceHandle, Wn as Denial, Wt as Instant } from "./policy-types-DGIO_gxq.js";
+import { Gt as InstanceHandle, Jn as Denial, Kt as Instant } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
 //#region src/core/automation.d.ts

package/dist/better-auth/index.d.ts

@@ -1,4 +1,4 @@
-import { G as CustomRoleSource, J as DecisionSink, N as RoleBinding, hr as Subject, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { K as CustomRoleSource, P as RoleBinding, Y as DecisionSink, _r as Principal, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts

package/dist/better-auth/index.js

@@ -1,9 +1,9 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
-import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
+import { n as role, r as allow } from "../role-builder-CMW4wWzn.js";
 import { c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { r as validateRecord } from "../thenable-BNSM1U2R.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
+import { i as rootMembershipId, t as anonymousSubject } from "../subject-C7RddW0G.js";
 import { d as membershipEvent } from "../sink-D9_vh372.js";
 //#region src/better-auth/parse.ts
 function asRoles(value) {
@@ -62,7 +62,8 @@ function parseMemberRows(value, userId, requireUserId = true) {
 		const roles = asRoles(item["role"] ?? item["roles"]);
 		if (tenant === void 0 || roles.length === 0) continue;
 		out.push(compact({
-			tenant,
+			scope: "tenant",
+			id: tenant,
 			roles
 		}));
 	}
@@ -79,8 +80,9 @@ function parseTeamRows(value, userId) {
 		const roles = asRoles(item["role"] ?? item["roles"]);
 		if (team === void 0 || roles.length === 0) continue;
 		out.push(compact({
-			tenant,
-			team,
+			within: tenant === void 0 ? void 0 : { tenant },
+			scope: "team",
+			id: team,
 			roles,
 			via: `team:${team}`
 		}));
@@ -279,7 +281,7 @@ function memberIn(auth, userId, organizationId, tenant, headers) {
 			filterValue: userId
 		},
 		headers
-	}), userId).filter((item) => item.tenant === organizationId), []);
+	}), userId).filter((item) => rootMembershipId(item) === organizationId), []);
 }
 async function loadMemberships(auth, session, user, userId, tenant, options) {
 	let members = parseMemberRows(session["members"] ?? session["member"] ?? user["members"], userId, false);
@@ -295,8 +297,8 @@ async function loadMemberships(auth, session, user, userId, tenant, options) {
 	const listUserTeams = auth.api?.listUserTeams;
 	if (teams.length === 0 && listUserTeams !== void 0) teams = await settle(async () => parseTeamRows(await listUserTeams({ headers }), userId), []);
 	if (options.memberships === "active" && tenant !== void 0) {
-		members = members.filter((item) => item.tenant === tenant);
-		teams = teams.filter((item) => item.tenant === tenant);
+		members = members.filter((item) => rootMembershipId(item) === tenant);
+		teams = teams.filter((item) => item.within?.["tenant"] === tenant);
 	}
 	return [...members, ...teams];
 }

package/dist/better-supabase/index.d.ts

@@ -1,21 +1,21 @@
-import { Cn as ApproverInput, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Wt as Instant, X as Intent, hr as Subject, nt as MembershipSource, pr as Principal, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
+import { At as ApiKeyPrincipal, E as Policy, Kt as Instant, Tn as ApproverInput, W as CredentialVerifier, Z as Intent, Zn as DeniedDecision, _r as Principal, an as AuthEvent, rt as MembershipSource, wt as SupportSession, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, h as PrincipalIdentity, o as PermDockOptions } from "../permdock-CprAPN3w.js";
-import { c as AccessReviewStore } from "../types-B2efzoSX.js";
-import { i as SupabaseRpcCaller } from "../postgrest-D5nUGm-c.js";
-import { a as CatalogDocument } from "../types-ZzRGoViD.js";
-import { A as SupabaseSubjectOptions, C as SupabasePrincipal, N as SupabaseSuspension, O as SupabaseSessionLike, s as SqlMembershipSource } from "../sources-oB1Hg1Fm.js";
-import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
+import { i as OperationEffect } from "../operations-Ci_rT6Uo.js";
+import { i as ApprovalPolicySource } from "../approval-policies-oNnckT12.js";
+import { A as PermissionState, _ as PrincipalSource, a as PermDock, h as PrincipalIdentity, k as PermissionCheck, o as PermDockOptions, w as InstanceCache } from "../permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
+import { c as AccessReviewStore } from "../types-CDVXR6YD.js";
+import { i as SupabaseRpcCaller } from "../postgrest-D84p5dbA.js";
+import { a as CatalogDocument } from "../types-NYoj8JBm.js";
+import { n as VersionCache } from "../version-cache-DzNKWiI6.js";
+import { A as SupabaseSubjectOptions, C as SupabasePrincipal, N as SupabaseSuspension, O as SupabaseSessionLike, s as SqlMembershipSource } from "../sources-xdQShLDU.js";
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
-import { AuthorizationProvider } from "better-supabase/config";
-import { AuthSession, AuthorizationHooks, AuthorizationRequest, Authorizer, SupportAuthorize, SupportAuthorizeInput } from "better-supabase/server";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BZ_veK9o.js";
+import { AccessBucketPolicy, AccessTopicPolicy, AuthorizationHooks, AuthorizationProvider, AuthorizationRequest, Authorizer, BlockTables, CredentialProvider, SupportAuthorize, SupportAuthorizeInput, ToolDecision, ToolRef } from "better-supabase/contract";
 import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";
+import { AuthSession } from "better-supabase/server";
 import { ApiKey, ApiKeyClaimsOptions, ApiKeys } from "better-supabase/blocks/api-keys";
-import { AccessTopicPolicy } from "better-supabase/realtime";
-import { AccessBucketPolicy } from "better-supabase/storage";
-import { CredentialProvider } from "better-supabase/credentials";
-import { ToolDecision, ToolRef } from "better-supabase/mcp";
 import { AuthorizeHookOptions, ProtectWebHandlerOptions } from "better-supabase/workflow-sdk";
 //#region src/better-supabase/access-reviews.d.ts
 type AccessReviewApplierOptions = {
@@ -82,6 +82,140 @@ type AccessReviewApplyResult = {
  */
 export declare function accessReviewApplier(options: AccessReviewApplierOptions): (reviewId: string) => Promise<AccessReviewApplyResult>;
 //#endregion
+//#region src/better-supabase/approvals-block.d.ts
+/** better-supabase's `AsyncResult`: awaiting it gives `{ ok, data, error }`. */
+type BlockResult<T> = PromiseLike<{
+  readonly ok: true;
+  readonly data: T;
+} | {
+  readonly ok: false;
+  readonly error: unknown;
+}>;
+/** A `Temporal.Instant`, as far as the bridge reads it. */
+type BlockInstant = {
+  readonly toJSON: () => string;
+};
+type BlockStatus = "pending" | "approved" | "rejected" | "cancelled" | "expired";
+/** The approvals block's request; instants are `Temporal.Instant`. */
+type BlockApprovalRecord<I extends BlockInstant> = {
+  readonly id: string;
+  readonly status: BlockStatus;
+  readonly payload: Readonly<Record<string, unknown>>;
+  readonly fingerprint?: string;
+  readonly expiresAt?: I;
+  readonly decidedAt?: I;
+  readonly consumedAt?: I;
+  readonly createdAt: I;
+};
+type BlockApprovalApprovers = {
+  readonly permission?: string;
+  readonly role?: string;
+  readonly team?: string;
+  readonly users?: readonly string[];
+  readonly manager?: boolean;
+};
+/**
+ * The approvals block's tenant or platform policy (`options.tenantPolicies`,
+ * `options.platformPolicies`). `organizationId` is `null` on a platform policy;
+ * `subjectType` and `action` may be `*`.
+ */
+type BlockApprovalTenantPolicy = {
+  readonly organizationId: string | null;
+  readonly subjectType: string;
+  readonly action: string;
+  readonly effect?: string;
+  readonly conditions?: unknown;
+  readonly mode: "confirm" | "authorize";
+  readonly steps: readonly {
+    readonly approvers: BlockApprovalApprovers;
+    readonly required: number | "all";
+  }[];
+  readonly selfApproval: boolean;
+  readonly expiresIn?: string;
+  readonly enabled: boolean;
+};
+/**
+ * The calls `blockApprovalStore` makes on `createApprovals(...)` from
+ * `better-supabase/blocks/approvals`.
+ */
+type BlockApprovalsClient<I extends BlockInstant> = {
+  readonly request: (subject: {
+    readonly type: string;
+    readonly id: string;
+  }, input: {
+    readonly action: string;
+    readonly reason?: string;
+    readonly payload?: Readonly<Record<string, unknown>>;
+    readonly fingerprint?: string;
+    readonly tenantless?: boolean;
+  }) => BlockResult<BlockApprovalRecord<I>>;
+  readonly list: (options?: {
+    readonly status?: BlockStatus | null;
+    readonly pageSize?: number;
+    readonly before?: I;
+    readonly tenantless?: boolean;
+  }) => BlockResult<readonly BlockApprovalRecord<I>[]>;
+  readonly consume: (id: string, fingerprint?: string) => BlockResult<BlockApprovalRecord<I>>;
+  readonly approve?: BlockDecide<I>;
+  readonly reject?: BlockDecide<I>;
+};
+type BlockDecide<I extends BlockInstant> = (id: string, comment?: string, options?: {
+  readonly decidedBy?: string;
+}) => BlockResult<BlockApprovalRecord<I>>;
+/** The call `blockApprovalPolicySource` makes on the approvals block. */
+type BlockApprovalPoliciesClient = {
+  readonly listPolicies: (options?: {
+    readonly subjectType?: string;
+    readonly pageSize?: number;
+    readonly platform?: boolean;
+  }) => BlockResult<readonly BlockApprovalTenantPolicy[]>;
+};
+type BlockApprovalStoreOptions = {
+  readonly tenantless?: boolean;
+};
+/**
+ * An `ApprovalStore` over better-supabase's approvals block, so a PermDock
+ * `approval-required` decision files a block request and is decided in the
+ * block's own approve and reject flow. `create` files the request on the
+ * resource under the permission's action, with the PermDock request in
+ * `payload.permdock` and its `fingerprint`. `get`, `getById` and `list` read
+ * the block's latest 2,000 requests in the block's tenant, and with
+ * `tenantless` the latest 2,000 without one. `consume` calls the block's
+ * `consume`, which refuses a second use and another fingerprint. `resolve`
+ * checks the verdict against the PermDock request, then calls the block's
+ * `approve` or `reject` with `decidedBy` set to the approver, so a service-role
+ * client records the user who decided; without `approve` and `reject` on the
+ * client it throws. `expire` answers 0, since the block expires requests
+ * itself.
+ */
+export declare function blockApprovalStore<I extends BlockInstant>(approvals: BlockApprovalsClient<I>, options?: BlockApprovalStoreOptions): ApprovalStore;
+type BlockApprovalPolicySourceOptions = {
+  /** The scope a step's `role` is held in. Default `tenant`. */
+  readonly roleScope?: string;
+  readonly platform?: boolean;
+  readonly permissions?: PermissionTree;
+  readonly effects?: Readonly<Record<string, readonly OperationEffect[]>>;
+};
+/**
+ * An `ApprovalPolicySource` over the approvals block's tenant policies, and
+ * with `platform` its platform policies, so a PermDock decision asks for
+ * approval wherever the block would. A policy keys the permission
+ * `<subjectType>.<action>`; a platform policy has no tenant. Its steps become
+ * sequential stages whose approvers are any of the step's permission, role,
+ * users and manager; `required: "all"` over users needs each of them. `confirm`
+ * with `selfApproval` lets the principal approve; `expiresIn` caps the
+ * request's `ttl`. `conditions` become a `check` over the call's input, or the
+ * row without one; a tree PermDock cannot express is dropped, so the policy
+ * applies to every call: stricter, never looser. A `*` subject type or action
+ * with an effect PermDock knows matches every operation with that effect, and
+ * without one expands over `permissions`. A concrete policy's `effect` is
+ * ignored, so it applies to every call of its permission. A step with only a
+ * `team` approver, `required: "all"` over anything but users, an interval it
+ * cannot read or a failed read makes the source fail, and every call an allow
+ * would grant denies.
+ */
+export declare function blockApprovalPolicySource(approvals: BlockApprovalPoliciesClient, options?: BlockApprovalPolicySourceOptions): ApprovalPolicySource;
+//#endregion
 //#region src/better-supabase/approvers.d.ts
 /**
  * Who may approve each better-supabase request kind: `'ai-tool'` (a tool call),
@@ -163,9 +297,9 @@ type ApiKeySessionOptions = {
 };
 /**
  * The fields of better-supabase's `SessionSnapshot` a subject reads: one
- * verified token, from `bsb.getRequestSession()`, that `'use cache: private'`
- * scopes share. Its `issuedAt` and `authzVersion` come from the `iat` and
- * `authz_ver` claims.
+ * verified token, from `bsb.getClaims()` in Next.js, where `'use cache:
+ * private'` scopes share it, or from `server.snapshot(request)` elsewhere. Its
+ * `issuedAt` and `authzVersion` come from the `iat` and `authz_ver` claims.
  */
 type SessionSnapshotLike = {
   readonly accessToken: string;
@@ -204,6 +338,81 @@ type BetterSupabaseSubjectOptions = Omit<SupabaseSubjectOptions, "claims"> & {
  */
 export declare function subjectFromBetterSupabase(session: SupabaseSessionLike | ApiKeySession | SessionSnapshotLike | null | undefined, options?: BetterSupabaseSubjectOptions): Subject<SupabasePrincipal> | Subject<ApiKeyPrincipal> | Subject;
 //#endregion
+//#region src/better-supabase/permdock-for.d.ts
+/**
+ * What `bsb.bootstrap()` and `bsb.getAccess()` return: a session with the
+ * tenant and the authorization version read in the same request.
+ */
+type PermDockForResult = {
+  readonly session: SupabaseSessionLike | ApiKeySession | null;
+  readonly tenant: string | null;
+  readonly authzVersion: number | null;
+  /** `bsb.bootstrap()`'s `session_active()`; `false` is signed out. */
+  readonly sessionActive?: boolean;
+};
+/** Who an instance is for. */
+type PermDockForInput = SupabaseSessionLike | ApiKeySession | SessionSnapshotLike | PermDockForResult | Subject | null | undefined;
+type PermDockForQuery = {
+  /** Default the source's tenant (`bootstrap`, `getAccess`). */
+  readonly tenant?: string | null;
+  /** Default `read`. */
+  readonly intent?: Intent;
+};
+/**
+ * The instance for a session, a `bsb.bootstrap()` result, a `bsb.getAccess()`
+ * result or a subject. The second argument is a query or a tenant, so it also
+ * serves as an approvals handler's or access-review handler's `permdockFor`.
+ * The third is the version cache better-supabase passes at runtime, which
+ * replaces the `versions` option.
+ */
+type PermDockFor = {
+  (source: PermDockForInput, query?: PermDockForQuery | string | null, versions?: VersionCache): Promise<PermDock>;
+  /**
+   * The instance options every instance of `versions` (default the `versions`
+   * option) is built with: the same object on every call, so an adapter that
+   * spreads it into its own options, such as oRPC's or MCP's `createPermDock`,
+   * shares the `claimsFirst` memberships and the `instances` entries.
+   */
+  readonly sources: (versions?: VersionCache) => InstanceOptions;
+};
+type PermDockForOptions = {
+  readonly policy: Policy;
+  /** How the verified claims map to a subject. */
+  readonly subject?: BetterSupabaseSubjectOptions;
+  /**
+   * The membership source a stale token is re-read from, wrapped in
+   * `claimsFirst(source, { onStale: 'reread', versions })`.
+   */
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The version `claimsFirst` compares with `authz_ver`; default the source's. */
+  readonly version?: MembershipSource["version"];
+  /** The process-wide version cache (`createNext({ versions })`). */
+  readonly versions?: VersionCache;
+  /** The process-wide instance cache, shared with the app's other adapters. */
+  readonly instances?: InstanceCache;
+  /** Sources and sinks for each instance. */
+  readonly options?: Omit<PermDockOptions, "tenant" | "intent" | "version">;
+};
+/**
+ * One resolver for every instance of the app: `permdockFor(await
+ * bsb.claims())`, `permdockFor(await bsb.bootstrap(...))` or `permdockFor(await
+ * bsb.getAccess(...))`. A bootstrap or access result passes its `authzVersion`
+ * as `version.known`, so the instance reads no version, and a `sessionActive:
+ * false` bootstrap is anonymous. With `instances`, a subject at an unchanged
+ * version reuses its instance across requests. Pass the same resolver to
+ * `authorizer({ permdockFor })`, `authorizationHooks({ permdockFor })` and,
+ * through `permdockFor.sources()`, to every other adapter's options, so they
+ * share one instance per subject and version.
+ */
+export declare function permdockFor(options: PermDockForOptions): PermDockFor;
+/**
+ * One `{ allowed, outcome, reason? }` per named check for `input`, from one
+ * `permdockFor` instance: frozen plain JSON an island returns from `'use cache:
+ * private'`. A check that throws denies its entry; an instance that cannot be
+ * built denies them all.
+ */
+export declare function getPermissions<K extends string>(resolve: (source: PermDockForInput, query?: PermDockForQuery | string | null) => Promise<PermDock>, input: PermDockForInput, checks: Readonly<Record<K, PermissionCheck>>, query?: PermDockForQuery | string | null): Promise<Readonly<Record<K, PermissionState>>>;
+//#endregion
 //#region src/better-supabase/subscribers.d.ts
 /** The fields of better-supabase's `OutboxEvent` the policy reads. */
 type SubscriberPolicyEvent = {
@@ -234,6 +443,11 @@ type SubscriberPolicyOptions<E extends SubscriberPolicyEvent = SubscriberPolicyE
   readonly sender?: (event: E) => string | null | undefined;
   /** Sources for the sender's and subscribers' instances. */
   readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt" | "principals">;
+  /**
+   * The process-wide instance cache: an instance is reused while the subject's
+   * authorization version is unchanged.
+   */
+  readonly instances?: InstanceCache;
 };
 /**
  * The per-subscriber check for better-supabase's webhooks-out, outbox and
@@ -267,6 +481,11 @@ type SupportPolicyOptions = {
    * tenant's `supportSessions` rules.
    */
   readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt">;
+  /**
+   * The process-wide instance cache: an instance is reused while the subject's
+   * authorization version is unchanged.
+   */
+  readonly instances?: InstanceCache;
   /**
    * The session's permissions when a start asks for `readOnly: false`. Without
    * it such a start is refused; a read-only start gets every `readOnlyHint`
@@ -304,6 +523,13 @@ type Maybe$1<T> = T | null | undefined | Promise<T | null | undefined>;
 type Claims = Readonly<Record<string, unknown>>;
 type AuthorizationHooksOptions = {
   readonly policy: Policy;
+  /**
+   * The app's `permdockFor` resolver, shared with `authorizer({ permdockFor })`
+   * so a hook reuses the instances the checks built. It holds `subject`,
+   * `memberships`, `version`, `versions`, `instances` and `options`; passing
+   * one of those as well throws a `TypeError`.
+   */
+  readonly permdockFor?: PermDockFor;
   /**
    * The claims better-supabase mints for `userId` now, or `null` for a user
    * deleted, suspended or unknown: the same loader `principalSource` takes.
@@ -316,6 +542,11 @@ type AuthorizationHooksOptions = {
    * `subjectFromBetterSupabase`.
    */
   readonly subject?: Omit<BetterSupabaseSubjectOptions, "apiKeys">;
+  /**
+   * The process-wide instance cache: an instance is reused while the subject's
+   * authorization version is unchanged.
+   */
+  readonly instances?: InstanceCache;
   /** Sources for every instance the hooks build. */
   readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt">;
   /**
@@ -358,11 +589,12 @@ type AuthorizationHooksOptions = {
  * authorization })`), decided by `policy`. Every hook builds the principal's
  * instance from the claims `claims` loads now, never from the request, and
  * fails closed: a throw, an unknown key and `approval-required` refuse.
- * `automation` and `delegation` are always set; `identities`, `delivery`,
- * `approverOf`, `support` and `tickets` only with the options they read.
- * `delegation.permissions` maps each scope to the keys whose `.scope` it is,
- * was renamed from, or that a policy `oauthScopes` entry covers, and reads no
- * `authorization_details`.
+ * `automation`, `delegation` and `sessionTags` (`snapshotTag(userId)`, so
+ * `evictSession` and sign-out clear PermDock snapshots) are always set;
+ * `identities`, `delivery`, `approverOf`, `support` and `tickets` only with the
+ * options they read. `delegation.permissions` maps each scope to the keys whose
+ * `.scope` it is, was renamed from, or that a policy `oauthScopes` entry
+ * covers, and reads no `authorization_details`.
  */
 export declare function authorizationHooks(options: AuthorizationHooksOptions): AuthorizationHooks;
 //#endregion
@@ -407,6 +639,7 @@ type AuthorizationProviderOptions = {
    * `permdock_is_approver` from `rls.approvals`.
    */
   readonly approvers?: ProviderApprovers;
+  readonly requestApprovers?: boolean;
   /**
    * better-supabase's `blocks.permissions.activeTenant`. When the token hook
    * reads the active tenant from another place than better-supabase writes it,
@@ -462,6 +695,15 @@ type BetterSupabaseOnError = (error: unknown, context: BetterSupabaseErrorContex
 type AuthorizerOperation = "list" | "get" | "create" | "update" | "delete";
 type AuthorizerOptions = {
   readonly policy: Policy;
+  /**
+   * The app's `permdockFor` resolver: `bsb.action`, `protectAction` and every
+   * adapter that spreads `permdockFor.sources()` then share one instance per
+   * subject and version. Each check calls it with better-supabase's runtime
+   * `versions`. It holds `subject`, `memberships`, `version`, `versions`,
+   * `instances` and `options`; passing one of those as well throws a
+   * `TypeError`.
+   */
+  readonly permdockFor?: PermDockFor;
   /**
    * How the verified claims map to a subject; the defaults of
    * `subjectFromBetterSupabase`.
@@ -494,12 +736,25 @@ type AuthorizerOptions = {
    */
   readonly versions?: VersionCache;
   /**
-   * The intent of one check. By default a batch (`evaluations`, list and row
-   * filtering) and an action named `read`, `list` or `view` are `read`, so
-   * `claimsFirst` may answer from the version cache; every other check is
-   * `write` and reads the version live.
+   * The intent of one check. By default better-supabase's `context.intent`;
+   * without it a batch (`evaluations`, list and row filtering) and an action
+   * named `read`, `list` or `view` are `read`, so `claimsFirst` may answer from
+   * the version cache, and every other check is `write` and reads the version
+   * live.
    */
   readonly intent?: (request: AuthorizationRequest<Permission>) => Intent;
+  /**
+   * The approval store an `approval-required` decision files its request in and
+   * resumes from. The approval id the client sends (better-supabase's
+   * `approval: { header }`) resumes one `evaluate` call; `evaluations` never
+   * consumes it. Without a store, `approval-required` is returned as is.
+   */
+  readonly store?: ApprovalStore;
+  /**
+   * Shares instances across requests while the caller's authorization version
+   * is unchanged: the `instanceCache()` the app's other adapters use.
+   */
+  readonly instances?: InstanceCache;
   /** Receives every error a check threw; the check still denies. */
   readonly onError?: BetterSupabaseOnError;
   /**
@@ -517,7 +772,7 @@ type AuthorizerOptions = {
  * throw denies. With better-supabase's runtime `memo`, the checks of one
  * request scope share an instance per claims, tenant and intent.
  */
-export declare function authorizer(options: AuthorizerOptions): Authorizer<Permission>;
+export declare function authorizer(options: AuthorizerOptions): Authorizer<Permission, VersionCache>;
 //#endregion
 //#region src/better-supabase/block-memberships.d.ts
 /**
@@ -545,14 +800,23 @@ type BlockRoleJunction = {
   readonly id?: string;
 };
 type BlockMembershipSourceOptions = {
-  /** The memberships block's table. Default `better_supabase.memberships`. */
+  /**
+   * `blockTables(config)` from `better-supabase/sql`: the memberships and
+   * `membership_roles` tables with the app's `blocks.memberships.tables` and
+   * `columns` renames. `table` and `columns` win over it.
+   */
+  readonly tables?: BlockTables;
+  /**
+   * The memberships block's table. Default the `tables` entry, else
+   * `better_supabase.memberships`.
+   */
   readonly table?: string;
   /** The declared scope a row is a membership of. Default `organization`. */
   readonly scope?: string;
   /**
    * Physical column names, keyed like better-supabase's
-   * `blocks.memberships.columns.memberships`. Defaults `organization_id`,
-   * `user_id`, `role` and `disabled_at`.
+   * `blocks.memberships.columns.memberships`. Defaults the `tables` entry's
+   * columns, else `organization_id`, `user_id`, `role` and `disabled_at`.
    */
   readonly columns?: {
     readonly tenant?: string;
@@ -566,10 +830,10 @@ type BlockMembershipSourceOptions = {
    */
   readonly roleThrough?: BlockRoleThrough;
   /**
-   * A role junction read instead of the role column. `"many"` reads
-   * `membership_roles` in the table's schema, the role set
-   * `blocks.memberships.options.roles.many` keeps, keyed by the tenant and user
-   * columns.
+   * A role junction read instead of the role column. `"many"` reads the
+   * `tables` entry for `membership_roles`, else `membership_roles` in the
+   * table's schema: the role set `blocks.memberships.options.roles.many` keeps,
+   * keyed by the tenant and user columns.
    */
   readonly roles?: BlockRoleJunction | "many";
   readonly query?: SqlQuery;
@@ -703,9 +967,10 @@ type ToolPolicy<C> = {
  * The `authorize` and `visible` hooks of better-supabase's `createMcp`, for
  * tools whose `meta` is a PermDock permission. A tool without a permission is
  * hidden and refused. `authorize` grants only a `granted` decision: an
- * approval-required call is refused, because `createMcp` has no approval flow.
- * A denial's text names the first denial reason. A throw anywhere refuses and
- * reaches `onError`.
+ * approval-required call is refused, because `authorize` has no approval
+ * outcome. A tool whose `permission` goes through `authorizer` with a `store`
+ * returns the approval id and resumes it instead. A denial's text names the
+ * first denial reason. A throw anywhere refuses and reaches `onError`.
  */
 export declare function toolPolicy<C>(options: ToolPolicyOptions<C>): ToolPolicy<C>;
 //#endregion
@@ -915,4 +1180,36 @@ export declare function hookCan(permdock: PermDock, options?: HookCanOptions): N
  */
 export declare function handlerCan(source: HandlerPermDockSource, options?: HandlerCanOptions): ProtectWebHandlerOptions["can"];
 //#endregion
-export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseActiveTenant, BetterSupabaseErrorContext, BetterSupabaseIdentityLink, BetterSupabaseMembershipRow, BetterSupabaseOnError, BetterSupabaseSubjectOptions, BlockMembershipSourceOptions, BlockRoleJunction, BlockRoleThrough, BucketAccess, CredentialGuardOptions, HandlerCanOptions, HandlerPermDockSource, HookCanOptions, McpToolDecision, McpToolRef, PendingSupportSession, PrincipalFromMembershipsOptions, PrincipalSourceOptions, ProviderApprovers, RoleOrderOptions, ServiceRoles, SessionSnapshotLike, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess };
+//#region src/better-supabase/workflow-resource.d.ts
+/**
+ * better-supabase's `RecordRef`: the record a workflow run belongs to, a
+ * subject type from `config.subjects` and its id. Structural, so the
+ * better-supabase type satisfies it without an import.
+ */
+type WorkflowRecordRef = {
+  readonly type: string;
+  readonly id: string;
+};
+/** A subject type from `config.subjects` to the PermDock resource name it is. */
+type WorkflowSubjectTypes = Readonly<Record<string, string>>;
+type WorkflowResourceResult = {
+  readonly ok: true;
+  readonly resource: {
+    readonly type: string;
+    readonly id: string;
+  };
+} | {
+  readonly ok: false;
+  readonly cause: "validation";
+  readonly decision: DeniedDecision;
+};
+/**
+ * The resource a `workflow.start` check decides on for a run started on
+ * `subject`: `{ type, id }`, with the type `types` maps the subject type to. A
+ * subject type `types` does not name, a missing or empty id, or an id over 256
+ * characters is `{ ok: false, cause: 'validation' }` with the denial to
+ * return.
+ */
+export declare function workflowResource(subject: unknown, types: WorkflowSubjectTypes): WorkflowResourceResult;
+//#endregion
+export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseActiveTenant, BetterSupabaseErrorContext, BetterSupabaseIdentityLink, BetterSupabaseMembershipRow, BetterSupabaseOnError, BetterSupabaseSubjectOptions, BlockApprovalApprovers, BlockApprovalPoliciesClient, BlockApprovalPolicySourceOptions, BlockApprovalRecord, BlockApprovalStoreOptions, BlockApprovalTenantPolicy, BlockApprovalsClient, BlockDecide, BlockInstant, BlockMembershipSourceOptions, BlockRoleJunction, BlockRoleThrough, BucketAccess, CredentialGuardOptions, HandlerCanOptions, HandlerPermDockSource, HookCanOptions, McpToolDecision, McpToolRef, PendingSupportSession, PermDockFor, PermDockForInput, PermDockForOptions, PermDockForQuery, PermDockForResult, PrincipalFromMembershipsOptions, PrincipalSourceOptions, ProviderApprovers, RoleOrderOptions, ServiceRoles, SessionSnapshotLike, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess, WorkflowRecordRef, WorkflowResourceResult, WorkflowSubjectTypes };