permdock 0.16.0 → 0.18.0

package/dist/{supabase-CDHMsDD0.js → supabase-BiViJpQ4.js}

@@ -2,13 +2,13 @@ import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { s as ApprovalError } from "./types-CcUXciSj.js";
-import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-RNFvaJJv.js";
-import { a as parseCapability } from "./capability-BqX94r07.js";
+import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-DmVqy74I.js";
+import { a as parseCapability } from "./capability-zN6T9fxe.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
-import "./budget-BELja5A9.js";
+import "./budget-BBCPDOGP.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { d as keptKeys, l as roleColumn } from "./sources-C4vkzZJV.js";
-import { t as callRpc } from "./postgrest-DAxFltvO.js";
+import { t as callRpc } from "./postgrest-BrjrckDG.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -96,8 +96,6 @@ function checkMembership(item, path, issues) {
 	for (const key of [
 		"scope",
 		"id",
-		"tenant",
-		"team",
 		"via",
 		"granted_by",
 		"reason"
@@ -110,7 +108,7 @@ function checkMembership(item, path, issues) {
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
 	optional(item, "grants", path, issues, isRecord, "an object");
-	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
+	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, or on");
 }
 function checkPermDockClaims(record, tenantClaim, path, issues) {
 	optional(record, "user_role", path, issues, (value) => value === null || typeof value === "string" || isStrings(value), "a string, an array of strings or null");
@@ -341,6 +339,31 @@ function supabaseApprovalStore(client, options = {}) {
 	};
 }
 //#endregion
+//#region src/supabase/approval-policies.ts
+function rowsOf$1(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+/**
+* Approval policies from the table `rls.approvals.tenantPolicies` generates:
+* the subject's tenants' enabled rows and every platform floor. A row whose
+* body is not an object throws, and the evaluator checks every entry with
+* `validateApprovalPolicy`, so a bad row denies every call an allow would grant
+* until it is fixed.
+*/
+function tableApprovalPolicySource(options) {
+	const fn = quoteQualifiedTable(`${options.schema ?? "permdock"}.permdock_approval_policies_for`);
+	return {
+		name: "table",
+		async approvalPoliciesFor(query) {
+			return rowsOf$1(await options.query(`select p.body from ${fn}($1::text[]) p(body)`, [[...query.tenants]])).map((row) => {
+				const body = row["body"];
+				if (!isRecord(body)) throw new TypeError("PermDock: an approval_policies row has a body that is not an object");
+				return body;
+			});
+		}
+	};
+}
+//#endregion
 //#region src/supabase/approval-delegations.ts
 function rowsOf(result) {
 	return Array.isArray(result) ? result : result.rows;
@@ -697,4 +720,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-export { supabaseClaims as a, supabaseApprovalStore as i, supabaseRls as n, exchangeCapability as o, tableApprovalDelegationSource as r, authorizeSql as t };
+export { supabaseApprovalStore as a, tableApprovalPolicySource as i, supabaseRls as n, supabaseClaims as o, tableApprovalDelegationSource as r, exchangeCapability as s, authorizeSql as t };

package/dist/{supabase-DYWnT800.js → supabase-CogTyJH2.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/supabase.ts
 const hookGenerate = defineLeaf({
 	flags: {
@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
+		const { runSupabase } = await import("./supabase-hook-BN46IrVI.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
+		const { runSupabase } = await import("./supabase-hook-BN46IrVI.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/supabase-hook-BN46IrVI.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-DX38Hj8h.js";

package/dist/{supabase-hook-HPgwYb9V.js → supabase-hook-DX38Hj8h.js}

@@ -1,30 +1,31 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
-import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMP8Cmxd.js";
+import { t as AUTHZ_EVENT } from "./authz-topic-Dbc-HDOS.js";
+import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import "./budget-BELja5A9.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
+import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
-import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-CDHMsDD0.js";
+import { i as scopeColumn } from "./compile-B_oJqmIg.js";
+import { t as authorizeSql } from "./supabase-BiViJpQ4.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
-import { o as readMemberships } from "./postgrest-DAxFltvO.js";
+import { o as readMemberships } from "./postgrest-BrjrckDG.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
-import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
+import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BfOk0ymL.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
-import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-DI8s3cPl.js";
-import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
+import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-CrjL6A49.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-CBl4r4_r.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
@@ -1885,6 +1886,246 @@ function customRolesOfSql(parts) {
       );`;
 }
 //#endregion
+//#region src/cli/rls/approval-managers.ts
+/** Whether the signed-in user manages a requester; better-supabase reads it. */
+const MANAGES = "permdock_manages";
+/**
+* The approver check with `manager` leaves; only `permdock_is_approver` calls
+* it.
+*/
+const APPROVES = "permdock_approves";
+const MANAGES_FOR = "permdock_manages_for";
+function named(value) {
+	return typeof value === "string" && value !== "";
+}
+function checked(managers) {
+	if (typeof managers !== "object" || managers === null || !("table" in managers && named(managers.table)) || !("user" in managers && named(managers.user)) || !("manager" in managers && named(managers.manager))) throw configError("PermDock CLI: rls.approvals.managers needs { table, user, manager }: the table that names each user's manager, its user column and its manager column");
+	return {
+		table: managers.table,
+		user: managers.user,
+		manager: managers.manager
+	};
+}
+/**
+* `rls.approvals.managers`: `permdock_manages(p_requester, p_levels)` walks the
+* app's manager table up to `levels` steps (at most `MAX_MANAGER_LEVELS`) with
+* a cycle guard, and `permdock_approves` decides `manager` leaves with it and
+* every other leaf through the two-argument `permdock_is_approver`. The
+* requester never manages themselves into an approval. Without `delegations`,
+* the four-argument `permdock_is_approver` is written here; with them,
+* `approvalDelegationsSql` writes it and calls `permdock_approves` first.
+*/
+function approvalManagersSql(ctx, given, isApprover, delegations) {
+	const managers = checked(given);
+	const table = quoteQualified(managers.table);
+	const user = quoteIdent(managers.user);
+	const boss = quoteIdent(managers.manager);
+	const manages = qualified(ctx, MANAGES);
+	const managesFor = qualified(ctx, MANAGES_FOR);
+	const approves = qualified(ctx, APPROVES);
+	const me = `${subjectIdSql(ctx)}::text`;
+	const entry = delegations ? "" : `
+-- approvers with managers: permdock_approves for the signed-in user
+create or replace function ${isApprover}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${approves}(p_approvers, p_tenant, p_requester)
+$$;
+revoke execute on function ${isApprover}(jsonb, text, text, text) from public, anon;
+grant execute on function ${isApprover}(jsonb, text, text, text) to authenticated;
+`;
+	return `
+-- approval managers: whether p_user manages p_requester within p_levels steps of ${managers.table}
+create or replace function ${managesFor}(p_user text, p_requester text, p_levels integer)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with recursive chain (id, depth, path) as (
+    select m.${boss}::text, 1, array[p_requester, m.${boss}::text]
+    from ${table} m
+    where m.${user}::text = p_requester
+      and m.${boss} is not null
+    union all
+    select m.${boss}::text, c.depth + 1, c.path || m.${boss}::text
+    from chain c
+    join ${table} m on m.${user}::text = c.id
+    where c.depth < least(p_levels, ${String(8)})
+      and m.${boss} is not null
+      and not (m.${boss}::text = any (c.path))
+  )
+  select coalesce(
+    p_requester <> ''
+      and p_user <> ''
+      and p_levels between 1 and ${String(8)}
+      and p_user <> p_requester
+      and exists (select 1 from chain c where c.id = p_user),
+    false
+  )
+$$;
+revoke execute on function ${managesFor}(text, text, integer) from public, anon, authenticated;
+
+-- approval managers: whether the signed-in user manages p_requester within p_levels steps of ${managers.table}
+create or replace function ${manages}(p_requester text, p_levels integer)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${managesFor}(${me}, p_requester, p_levels)
+$$;
+revoke execute on function ${manages}(text, integer) from public, anon, authenticated;
+
+-- approval managers: approvers.by with manager leaves; only permdock_is_approver calls it
+create or replace function ${approves}(p_approvers jsonb, p_tenant text, p_requester text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+  v_levels jsonb;
+begin
+  if p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${approves}(v_item, p_tenant, p_requester) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'manager' then
+      v_levels := coalesce(p_approvers -> 'levels', '1'::jsonb);
+      if jsonb_typeof(v_levels) <> 'number' or v_levels::text !~ '^[0-9]{1,2}$' then
+        return false;
+      end if;
+      return coalesce(${manages}(p_requester, v_levels::text::integer), false);
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${approves}(v_item, p_tenant, p_requester) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return ${isApprover}(p_approvers, p_tenant);
+  end case;
+end;
+$$;
+revoke execute on function ${approves}(jsonb, text, text) from public, anon, authenticated;
+${entry}`;
+}
+//#endregion
+//#region src/cli/rls/approval-policies.ts
+/**
+* The objects `rls.approvals.tenantPolicies` adds; `tableApprovalPolicySource`
+* calls the function.
+*/
+const APPROVAL_POLICIES = {
+	table: "approval_policies",
+	read: "permdock_approval_policies_for"
+};
+const KEY = /^[A-Za-z][\w-]*(?:\.[A-Za-z][\w-]*)+$/u;
+/**
+* `rls.approvals.tenantPolicies`: one table of `ApprovalPolicy` bodies, a
+* tenant row per requirement a tenant adds and platform floors with `tenant`
+* null. Members read their tenants' rows and the floors; a holder of `manage`
+* in a tenant writes that tenant's rows; nobody but the owner writes a floor.
+* `permdock_approval_policies_for(p_tenants)` answers the enabled bodies with
+* the row's tenant set, floors first, and only the owner may execute it, since
+* it reads every tenant.
+*/
+function approvalPoliciesSql(ctx, options, actorMayWrite = false) {
+	if (options === null || typeof options !== "object" || !("manage" in options) || typeof options.manage !== "string" || !KEY.test(options.manage)) throw configError("PermDock CLI: rls.approvals.tenantPolicies needs { manage: '<permission key>' }, the permission whose holders in a tenant edit its approval policies");
+	const root = ctx.scopes[0]?.name;
+	if (root === void 0) throw configError("PermDock CLI: rls.approvals.tenantPolicies needs a tenant scope; declare one in the policy's scopes");
+	const table = qualified(ctx, APPROVAL_POLICIES.table);
+	const fn = qualified(ctx, APPROVAL_POLICIES.read);
+	const member = `tenant in (select m.id::text from ${qualified(ctx, memberIdsHelper(root))}() m(id))`;
+	const manages = `exists (
+      select 1
+      from ${qualified(ctx, checkName(permittedByPermissionHelper(root)))}(${quoteLiteral(options.manage)}) i(id)
+      where i.id::text = tenant
+    )`;
+	const writable = actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : "";
+	const own = `tenant is not null and ${subjectIdSql(ctx)} is not null and ${manages}${writable}`;
+	const policy = (name) => quoteIdent(`${APPROVAL_POLICIES.table}_${name}`);
+	return `
+-- approval policies: requirements a tenant keeps as data, plus platform floors (tenant null); tableApprovalPolicySource reads them
+create table if not exists ${table} (
+  id text primary key default gen_random_uuid()::text,
+  tenant text,
+  name text not null,
+  body jsonb not null,
+  enabled boolean not null default true,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  constraint ${quoteIdent(`${APPROVAL_POLICIES.table}_body`)} check (jsonb_typeof(body) = 'object' and body ? 'approval')
+);
+create index if not exists ${quoteIdent(`${APPROVAL_POLICIES.table}_tenant`)} on ${table} (tenant);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, public;
+grant select, insert, update, delete on table ${table} to authenticated;
+drop policy if exists ${policy("read")} on ${table};
+create policy ${policy("read")} on ${table}
+  for select to authenticated
+  using (tenant is null or ${member});
+drop policy if exists ${policy("insert")} on ${table};
+create policy ${policy("insert")} on ${table}
+  for insert to authenticated
+  with check (${own});
+drop policy if exists ${policy("update")} on ${table};
+create policy ${policy("update")} on ${table}
+  for update to authenticated
+  using (${own})
+  with check (${own});
+drop policy if exists ${policy("delete")} on ${table};
+create policy ${policy("delete")} on ${table}
+  for delete to authenticated
+  using (${own});
+
+-- approval policies: the enabled bodies for p_tenants and every floor, with the row's tenant; only the owner executes it
+create or replace function ${fn}(p_tenants text[])
+returns setof jsonb
+language sql
+stable
+set search_path = ''
+as $$
+  select case
+      when p.tenant is null then p.body - 'tenant'
+      else p.body || jsonb_build_object('tenant', p.tenant)
+    end
+  from ${table} p
+  where p.enabled
+    and (p.tenant is null or p.tenant = any(coalesce(p_tenants, '{}')))
+  order by p.tenant nulls first, p.created_at, p.id;
+$$;
+revoke execute on function ${fn}(text[]) from public, anon, authenticated;
+`;
+}
+//#endregion
 //#region src/cli/rls/approvals.ts
 /**
 * `rls.approvals`' approver check; better-supabase's `isApprover` template
@@ -2188,17 +2429,30 @@ grant execute on function ${fn}(jsonb, text) to authenticated;
 }
 /**
 * Everything `rls.approvals` writes: the generated or adopted store, the
-* approver check and, with `delegations: true`, the covers. With
+* approver check, with `managers` the manager walk, with `delegations: true`
+* the covers, and with `tenantPolicies` the tenant approval policies. With
 * `actorMayWrite`, the covers' write policies call
 * `permdock_actor_may_write()`.
 */
 function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 	if (approvals === void 0 || approvals === false) return;
 	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
-	const { table, delegations } = approvals;
+	const { table, delegations, tenantPolicies, managers } = approvals;
 	if (delegations !== void 0 && typeof delegations !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.delegations must be a boolean");
+	if (approvals.store !== void 0 && typeof approvals.store !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.store must be a boolean");
 	let store;
-	if (table === void 0) {
+	if (approvals.store === false) {
+		const adopted = [
+			"table",
+			"token",
+			"body",
+			"open",
+			"schema",
+			"mirror"
+		].find((key) => approvals[key] !== void 0);
+		if (adopted !== void 0) throw configError(`PermDock CLI: rls.approvals.${adopted} configures the approval store, which rls.approvals.store: false leaves out`);
+		store = "";
+	} else if (table === void 0) {
 		const adoptOnly = [
 			"token",
 			"body",
@@ -2212,7 +2466,7 @@ function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 		...approvals,
 		table
 	}, jsonSchema);
-	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite) : "");
+	return store + isApproverSql(ctx) + (managers === void 0 ? "" : approvalManagersSql(ctx, managers, qualified(ctx, APPROVAL_STORE.isApprover), delegations === true)) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite, managers !== void 0) : "") + (delegations === true || managers !== void 0 ? requestApproversSql(ctx) : "") + (tenantPolicies === void 0 ? "" : approvalPoliciesSql(ctx, tenantPolicies, actorMayWrite));
 }
 /**
 * The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
@@ -2225,13 +2479,15 @@ const DELEGATIONS = {
 /**
 * `rls.approvals.delegations`: one table of out-of-office covers that a user
 * writes for themselves, and a four-argument `permdock_is_approver` that also
-* answers for a delegate inside an active cover. One hop: a cover is checked
+* answers for a delegate inside an active cover. With `managers`, the signed-in
+* user's own check is `permdock_approves`, and a cover passes on a `manager`
+* leaf when the delegator manages the requester. One hop: a cover is checked
 * against the delegator's own approver rights, never the delegator's covers. A
 * delegator who is the requester never counts. A `holder()` approver through a
 * cover needs `rls.mode: "database"`, where the `_for` helpers exist; in `jwt`
 * mode only `user()` approvers pass.
 */
-function approvalDelegationsSql(ctx, actorMayWrite = false) {
+function approvalDelegationsSql(ctx, actorMayWrite = false, managers = false) {
 	const table = qualified(ctx, DELEGATIONS.table);
 	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
 	const covers = qualified(ctx, DELEGATIONS.covers);
@@ -2248,7 +2504,15 @@ function approvalDelegationsSql(ctx, actorMayWrite = false) {
           where i.id::text = p_tenant
         )` : "false";
 	const policy = (name) => quoteIdent(`${DELEGATIONS.table}_${name}`);
-	const mine = `delegator::text = ${me}${actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : ""}`;
+	const writable = actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : "";
+	const managerCase = managers ? `
+    when 'manager' then
+      v_levels := coalesce(p_approvers -> 'levels', '1'::jsonb);
+      if jsonb_typeof(v_levels) <> 'number' or v_levels::text !~ '^[0-9]{1,2}$' then
+        return false;
+      end if;
+      return coalesce(${qualified(ctx, MANAGES_FOR)}(p_delegator::text, p_requester, v_levels::text::integer), false);` : "";
+	const mine = `delegator::text = ${me}${writable}`;
 	const own = `${mine} and (tenant is null or ${member("tenant")})`;
 	return `
 -- approval delegations: out-of-office covers a user writes for themselves; tableApprovalDelegationSource and permdock_is_approver read them
@@ -2288,7 +2552,7 @@ create policy ${policy("delete")} on ${table}
   using (${mine});
 
 -- approval delegations: whether a delegator's own rights match approvers.by; only permdock_is_approver calls it
-create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text)
+create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text, p_requester text)
 returns boolean
 language plpgsql
 stable
@@ -2296,7 +2560,7 @@ security definer
 set search_path = ''
 as $$
 declare
-  v_item jsonb;
+  v_item jsonb;${managers ? "\n  v_levels jsonb;" : ""}
 begin
   if p_delegator is null or p_approvers is null then
     return false;
@@ -2306,7 +2570,7 @@ begin
       return false;
     end if;
     for v_item in select value from jsonb_array_elements(p_approvers) loop
-      if not ${covers}(p_delegator, v_item, p_tenant) then
+      if not ${covers}(p_delegator, v_item, p_tenant, p_requester) then
         return false;
       end if;
     end loop;
@@ -2322,13 +2586,13 @@ begin
       if p_tenant is null then
         return ${holderGlobal};
       end if;
-      return ${holderTenant};
+      return ${holderTenant};${managerCase}
     when 'any-of' then
       if jsonb_typeof(p_approvers -> 'of') <> 'array' then
         return false;
       end if;
       for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
-        if ${covers}(p_delegator, v_item, p_tenant) then
+        if ${covers}(p_delegator, v_item, p_tenant, p_requester) then
           return true;
         end if;
       end loop;
@@ -2338,7 +2602,7 @@ begin
   end case;
 end;
 $$;
-revoke execute on function ${covers}(${user}, jsonb, text) from public, anon, authenticated;
+revoke execute on function ${covers}(${user}, jsonb, text, text) from public, anon, authenticated;
 
 -- approvers with covers: the signed-in user, or a delegate inside an active cover of a delegator who is not the requester
 create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
@@ -2352,7 +2616,7 @@ declare
   v_delegator ${user};
   v_user text := ${me};
 begin
-  if ${fn}(p_approvers, p_tenant) then
+  if ${managers ? `${qualified(ctx, APPROVES)}(p_approvers, p_tenant, p_requester)` : `${fn}(p_approvers, p_tenant)`} then
     return true;
   end if;
   if coalesce(v_user, '') = '' or coalesce(p_requester, '') = '' then
@@ -2373,7 +2637,7 @@ begin
       and d.permissions is null
       and (d.resources is null or p_resource = any (d.resources))
   loop
-    if ${covers}(v_delegator, p_approvers, p_tenant) then
+    if ${covers}(v_delegator, p_approvers, p_tenant, p_requester) then
       return true;
     end if;
   end loop;
@@ -2384,6 +2648,45 @@ revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
 grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
 `;
 }
+function requestApproversSql(ctx) {
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	return `
+-- approvers with the current step: the four-argument check over p_approvers and the step's users, manager and permission
+create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text, p_request_approvers jsonb)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${fn}(
+    jsonb_build_object(
+      'kind', 'any-of',
+      'of',
+      case when p_approvers is null then '[]'::jsonb else jsonb_build_array(p_approvers) end
+        || case
+          when jsonb_typeof(p_request_approvers -> 'users') = 'array' then coalesce(
+            (select jsonb_agg(jsonb_build_object('kind', 'user', 'id', u.id)) from jsonb_array_elements_text(p_request_approvers -> 'users') u(id)),
+            '[]'::jsonb
+          )
+          else '[]'::jsonb
+        end
+        || case when p_request_approvers -> 'manager' = 'true'::jsonb then '[{"kind": "manager"}]'::jsonb else '[]'::jsonb end
+        || case
+          when jsonb_typeof(p_request_approvers -> 'permission') = 'string'
+            then jsonb_build_array(jsonb_build_object('kind', 'permission', 'permission', p_request_approvers ->> 'permission'))
+          else '[]'::jsonb
+        end
+    ),
+    p_tenant,
+    p_requester,
+    p_resource
+  )
+$$;
+revoke execute on function ${fn}(jsonb, text, text, text, jsonb) from public, anon;
+grant execute on function ${fn}(jsonb, text, text, text, jsonb) to authenticated;
+`;
+}
 /**
 * The request fields an adopted table may mirror into its own columns, as SQL
 * over a body.
@@ -2847,6 +3150,10 @@ function hookParts(scopes, config, overrides) {
 		sources: hook.memberships,
 		budget: positiveInteger(overrides.budget ?? hook.budget ?? 1024, "budget"),
 		version: hook.version !== false,
+		broadcast: hook.version === false || hook.broadcast === false ? void 0 : {
+			topic: hook.broadcast?.topic ?? "permdock:authz",
+			receivePolicy: hook.broadcast?.receivePolicy ?? true
+		},
 		jwtExpiry: positiveInteger(hook.jwtExpiry ?? 900, "jwtExpiry"),
 		tenantClaim,
 		users: suspension?.users,
@@ -2964,7 +3271,60 @@ revoke execute on function ${bump}() from public, anon, authenticated;
 ${tables.map(([name, user]) => `drop trigger if exists ${quoteIdent(VERSION_TRIGGER)} on ${quoteQualified(name)};
 create trigger ${quoteIdent(VERSION_TRIGGER)}
   after insert or update or delete on ${quoteQualified(name)}
-  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+  for each row execute function ${bump}(${quoteLiteral(user)});`).join("\n")}${broadcastSql(parts, versionTable)}${memberUsersVersionSql(parts, bumpFor)}${roleKeysVersionSql(parts, versionTable)}`;
+}
+/**
+* Every version row written is sent as `{ user_id, version }` on the server
+* topic and on the user's `authz:<uid>`, in the shape better-supabase's
+* `subscribeAuthzVersions` and `SessionProvider` read.
+*/
+function broadcastSql(parts, versionTable) {
+	const broadcast = parts.broadcast;
+	if (broadcast === void 0) return "";
+	const send = `${quoteIdent(parts.schema)}.permdock_broadcast_authz_version`;
+	const payload = "jsonb_build_object('user_id', new.user_id, 'version', new.version)";
+	const event = quoteLiteral(AUTHZ_EVENT);
+	const receive = broadcast.receivePolicy ? `
+
+-- each user receives their own authz:<uid> topic, and no user may join the server topic
+do $$
+begin
+  if to_regclass('realtime.messages') is not null and not exists (
+    select 1 from pg_policies
+    where schemaname = 'realtime' and tablename = 'messages'
+      and policyname = 'permdock_authz_version_receive'
+  ) then
+    create policy permdock_authz_version_receive on realtime.messages
+      for select to authenticated
+      using (
+        realtime.messages.extension = 'broadcast'
+        and (select realtime.topic()) = 'authz:' || (select auth.uid())::text
+      );
+  end if;
+end;
+$$;` : "";
+	return `
+
+-- sends every version bump on the server topic and on the user's authz:<uid>
+create or replace function ${send}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if to_regprocedure('realtime.send(jsonb, text, text, boolean)') is not null then
+    perform realtime.send(${payload}, ${event}, ${quoteLiteral(broadcast.topic)}, true);
+    perform realtime.send(${payload}, ${event}, 'authz:' || new.user_id::text, true);
+  end if;
+  return null;
+end;
+$$;
+revoke execute on function ${send}() from public, anon, authenticated;
+drop trigger if exists permdock_authz_version_broadcast on ${versionTable};
+create trigger permdock_authz_version_broadcast
+  after insert or update on ${versionTable}
+  for each row execute function ${send}();${receive}`;
 }
 function signedUp(user) {
 	return `exists (select 1 from auth.users a where a.id = ${user})`;
@@ -3240,7 +3600,8 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
 		...config.rls?.tokenScopes === true ? [helperEntry(TOKEN_SCOPE_ALLOWS, "p_grant text", "boolean", client)] : [],
 		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
-		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
+		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && (config.rls.approvals.delegations === true || config.rls.approvals.managers !== void 0) ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
+		...typeof config.rls?.approvals === "object" && config.rls.approvals.managers !== void 0 ? [helperEntry(MANAGES, "p_requester text, p_levels integer", "boolean", [])] : [],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;