permdock 0.16.0 → 0.18.0

package/dist/better-supabase/index.js

@@ -1,7 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
-import { l as asApprover } from "../role-builder-BK2-T6oD.js";
-import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-B4r0N_Uz.js";
+import { a as flattenApprovers, i as approverManagerKey, o as holder, r as approverLeaves } from "../approvers-BaNwKYgd.js";
 import { t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { a as isId, r as idList } from "../expiry-6XByK0dm.js";
 import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-B8tYxPIt.js";
@@ -9,21 +8,33 @@ import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-
 import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "../sha256-C-4WXKIu.js";
 import { t as decideSupportSession } from "../support-session-BsmPCbz8.js";
-import { f as scopeList } from "../scopes-0Up_UA2t.js";
+import { d as scopeList } from "../scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
-import { _ as claimsFirst } from "../instance-snapshot-DuWf1cT3.js";
-import { a as delegatedScopeMap, s as scopesReaching, t as getPermDock } from "../permdock-BvjivVb9.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-BqX94r07.js";
-import { r as credentialSubject, s as parseCredential } from "../credential-CyyyvCsL.js";
+import { n as asApprover } from "../approval-normalize-CUjgSsOl.js";
+import { n as isOperationEffect } from "../operations-Bm9HFecz.js";
+import { r as isSubject, t as anonymousSubject } from "../subject-C7RddW0G.js";
+import { I as decisionTenant } from "../evaluate-Czbj7thS.js";
+import { _ as claimsFirst } from "../instance-snapshot-BWa71my8.js";
+import { a as permissionStates } from "../checks-fyDOhcz0.js";
+import { a as delegatedScopeMap, s as scopesReaching } from "../permdock-D-_WrdKu.js";
+import { s as ApprovalError } from "../types-CcUXciSj.js";
+import { t as applyApprovalVerdict } from "../store-DmVqy74I.js";
+import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-zN6T9fxe.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-B3Hj4puZ.js";
+import { h as managerKeys, s as resumeDecision } from "../helpers-DmqGy63f.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
+import { t as parseApprovalRequest } from "../parse-request-DOBVaeiQ.js";
+import { n as parseApprovalHeader } from "../approval-header-8QV6MU4H.js";
+import { i as snapshotTag } from "../snapshot-cache-B66h7FBK.js";
+import { t as buildInstance } from "../build-instance-BFMFQdE_.js";
+import { n as NO_GRANT } from "../decision-CaG5_eNJ.js";
 import { t as policyRowConditionKeys } from "../row-conditions-BAGHOmVq.js";
-import { n as subscribersFor } from "../audience-DTjR8xet.js";
+import { n as subscribersFor } from "../audience-B4YR9UpV.js";
 import { i as qualifySqlTable, l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
 import { o as junctionMembershipSource } from "../sources-C4vkzZJV.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-DAxFltvO.js";
-import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "../parse-1_ZheTW5.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-BrjrckDG.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BdzBobNK.js";
+import { t as parseCatalog } from "../parse-UTC-sDrt.js";
 import { n as activeTenantMismatch, t as activeOrganizationFrom } from "../active-tenant-DVee32-T.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/access-reviews.ts
@@ -155,6 +166,439 @@ function accessReviewApplier(options) {
 	};
 }
 //#endregion
+//#region src/better-supabase/approvals-block.ts
+const PAGE = 100;
+const MAX_SCANNED = 2e3;
+function statusOf(status) {
+	switch (status) {
+		case "pending":
+		case "approved":
+		case "rejected":
+		case "expired": return status;
+		case "cancelled": return "rejected";
+		default: return status;
+	}
+}
+function instantOf(value) {
+	if (value === void 0) return;
+	const ms = Date.parse(value.toJSON());
+	return Number.isNaN(ms) ? void 0 : isoAt(ms);
+}
+/** The PermDock request a block record carries, with the block's state. */
+function requestOf(record) {
+	const stored = parseApprovalRequest(record.payload["permdock"]);
+	if (stored === null) return null;
+	const status = statusOf(record.status);
+	return freezeDeep(compact({
+		...stored,
+		status,
+		expiresAt: instantOf(record.expiresAt) ?? stored.expiresAt,
+		resolvedAt: status === "pending" ? void 0 : instantOf(record.decidedAt),
+		consumedAt: instantOf(record.consumedAt),
+		fingerprint: record.fingerprint ?? stored.fingerprint
+	}));
+}
+async function unwrap(result, call) {
+	const awaited = await result;
+	if (!awaited.ok) throw new Error(`PermDock: the approvals block's ${call} failed`, { cause: awaited.error });
+	return awaited.data;
+}
+/** Every block record carrying a PermDock request, newest first, capped. */
+async function scan(approvals, found, tenantless) {
+	const out = [];
+	let before;
+	for (let scanned = 0; scanned < MAX_SCANNED; scanned += PAGE) {
+		const page = await unwrap(approvals.list({
+			status: null,
+			pageSize: PAGE,
+			...before === void 0 ? {} : { before },
+			...tenantless ? { tenantless } : {}
+		}), "list");
+		for (const record of page) {
+			const request = requestOf(record);
+			if (request !== null) {
+				const pair = {
+					record,
+					request
+				};
+				out.push(pair);
+				if (found(pair)) return out;
+			}
+		}
+		const last = page.at(-1);
+		if (page.length < PAGE || last === void 0) break;
+		before = last.createdAt;
+	}
+	return out;
+}
+function actionOf(permission) {
+	const dot = permission.lastIndexOf(".");
+	return dot === -1 ? permission : permission.slice(dot + 1);
+}
+function matchesQuery(request, query) {
+	return (query.status === void 0 || request.status === query.status) && (query.principalId === void 0 || request.subject.principal?.id === query.principalId) && (query.actorId === void 0 || request.subject.actor?.id === query.actorId) && (query.tenant === void 0 || decisionTenant(request.subject, request.membership) === query.tenant) && (query.session === void 0 || request.subject.session === query.session);
+}
+/**
+* An `ApprovalStore` over better-supabase's approvals block, so a PermDock
+* `approval-required` decision files a block request and is decided in the
+* block's own approve and reject flow. `create` files the request on the
+* resource under the permission's action, with the PermDock request in
+* `payload.permdock` and its `fingerprint`. `get`, `getById` and `list` read
+* the block's latest 2,000 requests in the block's tenant, and with
+* `tenantless` the latest 2,000 without one. `consume` calls the block's
+* `consume`, which refuses a second use and another fingerprint. `resolve`
+* checks the verdict against the PermDock request, then calls the block's
+* `approve` or `reject` with `decidedBy` set to the approver, so a service-role
+* client records the user who decided; without `approve` and `reject` on the
+* client it throws. `expire` answers 0, since the block expires requests
+* itself.
+*/
+function blockApprovalStore(approvals, options = {}) {
+	const tenantless = options.tenantless === true;
+	const scanAll = async (found) => {
+		const inTenant = await scan(approvals, found, false);
+		if (!tenantless || inTenant.some(found)) return inTenant;
+		return [...inTenant, ...await scan(approvals, found, true)];
+	};
+	const byToken = async (token) => (await scanAll(({ request }) => request.token === token)).find(({ request }) => request.token === token);
+	return Object.freeze({
+		name: "better-supabase-approvals",
+		async create(request) {
+			await unwrap(approvals.request({
+				type: request.resource.type,
+				id: request.resource.id ?? request.id
+			}, compact({
+				action: actionOf(request.permission),
+				reason: request.detail,
+				payload: { permdock: request },
+				fingerprint: request.fingerprint,
+				tenantless: tenantless && decisionTenant(request.subject, request.membership) === void 0 ? true : void 0
+			})), "request");
+		},
+		async get(token) {
+			return (await byToken(token))?.request ?? null;
+		},
+		async getById(id) {
+			return (await scanAll(({ request }) => request.id === id)).find(({ request }) => request.id === id)?.request ?? null;
+		},
+		async resolve(token, verdict) {
+			const decide = verdict.status === "approved" ? approvals.approve : approvals.reject;
+			if (decide === void 0) throw new Error("PermDock: blockApprovalStore resolves only with the approvals block's approve and reject on the client");
+			const found = await byToken(token);
+			if (found === void 0) throw new ApprovalError("approval-not-found", "approval was not found");
+			applyApprovalVerdict(found.request, verdict);
+			const by = verdict.by.principal?.id;
+			const next = requestOf(await unwrap(decide(found.record.id, verdict.note, compact({ decidedBy: by })), verdict.status === "approved" ? "approve" : "reject"));
+			if (next === null) throw new ApprovalError("approval-not-found", "approval was not found");
+			return next;
+		},
+		async list(query) {
+			const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);
+			const offset = query.cursor === void 0 ? 0 : Number(query.cursor);
+			if (!Number.isSafeInteger(offset) || offset < 0) return { items: [] };
+			const all = (await scanAll(() => false)).map(({ request }) => request).filter((request) => matchesQuery(request, query)).toReversed().toSorted((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
+			const items = all.slice(offset, offset + limit);
+			return offset + limit < all.length ? {
+				items,
+				next: String(offset + limit)
+			} : { items };
+		},
+		expire() {
+			return 0;
+		},
+		async consume(token) {
+			const found = await byToken(token);
+			if (found === void 0) return null;
+			const consumed = await approvals.consume(found.record.id, found.request.fingerprint);
+			return consumed.ok ? requestOf(consumed.data) : null;
+		}
+	});
+}
+const INTERVAL_UNITS = {
+	second: 1,
+	minute: 60,
+	hour: 3600,
+	day: 86400,
+	week: 604800
+};
+/** Seconds in a Postgres interval such as `3 days` or `1 day 2 hours`. */
+function intervalSeconds(interval) {
+	const parts = interval.trim().toLowerCase().split(/\s+/u);
+	let seconds = 0;
+	for (let index = 0; index < parts.length; index += 2) {
+		const amount = Number(parts[index]);
+		const unit = parts[index + 1]?.replace(/s$/u, "");
+		const size = unit === void 0 ? void 0 : INTERVAL_UNITS[unit];
+		if (!Number.isSafeInteger(amount) || amount < 0 || size === void 0) throw new TypeError(`PermDock: the approval policy interval '${interval}' is not whole seconds, minutes, hours, days or weeks`);
+		seconds += amount * size;
+	}
+	if (seconds === 0) throw new TypeError(`PermDock: the approval policy interval '${interval}' is empty`);
+	return seconds;
+}
+function stageApprovers(approvers, roleScope) {
+	const leaves = [
+		...approvers.permission === void 0 ? [] : [{
+			kind: "permission",
+			permission: approvers.permission
+		}],
+		...approvers.role === void 0 ? [] : [{
+			kind: "role",
+			role: approvers.role,
+			scope: roleScope
+		}],
+		...(approvers.users ?? []).map((id) => ({
+			kind: "user",
+			id
+		})),
+		...approvers.manager === true ? [{ kind: "manager" }] : []
+	];
+	if (leaves.length === 0) throw new TypeError("PermDock: an approval policy step names no approver PermDock can check (team approvers are not supported)");
+	return {
+		kind: "any-of",
+		of: leaves
+	};
+}
+function quorumOf(step) {
+	if (step.required !== "all") return step.required;
+	const { users = [], permission, role, team, manager } = step.approvers;
+	if (users.length === 0 || permission !== void 0 || role !== void 0 || team !== void 0 || manager === true) throw new TypeError("PermDock: an approval policy step with required \"all\" needs users and no other approvers, since the block counts other holders when a request is filed");
+	return users.length;
+}
+const NUMERIC = /^-?\d+(?:\.\d+)?$/u;
+function isScalar(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function variants(value) {
+	if (typeof value === "string" && NUMERIC.test(value)) return [value, Number(value)];
+	return typeof value === "number" ? [value, String(value)] : [value];
+}
+function numberOf(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	return typeof value === "string" && NUMERIC.test(value) ? Number(value) : void 0;
+}
+const ORDER = {
+	gt: "gt",
+	gte: "gte",
+	lt: "lt",
+	lte: "lte"
+};
+function ruleCondition(field, operator, value) {
+	const list = Array.isArray(value) && value.every(isScalar) ? value : [];
+	const contains = (item) => ({
+		op: "contains",
+		field,
+		value: item
+	});
+	switch (operator) {
+		case "": return true;
+		case "is":
+		case "eq": return isScalar(value) ? {
+			op: "or",
+			conditions: variants(value).map((item) => ({
+				op: "eq",
+				field,
+				value: item
+			}))
+		} : void 0;
+		case "is_not":
+		case "neq": return isScalar(value) ? {
+			op: "and",
+			conditions: variants(value).map((item) => ({
+				op: "ne",
+				field,
+				value: item
+			}))
+		} : void 0;
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const bound = numberOf(value);
+			return bound === void 0 ? void 0 : {
+				op: ORDER[operator],
+				field,
+				value: bound
+			};
+		}
+		case "between":
+		case "not_between": {
+			const [low, high] = Array.isArray(value) ? value.map(numberOf) : [void 0, void 0];
+			if (low === void 0 || high === void 0) return;
+			const between = {
+				op: "and",
+				conditions: [{
+					op: "gte",
+					field,
+					value: low
+				}, {
+					op: "lte",
+					field,
+					value: high
+				}]
+			};
+			return operator === "between" ? between : {
+				op: "not",
+				condition: between
+			};
+		}
+		case "is_any_of":
+		case "is_none_of": return list.length === 0 ? void 0 : {
+			op: operator === "is_any_of" ? "in" : "notIn",
+			field,
+			value: list.flatMap(variants)
+		};
+		case "contains": return typeof value === "string" ? contains(value) : void 0;
+		case "not_contains": return typeof value === "string" ? {
+			op: "not",
+			condition: contains(value)
+		} : void 0;
+		case "has_any_of":
+		case "has_all_of":
+		case "has_none_of": {
+			if (list.length === 0) return;
+			const each = list.map(contains);
+			if (operator === "has_all_of") return {
+				op: "and",
+				conditions: each
+			};
+			const any = {
+				op: "or",
+				conditions: each
+			};
+			return operator === "has_any_of" ? any : {
+				op: "not",
+				condition: any
+			};
+		}
+		case "empty": return {
+			op: "isNull",
+			field,
+			value: true
+		};
+		case "not_empty": return {
+			op: "isNull",
+			field,
+			value: false
+		};
+		default: return;
+	}
+}
+function treeCondition(node) {
+	if (!isRecord(node)) return;
+	let condition;
+	if (node["type"] === "group") {
+		const rules = node["rules"];
+		const combinator = node["combinator"];
+		if (!Array.isArray(rules) || combinator !== "and" && combinator !== "or") return;
+		const parts = [];
+		for (const rule of rules) {
+			const part = treeCondition(rule);
+			if (part === void 0) return;
+			if (part === true) {
+				if (combinator === "or") return true;
+				continue;
+			}
+			parts.push(part);
+		}
+		condition = parts.length === 0 ? true : {
+			op: combinator,
+			conditions: parts
+		};
+	} else if (node["type"] === "rule") {
+		const path = node["path"];
+		const operator = node["operator"];
+		if (!Array.isArray(path) || path.length !== 1 || typeof path[0] !== "string" || typeof operator !== "string") return;
+		condition = ruleCondition(path[0], operator, node["value"]);
+	}
+	if (node["negated"] !== true || condition === void 0) return condition;
+	return condition === true ? void 0 : {
+		op: "not",
+		condition
+	};
+}
+function effectsOf(effect, options) {
+	if (effect === void 0) return;
+	const mapped = options.effects !== void 0 && Object.hasOwn(options.effects, effect) ? options.effects[effect] : void 0;
+	if (mapped !== void 0) return mapped.length === 0 ? void 0 : mapped;
+	return isOperationEffect(effect) ? [effect] : void 0;
+}
+function keysOf(entry, permissions) {
+	if (permissions === void 0) throw new TypeError("PermDock: an approval policy for every subject type or action needs blockApprovalPolicySource's permissions, or an effect PermDock knows");
+	return listPermissions(permissions).map((permission) => permission.key).filter((key) => {
+		const dot = key.lastIndexOf(".");
+		return dot > 0 && (entry.subjectType === "*" || key.slice(0, dot) === entry.subjectType) && (entry.action === "*" || key.slice(dot + 1) === entry.action);
+	});
+}
+function policiesOf(entry, options) {
+	const roleScope = options.roleScope ?? "tenant";
+	const approval = compact({
+		stages: entry.steps.length === 0 ? void 0 : entry.steps.map((step) => ({
+			by: stageApprovers(step.approvers, roleScope),
+			quorum: quorumOf(step)
+		})),
+		combine: entry.steps.length > 1 ? "sequential" : void 0,
+		mode: entry.mode === "confirm" && entry.selfApproval ? "confirm" : void 0,
+		ttl: entry.expiresIn === void 0 ? void 0 : intervalSeconds(entry.expiresIn)
+	});
+	const tree = entry.conditions === void 0 || entry.conditions === null ? true : treeCondition(entry.conditions);
+	const shared = compact({
+		tenant: entry.organizationId ?? void 0,
+		check: tree === true || tree === void 0 ? void 0 : tree,
+		approval
+	});
+	if (!(entry.subjectType === "*" || entry.action === "*")) return [{
+		...shared,
+		permission: `${entry.subjectType}.${entry.action}`
+	}];
+	const effects = effectsOf(entry.effect, options);
+	if (effects !== void 0) return [{
+		...shared,
+		effects
+	}];
+	return keysOf(entry, options.permissions).map((permission) => ({
+		...shared,
+		permission
+	}));
+}
+function enabledIn(tenants) {
+	return (entry) => isRecord(entry) && entry["enabled"] === true && (entry["organizationId"] === null || typeof entry["organizationId"] === "string" && tenants.includes(entry["organizationId"]));
+}
+async function listed(approvals, platform) {
+	const entries = await unwrap(approvals.listPolicies(platform ? {
+		pageSize: 200,
+		platform
+	} : { pageSize: 200 }), "listPolicies");
+	if (!Array.isArray(entries)) throw new TypeError("PermDock: listPolicies answered no list");
+	return entries.map((entry) => entry);
+}
+/**
+* An `ApprovalPolicySource` over the approvals block's tenant policies, and
+* with `platform` its platform policies, so a PermDock decision asks for
+* approval wherever the block would. A policy keys the permission
+* `<subjectType>.<action>`; a platform policy has no tenant. Its steps become
+* sequential stages whose approvers are any of the step's permission, role,
+* users and manager; `required: "all"` over users needs each of them. `confirm`
+* with `selfApproval` lets the principal approve; `expiresIn` caps the
+* request's `ttl`. `conditions` become a `check` over the call's input, or the
+* row without one; a tree PermDock cannot express is dropped, so the policy
+* applies to every call: stricter, never looser. A `*` subject type or action
+* with an effect PermDock knows matches every operation with that effect, and
+* without one expands over `permissions`. A concrete policy's `effect` is
+* ignored, so it applies to every call of its permission. A step with only a
+* `team` approver, `required: "all"` over anything but users, an interval it
+* cannot read or a failed read makes the source fail, and every call an allow
+* would grant denies.
+*/
+function blockApprovalPolicySource(approvals, options = {}) {
+	return Object.freeze({
+		name: "better-supabase-approvals",
+		async approvalPoliciesFor(query) {
+			const [own, platform] = await Promise.all([listed(approvals, false), options.platform === true ? listed(approvals, true) : []]);
+			return [...platform, ...own].filter(enabledIn(query.tenants)).flatMap((entry) => policiesOf(entry, options));
+		}
+	});
+}
+//#endregion
 //#region src/better-supabase/api-keys.ts
 const EPOCH = "1970-01-01T00:00:00.000Z";
 const rfc3339Of = (instant) => isoAt(instant.epochMilliseconds);
@@ -341,6 +785,127 @@ function subjectFromBetterSupabase(session, options = {}) {
 	});
 }
 //#endregion
+//#region src/better-supabase/permdock-for.ts
+/** The options a `permdockFor` resolver already holds. */
+const RESOLVER_OWNS = [
+	"subject",
+	"memberships",
+	"version",
+	"versions",
+	"instances",
+	"options"
+];
+function isResult(source) {
+	return isRecord(source) && Object.hasOwn(source, "session") && Object.hasOwn(source, "authzVersion") && !Object.hasOwn(source, "kind");
+}
+function knownVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : void 0;
+}
+function subjectOf(source, result, signedOut, options) {
+	if (isSubject(source)) return source;
+	if (result !== void 0) return subjectFromBetterSupabase(signedOut ? null : result.session, options);
+	return subjectFromBetterSupabase(source, options);
+}
+/**
+* The resolver behind `permdockFor`, the authorizer and the hooks: one sources
+* object per version cache, so every instance of one subject at one version
+* shares an `instances` entry.
+*/
+function permdockResolver(options) {
+	const byCache = /* @__PURE__ */ new WeakMap();
+	let uncached;
+	const sourcesOf = (versions) => ({
+		...options.options,
+		...options.instances === void 0 ? {} : { instances: options.instances },
+		...options.memberships === void 0 ? {} : { memberships: claimsFirst(options.memberships, {
+			onStale: "reread",
+			...options.version === void 0 ? {} : { version: options.version },
+			...versions === void 0 ? {} : { versions }
+		}) }
+	});
+	const sourcesFor = (versions) => {
+		if (versions === void 0) {
+			uncached ??= sourcesOf(void 0);
+			return uncached;
+		}
+		const known = byCache.get(versions);
+		if (known !== void 0) return known;
+		const created = sourcesOf(versions);
+		byCache.set(versions, created);
+		return created;
+	};
+	const resolve = async (source, query, runtimeVersions) => {
+		const result = isResult(source) ? source : void 0;
+		const signedOut = result?.sessionActive === false;
+		const user = subjectOf(source, result, signedOut, options.subject);
+		const tenant = query.tenant ?? result?.tenant ?? void 0;
+		const known = signedOut ? void 0 : knownVersion(result?.authzVersion);
+		const sources = sourcesFor(runtimeVersions ?? options.versions);
+		const { permdock } = await buildInstance({
+			policy: options.policy,
+			user,
+			sources,
+			scope: {
+				...options.options,
+				memberships: sources.memberships,
+				intent: query.intent ?? "read",
+				tenant: tenant ?? void 0,
+				version: known === void 0 ? void 0 : { known }
+			}
+		});
+		return permdock;
+	};
+	const sources = (versions) => sourcesFor(versions ?? options.versions);
+	return Object.freeze(Object.assign(resolve, { sources }));
+}
+/**
+* The resolver an adapter builds instances with: the app's `permdockFor`, or
+* one built from the adapter's own options. `permdockFor` with any option it
+* already holds throws a `TypeError`, since two sources of the same option
+* would disagree.
+*/
+function resolverOf(options, adapter) {
+	const shared = options.permdockFor;
+	if (shared === void 0) return permdockResolver(options);
+	const clash = RESOLVER_OWNS.find((key) => options[key] !== void 0);
+	if (clash !== void 0) throw new TypeError(`PermDock: ${adapter} takes ${clash} from permdockFor; pass it to permdockFor instead`);
+	const resolve = (source, query, versions) => shared(source, query, versions);
+	return Object.freeze(Object.assign(resolve, { sources: shared.sources }));
+}
+/**
+* One resolver for every instance of the app: `permdockFor(await
+* bsb.claims())`, `permdockFor(await bsb.bootstrap(...))` or `permdockFor(await
+* bsb.getAccess(...))`. A bootstrap or access result passes its `authzVersion`
+* as `version.known`, so the instance reads no version, and a `sessionActive:
+* false` bootstrap is anonymous. With `instances`, a subject at an unchanged
+* version reuses its instance across requests. Pass the same resolver to
+* `authorizer({ permdockFor })`, `authorizationHooks({ permdockFor })` and,
+* through `permdockFor.sources()`, to every other adapter's options, so they
+* share one instance per subject and version.
+*/
+function permdockFor(options) {
+	const resolve = permdockResolver(options);
+	const call = (source, query, versions) => resolve(source, typeof query === "string" || query === null ? { tenant: query } : query ?? {}, versions);
+	return Object.freeze(Object.assign(call, { sources: resolve.sources }));
+}
+/**
+* One `{ allowed, outcome, reason? }` per named check for `input`, from one
+* `permdockFor` instance: frozen plain JSON an island returns from `'use cache:
+* private'`. A check that throws denies its entry; an instance that cannot be
+* built denies them all.
+*/
+async function getPermissions(resolve, input, checks, query) {
+	let permdock;
+	try {
+		permdock = await resolve(input, query);
+	} catch {
+		permdock = void 0;
+	}
+	if (permdock === void 0) return permissionStates(() => NO_GRANT, checks);
+	const decide = permdock.decide;
+	return permissionStates(decide, checks);
+}
+//#endregion
 //#region src/better-supabase/subscribers.ts
 function permissionFor(events, type) {
 	if (Object.hasOwn(events, type)) return events[type];
@@ -356,6 +921,14 @@ function permissionFor(events, type) {
 * tenant and a throw reach no one.
 */
 function subscriberPolicy(options) {
+	const resolve = permdockFor({
+		policy: options.policy,
+		options: {
+			...options.options,
+			principals: options.principals
+		},
+		...options.instances === void 0 ? {} : { instances: options.instances }
+	});
 	return async (event, subscribers) => {
 		try {
 			const permission = permissionFor(options.events, event.type);
@@ -364,14 +937,10 @@ function subscriberPolicy(options) {
 			if (permission === void 0 || tenant === null || senderId === null || senderId === void 0) return [];
 			const sender = await loadPrincipal(options.principals, senderId, tenant);
 			if (sender === null) return [];
-			const permdock = await getPermDock(options.policy, {
+			const permdock = await resolve({
 				principal: sender,
 				context: {}
-			}, {
-				...options.options,
-				principals: options.principals,
-				tenant
-			});
+			}, tenant);
 			if (permdock.subject.principal?.tenant !== tenant) return [];
 			return await subscribersFor(permdock, {
 				permission,
@@ -407,12 +976,13 @@ function requestId(input) {
 * is `false`.
 */
 function supportPolicy(options) {
+	const resolve = permdockFor(options);
 	return async (input) => {
 		try {
-			const base = await getPermDock(options.policy, subjectFromBetterSupabase({
+			const base = await resolve({
 				kind: "user",
 				claims: input.admin.claims
-			}, options.subject), options.options);
+			});
 			if (base.subject.principal?.id !== input.admin.user.id) return false;
 			if (!input.readOnly && options.writable === void 0) return false;
 			const permdock = input.tenant === void 0 ? base : base.tenant(input.tenant);
@@ -468,16 +1038,17 @@ function grants$1(permdock, key) {
 	return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
 }
 /**
-* A list matches when every entry does, `anyOf` when one does; other leaves
-* match nobody, as in SQL.
+* A list matches when every entry does, `anyOf` when one does; `manager` when
+* its key is in `managed`; other leaves match nobody, as in SQL.
 */
-function matches(approvers, userId, permdock) {
+function matches(approvers, userId, permdock, managed) {
 	const items = flattenApprovers(approvers);
 	return items.length > 0 && items.every((item) => {
 		switch (item.kind) {
 			case "user": return item.id === userId;
 			case "permission": return grants$1(permdock, item.permission);
-			case "any-of": return item.of.some((entry) => matches(entry, userId, permdock));
+			case "any-of": return item.of.some((entry) => matches(entry, userId, permdock, managed));
+			case "manager": return managed.has(approverManagerKey(item));
 			case "actor":
 			case "anyone":
 			case "assurance":
@@ -495,25 +1066,23 @@ function matches(approvers, userId, permdock) {
 * authorization })`), decided by `policy`. Every hook builds the principal's
 * instance from the claims `claims` loads now, never from the request, and
 * fails closed: a throw, an unknown key and `approval-required` refuse.
-* `automation` and `delegation` are always set; `identities`, `delivery`,
-* `approverOf`, `support` and `tickets` only with the options they read.
-* `delegation.permissions` maps each scope to the keys whose `.scope` it is,
-* was renamed from, or that a policy `oauthScopes` entry covers, and reads no
-* `authorization_details`.
+* `automation`, `delegation` and `sessionTags` (`snapshotTag(userId)`, so
+* `evictSession` and sign-out clear PermDock snapshots) are always set;
+* `identities`, `delivery`, `approverOf`, `support` and `tickets` only with the
+* options they read. `delegation.permissions` maps each scope to the keys whose
+* `.scope` it is, was renamed from, or that a policy `oauthScopes` entry
+* covers, and reads no `authorization_details`.
 */
 function authorizationHooks(options) {
 	const { policy } = options;
+	const resolve = resolverOf(options, "authorizationHooks");
 	const instance = async (claims, tenant) => {
-		const subject = subjectFromBetterSupabase({
+		const permdock = await resolve({
 			kind: "user",
 			claims
-		}, options.subject);
-		if (subject.principal === null) return null;
-		const permdock = await getPermDock(policy, subject, {
-			...options.options,
-			...tenant === null || tenant === void 0 ? {} : { tenant }
-		});
-		return tenant === null || tenant === void 0 || permdock.subject.principal?.tenant === tenant ? permdock : null;
+		}, { tenant: tenant ?? null });
+		if (permdock.subject.principal === null) return null;
+		return tenant === null || tenant === void 0 || permdock.subject.principal.tenant === tenant ? permdock : null;
 	};
 	const holdsAll = async (claims, automation) => {
 		const permdock = await instance(claims, automation.tenant);
@@ -559,7 +1128,10 @@ function authorizationHooks(options) {
 			const given = approvers[request.kind];
 			if (given === void 0 || approver.claims["sub"] !== approver.userId) return false;
 			const permdock = await instance(approver.claims, request.tenant);
-			return permdock !== null && matches(asApprover(given), approver.userId, permdock);
+			if (permdock === null) return false;
+			const wanted = asApprover(given);
+			const managed = request.requester === void 0 ? [] : await managerKeys(approverLeaves(wanted), request.requester, approver.userId, compact({ relations: resolve.sources().relations }));
+			return matches(wanted, approver.userId, permdock, new Set(managed));
 		} catch {
 			return false;
 		}
@@ -589,6 +1161,7 @@ function authorizationHooks(options) {
 	return Object.freeze({
 		apiVersion: 1,
 		name: "PermDock",
+		sessionTags: (userId) => [snapshotTag(userId)],
 		automation: Object.freeze(automation),
 		delegation: Object.freeze(delegation),
 		...approverOf === void 0 ? {} : { approverOf },
@@ -620,6 +1193,8 @@ function authorizationHooks(options) {
 //#region src/better-supabase/approvers.ts
 /** `rls.approvals`' approver check, executable by `authenticated`. */
 const IS_APPROVER = "permdock_is_approver";
+/** The manager walk `rls.approvals.managers` writes. */
+const MANAGES = "permdock_manages";
 /**
 * The resource a cover's `resources` names for a request kind: `job` for
 * `job.update`, else the kind.
@@ -631,14 +1206,20 @@ function resourceOf(kind) {
 /**
 * better-supabase's `isApprover` template: one `case` over `{kind}` whose
 * branches call `permdock_is_approver` with the kind's approvers as JSON. A
-* kind with no branch is `false`. Only `user`, `holder` and `anyOf` approvers
-* match in SQL; other leaves are reported and match nobody.
+* kind with no branch is `false`. With `requestApprovers`, every call is the
+* five-argument form, which also gets better-supabase's `{approvers}`, the
+* request's current approvers. Only `user`, `holder` and `anyOf` approvers, and
+* `manager` with `rls.approvals.managers`, match in SQL; other leaves are
+* reported and match nobody.
 */
 function isApproverTemplate(input) {
 	const problems = [];
 	if (!input.listed) return { problems: [`approvers needs ${input.schema}.${IS_APPROVER}, which \`permdock rls generate\` writes with rls.approvals. Run it, then \`permdock supabase inspect --out\`.`] };
 	const fn = `${sqlIdent(input.schema)}.${sqlIdent(IS_APPROVER)}`;
 	const keys = input.catalog === void 0 ? void 0 : new Set(input.catalog.permissions.map((permission) => permission.key));
+	const current = input.requestApprovers === true;
+	if (current && input.covers !== true) return { problems: [`requestApprovers needs the five-argument ${IS_APPROVER}, which \`permdock rls generate\` writes with rls.approvals.delegations or rls.approvals.managers. Set one, run it, then \`permdock supabase inspect --out\`.`] };
+	const passed = current ? ", ({approvers})::jsonb" : "";
 	const branches = [];
 	for (const [kind, given] of Object.entries(input.approvers)) {
 		if (kind === "") {
@@ -646,24 +1227,28 @@ function isApproverTemplate(input) {
 			continue;
 		}
 		const approvers = asApprover(given);
+		const managers = input.managers === true && input.covers === true;
 		for (const leaf of approverLeaves(approvers)) {
 			if (leaf.kind === "user") continue;
-			if (leaf.kind !== "permission") problems.push(`The ${kind} approvers name a ${leaf.kind} approver, which ${IS_APPROVER} cannot check in SQL, so it matches nobody. Use user(), holder() or anyOf().`);
+			if (leaf.kind === "manager") {
+				if (!managers) problems.push(`The ${kind} approvers name a manager approver, which ${IS_APPROVER} checks only with rls.approvals.managers, so it matches nobody. Set rls.approvals.managers, run \`permdock rls generate\`, then \`permdock supabase inspect --out\`.`);
+			} else if (leaf.kind !== "permission") problems.push(`The ${kind} approvers name a ${leaf.kind} approver, which ${IS_APPROVER} cannot check in SQL, so it matches nobody. Use user(), holder(), manager() or anyOf().`);
 			else if (keys !== void 0 && !keys.has(leaf.permission)) problems.push(`The ${kind} approver permission ${leaf.permission} is not in the catalog. Run \`permdock catalog\` after adding it to the policy.`);
 		}
 		const json = `${quoteSqlLiteral(JSON.stringify(approvers))}::jsonb`;
-		branches.push(input.covers === true ? `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text, ({requester})::text, ${quoteSqlLiteral(resourceOf(kind))})` : `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text)`);
+		branches.push(input.covers === true ? `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text, ({requester})::text, ${quoteSqlLiteral(resourceOf(kind))}${passed})` : `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text)`);
 	}
-	if (branches.length === 0) {
+	if (branches.length === 0 && !current) {
 		problems.push("approvers names no kind, so isApprover is not set.");
 		return { problems };
 	}
 	if (!input.rootTenant) problems.push(`The tenant scope "${input.tenantScope}" is not a root scope, and ${IS_APPROVER} checks holder() approvers at the root scope, so they match nobody.`);
+	const otherwise = current ? `${fn}(null::jsonb, ({tenant})::text, ({requester})::text, split_part({kind}, '.', 1)${passed})` : "false";
 	return {
-		template: `case {kind} ${branches.join(" ")} else false end`,
+		template: branches.length === 0 ? otherwise : `case {kind} ${branches.join(" ")} else ${otherwise} end`,
 		requires: {
 			function: fn,
-			args: input.covers === true ? "jsonb, text, text, text" : "jsonb, text",
+			args: current ? "jsonb, text, text, text, jsonb" : input.covers === true ? "jsonb, text, text, text" : "jsonb, text",
 			role: "postgres"
 		},
 		problems
@@ -879,12 +1464,14 @@ function tokenHookOf(manifest, activeTenant) {
 	const owned = manifest.claims.filter((claim) => claim.source === "permdock");
 	const registered = manifest.claims.filter((claim) => claim.source !== "permdock");
 	const budgeted = manifest.claims.filter((claim) => claim.budget);
+	const truncated = owned.some((claim) => claim.name === "memberships_truncated") ? "memberships_truncated" : void 0;
 	const activeFrom = activeTenant === "resolver" || manifest.hook.activeFrom === void 0 ? void 0 : activeOrganizationFrom(manifest.hook.activeFrom, manifest.tenantClaim);
 	return {
 		function: `${manifest.hook.schema}.${manifest.hook.function}`,
 		tenantClaim: manifest.tenantClaim,
 		...activeFrom === void 0 ? {} : { activeOrganizationFrom: activeFrom },
 		ownedClaims: owned.map((claim) => claim.name),
+		...truncated === void 0 ? {} : { truncatedClaim: truncated },
 		...registered.length > 0 ? { registeredClaims: registered.map((claim) => ({
 			name: claim.name,
 			function: claim.source
@@ -892,7 +1479,7 @@ function tokenHookOf(manifest, activeTenant) {
 		budget: {
 			claims: budgeted.map((claim) => claim.name),
 			bytes: manifest.budget.bytes,
-			...owned.some((claim) => claim.name === "memberships_truncated") ? { truncatedClaim: "memberships_truncated" } : {}
+			...truncated === void 0 ? {} : { truncatedClaim: truncated }
 		},
 		markers: {
 			hook: `-- permdock:hook ${manifest.markers.hook}`,
@@ -1073,12 +1660,14 @@ function authorizationProvider(options) {
 		...options.approvers
 	};
 	let isApprover;
-	if (approvers !== void 0) {
+	if (approvers !== void 0 || options.requestApprovers === true) {
 		const built = isApproverTemplate({
-			approvers,
+			approvers: approvers ?? {},
+			requestApprovers: options.requestApprovers === true,
 			schema: rls.schema,
 			listed: helpers.has(IS_APPROVER),
 			covers: /\bp_requester\b/u.test(helpers.get("permdock_is_approver")?.args ?? ""),
+			managers: helpers.has(MANAGES),
 			tenantScope,
 			rootTenant,
 			catalog
@@ -1197,9 +1786,6 @@ const denied = (reason) => ({
 	outcome: "denied",
 	reason
 });
-function isVersionCache(value) {
-	return isRecord(value) && typeof value["maxStaleMs"] === "number" && typeof value["current"] === "function" && typeof value["evict"] === "function";
-}
 function outcomeOf(decision, key) {
 	switch (decision.outcome) {
 		case "granted": return { outcome: "granted" };
@@ -1211,10 +1797,31 @@ function outcomeOf(decision, key) {
 		default: return decision;
 	}
 }
-function decideWith(permdock, request) {
-	const { action } = request;
-	if (!isPermission(action)) return denied("Unknown permission.");
-	return outcomeOf(permdock.decide(action, request.resource.properties), action.key);
+/**
+* The row a check decides on. A write is `change`: a create checks the new
+* values, an update the stored row against the stored row with the new values
+* over it. Only a row better-supabase loaded itself, with no change, skips
+* schema validation.
+*/
+function dataOf(resource) {
+	const { change } = resource;
+	if (change !== void 0) return change.current === void 0 ? {
+		data: change.next,
+		trusted: false
+	} : {
+		data: {
+			current: change.current,
+			next: {
+				...change.current,
+				...change.next
+			}
+		},
+		trusted: false
+	};
+	return {
+		data: resource.properties,
+		trusted: resource.source === "loaded"
+	};
 }
 /**
 * The verified claims better-supabase passes in `subject.properties.claims`,
@@ -1227,7 +1834,7 @@ function claimsOf(request) {
 	return isRecord(claims) ? claims : void 0;
 }
 const tenantOf = (request) => {
-	const tenant = request.context["tenant"];
+	const { tenant } = request.context;
 	return typeof tenant === "string" ? tenant : null;
 };
 const keyOf = (request) => isPermission(request.action) ? request.action.key : null;
@@ -1241,38 +1848,61 @@ const keyOf = (request) => isPermission(request.action) ? request.action.key : n
 * request scope share an instance per claims, tenant and intent.
 */
 function authorizer(options) {
-	const { operations } = options;
+	const { operations, store } = options;
 	const intentOf = (request, batch) => {
 		if (options.intent !== void 0) return options.intent(request);
+		const { intent } = request.context;
+		if (intent === "read" || intent === "write") return intent;
 		if (batch) return "read";
 		return isPermission(request.action) && READ_ACTIONS.has(request.action.action) ? "read" : "write";
 	};
-	const membershipsFor = (runtime) => {
-		if (options.memberships === void 0) return {};
-		const versions = isVersionCache(runtime?.versions) ? runtime.versions : options.versions;
-		return { memberships: claimsFirst(options.memberships, {
-			onStale: "reread",
-			...options.version === void 0 ? {} : { version: options.version },
-			...versions === void 0 ? {} : { versions }
-		}) };
-	};
-	const instanceFor = async (claims, tenant, intent, runtime) => {
-		const session = claims === void 0 ? null : {
-			kind: "user",
-			claims
-		};
-		const base = await getPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), {
-			...options.options,
-			...membershipsFor(runtime),
+	const resolve = resolverOf(options, "authorizer");
+	const instanceFor = (claims, tenant, intent, runtime) => resolve(claims === void 0 ? null : {
+		kind: "user",
+		claims
+	}, {
+		tenant,
+		intent
+	}, runtime?.versions);
+	const scoped = (claims, tenant, intent, runtime, batch) => {
+		const key = `permdock:authorizer:${canonicalJson([
+			claims ?? null,
+			tenant,
 			intent
+		])}`;
+		const build = () => instanceFor(claims, tenant, intent, runtime);
+		if (runtime?.memo !== void 0) return runtime.memo.once(key, build);
+		if (batch === void 0) return build();
+		const known = batch.get(key);
+		if (known !== void 0) return known;
+		const created = build();
+		batch.set(key, created);
+		return created;
+	};
+	const decideWith = async (permdock, request, consume) => {
+		const { action } = request;
+		if (!isPermission(action)) return denied("Unknown permission.");
+		const { data, trusted } = dataOf(request.resource);
+		const decision = permdock.decide(action, data, {
+			trusted,
+			adapter: "better-supabase"
 		});
-		return tenant === null ? base : base.tenant(tenant);
+		if (store === void 0 || decision.outcome !== "approval-required") return outcomeOf(decision, action.key);
+		const { id } = request.resource;
+		return outcomeOf(await resumeDecision({
+			decision,
+			permission: action,
+			subject: permdock.subject,
+			store,
+			resource: id === void 0 ? { type: action.resource } : {
+				type: action.resource,
+				id
+			},
+			adapter: "better-supabase",
+			token: parseApprovalHeader(request.context.approval ?? null),
+			consume
+		}), action.key);
 	};
-	const scoped = (claims, tenant, intent, runtime) => runtime?.memo === void 0 ? instanceFor(claims, tenant, intent, runtime) : runtime.memo.once(`permdock:authorizer:${JSON.stringify([
-		claims ?? null,
-		tenant,
-		intent
-	])}`, () => instanceFor(claims, tenant, intent, runtime));
 	const failed = (error, request) => {
 		report(options.onError, error, {
 			permission: keyOf(request),
@@ -1293,33 +1923,17 @@ function authorizer(options) {
 		} },
 		async evaluate(request, runtime) {
 			try {
-				return decideWith(await scoped(claimsOf(request), tenantOf(request), intentOf(request, false), runtime), request);
+				return await decideWith(await scoped(claimsOf(request), tenantOf(request), intentOf(request, false), runtime), request, true);
 			} catch (error) {
 				return failed(error, request);
 			}
 		},
 		evaluations(requests, runtime) {
-			const cache = /* @__PURE__ */ new Map();
-			const shared = (request) => {
-				const claims = claimsOf(request);
-				const tenant = tenantOf(request);
-				const intent = intentOf(request, true);
-				let byKey = cache.get(claims);
-				if (byKey === void 0) {
-					byKey = /* @__PURE__ */ new Map();
-					cache.set(claims, byKey);
-				}
-				const key = JSON.stringify([tenant, intent]);
-				let instance = byKey.get(key);
-				if (instance === void 0) {
-					instance = scoped(claims, tenant, intent, runtime);
-					byKey.set(key, instance);
-				}
-				return instance;
-			};
+			const batch = /* @__PURE__ */ new Map();
+			const shared = (request) => scoped(claimsOf(request), tenantOf(request), intentOf(request, true), runtime, batch);
 			return Promise.all(requests.map(async (request) => {
 				try {
-					return decideWith(await shared(request), request);
+					return await decideWith(await shared(request), request, false);
 				} catch (error) {
 					return failed(error, request);
 				}
@@ -1332,14 +1946,17 @@ function authorizer(options) {
 function roleOf(options, columns) {
 	const column = columns.role;
 	if (options.roles !== void 0 && options.roleThrough !== void 0) throw new TypeError("PermDock: blockMembershipSource takes roles or roleThrough, not both; a junction holds role keys");
-	if (options.roles === "many") return {
-		through: `${qualifySqlTable(columns.table).split(".")[0] ?? "better_supabase"}.membership_roles`,
-		on: {
-			[columns.tenant]: columns.tenant,
-			[columns.user]: columns.user
-		},
-		column: "role"
-	};
+	if (options.roles === "many") {
+		const junction = options.tables?.membershipRoles;
+		return {
+			through: junction?.table ?? `${qualifySqlTable(columns.table).split(".")[0] ?? "better_supabase"}.membership_roles`,
+			on: {
+				[columns.tenant]: junction?.columns.tenant ?? columns.tenant,
+				[columns.user]: junction?.columns.user ?? columns.user
+			},
+			column: junction?.columns.role ?? "role"
+		};
+	}
 	if (options.roles !== void 0) return {
 		through: options.roles.table,
 		on: { [options.roles.id ?? "id"]: options.roles.membership },
@@ -1361,11 +1978,14 @@ function roleOf(options, columns) {
 */
 function blockMembershipSource(options = {}) {
 	const c = options.columns ?? {};
+	const block = options.tables?.memberships;
 	const scope = options.scope ?? "organization";
-	const disabledAt = c.disabledAt === null ? void 0 : c.disabledAt ?? "disabled_at";
-	const table = options.table ?? "better_supabase.memberships";
-	const tenant = c.tenant ?? "organization_id";
-	const user = c.user ?? "user_id";
+	const disabled = c.disabledAt === void 0 ? block?.columns.disabledAt : c.disabledAt;
+	const disabledAt = disabled === null ? void 0 : disabled ?? "disabled_at";
+	const table = options.table ?? block?.table ?? "better_supabase.memberships";
+	const tenant = c.tenant ?? block?.columns.tenant ?? "organization_id";
+	const user = c.user ?? block?.columns.user ?? "user_id";
+	const role = c.role ?? block?.columns.role ?? "role";
 	return junctionMembershipSource({
 		table,
 		scope,
@@ -1373,7 +1993,7 @@ function blockMembershipSource(options = {}) {
 		user,
 		roles: roleOf(options, {
 			table,
-			role: c.role ?? "role",
+			role,
 			tenant,
 			user
 		}),
@@ -1515,9 +2135,10 @@ const refused = (reason) => ({
 * The `authorize` and `visible` hooks of better-supabase's `createMcp`, for
 * tools whose `meta` is a PermDock permission. A tool without a permission is
 * hidden and refused. `authorize` grants only a `granted` decision: an
-* approval-required call is refused, because `createMcp` has no approval flow.
-* A denial's text names the first denial reason. A throw anywhere refuses and
-* reaches `onError`.
+* approval-required call is refused, because `authorize` has no approval
+* outcome. A tool whose `permission` goes through `authorizer` with a `store`
+* returns the approval id and resumes it instead. A denial's text names the
+* first denial reason. A throw anywhere refuses and reaches `onError`.
 */
 function toolPolicy(options) {
 	return Object.freeze({
@@ -1828,4 +2449,44 @@ function handlerCan(source, options = {}) {
 	};
 }
 //#endregion
-export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, blockMembershipSource, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };
+//#region src/better-supabase/workflow-resource.ts
+const MAX_ID_LENGTH = 256;
+function invalid(detail) {
+	return freezeDeep({
+		ok: false,
+		cause: "validation",
+		decision: {
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "validation",
+				detail
+			}],
+			alternatives: []
+		}
+	});
+}
+/**
+* The resource a `workflow.start` check decides on for a run started on
+* `subject`: `{ type, id }`, with the type `types` maps the subject type to. A
+* subject type `types` does not name, a missing or empty id, or an id over 256
+* characters is `{ ok: false, cause: 'validation' }` with the denial to
+* return.
+*/
+function workflowResource(subject, types) {
+	if (!isRecord(subject)) return invalid("subject is not a { type, id } record");
+	const { type, id } = subject;
+	if (typeof type !== "string" || !Object.hasOwn(types, type)) return invalid(`unknown subject type ${JSON.stringify(type) ?? "undefined"}`);
+	if (typeof id !== "string" || id === "" || id.length > MAX_ID_LENGTH) return invalid("subject id is not a non-empty string of at most 256 characters");
+	const resource = types[type];
+	if (typeof resource !== "string" || resource === "") return invalid(`subject type ${type} maps to no resource`);
+	return freezeDeep({
+		ok: true,
+		resource: {
+			type: resource,
+			id
+		}
+	});
+}
+//#endregion
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, blockApprovalPolicySource, blockApprovalStore, blockMembershipSource, bucketPolicy, credentialGuard, getPermissions, handlerCan, hookCan, permdockFor, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy, workflowResource };