permdock 0.17.0 → 0.18.0

package/dist/{supabase-hook-Cj85nccs.js → supabase-hook-DX38Hj8h.js}

@@ -2,6 +2,7 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMP8Cmxd.js";
+import { t as AUTHZ_EVENT } from "./authz-topic-Dbc-HDOS.js";
 import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
@@ -9,8 +10,7 @@ import { c as requirePolicy } from "./load-BaEamml-.js";
 import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-B_oJqmIg.js";
-import { t as AUTHZ_EVENT } from "./authz-topic-Dbc-HDOS.js";
-import { t as authorizeSql } from "./supabase-C8cNzp4i.js";
+import { t as authorizeSql } from "./supabase-BiViJpQ4.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-BrjrckDG.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
@@ -19,13 +19,13 @@ import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAG
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
 import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DyYVEjKC.js";
-import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BsGE6HBR.js";
-import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BfOk0ymL.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
 import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
 import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-CrjL6A49.js";
-import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-1nCei24V.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-CBl4r4_r.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
@@ -1886,6 +1886,158 @@ function customRolesOfSql(parts) {
       );`;
 }
 //#endregion
+//#region src/cli/rls/approval-managers.ts
+/** Whether the signed-in user manages a requester; better-supabase reads it. */
+const MANAGES = "permdock_manages";
+/**
+* The approver check with `manager` leaves; only `permdock_is_approver` calls
+* it.
+*/
+const APPROVES = "permdock_approves";
+const MANAGES_FOR = "permdock_manages_for";
+function named(value) {
+	return typeof value === "string" && value !== "";
+}
+function checked(managers) {
+	if (typeof managers !== "object" || managers === null || !("table" in managers && named(managers.table)) || !("user" in managers && named(managers.user)) || !("manager" in managers && named(managers.manager))) throw configError("PermDock CLI: rls.approvals.managers needs { table, user, manager }: the table that names each user's manager, its user column and its manager column");
+	return {
+		table: managers.table,
+		user: managers.user,
+		manager: managers.manager
+	};
+}
+/**
+* `rls.approvals.managers`: `permdock_manages(p_requester, p_levels)` walks the
+* app's manager table up to `levels` steps (at most `MAX_MANAGER_LEVELS`) with
+* a cycle guard, and `permdock_approves` decides `manager` leaves with it and
+* every other leaf through the two-argument `permdock_is_approver`. The
+* requester never manages themselves into an approval. Without `delegations`,
+* the four-argument `permdock_is_approver` is written here; with them,
+* `approvalDelegationsSql` writes it and calls `permdock_approves` first.
+*/
+function approvalManagersSql(ctx, given, isApprover, delegations) {
+	const managers = checked(given);
+	const table = quoteQualified(managers.table);
+	const user = quoteIdent(managers.user);
+	const boss = quoteIdent(managers.manager);
+	const manages = qualified(ctx, MANAGES);
+	const managesFor = qualified(ctx, MANAGES_FOR);
+	const approves = qualified(ctx, APPROVES);
+	const me = `${subjectIdSql(ctx)}::text`;
+	const entry = delegations ? "" : `
+-- approvers with managers: permdock_approves for the signed-in user
+create or replace function ${isApprover}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${approves}(p_approvers, p_tenant, p_requester)
+$$;
+revoke execute on function ${isApprover}(jsonb, text, text, text) from public, anon;
+grant execute on function ${isApprover}(jsonb, text, text, text) to authenticated;
+`;
+	return `
+-- approval managers: whether p_user manages p_requester within p_levels steps of ${managers.table}
+create or replace function ${managesFor}(p_user text, p_requester text, p_levels integer)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  with recursive chain (id, depth, path) as (
+    select m.${boss}::text, 1, array[p_requester, m.${boss}::text]
+    from ${table} m
+    where m.${user}::text = p_requester
+      and m.${boss} is not null
+    union all
+    select m.${boss}::text, c.depth + 1, c.path || m.${boss}::text
+    from chain c
+    join ${table} m on m.${user}::text = c.id
+    where c.depth < least(p_levels, ${String(8)})
+      and m.${boss} is not null
+      and not (m.${boss}::text = any (c.path))
+  )
+  select coalesce(
+    p_requester <> ''
+      and p_user <> ''
+      and p_levels between 1 and ${String(8)}
+      and p_user <> p_requester
+      and exists (select 1 from chain c where c.id = p_user),
+    false
+  )
+$$;
+revoke execute on function ${managesFor}(text, text, integer) from public, anon, authenticated;
+
+-- approval managers: whether the signed-in user manages p_requester within p_levels steps of ${managers.table}
+create or replace function ${manages}(p_requester text, p_levels integer)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${managesFor}(${me}, p_requester, p_levels)
+$$;
+revoke execute on function ${manages}(text, integer) from public, anon, authenticated;
+
+-- approval managers: approvers.by with manager leaves; only permdock_is_approver calls it
+create or replace function ${approves}(p_approvers jsonb, p_tenant text, p_requester text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_item jsonb;
+  v_levels jsonb;
+begin
+  if p_approvers is null then
+    return false;
+  end if;
+  if jsonb_typeof(p_approvers) = 'array' then
+    if jsonb_array_length(p_approvers) = 0 then
+      return false;
+    end if;
+    for v_item in select value from jsonb_array_elements(p_approvers) loop
+      if not ${approves}(v_item, p_tenant, p_requester) then
+        return false;
+      end if;
+    end loop;
+    return true;
+  end if;
+  if jsonb_typeof(p_approvers) <> 'object' then
+    return false;
+  end if;
+  case p_approvers ->> 'kind'
+    when 'manager' then
+      v_levels := coalesce(p_approvers -> 'levels', '1'::jsonb);
+      if jsonb_typeof(v_levels) <> 'number' or v_levels::text !~ '^[0-9]{1,2}$' then
+        return false;
+      end if;
+      return coalesce(${manages}(p_requester, v_levels::text::integer), false);
+    when 'any-of' then
+      if jsonb_typeof(p_approvers -> 'of') <> 'array' then
+        return false;
+      end if;
+      for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
+        if ${approves}(v_item, p_tenant, p_requester) then
+          return true;
+        end if;
+      end loop;
+      return false;
+    else
+      return ${isApprover}(p_approvers, p_tenant);
+  end case;
+end;
+$$;
+revoke execute on function ${approves}(jsonb, text, text) from public, anon, authenticated;
+${entry}`;
+}
+//#endregion
 //#region src/cli/rls/approval-policies.ts
 /**
 * The objects `rls.approvals.tenantPolicies` adds; `tableApprovalPolicySource`
@@ -2277,17 +2429,30 @@ grant execute on function ${fn}(jsonb, text) to authenticated;
 }
 /**
 * Everything `rls.approvals` writes: the generated or adopted store, the
-* approver check, with `delegations: true` the covers, and with
-* `tenantPolicies` the tenant approval policies. With `actorMayWrite`, the
-* covers' write policies call `permdock_actor_may_write()`.
+* approver check, with `managers` the manager walk, with `delegations: true`
+* the covers, and with `tenantPolicies` the tenant approval policies. With
+* `actorMayWrite`, the covers' write policies call
+* `permdock_actor_may_write()`.
 */
 function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 	if (approvals === void 0 || approvals === false) return;
 	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
-	const { table, delegations, tenantPolicies } = approvals;
+	const { table, delegations, tenantPolicies, managers } = approvals;
 	if (delegations !== void 0 && typeof delegations !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.delegations must be a boolean");
+	if (approvals.store !== void 0 && typeof approvals.store !== "boolean") throw new TypeError("PermDock CLI: rls.approvals.store must be a boolean");
 	let store;
-	if (table === void 0) {
+	if (approvals.store === false) {
+		const adopted = [
+			"table",
+			"token",
+			"body",
+			"open",
+			"schema",
+			"mirror"
+		].find((key) => approvals[key] !== void 0);
+		if (adopted !== void 0) throw configError(`PermDock CLI: rls.approvals.${adopted} configures the approval store, which rls.approvals.store: false leaves out`);
+		store = "";
+	} else if (table === void 0) {
 		const adoptOnly = [
 			"token",
 			"body",
@@ -2301,7 +2466,7 @@ function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 		...approvals,
 		table
 	}, jsonSchema);
-	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite) : "") + (tenantPolicies === void 0 ? "" : approvalPoliciesSql(ctx, tenantPolicies, actorMayWrite));
+	return store + isApproverSql(ctx) + (managers === void 0 ? "" : approvalManagersSql(ctx, managers, qualified(ctx, APPROVAL_STORE.isApprover), delegations === true)) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite, managers !== void 0) : "") + (delegations === true || managers !== void 0 ? requestApproversSql(ctx) : "") + (tenantPolicies === void 0 ? "" : approvalPoliciesSql(ctx, tenantPolicies, actorMayWrite));
 }
 /**
 * The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
@@ -2314,13 +2479,15 @@ const DELEGATIONS = {
 /**
 * `rls.approvals.delegations`: one table of out-of-office covers that a user
 * writes for themselves, and a four-argument `permdock_is_approver` that also
-* answers for a delegate inside an active cover. One hop: a cover is checked
+* answers for a delegate inside an active cover. With `managers`, the signed-in
+* user's own check is `permdock_approves`, and a cover passes on a `manager`
+* leaf when the delegator manages the requester. One hop: a cover is checked
 * against the delegator's own approver rights, never the delegator's covers. A
 * delegator who is the requester never counts. A `holder()` approver through a
 * cover needs `rls.mode: "database"`, where the `_for` helpers exist; in `jwt`
 * mode only `user()` approvers pass.
 */
-function approvalDelegationsSql(ctx, actorMayWrite = false) {
+function approvalDelegationsSql(ctx, actorMayWrite = false, managers = false) {
 	const table = qualified(ctx, DELEGATIONS.table);
 	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
 	const covers = qualified(ctx, DELEGATIONS.covers);
@@ -2337,7 +2504,15 @@ function approvalDelegationsSql(ctx, actorMayWrite = false) {
           where i.id::text = p_tenant
         )` : "false";
 	const policy = (name) => quoteIdent(`${DELEGATIONS.table}_${name}`);
-	const mine = `delegator::text = ${me}${actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : ""}`;
+	const writable = actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : "";
+	const managerCase = managers ? `
+    when 'manager' then
+      v_levels := coalesce(p_approvers -> 'levels', '1'::jsonb);
+      if jsonb_typeof(v_levels) <> 'number' or v_levels::text !~ '^[0-9]{1,2}$' then
+        return false;
+      end if;
+      return coalesce(${qualified(ctx, MANAGES_FOR)}(p_delegator::text, p_requester, v_levels::text::integer), false);` : "";
+	const mine = `delegator::text = ${me}${writable}`;
 	const own = `${mine} and (tenant is null or ${member("tenant")})`;
 	return `
 -- approval delegations: out-of-office covers a user writes for themselves; tableApprovalDelegationSource and permdock_is_approver read them
@@ -2377,7 +2552,7 @@ create policy ${policy("delete")} on ${table}
   using (${mine});
 
 -- approval delegations: whether a delegator's own rights match approvers.by; only permdock_is_approver calls it
-create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text)
+create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text, p_requester text)
 returns boolean
 language plpgsql
 stable
@@ -2385,7 +2560,7 @@ security definer
 set search_path = ''
 as $$
 declare
-  v_item jsonb;
+  v_item jsonb;${managers ? "\n  v_levels jsonb;" : ""}
 begin
   if p_delegator is null or p_approvers is null then
     return false;
@@ -2395,7 +2570,7 @@ begin
       return false;
     end if;
     for v_item in select value from jsonb_array_elements(p_approvers) loop
-      if not ${covers}(p_delegator, v_item, p_tenant) then
+      if not ${covers}(p_delegator, v_item, p_tenant, p_requester) then
         return false;
       end if;
     end loop;
@@ -2411,13 +2586,13 @@ begin
       if p_tenant is null then
         return ${holderGlobal};
       end if;
-      return ${holderTenant};
+      return ${holderTenant};${managerCase}
     when 'any-of' then
       if jsonb_typeof(p_approvers -> 'of') <> 'array' then
         return false;
       end if;
       for v_item in select value from jsonb_array_elements(p_approvers -> 'of') loop
-        if ${covers}(p_delegator, v_item, p_tenant) then
+        if ${covers}(p_delegator, v_item, p_tenant, p_requester) then
           return true;
         end if;
       end loop;
@@ -2427,7 +2602,7 @@ begin
   end case;
 end;
 $$;
-revoke execute on function ${covers}(${user}, jsonb, text) from public, anon, authenticated;
+revoke execute on function ${covers}(${user}, jsonb, text, text) from public, anon, authenticated;
 
 -- approvers with covers: the signed-in user, or a delegate inside an active cover of a delegator who is not the requester
 create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text)
@@ -2441,7 +2616,7 @@ declare
   v_delegator ${user};
   v_user text := ${me};
 begin
-  if ${fn}(p_approvers, p_tenant) then
+  if ${managers ? `${qualified(ctx, APPROVES)}(p_approvers, p_tenant, p_requester)` : `${fn}(p_approvers, p_tenant)`} then
     return true;
   end if;
   if coalesce(v_user, '') = '' or coalesce(p_requester, '') = '' then
@@ -2462,7 +2637,7 @@ begin
       and d.permissions is null
       and (d.resources is null or p_resource = any (d.resources))
   loop
-    if ${covers}(v_delegator, p_approvers, p_tenant) then
+    if ${covers}(v_delegator, p_approvers, p_tenant, p_requester) then
       return true;
     end if;
   end loop;
@@ -2473,6 +2648,45 @@ revoke execute on function ${fn}(jsonb, text, text, text) from public, anon;
 grant execute on function ${fn}(jsonb, text, text, text) to authenticated;
 `;
 }
+function requestApproversSql(ctx) {
+	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
+	return `
+-- approvers with the current step: the four-argument check over p_approvers and the step's users, manager and permission
+create or replace function ${fn}(p_approvers jsonb, p_tenant text, p_requester text, p_resource text, p_request_approvers jsonb)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${fn}(
+    jsonb_build_object(
+      'kind', 'any-of',
+      'of',
+      case when p_approvers is null then '[]'::jsonb else jsonb_build_array(p_approvers) end
+        || case
+          when jsonb_typeof(p_request_approvers -> 'users') = 'array' then coalesce(
+            (select jsonb_agg(jsonb_build_object('kind', 'user', 'id', u.id)) from jsonb_array_elements_text(p_request_approvers -> 'users') u(id)),
+            '[]'::jsonb
+          )
+          else '[]'::jsonb
+        end
+        || case when p_request_approvers -> 'manager' = 'true'::jsonb then '[{"kind": "manager"}]'::jsonb else '[]'::jsonb end
+        || case
+          when jsonb_typeof(p_request_approvers -> 'permission') = 'string'
+            then jsonb_build_array(jsonb_build_object('kind', 'permission', 'permission', p_request_approvers ->> 'permission'))
+          else '[]'::jsonb
+        end
+    ),
+    p_tenant,
+    p_requester,
+    p_resource
+  )
+$$;
+revoke execute on function ${fn}(jsonb, text, text, text, jsonb) from public, anon;
+grant execute on function ${fn}(jsonb, text, text, text, jsonb) to authenticated;
+`;
+}
 /**
 * The request fields an adopted table may mirror into its own columns, as SQL
 * over a body.
@@ -3386,7 +3600,8 @@ function trustedHelpers(parts, config, types, tenantType, policy) {
 		...config.rls?.apiKeys === void 0 ? [] : [helperEntry(API_KEY_ALLOWS, "p_grant text", "boolean", client)],
 		...config.rls?.tokenScopes === true ? [helperEntry(TOKEN_SCOPE_ALLOWS, "p_grant text", "boolean", client)] : [],
 		...readOnlyActorKinds(config.rls?.readOnlyActors) === void 0 ? [] : [helperEntry(ACTOR_MAY_WRITE, "", "boolean", client)],
-		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && config.rls.approvals.delegations === true ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
+		...config.rls?.approvals === true || typeof config.rls?.approvals === "object" ? [helperEntry(IS_APPROVER, typeof config.rls.approvals === "object" && (config.rls.approvals.delegations === true || config.rls.approvals.managers !== void 0) ? "p_approvers jsonb, p_tenant text, p_requester text, p_resource text" : "p_approvers jsonb, p_tenant text", "boolean", client)] : [],
+		...typeof config.rls?.approvals === "object" && config.rls.approvals.managers !== void 0 ? [helperEntry(MANAGES, "p_requester text, p_levels integer", "boolean", [])] : [],
 		...forUser
 	];
 	if (!(policy !== void 0 && (ownershipRules(policy, parts.scopes)?.assigns.length ?? 0) > 0)) return keyed;

package/dist/{supautils-BP_5WAIc.js → supautils-BGf6zRvM.js}

@@ -1,22 +1,22 @@
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
 import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { l as policyLevels } from "./policy-DxQyHKPB.js";
+import { l as policyLevels } from "./policy-cV_wwPb8.js";
 import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
 import "./budget-BBCPDOGP.js";
 import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-CM0BnH05.js";
-import { x as resolveAuthorize } from "./supabase-hook-Cj85nccs.js";
+import { x as resolveAuthorize } from "./supabase-hook-DX38Hj8h.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
-import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BsGE6HBR.js";
-import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BfOk0ymL.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-CrjL6A49.js";
-import { t as resolveNames } from "./resolve-names-1nCei24V.js";
-import { m as tableFor } from "./verify-C8G8D5mk.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
+import { m as tableFor } from "./verify-Bpj0hauG.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/svelte/index.d.ts

@@ -1,11 +1,11 @@
-import { c as requiredPlans } from "../errors-Dc9FdamT.js";
-import { i as describe } from "../describe-nalX_HHE.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
 import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BtdN3eDO.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-EPul_8MN.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/index.js

@@ -1,12 +1,12 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-CogP1loh.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
-import { u as slotContent } from "../views-TrZYlDnM.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
+import { u as slotContent } from "../views-MWmJ6Y4P.js";
 import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
 import { n as getUi, t as getStore } from "../context-DeammvFl.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CBXkOcg9.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-53_kOwPi.js";
+import { n as viewFor, t as scopedFor } from "../runtime-rf0ZuyF3.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BYFopOm1.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-nalX_HHE.js";
+import { n as DescribeMessages } from "../describe-BKtC_8PG.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { t as ClientStore } from "../store-g5ctUrOI.js";
-import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
+import { t as ClientStore } from "../store-DYeB-_U3.js";
+import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { u as slotContent } from "../views-TrZYlDnM.js";
+import { u as slotContent } from "../views-MWmJ6Y4P.js";
 import { n as getUi, t as getStore } from "../context-DeammvFl.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CBXkOcg9.js";
+import { n as viewFor, t as scopedFor } from "../runtime-rf0ZuyF3.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,11 +1,11 @@
-import { c as requiredPlans } from "../errors-Dc9FdamT.js";
-import { i as describe } from "../describe-nalX_HHE.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
 import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-DVZNTkU0.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BtdN3eDO.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-EPul_8MN.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/source.js

@@ -1,8 +1,8 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-CogP1loh.js";
-import { r as approvalHeaders } from "../protected-action-B6n6w7Rl.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
 import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-53_kOwPi.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BYFopOm1.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/{tables-BsGE6HBR.js → tables-BfOk0ymL.js}

@@ -4,7 +4,7 @@ import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } fr
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
 import { l as partitionsOf, p as scopeField } from "./tenancy-DvOHHk3-.js";
-import { a as delegatedScopeMap } from "./permdock-DdzMv5-F.js";
+import { a as delegatedScopeMap } from "./permdock-D-_WrdKu.js";
 import { i as configError } from "./errors-BhRkoNS7.js";
 import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-B_oJqmIg.js";

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { E as Policy, Kt as Instant, M as PolicyVocabulary, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { E as Policy, Kt as Instant, M as PolicyVocabulary, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { m as ApprovalStore } from "../types-BvBbkAu1.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-Dc9FdamT.js";
-import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -3,11 +3,11 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { h as secondsAt } from "../time-nR1JesoH.js";
 import { r as isSubject } from "../subject-C7RddW0G.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DmqGy63f.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BFMFQdE_.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";

package/dist/testing/core.d.ts

@@ -1,2 +1,2 @@
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-0iYZ5HUx.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-D87h2kpR.js";
 export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-W5f4Rjt0.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-B8sLve3z.js";