permdock 0.17.0 → 0.18.0

package/dist/better-supabase/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
-import { a as flattenApprovers, o as holder, r as approverLeaves } from "../approvers-CNtl4Vc5.js";
+import { a as flattenApprovers, i as approverManagerKey, o as holder, r as approverLeaves } from "../approvers-BaNwKYgd.js";
 import { t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { a as isId, r as idList } from "../expiry-6XByK0dm.js";
 import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-B8tYxPIt.js";
@@ -10,27 +10,30 @@ import { r as sha256Digest } from "../sha256-C-4WXKIu.js";
 import { t as decideSupportSession } from "../support-session-BsmPCbz8.js";
 import { d as scopeList } from "../scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
-import { n as asApprover } from "../approval-normalize-4KxMRdJC.js";
+import { n as asApprover } from "../approval-normalize-CUjgSsOl.js";
+import { n as isOperationEffect } from "../operations-Bm9HFecz.js";
 import { r as isSubject, t as anonymousSubject } from "../subject-C7RddW0G.js";
-import { I as decisionTenant } from "../evaluate-CsjXeLRo.js";
-import { _ as claimsFirst } from "../instance-snapshot-BgOGtyCy.js";
+import { I as decisionTenant } from "../evaluate-Czbj7thS.js";
+import { _ as claimsFirst } from "../instance-snapshot-BWa71my8.js";
 import { a as permissionStates } from "../checks-fyDOhcz0.js";
-import { a as delegatedScopeMap, s as scopesReaching } from "../permdock-DdzMv5-F.js";
+import { a as delegatedScopeMap, s as scopesReaching } from "../permdock-D-_WrdKu.js";
+import { s as ApprovalError } from "../types-CcUXciSj.js";
+import { t as applyApprovalVerdict } from "../store-DmVqy74I.js";
 import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-zN6T9fxe.js";
 import { r as credentialSubject, s as parseCredential } from "../credential-B3Hj4puZ.js";
-import { s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { h as managerKeys, s as resumeDecision } from "../helpers-DmqGy63f.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
 import { t as parseApprovalRequest } from "../parse-request-DOBVaeiQ.js";
 import { n as parseApprovalHeader } from "../approval-header-8QV6MU4H.js";
 import { i as snapshotTag } from "../snapshot-cache-B66h7FBK.js";
-import { t as buildInstance } from "../build-instance-lye7oEqf.js";
+import { t as buildInstance } from "../build-instance-BFMFQdE_.js";
 import { n as NO_GRANT } from "../decision-CaG5_eNJ.js";
 import { t as policyRowConditionKeys } from "../row-conditions-BAGHOmVq.js";
-import { n as subscribersFor } from "../audience-jRO819i3.js";
+import { n as subscribersFor } from "../audience-B4YR9UpV.js";
 import { i as qualifySqlTable, l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
 import { o as junctionMembershipSource } from "../sources-C4vkzZJV.js";
 import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-BrjrckDG.js";
-import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BdzBobNK.js";
 import { t as parseCatalog } from "../parse-UTC-sDrt.js";
 import { n as activeTenantMismatch, t as activeOrganizationFrom } from "../active-tenant-DVee32-T.js";
 import { AsyncResult, dbError } from "better-supabase";
@@ -201,14 +204,15 @@ async function unwrap(result, call) {
 	return awaited.data;
 }
 /** Every block record carrying a PermDock request, newest first, capped. */
-async function scan(approvals, found) {
+async function scan(approvals, found, tenantless) {
 	const out = [];
 	let before;
 	for (let scanned = 0; scanned < MAX_SCANNED; scanned += PAGE) {
 		const page = await unwrap(approvals.list({
 			status: null,
 			pageSize: PAGE,
-			...before === void 0 ? {} : { before }
+			...before === void 0 ? {} : { before },
+			...tenantless ? { tenantless } : {}
 		}), "list");
 		for (const record of page) {
 			const request = requestOf(record);
@@ -240,14 +244,23 @@ function matchesQuery(request, query) {
 * block's own approve and reject flow. `create` files the request on the
 * resource under the permission's action, with the PermDock request in
 * `payload.permdock` and its `fingerprint`. `get`, `getById` and `list` read
-* the block's latest 2,000 requests in the block's tenant. `consume` calls the
-* block's `consume`, which refuses a second use and another fingerprint.
-* `resolve` throws: approvers decide through the block, never through
-* `approvalsHandler`. `expire` answers 0, since the block expires requests
+* the block's latest 2,000 requests in the block's tenant, and with
+* `tenantless` the latest 2,000 without one. `consume` calls the block's
+* `consume`, which refuses a second use and another fingerprint. `resolve`
+* checks the verdict against the PermDock request, then calls the block's
+* `approve` or `reject` with `decidedBy` set to the approver, so a service-role
+* client records the user who decided; without `approve` and `reject` on the
+* client it throws. `expire` answers 0, since the block expires requests
 * itself.
 */
-function blockApprovalStore(approvals) {
-	const byToken = async (token) => (await scan(approvals, ({ request }) => request.token === token)).find(({ request }) => request.token === token);
+function blockApprovalStore(approvals, options = {}) {
+	const tenantless = options.tenantless === true;
+	const scanAll = async (found) => {
+		const inTenant = await scan(approvals, found, false);
+		if (!tenantless || inTenant.some(found)) return inTenant;
+		return [...inTenant, ...await scan(approvals, found, true)];
+	};
+	const byToken = async (token) => (await scanAll(({ request }) => request.token === token)).find(({ request }) => request.token === token);
 	return Object.freeze({
 		name: "better-supabase-approvals",
 		async create(request) {
@@ -258,23 +271,32 @@ function blockApprovalStore(approvals) {
 				action: actionOf(request.permission),
 				reason: request.detail,
 				payload: { permdock: request },
-				fingerprint: request.fingerprint
+				fingerprint: request.fingerprint,
+				tenantless: tenantless && decisionTenant(request.subject, request.membership) === void 0 ? true : void 0
 			})), "request");
 		},
 		async get(token) {
 			return (await byToken(token))?.request ?? null;
 		},
 		async getById(id) {
-			return (await scan(approvals, ({ request }) => request.id === id)).find(({ request }) => request.id === id)?.request ?? null;
+			return (await scanAll(({ request }) => request.id === id)).find(({ request }) => request.id === id)?.request ?? null;
 		},
-		resolve() {
-			throw new Error("PermDock: blockApprovalStore requests are decided through the approvals block's approve and reject, not resolve");
+		async resolve(token, verdict) {
+			const decide = verdict.status === "approved" ? approvals.approve : approvals.reject;
+			if (decide === void 0) throw new Error("PermDock: blockApprovalStore resolves only with the approvals block's approve and reject on the client");
+			const found = await byToken(token);
+			if (found === void 0) throw new ApprovalError("approval-not-found", "approval was not found");
+			applyApprovalVerdict(found.request, verdict);
+			const by = verdict.by.principal?.id;
+			const next = requestOf(await unwrap(decide(found.record.id, verdict.note, compact({ decidedBy: by })), verdict.status === "approved" ? "approve" : "reject"));
+			if (next === null) throw new ApprovalError("approval-not-found", "approval was not found");
+			return next;
 		},
 		async list(query) {
 			const limit = Math.min(Math.max(query.limit ?? 50, 1), 200);
 			const offset = query.cursor === void 0 ? 0 : Number(query.cursor);
 			if (!Number.isSafeInteger(offset) || offset < 0) return { items: [] };
-			const all = (await scan(approvals, () => false)).map(({ request }) => request).filter((request) => matchesQuery(request, query)).toReversed().toSorted((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
+			const all = (await scanAll(() => false)).map(({ request }) => request).filter((request) => matchesQuery(request, query)).toReversed().toSorted((a, b) => Date.parse(a.createdAt) - Date.parse(b.createdAt));
 			const items = all.slice(offset, offset + limit);
 			return offset + limit < all.length ? {
 				items,
@@ -336,41 +358,243 @@ function stageApprovers(approvers, roleScope) {
 		of: leaves
 	};
 }
-function policyOf(entry, roleScope) {
+function quorumOf(step) {
+	if (step.required !== "all") return step.required;
+	const { users = [], permission, role, team, manager } = step.approvers;
+	if (users.length === 0 || permission !== void 0 || role !== void 0 || team !== void 0 || manager === true) throw new TypeError("PermDock: an approval policy step with required \"all\" needs users and no other approvers, since the block counts other holders when a request is filed");
+	return users.length;
+}
+const NUMERIC = /^-?\d+(?:\.\d+)?$/u;
+function isScalar(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function variants(value) {
+	if (typeof value === "string" && NUMERIC.test(value)) return [value, Number(value)];
+	return typeof value === "number" ? [value, String(value)] : [value];
+}
+function numberOf(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	return typeof value === "string" && NUMERIC.test(value) ? Number(value) : void 0;
+}
+const ORDER = {
+	gt: "gt",
+	gte: "gte",
+	lt: "lt",
+	lte: "lte"
+};
+function ruleCondition(field, operator, value) {
+	const list = Array.isArray(value) && value.every(isScalar) ? value : [];
+	const contains = (item) => ({
+		op: "contains",
+		field,
+		value: item
+	});
+	switch (operator) {
+		case "": return true;
+		case "is":
+		case "eq": return isScalar(value) ? {
+			op: "or",
+			conditions: variants(value).map((item) => ({
+				op: "eq",
+				field,
+				value: item
+			}))
+		} : void 0;
+		case "is_not":
+		case "neq": return isScalar(value) ? {
+			op: "and",
+			conditions: variants(value).map((item) => ({
+				op: "ne",
+				field,
+				value: item
+			}))
+		} : void 0;
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const bound = numberOf(value);
+			return bound === void 0 ? void 0 : {
+				op: ORDER[operator],
+				field,
+				value: bound
+			};
+		}
+		case "between":
+		case "not_between": {
+			const [low, high] = Array.isArray(value) ? value.map(numberOf) : [void 0, void 0];
+			if (low === void 0 || high === void 0) return;
+			const between = {
+				op: "and",
+				conditions: [{
+					op: "gte",
+					field,
+					value: low
+				}, {
+					op: "lte",
+					field,
+					value: high
+				}]
+			};
+			return operator === "between" ? between : {
+				op: "not",
+				condition: between
+			};
+		}
+		case "is_any_of":
+		case "is_none_of": return list.length === 0 ? void 0 : {
+			op: operator === "is_any_of" ? "in" : "notIn",
+			field,
+			value: list.flatMap(variants)
+		};
+		case "contains": return typeof value === "string" ? contains(value) : void 0;
+		case "not_contains": return typeof value === "string" ? {
+			op: "not",
+			condition: contains(value)
+		} : void 0;
+		case "has_any_of":
+		case "has_all_of":
+		case "has_none_of": {
+			if (list.length === 0) return;
+			const each = list.map(contains);
+			if (operator === "has_all_of") return {
+				op: "and",
+				conditions: each
+			};
+			const any = {
+				op: "or",
+				conditions: each
+			};
+			return operator === "has_any_of" ? any : {
+				op: "not",
+				condition: any
+			};
+		}
+		case "empty": return {
+			op: "isNull",
+			field,
+			value: true
+		};
+		case "not_empty": return {
+			op: "isNull",
+			field,
+			value: false
+		};
+		default: return;
+	}
+}
+function treeCondition(node) {
+	if (!isRecord(node)) return;
+	let condition;
+	if (node["type"] === "group") {
+		const rules = node["rules"];
+		const combinator = node["combinator"];
+		if (!Array.isArray(rules) || combinator !== "and" && combinator !== "or") return;
+		const parts = [];
+		for (const rule of rules) {
+			const part = treeCondition(rule);
+			if (part === void 0) return;
+			if (part === true) {
+				if (combinator === "or") return true;
+				continue;
+			}
+			parts.push(part);
+		}
+		condition = parts.length === 0 ? true : {
+			op: combinator,
+			conditions: parts
+		};
+	} else if (node["type"] === "rule") {
+		const path = node["path"];
+		const operator = node["operator"];
+		if (!Array.isArray(path) || path.length !== 1 || typeof path[0] !== "string" || typeof operator !== "string") return;
+		condition = ruleCondition(path[0], operator, node["value"]);
+	}
+	if (node["negated"] !== true || condition === void 0) return condition;
+	return condition === true ? void 0 : {
+		op: "not",
+		condition
+	};
+}
+function effectsOf(effect, options) {
+	if (effect === void 0) return;
+	const mapped = options.effects !== void 0 && Object.hasOwn(options.effects, effect) ? options.effects[effect] : void 0;
+	if (mapped !== void 0) return mapped.length === 0 ? void 0 : mapped;
+	return isOperationEffect(effect) ? [effect] : void 0;
+}
+function keysOf(entry, permissions) {
+	if (permissions === void 0) throw new TypeError("PermDock: an approval policy for every subject type or action needs blockApprovalPolicySource's permissions, or an effect PermDock knows");
+	return listPermissions(permissions).map((permission) => permission.key).filter((key) => {
+		const dot = key.lastIndexOf(".");
+		return dot > 0 && (entry.subjectType === "*" || key.slice(0, dot) === entry.subjectType) && (entry.action === "*" || key.slice(dot + 1) === entry.action);
+	});
+}
+function policiesOf(entry, options) {
+	const roleScope = options.roleScope ?? "tenant";
 	const approval = compact({
 		stages: entry.steps.length === 0 ? void 0 : entry.steps.map((step) => ({
 			by: stageApprovers(step.approvers, roleScope),
-			quorum: step.required
+			quorum: quorumOf(step)
 		})),
 		combine: entry.steps.length > 1 ? "sequential" : void 0,
 		mode: entry.mode === "confirm" && entry.selfApproval ? "confirm" : void 0,
 		ttl: entry.expiresIn === void 0 ? void 0 : intervalSeconds(entry.expiresIn)
 	});
-	return {
-		permission: `${entry.subjectType}.${entry.action}`,
-		tenant: entry.organizationId,
+	const tree = entry.conditions === void 0 || entry.conditions === null ? true : treeCondition(entry.conditions);
+	const shared = compact({
+		tenant: entry.organizationId ?? void 0,
+		check: tree === true || tree === void 0 ? void 0 : tree,
 		approval
-	};
+	});
+	if (!(entry.subjectType === "*" || entry.action === "*")) return [{
+		...shared,
+		permission: `${entry.subjectType}.${entry.action}`
+	}];
+	const effects = effectsOf(entry.effect, options);
+	if (effects !== void 0) return [{
+		...shared,
+		effects
+	}];
+	return keysOf(entry, options.permissions).map((permission) => ({
+		...shared,
+		permission
+	}));
+}
+function enabledIn(tenants) {
+	return (entry) => isRecord(entry) && entry["enabled"] === true && (entry["organizationId"] === null || typeof entry["organizationId"] === "string" && tenants.includes(entry["organizationId"]));
+}
+async function listed(approvals, platform) {
+	const entries = await unwrap(approvals.listPolicies(platform ? {
+		pageSize: 200,
+		platform
+	} : { pageSize: 200 }), "listPolicies");
+	if (!Array.isArray(entries)) throw new TypeError("PermDock: listPolicies answered no list");
+	return entries.map((entry) => entry);
 }
 /**
-* An `ApprovalPolicySource` over the approvals block's tenant policies, so a
-* PermDock decision asks for approval wherever the block would. A policy keys
-* the permission `<subjectType>.<action>`; its steps become sequential stages
-* whose approvers are any of the step's permission, role, users and manager;
-* `confirm` with `selfApproval` lets the principal approve; `expiresIn` caps
-* the request's `ttl`. `conditions` are not read, so a conditional policy
-* applies to every call: stricter, never looser. A step with only a `team`
-* approver, an interval it cannot read or a failed read makes the source fail,
-* and every call an allow would grant denies.
+* An `ApprovalPolicySource` over the approvals block's tenant policies, and
+* with `platform` its platform policies, so a PermDock decision asks for
+* approval wherever the block would. A policy keys the permission
+* `<subjectType>.<action>`; a platform policy has no tenant. Its steps become
+* sequential stages whose approvers are any of the step's permission, role,
+* users and manager; `required: "all"` over users needs each of them. `confirm`
+* with `selfApproval` lets the principal approve; `expiresIn` caps the
+* request's `ttl`. `conditions` become a `check` over the call's input, or the
+* row without one; a tree PermDock cannot express is dropped, so the policy
+* applies to every call: stricter, never looser. A `*` subject type or action
+* with an effect PermDock knows matches every operation with that effect, and
+* without one expands over `permissions`. A concrete policy's `effect` is
+* ignored, so it applies to every call of its permission. A step with only a
+* `team` approver, `required: "all"` over anything but users, an interval it
+* cannot read or a failed read makes the source fail, and every call an allow
+* would grant denies.
 */
 function blockApprovalPolicySource(approvals, options = {}) {
-	const roleScope = options.roleScope ?? "tenant";
 	return Object.freeze({
 		name: "better-supabase-approvals",
 		async approvalPoliciesFor(query) {
-			const entries = await unwrap(approvals.listPolicies({ pageSize: 200 }), "listPolicies");
-			if (!Array.isArray(entries)) throw new TypeError("PermDock: listPolicies answered no list");
-			return entries.filter((entry) => isRecord(entry) && entry["enabled"] === true && typeof entry["organizationId"] === "string" && query.tenants.includes(entry["organizationId"])).map((entry) => policyOf(entry, roleScope));
+			const [own, platform] = await Promise.all([listed(approvals, false), options.platform === true ? listed(approvals, true) : []]);
+			return [...platform, ...own].filter(enabledIn(query.tenants)).flatMap((entry) => policiesOf(entry, options));
 		}
 	});
 }
@@ -562,6 +786,15 @@ function subjectFromBetterSupabase(session, options = {}) {
 }
 //#endregion
 //#region src/better-supabase/permdock-for.ts
+/** The options a `permdockFor` resolver already holds. */
+const RESOLVER_OWNS = [
+	"subject",
+	"memberships",
+	"version",
+	"versions",
+	"instances",
+	"options"
+];
 function isResult(source) {
 	return isRecord(source) && Object.hasOwn(source, "session") && Object.hasOwn(source, "authzVersion") && !Object.hasOwn(source, "kind");
 }
@@ -601,7 +834,7 @@ function permdockResolver(options) {
 		byCache.set(versions, created);
 		return created;
 	};
-	return async (source, query, runtimeVersions) => {
+	const resolve = async (source, query, runtimeVersions) => {
 		const result = isResult(source) ? source : void 0;
 		const signedOut = result?.sessionActive === false;
 		const user = subjectOf(source, result, signedOut, options.subject);
@@ -622,6 +855,22 @@ function permdockResolver(options) {
 		});
 		return permdock;
 	};
+	const sources = (versions) => sourcesFor(versions ?? options.versions);
+	return Object.freeze(Object.assign(resolve, { sources }));
+}
+/**
+* The resolver an adapter builds instances with: the app's `permdockFor`, or
+* one built from the adapter's own options. `permdockFor` with any option it
+* already holds throws a `TypeError`, since two sources of the same option
+* would disagree.
+*/
+function resolverOf(options, adapter) {
+	const shared = options.permdockFor;
+	if (shared === void 0) return permdockResolver(options);
+	const clash = RESOLVER_OWNS.find((key) => options[key] !== void 0);
+	if (clash !== void 0) throw new TypeError(`PermDock: ${adapter} takes ${clash} from permdockFor; pass it to permdockFor instead`);
+	const resolve = (source, query, versions) => shared(source, query, versions);
+	return Object.freeze(Object.assign(resolve, { sources: shared.sources }));
 }
 /**
 * One resolver for every instance of the app: `permdockFor(await
@@ -629,11 +878,15 @@ function permdockResolver(options) {
 * bsb.getAccess(...))`. A bootstrap or access result passes its `authzVersion`
 * as `version.known`, so the instance reads no version, and a `sessionActive:
 * false` bootstrap is anonymous. With `instances`, a subject at an unchanged
-* version reuses its instance across requests.
+* version reuses its instance across requests. Pass the same resolver to
+* `authorizer({ permdockFor })`, `authorizationHooks({ permdockFor })` and,
+* through `permdockFor.sources()`, to every other adapter's options, so they
+* share one instance per subject and version.
 */
 function permdockFor(options) {
 	const resolve = permdockResolver(options);
-	return (source, query) => resolve(source, typeof query === "string" || query === null ? { tenant: query } : query ?? {});
+	const call = (source, query, versions) => resolve(source, typeof query === "string" || query === null ? { tenant: query } : query ?? {}, versions);
+	return Object.freeze(Object.assign(call, { sources: resolve.sources }));
 }
 /**
 * One `{ allowed, outcome, reason? }` per named check for `input`, from one
@@ -785,22 +1038,22 @@ function grants$1(permdock, key) {
 	return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
 }
 /**
-* A list matches when every entry does, `anyOf` when one does; other leaves
-* match nobody, as in SQL.
+* A list matches when every entry does, `anyOf` when one does; `manager` when
+* its key is in `managed`; other leaves match nobody, as in SQL.
 */
-function matches(approvers, userId, permdock) {
+function matches(approvers, userId, permdock, managed) {
 	const items = flattenApprovers(approvers);
 	return items.length > 0 && items.every((item) => {
 		switch (item.kind) {
 			case "user": return item.id === userId;
 			case "permission": return grants$1(permdock, item.permission);
-			case "any-of": return item.of.some((entry) => matches(entry, userId, permdock));
+			case "any-of": return item.of.some((entry) => matches(entry, userId, permdock, managed));
+			case "manager": return managed.has(approverManagerKey(item));
 			case "actor":
 			case "anyone":
 			case "assurance":
 			case "authenticated":
 			case "inherit":
-			case "manager":
 			case "plan":
 			case "relation":
 			case "role": return false;
@@ -822,12 +1075,12 @@ function matches(approvers, userId, permdock) {
 */
 function authorizationHooks(options) {
 	const { policy } = options;
-	const resolve = permdockFor(options);
+	const resolve = resolverOf(options, "authorizationHooks");
 	const instance = async (claims, tenant) => {
 		const permdock = await resolve({
 			kind: "user",
 			claims
-		}, tenant);
+		}, { tenant: tenant ?? null });
 		if (permdock.subject.principal === null) return null;
 		return tenant === null || tenant === void 0 || permdock.subject.principal.tenant === tenant ? permdock : null;
 	};
@@ -875,7 +1128,10 @@ function authorizationHooks(options) {
 			const given = approvers[request.kind];
 			if (given === void 0 || approver.claims["sub"] !== approver.userId) return false;
 			const permdock = await instance(approver.claims, request.tenant);
-			return permdock !== null && matches(asApprover(given), approver.userId, permdock);
+			if (permdock === null) return false;
+			const wanted = asApprover(given);
+			const managed = request.requester === void 0 ? [] : await managerKeys(approverLeaves(wanted), request.requester, approver.userId, compact({ relations: resolve.sources().relations }));
+			return matches(wanted, approver.userId, permdock, new Set(managed));
 		} catch {
 			return false;
 		}
@@ -937,6 +1193,8 @@ function authorizationHooks(options) {
 //#region src/better-supabase/approvers.ts
 /** `rls.approvals`' approver check, executable by `authenticated`. */
 const IS_APPROVER = "permdock_is_approver";
+/** The manager walk `rls.approvals.managers` writes. */
+const MANAGES = "permdock_manages";
 /**
 * The resource a cover's `resources` names for a request kind: `job` for
 * `job.update`, else the kind.
@@ -948,14 +1206,20 @@ function resourceOf(kind) {
 /**
 * better-supabase's `isApprover` template: one `case` over `{kind}` whose
 * branches call `permdock_is_approver` with the kind's approvers as JSON. A
-* kind with no branch is `false`. Only `user`, `holder` and `anyOf` approvers
-* match in SQL; other leaves are reported and match nobody.
+* kind with no branch is `false`. With `requestApprovers`, every call is the
+* five-argument form, which also gets better-supabase's `{approvers}`, the
+* request's current approvers. Only `user`, `holder` and `anyOf` approvers, and
+* `manager` with `rls.approvals.managers`, match in SQL; other leaves are
+* reported and match nobody.
 */
 function isApproverTemplate(input) {
 	const problems = [];
 	if (!input.listed) return { problems: [`approvers needs ${input.schema}.${IS_APPROVER}, which \`permdock rls generate\` writes with rls.approvals. Run it, then \`permdock supabase inspect --out\`.`] };
 	const fn = `${sqlIdent(input.schema)}.${sqlIdent(IS_APPROVER)}`;
 	const keys = input.catalog === void 0 ? void 0 : new Set(input.catalog.permissions.map((permission) => permission.key));
+	const current = input.requestApprovers === true;
+	if (current && input.covers !== true) return { problems: [`requestApprovers needs the five-argument ${IS_APPROVER}, which \`permdock rls generate\` writes with rls.approvals.delegations or rls.approvals.managers. Set one, run it, then \`permdock supabase inspect --out\`.`] };
+	const passed = current ? ", ({approvers})::jsonb" : "";
 	const branches = [];
 	for (const [kind, given] of Object.entries(input.approvers)) {
 		if (kind === "") {
@@ -963,24 +1227,28 @@ function isApproverTemplate(input) {
 			continue;
 		}
 		const approvers = asApprover(given);
+		const managers = input.managers === true && input.covers === true;
 		for (const leaf of approverLeaves(approvers)) {
 			if (leaf.kind === "user") continue;
-			if (leaf.kind !== "permission") problems.push(`The ${kind} approvers name a ${leaf.kind} approver, which ${IS_APPROVER} cannot check in SQL, so it matches nobody. Use user(), holder() or anyOf().`);
+			if (leaf.kind === "manager") {
+				if (!managers) problems.push(`The ${kind} approvers name a manager approver, which ${IS_APPROVER} checks only with rls.approvals.managers, so it matches nobody. Set rls.approvals.managers, run \`permdock rls generate\`, then \`permdock supabase inspect --out\`.`);
+			} else if (leaf.kind !== "permission") problems.push(`The ${kind} approvers name a ${leaf.kind} approver, which ${IS_APPROVER} cannot check in SQL, so it matches nobody. Use user(), holder(), manager() or anyOf().`);
 			else if (keys !== void 0 && !keys.has(leaf.permission)) problems.push(`The ${kind} approver permission ${leaf.permission} is not in the catalog. Run \`permdock catalog\` after adding it to the policy.`);
 		}
 		const json = `${quoteSqlLiteral(JSON.stringify(approvers))}::jsonb`;
-		branches.push(input.covers === true ? `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text, ({requester})::text, ${quoteSqlLiteral(resourceOf(kind))})` : `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text)`);
+		branches.push(input.covers === true ? `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text, ({requester})::text, ${quoteSqlLiteral(resourceOf(kind))}${passed})` : `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text)`);
 	}
-	if (branches.length === 0) {
+	if (branches.length === 0 && !current) {
 		problems.push("approvers names no kind, so isApprover is not set.");
 		return { problems };
 	}
 	if (!input.rootTenant) problems.push(`The tenant scope "${input.tenantScope}" is not a root scope, and ${IS_APPROVER} checks holder() approvers at the root scope, so they match nobody.`);
+	const otherwise = current ? `${fn}(null::jsonb, ({tenant})::text, ({requester})::text, split_part({kind}, '.', 1)${passed})` : "false";
 	return {
-		template: `case {kind} ${branches.join(" ")} else false end`,
+		template: branches.length === 0 ? otherwise : `case {kind} ${branches.join(" ")} else ${otherwise} end`,
 		requires: {
 			function: fn,
-			args: input.covers === true ? "jsonb, text, text, text" : "jsonb, text",
+			args: current ? "jsonb, text, text, text, jsonb" : input.covers === true ? "jsonb, text, text, text" : "jsonb, text",
 			role: "postgres"
 		},
 		problems
@@ -1392,12 +1660,14 @@ function authorizationProvider(options) {
 		...options.approvers
 	};
 	let isApprover;
-	if (approvers !== void 0) {
+	if (approvers !== void 0 || options.requestApprovers === true) {
 		const built = isApproverTemplate({
-			approvers,
+			approvers: approvers ?? {},
+			requestApprovers: options.requestApprovers === true,
 			schema: rls.schema,
 			listed: helpers.has(IS_APPROVER),
 			covers: /\bp_requester\b/u.test(helpers.get("permdock_is_approver")?.args ?? ""),
+			managers: helpers.has(MANAGES),
 			tenantScope,
 			rootTenant,
 			catalog
@@ -1586,7 +1856,7 @@ function authorizer(options) {
 		if (batch) return "read";
 		return isPermission(request.action) && READ_ACTIONS.has(request.action.action) ? "read" : "write";
 	};
-	const resolve = permdockResolver(options);
+	const resolve = resolverOf(options, "authorizer");
 	const instanceFor = (claims, tenant, intent, runtime) => resolve(claims === void 0 ? null : {
 		kind: "user",
 		claims

package/dist/{bind-BJFeLX1V.js → bind-B4pMH9bm.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { l as withApp } from "./permdock-DdzMv5-F.js";
+import { l as withApp } from "./permdock-D-_WrdKu.js";
 import { t as composeWraps } from "./wrap-C5PWzgkq.js";
-import { r as instanceOptions } from "./build-instance-lye7oEqf.js";
-import { f as invalidSignatureResponse } from "./evaluations-DG40eSJa.js";
+import { r as instanceOptions } from "./build-instance-BFMFQdE_.js";
+import { f as invalidSignatureResponse } from "./evaluations-h3KoJAPa.js";
 import { n as tenantScope } from "./adapter-context-OHikyRqV.js";
-import { t as createPermDock } from "./create-jCPwPWXf.js";
+import { t as createPermDock } from "./create-3A7J9KRR.js";
 //#region src/server/bind.ts
 /**
 * The server kernel with the subject and actor callbacks reading the context

package/dist/{bind-DjFNX0Pq.d.ts → bind-DR6ku3A9.d.ts}

@@ -1,11 +1,11 @@
-import { Z as Intent, yr as Subject } from "./policy-types-IRJVABmm.js";
-import { m as ApprovalStore } from "./types-BvBbkAu1.js";
-import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
+import { Z as Intent, yr as Subject } from "./policy-types-D-GwfQTc.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
-import { o as OtelWrap } from "./types-Sj1U8HMm.js";
-import { r as PdpFactory } from "./types-B3BOcI0J.js";
-import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-Bw-lWqzR.js";
+import { n as PermDockWrap } from "./wrap-BHGA-SMM.js";
+import { o as OtelWrap } from "./types-DGf_cpKF.js";
+import { r as PdpFactory } from "./types-B8qUkGja.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-3OnXjZ2D.js";
 //#region src/server/bind.d.ts
 /**
  * The options of every framework adapter; `TContext` is what its callbacks

package/dist/{build-instance-lye7oEqf.js → build-instance-BFMFQdE_.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
 //#region src/core/instance-options.ts
 const INSTANCE_KEYS = {
 	memberships: true,

package/dist/{capability-BzjWdKmP.d.ts → capability-BZ_veK9o.d.ts}

@@ -1,4 +1,4 @@
-import { Kt as Instant, _r as Principal, gt as TokenSigner } from "./policy-types-IRJVABmm.js";
+import { Kt as Instant, _r as Principal, gt as TokenSigner } from "./policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/capability.d.ts
 /**