permdock 0.2.0 → 0.3.0

package/dist/{rls-BMNydpHk.js → rls-DQtdgTHB.js}

@@ -4,21 +4,21 @@ import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { E as listRoles, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
 import { h as scopeField } from "./validity-uOp8UpYn.js";
 import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
-import { s as policyRowConditionKeys } from "./catalog-doc-Dsc9y7sd.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import "./budget-NbEtbJC_.js";
 import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
+import "./sources-4p0-4xQm.js";
 import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bs44dare.js";
-import { B as parseMembershipsFlag, C as graphHelper, G as quoteLiteral, H as permittedIdsHelper, K as quoteTable, L as memberIdsHelper, Q as sessionLiveHelperSql, U as qualifiedTable$1, W as quoteIdent$1, X as scopeTable, Y as scopeSources, Z as scopeTypeOf, a as qualified$1, d as SESSION_LIVE_HELPER, et as subjectClaimJsonSql, n as HELPERS, nt as subjectIdSql, v as checkSuspension, w as graphSqlName } from "./rls-shared-aOQ4hGTO.js";
-import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-BMasREhR.js";
-import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-pc9fuXYm.js";
-import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-B5Lkq62W.js";
-import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-BuxLQLpU.js";
-import { n as runRlsVerify } from "./rls-verify-D8B7dOTh.js";
-import { t as supautilsRejections } from "./supautils-DYZnzRWV.js";
+import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-BpPXt3x1.js";
+import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
+import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-74oZPXWL.js";
+import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
+import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-RuFqaqGz.js";
+import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-CSLQ4zJ3.js";
+import { n as runRlsVerify } from "./rls-verify-CVQTHTh5.js";
+import { t as supautilsRejections } from "./supautils-Cn4R4cJ4.js";
 import { basename, delimiter, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 //#region src/cli/rls-advisors.ts
@@ -2363,7 +2363,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-7wikfrVI.js");
+	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-CN4TlJTO.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2471,7 +2471,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-D8F7j35Q.js");
+			const { runRlsImport } = await import("./rls-import-BTFVk3jH.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/{rls-fields-BMasREhR.js → rls-fields-74oZPXWL.js}

@@ -7,15 +7,15 @@ import { E as listRoles, l as inheritCondition, m as relationCondition } from ".
 import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
 import { d as partitionsOf, h as scopeField } from "./validity-uOp8UpYn.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { _ as leveled, p as andWhere } from "./permdock-CzqXjCpU.js";
+import { _ as leveled, p as andWhere } from "./permdock-CbgvLnuo.js";
 import { i as requiresStandIn } from "./delegation-D8pUEuce.js";
 import { t as CliError } from "./errors-CWfoNg9N.js";
-import { o as jsonSchemaOf } from "./catalog-doc-Dsc9y7sd.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
 import { i as scopeMembershipTable, o as relatedSql, r as scopeColumn } from "./compile-Ba4blROR.js";
 import { t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import { c as roleManifest, s as roleColumn } from "./sources-B0UvrJ21.js";
+import { l as roleColumn, u as roleManifest } from "./sources-4p0-4xQm.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { $ as sqlType, A as keyTenantSql, C as graphHelper, D as inheritedRowsHelper, E as hasMemberFor, F as memberForSources, G as quoteLiteral, H as permittedIdsHelper, J as roleKindSql, K as quoteTable, L as memberIdsHelper, M as linkHelper, N as liveSessionSql, O as isRecord, P as memberForHelper, R as memberRoleOf, S as grantPermissionSql, T as graphSqlText, U as qualifiedTable, V as permittedForHelper, W as quoteIdent, X as scopeTable, Y as scopeSources, Z as scopeTypeOf, _ as arrayColumnsOf, a as qualified$1, at as userIdHelperSql, b as disabledKeep, c as textArray, et as subjectClaimJsonSql, g as activeUserSql, i as helperSchema, it as tenantTypeOf, j as kindFilterSql, k as keptRowSql, l as CLAIM, m as activeMembershipSql, n as HELPERS, nt as subjectIdSql, o as rootName, p as activeInstancesSql, q as restrictedHelper, r as allowEntry, rt as tenantClaimSql, s as signedIn, t as CUSTOM_ROLES, tt as subjectClaimSql, u as CLOSURE, x as globalKindFilterSql, y as columnTypesOf, z as memberVia } from "./rls-shared-aOQ4hGTO.js";
+import { A as keptRowSql, B as memberVia, C as grantPermissionSql, D as hasMemberFor, E as graphSqlText, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, J as restrictedHelper, K as quoteLiteral, M as kindFilterSql, N as linkHelper, O as inheritedRowsHelper, P as liveSessionSql, Q as scopeTypeOf, R as memberIdsHelper, S as globalKindFilterSql, U as permittedIdsHelper, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, _ as activeUserSql, a as helperSchema, at as tenantTypeOf, b as columnTypesOf, c as signedIn, d as CLOSURE, et as sqlType, h as activeMembershipSql, i as allowEntry, it as tenantClaimSql, j as keyTenantSql, k as isRecord, l as textArray, m as activeInstancesSql, n as GLOBAL_ROLES, nt as subjectClaimSql, o as qualified$1, ot as userIdHelperSql, q as quoteTable, r as HELPERS, rt as subjectIdSql, s as rootName, t as CUSTOM_ROLES, tt as subjectClaimJsonSql, u as CLAIM, v as arrayColumnsOf, w as graphHelper, x as disabledKeep, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
 import { createHash } from "node:crypto";
 //#region src/cli/rls-api-keys.ts
 const API_KEY_ALLOWS = "permdock_api_key_allows";
@@ -1472,6 +1472,84 @@ create trigger "permdock_custom_role_cascade"
 `;
 }
 //#endregion
+//#region src/cli/rls-global-roles.ts
+function qualifiedName(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/**
+* `permdock_replace_global_roles(p_user, p_roles)`: sets the global roles of
+* one user in `rls.roles` in one statement pair. It runs as the invoker, so
+* the table's policies and the `rls.assignments` trigger judge every row it
+* deletes or inserts.
+*/
+function globalRolesSql(ctx) {
+	if (ctx.roles === void 0) return "";
+	const source = globalRoleSource(ctx.roles, "public", "t");
+	const table = quoteTable(qualifiedName(ctx.roles.table));
+	const user = quoteIdent(source.user);
+	const fn = qualified$1(ctx, GLOBAL_ROLES.replace);
+	const type = ctx.dialect === "supabase" ? "uuid" : "text";
+	const wanted = `select distinct r from unnest(coalesce(p_roles, '{}'::text[])) r where r is not null`;
+	const through = source.through;
+	let body;
+	if (through === void 0) {
+		const role = typeof ctx.roles.role === "string" ? ctx.roles.role : "role";
+		const column = quoteIdent(role);
+		body = `  delete from ${table} t
+  where t.${user} = p_user
+    and t.${column}::text <> all(coalesce(p_roles, '{}'::text[]));
+  insert into ${table} (${user}, ${column})
+  select p_user, w.r
+  from (${wanted}) w(r)
+  where not exists (
+    select 1 from ${table} t where t.${user} = p_user and t.${column}::text = w.r
+  );`;
+	} else {
+		const keys = quoteTable(through.table);
+		const id = quoteIdent(through.id);
+		const key = quoteIdent(through.key);
+		const ref = quoteIdent(through.ref);
+		body = `  select string_agg(w.r, ', ' order by w.r) into v_unknown
+  from (${wanted}) w(r)
+  where not exists (select 1 from ${keys} k where k.${key}::text = w.r);
+  if v_unknown is not null then
+    raise exception using
+      errcode = '22023',
+      message = 'permdock: ' || v_unknown || ' is not a role',
+      hint = 'unknown-role';
+  end if;
+  delete from ${table} t
+  where t.${user} = p_user
+    and not exists (
+      select 1 from ${keys} k
+      where k.${id} = t.${ref}
+        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))
+    );
+  insert into ${table} (${user}, ${ref})
+  select p_user, k.${id}
+  from ${keys} k
+  where k.${key}::text in (${wanted})
+    and not exists (
+      select 1 from ${table} t where t.${user} = p_user and t.${ref} = k.${id}
+    );`;
+	}
+	const declare = through === void 0 ? "" : "declare\n  v_unknown text;\n";
+	const args = `${type}, text[]`;
+	return `-- set the global roles of a user: delete the others and insert the missing ones, as the caller, so the table's policies and the assignment trigger still apply
+create or replace function ${fn}(p_user ${type}, p_roles text[])
+returns void
+language plpgsql
+volatile
+set search_path = ''
+as $$
+${declare}begin
+${body}
+end;
+$$;
+revoke execute on function ${fn}(${args}) from public, anon;
+grant execute on function ${fn}(${args}) to authenticated;`;
+}
+//#endregion
 //#region src/cli/rls-helpers.ts
 /** The helper `--capabilities` adds: ids of one resource a link capability claim reaches. Part of the SQL contract. */
 const CAPABILITIES = { ids: "permdock_capability_ids" };
@@ -2183,6 +2261,8 @@ revoke all on table ${ur} from anon, authenticated, public;`);
 		const cascade = customRoleCascadeSql(ctx);
 		if (cascade !== "") chunks.push(cascade);
 	}
+	const globalRoles = globalRolesSql(ctx);
+	if (globalRoles !== "") chunks.push(globalRoles);
 	const readers = roleReadersSql(ctx, options.permissions, options.trustedReaders);
 	if (readers !== "") chunks.push(readers);
 	return `${chunks.join("\n\n")}\n`;

package/dist/{rls-graph-pc9fuXYm.js → rls-graph-CHwx0V8q.js}

@@ -2,8 +2,8 @@ import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isS
 import { d as scopeList } from "./scopes-CVdPrWN-.js";
 import { l as inheritCondition, m as relationCondition, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
 import { c as relationArmSql, u as restrictedRowsSql } from "./compile-Ba4blROR.js";
-import "./sources-B0UvrJ21.js";
-import { C as graphHelper, G as quoteLiteral, K as quoteTable, M as linkHelper, T as graphSqlText, U as qualifiedTable, W as quoteIdent, g as activeUserSql, n as HELPERS, q as restrictedHelper, u as CLOSURE, w as graphSqlName } from "./rls-shared-aOQ4hGTO.js";
+import "./sources-4p0-4xQm.js";
+import { E as graphSqlText, G as quoteIdent, J as restrictedHelper, K as quoteLiteral, N as linkHelper, T as graphSqlName, W as qualifiedTable, _ as activeUserSql, d as CLOSURE, q as quoteTable, r as HELPERS, w as graphHelper } from "./rls-shared-Cewd_-zI.js";
 //#region src/cli/helper-calls.ts
 /**
 * Tables whose policies other packages write by calling the SQL helpers

package/dist/{rls-import-D8F7j35Q.js → rls-import-BTFVk3jH.js}

@@ -1,7 +1,7 @@
 import { o as usageResult } from "./errors-CWfoNg9N.js";
 import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import { B as parseMembershipsFlag, n as HELPERS } from "./rls-shared-aOQ4hGTO.js";
-import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-BMasREhR.js";
+import { V as parseMembershipsFlag, r as HELPERS } from "./rls-shared-Cewd_-zI.js";
+import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{rls-migrate-7wikfrVI.js → rls-migrate-CN4TlJTO.js}

@@ -1,8 +1,8 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
 import { a as sqlFiles } from "./files-DWUN9PzI.js";
 import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
-import { n as HELPERS } from "./rls-shared-aOQ4hGTO.js";
+import "./sources-4p0-4xQm.js";
+import { r as HELPERS } from "./rls-shared-Cewd_-zI.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import { parse } from "pgsql-parser";

package/dist/{rls-ownership-B5Lkq62W.js → rls-ownership-RuFqaqGz.js}

@@ -1,8 +1,8 @@
 import { l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { S as findRole } from "./grantee-Cv5Sogfv.js";
-import { s as roleColumn } from "./sources-B0UvrJ21.js";
-import { F as memberForSources, G as quoteLiteral, I as memberForTable, J as roleKindSql, K as quoteTable, R as memberRoleOf, U as qualifiedTable, W as quoteIdent, X as scopeTable, Y as scopeSources, a as qualified, it as tenantTypeOf, j as kindFilterSql, nt as subjectIdSql, s as signedIn, t as CUSTOM_ROLES, x as globalKindFilterSql, z as memberVia } from "./rls-shared-aOQ4hGTO.js";
-import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-BMasREhR.js";
+import { l as roleColumn } from "./sources-4p0-4xQm.js";
+import { B as memberVia, G as quoteIdent, I as memberForSources, K as quoteLiteral, L as memberForTable, M as kindFilterSql, S as globalKindFilterSql, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, at as tenantTypeOf, c as signedIn, o as qualified, q as quoteTable, rt as subjectIdSql, t as CUSTOM_ROLES, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
+import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-74oZPXWL.js";
 //#region src/cli/rls-ownership.ts
 /** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
 const OWNERSHIP = {

package/dist/{rls-shared-aOQ4hGTO.js → rls-shared-Cewd_-zI.js}

@@ -3,7 +3,7 @@ import { c as rootScope, l as scopeChain, o as resolveScope } from "./scopes-CVd
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
 import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import { l as keptKeys, s as roleColumn } from "./sources-B0UvrJ21.js";
+import { d as keptKeys, l as roleColumn } from "./sources-4p0-4xQm.js";
 //#region src/cli/rls-sql.ts
 const CLI = "PermDock CLI";
 const CLAIM = SQL_IDENT;
@@ -469,6 +469,8 @@ const CUSTOM_ROLES = {
 	trustedRemove: "permdock_trusted_delete_custom_role_grants",
 	cascade: "permdock_cascade_custom_role"
 };
+/** The function `rls.roles` adds. The name is part of the SQL contract. */
+const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
 function helperSchema(ctx) {
 	return ctx.schema ?? "permdock";
 }
@@ -490,4 +492,4 @@ function textArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
 }
 //#endregion
-export { sqlType as $, keyTenantSql as A, parseMembershipsFlag as B, graphHelper as C, inheritedRowsHelper as D, hasMemberFor as E, memberForSources as F, quoteLiteral as G, permittedIdsHelper as H, memberForTable as I, roleKindSql as J, quoteTable as K, memberIdsHelper as L, linkHelper as M, liveSessionSql as N, isRecord as O, memberForHelper as P, sessionLiveHelperSql as Q, memberRoleOf as R, grantPermissionSql as S, graphSqlText as T, qualifiedTable as U, permittedForHelper as V, quoteIdent as W, scopeTable as X, scopeSources as Y, scopeTypeOf as Z, arrayColumnsOf as _, qualified as a, userIdHelperSql as at, disabledKeep as b, textArray as c, SESSION_LIVE_HELPER as d, subjectClaimJsonSql as et, USER_ID_HELPER as f, activeUserSql as g, activeRowSql as h, helperSchema as i, tenantTypeOf as it, kindFilterSql as j, keptRowSql as k, CLAIM as l, activeMembershipSql as m, HELPERS as n, subjectIdSql as nt, rootName as o, activeInstancesSql as p, restrictedHelper as q, allowEntry as r, tenantClaimSql as rt, signedIn as s, CUSTOM_ROLES as t, subjectClaimSql as tt, CLOSURE as u, checkSuspension as v, graphSqlName as w, globalKindFilterSql as x, columnTypesOf as y, memberVia as z };
+export { sessionLiveHelperSql as $, keptRowSql as A, memberVia as B, grantPermissionSql as C, hasMemberFor as D, graphSqlText as E, memberForHelper as F, quoteIdent as G, permittedForHelper as H, memberForSources as I, restrictedHelper as J, quoteLiteral as K, memberForTable as L, kindFilterSql as M, linkHelper as N, inheritedRowsHelper as O, liveSessionSql as P, scopeTypeOf as Q, memberIdsHelper as R, globalKindFilterSql as S, graphSqlName as T, permittedIdsHelper as U, parseMembershipsFlag as V, qualifiedTable as W, scopeSources as X, roleKindSql as Y, scopeTable as Z, activeUserSql as _, helperSchema as a, tenantTypeOf as at, columnTypesOf as b, signedIn as c, CLOSURE as d, sqlType as et, SESSION_LIVE_HELPER as f, activeRowSql as g, activeMembershipSql as h, allowEntry as i, tenantClaimSql as it, keyTenantSql as j, isRecord as k, textArray as l, activeInstancesSql as m, GLOBAL_ROLES as n, subjectClaimSql as nt, qualified as o, userIdHelperSql as ot, USER_ID_HELPER as p, quoteTable as q, HELPERS as r, subjectIdSql as rt, rootName as s, CUSTOM_ROLES as t, subjectClaimJsonSql as tt, CLAIM as u, arrayColumnsOf as v, graphHelper as w, disabledKeep as x, checkSuspension as y, memberRoleOf as z };

package/dist/{rls-verify-D8B7dOTh.js → rls-verify-CVQTHTh5.js}

@@ -1,17 +1,18 @@
 import { _ as listPermissions, d as isEdgeRelation, f as isFieldRelation, i as findPermission, m as isPrincipalRelation } from "./permissions-DVoF6dMt.js";
 import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource } from "./src-BDwEZWrZ.js";
 import { d as scopeList } from "./scopes-CVdPrWN-.js";
-import { g as customRoleScope, t as createPermDock, v as membershipsClaim } from "./permdock-CzqXjCpU.js";
+import { g as customRoleScope, t as createPermDock, v as membershipsClaim } from "./permdock-CbgvLnuo.js";
 import { t as memoryRelations } from "./relations-cjOL01hZ.js";
 import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
-import { o as jsonSchemaOf, s as policyRowConditionKeys } from "./catalog-doc-Dsc9y7sd.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import "./budget-NbEtbJC_.js";
-import "./sources-B0UvrJ21.js";
-import { G as quoteLiteral, K as quoteTable, W as quoteIdent, y as columnTypesOf } from "./rls-shared-aOQ4hGTO.js";
-import { p as commandFor, s as viewName, t as FIELD_VIEWS, w as connectPg } from "./rls-fields-BMasREhR.js";
-import { a as HELPER_TABLE_POLICIES_SQL, d as rowConditionMessage, n as graphPlan, u as helperTablePoliciesFromRows } from "./rls-graph-pc9fuXYm.js";
+import "./sources-4p0-4xQm.js";
+import { G as quoteIdent, K as quoteLiteral, b as columnTypesOf, q as quoteTable } from "./rls-shared-Cewd_-zI.js";
+import { p as commandFor, s as viewName, t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
+import { a as HELPER_TABLE_POLICIES_SQL, d as rowConditionMessage, n as graphPlan, u as helperTablePoliciesFromRows } from "./rls-graph-CHwx0V8q.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
 import { resolve } from "node:path";
 import { randomUUID } from "node:crypto";

package/dist/row-conditions-h2HythXQ.js

@@ -0,0 +1,27 @@
+//#region src/core/row-conditions.ts
+const ROW_GRANTEES = /* @__PURE__ */ new Set([
+	"relation",
+	"plan",
+	"actor",
+	"assurance",
+	"inherit"
+]);
+/**
+* Whether a grant depends on more than the role and the scope: a row or body
+* condition, a closure, a field list, a purpose, a break-glass override, a
+* validity window, a `requires`, or a relation, plan, actor or assurance grantee. The SQL helpers
+* (`permdock_has`, `permitted_<scope>_ids`) check only role and scope, so a
+* policy that calls them for such a permission would widen access.
+*/
+function grantHasRowConditions(grant) {
+	const grantees = Array.isArray(grant.to) ? grant.to : [grant.to];
+	return grant.where !== void 0 || grant.check !== void 0 || grant.closure !== void 0 || !grant.portable || grant.fields !== void 0 || grant.purpose !== void 0 || grant.breakGlass !== void 0 || grant.validity !== void 0 || grant.requires !== void 0 || grantees.some((grantee) => ROW_GRANTEES.has(grantee.kind));
+}
+/** Per permission key, whether any code grant for it has row conditions. */
+function policyRowConditionKeys(policy) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grantHasRowConditions(grant)) keys.add(grant.permission.key);
+	return keys;
+}
+//#endregion
+export { policyRowConditionKeys as t };

package/dist/{rpc-DOK54_CS.js → rpc-DL9Sqvb1.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
 import { o as requestFromContext } from "./http-SO7qGttf.js";
 import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
-import { t as adapterKernel } from "./bind-VnYn2HKq.js";
+import { t as adapterKernel } from "./bind-CuzGytRf.js";
 import { n as guardIterable } from "./stream-DDpvynSB.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/{run-YXCJDNYk.js → run-DKDbM4Du.js}

@@ -1,7 +1,7 @@
 import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
 import { o as cliVersion } from "./version-BvacVTZR.js";
 import { a as resolveCwd, i as readConfig } from "./config-BJiM-xAm.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { stripVTControlCharacters } from "node:util";
 import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
 //#region src/cli/run.ts

package/dist/{saas-Bj_FFkjN.js → saas-DhpJjnBA.js}

@@ -1,10 +1,10 @@
 import { r as principal } from "./refs-KYb4ntaz.js";
 import { _ as memoryLimitStore, a as definePolicy, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
-import { _ as memoryRoleSource } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource } from "./src-BDwEZWrZ.js";
 import { n as anyone, p as relation } from "./grantee-Cv5Sogfv.js";
 import { t as memoryRelations } from "./relations-cjOL01hZ.js";
 import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CpZrivYv.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-RJrovw98.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/scim/index.d.ts

@@ -1,2 +1,2 @@
-import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-A0YNL8jZ.js";
+import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-C8z4RjQV.js";
 export { type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/server/index.d.ts

@@ -1,11 +1,11 @@
-import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-CFZAr_Al.js";
+import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CtF23SrC.js";
-import { t as Disclosure } from "../problem-details-CkL50EEf.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DAqevpNk.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Ba264OaJ.js";
+import { t as Disclosure } from "../problem-details-DX075l9V.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DPdqI50v.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-BWyx3jua.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DwQH8ufx.js";
+import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-B1d519XK.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-B-LxUahj.js";
 //#region src/server/credentials.d.ts
 /** `on('auth')` causes for an API key that resolves to the anonymous subject. */
 type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";

package/dist/server/index.js

@@ -5,7 +5,7 @@ import { d as wwwAuthenticate, o as problemFromDecision, s as problemResponse, u
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
 import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
 import { n as tenantScope } from "../adapter-context-mlWsVGGg.js";
-import { n as createServerKernel, t as createPermDock } from "../create-CPhDL6qx.js";
+import { n as createServerKernel, t as createPermDock } from "../create-CMwIl-w2.js";
 import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-DlZ28Oz5.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, snapshotHeaders, snapshotTag, subjectFromApiKey, tenantScope, validationProblem, verifyWebBotAuth, wwwAuthenticate };

package/dist/{sink-Gs6TTVa-.d.ts → sink-B1fZzIMf.d.ts}

@@ -1,4 +1,4 @@
-import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-CFZAr_Al.js";
+import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-IB6yxpC3.js";
 //#region src/core/sink.d.ts
 /** The closed list of CloudEvents `type` values PermDock emits. */
 declare const CLOUD_EVENT_TYPES: {

package/dist/{skills-JaymNCdK.js → skills-Bx-U0irG.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { r as pick, t as CANCELLED } from "./prompt-CXYhLfsS.js";
 import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Biq5uup3.js";
 import { defineCommand } from "citty";

package/dist/{snapshot-cache-DwQH8ufx.d.ts → snapshot-cache-B-LxUahj.d.ts}

@@ -1,4 +1,4 @@
-import { Tt as Snapshot } from "./policy-CFZAr_Al.js";
+import { Tt as Snapshot } from "./policy-IB6yxpC3.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */

package/dist/solid/index.d.ts

@@ -1,11 +1,11 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-CFZAr_Al.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */

package/dist/solid/index.js

@@ -2,10 +2,10 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-yO0V6gRn.js";
+import { i as isPromiseLike } from "../store-options-ByhZq1jV.js";
 import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-DNyC1y48.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-Cfbvo4DE.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);

package/dist/{sources-B0UvrJ21.js → sources-4p0-4xQm.js}

@@ -518,6 +518,17 @@ const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 * API's exposed schemas, so the `security definer` functions are not RPCs.
 */
 const PERMDOCK_SCHEMA = "permdock";
+/** Where `supabase.hook.api` puts the PostgREST wrappers, and the prefix of their names. */
+const HOOK_API_SCHEMA = "public";
+const HOOK_API_PREFIX = "permdock_";
+/** The wrapper function names of `supabase.hook.api` for `prefix`. */
+function hookApiNames(prefix = HOOK_API_PREFIX) {
+	return {
+		subjectFor: `${prefix}subject_for`,
+		membersOf: `${prefix}members_of`,
+		authzVersionFor: `${prefix}authz_version_for`
+	};
+}
 /**
 * Reads the authorization version `permdock supabase hook generate` keeps in
 * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
@@ -531,4 +542,4 @@ function authzVersion(options) {
 	};
 }
 //#endregion
-export { fromSupabasePostgres as a, roleManifest as c, fromJunction as i, keptKeys as l, PERMDOCK_SCHEMA as n, fromTable as o, authzVersion as r, roleColumn as s, AUTHZ_VERSION_TABLE as t };
+export { fromJunction as a, hookApiNames as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, fromSupabasePostgres as o, PERMDOCK_SCHEMA as r, fromTable as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };

package/dist/{sources-BcJgw0lt.d.ts → sources-BdOYLw9j.d.ts}

@@ -1,5 +1,5 @@
-import { gt as MembershipSource } from "./policy-CFZAr_Al.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-yF5LmQVD.js";
+import { gt as MembershipSource } from "./policy-IB6yxpC3.js";
+import { n as RoleThrough, y as SupabaseSuspension } from "./types-C97IskBw.js";
 import { o as SupabaseManifestMembership } from "./manifest-uDS9y5de.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */

package/dist/{src-CSbUiozF.js → src-BDwEZWrZ.js}

@@ -9,7 +9,7 @@ import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
 import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
 import { g as tenantsOf } from "./validity-uOp8UpYn.js";
 import { n as isThenable } from "./thenable-okc2xDsj.js";
-import { a as collectSnapshotGrants, c as rankRoles, l as usesAssigns, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as declaredRoleNames$1, y as resolveCustomRole } from "./permdock-CzqXjCpU.js";
+import { a as collectSnapshotGrants, c as rankRoles, l as usesAssigns, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as declaredRoleNames$1, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
 import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-BrMozJCo.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-9AWO9EGt.js";
-import { t as memoryReplayStore } from "../replay-sqBGMnNs.js";
-import { t as createPermDock } from "../index-CtE07CBF.js";
+import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-Cq_H8N_X.js";
+import { t as memoryReplayStore } from "../replay-CYyiLiwO.js";
+import { t as createPermDock } from "../index-0nNqHspG.js";
 export { type CaepEventName, type PollHandle, type PollOptions, type PollResult, type ReplayStore, type SetSubject, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfSubject, type SsfSubjectMapper, createPermDock, memoryReplayStore };

package/dist/{store-D_pjn91-.d.ts → store-jOBYpiXC.d.ts}

@@ -1,6 +1,6 @@
-import { Tt as Snapshot, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
-import { n as ApprovalState, r as ClientPermDock, s as PermissionState } from "./types-kxznc7cn.js";
+import { n as ApprovalState, r as ClientPermDock, s as PermissionState } from "./types-CKNSyIf_.js";
 //#region src/client/store.d.ts
 type ClientStore = {
   get(): ClientPermDock;

package/dist/{store-options-yO0V6gRn.js → store-options-ByhZq1jV.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-y6vfu2_f.js";
 import { c as rowIdOf, n as parseSnapshot } from "./snapshot-Enxd0n-s.js";
 import { u as nowSeconds } from "./validity-uOp8UpYn.js";
 import { n as payloadDigest } from "./token-CIWxJOCh.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/approvals.ts
 /** Ceiling for the approval poll backoff after a failed status request. */

package/dist/{stores-4_sqiOA1.js → stores-BT2pSCub.js}

@@ -1,5 +1,5 @@
 import { c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, t as approvalHandle } from "./views-Soe7bGSC.js";
-import { n as providePermDock, t as getStore } from "./context-Ttp0ekMT.js";
+import { n as providePermDock, t as getStore } from "./context-Bcy85rGi.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stores-DVR5NHLE.d.ts → stores-C0IMQrGI.d.ts}

@@ -1,7 +1,7 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { r as Role } from "./vocabulary-DA8a8zif.js";
-import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-CKNSyIf_.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/types.d.ts
 type PermDockSvelteOptions = {

package/dist/{stream-DlvG2hs-.d.ts → stream-D1RXubw2.d.ts}

@@ -1,5 +1,5 @@
 import { f as Permission } from "./permissions-DttnqqxC.js";
-import { i as ProtectOptions } from "./create-BWyx3jua.js";
+import { i as ProtectOptions } from "./create-B1d519XK.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/supabase/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-CFZAr_Al.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-yF5LmQVD.js";
+import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-IB6yxpC3.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-C97IskBw.js";
 import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BcJgw0lt.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BdOYLw9j.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
@@ -54,6 +54,17 @@ type SupabaseRpcCaller = {
   };
 };
 type PostgrestSourcesOptions = {
+  /**
+   * The `supabase.hook.api` setting the hook file was generated with: the
+   * wrappers live in `schema` (default `public`) as `<prefix>subject_for`,
+   * `<prefix>members_of` and `<prefix>authz_version_for` (default prefix
+   * `permdock_`). It sets the defaults of `schema`, `fn`, `membersFn` and
+   * `versionFn`, which still override it.
+   */
+  readonly api?: {
+    readonly schema?: string;
+    readonly prefix?: string;
+  };
   /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
   readonly schema?: string;
   /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */

package/dist/supabase/index.js

@@ -1,5 +1,5 @@
-import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-DTBaC20O.js";
+import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-C0qESOa-.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as fromSupabasePostgres, i as fromJunction, o as fromTable, r as authzVersion, t as AUTHZ_VERSION_TABLE } from "../sources-B0UvrJ21.js";
+import { a as fromJunction, i as authzVersion, o as fromSupabasePostgres, s as fromTable, t as AUTHZ_VERSION_TABLE } from "../sources-4p0-4xQm.js";
 import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
 export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };