permdock 0.2.0 → 0.3.0

package/dist/supabase/middleware.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
-import { n as OpenApiHooks } from "../create-BWyx3jua.js";
-import { n as ServerAdapterServices } from "../bind-CVy3Espv.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { n as OpenApiHooks } from "../create-B1d519XK.js";
+import { n as ServerAdapterServices } from "../bind-C_ob3LKa.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -2,8 +2,8 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { r as credentialSubject } from "../credential-8P81ff4u.js";
 import { i as methodNotAllowed } from "../problem-B43ztKIm.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createServerKernel } from "../create-CPhDL6qx.js";
-import { n as attached } from "../bind-VnYn2HKq.js";
+import { n as createServerKernel } from "../create-CMwIl-w2.js";
+import { n as attached } from "../bind-CuzGytRf.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-CwafwxxF.js → supabase-Boqb9a_Y.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/supabase.ts
 function supabase(ctx) {
@@ -61,7 +61,7 @@ function supabase(ctx) {
 			const budget = stringArg(parsed.budget);
 			const schema = stringArg(parsed.schema);
 			const grantsOut = stringArg(parsed["grants-out"]);
-			const { runSupabase } = await import("./supabase-hook-D5qVd_D8.js");
+			const { runSupabase } = await import("./supabase-hook-6sYLXg_u.js");
 			ctx.report(await runSupabase({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{supabase-DTBaC20O.js → supabase-C0qESOa-.js}

@@ -6,7 +6,7 @@ import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCu
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 import "./budget-NbEtbJC_.js";
 import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
-import { l as keptKeys, s as roleColumn } from "./sources-B0UvrJ21.js";
+import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-4p0-4xQm.js";
 import { i as readMemberships } from "./manifest-iaoBXHKc.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
@@ -319,10 +319,12 @@ function readSubjectRecord(value) {
 * `postgrestSources` call, so create it per request or per job.
 */
 function postgrestSources(client, options = {}) {
-	const schema = options.schema ?? "permdock";
-	const fn = options.fn ?? "subject_for";
-	const membersFn = options.membersFn ?? "members_of";
-	const versionFn = options.versionFn ?? "authz_version_for";
+	const api = options.api;
+	const names = api === void 0 ? void 0 : hookApiNames(api.prefix);
+	const schema = options.schema ?? (api === void 0 ? "permdock" : api.schema ?? "public");
+	const fn = options.fn ?? names?.subjectFor ?? "subject_for";
+	const membersFn = options.membersFn ?? names?.membersOf ?? "members_of";
+	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
 	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
 	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
 	const loaded = /* @__PURE__ */ new Map();

package/dist/{supabase-config-Bs44dare.js → supabase-config-BpPXt3x1.js}

@@ -1,6 +1,6 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
 import { a as sqlFiles, i as rel } from "./files-DWUN9PzI.js";
-import { t as FIELD_VIEWS } from "./rls-fields-BMasREhR.js";
+import { t as FIELD_VIEWS } from "./rls-fields-74oZPXWL.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { createRequire } from "node:module";

package/dist/supabase-hook-6sYLXg_u.js

@@ -0,0 +1,2 @@
+import { i as runSupabase } from "./supabase-hook-CSLQ4zJ3.js";
+export { runSupabase };

package/dist/{supabase-hook-BuxLQLpU.js → supabase-hook-CSLQ4zJ3.js}

@@ -5,15 +5,15 @@ import { a as sqlFiles } from "./files-DWUN9PzI.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import { t as shortDiff } from "./text-diff-BdkkYSbi.js";
 import { r as scopeColumn } from "./compile-Ba4blROR.js";
-import { t as authorizeSql } from "./supabase-DTBaC20O.js";
+import { t as authorizeSql } from "./supabase-C0qESOa-.js";
 import "./budget-NbEtbJC_.js";
-import { c as roleManifest, l as keptKeys, t as AUTHZ_VERSION_TABLE } from "./sources-B0UvrJ21.js";
+import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-4p0-4xQm.js";
 import { i as readMemberships } from "./manifest-iaoBXHKc.js";
 import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
-import { E as hasMemberFor, F as memberForSources, G as quoteLiteral, H as permittedIdsHelper, I as memberForTable, K as quoteTable, L as memberIdsHelper, P as memberForHelper, R as memberRoleOf, U as qualifiedTable, V as permittedForHelper, W as quoteIdent, Z as scopeTypeOf, f as USER_ID_HELPER, h as activeRowSql, it as tenantTypeOf, n as HELPERS, v as checkSuspension } from "./rls-shared-aOQ4hGTO.js";
-import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-BMasREhR.js";
-import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-B5Lkq62W.js";
+import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
+import { D as hasMemberFor, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, K as quoteLiteral, L as memberForTable, Q as scopeTypeOf, R as memberIdsHelper, U as permittedIdsHelper, W as qualifiedTable, at as tenantTypeOf, g as activeRowSql, p as USER_ID_HELPER, q as quoteTable, r as HELPERS, y as checkSuspension, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
+import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-74oZPXWL.js";
+import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-RuFqaqGz.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 /** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
@@ -92,10 +92,25 @@ function isSeedsDirectory(cwd, out) {
 function migrationVersion(now) {
 	return now.toISOString().replaceAll(/[^0-9]/gu, "").slice(0, 14);
 }
+const VERSION_PREFIX = /^\d{14}(?=_)/u;
+/**
+* The version of a new migration that sorts after every migration in
+* `names`: one second past the newest, so the same directory always gives the
+* same name. Only a directory with no versioned migration falls back to `now`.
+*/
+function nextMigrationVersion(names, now) {
+	const times = names.flatMap((name) => {
+		const stamp = VERSION_PREFIX.exec(name)?.[0];
+		return stamp === void 0 ? [] : [Date.UTC(Number(stamp.slice(0, 4)), Number(stamp.slice(4, 6)) - 1, Number(stamp.slice(6, 8)), Number(stamp.slice(8, 10)), Number(stamp.slice(10, 12)), Number(stamp.slice(12, 14)))];
+	});
+	return times.length === 0 ? migrationVersion(now) : migrationVersion(new Date(Math.max(...times) + 1e3));
+}
 /**
 * The seeds part in a migrations directory: the newest migration there that
 * starts with \`marker\` when its text is \`text\` already, otherwise a new
-* \`<version>_permdock_seeds.sql\`. \`current\` is false when a new one is due.
+* \`<version>_permdock_seeds.sql\` one second after the newest migration
+* (\`nextMigrationVersion\`), so a regeneration of the same directory names it
+* the same. \`current\` is false when a new one is due.
 */
 function seedsMigration(cwd, dir, marker, text, now) {
 	const base = dir.endsWith("/") ? dir.slice(0, -1) : dir;
@@ -106,7 +121,7 @@ function seedsMigration(cwd, dir, marker, text, now) {
 		current: true
 	};
 	return {
-		rel: `${base}/${migrationVersion(now)}_permdock_seeds.sql`,
+		rel: `${base}/${nextMigrationVersion(existsSync(path) ? readdirSync(path) : [], now)}_permdock_seeds.sql`,
 		current: false
 	};
 }
@@ -850,6 +865,36 @@ end;
 $$;
 revoke execute on function ${fn}(uuid) from public, anon, authenticated;`;
 }
+/**
+* The PostgREST wrappers `supabase.hook.api` asks for: one `security definer`
+* function per reader, in the API schema, executable by `service_role` only.
+*/
+function apiWrappersSql(parts) {
+	const api = parts.hook.api;
+	if (api === void 0) return "";
+	const target = api.schema ?? "public";
+	const names = hookApiNames(api.prefix);
+	const source = quoteIdent(parts.schema);
+	const wrapper = (name, inner, params, args, types, returns) => {
+		const fn = `${quoteIdent(target)}.${quoteIdent(name)}`;
+		if (target === parts.schema && name === inner) throw new Error(`PermDock CLI: supabase.hook.api would replace ${source}.${inner}: set api.schema or api.prefix`);
+		return `create or replace function ${fn}(${params})
+returns ${returns}
+language sql
+stable
+security definer
+set search_path = ''
+as $$ select ${source}.${inner}(${args}) $$;
+revoke execute on function ${fn}(${types}) from public, anon, authenticated;
+grant execute on function ${fn}(${types}) to service_role;`;
+	};
+	return `-- supabase.hook.api: wrappers in ${quoteIdent(target)} for a backend that reaches the hook schema through the Data API; only service_role may execute them
+${wrapper(names.subjectFor, SUBJECT_FOR, "p_user uuid", "p_user", "uuid", "jsonb")}
+
+${wrapper(names.membersOf, MEMBERS_OF, "p_scope text, p_id text", "p_scope, p_id", "text, text", "jsonb")}
+
+${wrapper(names.authzVersionFor, AUTHZ_VERSION_FOR, "p_user uuid", "p_user", "uuid", "bigint")}`;
+}
 const AUTHZ_VERSION_FOR = "authz_version_for";
 /**
 * `authz_version_for(p_user uuid) returns bigint`: the authorization version
@@ -1618,7 +1663,7 @@ Reads supabase.hook from permdock.config.ts: the fromTable / fromJunction source
 passes as memberships. hook generate emits custom_access_token_hook(jsonb), the grants it
 needs (the ones db diff drops in --grants-out, for declarative schemas), the permdock_authz_version table
 and its triggers. Never grants anything to
-service_role. inspect prints the manifest: helper schema, names and signatures, tenant claim,
+service_role unless supabase.hook.api is set, which grants its wrappers to it. inspect prints the manifest: helper schema, names and signatures, tenant claim,
 budget, the claims the hook writes, the membership sources and the columns that decide them.
 --out writes it as JSON, to permdock.manifest.json without a path; --check exits 1 when that
 file differs.
@@ -1656,6 +1701,7 @@ ${toml}${grantsOut === void 0 ? "" : `\n-- what supabase db diff drops from this
 		subjectForSql(parts, config),
 		authzVersionForSql(parts),
 		membersOfSql(parts),
+		apiWrappersSql(parts),
 		grantsSql(parts),
 		managedSql(parts)
 	].filter((chunk) => chunk !== "").join("\n\n");

package/dist/{supautils-DYZnzRWV.js → supautils-Cn4R4cJ4.js}

@@ -1,4 +1,4 @@
-import { d as group, p as sqlStatements } from "./supabase-config-Bs44dare.js";
+import { d as group, p as sqlStatements } from "./supabase-config-BpPXt3x1.js";
 //#region src/cli/supautils.ts
 /** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
 const RESERVED_ROLES = /* @__PURE__ */ new Set([

package/dist/svelte/index.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/index.js

@@ -2,9 +2,9 @@ import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Ttp0ekMT.js";
+import { t as getStore } from "../context-Bcy85rGi.js";
 import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";

package/dist/svelte/runtime.d.ts

@@ -1,6 +1,6 @@
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as ClientStore } from "../store-D_pjn91-.js";
-import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+import { t as ClientStore } from "../store-jOBYpiXC.js";
+import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-xAr24FEC.js";
 //#region src/svelte/context.d.ts
 export declare function getStore(): ClientStore;
 //#endregion

package/dist/svelte/runtime.js

@@ -1,4 +1,4 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Ttp0ekMT.js";
+import { t as getStore } from "../context-Bcy85rGi.js";
 import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
 export { boundaryDigest, boundaryFallback, getStore, scopedFor, viewFor };

package/dist/svelte/source.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/source.js

@@ -1,7 +1,7 @@
 import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts

package/dist/terminal/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-DAqevpNk.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-DPdqI50v.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { i as isSubject } from "../subject-C6dLxqHU.js";
 import { l as storedApprovalToken, s as resumeDecision } from "../helpers-H_KARDVC.js";

package/dist/testing/index.d.ts

@@ -1,15 +1,15 @@
-import { At as SnapshotSource, C as Policy, Ct as SettingsSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Nr as Principal, Pr as Subject, Pt as TokenSigner, Rt as WhereCompiler, Tt as Snapshot, Wn as ApprovalPolicySource, at as DecisionSink, bn as PolicySource, bt as RelationSource, dt as LimitStore, gt as MembershipSource, jt as SubjectResolver, ln as PermDock, mn as WhereResult, nt as CredentialVerifier, st as EntitlementSource, un as PermDockOptions, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { At as SnapshotSource, C as Policy, Ct as SettingsSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Nr as Principal, Pr as Subject, Pt as TokenSigner, Rt as WhereCompiler, Tt as Snapshot, Wn as ApprovalPolicySource, at as DecisionSink, bn as PolicySource, bt as RelationSource, dt as LimitStore, gt as MembershipSource, jt as SubjectResolver, ln as PermDock, mn as WhereResult, nt as CredentialVerifier, st as EntitlementSource, un as PermDockOptions, xt as RoleSource } from "../policy-IB6yxpC3.js";
 import { f as Permission, g as ResourceInit, u as InferPermissionTree } from "../permissions-DttnqqxC.js";
 import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { f as ApprovalStore } from "../types-aqOHTHcp.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 import { n as SupabaseHookManifest } from "../manifest-uDS9y5de.js";
 import { t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { g as ReplayStore } from "../types-9AWO9EGt.js";
-import { v as DirectoryStore } from "../index-A0YNL8jZ.js";
+import { g as ReplayStore } from "../types-Cq_H8N_X.js";
+import { v as DirectoryStore } from "../index-C8z4RjQV.js";
 import { a as SaasProject } from "../permissions-CDgvKG5L.js";
-import { n as saasPolicy } from "../policy-D8UFyERw.js";
+import { n as saasPolicy } from "../policy-D2W7uv19.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";

package/dist/testing/index.js

@@ -1,14 +1,14 @@
 import { _ as listPermissions, b as resource, n as definePermissions } from "../permissions-DVoF6dMt.js";
 import { r as principal } from "../refs-KYb4ntaz.js";
 import { _ as memoryLimitStore, a as definePolicy, m as role, t as allow } from "../policy-xyWg7QdR.js";
-import { _ as memoryRoleSource, u as snapshotFor } from "../src-CSbUiozF.js";
+import { _ as memoryRoleSource, u as snapshotFor } from "../src-BDwEZWrZ.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { a as normalizeMemberships, d as scopeList } from "../scopes-CVdPrWN-.js";
 import { n as parseSnapshot, p as evaluateCondition } from "../snapshot-Enxd0n-s.js";
 import { i as parsePolicyDocument, r as mergeHostedGrants } from "../hosted-DJQw46hn.js";
-import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-CzqXjCpU.js";
+import { E as approvalPoliciesFor, b as validateCustomRole, t as createPermDock, v as membershipsClaim } from "../permdock-CbgvLnuo.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { n as fromSnapshot } from "../from-snapshot-C3sHpZNS.js";
+import { n as fromSnapshot } from "../from-snapshot-CTLijvdm.js";
 import { o as parseCredential } from "../credential-8P81ff4u.js";
 import { o as problemFromDecision } from "../problem-B43ztKIm.js";
 import { l as APPROVAL_HEADER, r as memoryApprovalStore } from "../store-DMAWwAJV.js";
@@ -17,8 +17,8 @@ import { a as parseApiKey } from "../server-DlZ28Oz5.js";
 import { S as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-BFGBBAqR.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
 import { a as quoteSqlTable, r as quoteSqlIdent, t as SQL_IDENT } from "../sql-xdg5f4Fi.js";
-import { i as saasPermissions } from "../permissions-CpZrivYv.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-Bj_FFkjN.js";
+import { i as saasPermissions } from "../permissions-RJrovw98.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DhpJjnBA.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts
 function isOutcomeCell(value) {

package/dist/testing/saas/index.d.ts

@@ -1,7 +1,7 @@
-import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-CFZAr_Al.js";
+import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-IB6yxpC3.js";
 import { f as Permission } from "../../permissions-DttnqqxC.js";
 import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D8UFyERw.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D2W7uv19.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-Bj_FFkjN.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DhpJjnBA.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.js

@@ -1,2 +1,2 @@
-import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CpZrivYv.js";
+import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
 export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/trpc/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
-import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { a as problemMessage } from "../http-SO7qGttf.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-VnYn2HKq.js";
+import { n as attached } from "../bind-CuzGytRf.js";
 import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{types-C3s9xVJG.d.ts → types-BnIEz1sU.d.ts}

@@ -1,4 +1,4 @@
-import { Ft as TokenVerifier, Tt as Snapshot, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { Ft as TokenVerifier, Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts

package/dist/{types-yF5LmQVD.d.ts → types-C97IskBw.d.ts}

@@ -1,4 +1,4 @@
-import { Nr as Principal, et as AuthEvent } from "./policy-CFZAr_Al.js";
+import { Nr as Principal, et as AuthEvent } from "./policy-IB6yxpC3.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts

package/dist/{types-kxznc7cn.d.ts → types-CKNSyIf_.d.ts}

@@ -1,4 +1,4 @@
-import { Cr as Actor, D as PolicyVocabulary, Nr as Principal, Yn as Decision, kr as Delegation, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { Cr as Actor, D as PolicyVocabulary, Nr as Principal, Yn as Decision, kr as Delegation, ln as PermDock } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 //#region src/client/types.d.ts
 type ClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/{types-9AWO9EGt.d.ts → types-Cq_H8N_X.d.ts}

@@ -1,5 +1,5 @@
-import { Cr as Actor, Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, ct as JwtClaims, et as AuthEvent, gt as MembershipSource } from "./policy-CFZAr_Al.js";
-import { f as ApprovalStore } from "./types-vKyAMtcX.js";
+import { Cr as Actor, Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, ct as JwtClaims, et as AuthEvent, gt as MembershipSource } from "./policy-IB6yxpC3.js";
+import { f as ApprovalStore } from "./types-aqOHTHcp.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{types-BPxgszlT.d.ts → types-DbjRN55U.d.ts}

@@ -1,5 +1,5 @@
-import { n as RoleThrough } from "./types-yF5LmQVD.js";
-import { o as SqlMembershipSource } from "./sources-BcJgw0lt.js";
+import { n as RoleThrough } from "./types-C97IskBw.js";
+import { o as SqlMembershipSource } from "./sources-BdOYLw9j.js";
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -468,6 +468,19 @@ type SupabaseHookConfig = {
   readonly budget?: number;
   /** Keep `permdock_authz_version` and write the `authz_ver` claim. Default `true`. */
   readonly version?: boolean;
+  /**
+   * Write PostgREST wrappers for `subject_for`, `members_of` and
+   * `authz_version_for` into `schema` (default `public`), named
+   * `<prefix>subject_for` and so on (default prefix `permdock_`), for a
+   * backend that reaches Postgres through the Data API while the hook schema
+   * is not exposed. Each wrapper is `security definer`, revoked from
+   * `public`, `anon` and `authenticated`, and granted to `service_role`: the
+   * one place the hook grants to it. Pass the same setting to `postgrestSources`.
+   */
+  readonly api?: {
+    readonly schema?: string;
+    readonly prefix?: string;
+  };
   /** The `jwt_expiry` the printed `config.toml` block sets. Default 900. */
   readonly jwtExpiry?: number;
   /** Suspended users get empty claims. Default `rls.suspension`. */

package/dist/{types-BVyImy5I.d.ts → types-DxiCGmmd.d.ts}

@@ -1,4 +1,4 @@
-import { $n as ExplainedDecision, C as Policy, D as PolicyVocabulary, In as ArazzoPlan, Ln as ArazzoSimulateInput, Mr as Membership, Nr as Principal, Pr as Subject, Yn as Decision, cn as DeriveOptions, fn as SimulateOptions, ln as PermDock, mn as WhereResult, sn as DecideOptions, un as PermDockOptions } from "./policy-CFZAr_Al.js";
+import { $n as ExplainedDecision, C as Policy, D as PolicyVocabulary, In as ArazzoPlan, Ln as ArazzoSimulateInput, Mr as Membership, Nr as Principal, Pr as Subject, Yn as Decision, cn as DeriveOptions, fn as SimulateOptions, ln as PermDock, mn as WhereResult, sn as DecideOptions, un as PermDockOptions } from "./policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {

package/dist/{types-vNSDF7Dq.d.ts → types-QCuYJh4q.d.ts}

@@ -1,4 +1,4 @@
-import { D as PolicyVocabulary, ln as PermDock, rt as DecisionEvent } from "./policy-CFZAr_Al.js";
+import { D as PolicyVocabulary, ln as PermDock, rt as DecisionEvent } from "./policy-IB6yxpC3.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-vKyAMtcX.d.ts → types-aqOHTHcp.d.ts}

@@ -1,4 +1,4 @@
-import { G as Approver, Mr as Membership, Pr as Subject, dr as RelationGrantee, o as ApprovalStage, r as ApprovalMode } from "./policy-CFZAr_Al.js";
+import { G as Approver, Mr as Membership, Pr as Subject, dr as RelationGrantee, o as ApprovalStage, r as ApprovalMode } from "./policy-IB6yxpC3.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-BPxgszlT.js";
+import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-UihESpsJ.js";
+import { n as createCollectScheduler, r as report } from "../watch-DVBJ9cBq.js";
 import { t as peerHint } from "../peer-BOr_kJE1.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-DorAJiU_.js

@@ -0,0 +1,2 @@
+import { t as runUsage } from "./usage-ItS7nLcl.js";
+export { runUsage };

package/dist/{usage-D07N9QJ3.js → usage-GTixvDDU.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/usage.ts
 function usage(ctx) {
@@ -24,7 +24,7 @@ function usage(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./usage-D82l1CwK.js")).runUsage({
+			const result = await (await import("./usage-DorAJiU_.js")).runUsage({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				ignore: listArg(rawArgs, "ignore"),

package/dist/{usage-DG1oeCca.js → usage-ItS7nLcl.js}

@@ -1,10 +1,10 @@
 import { c as getResource } from "./permissions-DVoF6dMt.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
 import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
-import { o as jsonSchemaOf } from "./catalog-doc-Dsc9y7sd.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
 import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { r as runCollect } from "./collect-DSTE3ml9.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{validation-error-CtF23SrC.d.ts → validation-error-Ba264OaJ.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-DAqevpNk.js";
+import { a as ProblemDetails } from "./errors-DPdqI50v.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */

package/dist/vue/index.d.ts

@@ -1,11 +1,11 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-CFZAr_Al.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = {

package/dist/vue/index.js

@@ -1,10 +1,10 @@
 import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-yO0V6gRn.js";
+import { i as isPromiseLike } from "../store-options-ByhZq1jV.js";
 import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-DNyC1y48.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-Cfbvo4DE.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");

package/dist/watch-BwxLTYMZ.js

@@ -0,0 +1,2 @@
+import { n as createCollectScheduler } from "./watch-DVBJ9cBq.js";
+export { createCollectScheduler };