permdock 0.3.1 → 0.4.0

package/dist/{store-options-ByhZq1jV.js → store-options-CbUHDoSe.js}

@@ -1,8 +1,8 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { c as rowIdOf, n as parseSnapshot } from "./snapshot-Enxd0n-s.js";
-import { u as nowSeconds } from "./validity-uOp8UpYn.js";
-import { n as payloadDigest } from "./token-CIWxJOCh.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { f as rowIdOf, n as parseSnapshot } from "./snapshot-Dc9CHPME.js";
+import { c as nowSeconds } from "./tenancy-DshjqY0n.js";
+import { n as payloadDigest } from "./token-Bx9qy30p.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/approvals.ts
 /** Ceiling for the approval poll backoff after a failed status request. */
@@ -692,6 +692,14 @@ function hintOnce() {
 		console.info(`PermDock: ${permission.key} needs the server (a closure, graph relation or period grant) and endpoint is false, so it is denied with reason server-only; check it on the server instead`);
 	};
 }
+/** Runs both hooks: the one the adapter needs first, then the provider option. */
+function both(first, second) {
+	if (first === void 0 || second === void 0) return first ?? second;
+	return (...args) => {
+		first(...args);
+		second(...args);
+	};
+}
 function adapterStore(options, snapshot, native) {
 	return createClientStore(compact({
 		snapshot,
@@ -708,8 +716,9 @@ function adapterStore(options, snapshot, native) {
 		passCache: options.passCache,
 		server: native?.server,
 		stale: native?.stale,
-		onSnapshot: native?.onSnapshot,
-		onClear: native?.onClear
+		onSnapshot: both(native?.onSnapshot, options.onSnapshot),
+		onClear: both(native?.onClear, options.onClear),
+		approvalInterval: options.approvalInterval
 	}));
 }
 //#endregion

package/dist/{stores-BT2pSCub.js → stores-BHXdSbw9.js}

@@ -1,5 +1,5 @@
-import { c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, t as approvalHandle } from "./views-Soe7bGSC.js";
-import { n as providePermDock, t as getStore } from "./context-Bcy85rGi.js";
+import { a as permissionSet, d as tenantView, i as livePermDock, n as describeWith, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "./views-CJsrBS1f.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-DieZVJXu.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {
@@ -23,6 +23,10 @@ function setPermDock(options) {
 function getPermDock() {
 	return sveltePermDock(getStore());
 }
+/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
+function getDescribe() {
+	return describeWith(getUi().messages);
+}
 function permission(reference, data) {
 	return permissionFor(getStore(), reference, data);
 }
@@ -84,4 +88,4 @@ function approvalFor(store, decision) {
 	return fromStore(store, () => approvalHandle(store, decision()));
 }
 //#endregion
-export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, assignablePermissions as r, permission as s, approval as t, setPermDock as u };
+export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/stores-Cxz_80g-.d.ts

@@ -0,0 +1,31 @@
+import { Dr as Membership, ir as Decision } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { r as Role } from "./vocabulary-hhEFLFoL.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-C3ldA9os.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, l as PermissionState, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "./store-9KO4BlkB.js";
+import { n as PermDockSvelteOptions } from "./types-ByUo56un.js";
+import { Readable } from "svelte/store";
+//#region src/svelte/stores.d.ts
+declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
+declare function getPermDock(): ClientPermDock;
+/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
+declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
+declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
+declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
+declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
+declare function tenant(): Readable<TenantView>;
+declare function memberships(): Readable<readonly Membership[]>;
+declare function roles(options?: () => UseRolesOptions): Readable<{
+  readonly roles: readonly Role[];
+}>;
+declare function assignable(): Readable<readonly Role[]>;
+type AssignableOptions = {
+  readonly tenant?: string;
+} | (() => {
+  readonly tenant?: string;
+});
+declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
+declare function subject(): Readable<SubjectView>;
+declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
+//#endregion
+export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/{stream-DDpvynSB.js → stream-BMui98KK.js}

@@ -1,4 +1,4 @@
-import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+import { r as PermDockRevokedError } from "./errors-drnfxYtm.js";
 //#region src/server/stream.ts
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
@@ -22,6 +22,7 @@ async function* guardIterable(source, connection, options) {
 			const next = await Promise.race([iterator.next(), aborted]);
 			if (next.done === true) return next.value;
 			const row = options.unwrap === void 0 ? next.value : options.unwrap(next.value);
+			await Promise.race([connection.settled(), aborted]);
 			if (options.items === void 0 || connection.check(options.items, row).outcome === "granted") yield next.value;
 		}
 	} catch (error) {

package/dist/{stream-D1RXubw2.d.ts → stream-Dwsg6WwE.d.ts}

@@ -1,5 +1,5 @@
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { i as ProtectOptions } from "./create-B1d519XK.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { o as ProtectOptions } from "./server-types-DdqBwZN_.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/{subject-settings-BwBmCdTR.js → subject-settings-CkEwrw3W.js}

@@ -1,3 +1,20 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+//#region src/conditions/peer.ts
+/**
+* Requires an optional peer through `node:module`. Feature-detected so the
+* entry loads on runtimes without a Node module loader; there the caller
+* injects the peer and `message` names the option that does it.
+*/
+function loadPeer(id, message) {
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)(id);
+	} catch {
+		throw new Error(message);
+	}
+}
+//#endregion
 //#region src/conditions/row-check.ts
 const MISSING = Object.freeze({ found: false });
 const GRANTED = Object.freeze({
@@ -24,9 +41,6 @@ function settingName(name, what) {
 	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
 	return name;
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function strings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -120,9 +134,13 @@ function statementText(statement) {
 	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
 	return text;
 }
+/** Strings as a template-strings array, for calling a `sql` tag directly. */
+function templateOf(parts) {
+	return Object.assign([...parts], { raw: [...parts] });
+}
 /** A statement as a template-strings array, for `sql` tags. */
 function statementTemplate(statement) {
-	return Object.assign([...statement.strings], { raw: [...statement.strings] });
+	return templateOf(statement.strings);
 }
 //#endregion
-export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };
+export { rowCheckFrom as a, templateOf as i, statementText as n, rowCheckOf as o, subjectStatements as r, loadPeer as s, statementTemplate as t };

package/dist/supabase/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-IB6yxpC3.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-C97IskBw.js";
+import { Dr as Membership, E as Policy, Sr as CustomRole, X as MemberEntry, Z as MembershipSource, kr as Subject, nt as RoleSource } from "../policy-types-sp9P1iIV.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-CqrjB9o6.js";
 import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BdOYLw9j.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-Dljy06zL.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {

package/dist/supabase/index.js

@@ -1,5 +1,5 @@
-import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-C0qESOa-.js";
+import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-C1TWlnYt.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as fromJunction, i as authzVersion, o as fromSupabasePostgres, s as fromTable, t as AUTHZ_VERSION_TABLE } from "../sources-4p0-4xQm.js";
-import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
+import { a as fromJunction, i as authzVersion, o as fromSupabasePostgres, s as fromTable, t as AUTHZ_VERSION_TABLE } from "../sources-B1-b-R0t.js";
+import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-BngWKryL.js";
 export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };

package/dist/supabase/middleware.d.ts

@@ -1,8 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { n as OpenApiHooks } from "../create-B1d519XK.js";
-import { n as ServerAdapterServices } from "../bind-C_ob3LKa.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, kr as Subject } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
+import { i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
+import { n as ServerAdapterServices } from "../bind-BzqG8SMb.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
@@ -52,6 +53,11 @@ export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = InstanceOptions
   readonly secretKeys?: Readonly<Record<string, SupabaseSecretKey>>;
   readonly subject: (ctx: SupabaseMiddlewareContext, request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly tenant?: string | ((ctx: SupabaseMiddlewareContext, request: Request) => string | undefined | Promise<string | undefined>);
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input.
+   */
+  readonly context?: (ctx: SupabaseMiddlewareContext, request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
 };
 export type WithPermDockConfig = {
   /** Run `protect` before the handler; a denial short-circuits with Problem Details. */

package/dist/supabase/middleware.js

@@ -1,9 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as credentialSubject } from "../credential-8P81ff4u.js";
-import { i as methodNotAllowed } from "../problem-B43ztKIm.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createServerKernel } from "../create-CMwIl-w2.js";
-import { n as attached } from "../bind-CuzGytRf.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { t as composeWraps } from "../wrap-DWsU_5Bd.js";
+import { r as credentialSubject } from "../credential-kue0qpbm.js";
+import { a as methodNotAllowed } from "../problem-CnWraVhC.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createServerKernel } from "../create-BBO24vj6.js";
+import { n as attached } from "../bind-kk-uyCwH.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;
@@ -53,12 +54,14 @@ function createPermDock(policy, options) {
 			return secretKeySubject(secretKeys, ctx) ?? options.subject(ctx, request);
 		},
 		tenant: typeof tenantOption === "function" ? (request) => tenantOption(contextFor(request), request) : tenantOption,
+		context: options.context === void 0 ? void 0 : (request) => options.context?.(contextFor(request), request),
 		...instanceOptions(options),
 		store: options.store,
 		pdp: options.pdp,
 		webBotAuth: options.webBotAuth,
 		adapter: "supabase-middleware",
-		wrap: options.otel
+		wrap: composeWraps(options.otel, options.wrap),
+		onDenied: options.onDenied
 	}));
 	const bind = (request, ctx) => {
 		contexts.set(request, ctx);

package/dist/{supabase-C0qESOa-.js → supabase-C1TWlnYt.js}

@@ -1,13 +1,13 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { o as parseCapability } from "./capability-4qPdO9gk.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
+import { o as parseCapability } from "./capability-txATtKV4.js";
 import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-DMAWwAJV.js";
+import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-ILkLUj_o.js";
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
-import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-4p0-4xQm.js";
-import { i as readMemberships } from "./manifest-iaoBXHKc.js";
+import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
+import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-B1-b-R0t.js";
+import { i as readMemberships } from "./manifest-BngWKryL.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -63,9 +63,6 @@ const KNOWN = /* @__PURE__ */ new Set([
 	"act",
 	"app_metadata"
 ]);
-function isRecord$2(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function own(record, key) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
@@ -84,7 +81,7 @@ function optional(record, key, path, issues, check, expected) {
 }
 const isString = (value) => typeof value === "string";
 function checkMembership(item, path, issues) {
-	if (!isRecord$2(item)) {
+	if (!isRecord(item)) {
 		issue(issues, path, "Expected a membership object");
 		return;
 	}
@@ -99,14 +96,14 @@ function checkMembership(item, path, issues) {
 		"grantedBy",
 		"reason"
 	]) optional(item, key, path, issues, isString, "a string");
-	optional(item, "within", path, issues, (value) => isRecord$2(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
-	optional(item, "on", path, issues, (value) => isRecord$2(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
+	optional(item, "within", path, issues, (value) => isRecord(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
+	optional(item, "on", path, issues, (value) => isRecord(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
 	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
-	optional(item, "member", path, issues, (value) => isRecord$2(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
+	optional(item, "member", path, issues, (value) => isRecord(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
 	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
-	optional(item, "grants", path, issues, isRecord$2, "an object");
+	optional(item, "grants", path, issues, isRecord, "an object");
 	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
 }
 function checkPermDockClaims(record, tenantClaim, path, issues) {
@@ -123,7 +120,7 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 	}
 	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
 	optional(record, tenantClaim, path, issues, isString, "a string");
-	optional(record, "attrs", path, issues, isRecord$2, "an object");
+	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
 /** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
@@ -144,7 +141,7 @@ function checkAct(value, issues) {
 	let current = value;
 	const path = ["act"];
 	while (current !== void 0) {
-		if (!isRecord$2(current)) {
+		if (!isRecord(current)) {
 			issue(issues, path, "Expected an object");
 			return;
 		}
@@ -157,7 +154,7 @@ function checkAct(value, issues) {
 }
 function checkClaims(value, tenantClaim) {
 	const issues = [];
-	if (!isRecord$2(value)) {
+	if (!isRecord(value)) {
 		issue(issues, [], "Expected a claims object");
 		return issues;
 	}
@@ -168,7 +165,7 @@ function checkClaims(value, tenantClaim) {
 	if (act !== void 0) checkAct(act, issues);
 	const meta = own(value, "app_metadata");
 	if (meta !== void 0) {
-		if (isRecord$2(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
+		if (isRecord(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
 		else issue(issues, ["app_metadata"], "Expected an object");
 	}
 	return issues;
@@ -178,8 +175,8 @@ function merge(base, app) {
 	if (issues.length > 0) return { issues };
 	const baseValue = base.value;
 	const appValue = app.value;
-	if (!isRecord$2(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
-	return { value: isRecord$2(baseValue) ? {
+	if (!isRecord(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
+	return { value: isRecord(baseValue) ? {
 		...baseValue,
 		...appValue
 	} : appValue };
@@ -192,9 +189,9 @@ function schemaOf(validate) {
 			validate
 		}),
 		extend(app) {
-			if (!isRecord$2(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const props = Reflect.get(app, "~standard");
-			if (!isRecord$2(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const run = app["~standard"].validate.bind(app["~standard"]);
 			return schemaOf((value) => {
 				const base = validate(value);
@@ -229,14 +226,11 @@ function supabaseClaims(options = {}) {
 function callRpc(client, schema, fn, args) {
 	return client.schema(schema).rpc(fn, args);
 }
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function strings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
 function grantOf(value) {
-	if (!isRecord$1(value) || typeof value["permission"] !== "string") return;
+	if (!isRecord(value) || typeof value["permission"] !== "string") return;
 	return compact({
 		permission: value["permission"],
 		effect: value["effect"] === "deny" ? "deny" : "allow",
@@ -244,7 +238,7 @@ function grantOf(value) {
 	});
 }
 function customRoleOf(value) {
-	if (!isRecord$1(value) || typeof value["name"] !== "string") return;
+	if (!isRecord(value) || typeof value["name"] !== "string") return;
 	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
 		const grant = grantOf(item);
 		return grant === void 0 ? [] : [grant];
@@ -270,7 +264,7 @@ function customRoleOf(value) {
 function readMemberEntries(value) {
 	if (!Array.isArray(value)) return [];
 	return value.flatMap((item) => {
-		if (!isRecord$1(item) || !isRecord$1(item["principal"])) return [];
+		if (!isRecord(item) || !isRecord(item["principal"])) return [];
 		const id = item["principal"]["id"];
 		const [membership] = readMemberships([item["membership"]]).memberships;
 		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
@@ -285,7 +279,7 @@ function versionOf(value) {
 }
 /** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
 function readSubjectRecord(value) {
-	if (!isRecord$1(value) || typeof value["id"] !== "string") return;
+	if (!isRecord(value) || typeof value["id"] !== "string") return;
 	if (value["active"] !== true) return {
 		id: value["id"],
 		active: false,
@@ -410,9 +404,6 @@ function postgrestSources(client, options = {}) {
 }
 //#endregion
 //#region src/supabase/approval-store.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
 function requestOf(value) {
 	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
@@ -527,30 +518,23 @@ function supabaseRls(options = {}) {
 	});
 }
 const ident = (name) => quoteSqlIdent(name);
-const table = (name) => quoteSqlTable(name);
 const literal = quoteSqlLiteral;
-function qualifiedTable(name) {
-	return table(name.includes(".") ? name : `public.${name}`);
-}
 /** The memberships table's role key over alias `m`, joined to its roles table when it holds a reference. */
 function tenantRole(memberships) {
-	return roleColumn(memberships.role, memberships.table.includes(".") ? memberships.table : `public.${memberships.table}`, "m", {
+	return roleColumn(memberships.role, qualifySqlTable(memberships.table), "m", {
 		label: "authorizeSql tenant.role",
 		indent: "      "
 	});
 }
-function textArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(literal).join(", ")}]::text[]`;
-}
 function activeRow(row, id, text = false) {
 	const parts = [`s.${ident(row.id)}${text ? "::text" : ""} = ${id}`];
 	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
 	if (row.status !== void 0) {
 		if (row.active === void 0 || row.active.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(${textArray(row.active)})`);
+		parts.push(`s.${ident(row.status)}::text = any(${sqlTextArray(row.active)})`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
-	return `exists (select 1 from ${qualifiedTable(row.table)} s where ${parts.join(" and ")})`;
+	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
 /**
 * Early `return false` for a suspended user, or a tenant request for a
@@ -565,7 +549,7 @@ function suspendedGuards(suspension, scope, uid) {
 	const tenant = suspension?.scopes?.[scope];
 	if (tenant !== void 0) {
 		const keep = keptKeys(tenant);
-		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${textArray(keep)}))`;
+		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${sqlTextArray(keep)}))`;
 		lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)}${kept} then
     return false; -- suspended ${scope}
   end if;`);
@@ -594,7 +578,7 @@ function disabledLine(memberships, suspension) {
 	if (memberships.disabledAt === void 0) return "";
 	const column = `m.${ident(memberships.disabledAt)}`;
 	const keep = keptKeys(suspension?.memberships);
-	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${textArray(keep)}))`;
+	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${sqlTextArray(keep)}))`;
 }
 function claimKept(suspension) {
 	return keptKeys(suspension?.memberships).length === 0 ? "" : `\n        and case coalesce(jsonb_typeof(m -> 'keep'), 'null') when 'null' then true when 'array' then m -> 'keep' @> jsonb_build_array(requested_permission::text) else false end`;
@@ -605,10 +589,10 @@ function customDatabaseBranch(q, scope, memberships, declared, levels, suspensio
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m${role.join}
+      from ${quoteQualifiedTable(memberships.table)} m${role.join}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(memberships.tenant)} = v_member_tenant
-        and not (${role.sql} = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
+        and not (${role.sql} = any(${sqlTextArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
         and ${customHolds(q, scope, rows("custom_role_permissions", levels ? "permission || coalesce('@' || c.level, '')" : "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
     )`;
 }
@@ -638,7 +622,7 @@ function databaseBody(q, scope, memberships, custom, suspension) {
 		const role = tenantRole(memberships);
 		const held = (effect) => `exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m${role.join}
+      from ${quoteQualifiedTable(memberships.table)} m${role.join}
       join ${q("role_permissions")} rp on rp.role = ${role.sql}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(tenantColumn)} = v_member_tenant
@@ -661,8 +645,8 @@ function databaseBody(q, scope, memberships, custom, suspension) {
 	}
 	return `declare
   uid uuid := (select auth.uid());${memberships !== void 0 && tenantColumn !== void 0 ? `
-  v_member_user ${qualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
-  v_member_tenant ${qualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
+  v_member_user ${quoteQualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
+  v_member_tenant ${quoteQualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
 begin
   if uid is null then
     return false;
@@ -695,7 +679,7 @@ function jwtBody(q, scope, custom, suspension) {
         and m ->> 'id' = requested_tenant
         and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
         and jsonb_typeof(cg.g) = 'array'
-        and not (r.role = any(${textArray(custom.declared)}))
+        and not (r.role = any(${sqlTextArray(custom.declared)}))
         and ${customHolds(q, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
     )`;
 	const held = (effect) => `exists (
@@ -750,7 +734,7 @@ end;`;
 */
 function authorizeSql(options = {}) {
 	const schema = options.schema ?? "permdock";
-	const q = (name) => table(`${schema}.${name}`);
+	const q = (name) => quoteSqlTable(`${schema}.${name}`);
 	const memberships = typeof options.tenant === "object" ? options.tenant : void 0;
 	const scope = options.scope ?? "tenant";
 	if (!/^[a-z][a-z0-9_]*$/u.test(scope)) throw new TypeError(`PermDock: unsafe scope name '${scope}'`);

package/dist/{supabase-s4o9s1O1.js → supabase-Dbqr141s.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/supabase.ts
 function supabase(ctx) {
@@ -61,7 +61,7 @@ function supabase(ctx) {
 			const budget = stringArg(parsed.budget);
 			const schema = stringArg(parsed.schema);
 			const grantsOut = stringArg(parsed["grants-out"]);
-			const { runSupabase } = await import("./supabase-hook-gd3s8bxB.js");
+			const { runSupabase } = await import("./supabase-hook-BULg7Ut_.js");
 			ctx.report(await runSupabase({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/supabase-hook-BULg7Ut_.js

@@ -0,0 +1,2 @@
+import { i as runSupabase } from "./supabase-hook-Cva3ikXz.js";
+export { runSupabase };