permdock 0.3.1 → 0.5.0

package/dist/better-supabase/index.js

@@ -1,15 +1,647 @@
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { _ as listPermissions, p as isPermission } from "../permissions-DVoF6dMt.js";
-import { d as scopeList } from "../scopes-CVdPrWN-.js";
-import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { t as mayUse } from "../may-use-DndQ5tQ-.js";
-import { o as parseCredential, r as credentialSubject } from "../credential-8P81ff4u.js";
+import { l as asApprover } from "../role-builder-CXbis5-X.js";
+import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-CqPOLD-o.js";
+import { t as loadPrincipal } from "../principal-source-pHneukrx.js";
+import { a as isId, r as idList } from "../expiry-D4_YKRKD.js";
+import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-Br4jSNVi.js";
+import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
+import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "../sha256-D9ihqmvd.js";
+import { t as decideSupportSession } from "../support-session-C6xJQYut.js";
+import { d as scopeList } from "../scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "../grantee-Cn1HyUsI.js";
+import { t as byCodePoint } from "../compare-pfyVnBjE.js";
+import { o as scopesReaching, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
+import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-N1K9IpqS.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-DM2um3ha.js";
+import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
 import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
-import { i as quoteSqlLiteral, o as sqlIdent } from "../sql-xdg5f4Fi.js";
-import "../sources-4p0-4xQm.js";
-import { o as subjectFromSupabaseSession, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
-import { t as parseCatalog } from "../parse-BuyjxhZV.js";
+import { n as subscribersFor } from "../audience-Dg8XsRaO.js";
+import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-B5T1IL83.js";
+import "../sources-vs5dGOsS.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-CW0IqC-U.js";
+import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
+import { t as parseCatalog } from "../parse-Cxq0WxrA.js";
 import { AsyncResult, dbError } from "better-supabase";
+//#region src/better-supabase/access-reviews.ts
+const NOT_MEMBER = "ORGANIZATION_NOT_MEMBER";
+/** The `hint` better-supabase's block functions raise their code in, or the SQLSTATE. */
+function errorCode(error) {
+	if ("hint" in error && typeof error.hint === "string" && error.hint !== "") return error.hint;
+	return "code" in error && typeof error.code === "string" ? error.code : void 0;
+}
+var RpcFailure = class extends Error {
+	code;
+	constructor(fn, error) {
+		super(`${fn}: ${error.message}`);
+		this.code = errorCode(error);
+	}
+};
+/**
+* Whether a member holding `role` at `scope` holds `key` through it. A role
+* the policy does not declare, such as a custom role, counts as holding it.
+*/
+function roleGrants(policy, role, scope, key) {
+	if (!policy.index.declaredRoles.has(role)) return true;
+	return policy.grants.some((grant) => grant.effect === "allow" && grant.permission.key === key && flattenGrantee(grant.to).some((item) => item.kind === "role" && item.role === role && item.scope === scope));
+}
+function fallbackRole(demoteTo, via) {
+	if (demoteTo === void 0 || typeof demoteTo === "string") return demoteTo;
+	for (const role of via) if (Object.hasOwn(demoteTo, role)) return demoteTo[role];
+}
+function invitationsOf(data) {
+	if (!Array.isArray(data)) return [];
+	return data.flatMap((row) => isRecord(row) && typeof row["id"] === "string" && typeof row["email"] === "string" && typeof row["role"] === "string" ? [{
+		id: row["id"],
+		email: row["email"],
+		role: row["role"]
+	}] : []);
+}
+/**
+* Applies the revoked items of an access review to better-supabase's
+* organizations and invitations blocks, then marks each one applied. A
+* revoked member moves to the `demoteTo` role when the policy says that
+* role lacks the permission, and is removed otherwise. With `email`, the
+* tenant's open invitations to the member whose role grants the permission
+* are revoked too. A member who is no longer in the organization counts as
+* applied. Any other error leaves the item unapplied in `failed`, and one
+* item's failure never stops the others. Throws `review-not-found` for an
+* unknown review.
+*/
+function accessReviewApplier(options) {
+	const schema = options.schema ?? "better_supabase";
+	const scope = options.scope ?? options.policy.scopes[0]?.name ?? "tenant";
+	const rpc = async (fn, args) => {
+		const result = await callRpc(options.client, schema, fn, args);
+		if (result.error !== null) throw new RpcFailure(fn, result.error);
+		return result.data;
+	};
+	const changeMember = async (review, item) => {
+		const role = fallbackRole(options.demoteTo, item.via);
+		try {
+			if (role !== void 0 && !roleGrants(options.policy, role, scope, item.permission)) await rpc("update_member_role", {
+				organization: review.tenant,
+				member: item.principal,
+				role
+			});
+			else await rpc("remove_member", {
+				organization: review.tenant,
+				member: item.principal
+			});
+		} catch (error) {
+			if (error instanceof RpcFailure && (error.code === NOT_MEMBER || error.code === "P0002")) return;
+			throw error;
+		}
+	};
+	const revokeInvitations = async (review, item) => {
+		const email = await options.email?.(item.principal);
+		if (email === void 0 || email === null || email === "") return;
+		const wanted = email.toLowerCase();
+		const open = invitationsOf(await rpc("list_organization_invitations", { organization: review.tenant }));
+		await Promise.all(open.filter((invitation) => invitation.email.toLowerCase() === wanted && roleGrants(options.policy, invitation.role, scope, item.permission)).map((invitation) => rpc("revoke_invitation", { invitation_id: invitation.id })));
+	};
+	const stillHeld = async (review, item) => {
+		if (options.permdockFor === void 0) return false;
+		const permission = findPermission(options.policy.permissions, item.permission);
+		if (permission === void 0) throw new Error(`${item.permission} is not in the policy, so the change cannot be checked`);
+		const decide = (await options.permdockFor(item.principal, review.tenant)).decide;
+		return decide(permission).outcome !== "denied";
+	};
+	/** `undefined` once the item is marked applied, else why it is not. */
+	const applyItem = async (review, item) => {
+		try {
+			await changeMember(review, item);
+			await revokeInvitations(review, item);
+			if (await stillHeld(review, item)) return `${item.principal} still holds ${item.permission} after the change`;
+			await options.reviews.markApplied(review.id, item.id, dateAt(options.now).toISOString());
+			return;
+		} catch (error) {
+			return error instanceof Error ? error.message : String(error);
+		}
+	};
+	return async (reviewId) => {
+		const review = await options.reviews.get(reviewId);
+		if (review === null) throw new AccessReviewError("review-not-found", `access review ${reviewId} not found`);
+		const applied = [];
+		const failed = [];
+		let cursor;
+		do {
+			const page = await options.reviews.items({
+				review: reviewId,
+				status: "revoked",
+				...cursor === void 0 ? {} : { cursor }
+			});
+			const pending = page.items.filter((item) => item.appliedAt === void 0);
+			const causes = await Promise.all(pending.map((item) => applyItem(review, item)));
+			for (const [index, item] of pending.entries()) {
+				const cause = causes[index];
+				if (cause === void 0) applied.push(item.id);
+				else failed.push({
+					item: item.id,
+					cause
+				});
+			}
+			cursor = page.next;
+		} while (cursor !== void 0);
+		return {
+			applied,
+			failed
+		};
+	};
+}
+//#endregion
+//#region src/better-supabase/api-keys.ts
+const EPOCH = "1970-01-01T00:00:00.000Z";
+const rfc3339Of = (instant) => isoAt(instant.epochMilliseconds);
+/** When a key stops verifying: its expiry, or the end of a rotated key's grace period. */
+function endOf(key) {
+	const { expiresAt, revokedAt } = key;
+	if (revokedAt === void 0) return expiresAt;
+	if (expiresAt === void 0) return revokedAt;
+	return revokedAt.epochMilliseconds < expiresAt.epochMilliseconds ? revokedAt : expiresAt;
+}
+/** `rls.apiKeys.serviceRoles` from the manifest, when it has `rls.apiKeys`. */
+function manifestServiceRoles(manifest) {
+	return manifest === void 0 ? void 0 : parseSupabaseManifest(manifest).rls.apiKeys?.serviceRoles;
+}
+/**
+* A personal key as a `user` credential acting as its user, a tenant key as
+* a `service` credential holding `roles` in its tenant; `null` when `*`
+* has no expansion, a tenant key has no roles, or the record is invalid.
+*/
+function keyCredential(key, roles, allPermissions) {
+	const scopes = key.scopes.includes("*") ? allPermissions?.map((permission) => permission.key) : key.scopes;
+	if (scopes === void 0) return null;
+	const owner = key.userId;
+	const base = {
+		v: 1,
+		id: key.id,
+		permissions: scopes.map((permission) => ({ permission })),
+		createdBy: key.createdBy ?? owner ?? key.id,
+		createdAt: key.createdAt ?? EPOCH,
+		...key.expiresAt === void 0 ? {} : { expiresAt: key.expiresAt },
+		name: key.name
+	};
+	if (owner !== void 0) return parseCredential({
+		...base,
+		kind: "user",
+		principal: owner,
+		...key.organizationId === void 0 ? {} : { tenant: key.organizationId }
+	}) ?? null;
+	if (roles === void 0 || key.organizationId === void 0) return null;
+	return parseCredential({
+		...base,
+		kind: "service",
+		principal: key.id,
+		tenant: key.organizationId,
+		roles
+	}) ?? null;
+}
+/**
+* better-supabase's API keys as a `CredentialVerifier`, for
+* `subjectFromApiKey` from `permdock/server`, which reads PermDock's
+* `pdk_<id>_<secret>` format: create the keys with `prefix: "pdk"`. The
+* credential id is the key's `publicId`, the id in the token. A personal key
+* is a `user` credential acting as its user (inside its tenant when the key
+* is limited to one), a tenant key a `service` credential holding
+* `serviceRoles` in its tenant, and the key's scopes are the credential's
+* permissions. better-supabase records the use when it verifies, so there is
+* no `touch`. A rotated key in its grace period verifies, and its credential
+* expires when the grace period ends. An invalid, revoked, expired or
+* rate-limited key, and a failed lookup, are `null`. `permdock/server` exports a different
+* `apiKeyVerifier`, over the application's own key records.
+*/
+function apiKeyVerifier(options) {
+	const fallback = manifestServiceRoles(options.manifest);
+	return freezeDeep({ async verify(secret) {
+		try {
+			const checked = await options.keys.verify(secret);
+			if (!checked.ok || checked.data.status !== "ok") return null;
+			const { key } = checked.data;
+			if (key.state !== "active" && key.state !== "grace") return null;
+			const end = endOf(key);
+			const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(key) : options.serviceRoles ?? fallback;
+			return keyCredential({
+				id: key.publicId,
+				name: key.name,
+				scopes: key.scopes,
+				createdAt: rfc3339Of(key.createdAt),
+				...key.organizationId === void 0 ? {} : { organizationId: key.organizationId },
+				...key.userId === void 0 ? {} : { userId: key.userId },
+				...key.createdBy === void 0 ? {} : { createdBy: key.createdBy },
+				...end === void 0 ? {} : { expiresAt: rfc3339Of(end) }
+			}, roles, options.allPermissions);
+		} catch {
+			return null;
+		}
+	} });
+}
+/**
+* The `claim` and `tenantClaim` options of better-supabase's
+* `apiKeyClaims()`, from the manifest's `rls.apiKeys`, so a key's token
+* carries the scopes ceiling, tenant and roles the `rls generate` helpers
+* read. Throws when the manifest has no `rls.apiKeys`.
+*/
+function apiKeyClaimOptions(manifest) {
+	const rls = parseSupabaseManifest(manifest).rls;
+	const apiKeys = rls.apiKeys;
+	if (!apiKeys) throw new TypeError("PermDock: the manifest has no rls.apiKeys. Set rls.apiKeys in permdock.config.ts, then run `permdock rls generate` and `permdock supabase inspect --out`.");
+	return freezeDeep({
+		claim: {
+			name: apiKeys.claim,
+			scopes: apiKeys.scopes,
+			tenant: apiKeys.tenant,
+			roles: apiKeys.roles,
+			serviceRoles: apiKeys.serviceRoles
+		},
+		tenantClaim: rls.tenantClaim
+	});
+}
+//#endregion
+//#region src/better-supabase/subject.ts
+/** `session` with the short codes in `claim` turned back into feature keys. */
+function decodedFeatures(session, claim, keys) {
+	const claims = session?.claims;
+	if (session === null || session === void 0 || !isRecord(claims)) return session;
+	const coded = claims[claim];
+	if (!isRecord(coded)) return session;
+	const byCode = new Map(Object.entries(keys).map(([key, code]) => [code, key]));
+	const decoded = Object.fromEntries(Object.entries(coded).map(([tenant, codes]) => [tenant, Array.isArray(codes) ? codes.flatMap((code) => {
+		const key = typeof code === "string" ? byCode.get(code) : void 0;
+		return key === void 0 ? [] : [key];
+	}) : codes]));
+	return {
+		...session,
+		claims: {
+			...claims,
+			[claim]: decoded
+		}
+	};
+}
+function isApiKeySession(session) {
+	if (typeof session !== "object" || session === null) return false;
+	const record = Object.fromEntries(Object.entries(session));
+	return record["kind"] === "apiKey" && typeof record["keyId"] === "string" && typeof record["name"] === "string" && Array.isArray(record["scopes"]) && record["scopes"].every((scope) => typeof scope === "string");
+}
+function apiKeySubject(session, options) {
+	const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(session) : options.serviceRoles ?? manifestServiceRoles(options.manifest);
+	const credential = keyCredential({
+		id: session.keyId,
+		name: session.name,
+		scopes: session.scopes,
+		...session.organizationId === void 0 ? {} : { organizationId: session.organizationId },
+		...session.userId === void 0 ? {} : { userId: session.userId },
+		...session.createdBy === void 0 ? {} : { createdBy: session.createdBy },
+		...session.createdAt === void 0 || !Number.isFinite(session.createdAt) ? {} : { createdAt: rfc3339(session.createdAt) }
+	}, roles, listPermissions(options.permissions));
+	return credential === null ? anonymousSubject() : credentialSubject(credential, { permissions: options.permissions });
+}
+/**
+* `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
+* `memberships` for the memberships and the entitlements module's `features`
+* claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
+* a verified `apiKey` session is the key's credential subject: a personal key
+* acts as its user within the key's scopes, a tenant key as a `service`
+* principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
+* `service` and `invalid` sessions, the subject is anonymous.
+*/
+function subjectFromBetterSupabase(session, options = {}) {
+	const { apiKeys, plans = "features", claims, ...rest } = options;
+	if (isApiKeySession(session)) return apiKeys === void 0 ? anonymousSubject() : apiKeySubject(session, apiKeys);
+	const claim = typeof plans === "string" ? plans : plans.claim ?? "features";
+	const keys = typeof plans === "string" ? void 0 : plans.keys;
+	return subjectFromSupabaseSession(keys === void 0 ? session : decodedFeatures(session, claim, keys), {
+		...rest,
+		claims: {
+			memberships: "memberships",
+			...claims,
+			plans: claim
+		}
+	});
+}
+//#endregion
+//#region src/better-supabase/subscribers.ts
+function permissionFor(events, type) {
+	if (Object.hasOwn(events, type)) return events[type];
+	let best;
+	for (const pattern of Object.keys(events)) if ((pattern === "*" || pattern.endsWith(".*") && type.startsWith(pattern.slice(0, -1))) && (best === void 0 || pattern.length > best.length)) best = pattern;
+	return best === void 0 ? void 0 : events[best];
+}
+/**
+* The per-subscriber check for better-supabase's webhooks-out, outbox and
+* realtime fan-out: the subscribers whose `principal` `decideFor` grants
+* the event type's permission on its row, in the event's tenant, as the
+* sender. An unmapped type, an event without a tenant or sender, a sender
+* outside the tenant and a throw reach no one.
+*/
+function subscriberPolicy(options) {
+	return async (event, subscribers) => {
+		try {
+			const permission = permissionFor(options.events, event.type);
+			const tenant = event.tenant;
+			const senderId = options.sender?.(event) ?? event.actorId;
+			if (permission === void 0 || tenant === null || senderId === null || senderId === void 0) return [];
+			const sender = await loadPrincipal(options.principals, senderId, tenant);
+			if (sender === null) return [];
+			const permdock = await getPermDock(options.policy, {
+				principal: sender,
+				context: {}
+			}, {
+				...options.options,
+				principals: options.principals,
+				tenant
+			});
+			if (permdock.subject.principal?.tenant !== tenant) return [];
+			return await subscribersFor(permdock, {
+				permission,
+				row: options.row === void 0 ? event.payload : options.row(event)
+			}, subscribers);
+		} catch {
+			return [];
+		}
+	};
+}
+//#endregion
+//#region src/better-supabase/support.ts
+/**
+* Bound to the admin, target, tenant, reason and mode, so the same start
+* gets the same approval token each time.
+*/
+function requestId(input) {
+	return sha256Digest(canonicalJson({
+		t: "better-supabase-support",
+		admin: input.admin.user.id,
+		target: input.targetUserId,
+		tenant: input.tenant ?? null,
+		reason: input.reason,
+		readOnly: input.readOnly
+	}));
+}
+/**
+* The `authorize` option of better-supabase's `supportSessions`: the admin's
+* verified claims become a PermDock subject, and the start is decided with
+* `permdock.decideSupportSession` in the requested tenant. `true` only for
+* `granted`: an `approval-required` start passes once `approved` returns a
+* distinct approver for its token. `readOnly: false` needs `writable`. A
+* throw is `false`.
+*/
+function supportPolicy(options) {
+	return async (input) => {
+		try {
+			const base = await getPermDock(options.policy, subjectFromBetterSupabase({
+				kind: "user",
+				claims: input.admin.claims
+			}, options.subject), options.options);
+			if (base.subject.principal?.id !== input.admin.user.id) return false;
+			if (!input.readOnly && options.writable === void 0) return false;
+			const permdock = input.tenant === void 0 ? base : base.tenant(input.tenant);
+			const request = {
+				id: requestId(input),
+				principal: input.targetUserId,
+				reason: input.reason,
+				...input.tenant === void 0 ? {} : { tenant: input.tenant },
+				...input.readOnly ? {} : { permissions: options.writable },
+				...typeof input.metadata["reference"] === "string" ? { reference: input.metadata["reference"] } : {}
+			};
+			const settings = options.options?.settings;
+			const decide = (approved) => decideSupportSession(permdock, request, {
+				...settings === void 0 ? {} : { settings },
+				...options.approval === false ? { approval: false } : {},
+				...approved === void 0 ? {} : {
+					approved: approved.token,
+					approvedBy: approved.approvedBy
+				}
+			});
+			const decision = await decide();
+			switch (decision.outcome) {
+				case "granted": return true;
+				case "denied": return false;
+				case "approval-required": {
+					const found = await options.approved?.(input, {
+						token: decision.token,
+						session: decision.session
+					});
+					if (found === void 0) return false;
+					return (await decide({
+						token: decision.token,
+						approvedBy: found.approvedBy
+					})).outcome === "granted";
+				}
+				default: return decision;
+			}
+		} catch {
+			return false;
+		}
+	};
+}
+//#endregion
+//#region src/better-supabase/hooks.ts
+/** better-supabase's claim that caps a context to the permission keys it lists. */
+const PERMISSION_CAP_CLAIM = "bs_permission_cap";
+/** Whether `permdock` is granted `key` with no row; an unknown key and `approval-required` are `false`. */
+function grants$1(permdock, key) {
+	const permission = findPermission(permdock.permissions, key);
+	return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
+}
+/** A list matches when every entry does, `anyOf` when one does; other leaves match nobody, as in SQL. */
+function matches(approvers, userId, permdock) {
+	const items = flattenApprovers(approvers);
+	return items.length > 0 && items.every((item) => {
+		switch (item.kind) {
+			case "user": return item.id === userId;
+			case "permission": return grants$1(permdock, item.permission);
+			case "any-of": return item.of.some((entry) => matches(entry, userId, permdock));
+			case "actor":
+			case "anyone":
+			case "assurance":
+			case "authenticated":
+			case "inherit":
+			case "plan":
+			case "relation":
+			case "role": return false;
+			default: return item;
+		}
+	});
+}
+/**
+* better-supabase's `AuthorizationHooks` (`createServer(betterSupabase,
+* { authorization })`), decided by `policy`. Every hook builds the
+* principal's instance from the claims `claims` loads now, never from the
+* request, and fails closed: a throw, an unknown key and `approval-required`
+* refuse. `automation` and `delegation` are always set; `identities`,
+* `delivery`, `approverOf`, `support` and `tickets` only with the options
+* they read. `delegation.permissions` maps each scope to the keys whose
+* `.scope` it is, was renamed from, or that a policy `oauthScopes` entry
+* covers, and reads no `authorization_details`.
+*/
+function authorizationHooks(options) {
+	const { policy } = options;
+	const instance = async (claims, tenant) => {
+		const subject = subjectFromBetterSupabase({
+			kind: "user",
+			claims
+		}, options.subject);
+		if (subject.principal === null) return null;
+		const permdock = await getPermDock(policy, subject, {
+			...options.options,
+			...tenant === null || tenant === void 0 ? {} : { tenant }
+		});
+		return tenant === null || tenant === void 0 || permdock.subject.principal?.tenant === tenant ? permdock : null;
+	};
+	const holdsAll = async (claims, automation) => {
+		const permdock = await instance(claims, automation.tenant);
+		return permdock !== null && automation.permissions.every((key) => grants$1(permdock, key));
+	};
+	const claimsOf = async (userId, tenant) => {
+		const claims = await options.claims(userId, tenant === null || tenant === void 0 ? {} : { tenant });
+		return isRecord(claims) && claims["sub"] === userId ? claims : null;
+	};
+	const automation = {
+		async mayPublish(ref) {
+			try {
+				return ref.publisher !== null && await holdsAll(ref.claims, ref);
+			} catch {
+				return false;
+			}
+		},
+		async runAs(ref) {
+			try {
+				const claims = ref.publisher === null ? await options.service?.(ref.tenant) : await claimsOf(ref.publisher, ref.tenant);
+				if (!isRecord(claims) || !await holdsAll(claims, ref)) return null;
+				return Object.freeze({
+					...claims,
+					[PERMISSION_CAP_CLAIM]: [...ref.permissions]
+				});
+			} catch {
+				return null;
+			}
+		}
+	};
+	const delegation = { permissions(ref) {
+		try {
+			const scopes = new Set(ref.scopes);
+			return listPermissions(policy.permissions).filter((permission) => scopesReaching(policy, permission).some((scope) => scopes.has(scope))).map((permission) => permission.key);
+		} catch {
+			return [];
+		}
+	} };
+	const { principals, events, approvers, support, tickets } = options;
+	const approverOf = approvers === void 0 ? void 0 : async (approver, request) => {
+		try {
+			if (approver.userId === request.requester || !Object.hasOwn(approvers, request.kind)) return false;
+			const given = approvers[request.kind];
+			if (given === void 0 || approver.claims["sub"] !== approver.userId) return false;
+			const permdock = await instance(approver.claims, request.tenant);
+			return permdock !== null && matches(asApprover(given), approver.userId, permdock);
+		} catch {
+			return false;
+		}
+	};
+	const identities = principals?.principalByIdentity === void 0 ? void 0 : { async principalByIdentity(identity) {
+		try {
+			const found = await principals.principalByIdentity?.(identity);
+			if (found === null || found === void 0) return null;
+			return found.kind === "contact" ? {
+				kind: "contact",
+				contactId: found.id
+			} : {
+				kind: "user",
+				userId: found.id
+			};
+		} catch {
+			return null;
+		}
+	} };
+	const fanOut = principals === void 0 || events === void 0 ? void 0 : subscriberPolicy({
+		policy,
+		principals,
+		events,
+		...options.row === void 0 ? {} : { row: options.row },
+		...options.options === void 0 ? {} : { options: options.options }
+	});
+	return Object.freeze({
+		apiVersion: 1,
+		name: "PermDock",
+		automation: Object.freeze(automation),
+		delegation: Object.freeze(delegation),
+		...approverOf === void 0 ? {} : { approverOf },
+		...identities === void 0 ? {} : { identities: Object.freeze(identities) },
+		...fanOut === void 0 ? {} : { delivery: Object.freeze({
+			subscribers: fanOut,
+			audience: fanOut
+		}) },
+		...support === void 0 ? {} : { support: Object.freeze({ authorize: supportPolicy({
+			...support,
+			policy
+		}) }) },
+		...tickets === void 0 ? {} : { tickets: Object.freeze({ async subject(ticket) {
+			try {
+				const found = await tickets(ticket);
+				if (!isRecord(found) || typeof found.userId !== "string") return null;
+				const claims = await claimsOf(found.userId, found.tenant);
+				return claims === null ? null : {
+					claims,
+					...found.tenant === void 0 ? {} : { tenant: found.tenant }
+				};
+			} catch {
+				return null;
+			}
+		} }) }
+	});
+}
+//#endregion
+//#region src/better-supabase/approvers.ts
+/** `rls.approvals`' approver check, executable by `authenticated`. */
+const IS_APPROVER = "permdock_is_approver";
+/** The resource a cover's `resources` names for a request kind: `job` for `job.update`, else the kind. */
+function resourceOf(kind) {
+	const dot = kind.indexOf(".");
+	return dot <= 0 ? kind : kind.slice(0, dot);
+}
+/**
+* better-supabase's `isApprover` template: one `case` over `{kind}` whose
+* branches call `permdock_is_approver` with the kind's approvers as JSON.
+* A kind with no branch is `false`. Only `user`, `holder` and `anyOf`
+* approvers match in SQL; other leaves are reported and match nobody.
+*/
+function isApproverTemplate(input) {
+	const problems = [];
+	if (!input.listed) return { problems: [`approvers needs ${input.schema}.${IS_APPROVER}, which \`permdock rls generate\` writes with rls.approvals. Run it, then \`permdock supabase inspect --out\`.`] };
+	const fn = `${sqlIdent(input.schema)}.${sqlIdent(IS_APPROVER)}`;
+	const keys = input.catalog === void 0 ? void 0 : new Set(input.catalog.permissions.map((permission) => permission.key));
+	const branches = [];
+	for (const [kind, given] of Object.entries(input.approvers)) {
+		if (kind === "") {
+			problems.push("approvers has an empty kind, which no request has.");
+			continue;
+		}
+		const approvers = asApprover(given);
+		for (const leaf of approverLeaves(approvers)) {
+			if (leaf.kind === "user") continue;
+			if (leaf.kind !== "permission") problems.push(`The ${kind} approvers name a ${leaf.kind} approver, which ${IS_APPROVER} cannot check in SQL, so it matches nobody. Use user(), holder() or anyOf().`);
+			else if (keys !== void 0 && !keys.has(leaf.permission)) problems.push(`The ${kind} approver permission ${leaf.permission} is not in the catalog. Run \`permdock catalog\` after adding it to the policy.`);
+		}
+		const json = `${quoteSqlLiteral(JSON.stringify(approvers))}::jsonb`;
+		branches.push(input.covers === true ? `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text, ({requester})::text, ${quoteSqlLiteral(resourceOf(kind))})` : `when ${quoteSqlLiteral(kind)} then ${fn}(${json}, ({tenant})::text)`);
+	}
+	if (branches.length === 0) {
+		problems.push("approvers names no kind, so isApprover is not set.");
+		return { problems };
+	}
+	if (!input.rootTenant) problems.push(`The tenant scope "${input.tenantScope}" is not a root scope, and ${IS_APPROVER} checks holder() approvers at the root scope, so they match nobody.`);
+	return {
+		template: `case {kind} ${branches.join(" ")} else false end`,
+		requires: {
+			function: fn,
+			args: input.covers === true ? "jsonb, text, text, text" : "jsonb, text",
+			role: "postgres"
+		},
+		problems
+	};
+}
+//#endregion
 //#region src/better-supabase/provider.ts
 /**
 * The helper each template calls (with `{scope}` unfilled), its default
@@ -91,6 +723,13 @@ const ASSIGN_ANY = {
 	}
 };
 const listedName = (entry) => entry.listedAs ?? entry.helper;
+/**
+* No client role may execute `permitted_<scope>_users`, so `holdersOf` is
+* required for `postgres`, inside better-supabase's `security definer`
+* functions; better-supabase fills it for the tenant scope only.
+*/
+const HOLDERS_OF = "permitted_{scope}_users";
+const ACTOR_MAY_WRITE = "permdock_actor_may_write";
 const OPTIONAL = [
 	"idsWithFor",
 	"isPlatformFor",
@@ -100,10 +739,16 @@ const OPTIONAL = [
 	"canAssignFor",
 	"permissionsFor"
 ];
-/** Postgres aliases of the id types better-supabase reads (`uuid`, `text`, `bigint`, `integer`). */
+/**
+* Postgres aliases of the id types better-supabase reads (`uuid`, `text`,
+* `bigint`, `integer`), matching its `moduleIdType` from
+* `better-supabase/sql`, which this runtime entry does not import.
+*/
 const ID_TYPES = {
 	uuid: "uuid",
 	text: "text",
+	varchar: "text",
+	"character varying": "text",
 	bigint: "bigint",
 	int8: "bigint",
 	integer: "integer",
@@ -198,17 +843,97 @@ function tokenHookOf(manifest) {
 			hook: `-- permdock:hook ${manifest.markers.hook}`,
 			grants: `-- permdock:grants ${manifest.markers.grants}`
 		},
-		grantsCommand: `permdock supabase hook generate --grants-out supabase/migrations/<timestamp>_permdock_hook_grants.sql`
+		grantsCommand: grantsCommandOf(manifest.hook.schemas ?? "pg-delta")
 	};
 }
+/** The command better-supabase doctor prints when the hook lacks its grants. */
+function grantsCommandOf(schemas) {
+	switch (schemas) {
+		case "pg-delta": return "permdock supabase hook generate && supabase db schema declarative sync -f permdock_hook";
+		case "migra": return "permdock supabase hook generate --grants-out supabase/migrations/<timestamp>_permdock_hook_grants.sql";
+		case "migrations": return "permdock supabase hook generate --out supabase/migrations/<timestamp>_permdock_hook.sql";
+		default: return schemas;
+	}
+}
+/**
+* better-supabase's `permitted` template. An instance of a scope (`{resource}`
+* names the scope) is checked against that scope's ids; any other resource
+* at the tenant, and with a catalog only for a key without row conditions.
+* Without a catalog better-supabase refuses every key anyway.
+*/
+function permittedTemplate(schema, scopes, tenantScope, catalog) {
+	const idsOf = (scope) => `select ids::text from ${schema}.${sqlIdent(`permitted_${scope}_ids_by_permission`)}({permission}) as ids`;
+	const branches = scopes.map((scope) => `when {resource} = ${quoteSqlLiteral(scope)} then {id} in (${idsOf(scope)})`);
+	const atTenant = `{tenant} in (${idsOf(tenantScope)})`;
+	const complete = catalog?.permissions.filter((permission) => !permission.rowConditions).map((permission) => quoteSqlLiteral(permission.key));
+	const otherwise = complete === void 0 ? atTenant : complete.length === 0 ? `false and ${atTenant}` : `{permission} in (${complete.join(", ")}) and ${atTenant}`;
+	return `case ${branches.join(" ")} else ${otherwise} end`;
+}
+const RISKS = {
+	low: "low",
+	medium: "medium",
+	high: "high",
+	critical: "high"
+};
+const EFFECTS = {
+	read: "read",
+	write: "write",
+	delete: "delete",
+	send: "external",
+	spend: "external",
+	external: "external"
+};
+/**
+* The catalog's `defineOperations` entries as better-supabase operations. A
+* name with a `.` is used as written (`workflow.node.http`); any other is
+* the tool `ai.tool.<name>` and `mcp.tool.<name>`. `critical` risk is
+* `high`, and `send` and `spend` effects are `external`.
+*/
+function operationsOf(catalog) {
+	const operations = {};
+	for (const operation of catalog.operations ?? []) {
+		const effects = [...new Set((operation.meta.effects ?? []).map((effect) => EFFECTS[effect]))];
+		const meta = {
+			...operation.meta.risk === void 0 ? {} : { risk: RISKS[operation.meta.risk] },
+			...effects.length > 0 ? { effects } : {},
+			...operation.meta.title === void 0 ? {} : { title: operation.meta.title }
+		};
+		const entry = {
+			permission: operation.permission,
+			...Object.keys(meta).length > 0 ? { meta } : {}
+		};
+		const names = operation.name.includes(".") ? [operation.name] : [`ai.tool.${operation.name}`, `mcp.tool.${operation.name}`];
+		for (const name of names) operations[name] = entry;
+	}
+	return operations;
+}
+/**
+* better-supabase's `delegation.scopes`: each permission's own scope, and
+* each coarse scope the catalog's `oauthScopes` lists, to the permission keys
+* it reaches, sorted by code point. A key the catalog does not list is
+* dropped, so a stale `oauthScopes` entry grants nothing.
+*/
+function delegatedScopes(catalog) {
+	const delegated = {};
+	const known = /* @__PURE__ */ new Set();
+	for (const permission of catalog?.permissions ?? []) {
+		known.add(permission.key);
+		(delegated[permission.scope] ??= /* @__PURE__ */ new Set()).add(permission.key);
+	}
+	for (const entry of catalog?.oauthScopes ?? []) for (const key of entry.permissions) if (known.has(key)) (delegated[entry.scope] ??= /* @__PURE__ */ new Set()).add(key);
+	return Object.fromEntries(Object.keys(delegated).toSorted(byCodePoint).map((scope) => [scope, [...delegated[scope] ?? []].toSorted(byCodePoint)]));
+}
 /**
 * better-supabase's `authorization` config value, built from PermDock's
 * manifest and catalog: the scopes, the `rls generate` helpers as SQL
 * templates, the membership tables, suspension rows, the token hook and
 * every catalog key with `sqlComplete` set from its `rowConditions`. A
 * `_for` template and `permissionsFor` are set only when the manifest lists
-* their helper, which `rls.mode: 'database'` writes; `canApprove` only with
-* `approver`. Throws when the manifest or catalog is invalid, or when the
+* their helper, which `rls.mode: 'database'` writes; `isApprover` only with
+* `approvers` and `permdock_is_approver`, and otherwise `canApprove` only
+* with `approver`. `holdersOf` (`permitted_<tenant scope>_users`) and
+* `actorMayWrite` (`permdock_actor_may_write()`) are set when the manifest
+* lists their helper. Throws when the manifest or catalog is invalid, or when the
 * tenant scope is ambiguous.
 */
 function authorizationProvider(options) {
@@ -264,25 +989,60 @@ function authorizationProvider(options) {
 	const users = rls.suspension?.users;
 	const tenants = rls.suspension?.scopes?.[tenantScope];
 	const approver = options.approver;
-	let canApprove;
-	if (approver !== void 0) {
-		if (catalog !== void 0 && !catalog.permissions.some((permission) => permission.key === approver.key)) problems.push(`The approver permission ${approver.key} is not in the catalog. Run \`permdock catalog\` after adding it to the policy.`);
-		const name = `permitted_${tenantScope}_ids_by_permission`;
-		canApprove = `{tenant} in (select ${schema}.${sqlIdent(name)}(${quoteSqlLiteral(approver.key)}))`;
+	const approvers = approver === void 0 ? options.approvers : {
+		"ai-tool": holder(approver),
+		...options.approvers
+	};
+	let isApprover;
+	if (approvers !== void 0) {
+		const built = isApproverTemplate({
+			approvers,
+			schema: rls.schema,
+			listed: helpers.has(IS_APPROVER),
+			covers: /\bp_requester\b/u.test(helpers.get("permdock_is_approver")?.args ?? ""),
+			tenantScope,
+			rootTenant,
+			catalog
+		});
+		problems.push(...built.problems);
+		isApprover = built.template;
+		if (built.requires !== void 0) requires.push(built.requires);
+	}
+	const holdersName = HOLDERS_OF.replace("{scope}", tenantScope);
+	const holders = helpers.get(holdersName);
+	let holdersOf;
+	if (holders !== void 0) {
+		const fn = `${schema}.${sqlIdent(holders.name)}`;
+		holdersOf = `${fn}({permission}, {tenant})`;
 		requires.push({
-			function: `${schema}.${sqlIdent(name)}`,
-			args: "text",
+			function: fn,
+			args: argTypes(holders.args),
 			role: "postgres"
 		});
 	}
+	let actorMayWrite;
+	if (helpers.has(ACTOR_MAY_WRITE)) {
+		const fn = `${schema}.${sqlIdent(ACTOR_MAY_WRITE)}`;
+		actorMayWrite = `${fn}()`;
+		requires.push({
+			function: fn,
+			role: "authenticated"
+		});
+	}
+	const permitted = listed("idsWith", tenantScope) ? permittedTemplate(schema, scopeNames.filter((scope) => listed("idsWith", scope)), tenantScope, catalog) : void 0;
 	const functions = {
 		...optional,
 		idsWith: `${schema}.${TEMPLATES.idsWith.sql}`,
 		isPlatform: `${schema}.${TEMPLATES.isPlatform.sql}`,
-		...canApprove === void 0 ? {} : { canApprove }
+		...holdersOf === void 0 ? {} : { holdersOf },
+		...actorMayWrite === void 0 ? {} : { actorMayWrite },
+		...isApprover === void 0 ? {} : { isApprover },
+		...permitted === void 0 ? {} : { permitted }
 	};
+	const operations = catalog === void 0 ? {} : operationsOf(catalog);
+	const delegated = delegatedScopes(catalog);
 	const scopes = rls.scopes.map((scope) => {
-		const idType = ID_TYPES[scope.type.trim().toLowerCase()];
+		const idType = ID_TYPES[scope.type.trim().toLowerCase().replaceAll(/\s+/gu, " ")];
 		if (idType === void 0) problems.push(`Scope "${scope.name}" has ids of type ${scope.type}; better-supabase reads uuid, text, bigint and integer ids.`);
 		return scope.within === void 0 ? {
 			name: scope.name,
@@ -307,13 +1067,114 @@ function authorizationProvider(options) {
 			...tenants ? { tenant: disabledRow(tenants) } : {}
 		} } : {},
 		...roleSources.length > 0 ? { roleSources } : {},
-		...canApprove === void 0 ? {} : { approvals: { distinctApprover: true } },
+		...Object.keys(operations).length > 0 ? { operations } : {},
+		...Object.keys(delegated).length > 0 ? { delegation: { scopes: delegated } } : {},
 		decidingColumns: manifest.decidingColumns,
 		tokenHook: tokenHookOf(manifest),
 		...problems.length > 0 ? { problems } : {}
 	});
 }
 //#endregion
+//#region src/better-supabase/authorizer.ts
+const OPERATIONS = /* @__PURE__ */ new Set([
+	"list",
+	"get",
+	"create",
+	"update",
+	"delete"
+]);
+const denied = (reason) => ({
+	outcome: "denied",
+	reason
+});
+function outcomeOf(decision, key) {
+	switch (decision.outcome) {
+		case "granted": return { outcome: "granted" };
+		case "approval-required": return {
+			outcome: "approval-required",
+			approval: { id: decision.token }
+		};
+		case "denied": {
+			const why = decision.denials[0]?.reason;
+			return denied(why === void 0 ? `PermDock denied ${key}.` : `PermDock denied ${key}: ${why}.`);
+		}
+		default: return decision;
+	}
+}
+function decideWith(permdock, request) {
+	const { action } = request;
+	if (!isPermission(action)) return denied("Unknown permission.");
+	return outcomeOf(permdock.decide(action, request.resource.properties), action.key);
+}
+/** The verified claims better-supabase passes in `subject.properties.claims`, for a user or a delegated agent. */
+function claimsOf(request) {
+	const { subject } = request;
+	if (subject.type !== "user" && subject.type !== "agent") return void 0;
+	const claims = subject.properties?.["claims"];
+	return isRecord(claims) ? claims : void 0;
+}
+/**
+* better-supabase's `authorizer` for PermDock: every resource, action, route
+* guard and MCP tool that declares a `permission` is decided with `decide`.
+* The subject is mapped from the verified claims with
+* `subjectFromBetterSupabase`; the request's `context.tenant` selects the
+* active tenant only among the memberships the claims hold. A caller without
+* claims is anonymous, and a throw denies.
+*/
+function authorizer(options) {
+	const { operations } = options;
+	const instanceFor = async (claims, tenant) => {
+		const session = claims === void 0 ? null : {
+			kind: "user",
+			claims
+		};
+		const base = await getPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), options.options);
+		return typeof tenant === "string" ? base.tenant(tenant) : base;
+	};
+	return Object.freeze({
+		apiVersion: 1,
+		name: "PermDock",
+		key(ref) {
+			if (!isPermission(ref)) throw new TypeError("Not a PermDock permission");
+			return ref.key;
+		},
+		...operations === void 0 ? {} : { forOperation(table, operation) {
+			if (!OPERATIONS.has(operation) || !Object.hasOwn(operations, table)) return void 0;
+			return operations[table]?.[operation];
+		} },
+		async evaluate(request) {
+			try {
+				return decideWith(await instanceFor(claimsOf(request), request.context["tenant"]), request);
+			} catch {
+				return denied("The permission check failed.");
+			}
+		},
+		evaluations(requests) {
+			const cache = /* @__PURE__ */ new Map();
+			const shared = (claims, tenant) => {
+				let byTenant = cache.get(claims);
+				if (byTenant === void 0) {
+					byTenant = /* @__PURE__ */ new Map();
+					cache.set(claims, byTenant);
+				}
+				let instance = byTenant.get(tenant);
+				if (instance === void 0) {
+					instance = instanceFor(claims, tenant);
+					byTenant.set(tenant, instance);
+				}
+				return instance;
+			};
+			return Promise.all(requests.map(async (request) => {
+				try {
+					return decideWith(await shared(claimsOf(request), request.context["tenant"]), request);
+				} catch {
+					return denied("The permission check failed.");
+				}
+			}));
+		}
+	});
+}
+//#endregion
 //#region src/better-supabase/policies.ts
 /** PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the policies it generates. */
 const SPLIT_KEY = /#\d+$/u;
@@ -401,113 +1262,6 @@ function topicPolicy(access, options) {
 	});
 }
 //#endregion
-//#region src/better-supabase/api-keys.ts
-const seconds = (instant) => Math.floor(instant.epochMilliseconds / 1e3);
-/** When a key stops verifying: its expiry, or the end of a rotated key's grace period. */
-function endOf(key) {
-	const { expiresAt, revokedAt } = key;
-	if (revokedAt === void 0) return expiresAt;
-	if (expiresAt === void 0) return revokedAt;
-	return revokedAt.epochMilliseconds < expiresAt.epochMilliseconds ? revokedAt : expiresAt;
-}
-/** `rls.apiKeys.serviceRoles` from the manifest, when it has `rls.apiKeys`. */
-function manifestServiceRoles(manifest) {
-	return manifest === void 0 ? void 0 : parseSupabaseManifest(manifest).rls.apiKeys?.serviceRoles;
-}
-/**
-* A personal key as a `user` credential acting as its user, a tenant key as
-* a `service` credential holding `roles` in its tenant; `null` when `*`
-* has no expansion, a tenant key has no roles, or the record is invalid.
-*/
-function keyCredential(key, roles, allPermissions) {
-	const scopes = key.scopes.includes("*") ? allPermissions?.map((permission) => permission.key) : key.scopes;
-	if (scopes === void 0) return null;
-	const owner = key.userId;
-	const base = {
-		v: 1,
-		id: key.id,
-		permissions: scopes.map((permission) => ({ permission })),
-		createdBy: key.createdBy ?? owner ?? key.id,
-		createdAt: key.createdAt ?? 0,
-		...key.expiresAt === void 0 ? {} : { expiresAt: key.expiresAt },
-		name: key.name
-	};
-	if (owner !== void 0) return parseCredential({
-		...base,
-		kind: "user",
-		principal: owner,
-		...key.organizationId === void 0 ? {} : { tenant: key.organizationId }
-	}) ?? null;
-	if (roles === void 0 || key.organizationId === void 0) return null;
-	return parseCredential({
-		...base,
-		kind: "service",
-		principal: key.id,
-		tenant: key.organizationId,
-		roles
-	}) ?? null;
-}
-/**
-* better-supabase's API keys as a `CredentialVerifier`, for
-* `subjectFromApiKey` from `permdock/server`, which reads PermDock's
-* `pdk_<id>_<secret>` format: create the keys with `prefix: "pdk"`. The
-* credential id is the key's `publicId`, the id in the token. A personal key
-* is a `user` credential acting as its user (inside its tenant when the key
-* is limited to one), a tenant key a `service` credential holding
-* `serviceRoles` in its tenant, and the key's scopes are the credential's
-* permissions. better-supabase records the use when it verifies, so there is
-* no `touch`. A rotated key in its grace period verifies, and its credential
-* expires when the grace period ends. An invalid, revoked, expired or
-* rate-limited key, and a failed lookup, are `null`. `permdock/server` exports a different
-* `apiKeyVerifier`, over the application's own key records.
-*/
-function apiKeyVerifier(options) {
-	const fallback = manifestServiceRoles(options.manifest);
-	return freezeDeep({ async verify(secret) {
-		try {
-			const checked = await options.keys.verify(secret);
-			if (!checked.ok || checked.data.status !== "ok") return null;
-			const { key } = checked.data;
-			if (key.state !== "active" && key.state !== "grace") return null;
-			const end = endOf(key);
-			const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(key) : options.serviceRoles ?? fallback;
-			return keyCredential({
-				id: key.publicId,
-				name: key.name,
-				scopes: key.scopes,
-				createdAt: seconds(key.createdAt),
-				...key.organizationId === void 0 ? {} : { organizationId: key.organizationId },
-				...key.userId === void 0 ? {} : { userId: key.userId },
-				...key.createdBy === void 0 ? {} : { createdBy: key.createdBy },
-				...end === void 0 ? {} : { expiresAt: seconds(end) }
-			}, roles, options.allPermissions);
-		} catch {
-			return null;
-		}
-	} });
-}
-/**
-* The `claim` and `tenantClaim` options of better-supabase's
-* `apiKeyClaims()`, from the manifest's `rls.apiKeys`, so a key's token
-* carries the scopes ceiling, tenant and roles the `rls generate` helpers
-* read. Throws when the manifest has no `rls.apiKeys`.
-*/
-function apiKeyClaimOptions(manifest) {
-	const rls = parseSupabaseManifest(manifest).rls;
-	const apiKeys = rls.apiKeys;
-	if (!apiKeys) throw new TypeError("PermDock: the manifest has no rls.apiKeys. Set rls.apiKeys in permdock.config.ts, then run `permdock rls generate` and `permdock supabase inspect --out`.");
-	return freezeDeep({
-		claim: {
-			name: apiKeys.claim,
-			scopes: apiKeys.scopes,
-			tenant: apiKeys.tenant,
-			roles: apiKeys.roles,
-			serviceRoles: apiKeys.serviceRoles
-		},
-		tenantClaim: rls.tenantClaim
-	});
-}
-//#endregion
 //#region src/better-supabase/credentials.ts
 /**
 * `provider` with every `getToken`, `startAuthorization`,
@@ -577,7 +1331,7 @@ function toolPolicy(options) {
 			const permission = tool.meta;
 			if (!isPermission(permission)) return false;
 			try {
-				return mayUse(await options.permdock(ctx), permission);
+				return (await options.permdock(ctx)).mayUse(permission);
 			} catch {
 				return false;
 			}
@@ -585,64 +1339,153 @@ function toolPolicy(options) {
 	});
 }
 //#endregion
-//#region src/better-supabase/subject.ts
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-/** `session` with the short codes in `claim` turned back into feature keys. */
-function decodedFeatures(session, claim, keys) {
-	const claims = session?.claims;
-	if (session === null || session === void 0 || !isRecord(claims)) return session;
-	const coded = claims[claim];
-	if (!isRecord(coded)) return session;
-	const byCode = new Map(Object.entries(keys).map(([key, code]) => [code, key]));
-	const decoded = Object.fromEntries(Object.entries(coded).map(([tenant, codes]) => [tenant, Array.isArray(codes) ? codes.flatMap((code) => {
-		const key = typeof code === "string" ? byCode.get(code) : void 0;
-		return key === void 0 ? [] : [key];
-	}) : codes]));
-	return {
-		...session,
-		claims: {
-			...claims,
-			[claim]: decoded
-		}
+//#region src/better-supabase/principals.ts
+/**
+* A `PrincipalSource` over better-supabase: `principal(id)` maps the claims
+* `claims` loads with `subjectFromBetterSupabase`, and `principalByIdentity`
+* follows `identities` to a user or a contact. Claims for another user, a
+* link to a non-contact principal and a missing link are `null`.
+*/
+function principalSource(options) {
+	const principal = async (id, lookup = {}) => {
+		const claims = await options.claims(id, lookup.tenant === void 0 ? {} : { tenant: lookup.tenant });
+		if (!isRecord(claims)) return null;
+		const found = subjectFromBetterSupabase({
+			kind: "user",
+			claims
+		}, options.subject).principal;
+		return found?.id === id ? freezeDeep(structuredClone(found)) : null;
 	};
+	const { identities } = options;
+	return Object.freeze({
+		principal,
+		...identities === void 0 ? {} : { async principalByIdentity(identity) {
+			const link = await identities(identity);
+			if (!isRecord(link)) return null;
+			if ("user" in link) return typeof link.user === "string" ? principal(link.user) : null;
+			const contact = link.contact;
+			return isRecord(contact) && contact.kind === "contact" ? freezeDeep(structuredClone(contact)) : null;
+		} }
+	});
 }
-function isApiKeySession(session) {
-	if (typeof session !== "object" || session === null) return false;
-	const record = Object.fromEntries(Object.entries(session));
-	return record["kind"] === "apiKey" && typeof record["keyId"] === "string" && typeof record["name"] === "string" && Array.isArray(record["scopes"]) && record["scopes"].every((scope) => typeof scope === "string");
+//#endregion
+//#region src/better-supabase/share-links.ts
+const DEFAULT_TTL = 300;
+const MAX_TTL = 3600;
+function ownEntry(record, key) {
+	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
-function apiKeySubject(session, options) {
-	const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(session) : options.serviceRoles ?? manifestServiceRoles(options.manifest);
-	const credential = keyCredential({
-		id: session.keyId,
-		name: session.name,
-		scopes: session.scopes,
-		...session.organizationId === void 0 ? {} : { organizationId: session.organizationId },
-		...session.userId === void 0 ? {} : { userId: session.userId },
-		...session.createdBy === void 0 ? {} : { createdBy: session.createdBy },
-		...session.createdAt === void 0 ? {} : { createdAt: session.createdAt }
-	}, roles, listPermissions(options.permissions));
-	return credential === null ? anonymousSubject() : credentialSubject(credential, { permissions: options.permissions });
+function isRow(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const row = Object.fromEntries(Object.entries(value));
+	const expiresAt = row["expiresAt"];
+	return isId(row["id"]) && isId(row["organizationId"]) && isId(row["subjectType"]) && isId(row["subjectId"]) && typeof row["role"] === "string" && (row["versionId"] === void 0 || typeof row["versionId"] === "string") && (expiresAt === void 0 || typeof expiresAt === "object" && expiresAt !== null && "epochMilliseconds" in expiresAt && typeof expiresAt.epochMilliseconds === "number" && Number.isFinite(expiresAt.epochMilliseconds));
 }
 /**
-* `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
-* `memberships` for the memberships and the entitlements module's `features`
-* claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
-* a verified `apiKey` session is the key's credential subject: a personal key
-* acts as its user within the key's scopes, a tenant key as a `service`
-* principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
-* `service` and `invalid` sessions, the subject is anonymous.
+* Resolves a better-supabase share-link token into the `link` subject it
+* acts as, for `exchangeCapability` and `--capabilities` RLS. The row is
+* read on every call, so a revoked or expired link stops resolving at
+* once. An unknown token, subject type or role, a malformed row, a broken
+* link policy, a `resolve` error and a throw are the anonymous subject. So
+* is a link pinned to a version: a capability grants the subject's current
+* rows, so a pinned link reads through `versions.getShared(token)` instead.
 */
-function subjectFromBetterSupabase(session, options = {}) {
-	const { apiKeys, plans = "features", ...rest } = options;
-	if (isApiKeySession(session)) return apiKeys === void 0 ? anonymousSubject() : apiKeySubject(session, apiKeys);
-	const claim = typeof plans === "string" ? plans : plans.claim ?? "features";
-	const keys = typeof plans === "string" ? void 0 : plans.keys;
-	return subjectFromSupabaseSession(keys === void 0 ? session : decodedFeatures(session, claim, keys), {
-		memberships: "memberships",
-		...rest,
-		plans: claim
-	});
+async function subjectFromShareLink(token, options) {
+	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
+	const deny = (reason, cause) => {
+		options.onAuth?.(compact({
+			reason,
+			cause,
+			source: "share-link",
+			requestId: options.requestId
+		}));
+		return anonymousSubject();
+	};
+	let row;
+	try {
+		const resolved = await options.shareLinks.resolve(token);
+		if (!resolved.ok) return deny("source-threw", "resolve-failed");
+		if (resolved.data === null) return deny("invalid-token", "share-link-unknown");
+		if (!isRow(resolved.data)) return deny("schema", "share-link-malformed");
+		row = resolved.data;
+	} catch {
+		return deny("source-threw");
+	}
+	if (row.versionId !== void 0) return deny("invalid-token", "share-link-pinned");
+	const target = ownEntry(options.links, row.subjectType);
+	if (target === void 0) return deny("invalid-token", "subject-type-unknown");
+	const roles = idList(ownEntry(target.roles, row.role));
+	if (roles === void 0 || roles.length === 0) return deny("unknown-role");
+	const now = nowSeconds(options.now);
+	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
+	const rowExpiry = row.expiresAt === void 0 ? Number.POSITIVE_INFINITY : Math.floor(row.expiresAt.epochMilliseconds / 1e3);
+	const expiresAt = Math.min(now + ttl, rowExpiry);
+	if (expiresAt <= now) return deny("invalid-token", "expired");
+	let capability;
+	try {
+		capability = capabilityOf({
+			id: row.id,
+			on: {
+				resource: target.resource,
+				id: row.subjectId
+			},
+			roles,
+			expiresAt
+		});
+	} catch {
+		return deny("schema", "invalid-claims");
+	}
+	try {
+		const policy = await options.linkPolicy?.(capability, row);
+		if (policy !== void 0 && linkPolicyViolation(capability, policy, void 0) !== void 0) return deny("invalid-token", "link-policy");
+	} catch {
+		return deny("source-threw");
+	}
+	return capabilitySubject(capability);
+}
+//#endregion
+//#region src/better-supabase/workflow.ts
+/** Whether `permdock` is granted the permission `key` (a catalog key or scope) with no row. */
+function grants(permdock, key) {
+	try {
+		const permission = findPermission(permdock.permissions, key);
+		return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
+	} catch {
+		return false;
+	}
+}
+/**
+* The `can` option of better-supabase's `authorizeHook`, for the caller's
+* `permdock`: `true` only when the caller is a member of the hook's tenant
+* and `decide` grants the permission its `hookMetadata` names there. An
+* unknown key, `approval-required` and a throw are `false`.
+*/
+function hookCan(permdock) {
+	return (tenant, key) => {
+		try {
+			return permdock.tenants().includes(tenant) && grants(permdock.tenant(tenant), key);
+		} catch {
+			return false;
+		}
+	};
+}
+/**
+* The `can` option of better-supabase's `protectWebHandler`: `undefined`
+* (401) when the request has no signed-in principal or `getPermDock`
+* throws, otherwise whether `decide` grants the permission in the request's
+* active tenant. An unknown key and `approval-required` are `false` (403).
+*/
+function handlerCan(source) {
+	return async (request, key) => {
+		let permdock;
+		try {
+			permdock = await source.getPermDock(request);
+		} catch {
+			return;
+		}
+		if (permdock.subject.principal === null) return;
+		return grants(permdock, key);
+	};
 }
 //#endregion
-export { apiKeyClaimOptions, apiKeyVerifier, authorizationProvider, bucketPolicy, credentialGuard, subjectFromBetterSupabase, toolPolicy, topicPolicy };
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalSource, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };