permdock 0.3.1 → 0.5.0

package/dist/{store-options-ByhZq1jV.js → store-options-BqEakYRa.js}

@@ -1,9 +1,22 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { c as rowIdOf, n as parseSnapshot } from "./snapshot-Enxd0n-s.js";
-import { u as nowSeconds } from "./validity-uOp8UpYn.js";
-import { n as payloadDigest } from "./token-CIWxJOCh.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { g as secondsOf } from "./time-DkWjdL98.js";
+import { c as rowIdOf } from "./delegation-DaXVdDhM.js";
+import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
+import { n as payloadDigest } from "./token-BLZcjQgt.js";
+import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+import { s as snapshotClaim } from "./where-scope-Dv-WTP-w.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+//#region src/client/source.ts
+/** A compact JWS: three non-empty dot-separated parts. */
+function isJws(value) {
+	const parts = value.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+//#endregion
 //#region src/client/approvals.ts
 /** Ceiling for the approval poll backoff after a failed status request. */
 const APPROVAL_BACKOFF_CAP_MS = 6e4;
@@ -237,16 +250,6 @@ function storeRequest(fetchImpl, headers) {
 	});
 }
 //#endregion
-//#region src/client/source.ts
-/** A compact JWS: three non-empty dot-separated parts. */
-function isJws(value) {
-	const parts = value.split(".");
-	return parts.length === 3 && parts.every((part) => part.length > 0);
-}
-function isPromiseLike(value) {
-	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
-}
-//#endregion
 //#region src/client/store.ts
 function withTenant(source, tenant) {
 	if (tenant === void 0) return source;
@@ -380,11 +383,13 @@ function createClientStore(options) {
 		return "ready";
 	};
 	const isStale = () => {
-		const maxAge = snapshot.issuedAt > 0 ? options.maxAge : void 0;
-		if (snapshot.expiresAt === void 0 && maxAge === void 0) return false;
+		const issuedAt = secondsOf(snapshot.issuedAt) ?? 0;
+		const expiresAt = secondsOf(snapshot.expiresAt);
+		const maxAge = issuedAt > 0 ? options.maxAge : void 0;
+		if (expiresAt === void 0 && maxAge === void 0) return false;
 		const now = nowSeconds();
-		if (snapshot.expiresAt !== void 0 && snapshot.expiresAt <= now) return true;
-		return maxAge !== void 0 && now - snapshot.issuedAt > maxAge;
+		if (expiresAt !== void 0 && expiresAt <= now) return true;
+		return maxAge !== void 0 && now - issuedAt > maxAge;
 	};
 	const serverOnly = () => {
 		hydrate(emptySnapshot());
@@ -401,8 +406,8 @@ function createClientStore(options) {
 	const verifyJws = async (raw) => {
 		if (options.verifier === void 0) return;
 		try {
-			const verified = await options.verifier.verify(raw, { typ: "permdock-snapshot+jwt" });
-			return verified.ok ? verified.claims["snapshot"] : void 0;
+			const verified = await options.verifier.verify(raw, { typ: "vnd.permdock.snapshot+jwt" });
+			return verified.ok ? snapshotClaim(verified.claims) : void 0;
 		} catch {
 			return;
 		}
@@ -565,7 +570,7 @@ function createClientStore(options) {
 					signed = body;
 					body = await verifyJws(body);
 					ok = body !== void 0;
-				}
+				} else if (ok && options.verifier !== void 0) ok = false;
 				refreshing -= 1;
 				if (started !== generation || seq !== refreshSeq) {
 					emit();
@@ -692,6 +697,14 @@ function hintOnce() {
 		console.info(`PermDock: ${permission.key} needs the server (a closure, graph relation or period grant) and endpoint is false, so it is denied with reason server-only; check it on the server instead`);
 	};
 }
+/** Runs both hooks: the one the adapter needs first, then the provider option. */
+function both(first, second) {
+	if (first === void 0 || second === void 0) return first ?? second;
+	return (...args) => {
+		first(...args);
+		second(...args);
+	};
+}
 function adapterStore(options, snapshot, native) {
 	return createClientStore(compact({
 		snapshot,
@@ -708,8 +721,9 @@ function adapterStore(options, snapshot, native) {
 		passCache: options.passCache,
 		server: native?.server,
 		stale: native?.stale,
-		onSnapshot: native?.onSnapshot,
-		onClear: native?.onClear
+		onSnapshot: both(native?.onSnapshot, options.onSnapshot),
+		onClear: both(native?.onClear, options.onClear),
+		approvalInterval: options.approvalInterval
 	}));
 }
 //#endregion

package/dist/{stores-BT2pSCub.js → stores-BbsD4fAR.js}

@@ -1,5 +1,5 @@
-import { c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, t as approvalHandle } from "./views-Soe7bGSC.js";
-import { n as providePermDock, t as getStore } from "./context-Bcy85rGi.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-bbFHR-0D.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {
@@ -23,6 +23,10 @@ function setPermDock(options) {
 function getPermDock() {
 	return sveltePermDock(getStore());
 }
+/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
+function getDescribe() {
+	return describeWith(getUi().messages);
+}
 function permission(reference, data) {
 	return permissionFor(getStore(), reference, data);
 }
@@ -84,4 +88,4 @@ function approvalFor(store, decision) {
 	return fromStore(store, () => approvalHandle(store, decision()));
 }
 //#endregion
-export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, assignablePermissions as r, permission as s, approval as t, setPermDock as u };
+export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/stores-ClZUgeoP.d.ts

@@ -0,0 +1,30 @@
+import { Nn as Decision, nr as Membership } from "./policy-types-DzwivBgR.js";
+import { r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-BNORmDM8.js";
+import { n as SveltePermDockOptions } from "./types-fbZ7JEXr.js";
+import { Readable } from "svelte/store";
+//#region src/svelte/stores.d.ts
+declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
+declare function getPermDock(): ClientPermDock;
+/** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
+declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
+declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
+declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
+declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
+declare function tenant(): Readable<TenantView>;
+declare function memberships(): Readable<readonly Membership[]>;
+declare function roles(options?: () => RolesOptions): Readable<{
+  readonly roles: readonly Role[];
+}>;
+declare function assignable(): Readable<readonly Role[]>;
+type AssignableOptions = {
+  readonly tenant?: string;
+} | (() => {
+  readonly tenant?: string;
+});
+declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
+declare function subject(): Readable<SubjectView>;
+declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
+//#endregion
+export { getDescribe as a, permission as c, setPermDock as d, subject as f, filtered as i, permissions as l, assignable as n, getPermDock as o, tenant as p, assignablePermissions as r, memberships as s, approval as t, roles as u };

package/dist/{stream-D1RXubw2.d.ts → stream-7-xmnf3U.d.ts}

@@ -1,5 +1,5 @@
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { i as ProtectOptions } from "./create-B1d519XK.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/{stream-DDpvynSB.js → stream-CvdUS9V1.js}

@@ -1,4 +1,4 @@
-import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+import { r as PermDockRevokedError } from "./errors-BKy0EfhN.js";
 //#region src/server/stream.ts
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
@@ -22,6 +22,7 @@ async function* guardIterable(source, connection, options) {
 			const next = await Promise.race([iterator.next(), aborted]);
 			if (next.done === true) return next.value;
 			const row = options.unwrap === void 0 ? next.value : options.unwrap(next.value);
+			await Promise.race([connection.settled(), aborted]);
 			if (options.items === void 0 || connection.check(options.items, row).outcome === "granted") yield next.value;
 		}
 	} catch (error) {
@@ -49,6 +50,13 @@ function reloadAfter(loaded, load) {
 }
 /** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
 const POLICY_VIOLATION = 1008;
+/**
+* The close reason for a problem: its PermDock type URI, or its `detail`
+* code for an `about:blank` one. RFC 6455 caps a reason at 123 bytes.
+*/
+function closeReason(problem) {
+	return problem.type === "about:blank" ? problem.detail : problem.type;
+}
 /** The Problem Details for an aborted connection signal. */
 function revokedProblem(signal) {
 	const reason = signal.reason;
@@ -63,4 +71,4 @@ function onRevoked(connection, end) {
 	else connection.signal.addEventListener("abort", fire, { once: true });
 }
 //#endregion
-export { reloadAfter as a, onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };
+export { onRevoked as a, isAsyncIterable as i, closeReason as n, reloadAfter as o, guardIterable as r, POLICY_VIOLATION as t };

package/dist/style-DiKWnAvn.js

@@ -0,0 +1 @@
+export { t as createStyle, n as streamHasColors } from "./style-Uao76wO7.js";

package/dist/{style-CTm1AXDT.js → style-Uao76wO7.js}

@@ -1,12 +1,13 @@
 import { styleText } from "node:util";
-//#region src/cli/style.ts
+//#region src/cli/core/style.ts
 function createStyle(color) {
 	const paint = (format, text) => color ? styleText(format, text, { validateStream: false }) : text;
 	return {
 		color,
 		paint,
 		errorMark: color ? paint("red", "✖") : "error",
-		warnMark: color ? paint("yellow", "⚠") : "warn"
+		warnMark: color ? paint("yellow", "⚠") : "warn",
+		okMark: color ? paint("green", "✔") : "ok"
 	};
 }
 /**

package/dist/subject-BGoM5o8B.js

@@ -0,0 +1,17 @@
+//#region src/core/subject.ts
+function isSubject(value) {
+	return value !== null && typeof value === "object" && "principal" in value && "context" in value && typeof value.context === "object";
+}
+function isActor(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && typeof record.kind === "string";
+}
+function anonymousSubject(context = {}) {
+	return Object.freeze({
+		principal: null,
+		context: Object.freeze({ ...context })
+	});
+}
+//#endregion
+export { isActor as n, isSubject as r, anonymousSubject as t };

package/dist/{subject-settings-BwBmCdTR.js → subject-settings-CkEwrw3W.js}

@@ -1,3 +1,20 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+//#region src/conditions/peer.ts
+/**
+* Requires an optional peer through `node:module`. Feature-detected so the
+* entry loads on runtimes without a Node module loader; there the caller
+* injects the peer and `message` names the option that does it.
+*/
+function loadPeer(id, message) {
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)(id);
+	} catch {
+		throw new Error(message);
+	}
+}
+//#endregion
 //#region src/conditions/row-check.ts
 const MISSING = Object.freeze({ found: false });
 const GRANTED = Object.freeze({
@@ -24,9 +41,6 @@ function settingName(name, what) {
 	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
 	return name;
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function strings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
@@ -120,9 +134,13 @@ function statementText(statement) {
 	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
 	return text;
 }
+/** Strings as a template-strings array, for calling a `sql` tag directly. */
+function templateOf(parts) {
+	return Object.assign([...parts], { raw: [...parts] });
+}
 /** A statement as a template-strings array, for `sql` tags. */
 function statementTemplate(statement) {
-	return Object.assign([...statement.strings], { raw: [...statement.strings] });
+	return templateOf(statement.strings);
 }
 //#endregion
-export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };
+export { rowCheckFrom as a, templateOf as i, statementText as n, rowCheckOf as o, subjectStatements as r, loadPeer as s, statementTemplate as t };

package/dist/supabase/index.d.ts

@@ -1,8 +1,9 @@
-import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-IB6yxpC3.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-C97IskBw.js";
-import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BdOYLw9j.js";
+import { Rt as Instant, ir as Subject } from "../policy-types-DzwivBgR.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-CCpc2Dcv.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-NUqZT-RB.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-CdlxsYQh.js";
+import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-mx5ghSFM.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-BV9j0DeZ.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
@@ -20,7 +21,7 @@ type ExchangeCapabilityOptions = {
   readonly issuer?: string;
   /** Lifetime in seconds, capped by the capability's own expiry. Default 300. */
   readonly ttl?: number;
-  readonly now?: number;
+  readonly now?: Instant;
 };
 /**
  * Exchanges a verified link subject (from `subjectFromCapability`) for a
@@ -30,109 +31,11 @@ type ExchangeCapabilityOptions = {
  */
 export declare function exchangeCapability(subject: Subject, options: ExchangeCapabilityOptions): Promise<string | undefined>;
 //#endregion
-//#region src/supabase/postgrest.d.ts
-/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
-type SupabaseRpcResult = {
-  readonly data: unknown;
-  readonly error: {
-    readonly message: string;
-  } | null;
-};
-/**
- * The part of a supabase-js client `postgrestSources` calls:
- * `client.schema(name).rpc(fn, args)`. Pass a client that may execute the
- * function, such as a `service_role` client after the grant the docs show.
- */
-type SupabaseRpcClient = {
-  schema(name: string): {
-    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
-  };
-};
-type SupabaseRpcCaller = {
-  schema(name: never): {
-    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
-  };
-};
-type PostgrestSourcesOptions = {
-  /**
-   * The `supabase.hook.api` setting the hook file was generated with: the
-   * wrappers live in `schema` (default `public`) as `<prefix>subject_for`,
-   * `<prefix>members_of` and `<prefix>authz_version_for` (default prefix
-   * `permdock_`). It sets the defaults of `schema`, `fn`, `membersFn` and
-   * `versionFn`, which still override it.
-   */
-  readonly api?: {
-    readonly schema?: string;
-    readonly prefix?: string;
-  };
-  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
-  readonly schema?: string;
-  /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
-  readonly fn?: string;
-  readonly membersFn?: string;
-  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
-  readonly versionFn?: string;
-  /**
-   * The policy whose declared roles tell custom roles apart. With it,
-   * `customRoles` reads nothing while every role the subject holds is
-   * declared, and `memberships.version` reads the whole subject in one call
-   * when the token claims a custom role, which the custom roles need anyway.
-   */
-  readonly policy?: Policy;
-};
-/** One user as `subject_for(p_user)` returns it. */
-type SubjectRecord = {
-  readonly id: string;
-  /** `false` for a suspended user, who holds no roles or memberships. */
-  readonly active: boolean;
-  readonly roles: readonly string[];
-  readonly memberships: readonly Membership[];
-  readonly customRoles: readonly CustomRole[];
-  readonly authzVersion?: number;
-};
-type PostgrestSources = {
-  /**
-   * Memberships and the authorization version of any principal, and `list`,
-   * the live members of one scope instance through `members_of`, for
-   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
-   * the token was truncated.
-   */
-  readonly memberships: MembershipSource & {
-    list(query: {
-      readonly scope: string;
-      readonly id: string;
-    }): Promise<MemberEntry[]>;
-  };
-  /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
-  customRoles(principal: {
-    readonly id: string;
-  }): RoleSource;
-  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
-  subject(userId: string): Promise<Subject>;
-  /** The raw record, `undefined` for an unknown user. */
-  record(userId: string): Promise<SubjectRecord | undefined>;
-};
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
-export declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
-/**
- * Membership, custom-role and subject sources over the `subject_for(p_user)`,
- * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
- * `permdock supabase hook generate` writes, for a backend that reaches
- * Postgres only through PostgREST. `memberships.version` reads only the
- * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
- * only for a stale token; when the version function is missing it falls back
- * to `subject_for`. With `policy`, a token that claims a custom role has its
- * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once per
- * `postgrestSources` call, so create it per request or per job.
- */
-export declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
-//#endregion
 //#region src/supabase/approval-store.d.ts
 type SupabaseApprovalStoreOptions = {
   /** Schema of the generated store functions (`rls.schema`). Default `permdock`. */
   readonly schema?: string;
-  /** How long a request stays open when the caller sets no `ttl`, in milliseconds. */
+  /** Seconds a request stays open when the caller sets no `ttl`. */
   readonly ttl?: number;
   /**
    * Runs once per stored request, after the call that stored it, with the
@@ -152,6 +55,20 @@ type SupabaseApprovalStoreOptions = {
  */
 export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
 //#endregion
+//#region src/supabase/approval-delegations.d.ts
+type TableApprovalDelegationSourceOptions = {
+  readonly query: SqlQuery;
+  /** Defaults to `permdock.approval_delegations`, the table `rls.approvals.delegations` generates. */
+  readonly table?: string;
+};
+/**
+ * Approval delegations (out-of-office covers) from the table
+ * `rls.approvals.delegations` generates, so `approvalsHandler` and
+ * `permdock_is_approver` read the same rows. A cover without a tenant
+ * applies everywhere; a malformed row is skipped.
+ */
+export declare function tableApprovalDelegationSource(options: TableApprovalDelegationSourceOptions): ApprovalDelegationSource;
+//#endregion
 //#region src/supabase/rls.d.ts
 export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
 /**
@@ -191,4 +108,4 @@ export declare function subjectFromSupabase(claims: unknown, options?: SupabaseS
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, authzVersion, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };

package/dist/supabase/index.js

@@ -1,5 +1,6 @@
-import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-C0qESOa-.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-Dxlp8A94.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as fromJunction, i as authzVersion, o as fromSupabasePostgres, s as fromTable, t as AUTHZ_VERSION_TABLE } from "../sources-4p0-4xQm.js";
-import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };
+import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-vs5dGOsS.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-CW0IqC-U.js";
+import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,8 +1,10 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { n as OpenApiHooks } from "../create-B1d519XK.js";
-import { n as ServerAdapterServices } from "../bind-C_ob3LKa.js";
+import { T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
+import { i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
+import { n as ServerAdapterServices } from "../bind--9EFVYWF.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
@@ -52,6 +54,11 @@ export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = InstanceOptions
   readonly secretKeys?: Readonly<Record<string, SupabaseSecretKey>>;
   readonly subject: (ctx: SupabaseMiddlewareContext, request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly tenant?: string | ((ctx: SupabaseMiddlewareContext, request: Request) => string | undefined | Promise<string | undefined>);
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Only values the server derived belong here, never client input.
+   */
+  readonly context?: (ctx: SupabaseMiddlewareContext, request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
 };
 export type WithPermDockConfig = {
   /** Run `protect` before the handler; a denial short-circuits with Problem Details. */
@@ -78,5 +85,5 @@ export type SupabaseMiddlewarePermDock<V extends PolicyVocabulary = PolicyVocabu
   readonly permdockHandler: () => SupabaseMiddlewareHandler;
   readonly openapi: OpenApiHooks;
 };
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
 //#endregion

package/dist/supabase/middleware.js

@@ -1,9 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as credentialSubject } from "../credential-8P81ff4u.js";
-import { i as methodNotAllowed } from "../problem-B43ztKIm.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createServerKernel } from "../create-CMwIl-w2.js";
-import { n as attached } from "../bind-CuzGytRf.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { t as composeWraps } from "../wrap-gX61EtpB.js";
+import { r as credentialSubject } from "../credential-DM2um3ha.js";
+import { a as methodNotAllowed } from "../problem-CTviyH5L.js";
+import { r as instanceOptions } from "../build-instance-BMnAudHn.js";
+import { t as createPermDock$1 } from "../create-DnrmLnLW.js";
+import { n as attached } from "../bind-CZzhx-Vj.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;
@@ -21,7 +23,7 @@ function secretKeySubjects(keys, permissions) {
 			roles: [...key.roles],
 			permissions: key.permissions.map((permission) => ({ permission: permission.key })),
 			createdBy: key.id,
-			createdAt: 0,
+			createdAt: "1970-01-01T00:00:00.000Z",
 			name
 		};
 		subjects.set(name, credentialSubject(credential, { permissions }));
@@ -42,23 +44,26 @@ function secretKeySubject(subjects, ctx) {
 	const name = readString(ctx, "authKeyName");
 	return name === void 0 ? void 0 : subjects.get(name);
 }
-function createPermDock(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const contexts = /* @__PURE__ */ new WeakMap();
 	const tenantOption = options.tenant;
 	const contextFor = (request) => contexts.get(request) ?? { jwtClaims: null };
 	const secretKeys = secretKeySubjects(options.secretKeys, policy.permissions);
-	const kernel = createServerKernel(policy, compact({
+	const kernel = createPermDock$1(policy, compact({
 		subject: (request) => {
 			const ctx = contextFor(request);
 			return secretKeySubject(secretKeys, ctx) ?? options.subject(ctx, request);
 		},
 		tenant: typeof tenantOption === "function" ? (request) => tenantOption(contextFor(request), request) : tenantOption,
+		context: options.context === void 0 ? void 0 : (request) => options.context?.(contextFor(request), request),
 		...instanceOptions(options),
 		store: options.store,
 		pdp: options.pdp,
 		webBotAuth: options.webBotAuth,
 		adapter: "supabase-middleware",
-		wrap: options.otel
+		wrap: composeWraps(options.otel, options.wrap),
+		deniedResponse: options.deniedResponse
 	}));
 	const bind = (request, ctx) => {
 		contexts.set(request, ctx);
@@ -69,7 +74,7 @@ function createPermDock(policy, options) {
 		run: (config) => async (request, ctx) => {
 			bind(request, ctx);
 			if (config?.protect === void 0 && config?.oauthScopes === void 0) {
-				const instance = await attached(() => kernel.permdock(request));
+				const instance = await attached(() => kernel.getPermDock(request));
 				return instance.ok ? { permdock: instance.permdock } : instance.response;
 			}
 			const loadData = config.data;