permdock 0.3.1 → 0.5.0

package/dist/supabase-9pqI57pW.js

@@ -0,0 +1,92 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/supabase.ts
+const hookGenerate = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write",
+			valueHint: "file"
+		},
+		...checkFlag,
+		...dbUrlFlags,
+		"active-from": {
+			type: "string",
+			description: "Where the hook reads the active tenant",
+			valueHint: "source"
+		},
+		budget: {
+			type: "string",
+			description: "Byte budget for the memberships claim",
+			valueHint: "bytes"
+		},
+		schema: {
+			type: "string",
+			description: "Schema for the hook function",
+			valueHint: "name"
+		},
+		schemas: {
+			type: "enum",
+			options: [
+				"pg-delta",
+				"migra",
+				"migrations"
+			],
+			description: "Schema workflow (default supabase.schemas, else pg-delta)"
+		},
+		"grants-out": {
+			type: "string",
+			description: "migra: file for the privileges supabase db diff drops",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const out = fileOut("supabase hook generate", flags.out);
+		const db = await dbUrl(ctx, flags);
+		const activeFrom = given(flags["active-from"]);
+		const budget = given(flags.budget);
+		const schema = given(flags.schema);
+		const grantsOut = given(flags["grants-out"]);
+		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		return runSupabase({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["hook", "generate"],
+			check: flags.check,
+			json: ctx.json,
+			io: ctx.io,
+			...out === void 0 ? {} : { out },
+			...db === void 0 ? {} : { db },
+			...activeFrom === void 0 ? {} : { activeFrom },
+			...budget === void 0 ? {} : { budget },
+			...schema === void 0 ? {} : { schema },
+			...grantsOut === void 0 ? {} : { grantsOut },
+			...flags.schemas === void 0 ? {} : { schemas: flags.schemas }
+		});
+	}
+});
+const inspect = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write; a bare --out writes permdock.manifest.json",
+			valueHint: "file"
+		},
+		...checkFlag
+	},
+	async run(ctx, { flags }) {
+		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
+		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		return runSupabase({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["inspect"],
+			check: flags.check,
+			json: ctx.json,
+			io: ctx.io,
+			...out === void 0 ? {} : { out }
+		});
+	}
+});
+//#endregion
+export { hookGenerate, inspect };

package/dist/{supabase-C0qESOa-.js → supabase-Dxlp8A94.js}

@@ -1,13 +1,14 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { o as parseCapability } from "./capability-4qPdO9gk.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-DMAWwAJV.js";
-import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { s as ApprovalError } from "./types-DqzsnlSA.js";
+import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-4u_hxjWa.js";
+import { a as parseCapability } from "./capability-N1K9IpqS.js";
+import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
-import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-4p0-4xQm.js";
-import { i as readMemberships } from "./manifest-iaoBXHKc.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
+import { t as callRpc } from "./postgrest-CW0IqC-U.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -29,15 +30,19 @@ async function exchangeCapability(subject, options) {
 	if (principal === null || principal.kind !== "link") return;
 	const capability = parseCapability(principal["capability"]);
 	if (capability?.holder !== "link" || capability.id !== principal.id) return;
-	const now = Math.floor(options.now ?? Date.now() / 1e3);
+	const now = nowSeconds(options.now);
 	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
 	const exp = Math.min(now + ttl, Math.floor(capability.expiresAt));
 	if (exp <= now) return;
+	const { id: _id, expiresAt: _expiresAt, cnf: _cnf, ...claim } = capability;
 	const jose = await loadJose();
 	const key = isSecret(options.key) ? new TextEncoder().encode(options.key.secret) : await jose.importJWK(options.key, alg);
 	const jwt = new jose.SignJWT({
 		role: "anon",
-		capability
+		capability: {
+			...claim,
+			expires_at: exp
+		}
 	}).setProtectedHeader(secret ? {
 		alg: "HS256",
 		typ: "JWT"
@@ -63,9 +68,6 @@ const KNOWN = /* @__PURE__ */ new Set([
 	"act",
 	"app_metadata"
 ]);
-function isRecord$2(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function own(record, key) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
@@ -84,7 +86,7 @@ function optional(record, key, path, issues, check, expected) {
 }
 const isString = (value) => typeof value === "string";
 function checkMembership(item, path, issues) {
-	if (!isRecord$2(item)) {
+	if (!isRecord(item)) {
 		issue(issues, path, "Expected a membership object");
 		return;
 	}
@@ -96,17 +98,17 @@ function checkMembership(item, path, issues) {
 		"tenant",
 		"team",
 		"via",
-		"grantedBy",
+		"granted_by",
 		"reason"
 	]) optional(item, key, path, issues, isString, "a string");
-	optional(item, "within", path, issues, (value) => isRecord$2(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
-	optional(item, "on", path, issues, (value) => isRecord$2(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
-	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
-	optional(item, "member", path, issues, (value) => isRecord$2(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
-	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
+	optional(item, "within", path, issues, (value) => isRecord(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
+	optional(item, "on", path, issues, (value) => isRecord(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
+	optional(item, "expires_at", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
+	optional(item, "member", path, issues, (value) => isRecord(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
+	optional(item, "managed_by", path, issues, (value) => value === "idp", "'idp'");
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
-	optional(item, "grants", path, issues, isRecord$2, "an object");
+	optional(item, "grants", path, issues, isRecord, "an object");
 	if (!(own(item, "scope") !== void 0 && own(item, "id") !== void 0 || own(item, "tenant") !== void 0 || own(item, "team") !== void 0 || own(item, "on") !== void 0)) issue(issues, path, "Expected scope and id, tenant, team or on");
 }
 function checkPermDockClaims(record, tenantClaim, path, issues) {
@@ -123,17 +125,23 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 	}
 	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
 	optional(record, tenantClaim, path, issues, isString, "a string");
-	optional(record, "attrs", path, issues, isRecord$2, "an object");
+	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
-/** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
+/** The outer level's `kind`: none, `support` with a `session_id`, `impersonation`, or `agent` with optional `tools` and `read_only` and no `session_id`. */
 function checkActKind(level, path, issues) {
 	const marked = own(level, "kind");
 	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
 	optional(level, "reason", path, issues, isString, "a string");
 	if (kind === void 0 || kind === "impersonation") return;
+	if (kind === "agent") {
+		if (own(level, "session_id") !== void 0) issue(issues, [...path, "session_id"], "Expected no session_id on an agent level");
+		optional(level, "tools", path, issues, (value) => isStrings(value) && value.every((tool) => tool !== ""), "an array of non-empty strings");
+		optional(level, "read_only", path, issues, (value) => typeof value === "boolean", "a boolean");
+		return;
+	}
 	if (kind !== "support") {
-		issue(issues, [...path, "kind"], "Expected 'support' or 'impersonation'");
+		issue(issues, [...path, "kind"], "Expected 'support', 'impersonation' or 'agent'");
 		return;
 	}
 	const session = own(level, "session_id");
@@ -144,7 +152,7 @@ function checkAct(value, issues) {
 	let current = value;
 	const path = ["act"];
 	while (current !== void 0) {
-		if (!isRecord$2(current)) {
+		if (!isRecord(current)) {
 			issue(issues, path, "Expected an object");
 			return;
 		}
@@ -157,7 +165,7 @@ function checkAct(value, issues) {
 }
 function checkClaims(value, tenantClaim) {
 	const issues = [];
-	if (!isRecord$2(value)) {
+	if (!isRecord(value)) {
 		issue(issues, [], "Expected a claims object");
 		return issues;
 	}
@@ -168,7 +176,7 @@ function checkClaims(value, tenantClaim) {
 	if (act !== void 0) checkAct(act, issues);
 	const meta = own(value, "app_metadata");
 	if (meta !== void 0) {
-		if (isRecord$2(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
+		if (isRecord(meta)) checkPermDockClaims(meta, tenantClaim, ["app_metadata"], issues);
 		else issue(issues, ["app_metadata"], "Expected an object");
 	}
 	return issues;
@@ -178,8 +186,8 @@ function merge(base, app) {
 	if (issues.length > 0) return { issues };
 	const baseValue = base.value;
 	const appValue = app.value;
-	if (!isRecord$2(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
-	return { value: isRecord$2(baseValue) ? {
+	if (!isRecord(appValue)) return { issues: [{ message: "Expected the extension to output an object" }] };
+	return { value: isRecord(baseValue) ? {
 		...baseValue,
 		...appValue
 	} : appValue };
@@ -192,9 +200,9 @@ function schemaOf(validate) {
 			validate
 		}),
 		extend(app) {
-			if (!isRecord$2(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord(app) && typeof app !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const props = Reflect.get(app, "~standard");
-			if (!isRecord$2(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
+			if (!isRecord(props) || typeof props["validate"] !== "function") throw new TypeError("PermDock: supabaseClaims().extend needs a Standard Schema");
 			const run = app["~standard"].validate.bind(app["~standard"]);
 			return schemaOf((value) => {
 				const base = validate(value);
@@ -225,194 +233,7 @@ function supabaseClaims(options = {}) {
 	});
 }
 //#endregion
-//#region src/supabase/postgrest.ts
-function callRpc(client, schema, fn, args) {
-	return client.schema(schema).rpc(fn, args);
-}
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function strings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-function grantOf(value) {
-	if (!isRecord$1(value) || typeof value["permission"] !== "string") return;
-	return compact({
-		permission: value["permission"],
-		effect: value["effect"] === "deny" ? "deny" : "allow",
-		level: typeof value["level"] === "string" ? value["level"] : void 0
-	});
-}
-function customRoleOf(value) {
-	if (!isRecord$1(value) || typeof value["name"] !== "string") return;
-	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
-		const grant = grantOf(item);
-		return grant === void 0 ? [] : [grant];
-	}) : [];
-	const includes = strings(value["includes"]);
-	const body = {
-		name: value["name"],
-		grants,
-		...includes.length === 0 ? {} : { includes }
-	};
-	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
-		...body,
-		scope: "global"
-	} : void 0;
-	if (typeof value["tenant"] !== "string") return;
-	return compact({
-		...body,
-		tenant: value["tenant"],
-		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
-		id: typeof value["id"] === "string" ? value["id"] : void 0
-	});
-}
-function readMemberEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((item) => {
-		if (!isRecord$1(item) || !isRecord$1(item["principal"])) return [];
-		const id = item["principal"]["id"];
-		const [membership] = readMemberships([item["membership"]]).memberships;
-		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
-			principal: { id },
-			membership
-		}] : [];
-	});
-}
-function versionOf(value) {
-	const version = typeof value === "string" ? Number(value) : value;
-	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
-}
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
-function readSubjectRecord(value) {
-	if (!isRecord$1(value) || typeof value["id"] !== "string") return;
-	if (value["active"] !== true) return {
-		id: value["id"],
-		active: false,
-		roles: [],
-		memberships: [],
-		customRoles: []
-	};
-	const version = value["authzVersion"];
-	return compact({
-		id: value["id"],
-		active: true,
-		roles: strings(value["roles"]),
-		memberships: readMemberships(value["memberships"]).memberships,
-		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
-			const role = customRoleOf(item);
-			return role === void 0 ? [] : [role];
-		}) : [],
-		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
-	});
-}
-/**
-* Membership, custom-role and subject sources over the `subject_for(p_user)`,
-* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
-* subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
-*/
-function postgrestSources(client, options = {}) {
-	const api = options.api;
-	const names = api === void 0 ? void 0 : hookApiNames(api.prefix);
-	const schema = options.schema ?? (api === void 0 ? "permdock" : api.schema ?? "public");
-	const fn = options.fn ?? names?.subjectFor ?? "subject_for";
-	const membersFn = options.membersFn ?? names?.membersOf ?? "members_of";
-	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
-	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
-	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const loaded = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const listed = /* @__PURE__ */ new Map();
-	const list = (query) => {
-		const key = JSON.stringify([query.scope, query.id]);
-		const cached = listed.get(key);
-		if (cached !== void 0) return cached.then((entries) => [...entries]);
-		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
-			p_scope: query.scope,
-			p_id: query.id
-		})).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
-			return readMemberEntries(result.data);
-		});
-		listed.set(key, pending);
-		return pending.then((entries) => [...entries]);
-	};
-	const record = (userId) => {
-		const cached = loaded.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
-			return readSubjectRecord(result.data);
-		});
-		loaded.set(userId, pending);
-		return pending;
-	};
-	const version = (userId) => {
-		const read = loaded.get(userId);
-		if (read !== void 0) return read.then((found) => found?.authzVersion);
-		const cached = versions.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
-		versions.set(userId, pending);
-		return pending;
-	};
-	const live = async (userId) => {
-		const found = await record(userId);
-		return found?.active === true ? found : void 0;
-	};
-	return {
-		memberships: {
-			async membershipsFor(principal) {
-				return [...(await live(principal.id))?.memberships ?? []];
-			},
-			version(principal) {
-				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
-			},
-			list
-		},
-		customRoles(principal) {
-			return {
-				async rolesFor(tenant, context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
-				},
-				async globalRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
-				}
-			};
-		},
-		async subject(userId) {
-			const found = await live(userId);
-			if (found === void 0) return {
-				principal: null,
-				context: {}
-			};
-			return {
-				principal: compact({
-					id: found.id,
-					roles: found.roles,
-					memberships: found.memberships,
-					authzVersion: found.authzVersion
-				}),
-				context: {}
-			};
-		},
-		record
-	};
-}
-//#endregion
 //#region src/supabase/approval-store.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 /** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
 function requestOf(value) {
 	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
@@ -465,10 +286,10 @@ function supabaseApprovalStore(client, options = {}) {
 			if (written === null) throw new ApprovalError("approval-not-pending", "approval is not pending");
 			return written;
 		},
-		async consume(token, now = /* @__PURE__ */ new Date()) {
+		async consume(token, now) {
 			return requestOf(await call("permdock_approval_consume", {
 				p_token: token,
-				p_now: now.toISOString()
+				p_now: dateAt(now).toISOString()
 			}));
 		},
 		async list(query) {
@@ -492,8 +313,8 @@ function supabaseApprovalStore(client, options = {}) {
 				next: encodeApprovalCursor(last)
 			} : { items };
 		},
-		async expire(now = /* @__PURE__ */ new Date()) {
-			const count = await call("permdock_approval_expire", { p_now: now.toISOString() });
+		async expire(now) {
+			const count = await call("permdock_approval_expire", { p_now: dateAt(now).toISOString() });
 			return typeof count === "number" ? count : 0;
 		},
 		async cancel(filter, meta) {
@@ -501,13 +322,76 @@ function supabaseApprovalStore(client, options = {}) {
 				p_filter: filterOf(filter),
 				p_by: meta.by,
 				p_note: meta.note ?? null,
-				p_now: (/* @__PURE__ */ new Date()).toISOString()
+				p_now: isoNow()
 			});
 			return typeof count === "number" ? count : 0;
 		}
 	};
 }
 //#endregion
+//#region src/supabase/approval-delegations.ts
+function rowsOf(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+function instant(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? void 0 : value.toISOString();
+	if (typeof value !== "string") return;
+	const ms = Date.parse(value);
+	return Number.isNaN(ms) ? void 0 : isoAt(ms);
+}
+function list(value) {
+	if (value === null || value === void 0) return;
+	if (!Array.isArray(value)) return false;
+	const items = [];
+	for (const item of value) {
+		if (typeof item !== "string") return false;
+		items.push(item);
+	}
+	return items;
+}
+function delegationOf(row) {
+	const { id, delegator, delegate, tenant } = row;
+	const from = instant(row["from"]);
+	const until = instant(row["until"]);
+	const permissions = list(row["permissions"]);
+	const resources = list(row["resources"]);
+	if (typeof id !== "string" || typeof delegator !== "string" || typeof delegate !== "string" || tenant !== null && typeof tenant !== "string" || from === void 0 || until === void 0 || permissions === false || resources === false) return;
+	return {
+		id,
+		delegator,
+		delegate,
+		...typeof tenant === "string" ? { tenant } : {},
+		...permissions === void 0 ? {} : { permissions },
+		...resources === void 0 ? {} : { resources },
+		from,
+		until
+	};
+}
+/**
+* Approval delegations (out-of-office covers) from the table
+* `rls.approvals.delegations` generates, so `approvalsHandler` and
+* `permdock_is_approver` read the same rows. A cover without a tenant
+* applies everywhere; a malformed row is skipped.
+*/
+function tableApprovalDelegationSource(options) {
+	const table = quoteQualifiedTable(options.table ?? "permdock.approval_delegations");
+	return {
+		name: "table",
+		async delegationsFor(query) {
+			const values = [query.delegate, query.at];
+			let tenant = "d.tenant is null";
+			if (query.tenant !== void 0) {
+				values.push(query.tenant);
+				tenant = "(d.tenant is null or d.tenant = $3)";
+			}
+			return rowsOf(await options.query(`select d.id::text as id, d.delegator::text as delegator, d.delegate::text as delegate, d.tenant::text as tenant, d.permissions, d.resources, d."from", d."until" from ${table} d where d.delegate::text = $1 and d."from" <= $2::timestamptz and $2::timestamptz < d."until" and ${tenant} order by d.id`, values)).flatMap((row) => {
+				const entry = delegationOf(row);
+				return entry === void 0 ? [] : [entry];
+			});
+		}
+	};
+}
+//#endregion
 //#region src/supabase/rls.ts
 function isTable(value) {
 	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
@@ -527,30 +411,23 @@ function supabaseRls(options = {}) {
 	});
 }
 const ident = (name) => quoteSqlIdent(name);
-const table = (name) => quoteSqlTable(name);
 const literal = quoteSqlLiteral;
-function qualifiedTable(name) {
-	return table(name.includes(".") ? name : `public.${name}`);
-}
 /** The memberships table's role key over alias `m`, joined to its roles table when it holds a reference. */
 function tenantRole(memberships) {
-	return roleColumn(memberships.role, memberships.table.includes(".") ? memberships.table : `public.${memberships.table}`, "m", {
+	return roleColumn(memberships.role, qualifySqlTable(memberships.table), "m", {
 		label: "authorizeSql tenant.role",
 		indent: "      "
 	});
 }
-function textArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(literal).join(", ")}]::text[]`;
-}
 function activeRow(row, id, text = false) {
 	const parts = [`s.${ident(row.id)}${text ? "::text" : ""} = ${id}`];
 	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
 	if (row.status !== void 0) {
 		if (row.active === void 0 || row.active.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(${textArray(row.active)})`);
+		parts.push(`s.${ident(row.status)}::text = any(${sqlTextArray(row.active)})`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
-	return `exists (select 1 from ${qualifiedTable(row.table)} s where ${parts.join(" and ")})`;
+	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
 /**
 * Early `return false` for a suspended user, or a tenant request for a
@@ -565,7 +442,7 @@ function suspendedGuards(suspension, scope, uid) {
 	const tenant = suspension?.scopes?.[scope];
 	if (tenant !== void 0) {
 		const keep = keptKeys(tenant);
-		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${textArray(keep)}))`;
+		const kept = keep.length === 0 ? "" : ` and not (requested_permission::text = any(${sqlTextArray(keep)}))`;
 		lines.push(`  if requested_tenant is not null and not ${activeRow(tenant, "requested_tenant", true)}${kept} then
     return false; -- suspended ${scope}
   end if;`);
@@ -594,7 +471,7 @@ function disabledLine(memberships, suspension) {
 	if (memberships.disabledAt === void 0) return "";
 	const column = `m.${ident(memberships.disabledAt)}`;
 	const keep = keptKeys(suspension?.memberships);
-	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${textArray(keep)}))`;
+	return keep.length === 0 ? `\n        and ${column} is null` : `\n        and (${column} is null or requested_permission::text = any(${sqlTextArray(keep)}))`;
 }
 function claimKept(suspension) {
 	return keptKeys(suspension?.memberships).length === 0 ? "" : `\n        and case coalesce(jsonb_typeof(m -> 'keep'), 'null') when 'null' then true when 'array' then m -> 'keep' @> jsonb_build_array(requested_permission::text) else false end`;
@@ -605,10 +482,10 @@ function customDatabaseBranch(q, scope, memberships, declared, levels, suspensio
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m${role.join}
+      from ${quoteQualifiedTable(memberships.table)} m${role.join}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(memberships.tenant)} = v_member_tenant
-        and not (${role.sql} = any(${textArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
+        and not (${role.sql} = any(${sqlTextArray(declared)}))${memberships.expiresAt === void 0 ? "" : `\n        and (m.${ident(memberships.expiresAt)} is null or m.${ident(memberships.expiresAt)} > now())`}${disabledLine(memberships, suspension)}
         and ${customHolds(q, scope, rows("custom_role_permissions", levels ? "permission || coalesce('@' || c.level, '')" : "permission", " and c.effect = 'allow'"), rows("custom_role_permissions", "permission", " and c.effect = 'deny'"), rows("custom_role_includes", "include_role", ""))}
     )`;
 }
@@ -638,7 +515,7 @@ function databaseBody(q, scope, memberships, custom, suspension) {
 		const role = tenantRole(memberships);
 		const held = (effect) => `exists (
       select 1
-      from ${qualifiedTable(memberships.table)} m${role.join}
+      from ${quoteQualifiedTable(memberships.table)} m${role.join}
       join ${q("role_permissions")} rp on rp.role = ${role.sql}
       where m.${ident(memberships.user)} = v_member_user
         and m.${ident(tenantColumn)} = v_member_tenant
@@ -661,8 +538,8 @@ function databaseBody(q, scope, memberships, custom, suspension) {
 	}
 	return `declare
   uid uuid := (select auth.uid());${memberships !== void 0 && tenantColumn !== void 0 ? `
-  v_member_user ${qualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
-  v_member_tenant ${qualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
+  v_member_user ${quoteQualifiedTable(memberships.table)}.${ident(memberships.user)}%type;
+  v_member_tenant ${quoteQualifiedTable(memberships.table)}.${ident(tenantColumn)}%type;` : ""}
 begin
   if uid is null then
     return false;
@@ -672,9 +549,9 @@ ${tenantBranch}
     and not ${global("deny")};
 end;`;
 }
-/** A claim membership whose `expiresAt` (epoch seconds) has passed no longer holds its roles. */
-const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expiresAt')
-          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+/** A claim membership whose `expires_at` (epoch seconds) has passed no longer holds its roles. */
+const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expires_at')
+          when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
           else true
         end`;
 function jwtBody(q, scope, custom, suspension) {
@@ -695,7 +572,7 @@ function jwtBody(q, scope, custom, suspension) {
         and m ->> 'id' = requested_tenant
         and ${CLAIM_UNEXPIRED}${claimKept(suspension)}
         and jsonb_typeof(cg.g) = 'array'
-        and not (r.role = any(${textArray(custom.declared)}))
+        and not (r.role = any(${sqlTextArray(custom.declared)}))
         and ${customHolds(q, scope, claimEntries("left(e, 1) not in ('-', '@')", "e"), claimEntries("left(e, 1) = '-'", "substr(e, 2)"), claimEntries("left(e, 1) = '@'", "substr(e, 2)"))}
     )`;
 	const held = (effect) => `exists (
@@ -750,7 +627,7 @@ end;`;
 */
 function authorizeSql(options = {}) {
 	const schema = options.schema ?? "permdock";
-	const q = (name) => table(`${schema}.${name}`);
+	const q = (name) => quoteSqlTable(`${schema}.${name}`);
 	const memberships = typeof options.tenant === "object" ? options.tenant : void 0;
 	const scope = options.scope ?? "tenant";
 	if (!/^[a-z][a-z0-9_]*$/u.test(scope)) throw new TypeError(`PermDock: unsafe scope name '${scope}'`);
@@ -773,4 +650,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-export { readSubjectRecord as a, postgrestSources as i, supabaseRls as n, supabaseClaims as o, supabaseApprovalStore as r, exchangeCapability as s, authorizeSql as t };
+export { supabaseClaims as a, supabaseApprovalStore as i, supabaseRls as n, exchangeCapability as o, tableApprovalDelegationSource as r, authorizeSql as t };

package/dist/supabase-hook-CXcGpHqq.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-DdDQhMlw.js";