permdock 0.4.0 → 0.6.0

package/dist/{store-options-CbUHDoSe.js → store-options-u0ycEe8s.js}

@@ -1,9 +1,22 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { f as rowIdOf, n as parseSnapshot } from "./snapshot-Dc9CHPME.js";
-import { c as nowSeconds } from "./tenancy-DshjqY0n.js";
-import { n as payloadDigest } from "./token-Bx9qy30p.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
+import { g as secondsOf } from "./time-DkWjdL98.js";
+import { c as rowIdOf } from "./delegation-j6-rc37o.js";
+import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
+import { n as payloadDigest } from "./token-BLZcjQgt.js";
+import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
+import { s as snapshotClaim } from "./where-scope-C9vfEphl.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+//#region src/client/source.ts
+/** A compact JWS: three non-empty dot-separated parts. */
+function isJws(value) {
+	const parts = value.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+//#endregion
 //#region src/client/approvals.ts
 /** Ceiling for the approval poll backoff after a failed status request. */
 const APPROVAL_BACKOFF_CAP_MS = 6e4;
@@ -237,16 +250,6 @@ function storeRequest(fetchImpl, headers) {
 	});
 }
 //#endregion
-//#region src/client/source.ts
-/** A compact JWS: three non-empty dot-separated parts. */
-function isJws(value) {
-	const parts = value.split(".");
-	return parts.length === 3 && parts.every((part) => part.length > 0);
-}
-function isPromiseLike(value) {
-	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
-}
-//#endregion
 //#region src/client/store.ts
 function withTenant(source, tenant) {
 	if (tenant === void 0) return source;
@@ -380,11 +383,13 @@ function createClientStore(options) {
 		return "ready";
 	};
 	const isStale = () => {
-		const maxAge = snapshot.issuedAt > 0 ? options.maxAge : void 0;
-		if (snapshot.expiresAt === void 0 && maxAge === void 0) return false;
+		const issuedAt = secondsOf(snapshot.issuedAt) ?? 0;
+		const expiresAt = secondsOf(snapshot.expiresAt);
+		const maxAge = issuedAt > 0 ? options.maxAge : void 0;
+		if (expiresAt === void 0 && maxAge === void 0) return false;
 		const now = nowSeconds();
-		if (snapshot.expiresAt !== void 0 && snapshot.expiresAt <= now) return true;
-		return maxAge !== void 0 && now - snapshot.issuedAt > maxAge;
+		if (expiresAt !== void 0 && expiresAt <= now) return true;
+		return maxAge !== void 0 && now - issuedAt > maxAge;
 	};
 	const serverOnly = () => {
 		hydrate(emptySnapshot());
@@ -401,8 +406,8 @@ function createClientStore(options) {
 	const verifyJws = async (raw) => {
 		if (options.verifier === void 0) return;
 		try {
-			const verified = await options.verifier.verify(raw, { typ: "permdock-snapshot+jwt" });
-			return verified.ok ? verified.claims["snapshot"] : void 0;
+			const verified = await options.verifier.verify(raw, { typ: "vnd.permdock.snapshot+jwt" });
+			return verified.ok ? snapshotClaim(verified.claims) : void 0;
 		} catch {
 			return;
 		}
@@ -565,7 +570,7 @@ function createClientStore(options) {
 					signed = body;
 					body = await verifyJws(body);
 					ok = body !== void 0;
-				}
+				} else if (ok && options.verifier !== void 0) ok = false;
 				refreshing -= 1;
 				if (started !== generation || seq !== refreshSeq) {
 					emit();

package/dist/{stores-Cxz_80g-.d.ts → stores-BUGNbJTt.d.ts}

@@ -1,12 +1,11 @@
-import { Dr as Membership, ir as Decision } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { r as Role } from "./vocabulary-hhEFLFoL.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-C3ldA9os.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, l as PermissionState, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "./store-9KO4BlkB.js";
-import { n as PermDockSvelteOptions } from "./types-ByUo56un.js";
+import { Nn as Decision, nr as Membership } from "./policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
+import { n as SveltePermDockOptions } from "./types-CVZSNocA.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
-declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
+declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
 declare function getPermDock(): ClientPermDock;
 /** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
 declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
@@ -15,7 +14,7 @@ declare function permissions(references: () => readonly Permission[], data?: ()
 declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
 declare function tenant(): Readable<TenantView>;
 declare function memberships(): Readable<readonly Membership[]>;
-declare function roles(options?: () => UseRolesOptions): Readable<{
+declare function roles(options?: () => RolesOptions): Readable<{
   readonly roles: readonly Role[];
 }>;
 declare function assignable(): Readable<readonly Role[]>;

package/dist/{stores-BHXdSbw9.js → stores-CGhM8BN_.js}

@@ -1,5 +1,5 @@
-import { a as permissionSet, d as tenantView, i as livePermDock, n as describeWith, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "./views-CJsrBS1f.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-DieZVJXu.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-B_u3_bDJ.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stream-Dwsg6WwE.d.ts → stream-CeCMJmBB.d.ts}

@@ -1,5 +1,5 @@
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { o as ProtectOptions } from "./server-types-DdqBwZN_.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/{stream-BMui98KK.js → stream-CvdUS9V1.js}

@@ -1,4 +1,4 @@
-import { r as PermDockRevokedError } from "./errors-drnfxYtm.js";
+import { r as PermDockRevokedError } from "./errors-BKy0EfhN.js";
 //#region src/server/stream.ts
 function isAsyncIterable(value) {
 	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
@@ -50,6 +50,13 @@ function reloadAfter(loaded, load) {
 }
 /** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
 const POLICY_VIOLATION = 1008;
+/**
+* The close reason for a problem: its PermDock type URI, or its `detail`
+* code for an `about:blank` one. RFC 6455 caps a reason at 123 bytes.
+*/
+function closeReason(problem) {
+	return problem.type === "about:blank" ? problem.detail : problem.type;
+}
 /** The Problem Details for an aborted connection signal. */
 function revokedProblem(signal) {
 	const reason = signal.reason;
@@ -64,4 +71,4 @@ function onRevoked(connection, end) {
 	else connection.signal.addEventListener("abort", fire, { once: true });
 }
 //#endregion
-export { reloadAfter as a, onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };
+export { onRevoked as a, isAsyncIterable as i, closeReason as n, reloadAfter as o, guardIterable as r, POLICY_VIOLATION as t };

package/dist/style-DiKWnAvn.js

@@ -0,0 +1 @@
+export { t as createStyle, n as streamHasColors } from "./style-Uao76wO7.js";

package/dist/{style-CTm1AXDT.js → style-Uao76wO7.js}

@@ -1,12 +1,13 @@
 import { styleText } from "node:util";
-//#region src/cli/style.ts
+//#region src/cli/core/style.ts
 function createStyle(color) {
 	const paint = (format, text) => color ? styleText(format, text, { validateStream: false }) : text;
 	return {
 		color,
 		paint,
 		errorMark: color ? paint("red", "✖") : "error",
-		warnMark: color ? paint("yellow", "⚠") : "warn"
+		warnMark: color ? paint("yellow", "⚠") : "warn",
+		okMark: color ? paint("green", "✔") : "ok"
 	};
 }
 /**

package/dist/subject-BGoM5o8B.js

@@ -0,0 +1,17 @@
+//#region src/core/subject.ts
+function isSubject(value) {
+	return value !== null && typeof value === "object" && "principal" in value && "context" in value && typeof value.context === "object";
+}
+function isActor(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && typeof record.kind === "string";
+}
+function anonymousSubject(context = {}) {
+	return Object.freeze({
+		principal: null,
+		context: Object.freeze({ ...context })
+	});
+}
+//#endregion
+export { isActor as n, isSubject as r, anonymousSubject as t };

package/dist/supabase/index.d.ts

@@ -1,8 +1,9 @@
-import { Dr as Membership, E as Policy, Sr as CustomRole, X as MemberEntry, Z as MembershipSource, kr as Subject, nt as RoleSource } from "../policy-types-sp9P1iIV.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-Br9IXUBG.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-CqrjB9o6.js";
-import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-Dljy06zL.js";
+import { Rt as Instant, ar as Subject } from "../policy-types-n0uRTsW8.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-BdtSDbBO.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-CEgRbefE.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-BzzaHxt3.js";
+import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-mx5ghSFM.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-Xc4zkszI.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
@@ -20,7 +21,7 @@ type ExchangeCapabilityOptions = {
   readonly issuer?: string;
   /** Lifetime in seconds, capped by the capability's own expiry. Default 300. */
   readonly ttl?: number;
-  readonly now?: number;
+  readonly now?: Instant;
 };
 /**
  * Exchanges a verified link subject (from `subjectFromCapability`) for a
@@ -30,109 +31,11 @@ type ExchangeCapabilityOptions = {
  */
 export declare function exchangeCapability(subject: Subject, options: ExchangeCapabilityOptions): Promise<string | undefined>;
 //#endregion
-//#region src/supabase/postgrest.d.ts
-/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
-type SupabaseRpcResult = {
-  readonly data: unknown;
-  readonly error: {
-    readonly message: string;
-  } | null;
-};
-/**
- * The part of a supabase-js client `postgrestSources` calls:
- * `client.schema(name).rpc(fn, args)`. Pass a client that may execute the
- * function, such as a `service_role` client after the grant the docs show.
- */
-type SupabaseRpcClient = {
-  schema(name: string): {
-    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
-  };
-};
-type SupabaseRpcCaller = {
-  schema(name: never): {
-    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
-  };
-};
-type PostgrestSourcesOptions = {
-  /**
-   * The `supabase.hook.api` setting the hook file was generated with: the
-   * wrappers live in `schema` (default `public`) as `<prefix>subject_for`,
-   * `<prefix>members_of` and `<prefix>authz_version_for` (default prefix
-   * `permdock_`). It sets the defaults of `schema`, `fn`, `membersFn` and
-   * `versionFn`, which still override it.
-   */
-  readonly api?: {
-    readonly schema?: string;
-    readonly prefix?: string;
-  };
-  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
-  readonly schema?: string;
-  /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
-  readonly fn?: string;
-  readonly membersFn?: string;
-  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
-  readonly versionFn?: string;
-  /**
-   * The policy whose declared roles tell custom roles apart. With it,
-   * `customRoles` reads nothing while every role the subject holds is
-   * declared, and `memberships.version` reads the whole subject in one call
-   * when the token claims a custom role, which the custom roles need anyway.
-   */
-  readonly policy?: Policy;
-};
-/** One user as `subject_for(p_user)` returns it. */
-type SubjectRecord = {
-  readonly id: string;
-  /** `false` for a suspended user, who holds no roles or memberships. */
-  readonly active: boolean;
-  readonly roles: readonly string[];
-  readonly memberships: readonly Membership[];
-  readonly customRoles: readonly CustomRole[];
-  readonly authzVersion?: number;
-};
-type PostgrestSources = {
-  /**
-   * Memberships and the authorization version of any principal, and `list`,
-   * the live members of one scope instance through `members_of`, for
-   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
-   * the token was truncated.
-   */
-  readonly memberships: MembershipSource & {
-    list(query: {
-      readonly scope: string;
-      readonly id: string;
-    }): Promise<MemberEntry[]>;
-  };
-  /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
-  customRoles(principal: {
-    readonly id: string;
-  }): RoleSource;
-  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
-  subject(userId: string): Promise<Subject>;
-  /** The raw record, `undefined` for an unknown user. */
-  record(userId: string): Promise<SubjectRecord | undefined>;
-};
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
-export declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
-/**
- * Membership, custom-role and subject sources over the `subject_for(p_user)`,
- * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
- * `permdock supabase hook generate` writes, for a backend that reaches
- * Postgres only through PostgREST. `memberships.version` reads only the
- * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
- * only for a stale token; when the version function is missing it falls back
- * to `subject_for`. With `policy`, a token that claims a custom role has its
- * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once per
- * `postgrestSources` call, so create it per request or per job.
- */
-export declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
-//#endregion
 //#region src/supabase/approval-store.d.ts
 type SupabaseApprovalStoreOptions = {
   /** Schema of the generated store functions (`rls.schema`). Default `permdock`. */
   readonly schema?: string;
-  /** How long a request stays open when the caller sets no `ttl`, in milliseconds. */
+  /** Seconds a request stays open when the caller sets no `ttl`. */
   readonly ttl?: number;
   /**
    * Runs once per stored request, after the call that stored it, with the
@@ -152,6 +55,20 @@ type SupabaseApprovalStoreOptions = {
  */
 export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
 //#endregion
+//#region src/supabase/approval-delegations.d.ts
+type TableApprovalDelegationSourceOptions = {
+  readonly query: SqlQuery;
+  /** Defaults to `permdock.approval_delegations`, the table `rls.approvals.delegations` generates. */
+  readonly table?: string;
+};
+/**
+ * Approval delegations (out-of-office covers) from the table
+ * `rls.approvals.delegations` generates, so `approvalsHandler` and
+ * `permdock_is_approver` read the same rows. A cover without a tenant
+ * applies everywhere; a malformed row is skipped.
+ */
+export declare function tableApprovalDelegationSource(options: TableApprovalDelegationSourceOptions): ApprovalDelegationSource;
+//#endregion
 //#region src/supabase/rls.d.ts
 export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
 /**
@@ -191,4 +108,4 @@ export declare function subjectFromSupabase(claims: unknown, options?: SupabaseS
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, authzVersion, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };

package/dist/supabase/index.js

@@ -1,5 +1,6 @@
-import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-C1TWlnYt.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-x5JtR2tc.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { a as fromJunction, i as authzVersion, o as fromSupabasePostgres, s as fromTable, t as AUTHZ_VERSION_TABLE } from "../sources-B1-b-R0t.js";
-import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-BngWKryL.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };
+import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-vs5dGOsS.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAjUkF9w.js";
+import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,9 +1,10 @@
-import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, kr as Subject } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
-import { n as ServerAdapterServices } from "../bind-BzqG8SMb.js";
+import { i as OpenApiHooks } from "../server-types-CKQiCnON.js";
+import { n as ServerAdapterServices } from "../bind-DOyrv6zi.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
@@ -84,5 +85,5 @@ export type SupabaseMiddlewarePermDock<V extends PolicyVocabulary = PolicyVocabu
   readonly permdockHandler: () => SupabaseMiddlewareHandler;
   readonly openapi: OpenApiHooks;
 };
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
 //#endregion

package/dist/supabase/middleware.js

@@ -1,10 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { t as composeWraps } from "../wrap-DWsU_5Bd.js";
-import { r as credentialSubject } from "../credential-kue0qpbm.js";
-import { a as methodNotAllowed } from "../problem-CnWraVhC.js";
-import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
-import { n as createServerKernel } from "../create-BBO24vj6.js";
-import { n as attached } from "../bind-kk-uyCwH.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
+import { t as composeWraps } from "../wrap-gX61EtpB.js";
+import { r as credentialSubject } from "../credential-BcoiejpY.js";
+import { a as methodNotAllowed } from "../problem-CTviyH5L.js";
+import { r as instanceOptions } from "../build-instance-Bu_eDqYw.js";
+import { t as createPermDock$1 } from "../create-DCF2SvoT.js";
+import { n as attached } from "../bind-CAvgUuKs.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;
@@ -22,7 +23,7 @@ function secretKeySubjects(keys, permissions) {
 			roles: [...key.roles],
 			permissions: key.permissions.map((permission) => ({ permission: permission.key })),
 			createdBy: key.id,
-			createdAt: 0,
+			createdAt: "1970-01-01T00:00:00.000Z",
 			name
 		};
 		subjects.set(name, credentialSubject(credential, { permissions }));
@@ -43,12 +44,13 @@ function secretKeySubject(subjects, ctx) {
 	const name = readString(ctx, "authKeyName");
 	return name === void 0 ? void 0 : subjects.get(name);
 }
-function createPermDock(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const contexts = /* @__PURE__ */ new WeakMap();
 	const tenantOption = options.tenant;
 	const contextFor = (request) => contexts.get(request) ?? { jwtClaims: null };
 	const secretKeys = secretKeySubjects(options.secretKeys, policy.permissions);
-	const kernel = createServerKernel(policy, compact({
+	const kernel = createPermDock$1(policy, compact({
 		subject: (request) => {
 			const ctx = contextFor(request);
 			return secretKeySubject(secretKeys, ctx) ?? options.subject(ctx, request);
@@ -61,7 +63,7 @@ function createPermDock(policy, options) {
 		webBotAuth: options.webBotAuth,
 		adapter: "supabase-middleware",
 		wrap: composeWraps(options.otel, options.wrap),
-		onDenied: options.onDenied
+		deniedResponse: options.deniedResponse
 	}));
 	const bind = (request, ctx) => {
 		contexts.set(request, ctx);
@@ -72,7 +74,7 @@ function createPermDock(policy, options) {
 		run: (config) => async (request, ctx) => {
 			bind(request, ctx);
 			if (config?.protect === void 0 && config?.oauthScopes === void 0) {
-				const instance = await attached(() => kernel.permdock(request));
+				const instance = await attached(() => kernel.getPermDock(request));
 				return instance.ok ? { permdock: instance.permdock } : instance.response;
 			}
 			const loadData = config.data;

package/dist/supabase-By_frk3U.js

@@ -0,0 +1,92 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/supabase.ts
+const hookGenerate = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write",
+			valueHint: "file"
+		},
+		...checkFlag,
+		...dbUrlFlags,
+		"active-from": {
+			type: "string",
+			description: "Where the hook reads the active tenant",
+			valueHint: "source"
+		},
+		budget: {
+			type: "string",
+			description: "Byte budget for the memberships claim",
+			valueHint: "bytes"
+		},
+		schema: {
+			type: "string",
+			description: "Schema for the hook function",
+			valueHint: "name"
+		},
+		schemas: {
+			type: "enum",
+			options: [
+				"pg-delta",
+				"migra",
+				"migrations"
+			],
+			description: "Schema workflow (default supabase.schemas, else pg-delta)"
+		},
+		"grants-out": {
+			type: "string",
+			description: "migra: file for the privileges supabase db diff drops",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const out = fileOut("supabase hook generate", flags.out);
+		const db = await dbUrl(ctx, flags);
+		const activeFrom = given(flags["active-from"]);
+		const budget = given(flags.budget);
+		const schema = given(flags.schema);
+		const grantsOut = given(flags["grants-out"]);
+		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
+		return runSupabase({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["hook", "generate"],
+			check: flags.check,
+			json: ctx.json,
+			io: ctx.io,
+			...out === void 0 ? {} : { out },
+			...db === void 0 ? {} : { db },
+			...activeFrom === void 0 ? {} : { activeFrom },
+			...budget === void 0 ? {} : { budget },
+			...schema === void 0 ? {} : { schema },
+			...grantsOut === void 0 ? {} : { grantsOut },
+			...flags.schemas === void 0 ? {} : { schemas: flags.schemas }
+		});
+	}
+});
+const inspect = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "File to write; a bare --out writes permdock.manifest.json",
+			valueHint: "file"
+		},
+		...checkFlag
+	},
+	async run(ctx, { flags }) {
+		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
+		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
+		return runSupabase({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["inspect"],
+			check: flags.check,
+			json: ctx.json,
+			io: ctx.io,
+			...out === void 0 ? {} : { out }
+		});
+	}
+});
+//#endregion
+export { hookGenerate, inspect };