permdock 0.5.0 → 0.7.0

package/dist/{server-types-BLd4MnBX.d.ts → server-types-C4gZUEZy.d.ts}

@@ -1,14 +1,14 @@
-import { Nn as Decision, Rt as Instant, Vt as Snapshot, ir as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock, s as SnapshotOptions } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { Gt as Snapshot, Ln as Decision, Rt as Instant, Zn as Actor, ar as JsonWebKeyLike, j as PolicyVocabulary, lr as Subject } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock, l as SnapshotOptions } from "./permdock-Dco6dyCK.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { r as PdpFactory } from "./types-ClZaWzfb.js";
-import { i as evaluationsHandler } from "./evaluations-16UqqQ6W.js";
+import { r as PdpFactory } from "./types-D3A19w4A.js";
+import { i as evaluationsHandler } from "./evaluations-BCddEOfO.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {

package/dist/{shared-DvvFzYXe.js → shared-C8LjUdVU.js}

@@ -1,5 +1,5 @@
 import { a as durationOf, f as nowMillis } from "./time-DkWjdL98.js";
-import { t as decisionToken } from "./token-BLZcjQgt.js";
+import { t as decisionToken } from "./token-2qYDvXz2.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;

package/dist/{shared-CD11nBbC.js → shared-fMKOv8hP.js}

@@ -1,43 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as configError } from "./errors-CWTY6uih.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
-//#region src/cli/sql/quote.ts
-function quoteIdent(name) {
-	return quoteSqlIdent(name, CLI);
-}
-function quoteTable(name) {
-	return quoteSqlTable(name, CLI);
-}
-/** A table name with `public.` added when it names no schema, quoted. */
-function quoteQualified(name) {
-	return quoteQualifiedTable(name, CLI);
-}
-function helperSchema(ctx) {
-	return ctx.schema ?? "permdock";
-}
-function qualified(ctx, name) {
-	return `${quoteIdent(helperSchema(ctx))}.${name}`;
-}
-function quoteLiteral(value) {
-	return quoteSqlLiteral(value);
-}
-const CLI = "PermDock CLI";
-function declaredArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
-}
-/**
-* A text array as a Postgres literal (`'{admin,owner}'`). An element that
-* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
-* reads as `NULL`, is double-quoted and escaped, so one element can never
-* split into several.
-*/
-function textArrayLiteral(values) {
-	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
-}
-//#endregion
+import { i as configError } from "./errors-DpP_U6Bf.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B96movIM.js";
+import "./sources-B-zYB4GS.js";
 //#region src/cli/sql/columns.ts
 /** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
 function columnTypeOf(property) {
@@ -111,6 +77,40 @@ function scopeTypeOf(ctx, name) {
 	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
 }
 //#endregion
+//#region src/cli/sql/quote.ts
+function quoteIdent(name) {
+	return quoteSqlIdent(name, CLI);
+}
+function quoteTable(name) {
+	return quoteSqlTable(name, CLI);
+}
+/** A table name with `public.` added when it names no schema, quoted. */
+function quoteQualified(name) {
+	return quoteQualifiedTable(name, CLI);
+}
+function helperSchema(ctx) {
+	return ctx.schema ?? "permdock";
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(helperSchema(ctx))}.${name}`;
+}
+function quoteLiteral(value) {
+	return quoteSqlLiteral(value);
+}
+const CLI = "PermDock CLI";
+function declaredArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+/**
+* A text array as a Postgres literal (`'{admin,owner}'`). An element that
+* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
+* reads as `NULL`, is double-quoted and escaped, so one element can never
+* split into several.
+*/
+function textArrayLiteral(values) {
+	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
+}
+//#endregion
 //#region src/cli/sql/context.ts
 const CLAIM = SQL_IDENT;
 function parseMembershipsFlag(raw) {
@@ -279,13 +279,20 @@ const CUSTOM_ROLES = {
 	guardFor: "permdock_custom_role_guard_for",
 	shape: "permdock_custom_role_shape",
 	entries: "permdock_custom_role_entries",
+	entryProblem: "permdock_custom_role_entry_problem",
 	replace: "permdock_replace_custom_role_grants",
 	rename: "permdock_rename_custom_role_grants",
 	remove: "permdock_delete_custom_role_grants",
 	trustedReplace: "permdock_trusted_replace_custom_role_grants",
 	trustedRename: "permdock_trusted_rename_custom_role_grants",
 	trustedRemove: "permdock_trusted_delete_custom_role_grants",
-	cascade: "permdock_cascade_custom_role"
+	replaceById: "permdock_replace_custom_role_grants_by_id",
+	trustedReplaceById: "permdock_trusted_replace_custom_role_grants_by_id",
+	trustedReadById: "permdock_trusted_role_permissions_by_id",
+	cascade: "permdock_cascade_custom_role",
+	nameGuard: "permdock_custom_role_name_guard",
+	sync: "permdock_sync_custom_role",
+	shared: "permdock_is_shared_role"
 };
 /** The function `rls.roles` adds. The name is part of the SQL contract. */
 const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
@@ -301,4 +308,4 @@ function allowEntry(ctx) {
 	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
 }
 //#endregion
-export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, textArrayLiteral as L, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };
+export { quoteQualified as A, parseMembershipsFlag as C, qualified as D, helperSchema as E, scopeTypeOf as F, sqlType as I, tenantTypeOf as L, textArrayLiteral as M, arrayColumnsOf as N, quoteIdent as O, columnTypesOf as P, CLAIM as S, declaredArray as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, quoteTable as j, quoteLiteral as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, CLI as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{sink-Bj_lDUDq.d.ts → sink-Cp_Eot9W.d.ts}

@@ -1,7 +1,7 @@
-import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
-import { u as OperationRisk } from "./operations-CxybZErY.js";
-import { t as Automation } from "./automation-BMZPIVUM.js";
+import { $t as CredentialEvent, Ct as Credential, Qt as AutomationEvent, Xt as AccessEvent, gt as SupportSession, on as MembershipEvent, q as DecisionSink, sn as SinkEvent, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { O as AppData } from "./permission-types-DhNEmoRG.js";
+import { u as OperationRisk } from "./operations-BNLes61x.js";
+import { t as Automation } from "./automation-DOtAFWdy.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-B6lVdD_W.js → skills-Dcjw9_1C.js}

@@ -1,10 +1,11 @@
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
 import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { t as didYouMean } from "./args-IIolxxKA.js";
+import { t as didYouMean } from "./args-CC3OwyHW.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
-import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { findPackageJSON } from "node:module";
 //#region src/cli/skills.ts
 const SKILL_NAMES = [
 	"permdock",
@@ -183,9 +184,8 @@ function resolveTargets(agents) {
 }
 function resolveSkillsRoot(cwd, bundled) {
 	try {
-		const pkg = createRequire(resolve(cwd, "package.json")).resolve("permdock/package.json");
-		const root = join(dirname(pkg), "skills");
-		if (existsSync(root)) return root;
+		const pkg = findPackageJSON("permdock", pathToFileURL(resolve(cwd, "package.json")));
+		if (pkg !== void 0 && existsSync(join(dirname(pkg), "skills"))) return join(dirname(pkg), "skills");
 	} catch {}
 	const local = join(cwd, "node_modules/permdock/skills");
 	if (existsSync(local)) return local;

package/dist/{skills-CTYwkl44.js → skills-g_3BS9NC.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { t as checkFlag } from "./flags-C3DktBDY.js";
-import { r as pick, t as CANCELLED } from "./prompt-DfZLJLIn.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B6lVdD_W.js";
+import { t as checkFlag } from "./flags-aaeRAdiD.js";
+import { r as pick, t as CANCELLED } from "./prompt-DwtVemER.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Dcjw9_1C.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{snapshot-CXUWfsNy.js → snapshot-CbGmYiJx.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { c as isConditionRef, i as resolveConditionRef } from "./refs-K6eWUJ0H.js";
+import { a as resolveConditionRef, l as isConditionRef } from "./refs-CNJBiTFo.js";
 import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { d as scopeList } from "./scopes-CUPSjo9q.js";
-import { _ as listPlans, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { f as scopeList } from "./scopes-BHsc-wp-.js";
+import { _ as listPlans, v as listRoles } from "./grantee-BrRANrpT.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
-import { m as tenantsOf } from "./tenancy-DN2QAx9z.js";
+import { m as tenantsOf } from "./tenancy-CmeBQ6Nv.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 //#region src/conditions/bind.ts
 function isPrimitive(value) {

package/dist/{snapshot-cache-DZHQ0KF6.js → snapshot-cache-DT2Kx1F8.js}

@@ -1,5 +1,5 @@
 import { g as secondsOf, p as nowSeconds } from "./time-DkWjdL98.js";
-import { n as payloadDigest } from "./token-BLZcjQgt.js";
+import { n as payloadDigest } from "./token-2qYDvXz2.js";
 //#region src/core/snapshot-cache.ts
 /** Seconds since the epoch of a NumericDate or an RFC 3339 instant. */
 function epochSeconds(value) {

package/dist/{snapshot-cache-DqK9eDmM.d.ts → snapshot-cache-Pahd3IYJ.d.ts}

@@ -1,4 +1,4 @@
-import { Rt as Instant, Vt as Snapshot } from "./policy-types-DzwivBgR.js";
+import { Gt as Snapshot, Rt as Instant } from "./policy-types-B-F-qAZk.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */

package/dist/solid/index.d.ts

@@ -1,10 +1,11 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership, zn as GrantedDecision } from "../policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier, or as Membership } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { r as Role } from "../vocabulary-Bg3eeT2H.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-O0SwYIK8.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-CKV71kKh.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */

package/dist/solid/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
+import { i as isPromiseLike } from "../store-options-B_poyYvg.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-IgqQipCO.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-BB8E9dTP.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { i as decorate } from "../bind-CZzhx-Vj.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { i as decorate } from "../bind-D1nO6fiC.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-vs5dGOsS.js → sources-B-zYB4GS.js}

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlRows } from "./sql-B96movIM.js";
 //#region src/supabase/keep.ts
 /** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
 function keptKeys(row) {
@@ -115,7 +115,8 @@ function selectOf(shape, where, user, keep) {
 	return `select ${fields.join(", ")}
 from ${quoteQualifiedTable(shape.table)} m${shape.join}
 where ${where.join("\n  and ")}
-group by ${group.join(", ")}`;
+group by ${group.join(", ")}
+having ${shape.roles} is not null`;
 }
 function holdersOf(shape) {
 	const id = ident$1(shape.idColumn);
@@ -191,7 +192,8 @@ function roleColumn(role, table, alias, options) {
 		lookup: sql,
 		columns: [...new Set(parts.map((part) => part.column))],
 		throughs: parts.flatMap((part) => part.throughs),
-		lateral: true
+		lateral: true,
+		nullable: false
 	};
 }
 function singleRole(role, table, alias, options) {
@@ -204,8 +206,24 @@ function singleRole(role, table, alias, options) {
 		lookup: `${alias}.${q(role)}::text`,
 		columns: [role],
 		throughs: [],
-		lateral: false
+		lateral: false,
+		nullable: false
 	};
+	if ("map" in role) {
+		const arms = Object.entries(role.map).map(([value, key]) => `when ${quoteSqlLiteral(value)} then ${key === null ? "null" : quoteSqlLiteral(key)}`);
+		const mapped = `case ${alias}.${q(role.column)}::text ${arms.join(" ")} else null end`;
+		return {
+			column: role.column,
+			sql: mapped,
+			join: "",
+			lookup: mapped,
+			columns: [role.column],
+			throughs: [],
+			lateral: false,
+			map: role.map,
+			nullable: true
+		};
+	}
 	const pairs = Object.entries(role.on);
 	const [pair] = pairs;
 	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
@@ -220,19 +238,27 @@ function singleRole(role, table, alias, options) {
 		key: role.column,
 		ref
 	};
+	const plain = `${keys}.${q(role.column)}::text`;
+	const guard = options.guard;
+	const key = guard !== void 0 && qualifySqlTable(guard.table) === through ? `case when ${keys}.${q(guard.tenant)} is not null${guard.skip === void 0 ? "" : ` and not coalesce(${keys}.${q(guard.skip)}, false)`} and ${plain} = any(${sqlTextArray(guard.declared)}) then null else ${plain} end` : plain;
 	return {
 		column: ref,
-		sql: `${keys}.${q(role.column)}::text`,
+		sql: key,
 		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
-		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		lookup: `(select ${key} from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
 		through: keyed,
 		columns: [ref],
 		throughs: [keyed],
-		lateral: false
+		lateral: false,
+		nullable: false
 	};
 }
 /** The manifest entry of one role source: the column, and the roles table it references. */
-function sourceManifest(column, through) {
+function sourceManifest(column, through, map) {
+	if (map !== void 0) return {
+		column,
+		map
+	};
 	return through === void 0 ? { column } : {
 		column,
 		through: {
@@ -248,7 +274,7 @@ function columnManifest(role) {
 }
 /** The manifest entry of a role column, or one entry per source of a row with several. */
 function roleManifest(role) {
-	if (!role.lateral) return sourceManifest(role.column, role.through);
+	if (!role.lateral) return sourceManifest(role.column, role.through, role.map);
 	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
 }
 //#endregion
@@ -259,10 +285,11 @@ function isFixed(roles) {
 	return Array.isArray(roles);
 }
 /** A role column of the membership table, aliased `m`; a `through` column joins its roles table as `mk`. */
-function memberRole(role, table, label) {
+function memberRole(role, table, label, guard) {
 	return roleColumn(role, qualifySqlTable(table), "m", {
 		label,
-		indent: ""
+		indent: "",
+		...guard === void 0 ? {} : { guard }
 	});
 }
 /** The user of the membership table, aliased `m`; a `through` user joins its table as `mu`. */
@@ -278,12 +305,30 @@ function memberUser(user, table, label) {
 		sql: column.through === void 0 ? col(column.column) : `mu.${ident(column.through.key)}`
 	};
 }
-function roleAgg(role) {
-	return `jsonb_agg(distinct ${role.sql} order by ${role.sql})`;
+/** `through` tables qualified in the schema of `table`. */
+function throughIn(through, table) {
+	const schema = qualifySqlTable(table).split(".")[0] ?? "public";
+	return {
+		...through,
+		through: through.through.includes(".") ? through.through : `${schema}.${through.through}`
+	};
 }
-function rowsOf(result) {
-	return Array.isArray(result) ? result : result.rows;
+function qualifiedThrough(source, table) {
+	return typeof source === "string" || "map" in source ? source : throughIn(source, table);
 }
+function streamUser(user, table) {
+	return typeof user === "string" ? user : throughIn(user, table);
+}
+function isSourceList(role) {
+	return Array.isArray(role);
+}
+function streamRoles(role, table) {
+	return isSourceList(role) ? role.map((source) => qualifiedThrough(source, table)) : qualifiedThrough(role, table);
+}
+function roleAgg(role) {
+	return `jsonb_agg(distinct ${role.sql} order by ${role.sql}) filter (where ${role.sql} is not null)`;
+}
+const rowsOf = sqlRows;
 function strings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
 }
@@ -356,13 +401,16 @@ function supabasePostgresQuery(postgres) {
 * merge into one membership.
 */
 function tableMembershipSource(options) {
+	return tableSource(options, void 0);
+}
+function tableSource(options, guard) {
 	const c = options.columns ?? {};
 	const scope = `${col(c.scope ?? "scope")}::text`;
 	const id = `${col(c.id ?? "scope_id")}::text`;
 	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
 	const user = memberUser(c.user ?? "user_id", options.table, "tableMembershipSource columns.user");
-	const role = memberRole(c.role ?? "role", options.table, "tableMembershipSource columns.role");
-	return sourceOf(sqlOf({
+	const role = memberRole(c.role ?? "role", options.table, "tableMembershipSource columns.role", guard);
+	const shape = {
 		table: options.table,
 		join: `${user.column.join}${role.join}`,
 		through: role.through,
@@ -427,7 +475,26 @@ function tableMembershipSource(options) {
 			expiresAt: c.expiresAt === void 0 ? void 0 : { column: c.expiresAt },
 			disabledAt: c.disabledAt === void 0 ? void 0 : { column: c.disabledAt }
 		})
-	}), options.query);
+	};
+	const stream = compact({
+		table: qualifySqlTable(options.table),
+		user: streamUser(c.user ?? "user_id", options.table),
+		scope: { column: c.scope ?? "scope" },
+		id: c.id ?? "scope_id",
+		roles: streamRoles(c.role ?? "role", options.table),
+		via: c.via === void 0 ? void 0 : { column: c.via },
+		expiresAt: c.expiresAt,
+		disabledAt: c.disabledAt,
+		nullableRoles: true,
+		guard
+	});
+	return {
+		...sourceOf({
+			...sqlOf(shape),
+			stream
+		}, options.query),
+		guarded: (next) => tableSource(options, next)
+	};
 }
 /**
 * Memberships from a table of one scope (`customer_contacts`): every row is a
@@ -435,13 +502,16 @@ function tableMembershipSource(options) {
 * fixed `via`, and ancestor ids from `within` columns.
 */
 function junctionMembershipSource(options) {
+	return junctionSource(options, void 0);
+}
+function junctionSource(options, guard) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
 	const idColumn = options.id ?? `${options.scope}_id`;
 	const withinEntries = Object.entries(options.within ?? {});
 	const roles = options.roles;
 	const fixed = isFixed(roles) ? roles : void 0;
 	if (fixed?.length === 0) throw new TypeError("PermDock: junctionMembershipSource needs at least one role");
-	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "junctionMembershipSource roles");
+	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "junctionMembershipSource roles", guard);
 	const user = memberUser(options.user ?? "user_id", options.table, "junctionMembershipSource user");
 	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
 	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
@@ -509,12 +579,28 @@ function junctionMembershipSource(options) {
 		})
 	};
 	const sql = sqlOf(shape);
-	return sourceOf({
-		...sql,
-		scope: options.scope,
-		holds: [options.scope, ...withinEntries.map(([name]) => name)],
-		list: (keep = sql.keeps) => selectOf(shape, filters(shape, `$1::text = ${literal(options.scope)} and ${col(idColumn)}::text = $2::text`), true, keep)
-	}, options.query);
+	const stream = compact({
+		table: qualifySqlTable(options.table),
+		user: streamUser(options.user ?? "user_id", options.table),
+		scope: { value: options.scope },
+		id: idColumn,
+		roles: fixed === void 0 ? streamRoles(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table) : { value: [...fixed] },
+		via: options.via === void 0 ? void 0 : { value: options.via },
+		expiresAt: options.expiresAt,
+		disabledAt: options.disabledAt,
+		nullableRoles: fixed === void 0,
+		guard
+	});
+	return {
+		...sourceOf({
+			...sql,
+			stream,
+			scope: options.scope,
+			holds: [options.scope, ...withinEntries.map(([name]) => name)],
+			list: (keep = sql.keeps) => selectOf(shape, filters(shape, `$1::text = ${literal(options.scope)} and ${col(idColumn)}::text = $2::text`), true, keep)
+		}, options.query),
+		guarded: (next) => junctionSource(options, next)
+	};
 }
 const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 /**