permdock 0.5.0 → 0.7.0

package/dist/{standard-webhooks-6lg8v_is.d.ts → standard-webhooks-B_qRg0ws.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
-import { l as ReplayStore } from "./types-DiQjupG2.js";
+import { Rt as Instant, ar as JsonWebKeyLike } from "./policy-types-B-F-qAZk.js";
+import { l as ReplayStore } from "./types-cTos-H7p.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{store-4u_hxjWa.js → store-DSP9oGvh.js}

@@ -2,8 +2,8 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
 import { a as durationOf, i as dateAt } from "./time-DkWjdL98.js";
-import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { c as rootMembershipId } from "./scopes-BHsc-wp-.js";
+import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
 import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-DqzsnlSA.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;
@@ -70,10 +70,13 @@ function listAllApprovals(store, filter) {
 	return collect(void 0, 0, []);
 }
 //#endregion
-//#region src/approvals/store.ts
-function tenantOf(request) {
-	return request.subject.principal?.tenant;
-}
+//#region src/approvals/tenancy.ts
+/**
+* The tenants a subject acts in for approvals: `principal.tenant` and the
+* instance of every membership at the first scope. A membership at a nested
+* scope (a team, or one with `within`) names no tenant, even when its parent
+* is the request's tenant.
+*/
 function membershipTenants(subject) {
 	const principal = subject.principal;
 	if (principal === null) return [];
@@ -88,6 +91,11 @@ function membershipTenants(subject) {
 function belongsToTenant(subject, tenant) {
 	return membershipTenants(subject).includes(tenant);
 }
+//#endregion
+//#region src/approvals/store.ts
+function tenantOf(request) {
+	return request.subject.principal?.tenant;
+}
 function holdsRole(subject, role, tenant) {
 	const principal = subject.principal;
 	if (principal === null) return false;
@@ -355,4 +363,4 @@ function memoryApprovalStore(options = {}) {
 	};
 }
 //#endregion
-export { approvalPageSize as a, listAllApprovals as c, memoryApprovalStore as i, pageApprovals as l, assertApprover as n, decodeApprovalCursor as o, matchesApprovers as r, encodeApprovalCursor as s, applyApprovalVerdict as t };
+export { belongsToTenant as a, decodeApprovalCursor as c, pageApprovals as d, memoryApprovalStore as i, encodeApprovalCursor as l, assertApprover as n, membershipTenants as o, matchesApprovers as r, approvalPageSize as s, applyApprovalVerdict as t, listAllApprovals as u };

package/dist/{store-options-BqEakYRa.js → store-options-B_poyYvg.js}

@@ -1,11 +1,11 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { g as secondsOf } from "./time-DkWjdL98.js";
-import { c as rowIdOf } from "./delegation-DaXVdDhM.js";
-import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
-import { n as payloadDigest } from "./token-BLZcjQgt.js";
-import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
-import { s as snapshotClaim } from "./where-scope-Dv-WTP-w.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
+import { c as rowIdOf } from "./delegation-C5rOdTp5.js";
+import { c as nowSeconds } from "./tenancy-CmeBQ6Nv.js";
+import { n as payloadDigest } from "./token-2qYDvXz2.js";
+import { n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
+import { c as snapshotClaim } from "./where-scope-wq2coopv.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/source.ts
 /** A compact JWS: three non-empty dot-separated parts. */

package/dist/{stores-ClZUgeoP.d.ts → stores-BAZwSYZA.d.ts}

@@ -1,8 +1,9 @@
-import { Nn as Decision, nr as Membership } from "./policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-BNORmDM8.js";
-import { n as SveltePermDockOptions } from "./types-fbZ7JEXr.js";
+import { Ln as Decision, or as Membership } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { r as Role } from "./vocabulary-Bg3eeT2H.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-CKV71kKh.js";
+import { n as SveltePermDockOptions } from "./types-DXmwu78Z.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stores-BbsD4fAR.js → stores-BqEuHC05.js}

@@ -1,5 +1,5 @@
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-bbFHR-0D.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-BB8E9dTP.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context--uM9V3Ui.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stream-7-xmnf3U.d.ts → stream-2Vwhl7Er.d.ts}

@@ -1,5 +1,5 @@
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { o as ProtectOptions } from "./server-types-C4gZUEZy.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/{style-Uao76wO7.js → style-Cqo7-73x.js}

@@ -7,6 +7,7 @@ function createStyle(color) {
 		paint,
 		errorMark: color ? paint("red", "✖") : "error",
 		warnMark: color ? paint("yellow", "⚠") : "warn",
+		infoMark: color ? paint("cyan", "ℹ") : "info",
 		okMark: color ? paint("green", "✔") : "ok"
 	};
 }

package/dist/{style-DiKWnAvn.js → style-Ds1gNm77.js}

@@ -1 +1 @@
-export { t as createStyle, n as streamHasColors } from "./style-Uao76wO7.js";
+export { t as createStyle, n as streamHasColors } from "./style-Cqo7-73x.js";

package/dist/supabase/index.d.ts

@@ -1,9 +1,10 @@
-import { Rt as Instant, ir as Subject } from "../policy-types-DzwivBgR.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-CCpc2Dcv.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-NUqZT-RB.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-CdlxsYQh.js";
-import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-mx5ghSFM.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-BV9j0DeZ.js";
+import { Rt as Instant, lr as Subject } from "../policy-types-B-F-qAZk.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-DC44-hqb.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-CYacM_u7.js";
+import { C as SupabaseClaimsOptions, D as supabaseClaims, E as SupabasePermDockClaims, S as SupabaseClaims, T as SupabaseMembershipClaim, _ as SupabaseSubjectOptions, a as SupabaseActor, b as SupabaseSuspension, c as SupabaseInclude, d as SupabasePrincipal, f as SupabaseRealtime, g as SupabaseStorage, h as SupabaseSessionLike, i as SupabaseActiveRow, l as SupabaseMembershipTable, m as SupabaseRlsOptions, o as SupabaseActorResult, p as SupabaseRlsConfig, r as RoleThrough, s as SupabaseDelegation, t as AuthorizeSqlOptions, u as SupabasePermissionRef, v as SupabaseSuspendedMembership, w as SupabaseClaimsSchema, x as SupabaseActClaim, y as SupabaseSuspendedScope } from "../types-BfVmNJO5.js";
+import { t as SqlQuery } from "../sql-CDEPCA0g.js";
+import { a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestRole, f as SupabaseManifestThrough, h as parseSupabaseManifest, i as SupabaseManifest, l as SupabaseManifestRequires, m as hasTokenHook, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestValue, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRls } from "../manifest-BVhExYhw.js";
+import { a as MembershipStream, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-DEEuGb8S.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
@@ -108,4 +109,4 @@ export declare function subjectFromSupabase(claims: unknown, options?: SupabaseS
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipStream, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDatabaseManifest, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifest, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };

package/dist/supabase/index.js

@@ -1,6 +1,6 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-Dxlp8A94.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase--0aJdLEd.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-vs5dGOsS.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-CW0IqC-U.js";
-import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };
+import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-B-zYB4GS.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-r5faDIzD.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-B79YuF2T.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
-import { n as ServerAdapterServices } from "../bind--9EFVYWF.js";
+import { i as OpenApiHooks } from "../server-types-C4gZUEZy.js";
+import { n as ServerAdapterServices } from "../bind-JDuvxjuW.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
-import { t as composeWraps } from "../wrap-gX61EtpB.js";
-import { r as credentialSubject } from "../credential-DM2um3ha.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
+import { t as composeWraps } from "../wrap-CiSc_KCq.js";
+import { r as credentialSubject } from "../credential-CIM7wHwA.js";
 import { a as methodNotAllowed } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-BMnAudHn.js";
-import { t as createPermDock$1 } from "../create-DnrmLnLW.js";
-import { n as attached } from "../bind-CZzhx-Vj.js";
+import { r as instanceOptions } from "../build-instance-DxE7czo9.js";
+import { t as createPermDock$1 } from "../create-DJrlhEp9.js";
+import { n as attached } from "../bind-D1nO6fiC.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-Dxlp8A94.js → supabase--0aJdLEd.js}

@@ -1,14 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-4u_hxjWa.js";
-import { a as parseCapability } from "./capability-N1K9IpqS.js";
+import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-DSP9oGvh.js";
+import { a as parseCapability } from "./capability-L7NnfhiE.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-B96movIM.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
-import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
-import { t as callRpc } from "./postgrest-CW0IqC-U.js";
+import { d as keptKeys, l as roleColumn } from "./sources-B-zYB4GS.js";
+import { t as callRpc } from "./postgrest-r5faDIzD.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -61,6 +61,7 @@ const KNOWN = /* @__PURE__ */ new Set([
 	"roles",
 	"memberships",
 	"memberships_truncated",
+	"team_ids",
 	"attrs",
 	"authz_ver",
 	"client_id",
@@ -124,6 +125,7 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 		else issue(issues, [...path, "memberships"], "Expected an array");
 	}
 	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
+	optional(record, "team_ids", path, issues, isStrings, "an array of strings");
 	optional(record, tenantClaim, path, issues, isString, "a string");
 	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
@@ -478,7 +480,7 @@ function claimKept(suspension) {
 }
 function customDatabaseBranch(q, scope, memberships, declared, levels, suspension) {
 	const role = tenantRole(memberships);
-	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
+	const match = `case when ${q("permdock_is_shared_role")}(${literal(scope)}, ${role.sql}) then c.tenant_id is null else c.tenant_id::text = requested_tenant end and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1

package/dist/{supabase-9pqI57pW.js → supabase-Bqp7iIY2.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/supabase.ts
 const hookGenerate = defineLeaf({
 	flags: {
@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		const { runSupabase } = await import("./supabase-hook-DJxC4PoP.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		const { runSupabase } = await import("./supabase-hook-DJxC4PoP.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/supabase-hook-DJxC4PoP.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-Dg0SrQWR.js";