permdock 0.6.0 → 0.8.0

package/dist/better-supabase/index.js

@@ -1,33 +1,35 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { l as asApprover } from "../role-builder-uWQZ4v84.js";
-import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-CqPOLD-o.js";
-import { t as loadPrincipal } from "../principal-source-pHneukrx.js";
-import { a as isId, r as idList } from "../expiry-D4_YKRKD.js";
-import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-Br4jSNVi.js";
-import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
-import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
-import { r as sha256Digest } from "../sha256-D9ihqmvd.js";
-import { t as decideSupportSession } from "../support-session-C6xJQYut.js";
-import { d as scopeList } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
-import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { o as scopesReaching, t as getPermDock } from "../permdock-BrAscV28.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { l as asApprover } from "../role-builder-BK2-T6oD.js";
+import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-B4r0N_Uz.js";
+import { t as loadPrincipal } from "../principal-source-C6N60GtM.js";
+import { a as isId, r as idList } from "../expiry-6XByK0dm.js";
+import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-B8tYxPIt.js";
+import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-nR1JesoH.js";
+import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "../sha256-C-4WXKIu.js";
+import { t as decideSupportSession } from "../support-session-BsmPCbz8.js";
+import { f as scopeList } from "../scopes-0Up_UA2t.js";
+import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
+import { a as delegatedScopeMap, s as scopesReaching, t as getPermDock } from "../permdock-L-_I_3zP.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-N1K9IpqS.js";
-import { r as credentialSubject, s as parseCredential } from "../credential-BcoiejpY.js";
+import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-BqX94r07.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-CyyyvCsL.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
-import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
-import { n as subscribersFor } from "../audience-DabClFLQ.js";
-import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-B5T1IL83.js";
-import "../sources-vs5dGOsS.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-DAjUkF9w.js";
-import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "../parse-Cxq0WxrA.js";
+import { t as policyRowConditionKeys } from "../row-conditions-BAGHOmVq.js";
+import { n as subscribersFor } from "../audience-BAkBDMqn.js";
+import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
+import "../sources-CMAM-2A3.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-D4nuPXIQ.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-wg8WkkpD.js";
+import { t as parseCatalog } from "../parse-1_ZheTW5.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/access-reviews.ts
 const NOT_MEMBER = "ORGANIZATION_NOT_MEMBER";
-/** The `hint` better-supabase's block functions raise their code in, or the SQLSTATE. */
+/**
+* The `hint` better-supabase's block functions raise their code in, or the
+* SQLSTATE.
+*/
 function errorCode(error) {
 	if ("hint" in error && typeof error.hint === "string" && error.hint !== "") return error.hint;
 	return "code" in error && typeof error.code === "string" ? error.code : void 0;
@@ -40,8 +42,8 @@ var RpcFailure = class extends Error {
 	}
 };
 /**
-* Whether a member holding `role` at `scope` holds `key` through it. A role
-* the policy does not declare, such as a custom role, counts as holding it.
+* Whether a member holding `role` at `scope` holds `key` through it. A role the
+* policy does not declare, such as a custom role, counts as holding it.
 */
 function roleGrants(policy, role, scope, key) {
 	if (!policy.index.declaredRoles.has(role)) return true;
@@ -61,14 +63,13 @@ function invitationsOf(data) {
 }
 /**
 * Applies the revoked items of an access review to better-supabase's
-* organizations and invitations blocks, then marks each one applied. A
-* revoked member moves to the `demoteTo` role when the policy says that
-* role lacks the permission, and is removed otherwise. With `email`, the
-* tenant's open invitations to the member whose role grants the permission
-* are revoked too. A member who is no longer in the organization counts as
-* applied. Any other error leaves the item unapplied in `failed`, and one
-* item's failure never stops the others. Throws `review-not-found` for an
-* unknown review.
+* organizations and invitations blocks, then marks each one applied. A revoked
+* member moves to the `demoteTo` role when the policy says that role lacks the
+* permission, and is removed otherwise. With `email`, the tenant's open
+* invitations to the member whose role grants the permission are revoked too. A
+* member who is no longer in the organization counts as applied. Any other
+* error leaves the item unapplied in `failed`, and one item's failure never
+* stops the others. Throws `review-not-found` for an unknown review.
 */
 function accessReviewApplier(options) {
 	const schema = options.schema ?? "better_supabase";
@@ -155,7 +156,10 @@ function accessReviewApplier(options) {
 //#region src/better-supabase/api-keys.ts
 const EPOCH = "1970-01-01T00:00:00.000Z";
 const rfc3339Of = (instant) => isoAt(instant.epochMilliseconds);
-/** When a key stops verifying: its expiry, or the end of a rotated key's grace period. */
+/**
+* When a key stops verifying: its expiry, or the end of a rotated key's grace
+* period.
+*/
 function endOf(key) {
 	const { expiresAt, revokedAt } = key;
 	if (revokedAt === void 0) return expiresAt;
@@ -167,9 +171,9 @@ function manifestServiceRoles(manifest) {
 	return manifest === void 0 ? void 0 : parseSupabaseManifest(manifest).rls.apiKeys?.serviceRoles;
 }
 /**
-* A personal key as a `user` credential acting as its user, a tenant key as
-* a `service` credential holding `roles` in its tenant; `null` when `*`
-* has no expansion, a tenant key has no roles, or the record is invalid.
+* A personal key as a `user` credential acting as its user, a tenant key as a
+* `service` credential holding `roles` in its tenant; `null` when `*` has no
+* expansion, a tenant key has no roles, or the record is invalid.
 */
 function keyCredential(key, roles, allPermissions) {
 	const scopes = key.scopes.includes("*") ? allPermissions?.map((permission) => permission.key) : key.scopes;
@@ -200,18 +204,18 @@ function keyCredential(key, roles, allPermissions) {
 	}) ?? null;
 }
 /**
-* better-supabase's API keys as a `CredentialVerifier`, for
-* `subjectFromApiKey` from `permdock/server`, which reads PermDock's
-* `pdk_<id>_<secret>` format: create the keys with `prefix: "pdk"`. The
-* credential id is the key's `publicId`, the id in the token. A personal key
-* is a `user` credential acting as its user (inside its tenant when the key
-* is limited to one), a tenant key a `service` credential holding
-* `serviceRoles` in its tenant, and the key's scopes are the credential's
-* permissions. better-supabase records the use when it verifies, so there is
-* no `touch`. A rotated key in its grace period verifies, and its credential
-* expires when the grace period ends. An invalid, revoked, expired or
-* rate-limited key, and a failed lookup, are `null`. `permdock/server` exports a different
-* `apiKeyVerifier`, over the application's own key records.
+* better-supabase's API keys as a `CredentialVerifier`, for `subjectFromApiKey`
+* from `permdock/server`, which reads PermDock's `pdk_<id>_<secret>` format:
+* create the keys with `prefix: "pdk"`. The credential id is the key's
+* `publicId`, the id in the token. A personal key is a `user` credential acting
+* as its user (inside its tenant when the key is limited to one), a tenant key
+* a `service` credential holding `serviceRoles` in its tenant, and the key's
+* scopes are the credential's permissions. better-supabase records the use when
+* it verifies, so there is no `touch`. A rotated key in its grace period
+* verifies, and its credential expires when the grace period ends. An invalid,
+* revoked, expired or rate-limited key, and a failed lookup, are `null`.
+* `permdock/server` exports a different `apiKeyVerifier`, over the
+* application's own key records.
 */
 function apiKeyVerifier(options) {
 	const fallback = manifestServiceRoles(options.manifest);
@@ -239,10 +243,10 @@ function apiKeyVerifier(options) {
 	} });
 }
 /**
-* The `claim` and `tenantClaim` options of better-supabase's
-* `apiKeyClaims()`, from the manifest's `rls.apiKeys`, so a key's token
-* carries the scopes ceiling, tenant and roles the `rls generate` helpers
-* read. Throws when the manifest has no `rls.apiKeys`.
+* The `claim` and `tenantClaim` options of better-supabase's `apiKeyClaims()`,
+* from the manifest's `rls.apiKeys`, so a key's token carries the scopes
+* ceiling, tenant and roles the `rls generate` helpers read. Throws when the
+* manifest has no `rls.apiKeys`.
 */
 function apiKeyClaimOptions(manifest) {
 	const rls = parseSupabaseManifest(manifest).rls;
@@ -301,8 +305,8 @@ function apiKeySubject(session, options) {
 /**
 * `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
 * `memberships` for the memberships and the entitlements module's `features`
-* claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
-* a verified `apiKey` session is the key's credential subject: a personal key
+* claim for `principal.plans` (`plans` names another claim). With `apiKeys`, a
+* verified `apiKey` session is the key's credential subject: a personal key
 * acts as its user within the key's scopes, a tenant key as a `service`
 * principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
 * `service` and `invalid` sessions, the subject is anonymous.
@@ -331,10 +335,10 @@ function permissionFor(events, type) {
 }
 /**
 * The per-subscriber check for better-supabase's webhooks-out, outbox and
-* realtime fan-out: the subscribers whose `principal` `decideFor` grants
-* the event type's permission on its row, in the event's tenant, as the
-* sender. An unmapped type, an event without a tenant or sender, a sender
-* outside the tenant and a throw reach no one.
+* realtime fan-out: the subscribers whose `principal` `decideFor` grants the
+* event type's permission on its row, in the event's tenant, as the sender. An
+* unmapped type, an event without a tenant or sender, a sender outside the
+* tenant and a throw reach no one.
 */
 function subscriberPolicy(options) {
 	return async (event, subscribers) => {
@@ -366,8 +370,8 @@ function subscriberPolicy(options) {
 //#endregion
 //#region src/better-supabase/support.ts
 /**
-* Bound to the admin, target, tenant, reason and mode, so the same start
-* gets the same approval token each time.
+* Bound to the admin, target, tenant, reason and mode, so the same start gets
+* the same approval token each time.
 */
 function requestId(input) {
 	return sha256Digest(canonicalJson({
@@ -384,8 +388,8 @@ function requestId(input) {
 * verified claims become a PermDock subject, and the start is decided with
 * `permdock.decideSupportSession` in the requested tenant. `true` only for
 * `granted`: an `approval-required` start passes once `approved` returns a
-* distinct approver for its token. `readOnly: false` needs `writable`. A
-* throw is `false`.
+* distinct approver for its token. `readOnly: false` needs `writable`. A throw
+* is `false`.
 */
 function supportPolicy(options) {
 	return async (input) => {
@@ -440,12 +444,18 @@ function supportPolicy(options) {
 //#region src/better-supabase/hooks.ts
 /** better-supabase's claim that caps a context to the permission keys it lists. */
 const PERMISSION_CAP_CLAIM = "bs_permission_cap";
-/** Whether `permdock` is granted `key` with no row; an unknown key and `approval-required` are `false`. */
+/**
+* Whether `permdock` is granted `key` with no row; an unknown key and
+* `approval-required` are `false`.
+*/
 function grants$1(permdock, key) {
 	const permission = findPermission(permdock.permissions, key);
 	return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
 }
-/** A list matches when every entry does, `anyOf` when one does; other leaves match nobody, as in SQL. */
+/**
+* A list matches when every entry does, `anyOf` when one does; other leaves
+* match nobody, as in SQL.
+*/
 function matches(approvers, userId, permdock) {
 	const items = flattenApprovers(approvers);
 	return items.length > 0 && items.every((item) => {
@@ -466,15 +476,15 @@ function matches(approvers, userId, permdock) {
 	});
 }
 /**
-* better-supabase's `AuthorizationHooks` (`createServer(betterSupabase,
-* { authorization })`), decided by `policy`. Every hook builds the
-* principal's instance from the claims `claims` loads now, never from the
-* request, and fails closed: a throw, an unknown key and `approval-required`
-* refuse. `automation` and `delegation` are always set; `identities`,
-* `delivery`, `approverOf`, `support` and `tickets` only with the options
-* they read. `delegation.permissions` maps each scope to the keys whose
-* `.scope` it is, was renamed from, or that a policy `oauthScopes` entry
-* covers, and reads no `authorization_details`.
+* better-supabase's `AuthorizationHooks` (`createServer(betterSupabase, {
+* authorization })`), decided by `policy`. Every hook builds the principal's
+* instance from the claims `claims` loads now, never from the request, and
+* fails closed: a throw, an unknown key and `approval-required` refuse.
+* `automation` and `delegation` are always set; `identities`, `delivery`,
+* `approverOf`, `support` and `tickets` only with the options they read.
+* `delegation.permissions` maps each scope to the keys whose `.scope` it is,
+* was renamed from, or that a policy `oauthScopes` entry covers, and reads no
+* `authorization_details`.
 */
 function authorizationHooks(options) {
 	const { policy } = options;
@@ -595,16 +605,19 @@ function authorizationHooks(options) {
 //#region src/better-supabase/approvers.ts
 /** `rls.approvals`' approver check, executable by `authenticated`. */
 const IS_APPROVER = "permdock_is_approver";
-/** The resource a cover's `resources` names for a request kind: `job` for `job.update`, else the kind. */
+/**
+* The resource a cover's `resources` names for a request kind: `job` for
+* `job.update`, else the kind.
+*/
 function resourceOf(kind) {
 	const dot = kind.indexOf(".");
 	return dot <= 0 ? kind : kind.slice(0, dot);
 }
 /**
 * better-supabase's `isApprover` template: one `case` over `{kind}` whose
-* branches call `permdock_is_approver` with the kind's approvers as JSON.
-* A kind with no branch is `false`. Only `user`, `holder` and `anyOf`
-* approvers match in SQL; other leaves are reported and match nobody.
+* branches call `permdock_is_approver` with the kind's approvers as JSON. A
+* kind with no branch is `false`. Only `user`, `holder` and `anyOf` approvers
+* match in SQL; other leaves are reported and match nobody.
 */
 function isApproverTemplate(input) {
 	const problems = [];
@@ -729,6 +742,14 @@ const listedName = (entry) => entry.listedAs ?? entry.helper;
 * functions; better-supabase fills it for the tenant scope only.
 */
 const HOLDERS_OF = "permitted_{scope}_users";
+/**
+* better-supabase calls `teamIdsOf` from RLS policies as `authenticated`, so it
+* fills from the caller-bound `member_<scope>_ids_of`, never from the `_for`
+* form only `supabase_auth_admin` may execute.
+*/
+const TEAM_IDS_OF = "member_{scope}_ids_of";
+/** The scope names better-supabase reads as its teams (doctor BS417). */
+const TEAM_SCOPE = /^teams?$/u;
 const ACTOR_MAY_WRITE = "permdock_actor_may_write";
 const OPTIONAL = [
 	"idsWithFor",
@@ -741,8 +762,8 @@ const OPTIONAL = [
 ];
 /**
 * Postgres aliases of the id types better-supabase reads (`uuid`, `text`,
-* `bigint`, `integer`), matching its `moduleIdType` from
-* `better-supabase/sql`, which this runtime entry does not import.
+* `bigint`, `integer`), matching its `moduleIdType` from `better-supabase/sql`,
+* which this runtime entry does not import.
 */
 const ID_TYPES = {
 	uuid: "uuid",
@@ -766,7 +787,10 @@ function tenantScopeOf(manifest, explicit) {
 	}
 	const roots = manifest.rls.scopes.filter((scope) => scope.within === void 0);
 	const [root] = roots;
-	if (root === void 0 || roots.length > 1) throw new TypeError(`PermDock: the manifest has ${roots.length} root scopes (${roots.map((scope) => scope.name).join(", ") || "none"}), so it can't tell which scope tenants are. Pass { scope } with one of ${names.join(", ")}.`);
+	if (root === void 0 || roots.length > 1) {
+		const listed = roots.map((scope) => scope.name).join(", ");
+		throw new TypeError(`PermDock: the manifest has ${roots.length} root scopes (${listed === "" ? "none" : listed}), so it can't tell which scope tenants are. Pass { scope } with one of ${names.join(", ")}.`);
+	}
 	return root.name;
 }
 function covers(membership, scope) {
@@ -857,9 +881,9 @@ function grantsCommandOf(schemas) {
 }
 /**
 * better-supabase's `permitted` template. An instance of a scope (`{resource}`
-* names the scope) is checked against that scope's ids; any other resource
-* at the tenant, and with a catalog only for a key without row conditions.
-* Without a catalog better-supabase refuses every key anyway.
+* names the scope) is checked against that scope's ids; any other resource at
+* the tenant, and with a catalog only for a key without row conditions. Without
+* a catalog better-supabase refuses every key anyway.
 */
 function permittedTemplate(schema, scopes, tenantScope, catalog) {
 	const idsOf = (scope) => `select ids::text from ${schema}.${sqlIdent(`permitted_${scope}_ids_by_permission`)}({permission}) as ids`;
@@ -885,9 +909,9 @@ const EFFECTS = {
 };
 /**
 * The catalog's `defineOperations` entries as better-supabase operations. A
-* name with a `.` is used as written (`workflow.node.http`); any other is
-* the tool `ai.tool.<name>` and `mcp.tool.<name>`. `critical` risk is
-* `high`, and `send` and `spend` effects are `external`.
+* name with a `.` is used as written (`workflow.node.http`); any other is the
+* tool `ai.tool.<name>` and `mcp.tool.<name>`. `critical` risk is `high`, and
+* `send` and `spend` effects are `external`.
 */
 function operationsOf(catalog) {
 	const operations = {};
@@ -908,33 +932,25 @@ function operationsOf(catalog) {
 	return operations;
 }
 /**
-* better-supabase's `delegation.scopes`: each permission's own scope, and
-* each coarse scope the catalog's `oauthScopes` lists, to the permission keys
-* it reaches, sorted by code point. A key the catalog does not list is
-* dropped, so a stale `oauthScopes` entry grants nothing.
+* better-supabase's `delegation.scopes`, the same map `rls.tokenScopes`
+* compiles.
 */
 function delegatedScopes(catalog) {
-	const delegated = {};
-	const known = /* @__PURE__ */ new Set();
-	for (const permission of catalog?.permissions ?? []) {
-		known.add(permission.key);
-		(delegated[permission.scope] ??= /* @__PURE__ */ new Set()).add(permission.key);
-	}
-	for (const entry of catalog?.oauthScopes ?? []) for (const key of entry.permissions) if (known.has(key)) (delegated[entry.scope] ??= /* @__PURE__ */ new Set()).add(key);
-	return Object.fromEntries(Object.keys(delegated).toSorted(byCodePoint).map((scope) => [scope, [...delegated[scope] ?? []].toSorted(byCodePoint)]));
+	return delegatedScopeMap(catalog?.permissions ?? [], catalog?.oauthScopes);
 }
 /**
 * better-supabase's `authorization` config value, built from PermDock's
 * manifest and catalog: the scopes, the `rls generate` helpers as SQL
-* templates, the membership tables, suspension rows, the token hook and
-* every catalog key with `sqlComplete` set from its `rowConditions`. A
-* `_for` template and `permissionsFor` are set only when the manifest lists
-* their helper, which `rls.mode: 'database'` writes; `isApprover` only with
-* `approvers` and `permdock_is_approver`, and otherwise `canApprove` only
-* with `approver`. `holdersOf` (`permitted_<tenant scope>_users`) and
+* templates, the membership tables, suspension rows, the token hook and every
+* catalog key with `sqlComplete` set from its `rowConditions`. A `_for`
+* template and `permissionsFor` are set only when the manifest lists their
+* helper, which `rls.mode: 'database'` writes; `isApprover` only with
+* `approvers` and `permdock_is_approver`, and otherwise `canApprove` only with
+* `approver`. `holdersOf` (`permitted_<tenant scope>_users`) and
 * `actorMayWrite` (`permdock_actor_may_write()`) are set when the manifest
-* lists their helper. Throws when the manifest or catalog is invalid, or when the
-* tenant scope is ambiguous.
+* lists their helper, and so is `teamIdsOf` (`member_<scope>_ids_of({user})`)
+* for a scope named `team` or `teams`. Throws when the manifest or catalog is
+* invalid, or when the tenant scope is ambiguous.
 */
 function authorizationProvider(options) {
 	const manifest = parseSupabaseManifest(options.manifest);
@@ -1020,6 +1036,17 @@ function authorizationProvider(options) {
 			role: "postgres"
 		});
 	}
+	let teamIdsOf;
+	const teamHelper = scopeNames.filter((scope) => TEAM_SCOPE.test(scope)).map((scope) => helpers.get(TEAM_IDS_OF.replace("{scope}", scope))).find((helper) => helper !== void 0);
+	if (teamHelper !== void 0) {
+		const fn = `${schema}.${sqlIdent(teamHelper.name)}`;
+		teamIdsOf = `${fn}({user})`;
+		requires.push({
+			function: fn,
+			args: argTypes(teamHelper.args),
+			role: "authenticated"
+		});
+	}
 	let actorMayWrite;
 	if (helpers.has(ACTOR_MAY_WRITE)) {
 		const fn = `${schema}.${sqlIdent(ACTOR_MAY_WRITE)}`;
@@ -1035,6 +1062,7 @@ function authorizationProvider(options) {
 		idsWith: `${schema}.${TEMPLATES.idsWith.sql}`,
 		isPlatform: `${schema}.${TEMPLATES.isPlatform.sql}`,
 		...holdersOf === void 0 ? {} : { holdersOf },
+		...teamIdsOf === void 0 ? {} : { teamIdsOf },
 		...actorMayWrite === void 0 ? {} : { actorMayWrite },
 		...isApprover === void 0 ? {} : { isApprover },
 		...permitted === void 0 ? {} : { permitted }
@@ -1070,7 +1098,7 @@ function authorizationProvider(options) {
 		...Object.keys(operations).length > 0 ? { operations } : {},
 		...Object.keys(delegated).length > 0 ? { delegation: { scopes: delegated } } : {},
 		decidingColumns: manifest.decidingColumns,
-		tokenHook: tokenHookOf(manifest),
+		...hasTokenHook(manifest) ? { tokenHook: tokenHookOf(manifest) } : {},
 		...problems.length > 0 ? { problems } : {}
 	});
 }
@@ -1106,7 +1134,10 @@ function decideWith(permdock, request) {
 	if (!isPermission(action)) return denied("Unknown permission.");
 	return outcomeOf(permdock.decide(action, request.resource.properties), action.key);
 }
-/** The verified claims better-supabase passes in `subject.properties.claims`, for a user or a delegated agent. */
+/**
+* The verified claims better-supabase passes in `subject.properties.claims`,
+* for a user or a delegated agent.
+*/
 function claimsOf(request) {
 	const { subject } = request;
 	if (subject.type !== "user" && subject.type !== "agent") return void 0;
@@ -1115,11 +1146,11 @@ function claimsOf(request) {
 }
 /**
 * better-supabase's `authorizer` for PermDock: every resource, action, route
-* guard and MCP tool that declares a `permission` is decided with `decide`.
-* The subject is mapped from the verified claims with
-* `subjectFromBetterSupabase`; the request's `context.tenant` selects the
-* active tenant only among the memberships the claims hold. A caller without
-* claims is anonymous, and a throw denies.
+* guard and MCP tool that declares a `permission` is decided with `decide`. The
+* subject is mapped from the verified claims with `subjectFromBetterSupabase`;
+* the request's `context.tenant` selects the active tenant only among the
+* memberships the claims hold. A caller without claims is anonymous, and a
+* throw denies.
 */
 function authorizer(options) {
 	const { operations } = options;
@@ -1176,7 +1207,10 @@ function authorizer(options) {
 }
 //#endregion
 //#region src/better-supabase/policies.ts
-/** PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the policies it generates. */
+/**
+* PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the
+* policies it generates.
+*/
 const SPLIT_KEY = /#\d+$/u;
 function checkedKey(where, permission, facts, scope) {
 	const key = permission.key;
@@ -1228,11 +1262,10 @@ function target(options) {
 	};
 }
 /**
-* A better-supabase bucket `policy` that checks PermDock permissions with
-* the `rls generate` helpers at `scope`. The helpers check role and scope
-* only, so a permission with row conditions (`rowConditions: true` in the
-* catalog, or a conditioned grant in `policy`), or one not granted at
-* `scope`, throws.
+* A better-supabase bucket `policy` that checks PermDock permissions with the
+* `rls generate` helpers at `scope`. The helpers check role and scope only, so
+* a permission with row conditions (`rowConditions: true` in the catalog, or a
+* conditioned grant in `policy`), or one not granted at `scope`, throws.
 */
 function bucketPolicy(access, options) {
 	const { facts, sql } = target(options);
@@ -1266,10 +1299,10 @@ function topicPolicy(access, options) {
 /**
 * `provider` with every `getToken`, `startAuthorization`,
 * `completeAuthorization` and `revoke` decided by PermDock first, on the
-* `CredentialRef` as the row. Anything but `granted` is a `forbidden`
-* error with hint `PERMDOCK_DENIED`, and a failed check is one too.
-* `capabilities` and `verifyInbound` (a third party's request, with no
-* user) pass through. Build it per request, with that request's PermDock.
+* `CredentialRef` as the row. Anything but `granted` is a `forbidden` error
+* with hint `PERMDOCK_DENIED`, and a failed check is one too. `capabilities`
+* and `verifyInbound` (a third party's request, with no user) pass through.
+* Build it per request, with that request's PermDock.
 */
 function credentialGuard(provider, options) {
 	const allowed = async (permission, ref) => {
@@ -1303,10 +1336,10 @@ const refused = (reason) => ({
 });
 /**
 * The `authorize` and `visible` hooks of better-supabase's `createMcp`, for
-* tools whose `meta` is a PermDock permission. A tool without a permission
-* is hidden and refused. `authorize` grants only a `granted` decision: an
-* approval-required call is refused, because `createMcp`
-* has no approval flow. A throw anywhere refuses.
+* tools whose `meta` is a PermDock permission. A tool without a permission is
+* hidden and refused. `authorize` grants only a `granted` decision: an
+* approval-required call is refused, because `createMcp` has no approval flow.
+* A throw anywhere refuses.
 */
 function toolPolicy(options) {
 	return Object.freeze({
@@ -1339,12 +1372,46 @@ function toolPolicy(options) {
 	});
 }
 //#endregion
+//#region src/better-supabase/memberships.ts
+function isLiveRow(row, userId) {
+	return isRecord(row) && row["user_id"] === userId && typeof row["organization_id"] === "string" && row["organization_id"] !== "" && typeof row["role"] === "string" && row["role"] !== "" && (row["disabled_at"] === void 0 || row["disabled_at"] === null);
+}
+/**
+* The principal `userId` is in the better-supabase organizations block: one
+* membership per organization, keyed on `organization_id`, holding the role of
+* each of the user's rows. Rows of another user, disabled rows and malformed
+* rows are dropped, so a user with none holds no membership.
+*/
+function principalFromMemberships(userId, rows, options = {}) {
+	const scope = options.scope ?? "tenant";
+	const roles = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!isLiveRow(row, userId)) continue;
+		const held = roles.get(row.organization_id) ?? [];
+		if (!held.includes(row.role)) held.push(row.role);
+		roles.set(row.organization_id, held);
+	}
+	const memberships = [...roles].map(([id, names]) => ({
+		scope,
+		id,
+		roles: names
+	}));
+	return freezeDeep(options.tenant === void 0 ? {
+		id: userId,
+		memberships
+	} : {
+		id: userId,
+		memberships,
+		tenant: options.tenant
+	});
+}
+//#endregion
 //#region src/better-supabase/principals.ts
 /**
 * A `PrincipalSource` over better-supabase: `principal(id)` maps the claims
 * `claims` loads with `subjectFromBetterSupabase`, and `principalByIdentity`
-* follows `identities` to a user or a contact. Claims for another user, a
-* link to a non-contact principal and a missing link are `null`.
+* follows `identities` to a user or a contact. Claims for another user, a link
+* to a non-contact principal and a missing link are `null`.
 */
 function principalSource(options) {
 	const principal = async (id, lookup = {}) => {
@@ -1369,26 +1436,95 @@ function principalSource(options) {
 	});
 }
 //#endregion
+//#region src/better-supabase/role-order.ts
+/**
+* The catalog's role keys highest first, for better-supabase's
+* `blocks.sso.options.roleOrder`: a role that `assigns` another comes before
+* it, and roles the `assigns` lists do not order keep catalog order. Roles that
+* assign each other stay together in catalog order, at the first one's place.
+*/
+function roleOrderFromCatalog(catalog, options = {}) {
+	const roles = (catalog.roles ?? []).filter((role) => role.key !== options.owner && (options.scope === void 0 || role.on === options.scope));
+	const keys = roles.map((role) => role.key);
+	const assigns = new Map(roles.map((role) => [role.key, (role.assigns ?? []).filter((target) => target !== role.key && keys.includes(target))]));
+	const reach = new Map(keys.map((key) => [key, reachable(key, assigns)]));
+	const group = new Map(keys.map((key) => [key, keys.find((other) => other === key || reach.get(key)?.has(other) === true && reach.get(other)?.has(key) === true) ?? key]));
+	const remaining = new Set(keys);
+	const order = [];
+	while (remaining.size > 0) {
+		const ready = [...remaining].find((key) => {
+			const own = group.get(key);
+			return [...remaining].every((by) => group.get(by) === own || ![...remaining].some((target) => group.get(target) === own && (assigns.get(by) ?? []).includes(target)));
+		});
+		const own = group.get(ready ?? [...remaining][0] ?? "");
+		for (const key of keys) if (remaining.has(key) && group.get(key) === own) {
+			order.push(key);
+			remaining.delete(key);
+		}
+	}
+	return Object.freeze(order);
+}
+function reachable(from, assigns) {
+	const seen = /* @__PURE__ */ new Set();
+	const stack = [...assigns.get(from) ?? []];
+	while (stack.length > 0) {
+		const key = stack.pop();
+		if (key !== void 0 && !seen.has(key)) {
+			seen.add(key);
+			stack.push(...assigns.get(key) ?? []);
+		}
+	}
+	return seen;
+}
+//#endregion
 //#region src/better-supabase/share-links.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
 function ownEntry(record, key) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
+function rowSubject(row) {
+	if (!Object.hasOwn(row, "subject")) {
+		const type = row["subjectType"];
+		const id = row["subjectId"];
+		return isId(type) && isId(id) ? {
+			type,
+			id
+		} : void 0;
+	}
+	const subject = row["subject"];
+	if (typeof subject !== "object" || subject === null) return void 0;
+	const ref = Object.fromEntries(Object.entries(subject));
+	const type = ref["type"];
+	const id = ref["id"];
+	return isId(type) && isId(id) ? {
+		type,
+		id
+	} : void 0;
+}
+/** The row and its subject, or `undefined` for a malformed row. */
+function parseRow(value) {
+	if (!isRow(value)) return void 0;
+	const subject = rowSubject(Object.fromEntries(Object.entries(value)));
+	return subject === void 0 ? void 0 : {
+		row: value,
+		subject
+	};
+}
 function isRow(value) {
 	if (typeof value !== "object" || value === null) return false;
 	const row = Object.fromEntries(Object.entries(value));
 	const expiresAt = row["expiresAt"];
-	return isId(row["id"]) && isId(row["organizationId"]) && isId(row["subjectType"]) && isId(row["subjectId"]) && typeof row["role"] === "string" && (row["versionId"] === void 0 || typeof row["versionId"] === "string") && (expiresAt === void 0 || typeof expiresAt === "object" && expiresAt !== null && "epochMilliseconds" in expiresAt && typeof expiresAt.epochMilliseconds === "number" && Number.isFinite(expiresAt.epochMilliseconds));
+	return isId(row["id"]) && isId(row["organizationId"]) && rowSubject(row) !== void 0 && typeof row["role"] === "string" && (row["versionId"] === void 0 || typeof row["versionId"] === "string") && (expiresAt === void 0 || typeof expiresAt === "object" && expiresAt !== null && "epochMilliseconds" in expiresAt && typeof expiresAt.epochMilliseconds === "number" && Number.isFinite(expiresAt.epochMilliseconds));
 }
 /**
-* Resolves a better-supabase share-link token into the `link` subject it
-* acts as, for `exchangeCapability` and `--capabilities` RLS. The row is
-* read on every call, so a revoked or expired link stops resolving at
-* once. An unknown token, subject type or role, a malformed row, a broken
-* link policy, a `resolve` error and a throw are the anonymous subject. So
-* is a link pinned to a version: a capability grants the subject's current
-* rows, so a pinned link reads through `versions.getShared(token)` instead.
+* Resolves a better-supabase share-link token into the `link` subject it acts
+* as, for `exchangeCapability` and `--capabilities` RLS. The row is read on
+* every call, so a revoked or expired link stops resolving at once. An unknown
+* token, subject type or role, a malformed row, a broken link policy, a
+* `resolve` error and a throw are the anonymous subject. So is a link pinned to
+* a version: a capability grants the subject's current rows, so a pinned link
+* reads through `versions.getShared(token)` instead.
 */
 async function subjectFromShareLink(token, options) {
 	if (token === void 0 || token === null || token.length === 0) return anonymousSubject();
@@ -1402,17 +1538,19 @@ async function subjectFromShareLink(token, options) {
 		return anonymousSubject();
 	};
 	let row;
+	let subject;
 	try {
 		const resolved = await options.shareLinks.resolve(token);
 		if (!resolved.ok) return deny("source-threw", "resolve-failed");
 		if (resolved.data === null) return deny("invalid-token", "share-link-unknown");
-		if (!isRow(resolved.data)) return deny("schema", "share-link-malformed");
-		row = resolved.data;
+		const parsed = parseRow(resolved.data);
+		if (parsed === void 0) return deny("schema", "share-link-malformed");
+		({row, subject} = parsed);
 	} catch {
 		return deny("source-threw");
 	}
 	if (row.versionId !== void 0) return deny("invalid-token", "share-link-pinned");
-	const target = ownEntry(options.links, row.subjectType);
+	const target = ownEntry(options.links, subject.type);
 	if (target === void 0) return deny("invalid-token", "subject-type-unknown");
 	const roles = idList(ownEntry(target.roles, row.role));
 	if (roles === void 0 || roles.length === 0) return deny("unknown-role");
@@ -1427,7 +1565,7 @@ async function subjectFromShareLink(token, options) {
 			id: row.id,
 			on: {
 				resource: target.resource,
-				id: row.subjectId
+				id: subject.id
 			},
 			roles,
 			expiresAt
@@ -1445,7 +1583,10 @@ async function subjectFromShareLink(token, options) {
 }
 //#endregion
 //#region src/better-supabase/workflow.ts
-/** Whether `permdock` is granted the permission `key` (a catalog key or scope) with no row. */
+/**
+* Whether `permdock` is granted the permission `key` (a catalog key or scope)
+* with no row.
+*/
 function grants(permdock, key) {
 	try {
 		const permission = findPermission(permdock.permissions, key);
@@ -1456,9 +1597,9 @@ function grants(permdock, key) {
 }
 /**
 * The `can` option of better-supabase's `authorizeHook`, for the caller's
-* `permdock`: `true` only when the caller is a member of the hook's tenant
-* and `decide` grants the permission its `hookMetadata` names there. An
-* unknown key, `approval-required` and a throw are `false`.
+* `permdock`: `true` only when the caller is a member of the hook's tenant and
+* `decide` grants the permission its `hookMetadata` names there. An unknown
+* key, `approval-required` and a throw are `false`.
 */
 function hookCan(permdock) {
 	return (tenant, key) => {
@@ -1470,10 +1611,10 @@ function hookCan(permdock) {
 	};
 }
 /**
-* The `can` option of better-supabase's `protectWebHandler`: `undefined`
-* (401) when the request has no signed-in principal or `getPermDock`
-* throws, otherwise whether `decide` grants the permission in the request's
-* active tenant. An unknown key and `approval-required` are `false` (403).
+* The `can` option of better-supabase's `protectWebHandler`: `undefined` (401)
+* when the request has no signed-in principal or `getPermDock` throws,
+* otherwise whether `decide` grants the permission in the request's active
+* tenant. An unknown key and `approval-required` are `false` (403).
 */
 function handlerCan(source) {
 	return async (request, key) => {
@@ -1488,4 +1629,4 @@ function handlerCan(source) {
 	};
 }
 //#endregion
-export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalSource, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };