permdock 0.6.0 → 0.8.0

package/dist/{row-check-Dt35czLy.d.ts → subject-settings-vNW8qmUH.d.ts}

@@ -1,24 +1,45 @@
+//#region src/conditions/row-check.d.ts
+/**
+ * Whether the row a unique key names exists, and if so whether the filter keeps
+ * it.
+ */
+type RowCheck = {
+  readonly found: false;
+} | {
+  readonly found: true;
+  readonly granted: boolean;
+};
+//#endregion
 //#region src/conditions/subject-settings.d.ts
 type WithSubjectOptions = {
-  /** Which settings the generated policies read; match `rls.dialect`. Default `supabase`. */
+  /**
+   * Which settings the generated policies read; match `rls.dialect`. Default
+   * `supabase`.
+   */
   readonly dialect?: "supabase" | "guc" | "neon";
   /**
-   * The local `role` setting before the claims: `authenticated` with a principal, `anon` without.
-   * `false` keeps the connection's role, for a login role that RLS already applies to.
+   * The local `role` setting before the claims: `authenticated` with a
+   * principal, `anon` without. `false` keeps the connection's role, for a login
+   * role that RLS already applies to.
    */
   readonly role?: "authenticated" | "anon" | false;
   /** Prefix of the `guc` dialect's settings (`rls.gucPrefix`). Default `app`. */
   readonly gucPrefix?: string;
-  /** Claim holding the principal's tenant (`rls.tenantClaim`). Default `tenant_id`. */
+  /**
+   * Claim holding the principal's tenant (`rls.tenantClaim`). Default
+   * `tenant_id`.
+   */
   readonly tenantClaim?: string;
   /**
-   * Further claims from the verified token, such as `user_role` or `memberships` for `jwt`-mode
-   * helpers. `sub`, `role` and the tenant claim always come from the subject.
+   * Further claims from the verified token, such as `user_role` or
+   * `memberships` for `jwt`-mode helpers. `sub`, `role` and the tenant claim
+   * always come from the subject.
    */
   readonly claims?: Readonly<Record<string, unknown>>;
   /**
-   * Field names of the API-key claim written for a principal that acts through a credential
-   * (`rls.apiKeys`). Default `{ claim: 'api_key', scopes: 'scopes', tenant: 'tenant', roles: 'roles' }`.
+   * Field names of the API-key claim written for a principal that acts through
+   * a credential (`rls.apiKeys`). Default `{ claim: 'api_key', scopes:
+   * 'scopes', tenant: 'tenant', roles: 'roles' }`.
    */
   readonly apiKeys?: {
     readonly claim?: string;
@@ -28,13 +49,4 @@ type WithSubjectOptions = {
   };
 };
 //#endregion
-//#region src/conditions/row-check.d.ts
-/** Whether the row a unique key names exists, and if so whether the filter keeps it. */
-type RowCheck = {
-  readonly found: false;
-} | {
-  readonly found: true;
-  readonly granted: boolean;
-};
-//#endregion
-export { WithSubjectOptions as n, RowCheck as t };
+export { RowCheck as n, WithSubjectOptions as t };

package/dist/supabase/index.d.ts

@@ -1,10 +1,11 @@
-import { Rt as Instant, ar as Subject } from "../policy-types-n0uRTsW8.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-BdtSDbBO.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-CEgRbefE.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-BzzaHxt3.js";
-import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-mx5ghSFM.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-Xc4zkszI.js";
-import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
+import { Rt as Instant, lr as Subject } from "../policy-types-CCiDRZBH.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-B_tiYvk8.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-DicQyqm-.js";
+import { C as SupabaseClaims, D as SupabasePermDockClaims, E as SupabaseMembershipClaim, O as supabaseClaims, S as SupabaseActClaim, T as SupabaseClaimsSchema, _ as SupabaseStorage, a as SupabaseActor, b as SupabaseSuspendedScope, c as SupabaseInclude, d as SupabasePrincipal, f as SupabaseRealtime, g as SupabaseSessionLike, h as SupabaseRlsOptions, i as SupabaseActiveRow, l as SupabaseMembershipTable, m as SupabaseRlsMembershipTable, o as SupabaseActorResult, p as SupabaseRlsConfig, r as RoleThrough, s as SupabaseDelegation, t as AuthorizeSqlOptions, u as SupabasePermissionRef, v as SupabaseSubjectOptions, w as SupabaseClaimsOptions, x as SupabaseSuspension, y as SupabaseSuspendedMembership } from "../types-ah9NlU6j.js";
+import { t as SqlQuery } from "../sql-B80DFdpG.js";
+import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-CzzWtnAb.js";
+import { a as MembershipStream, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-B1Os_YUu.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {
   /**
@@ -15,7 +16,10 @@ type ExchangeCapabilityOptions = {
   readonly key: Record<string, unknown> | {
     readonly secret: string;
   };
-  /** Default `ES256`, Supabase's asymmetric signing key; the legacy secret needs `HS256` named. */
+  /**
+   * Default `ES256`, Supabase's asymmetric signing key; the legacy secret needs
+   * `HS256` named.
+   */
   readonly alg?: "ES256" | "RS256" | "HS256";
   readonly kid?: string;
   readonly issuer?: string;
@@ -40,60 +44,66 @@ type SupabaseApprovalStoreOptions = {
   /**
    * Runs once per stored request, after the call that stored it, with the
    * stored request: notify the approvers, or cancel the requests this one
-   * replaces. A repeated ask that finds the request still open does not run
-   * it again. A throw fails the open, so the caller does not run the action.
+   * replaces. A repeated ask that finds the request still open does not run it
+   * again. A throw fails the open, so the caller does not run the action.
    */
   readonly onOpen?: (request: ApprovalRequest) => void | Promise<void>;
 };
 /**
  * An `ApprovalStore` over the table and functions `rls.approvals` generates,
- * called through supabase-js (`client.schema(schema).rpc(...)`) with a
- * client that may execute them, such as a `service_role` client. Each method
- * is one atomic statement in the database: a repeated ask keeps the open
- * request, two racing approvers both count towards a quorum, and two racing
- * resumes never both consume an approval.
+ * called through supabase-js (`client.schema(schema).rpc(...)`) with a client
+ * that may execute them, such as a `service_role` client. Each method is one
+ * atomic statement in the database: a repeated ask keeps the open request, two
+ * racing approvers both count towards a quorum, and two racing resumes never
+ * both consume an approval.
  */
 export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
 //#endregion
 //#region src/supabase/approval-delegations.d.ts
 type TableApprovalDelegationSourceOptions = {
   readonly query: SqlQuery;
-  /** Defaults to `permdock.approval_delegations`, the table `rls.approvals.delegations` generates. */
+  /**
+   * Defaults to `permdock.approval_delegations`, the table
+   * `rls.approvals.delegations` generates.
+   */
   readonly table?: string;
 };
 /**
  * Approval delegations (out-of-office covers) from the table
  * `rls.approvals.delegations` generates, so `approvalsHandler` and
- * `permdock_is_approver` read the same rows. A cover without a tenant
- * applies everywhere; a malformed row is skipped.
+ * `permdock_is_approver` read the same rows. A cover without a tenant applies
+ * everywhere; a malformed row is skipped.
  */
 export declare function tableApprovalDelegationSource(options: TableApprovalDelegationSourceOptions): ApprovalDelegationSource;
 //#endregion
 //#region src/supabase/rls.d.ts
 export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
 /**
- * `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
- * scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
- * `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
- * tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
- * tenant request with no memberships source is denied, never answered from global roles. It
- * answers "does a role hold this permission" without seeing a row: an allow with row conditions
- * does not count, and a deny the user's tenant or global roles hold overrides every allow.
- * Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+ * `authorize(requested_permission, requested_tenant text default null)` for
+ * Supabase's RBAC scaffold, over the `role_permissions (role, permission,
+ * grant_key, scope, effect)` table that `permdock rls generate` seeds.
+ * `database` reads `user_roles` (and the memberships table for a tenant) on
+ * every call; `jwt` reads the hook-injected `user_role` and `memberships`
+ * claims. A tenant request with no memberships source is denied, never answered
+ * from global roles. It answers "does a role hold this permission" without
+ * seeing a row: an allow with row conditions does not count, and a deny the
+ * user's tenant or global roles hold overrides every allow. Generated policies
+ * call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
  * instead. Only `authenticated` may execute it.
  */
 export declare function authorizeSql(options?: AuthorizeSqlOptions): string;
 //#endregion
 //#region src/supabase/subject.d.ts
 /**
- * Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
- * actor; nested levels are prior actors, kept on `chain` for audit), else the
- * OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
- * none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
- * user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
- * `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
- * with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
- * is `{ ok: false }` and must deny.
+ * Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the
+ * current actor; nested levels are prior actors, kept on `chain` for audit),
+ * else the OAuth `client_id` of a third-party app. The outer level's `kind`
+ * names the actor: none is `oauth-client`, `support` a support session,
+ * `impersonation` an admin acting as the user. Reads only `act` and
+ * `client_id`; the caller applies the role rule first (`anon` and
+ * `service_role` are anonymous and carry no actor). An `act` that is not a
+ * chain of objects each with a non-empty `sub`, that names another `kind`, or a
+ * support level without `session_id`, is `{ ok: false }` and must deny.
  */
 export declare function actorOf(claims: unknown): SupabaseActorResult;
 /**
@@ -103,9 +113,10 @@ export declare function actorOf(claims: unknown): SupabaseActorResult;
 export declare function delegationOf(claims: unknown): SupabaseDelegation | undefined;
 export declare function subjectFromSupabase(claims: unknown, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 /**
- * A verified session object (`{ kind, claims }`) in, `Subject` out.
- * Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+ * A verified session object (`{ kind, claims }`) in, `Subject` out. Only `kind:
+ * 'user'` sessions map; `anon`, `service`, `invalid` and anything else are
+ * anonymous.
  */
 export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
 //#endregion
-export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipStream, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDatabaseManifest, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifest, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestNames, type SupabaseManifestRequires, type SupabaseManifestResourceNames, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestScopeNames, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsMembershipTable, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, type TableApprovalDelegationSourceOptions, authzVersion, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseTenantClaim, tableMembershipSource };

package/dist/supabase/index.js

@@ -1,6 +1,6 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-x5JtR2tc.js";
-import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
-import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-vs5dGOsS.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAjUkF9w.js";
-import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
-export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-BL1qJzzY.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
+import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-CMAM-2A3.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-D4nuPXIQ.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-wg8WkkpD.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-CKQiCnON.js";
-import { n as ServerAdapterServices } from "../bind-DOyrv6zi.js";
+import { i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
+import { n as ServerAdapterServices } from "../bind-Cp2hBHzP.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**
@@ -35,8 +35,8 @@ export type SupabaseMiddlewareContext = {
 };
 /**
  * A Supabase secret key that acts as a tenant service principal. `id` is the
- * principal id, `roles` are held in `tenant` only, and `permissions` caps
- * what the key may do, as a `service` credential does.
+ * principal id, `roles` are held in `tenant` only, and `permissions` caps what
+ * the key may do, as a `service` credential does.
  */
 export type SupabaseSecretKey = {
   readonly id: string;
@@ -61,17 +61,23 @@ export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = InstanceOptions
   readonly context?: (ctx: SupabaseMiddlewareContext, request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
 };
 export type WithPermDockConfig = {
-  /** Run `protect` before the handler; a denial short-circuits with Problem Details. */
+  /**
+   * Run `protect` before the handler; a denial short-circuits with Problem
+   * Details.
+   */
   readonly protect?: Permission;
   /**
-   * The OAuth scopes that reach the handler: a delegated token holding none
-   * of them is refused with `insufficient_scope`. Without `protect`, the
-   * handler needs a signed-in principal and checks no permission.
+   * The OAuth scopes that reach the handler: a delegated token holding none of
+   * them is refused with `insufficient_scope`. Without `protect`, the handler
+   * needs a signed-in principal and checks no permission.
    */
   readonly oauthScopes?: readonly string[];
   /** Load the row `protect` decides on; `null` or `undefined` yields 404. */
   readonly data?: (ctx: SupabaseMiddlewareContext, request: Request) => unknown;
-  /** `true` when `data` returns a row the server loaded; anything else is validated before the check. */
+  /**
+   * `true` when `data` returns a row the server loaded; anything else is
+   * validated before the check.
+   */
   readonly trusted?: boolean;
 };
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { t as composeWraps } from "../wrap-gX61EtpB.js";
-import { r as credentialSubject } from "../credential-BcoiejpY.js";
-import { a as methodNotAllowed } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-Bu_eDqYw.js";
-import { t as createPermDock$1 } from "../create-DCF2SvoT.js";
-import { n as attached } from "../bind-CAvgUuKs.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { t as composeWraps } from "../wrap-B2wziJI_.js";
+import { r as credentialSubject } from "../credential-CyyyvCsL.js";
+import { o as methodNotAllowed } from "../problem-BVLHFK33.js";
+import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
+import { t as createPermDock$1 } from "../create-_noSrY1T.js";
+import { n as attached } from "../bind-D_sZSVA3.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-x5JtR2tc.js → supabase-BL1qJzzY.js}

@@ -1,14 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-BDutJkDL.js";
-import { a as parseCapability } from "./capability-N1K9IpqS.js";
+import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { s as ApprovalError } from "./types-CcUXciSj.js";
+import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-RNFvaJJv.js";
+import { a as parseCapability } from "./capability-BqX94r07.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
-import "./budget-NbEtbJC_.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
-import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
-import { t as callRpc } from "./postgrest-DAjUkF9w.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import "./budget-BELja5A9.js";
+import { d as keptKeys, l as roleColumn } from "./sources-CMAM-2A3.js";
+import { t as callRpc } from "./postgrest-D4nuPXIQ.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -61,6 +61,7 @@ const KNOWN = /* @__PURE__ */ new Set([
 	"roles",
 	"memberships",
 	"memberships_truncated",
+	"team_ids",
 	"attrs",
 	"authz_ver",
 	"client_id",
@@ -124,11 +125,16 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 		else issue(issues, [...path, "memberships"], "Expected an array");
 	}
 	optional(record, "memberships_truncated", path, issues, (value) => typeof value === "boolean", "a boolean");
+	optional(record, "team_ids", path, issues, isStrings, "an array of strings");
 	optional(record, tenantClaim, path, issues, isString, "a string");
 	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
-/** The outer level's `kind`: none, `support` with a `session_id`, `impersonation`, or `agent` with optional `tools` and `read_only` and no `session_id`. */
+/**
+* The outer level's `kind`: none, `support` with a `session_id`,
+* `impersonation`, or `agent` with optional `tools` and `read_only` and no
+* `session_id`.
+*/
 function checkActKind(level, path, issues) {
 	const marked = own(level, "kind");
 	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
@@ -221,7 +227,9 @@ function schemaOf(validate) {
 * Needs no validation library.
 *
 * ```ts
-* sb.claims(supabaseClaims().extend(z.object({ datetime_preferences: Prefs })))
+* sb.claims(
+*   supabaseClaims().extend(z.object({ datetime_preferences: Prefs })),
+* );
 * ```
 */
 function supabaseClaims(options = {}) {
@@ -234,7 +242,10 @@ function supabaseClaims(options = {}) {
 }
 //#endregion
 //#region src/supabase/approval-store.ts
-/** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
+/**
+* A stored body as the request it is; the store wrote it from an
+* `ApprovalRequest`.
+*/
 function requestOf(value) {
 	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
 	return value;
@@ -250,11 +261,11 @@ function filterOf(filter) {
 }
 /**
 * An `ApprovalStore` over the table and functions `rls.approvals` generates,
-* called through supabase-js (`client.schema(schema).rpc(...)`) with a
-* client that may execute them, such as a `service_role` client. Each method
-* is one atomic statement in the database: a repeated ask keeps the open
-* request, two racing approvers both count towards a quorum, and two racing
-* resumes never both consume an approval.
+* called through supabase-js (`client.schema(schema).rpc(...)`) with a client
+* that may execute them, such as a `service_role` client. Each method is one
+* atomic statement in the database: a repeated ask keeps the open request, two
+* racing approvers both count towards a quorum, and two racing resumes never
+* both consume an approval.
 */
 function supabaseApprovalStore(client, options = {}) {
 	const schema = options.schema ?? "permdock";
@@ -370,8 +381,8 @@ function delegationOf(row) {
 /**
 * Approval delegations (out-of-office covers) from the table
 * `rls.approvals.delegations` generates, so `approvalsHandler` and
-* `permdock_is_approver` read the same rows. A cover without a tenant
-* applies everywhere; a malformed row is skipped.
+* `permdock_is_approver` read the same rows. A cover without a tenant applies
+* everywhere; a malformed row is skipped.
 */
 function tableApprovalDelegationSource(options) {
 	const table = quoteQualifiedTable(options.table ?? "permdock.approval_delegations");
@@ -396,15 +407,42 @@ function tableApprovalDelegationSource(options) {
 function isTable(value) {
 	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
 }
+/** A table with its `tenant` / `team` columns moved under `columns`. */
+function configTable(table) {
+	const { tenant, team, ...rest } = table;
+	const columns = compact({
+		tenant,
+		team,
+		...table.columns
+	});
+	return Object.keys(columns).length === 0 ? rest : {
+		...rest,
+		columns
+	};
+}
+function configTables(tables) {
+	return tables === void 0 ? void 0 : Object.fromEntries(Object.entries(tables).map(([name, table]) => [name, configTable(table)]));
+}
+function configMemberships(raw) {
+	if (raw === void 0) return;
+	if (isTable(raw)) return { scopes: { tenant: configTable(raw) } };
+	const scopes = configTables(compact({
+		tenant: raw.tenant,
+		team: raw.team,
+		...raw.scopes
+	}));
+	return compact({
+		scopes: scopes === void 0 || Object.keys(scopes).length === 0 ? void 0 : scopes,
+		resource: configTables(raw.resource)
+	});
+}
 function supabaseRls(options = {}) {
-	const raw = options.memberships;
-	const memberships = raw === void 0 ? void 0 : isTable(raw) ? { tenant: raw } : raw;
 	return compact({
 		dialect: "supabase",
 		roleClaim: options.roleClaim ?? "user_role",
 		tenantClaim: options.tenantClaim ?? "tenant_id",
-		tenantType: options.tenantType,
-		memberships,
+		scopeTypes: options.tenantType === void 0 ? void 0 : { tenant: options.tenantType },
+		memberships: configMemberships(options.memberships),
 		suspension: options.suspension,
 		realtime: options.realtime,
 		storage: options.storage
@@ -412,7 +450,10 @@ function supabaseRls(options = {}) {
 }
 const ident = (name) => quoteSqlIdent(name);
 const literal = quoteSqlLiteral;
-/** The memberships table's role key over alias `m`, joined to its roles table when it holds a reference. */
+/**
+* The memberships table's role key over alias `m`, joined to its roles table
+* when it holds a reference.
+*/
 function tenantRole(memberships) {
 	return roleColumn(memberships.role, qualifySqlTable(memberships.table), "m", {
 		label: "authorizeSql tenant.role",
@@ -490,9 +531,9 @@ function customDatabaseBranch(q, scope, memberships, declared, levels, suspensio
     )`;
 }
 /**
-* The `role_permissions` match for one effect. An allow counts only without
-* row conditions (`grant_key = permission`): `authorize()` never sees the row.
-* A deny counts with or without them, so a conditional deny still denies.
+* The `role_permissions` match for one effect. An allow counts only without row
+* conditions (`grant_key = permission`): `authorize()` never sees the row. A
+* deny counts with or without them, so a conditional deny still denies.
 */
 function effectMatch(scope, effect) {
 	return `rp.permission = requested_permission::text
@@ -549,7 +590,10 @@ ${tenantBranch}
     and not ${global("deny")};
 end;`;
 }
-/** A claim membership whose `expires_at` (epoch seconds) has passed no longer holds its roles. */
+/**
+* A claim membership whose `expires_at` (epoch seconds) has passed no longer
+* holds its roles.
+*/
 const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expires_at')
           when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
           else true
@@ -615,14 +659,16 @@ begin
 end;`;
 }
 /**
-* `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
-* scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
-* `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
-* tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
-* tenant request with no memberships source is denied, never answered from global roles. It
-* answers "does a role hold this permission" without seeing a row: an allow with row conditions
-* does not count, and a deny the user's tenant or global roles hold overrides every allow.
-* Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+* `authorize(requested_permission, requested_tenant text default null)` for
+* Supabase's RBAC scaffold, over the `role_permissions (role, permission,
+* grant_key, scope, effect)` table that `permdock rls generate` seeds.
+* `database` reads `user_roles` (and the memberships table for a tenant) on
+* every call; `jwt` reads the hook-injected `user_role` and `memberships`
+* claims. A tenant request with no memberships source is denied, never answered
+* from global roles. It answers "does a role hold this permission" without
+* seeing a row: an allow with row conditions does not count, and a deny the
+* user's tenant or global roles hold overrides every allow. Generated policies
+* call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
 * instead. Only `authenticated` may execute it.
 */
 function authorizeSql(options = {}) {

package/dist/{supabase-By_frk3U.js → supabase-D39cuGPt.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/supabase.ts
 const hookGenerate = defineLeaf({
 	flags: {
@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
+		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
+		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,