permdock 0.8.0 → 0.10.0

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { $n as AuthorizationDetail, T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, ar as AuthorizationDetail, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;

package/dist/a2a/index.js

@@ -5,10 +5,10 @@ import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "..
 import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
 import { t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-L-_I_3zP.js";
+import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BvjivVb9.js";
 import { p as wwwAuthenticate, r as bearerChallenge } from "../problem-BVLHFK33.js";
-import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
-import { n as createAgentKernel } from "../kernel-C-fYydV2.js";
+import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
+import { n as createAgentKernel } from "../kernel-qv4cr9w8.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/{action-result-CL-QCITA.d.ts → action-result-BcudBQOF.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
+import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
 //#region src/core/action-result.d.ts
 /** What a `protectAction` action resolves to; both members cross to the client. */
 type ActionResult<T> = {

package/dist/active-tenant-DVee32-T.js

@@ -0,0 +1,39 @@
+import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
+//#region src/better-supabase/active-tenant.ts
+function describe(from) {
+	return "appMetadata" in from ? `app_metadata.${from.appMetadata}` : `${from.table}.${from.column} (joined on ${from.id})`;
+}
+/**
+* Why PermDock's token hook and better-supabase disagree on the active tenant,
+* or `undefined` when they agree. `"resolver"` takes the tenant from the
+* request, so any hook source agrees with it.
+*/
+function activeTenantMismatch(from, tenantClaim, activeTenant) {
+	if (activeTenant === "resolver") return;
+	if (activeTenant === "claim") {
+		if ("appMetadata" in from && from.appMetadata === tenantClaim) return;
+		return `blocks.permissions.activeTenant is "claim", so better-supabase's switch_organization writes app_metadata.${tenantClaim}, but PermDock's token hook reads the active tenant from ${describe(from)}. Set supabase.hook.activeFrom: "app_metadata.${tenantClaim}" and run permdock supabase hook generate.`;
+	}
+	const dot = activeTenant.profileColumn.lastIndexOf(".");
+	if (dot <= 0) return;
+	const table = qualifySqlTable(activeTenant.profileColumn.slice(0, dot));
+	const column = activeTenant.profileColumn.slice(dot + 1);
+	const id = activeTenant.key ?? "id";
+	if ("table" in from && qualifySqlTable(from.table) === table && from.column === column && from.id === id) return;
+	return `blocks.permissions.activeTenant writes the active tenant to ${table}.${column} (joined on ${id}), but PermDock's token hook reads it from ${describe(from)}. Set supabase.hook.activeFrom: { table: "${table}", column: "${column}", id: "${id}" } and run permdock supabase hook generate.`;
+}
+/**
+* Where the token hook reads the active tenant, as better-supabase names it in
+* `tokenHook.activeOrganizationFrom`, or `undefined` when the hook reads an
+* `app_metadata` key other than the tenant claim, which has no better-supabase
+* name.
+*/
+function activeOrganizationFrom(from, tenantClaim) {
+	if ("appMetadata" in from) return from.appMetadata === tenantClaim ? "claim" : void 0;
+	return {
+		profileColumn: `${qualifySqlTable(from.table)}.${from.column}`,
+		...from.id === "id" ? {} : { key: from.id }
+	};
+}
+//#endregion
+export { activeTenantMismatch as n, activeOrganizationFrom as t };

package/dist/{adoption-scan-BLs67P1l.js → adoption-scan-0oFt2RD5.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-BSjrtIHw.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
-import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DHldhVUv.js";
+import { a as createPermDock, c as ModelMap, d as StepUp, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BPUopdfL.js";
 export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type StepUp, type ToolBinding, type ToolMap, createPermDock };

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-Cq4Uox0f.js";
+export { n as createPermDock } from "../create-6EwRQlig.js";

package/dist/ai-sdk/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CHNlVInN.js";
-import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-DHldhVUv.js";
+import { d as StepUp, o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
-import { r as stepUpText, t as approvalTokenOf } from "../kernel-C-fYydV2.js";
-import { t as agentRuntime } from "../create-Cq4Uox0f.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { r as stepUpText, t as approvalTokenOf } from "../kernel-qv4cr9w8.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",

package/dist/{approval-prompt-PYagyQUj.d.ts → approval-prompt-3BqWczTt.d.ts}

@@ -1,5 +1,5 @@
 import { s as OperationMeta, t as Operation } from "./operations-Ci_rT6Uo.js";
-import { u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { u as ApprovalRequest } from "./types-DLvhVm1r.js";
 //#region src/delivery/approval-prompt.d.ts
 /**
  * What an email or chat prompt shows an approver, wire format v1. It carries no

package/dist/approvals/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-B_tiYvk8.js";
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-DLvhVm1r.js";
 import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-CHwoRRpB.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-B2mlGuhW.js";
-import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-_9UiQIkt.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-B2efzoSX.js";
+import { $ as AccessReviewHolder, A as SignApprovalOptions, B as IdempotentResponse, C as ApproverRelationsOptions, D as approvalView, E as approvalEntityTag, F as ApprovalsHandlerOptions, G as ApprovalDelegationMatch, H as idempotencyRecordKey, I as approvalsHandler, J as memoryApprovalDelegationSource, K as MatchDelegationOptions, L as IdempotencyRecord, M as signApproval, N as APPROVAL_REQUEST_SCHEMA, O as ApprovalSignatureClaims, P as parseApprovalRequest, Q as pageAccessReviewItems, R as IdempotencyStore, S as vouchApproval, T as ApprovalView, U as matchesIdempotencyRecord, V as idempotencyRecord, W as memoryIdempotencyStore, X as MemoryAccessReviewStore, Y as parseApprovalDelegation, Z as memoryAccessReviewStore, _ as resolveApproval, a as approverPermissions, at as isAccessReviewError, b as storedApprovalToken, c as decodeApprovalCursor, ct as decideAccessReviewItem, d as pageApprovals, et as AccessReviewOptions, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, it as AccessReviewErrorCode, j as approvalSignatureClaims, k as ApprovalSignatureEntry, l as encodeApprovalCursor, lt as AccessReviewsHandlerOptions, m as inspectApproval, n as applyApprovalVerdict, nt as startAccessReview, o as ApprovalCursorPosition, ot as AccessReviewVerdict, p as consumeApproval, q as matchDelegation, r as assertApprover, rt as AccessReviewError, s as approvalPageSize, st as accessReviewerEligible, t as MemoryApprovalStore, tt as StartAccessReviewInput, u as listAllApprovals, ut as accessReviewsHandler, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as IdempotentCall } from "../index-DJwEgYzA.js";
 export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyRecord, type IdempotencyStore, type IdempotentCall, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalEntityTag, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalView, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, idempotencyRecord, idempotencyRecordKey, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, matchesIdempotencyRecord, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/{arazzo-3RhGfkAK.js → arazzo-DA9PCXew.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-B5-ulWif.js")).runArazzo({
+		return (await import("./arazzo-DhxDfYt-.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-B5-ulWif.js → arazzo-DhxDfYt-.js}

@@ -1,9 +1,9 @@
-import { _ as arazzoFindings } from "./src-DZ0l9UAg.js";
+import { _ as arazzoFindings } from "./src-C_pi2Rnh.js";
 import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/astro/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { APIContext, MiddlewareHandler } from "astro";
 //#region src/astro/create.d.ts
 type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;

package/dist/astro/index.js

@@ -1,5 +1,5 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/astro/create.ts
 const route = {
 	context: (context) => context,

package/dist/{audience-BAkBDMqn.js → audience-DTjR8xet.js}

@@ -1,4 +1,4 @@
-import { t as whoCan } from "./who-can-rI7dCR9Q.js";
+import { t as whoCan } from "./who-can-BoDJm0Nc.js";
 //#region src/delivery/audience.ts
 async function granted(permdock, ids, permission, row) {
 	const unique = [...new Set(ids.filter((id) => typeof id === "string" && id !== ""))];

package/dist/authzen/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, Zn as Actor, rr as Delegation, sr as Principal } from "../policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
-import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-z8dQFDaN.js";
+import { T as Policy, lr as Delegation, pr as Principal, rr as Actor } from "../policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-DOWuBpWv.js";
 //#region src/authzen/map.d.ts
 type AuthzenEntity = {
   readonly type?: unknown;

package/dist/authzen/index.js

@@ -7,7 +7,7 @@ import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { n as readBodyText, t as MAX_BODY_BYTES } from "../body-text-DQhcmqdY.js";
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
 import { d as unauthenticatedProblem, l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-IBceAeKT.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {

package/dist/{automation-DqEoWHBc.d.ts → automation-C6Jg75xq.d.ts}

@@ -1,4 +1,4 @@
-import { Lt as InstanceHandle, Rn as Denial, Rt as Instant } from "./policy-types-CCiDRZBH.js";
+import { Ut as InstanceHandle, Wn as Denial, Wt as Instant } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
 //#region src/core/automation.d.ts

package/dist/better-auth/index.d.ts

@@ -1,4 +1,4 @@
-import { N as RoleBinding, W as CustomRoleSource, lr as Subject, q as DecisionSink, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { G as CustomRoleSource, J as DecisionSink, N as RoleBinding, hr as Subject, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts

package/dist/better-supabase/index.d.ts

@@ -1,13 +1,15 @@
-import { Rt as Instant, St as ApiKeyPrincipal, T as Policy, U as CredentialVerifier, Zt as AuthEvent, _n as ApproverInput, gt as SupportSession, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { Cn as ApproverInput, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Wt as Instant, X as Intent, hr as Subject, nt as MembershipSource, pr as Principal, rn as AuthEvent } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, h as PrincipalIdentity, o as PermDockOptions } from "../permdock-B6Sf4T_S.js";
-import { c as AccessReviewStore } from "../types-B2mlGuhW.js";
-import { i as SupabaseRpcCaller } from "../postgrest-DicQyqm-.js";
+import { _ as PrincipalSource, a as PermDock, h as PrincipalIdentity, o as PermDockOptions } from "../permdock-CprAPN3w.js";
+import { c as AccessReviewStore } from "../types-B2efzoSX.js";
+import { i as SupabaseRpcCaller } from "../postgrest-D5nUGm-c.js";
 import { a as CatalogDocument } from "../types-ZzRGoViD.js";
-import { d as SupabasePrincipal, g as SupabaseSessionLike, v as SupabaseSubjectOptions } from "../types-ah9NlU6j.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-ChuiONQU.js";
+import { A as SupabaseSubjectOptions, C as SupabasePrincipal, N as SupabaseSuspension, O as SupabaseSessionLike, s as SqlMembershipSource } from "../sources-oB1Hg1Fm.js";
+import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
+import { t as SqlQuery } from "../sql-B80DFdpG.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Di9tiUvi.js";
 import { AuthorizationProvider } from "better-supabase/config";
-import { AuthSession, AuthorizationHooks, Authorizer, SupportAuthorize, SupportAuthorizeInput } from "better-supabase/server";
+import { AuthSession, AuthorizationHooks, AuthorizationRequest, Authorizer, SupportAuthorize, SupportAuthorizeInput } from "better-supabase/server";
 import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";
 import { ApiKey, ApiKeyClaimsOptions, ApiKeys } from "better-supabase/blocks/api-keys";
 import { AccessTopicPolicy } from "better-supabase/realtime";
@@ -159,6 +161,18 @@ type ApiKeySessionOptions = {
    */
   readonly serviceRoles?: ServiceRoles<ApiKeySession>;
 };
+/**
+ * better-supabase's `SessionSnapshot` (0.15 and later): one verified token,
+ * from `bsb.getRequestSession()`, that `'use cache: private'` scopes share. Its
+ * `issuedAt` and `authzVersion` come from the `iat` and `authz_ver` claims.
+ */
+type SessionSnapshotLike = {
+  readonly accessToken: string;
+  readonly userId: string;
+  readonly claims: unknown;
+  readonly issuedAt?: number | null;
+  readonly authzVersion?: number | null;
+};
 /** The claim, and the short code better-supabase writes for each feature key. */
 type FeatureClaim = EntitlementClaimOptions;
 type BetterSupabaseSubjectOptions = Omit<SupabaseSubjectOptions, "claims"> & {
@@ -184,9 +198,10 @@ type BetterSupabaseSubjectOptions = Omit<SupabaseSubjectOptions, "claims"> & {
  * verified `apiKey` session is the key's credential subject: a personal key
  * acts as its user within the key's scopes, a tenant key as a `service`
  * principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
- * `service` and `invalid` sessions, the subject is anonymous.
+ * `service` and `invalid` sessions, the subject is anonymous. A
+ * `SessionSnapshot` maps as the user session of its claims.
  */
-export declare function subjectFromBetterSupabase(session: SupabaseSessionLike | ApiKeySession | null | undefined, options?: BetterSupabaseSubjectOptions): Subject<SupabasePrincipal> | Subject<ApiKeyPrincipal> | Subject;
+export declare function subjectFromBetterSupabase(session: SupabaseSessionLike | ApiKeySession | SessionSnapshotLike | null | undefined, options?: BetterSupabaseSubjectOptions): Subject<SupabasePrincipal> | Subject<ApiKeyPrincipal> | Subject;
 //#endregion
 //#region src/better-supabase/subscribers.d.ts
 /** The fields of better-supabase's `OutboxEvent` the policy reads. */
@@ -350,6 +365,17 @@ type AuthorizationHooksOptions = {
  */
 export declare function authorizationHooks(options: AuthorizationHooksOptions): AuthorizationHooks;
 //#endregion
+//#region src/better-supabase/active-tenant.d.ts
+/**
+ * better-supabase's `blocks.permissions.activeTenant`: where its
+ * `switch_organization` writes the active tenant and `current_tenant_id()`
+ * reads it.
+ */
+type BetterSupabaseActiveTenant = "claim" | "resolver" | {
+  readonly profileColumn: string;
+  readonly key?: string;
+};
+//#endregion
 //#region src/better-supabase/provider.d.ts
 type AuthorizationProviderOptions = {
   /**
@@ -380,6 +406,14 @@ type AuthorizationProviderOptions = {
    * `permdock_is_approver` from `rls.approvals`.
    */
   readonly approvers?: ProviderApprovers;
+  /**
+   * better-supabase's `blocks.permissions.activeTenant`. When the token hook
+   * reads the active tenant from another place than better-supabase writes it,
+   * `problems` names the `supabase.hook.activeFrom` to set. With `"resolver"`
+   * the tenant comes from the request, so `tokenHook.activeOrganizationFrom`
+   * stays unset and doctor BS409 has nothing to compare.
+   */
+  readonly activeTenant?: BetterSupabaseActiveTenant;
 };
 /**
  * better-supabase's `authorization` config value, built from PermDock's
@@ -387,16 +421,31 @@ type AuthorizationProviderOptions = {
  * templates, the membership tables, suspension rows, the token hook and every
  * catalog key with `sqlComplete` set from its `rowConditions`. A `_for`
  * template and `permissionsFor` are set only when the manifest lists their
- * helper, which `rls.mode: 'database'` writes; `isApprover` only with
- * `approvers` and `permdock_is_approver`, and otherwise `canApprove` only with
- * `approver`. `holdersOf` (`permitted_<tenant scope>_users`) and
- * `actorMayWrite` (`permdock_actor_may_write()`) are set when the manifest
- * lists their helper, and so is `teamIdsOf` (`member_<scope>_ids_of({user})`)
- * for a scope named `team` or `teams`. Throws when the manifest or catalog is
- * invalid, or when the tenant scope is ambiguous.
+ * helper, which `rls.mode: 'database'` writes. `isApprover` is set with
+ * `approvers` or `approver` and `permdock_is_approver`: `approver` fills its
+ * `'ai-tool'` entry. `canApprove` is never set. `holdersOf` (`permitted_<tenant
+ * scope>_users`) and `actorMayWrite` (`permdock_actor_may_write()`) are set
+ * when the manifest lists their helper, and so is `teamIdsOf`
+ * (`member_<scope>_ids_of({user})`) for a scope named `team` or `teams`. Throws
+ * when the manifest or catalog is invalid, or when the tenant scope is
+ * ambiguous.
  */
 export declare function authorizationProvider(options: AuthorizationProviderOptions): AuthorizationProvider;
 //#endregion
+//#region src/better-supabase/report.d.ts
+/** What an `onError` sink receives next to the thrown error. */
+type BetterSupabaseErrorContext = {
+  /** The key of the permission being checked, when the request named one. */
+  readonly permission: string | null;
+  /** The active tenant the check ran in, or `null`. */
+  readonly tenant: string | null;
+};
+/**
+ * Receives an error a permission check threw. The check still denies; a sink
+ * that throws is ignored.
+ */
+type BetterSupabaseOnError = (error: unknown, context: BetterSupabaseErrorContext) => void;
+//#endregion
 //#region src/better-supabase/authorizer.d.ts
 /**
  * The table operations better-supabase's `permissions: true` resolves through
@@ -416,10 +465,36 @@ type AuthorizerOptions = {
    */
   readonly operations?: Readonly<Record<string, Partial<Record<AuthorizerOperation, Permission>>>>;
   /**
-   * Sources and sinks for each instance. The subject, actor and tenant always
-   * come from the verified request.
+   * The membership source a stale or truncated token is re-read from, wrapped
+   * in `claimsFirst(source, { onStale: 'reread', versions })`. `versions` is
+   * the cache better-supabase passes at runtime (`createNext({ versions })`),
+   * else the `versions` option.
    */
-  readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt">;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /**
+   * The current authorization version for `memberships`, such as
+   * `authzVersion({ query })`; default the source's own `version`.
+   */
+  readonly version?: MembershipSource["version"];
+  /**
+   * The version cache for `memberships` when better-supabase passes none (0.13
+   * and 0.14, or a server created without `versions`).
+   */
+  readonly versions?: VersionCache;
+  /**
+   * The intent of one check. By default a batch (`evaluations`, list and row
+   * filtering) and an action named `read`, `list` or `view` are `read`, so
+   * `claimsFirst` may answer from the version cache; every other check is
+   * `write` and reads the version live.
+   */
+  readonly intent?: (request: AuthorizationRequest<Permission>) => Intent;
+  /** Receives every error a check threw; the check still denies. */
+  readonly onError?: BetterSupabaseOnError;
+  /**
+   * Sources and sinks for each instance. The subject, actor, tenant and intent
+   * always come from the verified request.
+   */
+  readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt" | "intent">;
 };
 /**
  * better-supabase's `authorizer` for PermDock: every resource, action, route
@@ -427,10 +502,76 @@ type AuthorizerOptions = {
  * subject is mapped from the verified claims with `subjectFromBetterSupabase`;
  * the request's `context.tenant` selects the active tenant only among the
  * memberships the claims hold. A caller without claims is anonymous, and a
- * throw denies.
+ * throw denies. With better-supabase 0.15's runtime `memo`, the checks of one
+ * request scope share an instance per claims, tenant and intent.
  */
 export declare function authorizer(options: AuthorizerOptions): Authorizer<Permission>;
 //#endregion
+//#region src/better-supabase/block-memberships.d.ts
+/**
+ * A roles table the membership's role column references, in better-supabase's
+ * `blocks.memberships.options.roleThrough` shape: the role column holds
+ * `table.id`, and `table.column` holds the role key.
+ */
+type BlockRoleThrough = {
+  readonly table: string;
+  readonly id: string;
+  readonly column: string;
+};
+/**
+ * A role junction holding several roles per membership: one row per role,
+ * `membership` referencing the membership's `id` column and `role` holding the
+ * role key.
+ */
+type BlockRoleJunction = {
+  readonly table: string;
+  /** The junction column referencing the membership. */
+  readonly membership: string;
+  /** The junction column holding the role key. */
+  readonly role: string;
+  /** The membership's primary key column. Default `id`. */
+  readonly id?: string;
+};
+type BlockMembershipSourceOptions = {
+  /** The memberships block's table. Default `better_supabase.memberships`. */
+  readonly table?: string;
+  /** The declared scope a row is a membership of. Default `organization`. */
+  readonly scope?: string;
+  /**
+   * Physical column names, keyed like better-supabase's
+   * `blocks.memberships.columns.memberships`. Defaults `organization_id`,
+   * `user_id`, `role` and `disabled_at`.
+   */
+  readonly columns?: {
+    readonly tenant?: string;
+    readonly user?: string;
+    readonly role?: string;
+    readonly disabledAt?: string | null;
+  };
+  /**
+   * The roles table the role column references, so a custom role's key reads
+   * through it. The same value as `blocks.memberships.options.roleThrough`.
+   */
+  readonly roleThrough?: BlockRoleThrough;
+  /**
+   * A role junction read instead of the role column. `"many"` reads
+   * `membership_roles` in the table's schema, the role set
+   * `blocks.memberships.options.roles.many` keeps, keyed by the tenant and user
+   * columns.
+   */
+  readonly roles?: BlockRoleJunction | "many";
+  readonly query?: SqlQuery;
+  readonly suspension?: SupabaseSuspension;
+};
+/**
+ * Memberships from better-supabase's `memberships` block table: one row per
+ * user and organization, its role key in `role`, a custom role's key through
+ * `roleThrough`, or several roles from a `roles` junction or, with `roles:
+ * "many"`, from better-supabase's `membership_roles`. A row with `disabled_at`
+ * set is no membership.
+ */
+export declare function blockMembershipSource(options?: BlockMembershipSourceOptions): SqlMembershipSource;
+//#endregion
 //#region src/better-supabase/policies.d.ts
 type AccessScope = {
   /**
@@ -536,6 +677,11 @@ type ToolPolicyOptions<C> = {
    * with a row condition denies.
    */
   readonly data?: (ctx: C, tool: McpToolRef, args: unknown) => unknown;
+  /**
+   * Receives every error `authorize` or `visible` threw; the tool stays
+   * refused.
+   */
+  readonly onError?: BetterSupabaseOnError;
 };
 type ToolPolicy<C> = {
   readonly authorize: (ctx: C, tool: McpToolRef, args: unknown) => Promise<McpToolDecision>;
@@ -546,7 +692,8 @@ type ToolPolicy<C> = {
  * tools whose `meta` is a PermDock permission. A tool without a permission is
  * hidden and refused. `authorize` grants only a `granted` decision: an
  * approval-required call is refused, because `createMcp` has no approval flow.
- * A throw anywhere refuses.
+ * A denial's text names the first denial reason. A throw anywhere refuses and
+ * reaches `onError`.
  */
 export declare function toolPolicy<C>(options: ToolPolicyOptions<C>): ToolPolicy<C>;
 //#endregion
@@ -729,19 +876,37 @@ export declare function subjectFromShareLink(token: string | undefined | null, o
 type HandlerPermDockSource = {
   readonly getPermDock: (request: Request) => PermDock | Promise<PermDock>;
 };
+type HookCanOptions = {
+  /**
+   * Loads the row the permission `key` is decided on in `tenant`, so a
+   * condition on the row applies. Without it there is no row; a throw is
+   * `false`.
+   */
+  readonly data?: (tenant: string, key: string) => unknown;
+};
+type HandlerCanOptions = {
+  /**
+   * Loads the row the permission `key` is decided on for `request`, so a
+   * condition on the row applies. Without it there is no row; a throw is
+   * `false` (403).
+   */
+  readonly data?: (request: Request, key: string) => unknown;
+};
 /**
  * The `can` option of better-supabase's `authorizeHook`, for the caller's
  * `permdock`: `true` only when the caller is a member of the hook's tenant and
- * `decide` grants the permission its `hookMetadata` names there. An unknown
- * key, `approval-required` and a throw are `false`.
+ * `decide` grants the permission its `hookMetadata` names there, on the row
+ * `options.data` loads. An unknown key, `approval-required` and a throw are
+ * `false`.
  */
-export declare function hookCan(permdock: PermDock): NonNullable<AuthorizeHookOptions["can"]>;
+export declare function hookCan(permdock: PermDock, options?: HookCanOptions): NonNullable<AuthorizeHookOptions["can"]>;
 /**
  * The `can` option of better-supabase's `protectWebHandler`: `undefined` (401)
  * when the request has no signed-in principal or `getPermDock` throws,
  * otherwise whether `decide` grants the permission in the request's active
- * tenant. An unknown key and `approval-required` are `false` (403).
+ * tenant, on the row `options.data` loads. An unknown key, `approval-required`
+ * and a throwing `data` are `false` (403).
  */
-export declare function handlerCan(source: HandlerPermDockSource): ProtectWebHandlerOptions["can"];
+export declare function handlerCan(source: HandlerPermDockSource, options?: HandlerCanOptions): ProtectWebHandlerOptions["can"];
 //#endregion
-export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseIdentityLink, BetterSupabaseMembershipRow, BetterSupabaseSubjectOptions, BucketAccess, CredentialGuardOptions, HandlerPermDockSource, McpToolDecision, McpToolRef, PendingSupportSession, PrincipalFromMembershipsOptions, PrincipalSourceOptions, ProviderApprovers, RoleOrderOptions, ServiceRoles, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess };
+export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseActiveTenant, BetterSupabaseErrorContext, BetterSupabaseIdentityLink, BetterSupabaseMembershipRow, BetterSupabaseOnError, BetterSupabaseSubjectOptions, BlockMembershipSourceOptions, BlockRoleJunction, BlockRoleThrough, BucketAccess, CredentialGuardOptions, HandlerCanOptions, HandlerPermDockSource, HookCanOptions, McpToolDecision, McpToolRef, PendingSupportSession, PrincipalFromMembershipsOptions, PrincipalSourceOptions, ProviderApprovers, RoleOrderOptions, ServiceRoles, SessionSnapshotLike, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess };