permdock 0.0.0 → 0.1.0

package/dist/kernel-YOGCWNLf.js

@@ -0,0 +1,211 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as describe } from "./describe-Bt1YD5uS.js";
+import { o as deniedMessage } from "./errors-Iy71s7Oj.js";
+import { t as createPermDock } from "./permdock-yoZ7EjxX.js";
+import { t as mayUse } from "./may-use-CnFEjVEp.js";
+import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DnSOrhB9.js";
+//#region src/agent/reason.ts
+function modelReason(decision, permission, subjectId) {
+	if (decision.outcome === "denied") return deniedMessage(permission?.key ?? "unknown", subjectId, decision.denials, decision.alternatives.map((leaf) => leaf.key));
+	return describe(decision).detail;
+}
+function unmappedReason(toolName) {
+	return `Denied: unmapped tool ${toolName}.`;
+}
+function thrownReason(toolName) {
+	return `Denied: ${toolName} failed closed.`;
+}
+//#endregion
+//#region src/agent/kernel.ts
+function asActor(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
+	if (typeof record.id !== "string" || typeof record.kind !== "string") return;
+	return {
+		id: record.id,
+		kind: record.kind
+	};
+}
+async function resolveTenant(tenant, context) {
+	if (tenant === void 0 || typeof tenant === "string") return tenant;
+	try {
+		return await tenant(context);
+	} catch {
+		return;
+	}
+}
+/** The resume token an agent run carries under the namespaced `permdockApproval` key. */
+function approvalTokenOf(context) {
+	if (context === null || typeof context !== "object") return;
+	const token = context.permdockApproval;
+	return typeof token === "string" && token !== "" ? token : void 0;
+}
+function idOf(data) {
+	if (data === null || typeof data !== "object") return;
+	const id = data.id;
+	if (typeof id === "string" || typeof id === "number") return String(id);
+}
+function resourceRef(permission, data) {
+	return compact({
+		type: permission.resource,
+		id: idOf(data)
+	});
+}
+function runDecide(permdock, permission, data, adapter) {
+	return permdock.decide(permission, data, compact({
+		source: "adapter",
+		adapter,
+		boundary: "tool-args"
+	}));
+}
+function createAgentKernel(policy, options) {
+	const cache = /* @__PURE__ */ new WeakMap();
+	const instance = (context) => {
+		if (typeof context === "object" && context !== null) {
+			const hit = cache.get(context);
+			if (hit !== void 0) return hit;
+		}
+		const built = (async () => {
+			let user = null;
+			try {
+				user = await options.subject(context);
+			} catch {
+				user = null;
+			}
+			let actor;
+			if (options.actor !== void 0) try {
+				actor = asActor(await options.actor(context));
+			} catch {
+				actor = void 0;
+			}
+			let delegation;
+			if (options.delegation !== void 0) try {
+				delegation = await options.delegation(context);
+			} catch {
+				delegation = void 0;
+			}
+			const tenant = await resolveTenant(options.tenant, context);
+			return createPermDock(policy, user, compact({
+				tenant,
+				actor,
+				delegation,
+				memberships: options.memberships,
+				relations: options.relations,
+				entitlements: options.entitlements,
+				customRoles: options.customRoles,
+				policies: options.policies,
+				sink: options.sink,
+				limits: options.limits
+			}));
+		})();
+		if (typeof context === "object" && context !== null) {
+			cache.set(context, built);
+			const release = () => {
+				if (cache.get(context) === built) cache.delete(context);
+			};
+			built.then(release, release);
+		}
+		return built;
+	};
+	const evaluate = async (binding, toolName, args, context, decideOptions = {}) => {
+		try {
+			const permdock = await instance(context);
+			let data;
+			if (binding.data !== void 0) {
+				data = await binding.data(args);
+				if (data === null || data === void 0) {
+					const decision = {
+						outcome: "denied",
+						denials: [{
+							role: null,
+							reason: "validation"
+						}],
+						alternatives: []
+					};
+					return {
+						outcome: "denied",
+						decision,
+						permission: binding.permission,
+						reason: modelReason(decision, binding.permission, permdock.subject.principal?.id)
+					};
+				}
+			}
+			const raw = runDecide(permdock, binding.permission, data, options.adapter);
+			const decision = await resumeDecision({
+				decision: raw,
+				permission: binding.permission,
+				subject: permdock.subject,
+				store: options.store,
+				resource: resourceRef(binding.permission, data),
+				adapter: options.adapter,
+				token: decideOptions.resumeToken ?? await storedApprovalToken(options.store, raw, decideOptions.denyPending === true)
+			});
+			if (decision.outcome === "granted") return {
+				outcome: "granted",
+				decision,
+				permission: binding.permission,
+				data
+			};
+			if (decision.outcome === "approval-required") return {
+				outcome: "approval-required",
+				decision,
+				permission: binding.permission,
+				data,
+				token: decision.token,
+				summary: modelReason(decision, binding.permission, permdock.subject.principal?.id)
+			};
+			return {
+				outcome: "denied",
+				decision,
+				permission: binding.permission,
+				reason: modelReason(decision, binding.permission, permdock.subject.principal?.id)
+			};
+		} catch {
+			return {
+				outcome: "denied",
+				decision: null,
+				permission: binding.permission,
+				reason: thrownReason(toolName)
+			};
+		}
+	};
+	const tokenFor = async (binding, args, context) => {
+		try {
+			const permdock = await instance(context);
+			let data;
+			if (binding.data !== void 0) {
+				data = await binding.data(args);
+				if (data === null || data === void 0) return;
+			}
+			const raw = runDecide(permdock, binding.permission, data, options.adapter);
+			return raw.outcome === "approval-required" ? raw.token : void 0;
+		} catch {
+			return;
+		}
+	};
+	const decideTool = (toolName, args, context, decideOptions = {}) => {
+		const binding = options.tools[toolName];
+		if (binding === void 0) return Promise.resolve({
+			outcome: "denied",
+			decision: null,
+			permission: void 0,
+			reason: unmappedReason(toolName)
+		});
+		return evaluate(binding, toolName, args, context, decideOptions);
+	};
+	const allowedToolNames = async (context) => {
+		const permdock = await instance(context);
+		const allowed = /* @__PURE__ */ new Set();
+		for (const [name, binding] of Object.entries(options.tools)) if (mayUse(permdock, binding.permission)) allowed.add(name);
+		return allowed;
+	};
+	return {
+		instance,
+		decideTool,
+		evaluate,
+		tokenFor,
+		allowedToolNames
+	};
+}
+//#endregion
+export { createAgentKernel as n, approvalTokenOf as t };

package/dist/kysely/index.d.ts

@@ -0,0 +1,77 @@
+import { _r as Condition, hr as Subject, tn as WhereResult } from "../policy-CInmNGkM.js";
+import { n as WithSubjectOptions, r as RelationsMapping, t as RowCheck } from "../row-check-BajTgQZ-.js";
+import { t as MembershipsMapping } from "../compile-CQbvyIBr.js";
+//#region src/kysely/types.d.ts
+type KyselySelectQuery = {
+  select(expr: unknown): KyselySelectQuery;
+  where(column: string, op: string, value: unknown): KyselySelectQuery;
+  where(expression: unknown): KyselySelectQuery;
+  whereRef(left: string, op: string, right: string): KyselySelectQuery;
+};
+type KyselyExpressionBuilder = {
+  (left: unknown, op: string, right: unknown): unknown;
+  and(args: readonly unknown[]): unknown;
+  or(args: readonly unknown[]): unknown;
+  not(value: unknown): unknown;
+  lit(value: unknown): unknown;
+  val(value: unknown): unknown;
+  ref(column: string): unknown;
+  exists?(query: unknown): unknown;
+  selectFrom?(table: string): KyselySelectQuery;
+};
+/** Kysely's `sql` tag; `import { sql } from 'kysely'`. */
+type KyselySql = {
+  (strings: TemplateStringsArray, ...values: unknown[]): unknown;
+  ref(reference: string): unknown;
+};
+type KyselyWhereOptions = {
+  readonly columns?: Readonly<Record<string, string>>;
+  /** Condition fields that are Postgres arrays; `contains` on them is `@>`. */
+  readonly listFields?: readonly string[];
+  readonly subject?: Subject;
+  readonly memberships?: MembershipsMapping;
+  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  readonly relations?: RelationsMapping;
+  readonly now?: number;
+  /** Kysely's `sql` tag, for graph subqueries on runtimes without `require`; loaded from the `kysely` peer by default. */
+  readonly sql?: KyselySql;
+};
+type KyselyWithSubjectOptions = WithSubjectOptions & {
+  /** Kysely's `sql` tag, on runtimes without `require`; loaded from the `kysely` peer by default. */
+  readonly sql?: KyselySql;
+};
+//#endregion
+//#region src/kysely/to-where.d.ts
+export declare function toWhere(input: Condition | WhereResult, table: string, options?: KyselyWhereOptions): (eb: KyselyExpressionBuilder) => unknown;
+type KyselyLike<Trx> = {
+  transaction(): {
+    execute<T>(fn: (trx: Trx) => Promise<T>): Promise<T>;
+  };
+};
+/**
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+ * RLS policies decide for the same subject as the in-process checks.
+ */
+export declare function withSubject<Trx, T>(db: KyselyLike<Trx>, permdock: {
+  readonly subject: Subject;
+}, fn: (trx: Trx) => Promise<T>, options?: KyselyWithSubjectOptions): Promise<T>;
+type KyselySelectable = {
+  selectFrom(table: never): {
+    select(selection: (eb: never) => unknown): {
+      where(where: never): {
+        limit(count: number): {
+          execute(): Promise<readonly {
+            readonly granted?: unknown;
+          }[]>;
+        };
+      };
+    };
+  };
+};
+/**
+ * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+ * permission filter keeps the row. Throws when `key` matches more than one row.
+ */
+export declare function checkRow(db: KyselySelectable, table: string, input: Condition | WhereResult, key: (eb: KyselyExpressionBuilder) => unknown, options?: KyselyWhereOptions): Promise<RowCheck>;
+//#endregion
+export type { KyselyExpressionBuilder, KyselySql, KyselyWhereOptions, KyselyWithSubjectOptions, MembershipsMapping, RelationsMapping, RowCheck, WithSubjectOptions };

package/dist/kysely/index.js

@@ -0,0 +1,129 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { x as assertSafeKey } from "../permissions-DC7GROPA.js";
+import { n as escapeLike, t as compileWhere } from "../compile-D22iwvuV.js";
+import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-xt7V845g.js";
+//#region src/kysely/to-where.ts
+function ident(name) {
+	assertSafeKey(name, "sql identifier");
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) throw new Error(`PermDock: unsafe SQL identifier '${name}'`);
+	return name;
+}
+function col(table, field, columns) {
+	assertSafeKey(field, "condition field");
+	return `${ident(table)}.${ident(columns?.[field] ?? field)}`;
+}
+function existsExpr(eb, node, table, options) {
+	if (eb.exists === void 0 || eb.selectFrom === void 0) return eb.lit(false);
+	const m = (name) => `m.${ident(name)}`;
+	let query = eb.selectFrom(`${ident(node.table)} as m`).select(eb.lit(1)).whereRef(m(node.rowColumn), "=", col(table, node.rowField, options.columns)).where(m(node.user), "=", eb.val(node.userValue));
+	if (node.roles.length > 0) query = query.where(m(node.role), "in", node.roles);
+	if (node.expiresAt !== void 0) {
+		const expires = eb.ref(m(node.expiresAt));
+		query = query.where(eb.or([eb(expires, "is", null), eb(expires, ">", eb.val(node.now))]));
+	}
+	if (node.tenantColumn !== void 0 && node.tenantValue !== void 0) {
+		const tenant = eb.ref(m(node.tenantColumn));
+		query = query.where(eb.or([eb(tenant, "is", null), eb(tenant, "=", eb.val(node.tenantValue))]));
+	}
+	if (node.resourceColumn !== void 0 && node.resourceValue !== void 0) query = query.where(m(node.resourceColumn), "=", eb.val(node.resourceValue));
+	return eb.exists(query);
+}
+function containsExpr(eb, column, field, value, options) {
+	if (options.listFields?.includes(field) === true) return eb(column, "@>", eb.val([value]));
+	return typeof value === "string" ? eb(column, "like", eb.val(`%${escapeLike(value)}%`)) : eb(column, "@>", eb.val(value));
+}
+function loadSql(injected) {
+	if (injected !== void 0) return injected;
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)("kysely").sql;
+	} catch {
+		throw new Error("PermDock: graph grants and withSubject in permdock/kysely need the kysely peer; pass `sql` on runtimes without require");
+	}
+}
+function graphExpr(node, table, options) {
+	const sql = loadSql(options.sql);
+	const strings = [""];
+	const values = [];
+	for (const part of node.parts) {
+		if ("text" in part) {
+			strings[strings.length - 1] += part.text;
+			continue;
+		}
+		values.push("column" in part ? sql.ref(col(table, part.column, options.columns)) : "subject" in part ? node.subject : part.value);
+		strings.push("");
+	}
+	const template = strings;
+	Object.defineProperty(template, "raw", { value: strings });
+	return sql(template, ...values);
+}
+function render(eb, node, table, options) {
+	switch (node.kind) {
+		case "never": return eb.lit(false);
+		case "always": return eb.lit(true);
+		case "isNull": {
+			const column = eb.ref(col(table, node.field, options.columns));
+			return node.negated ? eb(column, "is not", null) : eb(column, "is", null);
+		}
+		case "and": return eb.and(node.items.map((item) => render(eb, item, table, options)));
+		case "or": return eb.or(node.items.map((item) => render(eb, item, table, options)));
+		case "not": return eb.not(render(eb, node.item, table, options));
+		case "exists": return existsExpr(eb, node, table, options);
+		case "sql": return graphExpr(node, table, options);
+		case "compare": {
+			const column = eb.ref(col(table, node.field, options.columns));
+			switch (node.op) {
+				case "eq": return eb(column, "=", eb.val(node.value));
+				case "ne": return eb(column, "!=", eb.val(node.value));
+				case "gt": return eb(column, ">", eb.val(node.value));
+				case "gte": return eb(column, ">=", eb.val(node.value));
+				case "lt": return eb(column, "<", eb.val(node.value));
+				case "lte": return eb(column, "<=", eb.val(node.value));
+				case "in": return eb(column, "in", node.value);
+				case "notIn": return eb(column, "not in", node.value);
+				case "contains": return containsExpr(eb, column, node.field, node.value, options);
+				/* v8 ignore next 4 */
+				default: {
+					const exhaustive = node.op;
+					throw new Error(`PermDock: unknown compare '${String(exhaustive)}'`);
+				}
+			}
+		}
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+function toWhere(input, table, options = {}) {
+	const compiled = compileWhere(input, compact({
+		subject: options.subject,
+		memberships: options.memberships,
+		now: options.now,
+		relations: options.relations
+	}));
+	return (eb) => render(eb, compiled, table, options);
+}
+/**
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+* RLS policies decide for the same subject as the in-process checks.
+*/
+function withSubject(db, permdock, fn, options = {}) {
+	const statements = subjectStatements(permdock, options);
+	const sql = loadSql(options.sql);
+	return db.transaction().execute(async (trx) => {
+		for (const statement of statements) await sql(statementTemplate(statement), ...statement.values).execute(trx);
+		return fn(trx);
+	});
+}
+/**
+* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+* permission filter keeps the row. Throws when `key` matches more than one row.
+*/
+async function checkRow(db, table, input, key, options = {}) {
+	const sql = loadSql(options.sql);
+	const filter = toWhere(input, table, options);
+	const rows = await db.selectFrom(table).select(((eb) => sql`coalesce(${filter(eb)}, false)`.as("granted"))).where(key).limit(2).execute();
+	return rowCheckFrom(rows);
+}
+//#endregion
+export { checkRow, toWhere, withSubject };

package/dist/load-BZ24CpZP.js

@@ -0,0 +1,69 @@
+import { g as listPermissions } from "./permissions-DC7GROPA.js";
+import { dirname, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+//#region src/cli/load.ts
+/**
+* Errors Node raises while resolving or parsing a module graph, before any of
+* its code runs, so loading it again through jiti cannot repeat a side effect.
+*/
+const NOT_NATIVE = /* @__PURE__ */ new Set([
+	"ERR_MODULE_NOT_FOUND",
+	"ERR_UNKNOWN_FILE_EXTENSION",
+	"ERR_UNSUPPORTED_DIR_IMPORT",
+	"ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+	"ERR_UNSUPPORTED_NODE_MODULES_TYPE_STRIPPING"
+]);
+function loadsWithJiti(error) {
+	if (error instanceof SyntaxError) return true;
+	const code = error !== null && typeof error === "object" && "code" in error ? error.code : void 0;
+	return typeof code === "string" && NOT_NATIVE.has(code);
+}
+/**
+* Imports a project module the way its bundler would. Node's own `import()`
+* comes first; a module it cannot resolve or parse (tsconfig `paths`
+* aliases, extensionless relative imports, `enum`, TSX) loads through jiti
+* with the `paths` of the nearest `tsconfig.json` above it. Exports are
+* returned as written; `default` is not merged into the namespace.
+*/
+async function loadModule(abs) {
+	let loaded;
+	try {
+		loaded = await import(pathToFileURL(abs).href);
+	} catch (error) {
+		if (!loadsWithJiti(error)) throw error;
+		loaded = await createJiti(import.meta.url, {
+			interopDefault: false,
+			jsx: true,
+			tsconfigPaths: dirname(abs)
+		}).import(abs);
+	}
+	if (loaded === null || typeof loaded !== "object") throw new Error(`PermDock CLI: module '${abs}' did not export an object`);
+	return loaded;
+}
+function pickNamed(mod, names) {
+	for (const name of names) if (name in mod) return mod[name];
+	return mod["default"];
+}
+function asPermissionTree(value) {
+	if (value === null || typeof value !== "object") throw new Error("PermDock CLI: permissions export is not a permission tree");
+	return value;
+}
+function asPolicy(value) {
+	if (value === null || typeof value !== "object" || !("roles" in value) || !("permissions" in value)) throw new Error("PermDock CLI: policy export is not a Policy");
+	return value;
+}
+function leavesOf(tree) {
+	return listPermissions(tree);
+}
+/** The configured policy export, or `undefined` when unset or unloadable. */
+async function loadConfiguredPolicy(cwd, path) {
+	if (path === void 0) return;
+	try {
+		return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { loadModule as a, loadConfiguredPolicy as i, asPolicy as n, pickNamed as o, leavesOf as r, asPermissionTree as t };

package/dist/load-QOOm1z70.js

@@ -0,0 +1,2 @@
+import { a as loadModule, o as pickNamed } from "./load-BZ24CpZP.js";
+export { loadModule, pickNamed };

package/dist/load-jose-BL6LH4bL.js

@@ -0,0 +1,11 @@
+//#region src/jwt/load-jose.ts
+let cached;
+function loadJose() {
+	cached ??= import("jose").catch((cause) => {
+		cached = void 0;
+		throw new Error("PermDock: permdock/jwt requires the optional peer \"jose\".", { cause });
+	});
+	return cached;
+}
+//#endregion
+export { loadJose as t };

package/dist/lru-8q4WZjBV.js

@@ -0,0 +1,28 @@
+//#region src/agent/lru.ts
+function boundedMap(limit) {
+	const map = /* @__PURE__ */ new Map();
+	return {
+		get: (key) => {
+			const value = map.get(key);
+			if (value !== void 0) {
+				map.delete(key);
+				map.set(key, value);
+			}
+			return value;
+		},
+		set: (key, value) => {
+			map.delete(key);
+			map.set(key, value);
+			if (map.size > limit) {
+				const oldest = map.keys().next();
+				if (oldest.done !== true) map.delete(oldest.value);
+			}
+		},
+		delete: (key) => {
+			map.delete(key);
+		},
+		size: () => map.size
+	};
+}
+//#endregion
+export { boundedMap as t };

package/dist/manifest-DDQbC6K0.d.ts

@@ -0,0 +1,118 @@
+//#region src/supabase/manifest.d.ts
+/**
+ * What `permdock supabase inspect --json` prints and `--out` writes to
+ * `permdock.manifest.json`: the contract between the generated hook and SQL
+ * helpers and a package that writes policies or claims next to them
+ * (better-supabase). `version` is the major of this shape; a field is only
+ * ever added within it. `schemas/supabase-manifest-v1.json` is its JSON Schema.
+ */
+type SupabaseHookManifest = {
+  readonly $schema: "https://permdock.dev/schemas/supabase-manifest-v1.json";
+  readonly version: 1;
+  readonly hook: {
+    readonly schema: string;
+    readonly function: "custom_access_token_hook";
+    readonly out: string;
+  };
+  readonly helpers: {
+    readonly schema: string;
+    /**
+     * `permdock_has` and, per declared scope, `permitted_<scope>_ids`, each
+     * `(p_grant text)`, the membership-only `member_<scope>_ids()` and, for a
+     * scope with a membership source, `member_<scope>_ids_for(p_user uuid)`.
+     */
+    readonly functions: readonly string[];
+  };
+  readonly tenantClaim: string;
+  readonly budget: {
+    readonly bytes: number;
+    readonly measure: string;
+  };
+  readonly claims: readonly SupabaseHookClaim[];
+  readonly authzVersion: boolean;
+  /**
+   * With `authzVersion`, the function that bumps the listed users' `authz_ver`,
+   * for a membership source outside the hook. It is `security definer` and no
+   * client role may execute it: call it from a trigger owned by the table's owner.
+   */
+  readonly authzVersionBump?: {
+    readonly schema: string;
+    readonly function: "permdock_bump_authz_version_for";
+    readonly args: "p_users uuid[]";
+  };
+  /** The `supabase.hook.memberships` sources, in the order the hook reads them. */
+  readonly memberships: readonly SupabaseManifestMembership[];
+  readonly rls: SupabaseManifestRls;
+  /**
+   * Every `schema.table.column` a membership or an `attrs` claim is computed
+   * from. A client role that can insert or update one can grant itself access.
+   */
+  readonly decidingColumns: readonly string[];
+  /** The majors of the `-- permdock:hook` and `-- permdock:grants` marker lines. */
+  readonly markers: {
+    readonly hook: "v1";
+    readonly grants: "v1";
+  };
+};
+type SupabaseHookClaim = {
+  readonly name: string;
+  /** `permdock`, or the `<schema>.<function>` of a `supabase.hook.claims` entry. */
+  readonly source: string;
+  /** Whether the claim counts toward `budget.bytes`. */
+  readonly budget: boolean;
+};
+type SupabaseManifestColumn = {
+  readonly column: string;
+};
+/** A column of the source table, or a value every row has. */
+type SupabaseManifestValue = SupabaseManifestColumn | {
+  readonly value: string | readonly string[];
+};
+/** One `fromTable` or `fromJunction` source. */
+type SupabaseManifestMembership = {
+  /** `schema.table`, `public` when the source names no schema. */
+  readonly table: string;
+  readonly user: SupabaseManifestColumn;
+  /** A column for `fromTable`, the fixed scope for `fromJunction`. */
+  readonly scope: SupabaseManifestValue;
+  readonly id: SupabaseManifestColumn;
+  /** A role column, or the fixed roles every row holds. */
+  readonly role: SupabaseManifestValue;
+  /** A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor scope. */
+  readonly within?: SupabaseManifestColumn | {
+    readonly columns: Readonly<Record<string, string>>;
+  };
+  readonly via?: SupabaseManifestValue;
+  readonly expiresAt?: SupabaseManifestColumn;
+  /** The columns of `table` that decide the membership. */
+  readonly columns: readonly string[];
+};
+type SupabaseManifestHelper = {
+  readonly name: string;
+  /** The argument list, `p_grant text`, or `''` for none. */
+  readonly args: string;
+  readonly returns: string;
+  /** The roles granted `execute`; a field view `anon` reads adds `anon` to the `authenticated` ones. */
+  readonly execute: readonly string[];
+};
+type SupabaseManifestRls = {
+  readonly schema: string;
+  /** Where the helpers read roles and memberships: the claims (`jwt`) or the tables (`database`). */
+  readonly mode: "jwt" | "database";
+  readonly tenantClaim: string;
+  /** The declared scopes, root first, with the Postgres type of their ids. */
+  readonly scopes: readonly {
+    readonly name: string;
+    readonly type: string;
+    readonly within?: string;
+  }[];
+  readonly helpers: readonly SupabaseManifestHelper[];
+  /**
+   * The tables `member_<scope>_ids_for` reads: an `rls.memberships` table
+   * mapped for the scope, else `rls.membershipSources`, else the hook's
+   * `memberships`.
+   */
+  readonly memberships: readonly SupabaseManifestMembership[];
+};
+//#endregion
+export { SupabaseManifestMembership as a, SupabaseManifestHelper as i, SupabaseHookManifest as n, SupabaseManifestRls as o, SupabaseManifestColumn as r, SupabaseManifestValue as s, SupabaseHookClaim as t };