permdock 0.0.0 → 0.1.0

package/dist/solid/index.d.ts

@@ -0,0 +1,63 @@
+import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { r as Role } from "../vocabulary-Dk0fs-Jk.js";
+import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
+//#region src/solid/types.d.ts
+/** Structural `JSX.Element`: text, a DOM node or a list of children. */
+type SolidChild = string | number | boolean | null | undefined | {
+  readonly nodeType: number;
+} | readonly SolidChild[];
+type PermDockProviderProps = {
+  /**
+   * An accessor re-hydrates the store when it changes and keeps it `pending`
+   * while it returns `undefined` (a loading `createResource`); a promise keeps
+   * the store `pending` until it settles.
+   */
+  readonly snapshot: Snapshot | string | Accessor$1<Snapshot | string | undefined> | PromiseLike<Snapshot | string>;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  readonly children: unknown;
+};
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly pending?: SolidChild;
+  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
+  readonly children: SolidChild | ((decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>) => SolidChild);
+};
+//#endregion
+//#region src/solid/hooks.d.ts
+export declare function usePermDock(): ClientPermDock;
+export declare function usePermission(permission: Permission | Accessor<Permission>, data?: Accessor<unknown>): Accessor<PermissionState>;
+export declare function usePermissions(permissions: Accessor<readonly Permission[]>, data?: Accessor<unknown>): Accessor<PermissionSet>;
+export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: Accessor<readonly T[]>): Accessor<FilterResult<T>>;
+export declare function useTenant(): Accessor<TenantView>;
+export declare function useMemberships(): Accessor<readonly Membership[]>;
+export declare function useRoles(options?: Accessor<UseRolesOptions>): Accessor<{
+  readonly roles: readonly Role[];
+}>;
+export declare function useAssignableRoles(): Accessor<readonly Role[]>;
+export declare function useAssignablePermissions(options?: {
+  readonly tenant?: string;
+}): Accessor<readonly Permission[]>;
+export declare function useSubject(): Accessor<SubjectView>;
+export declare function useApproval(decision: Accessor<Decision>): Accessor<ApprovalHandle>;
+//#endregion
+//#region src/solid/protected.d.ts
+export declare function Protected(props: ProtectedProps): JSX.Element;
+//#endregion
+//#region src/solid/provider.d.ts
+export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockProviderProps, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };

package/dist/solid/index.js

@@ -0,0 +1,197 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
+import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { t as createClientStore } from "../store-C6hFW6ta.js";
+import { t as isPromiseLike } from "../source-DoBBYJi2.js";
+import { createComponent, createComputed, createContext, createMemo, createSignal, on, onCleanup, useContext } from "solid-js";
+//#region src/solid/context.ts
+const PermDockContext = createContext(void 0);
+function useStore() {
+	const store = useContext(PermDockContext);
+	if (store === void 0) throw new Error("PermDock: hooks require <PermDockProvider>.");
+	return store;
+}
+//#endregion
+//#region src/solid/hooks.ts
+function useVersion(store) {
+	const [tick, setTick] = createSignal(0);
+	onCleanup(store.subscribe(() => {
+		setTick((current) => current + 1);
+	}));
+	return tick;
+}
+function usePermDock() {
+	const store = useStore();
+	const version = useVersion(store);
+	return new Proxy({}, { get(_target, prop, _receiver) {
+		version();
+		return Reflect.get(store.get(), prop);
+	} });
+}
+function usePermission(permission, data) {
+	const store = useStore();
+	const version = useVersion(store);
+	return createMemo(() => {
+		version();
+		const current = typeof permission === "function" ? permission() : permission;
+		return store.permissionState(current, data?.());
+	});
+}
+function usePermissions(permissions, data) {
+	const store = useStore();
+	const version = useVersion(store);
+	return createMemo(() => {
+		version();
+		const granted = [];
+		const byKey = {};
+		for (const permission of permissions()) {
+			const next = store.permissionState(permission, data?.());
+			byKey[permission.key] = next;
+			if (next.allowed) granted.push(permission);
+		}
+		return new Proxy({
+			granted,
+			get(permission) {
+				return byKey[permission.key];
+			}
+		}, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+			return Reflect.get(target, prop, receiver);
+		} });
+	});
+}
+function useFilter(permission, rows) {
+	const permdock = usePermDock();
+	return createMemo(() => {
+		const next = permdock.filter(permission, rows());
+		next.partial = permdock.where(permission).partial;
+		return next;
+	});
+}
+function useTenant() {
+	const permdock = usePermDock();
+	return createMemo(() => ({
+		tenant: permdock.subject.principal?.tenant ?? null,
+		tenants: permdock.tenants(),
+		switchTo: (id) => permdock.refresh({ tenant: id }),
+		status: permdock.status()
+	}));
+}
+function useMemberships() {
+	const permdock = usePermDock();
+	return createMemo(() => permdock.memberships());
+}
+function useRoles(options = () => ({})) {
+	const permdock = usePermDock();
+	return createMemo(() => {
+		const next = options();
+		return { roles: (next.team === void 0 ? permdock : permdock.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
+	});
+}
+function useAssignableRoles() {
+	const permdock = usePermDock();
+	return createMemo(() => permdock.assignableRoles());
+}
+function useAssignablePermissions(options = {}) {
+	const permdock = usePermDock();
+	return createMemo(() => permdock.assignablePermissions(options));
+}
+function useSubject() {
+	const permdock = usePermDock();
+	return createMemo(() => {
+		const snapshot = permdock.snapshot();
+		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
+		return {
+			principal: permdock.subject.principal,
+			actor: permdock.subject.actor,
+			delegation: permdock.subject.delegation,
+			expiresAt: permdock.subject.expiresAt,
+			simulated
+		};
+	});
+}
+function useApproval(decision) {
+	const store = useStore();
+	const version = useVersion(store);
+	return createMemo(() => {
+		version();
+		const next = decision();
+		return {
+			state: store.approvalState(next),
+			token: next.outcome === "approval-required" ? next.token : void 0,
+			request: (note) => store.requestApproval(next, note)
+		};
+	});
+}
+//#endregion
+//#region src/solid/protected.ts
+function Protected(props) {
+	const root = usePermDock();
+	const local = usePermission(() => props.permission, () => props.data);
+	const view = createMemo(() => {
+		if (props.tenant === void 0) return local();
+		return tenantView(root.tenant(props.tenant), props.permission, props.data);
+	});
+	const render = () => {
+		const scoped = view();
+		if (scoped.status === "pending") return props.pending ?? null;
+		if (!scoped.allowed || scoped.decision.outcome !== "granted") {
+			if (typeof props.fallback === "function") return props.fallback(scoped.decision);
+			return props.fallback ?? null;
+		}
+		if (typeof props.children === "function") return props.children(scoped.decision);
+		return props.children;
+	};
+	return render;
+}
+function tenantView(permdock, permission, data) {
+	const decision = permdock.decide(permission, data);
+	return {
+		allowed: decision.outcome === "granted",
+		status: "ready",
+		decision
+	};
+}
+//#endregion
+//#region src/solid/provider.ts
+function PermDockProvider(props) {
+	const source = props.snapshot;
+	const promised = isPromiseLike(source);
+	const read = typeof source === "function" ? source : void 0;
+	const initial = promised ? void 0 : read === void 0 ? source : read();
+	const store = createClientStore(compact({
+		snapshot: initial ?? emptySnapshot(),
+		endpoint: props.endpoint,
+		approvals: props.approvals,
+		tenant: props.tenant,
+		fetch: props.fetch,
+		headers: props.headers,
+		maxAge: props.maxAge,
+		verifier: props.verifier
+	}));
+	if (promised) store.follow(source);
+	else if (read !== void 0) {
+		let arrive;
+		if (initial === void 0) store.follow(new Promise((resolve) => {
+			arrive = resolve;
+		}));
+		createComputed(on(read, (next) => {
+			if (next === void 0) return;
+			if (arrive === void 0) {
+				store.replace(next);
+				return;
+			}
+			arrive(next);
+			arrive = void 0;
+		}, { defer: initial !== void 0 }));
+	}
+	return createComponent(PermDockContext.Provider, {
+		value: store,
+		get children() {
+			return props.children;
+		}
+	});
+}
+//#endregion
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/source-DoBBYJi2.js

@@ -0,0 +1,6 @@
+//#region src/react/source.ts
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+//#endregion
+export { isPromiseLike as t };

package/dist/sources-DOpW5Ila.d.ts

@@ -0,0 +1,347 @@
+import { J as AuthEvent, ct as MembershipSource, mr as Principal } from "./policy-CInmNGkM.js";
+import { a as SupabaseManifestMembership } from "./manifest-DDQbC6K0.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/supabase/claims.d.ts
+/** One entry of the `memberships` claim, as `schemas/supabase-claims-v1.json` defines it. */
+type SupabaseMembershipClaim = {
+  readonly scope?: string;
+  /** Canonical text of the scope instance id, compared exactly. */
+  readonly id?: string;
+  /** The id of every ancestor scope instance, by scope name. */
+  readonly within?: Readonly<Record<string, string>>;
+  readonly on?: {
+    readonly resource: string;
+    readonly id: string;
+  };
+  readonly tenant?: string;
+  readonly team?: string;
+  readonly roles: readonly string[];
+  readonly via?: string;
+  /** Seconds since the epoch. */
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  /** The subgroup a membership source's `group` fills: a fixed name or a column. */
+  readonly member?: {
+    readonly group: string;
+  };
+  readonly managedBy?: "idp";
+  readonly entitlements?: readonly string[];
+  /** Custom roles in compact form, read by the RLS helpers in `jwt` mode. */
+  readonly grants?: Readonly<Record<string, unknown>>;
+};
+/** An RFC 8693 `act` claim: the acting party, optionally acting for another. */
+type SupabaseActClaim = {
+  readonly sub?: string;
+  readonly act?: SupabaseActClaim;
+  readonly [claim: string]: unknown;
+};
+/** The claims the hook writes; each may also sit under `app_metadata`. */
+type SupabasePermDockClaims<TenantClaim extends string = "tenant_id"> = {
+  /** Global roles: one name, a list, or `null` for none. */
+  readonly user_role?: string | readonly string[] | null;
+  readonly roles?: readonly string[];
+  readonly memberships?: readonly SupabaseMembershipClaim[];
+  /** `true` when the size budget cut `memberships` or `attrs`. */
+  readonly memberships_truncated?: boolean;
+  /** Allow-listed server-owned attributes, read as `principal.claims.attrs.<key>`. */
+  readonly attrs?: Readonly<Record<string, unknown>>;
+  /** The principal's authorization version. */
+  readonly authz_ver?: number;
+} & { readonly [K in TenantClaim]?: string; };
+/**
+ * A Supabase access token in PermDock's claim contract
+ * (`schemas/supabase-claims-v1.json`). Claims it does not name pass through.
+ */
+type SupabaseClaims<TenantClaim extends string = "tenant_id"> = SupabasePermDockClaims<TenantClaim> & {
+  /** The OAuth client of a third-party app (Supabase OAuth server). */
+  readonly client_id?: string;
+  /** OAuth scopes, space-separated or as a list. */
+  readonly scope?: string | readonly string[];
+  readonly act?: SupabaseActClaim;
+  readonly app_metadata?: SupabasePermDockClaims<TenantClaim> & {
+    readonly [claim: string]: unknown;
+  };
+  readonly [claim: string]: unknown;
+};
+/**
+ * A Standard Schema v1 over {@link SupabaseClaims}. `extend(app)` adds an
+ * application's own claim schema: both validate the same claims, their issues
+ * are combined, and the app's output is merged over the base.
+ */
+type SupabaseClaimsSchema<TenantClaim extends string = "tenant_id", Extra = unknown> = StandardSchemaV1<unknown, SupabaseClaims<TenantClaim> & Extra> & {
+  extend<App extends StandardSchemaV1>(app: App): SupabaseClaimsSchema<TenantClaim, Extra & StandardSchemaV1.InferOutput<App>>;
+};
+type SupabaseClaimsOptions<TenantClaim extends string = "tenant_id"> = {
+  /** The claim holding the active tenant; `rls.tenantClaim`, default `tenant_id`. */
+  readonly tenantClaim?: TenantClaim;
+};
+/**
+ * A Standard Schema v1 for PermDock's Supabase claims. Unknown claims pass
+ * through unchanged; a known claim with the wrong shape is an issue, so the
+ * whole token is rejected as `schemas/supabase-claims-v1.json` rejects it.
+ * Needs no validation library.
+ *
+ * ```ts
+ * sb.claims(supabaseClaims().extend(z.object({ datetime_preferences: Prefs })))
+ * ```
+ */
+declare function supabaseClaims<TenantClaim extends string = "tenant_id">(options?: SupabaseClaimsOptions<TenantClaim>): SupabaseClaimsSchema<TenantClaim>;
+//#endregion
+//#region src/supabase/types.d.ts
+type SupabasePrincipal = Principal & {
+  readonly claims?: Readonly<Record<string, unknown>>;
+  readonly email?: string;
+  readonly phone?: string;
+  readonly is_anonymous?: boolean;
+};
+type SupabaseInclude = "email" | "phone" | "is_anonymous";
+type SupabaseMembershipTable = {
+  readonly table: string;
+  readonly user: string;
+  readonly role: string;
+  /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
+  readonly columns?: Readonly<Record<string, string>>;
+  readonly tenant?: string;
+  readonly team?: string;
+  readonly id?: string;
+  readonly expiresAt?: string;
+};
+/** A table whose row says whether a user or a scope instance is active. A missing row counts as suspended. */
+type SupabaseActiveRow = {
+  readonly table: string;
+  /** Column holding the user id or the scope instance id. */
+  readonly id: string;
+  /** Nullable timestamp column; a row with a value is suspended. */
+  readonly disabledAt?: string;
+  /** Status column; only a row whose value is in `active` counts as active. */
+  readonly status?: string;
+  readonly active?: readonly string[];
+};
+type SupabaseSuspension = {
+  /** A suspended user holds no role and no membership. */
+  readonly users?: SupabaseActiveRow;
+  /** Per scope name: a suspended instance voids its memberships and every membership nested under it. */
+  readonly scopes?: Readonly<Record<string, SupabaseActiveRow>>;
+};
+type SupabaseMemberships = {
+  /** The membership table of each named scope. */
+  readonly scopes?: Readonly<Record<string, SupabaseMembershipTable>>;
+  readonly tenant?: SupabaseMembershipTable;
+  readonly team?: SupabaseMembershipTable;
+  readonly resource?: Readonly<Record<string, SupabaseMembershipTable>>;
+};
+type AuthorizeSqlOptions = {
+  /** Postgres schema of `authorize`, `user_roles`, `role_permissions` and `app_permission`. Default `permdock`. */
+  readonly schema?: string;
+  /** `database` (default) reads the tables on every call; `jwt` reads the hook-injected claims. */
+  readonly authorize?: "database" | "jwt";
+  /** The policy's first scope, which `requested_tenant` is an instance of. Default `tenant`. */
+  readonly scope?: string;
+  /** Membership table for tenant requests in `database` mode; without one they deny. */
+  readonly tenant?: boolean | SupabaseMembershipTable;
+  /**
+   * Tenant requests also answer from custom roles, through the `permdock_custom_keys` function
+   * `permdock rls generate --custom-roles` emits: the `custom_role_*` tables in `database` mode,
+   * the `memberships[].grants` claim in `jwt` mode. `declared` role names never resolve as custom.
+   */
+  readonly customRoles?: {
+    readonly declared: readonly string[];
+  };
+  /** A suspended user, or a suspended instance of `scope` for a tenant request, answers `false`. */
+  readonly suspension?: SupabaseSuspension;
+};
+type SupabaseRlsOptions = {
+  readonly roleClaim?: string;
+  readonly tenantClaim?: string;
+  /** Postgres type of tenant columns; the tenant claim is cast to it. `rls generate` defaults to `uuid`. */
+  readonly tenantType?: string;
+  readonly memberships?: SupabaseMembershipTable | SupabaseMemberships;
+  readonly suspension?: SupabaseSuspension;
+};
+type SupabaseRlsConfig = {
+  readonly dialect: "supabase";
+  readonly roleClaim: string;
+  readonly tenantClaim: string;
+  readonly tenantType?: string;
+  readonly memberships?: SupabaseMemberships;
+  readonly suspension?: SupabaseSuspension;
+};
+/**
+ * The structural shape `subjectFromSupabaseSession` reads: a discriminant and the verified JWT claims.
+ * Matches better-supabase's `AuthSession` and similar session objects without importing them.
+ */
+type SupabaseSessionLike = {
+  readonly kind: string;
+  readonly claims?: unknown;
+};
+type SupabaseSubjectOptions = {
+  readonly roles?: string;
+  readonly tenant?: string;
+  readonly memberships?: string;
+  readonly schema?: StandardSchemaV1;
+  readonly include?: readonly SupabaseInclude[];
+  readonly declared?: readonly string[];
+  /** Claim holding plan names per tenant id; the active tenant's entry becomes `principal.plans`. */
+  readonly plans?: string;
+  /** `'deny'` maps a token with `is_anonymous: true` (`signInAnonymously()`) to the anonymous subject, as `rls.anonymousSignIns: 'deny'` does in RLS. */
+  readonly anonymousSignIns?: "deny";
+  /** Audit hook: `membership-dropped` for a `memberships` entry that could not be read, `invalid-chain` for a malformed `act`. */
+  readonly onAuth?: (event: AuthEvent) => void;
+};
+/**
+ * Who acts for the user. `oauth-client`: a third-party app or an agent chain (`client_id`, or an
+ * `act` without `kind`). `support`: a support session (`act.kind: "support"` with `session_id`).
+ * `impersonation`: an admin acting as the user (`act.kind: "impersonation"`). `chain` is a copy of
+ * the token's `act` claim when it has one.
+ */
+type SupabaseActor = {
+  readonly id: string;
+  readonly kind: "oauth-client";
+  readonly chain?: SupabaseActClaim;
+} | {
+  readonly id: string;
+  readonly kind: "support";
+  readonly sessionId: string;
+  readonly readOnly: boolean;
+  readonly reason?: string;
+  readonly chain: SupabaseActClaim;
+} | {
+  readonly id: string;
+  readonly kind: "impersonation";
+  readonly reason?: string;
+  readonly chain: SupabaseActClaim;
+};
+/** `actorOf` output: `{ ok: false }` must deny. */
+type SupabaseActorResult = {
+  readonly ok: true;
+  readonly actor?: SupabaseActor;
+} | {
+  readonly ok: false;
+  readonly reason: "invalid-chain";
+};
+type SupabaseDelegation = {
+  readonly scopes: readonly string[];
+};
+//#endregion
+//#region src/supabase/sources.d.ts
+/**
+ * Runs one parameterised statement: `pg`'s `client.query` (which resolves
+ * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
+ */
+type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
+  readonly rows: readonly Record<string, unknown>[];
+}>;
+type Common = {
+  readonly table: string;
+  /** Runs the lookups; without it the source only describes SQL (for `permdock supabase hook generate`). */
+  readonly query?: SqlQuery;
+  /** Drop suspended users and memberships under suspended instances, like `rls.suspension`. */
+  readonly suspension?: SupabaseSuspension;
+};
+type MembershipTableOptions = Common & {
+  /** Column names; `user`, `scope`, `id` and `role` default to `user_id`, `scope`, `scope_id`, `role`. */
+  readonly columns?: {
+    readonly user?: string;
+    readonly scope?: string;
+    readonly id?: string;
+    /** A `jsonb` column of ancestor ids keyed by scope name. */
+    readonly within?: string;
+    readonly role?: string;
+    readonly via?: string;
+    readonly expiresAt?: string;
+    /** The principal id that wrote the membership (`grantedBy`). */
+    readonly grantedBy?: string;
+    /** Free-text justification recorded on the membership (`reason`). */
+    readonly reason?: string;
+    /** A subgroup column filling `member.group`. */
+    readonly group?: string;
+    /** A text column; the value `idp` marks the row as owned by the identity provider. */
+    readonly managedBy?: string;
+    /** A `text[]` column of seats. */
+    readonly seats?: string;
+  };
+};
+type MembershipJunctionOptions = Common & {
+  /** The declared scope every row is a membership of. */
+  readonly scope: string;
+  /** Default `user_id`. */
+  readonly user?: string;
+  /** The column holding the scope instance id. Default `<scope>_id`. */
+  readonly id?: string;
+  /** Ancestor id columns keyed by scope name. */
+  readonly within?: Readonly<Record<string, string>>;
+  /** A role column, or fixed roles every row holds (a contact table with no role column). */
+  readonly roles: string | readonly string[];
+  /** The membership kind every row has (`contact`, `staff`, `partner`). */
+  readonly via?: string;
+  readonly expiresAt?: string;
+  /** The principal id that wrote the membership (`grantedBy`). */
+  readonly grantedBy?: string;
+  /** Free-text justification recorded on the membership (`reason`). */
+  readonly reason?: string;
+  /** A subgroup filling `member.group`: a fixed name every row has, or a column. */
+  readonly group?: string | {
+    readonly column: string;
+  };
+  /** `idp` when the identity provider owns every row, or a text column holding `idp` per row. */
+  readonly managedBy?: "idp" | {
+    readonly column: string;
+  };
+  /** A `text[]` column of seats. */
+  readonly seats?: string;
+};
+/** What `permdock supabase hook generate` compiles; the same SQL the source runs. */
+type MembershipSql = {
+  readonly table: string;
+  /** Columns of the table that decide a membership; triggers bump the authorization version on them. */
+  readonly user: string;
+  /** `<table>.<user>%type`: the PL/pgSQL type of the user column, for a variable `select` compares with. */
+  readonly userType: string;
+  /**
+   * The `select` of claim rows for one user, with every filter applied.
+   * `user` must have the column's type (a `userType` variable, or an untyped
+   * `$1` Postgres infers): the column is compared uncast so its index applies.
+   */
+  select(user: string): string;
+  /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
+  list(): string;
+  /** A text column holding `idp` for rows the identity provider owns; `''` when every row is owned. */
+  readonly managed?: string;
+  /** Other tables the `select` reads (suspension tables). */
+  readonly reads: readonly string[];
+  /** Every column that decides who holds which membership: user, scope, id, `within`, role, `via` and expiry. */
+  readonly columns: readonly string[];
+  /** For a single-scope source: its scope and the scopes whose ids each row carries. */
+  readonly scope?: string;
+  readonly holds?: readonly string[];
+  /** The source's entry in the hook manifest's `memberships`. */
+  readonly manifest: SupabaseManifestMembership;
+};
+type SqlMembershipSource = MembershipSource & {
+  readonly sql: MembershipSql;
+};
+/**
+ * Memberships from one table holding every scope: a row per user, scope,
+ * instance and role (`user_id, scope, scope_id, role`), with optional
+ * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
+ * merge into one membership.
+ */
+declare function fromTable(options: MembershipTableOptions): SqlMembershipSource;
+/**
+ * Memberships from a table of one scope (`customer_contacts`): every row is a
+ * membership of `scope`, with roles from a column or fixed (`['contact']`), a
+ * fixed `via`, and ancestor ids from `within` columns.
+ */
+declare function fromJunction(options: MembershipJunctionOptions): SqlMembershipSource;
+declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
+/**
+ * Reads the authorization version `permdock supabase hook generate` keeps in
+ * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
+ */
+declare function authzVersion(options: {
+  readonly query: SqlQuery;
+  readonly schema?: string;
+}): NonNullable<MembershipSource["version"]>;
+//#endregion
+export { SupabaseActClaim as C, SupabaseMembershipClaim as D, SupabaseClaimsSchema as E, SupabasePermDockClaims as O, SupabaseSuspension as S, SupabaseClaimsOptions as T, SupabasePrincipal as _, SqlMembershipSource as a, SupabaseSessionLike as b, fromJunction as c, SupabaseActiveRow as d, SupabaseActor as f, SupabaseMembershipTable as g, SupabaseInclude as h, MembershipTableOptions as i, supabaseClaims as k, fromTable as l, SupabaseDelegation as m, MembershipJunctionOptions as n, SqlQuery as o, SupabaseActorResult as p, MembershipSql as r, authzVersion as s, AUTHZ_VERSION_TABLE as t, AuthorizeSqlOptions as u, SupabaseRlsConfig as v, SupabaseClaims as w, SupabaseSubjectOptions as x, SupabaseRlsOptions as y };