permdock 0.0.0 → 0.1.0

package/dist/stream-Q_xlB6Ko.js

@@ -0,0 +1,52 @@
+import { r as PermDockRevokedError } from "./errors-Iy71s7Oj.js";
+//#region src/server/stream.ts
+function isAsyncIterable(value) {
+	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
+}
+/**
+* Yields `source` until `connection.signal` aborts, dropping items the
+* subscriber can no longer read. The connection closes when iteration ends.
+*/
+async function* guardIterable(source, connection, options) {
+	const iterator = source[Symbol.asyncIterator]();
+	const aborted = new Promise((_resolve, reject) => {
+		const fail = () => {
+			reject(connection.signal.reason instanceof PermDockRevokedError ? connection.signal.reason : new PermDockRevokedError({ code: "denied" }));
+		};
+		if (connection.signal.aborted) fail();
+		else connection.signal.addEventListener("abort", fail, { once: true });
+	});
+	aborted.catch(() => void 0);
+	try {
+		for (;;) {
+			const next = await Promise.race([iterator.next(), aborted]);
+			if (next.done === true) return next.value;
+			const row = options.unwrap === void 0 ? next.value : options.unwrap(next.value);
+			if (options.items === void 0 || connection.check(options.items, row).outcome === "granted") yield next.value;
+		}
+	} catch (error) {
+		if (error instanceof PermDockRevokedError) throw options.onRevoked(error);
+		throw error;
+	} finally {
+		connection.close();
+		const closing = iterator.return?.();
+		if (closing !== void 0) Promise.resolve(closing).catch(() => void 0);
+	}
+}
+/** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
+const POLICY_VIOLATION = 1008;
+/** The Problem Details for an aborted connection signal. */
+function revokedProblem(signal) {
+	const reason = signal.reason;
+	return (reason instanceof PermDockRevokedError ? reason : new PermDockRevokedError({ code: "denied" })).toProblemDetails();
+}
+/** Runs `end` once when the connection aborts, or now if it already has. */
+function onRevoked(connection, end) {
+	const fire = () => {
+		end(revokedProblem(connection.signal));
+	};
+	if (connection.signal.aborted) fire();
+	else connection.signal.addEventListener("abort", fire, { once: true });
+}
+//#endregion
+export { onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };

package/dist/style-CTm1AXDT.js

@@ -0,0 +1,22 @@
+import { styleText } from "node:util";
+//#region src/cli/style.ts
+function createStyle(color) {
+	const paint = (format, text) => color ? styleText(format, text, { validateStream: false }) : text;
+	return {
+		color,
+		paint,
+		errorMark: color ? paint("red", "✖") : "error",
+		warnMark: color ? paint("yellow", "⚠") : "warn"
+	};
+}
+/**
+* Whether a stream takes colour. On a TTY `hasColors()` honours `NO_COLOR`,
+* `FORCE_COLOR` and `TERM`; a pipe colours only under a non-zero `FORCE_COLOR`.
+*/
+function streamHasColors(stream, env = process.env) {
+	if (stream.isTTY === true) return stream.hasColors(env);
+	const force = env["FORCE_COLOR"];
+	return force !== void 0 && force !== "0" && force !== "false";
+}
+//#endregion
+export { streamHasColors as n, createStyle as t };

package/dist/subject-C6dLxqHU.js

@@ -0,0 +1,24 @@
+//#region src/core/subject.ts
+function isPrincipal(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	if ("principal" in value && "context" in value) return false;
+	const record = value;
+	if (typeof record.id !== "string") return false;
+	return Array.isArray(record.roles) || Array.isArray(record.memberships) || record.kind === "user" || record.kind === "service" || record.kind === "workload" || record.kind === "link" || typeof record.issuer === "string";
+}
+function isSubject(value) {
+	return value !== null && typeof value === "object" && "principal" in value && "context" in value && typeof value.context === "object";
+}
+function isActor(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && typeof record.kind === "string";
+}
+function anonymousSubject(context = {}) {
+	return Object.freeze({
+		principal: null,
+		context: Object.freeze({ ...context })
+	});
+}
+//#endregion
+export { isSubject as i, isActor as n, isPrincipal as r, anonymousSubject as t };

package/dist/subject-settings-xt7V845g.js

@@ -0,0 +1,82 @@
+//#region src/conditions/row-check.ts
+const MISSING = Object.freeze({ found: false });
+const GRANTED = Object.freeze({
+	found: true,
+	granted: true
+});
+const DENIED = Object.freeze({
+	found: true,
+	granted: false
+});
+function rowCheckOf(found, granted) {
+	return found ? granted ? GRANTED : DENIED : MISSING;
+}
+/** Reads `select <filter> as granted ... where <key> limit 2`; only a boolean `true` or `1` grants. */
+function rowCheckFrom(rows) {
+	if (rows.length > 1) throw new Error("PermDock: checkRow key matches more than one row");
+	const [row] = rows;
+	return rowCheckOf(row !== void 0, row?.granted === true || row?.granted === 1);
+}
+//#endregion
+//#region src/conditions/subject-settings.ts
+const NAME = /^[a-z_][a-z0-9_]*$/u;
+function settingName(name, what) {
+	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
+	return name;
+}
+function setConfig(name, value) {
+	return {
+		strings: [`select set_config('${name}', `, ", true)"],
+		values: [value]
+	};
+}
+/**
+* The transaction preamble that makes Postgres see `permdock.subject`: the role, then the
+* claims the generated policies read. Runs inside the caller's transaction, so every setting
+* is local to it.
+*/
+function subjectStatements(permdock, options = {}) {
+	const principal = permdock.subject.principal;
+	const role = options.role ?? (principal === null ? "anon" : "authenticated");
+	if (role !== false && role !== "authenticated" && role !== "anon") throw new Error(`PermDock: withSubject sets role authenticated or anon, not '${String(role)}'`);
+	const tenantClaim = settingName(options.tenantClaim ?? "tenant_id", "tenant claim");
+	const claims = Object.fromEntries(Object.entries(options.claims ?? {}).filter(([name]) => name !== "sub" && name !== "role" && name !== tenantClaim));
+	if (principal !== null) {
+		claims["sub"] = principal.id;
+		if (principal.tenant !== void 0) claims[tenantClaim] = principal.tenant;
+	}
+	if (role !== false) claims["role"] = role;
+	const statements = role === false ? [] : [{
+		strings: [`set local role ${role}`],
+		values: []
+	}];
+	const dialect = options.dialect ?? "supabase";
+	switch (dialect) {
+		case "supabase":
+		case "neon":
+			statements.push(setConfig("request.jwt.claims", JSON.stringify(claims)), setConfig("request.jwt.claim.sub", principal?.id ?? ""));
+			return statements;
+		case "guc": {
+			const prefix = settingName(options.gucPrefix ?? "app", "setting prefix");
+			statements.push(setConfig(`${prefix}.user_id`, principal?.id ?? ""));
+			for (const [name, value] of Object.entries(claims)) {
+				if (name === "sub") continue;
+				statements.push(setConfig(`${prefix}.${settingName(name, "claim name")}`, typeof value === "string" ? value : JSON.stringify(value)));
+			}
+			return statements;
+		}
+		default: return dialect;
+	}
+}
+/** A statement as text with `$1`, `$2` placeholders, for raw executors. */
+function statementText(statement) {
+	let text = "";
+	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
+	return text;
+}
+/** A statement as a template-strings array, for `sql` tags. */
+function statementTemplate(statement) {
+	return Object.assign([...statement.strings], { raw: [...statement.strings] });
+}
+//#endregion
+export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };

package/dist/supabase/index.d.ts

@@ -0,0 +1,67 @@
+import { hr as Subject } from "../policy-CInmNGkM.js";
+import { a as SupabaseManifestMembership, i as SupabaseManifestHelper, n as SupabaseHookManifest, o as SupabaseManifestRls, r as SupabaseManifestColumn, s as SupabaseManifestValue, t as SupabaseHookClaim } from "../manifest-DDQbC6K0.js";
+import { C as SupabaseActClaim, D as SupabaseMembershipClaim, E as SupabaseClaimsSchema, O as SupabasePermDockClaims, S as SupabaseSuspension, T as SupabaseClaimsOptions, _ as SupabasePrincipal, a as SqlMembershipSource, b as SupabaseSessionLike, c as fromJunction, d as SupabaseActiveRow, f as SupabaseActor, g as SupabaseMembershipTable, h as SupabaseInclude, i as MembershipTableOptions, k as supabaseClaims, l as fromTable, m as SupabaseDelegation, n as MembershipJunctionOptions, o as SqlQuery, p as SupabaseActorResult, r as MembershipSql, s as authzVersion, t as AUTHZ_VERSION_TABLE, u as AuthorizeSqlOptions, v as SupabaseRlsConfig, w as SupabaseClaims, x as SupabaseSubjectOptions, y as SupabaseRlsOptions } from "../sources-DOpW5Ila.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
+//#region src/supabase/capability.d.ts
+type ExchangeCapabilityOptions = {
+  /**
+   * The key Supabase verifies with: a private JWK imported into the project's
+   * JWT signing keys (`ES256` or `RS256`, with its `kid`), or the legacy JWT
+   * secret (`HS256`).
+   */
+  readonly key: Record<string, unknown> | {
+    readonly secret: string;
+  };
+  /** Default `ES256`, Supabase's asymmetric signing key; the legacy secret needs `HS256` named. */
+  readonly alg?: "ES256" | "RS256" | "HS256";
+  readonly kid?: string;
+  readonly issuer?: string;
+  /** Lifetime in seconds, capped by the capability's own expiry. Default 300. */
+  readonly ttl?: number;
+  readonly now?: number;
+};
+/**
+ * Exchanges a verified link subject (from `subjectFromCapability`) for a
+ * short-lived Supabase access token with role `anon` and the capability in a
+ * `capability` claim, which `permdock rls generate --capabilities` policies
+ * read. `undefined` for any subject that is not a live link.
+ */
+export declare function exchangeCapability(subject: Subject, options: ExchangeCapabilityOptions): Promise<string | undefined>;
+//#endregion
+//#region src/supabase/rls.d.ts
+export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
+/**
+ * `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
+ * scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
+ * `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
+ * tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
+ * tenant request with no memberships source is denied, never answered from global roles. It
+ * answers "does a role hold this permission" without seeing a row: an allow with row conditions
+ * does not count, and a deny the user's tenant or global roles hold overrides every allow.
+ * Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+ * instead. Only `authenticated` may execute it.
+ */
+export declare function authorizeSql(options?: AuthorizeSqlOptions): string;
+//#endregion
+//#region src/supabase/subject.d.ts
+/**
+ * Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
+ * actor; nested levels are prior actors, kept on `chain` for audit), else the
+ * OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
+ * none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
+ * user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
+ * `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
+ * with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
+ * is `{ ok: false }` and must deny.
+ */
+export declare function actorOf(claims: unknown): SupabaseActorResult;
+/** The OAuth `scope` claim (a space-separated string or a list) as `scopes`; `undefined` when empty. */
+export declare function delegationOf(claims: unknown): SupabaseDelegation | undefined;
+export declare function subjectFromSupabase(claims: unknown, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
+/**
+ * A verified session object (for example better-supabase's `AuthSession`) in, `Subject` out.
+ * Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+ */
+export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
+//#endregion
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type SqlMembershipSource, type SqlQuery, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRls, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePrincipal, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseSessionLike, type SupabaseSubjectOptions, type SupabaseSuspension, authzVersion, fromJunction, fromTable, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };

package/dist/supabase/index.js

@@ -0,0 +1,4 @@
+import { a as subjectFromSupabaseSession, c as supabaseClaims, i as subjectFromSupabase, l as exchangeCapability, n as delegationOf, o as authorizeSql, s as supabaseRls, t as actorOf } from "../supabase-DTxGtYdi.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
+import { a as fromTable, i as fromJunction, r as authzVersion, t as AUTHZ_VERSION_TABLE } from "../sources-DVHM3Mwq.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromTable, subjectFromSupabase, subjectFromSupabaseSession, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };

package/dist/supabase/middleware.d.ts

@@ -0,0 +1,77 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, hr as Subject, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { r as PdpFactory } from "../types-BvBk1wgn.js";
+import { h as WebBotAuthVerifier, n as OpenApiHooks } from "../create-BKF3dgFk.js";
+import { Middleware } from "@supabase/middleware";
+//#region src/supabase/middleware.d.ts
+/**
+ * The verified Supabase Auth access-token payload as `@supabase/server`
+ * contributes it under `ctx.jwtClaims`. Structural, so the `JWTClaims`
+ * interface from `@supabase/server` satisfies it without an import.
+ */
+export type SupabaseJwtClaims = {
+  readonly sub: string;
+  readonly iss?: string;
+  readonly aud?: string | readonly string[];
+  readonly exp?: number;
+  readonly iat?: number;
+  readonly role?: string;
+  readonly email?: string;
+  readonly app_metadata?: Readonly<Record<string, unknown>>;
+  readonly user_metadata?: Readonly<Record<string, unknown>>;
+  readonly [claim: string]: unknown;
+};
+/**
+ * What `withPermDock` requires upstream: a `jwtClaims` contribution. Supabase's
+ * `withClaims`, `withRequiredClaims` and `withSupabase` all provide it; `null`
+ * is the anonymous caller (no bearer token, an `sb_*` API key, or the `secret`
+ * auth mode).
+ */
+export type SupabaseMiddlewareContext = {
+  readonly jwtClaims: SupabaseJwtClaims | null;
+};
+export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = {
+  readonly subject: (ctx: SupabaseMiddlewareContext, request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
+  readonly tenant?: string | ((ctx: SupabaseMiddlewareContext, request: Request) => string | undefined | Promise<string | undefined>);
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** Accepted for adapter parity; not read by this adapter. */
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+};
+export type WithPermDockConfig = {
+  /** Run `protect` before the handler; a denial short-circuits with Problem Details. */
+  readonly protect?: Permission;
+  /** Load the row `protect` decides on; `null` or `undefined` yields 404. */
+  readonly data?: (ctx: SupabaseMiddlewareContext, request: Request) => unknown;
+  /** `true` when `data` returns a row the server loaded; anything else is validated before the check. */
+  readonly trusted?: boolean;
+};
+/**
+ * A terminal pipeline handler. Generic over the accumulated context so
+ * `pipeline([withClaims()], permdockHandler())` infers without a wrapping
+ * lambda; the constraint still requires an upstream `jwtClaims` contribution.
+ */
+export type SupabaseMiddlewareHandler = <Ctx extends SupabaseMiddlewareContext>(request: Request, ctx: Ctx) => Promise<Response>;
+export type SupabaseMiddlewarePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly withPermDock: Middleware<"permdock", WithPermDockConfig | undefined, SupabaseMiddlewareContext, PermDock<V>>;
+  readonly permdockHandler: () => SupabaseMiddlewareHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
+//#endregion

package/dist/supabase/middleware.js

@@ -0,0 +1,68 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { o as invalidSignatureResponse } from "../evaluations-DsAU9ppl.js";
+import { t as createKernel } from "../create-CSkhDU9T.js";
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/supabase/middleware.ts
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const tenantOption = options.tenant;
+	const contextFor = (request) => contexts.get(request) ?? { jwtClaims: null };
+	const kernel = createKernel(policy, compact({
+		subject: (request) => options.subject(contextFor(request), request),
+		tenant: typeof tenantOption === "function" ? (request) => tenantOption(contextFor(request), request) : tenantOption,
+		memberships: options.memberships,
+		relations: options.relations,
+		entitlements: options.entitlements,
+		customRoles: options.customRoles,
+		policies: options.policies,
+		store: options.store,
+		sink: options.sink,
+		limits: options.limits,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		adapter: "supabase-middleware",
+		wrap: options.otel
+	}));
+	const bind = (request, ctx) => {
+		contexts.set(request, ctx);
+		return request;
+	};
+	const withPermDock = defineMiddleware({
+		key: "permdock",
+		run: (config) => async (request, ctx) => {
+			bind(request, ctx);
+			if (config?.protect === void 0) try {
+				return { permdock: await kernel.permdock(request) };
+			} catch (error) {
+				const response = invalidSignatureResponse(error);
+				if (response !== void 0) return response;
+				throw error;
+			}
+			const loadData = config.data;
+			const guard = await kernel.protect(config.protect, loadData === void 0 ? void 0 : () => loadData(ctx, request), compact({ trusted: config.trusted }))(request);
+			if (!guard.ok) return guard.response;
+			return { permdock: guard.permdock };
+		}
+	});
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler();
+		return (request, ctx) => {
+			bind(request, ctx);
+			switch (request.method) {
+				case "POST": return POST(request);
+				case "GET": return GET(request);
+				default: return Promise.resolve(new Response(null, {
+					status: 405,
+					headers: { Allow: "GET, POST" }
+				}));
+			}
+		};
+	};
+	return {
+		withPermDock,
+		permdockHandler,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { createPermDock };

package/dist/supabase-D8UlBA7Z.js

@@ -0,0 +1,83 @@
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/supabase.ts
+function supabase(ctx) {
+	return defineCommand({
+		meta: {
+			name: "supabase",
+			description: COMMAND_DESCRIPTIONS.supabase
+		},
+		args: {
+			...globalArgs,
+			area: {
+				type: "positional",
+				required: false,
+				description: "hook or inspect"
+			},
+			verb: {
+				type: "positional",
+				required: false,
+				description: "hook: generate"
+			},
+			out: {
+				type: "string",
+				description: "File to write; a bare --out on inspect writes permdock.manifest.json",
+				valueHint: "file"
+			},
+			check: {
+				type: "boolean",
+				description: "Exit 1 when the file on disk is stale; write nothing"
+			},
+			db: {
+				type: "string",
+				description: "Postgres connection string",
+				valueHint: "url"
+			},
+			"active-from": {
+				type: "string",
+				description: "Where the hook reads the active tenant",
+				valueHint: "source"
+			},
+			budget: {
+				type: "string",
+				description: "Byte budget for the memberships claim",
+				valueHint: "bytes"
+			},
+			schema: {
+				type: "string",
+				description: "Schema for the hook function",
+				valueHint: "name"
+			},
+			"grants-out": {
+				type: "string",
+				description: "File for the supabase_auth_admin grants",
+				valueHint: "file"
+			}
+		},
+		async run({ args: parsed }) {
+			const out = parsed.out === "" ? true : stringArg(parsed.out);
+			const db = stringArg(parsed.db);
+			const activeFrom = stringArg(parsed["active-from"]);
+			const budget = stringArg(parsed.budget);
+			const schema = stringArg(parsed.schema);
+			const grantsOut = stringArg(parsed["grants-out"]);
+			const { runSupabase } = await import("./supabase-hook-DW-xP4hU.js");
+			ctx.report(await runSupabase({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				rest: parsed._,
+				check: parsed.check === true,
+				json: ctx.json,
+				io: ctx.io,
+				...out === void 0 ? {} : { out },
+				...db === void 0 ? {} : { db },
+				...activeFrom === void 0 ? {} : { activeFrom },
+				...budget === void 0 ? {} : { budget },
+				...schema === void 0 ? {} : { schema },
+				...grantsOut === void 0 ? {} : { grantsOut }
+			}));
+		}
+	});
+}
+//#endregion
+export { supabase };