permdock 0.0.0 → 0.1.0

package/dist/types-B9dmiiab.d.ts

@@ -0,0 +1,66 @@
+import { E as PolicyVocabulary, Z as DecisionEvent, Zt as PermDock } from "./policy-CInmNGkM.js";
+//#region src/otel/types.d.ts
+declare const GENAI_SEMCONV_PIN = "1.37.0";
+declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
+declare const GEN_AI_TOOL_CALL_ID = "gen_ai.tool.call.id";
+type StructuralLogger = {
+  readonly debug?: (message: string, attributes?: Record<string, unknown>) => void;
+  readonly info: (message: string, attributes?: Record<string, unknown>) => void;
+  readonly warn: (message: string, attributes?: Record<string, unknown>) => void;
+  readonly error?: (message: string, attributes?: Record<string, unknown>) => void;
+};
+type OtelSpan = {
+  readonly setAttribute?: (key: string, value: unknown) => void;
+  readonly setAttributes?: (attributes: Record<string, unknown>) => void;
+  readonly addEvent?: (name: string, attributes?: Record<string, unknown>) => void;
+  readonly recordException?: (error: unknown) => void;
+  readonly setStatus?: (status: {
+    readonly code: number;
+  }) => void;
+  readonly end?: (endTime?: number) => void;
+  readonly isRecording?: () => boolean;
+  readonly attributes?: Record<string, unknown>;
+};
+type OtelTracer = {
+  readonly startSpan: (name: string, options?: {
+    readonly startTime?: number;
+  }) => OtelSpan;
+};
+type OtelCounter = {
+  readonly add: (value: number, attributes?: Record<string, unknown>) => void;
+};
+type OtelHistogram = {
+  readonly record: (value: number, attributes?: Record<string, unknown>) => void;
+};
+type OtelMeter = {
+  readonly createCounter: (name: string) => OtelCounter;
+  readonly createHistogram: (name: string, options?: {
+    readonly unit?: string;
+    readonly description?: string;
+  }) => OtelHistogram;
+};
+type OtelApi = {
+  readonly trace: {
+    readonly getTracer: (name: string) => OtelTracer;
+    readonly getActiveSpan?: () => OtelSpan | undefined;
+  };
+  readonly metrics?: {
+    readonly getMeter: (name: string) => OtelMeter;
+  };
+};
+type OtelOptions = {
+  readonly tracer?: string;
+  readonly logger?: StructuralLogger;
+  readonly attributes?: (event: DecisionEvent) => Record<string, unknown>;
+  readonly redact?: readonly string[];
+  readonly errorOnDeny?: boolean;
+  readonly api?: OtelApi;
+};
+/**
+ * An adapter's `otel` option: wraps each request-scoped instance, usually
+ * `(permdock) => withOtel(permdock, options)` from `permdock/otel`, so an app
+ * without it does not bundle the instrumentation.
+ */
+type OtelWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;
+//#endregion
+export { OtelOptions as a, OtelApi as i, GEN_AI_TOOL_CALL_ID as n, OtelWrap as o, GEN_AI_TOOL_NAME as r, StructuralLogger as s, GENAI_SEMCONV_PIN as t };

package/dist/types-BBK-exvJ.d.ts

@@ -0,0 +1,177 @@
+import { b as ResourceRelation } from "./permissions-B4apnahQ.js";
+//#region src/catalog/types.d.ts
+type CatalogUsage = {
+  readonly file: string;
+  readonly line: number;
+  readonly call: string;
+};
+type CatalogPermission = {
+  readonly key: string;
+  readonly scope: string;
+  readonly resource: string;
+  readonly action: string;
+  readonly arity: "instance" | "collection";
+  readonly meta: Readonly<Record<string, unknown>>;
+  readonly usages: readonly CatalogUsage[];
+  /** Keys the permission was renamed from (`definePermissions` `renamed`), sorted; absent when none. */
+  readonly renamedFrom?: readonly string[];
+  /** Present only when the policy lists the permission in `hostable`. */
+  readonly hostable?: true;
+  /**
+   * `true` when a code grant for the key has a condition beyond role and
+   * scope, so the SQL helpers alone cannot enforce it, and when the catalog
+   * was built without the policy, which leaves it unknown.
+   */
+  readonly rowConditions: boolean;
+  /** The approvals code allows on this permission require; a hosted grant must meet each. */
+  readonly approvals?: readonly CatalogApproval[];
+  /** Present when a `breakGlass` override targets this permission. */
+  readonly breakGlass?: CatalogBreakGlass;
+};
+/** A break-glass override as the catalog carries it. */
+type CatalogBreakGlass = {
+  readonly overrides: readonly string[];
+  readonly purpose?: readonly string[];
+  readonly reason: boolean;
+  readonly maxDuration?: string;
+  readonly obligations: readonly string[];
+};
+type CatalogApproval = "human" | {
+  readonly by?: unknown;
+  readonly mode?: "any" | "all" | "sequential";
+  readonly stages?: readonly {
+    readonly by: unknown;
+    readonly quorum?: number;
+  }[];
+  readonly distinct?: boolean;
+  readonly staleOn?: "resource-change";
+  readonly quorum?: number;
+  readonly ttl?: string;
+  readonly escalation?: {
+    readonly after: string;
+    readonly to: unknown;
+  };
+};
+type CatalogResource = {
+  readonly id: string;
+  readonly schema: unknown;
+  readonly definedIn?: string;
+  readonly relations?: Readonly<Record<string, ResourceRelation>>;
+  /** The row field an `approval: { staleOn: 'resource-change' }` binds to. */
+  readonly version?: string;
+  /** The boolean column that keeps ancestor grants out of a row. */
+  readonly restricted?: string;
+};
+type CatalogRole = {
+  readonly key: string;
+  /** A declared scope name, or `resource`; absent for a global role. */
+  readonly on?: string;
+  readonly assignable?: boolean;
+  /** Fewest holders per scope instance; absent when 0. */
+  readonly min?: number;
+  readonly max?: number;
+  readonly transferOnly?: true;
+  readonly assigns?: readonly string[];
+  /** Membership kinds (`via`) that may hold the role. */
+  readonly for?: readonly string[];
+  readonly exclusiveWith?: readonly string[];
+  readonly audience?: string;
+  /** Present when the role is eligible-only and activated with `permdock.activate`. */
+  readonly activation?: CatalogActivation;
+  /** Present when the role is a `supportAccess` role. */
+  readonly supportAccess?: CatalogSupportAccess;
+};
+/** A role activation as the catalog carries it. */
+type CatalogActivation = {
+  readonly maxDuration?: string;
+  readonly justification: "required" | "optional";
+  readonly approval?: boolean;
+  readonly assurance?: {
+    readonly maxAge?: number;
+    readonly acr?: readonly string[];
+    readonly amr?: readonly string[];
+  };
+};
+/** A support-access role as the catalog carries it. */
+type CatalogSupportAccess = {
+  readonly actorRequired: boolean;
+  readonly group: string;
+  readonly durations: readonly string[];
+};
+/** One declared scope, in declaration order. */
+type CatalogScope = {
+  readonly name: string;
+  readonly key: string;
+  readonly within?: string;
+};
+/** A grant's `validFrom` / `validUntil` window in Unix seconds. */
+type CatalogValidity = {
+  readonly from?: number;
+  readonly until?: number;
+};
+/**
+ * One code grant as the catalog carries it: the normalised shape
+ * `definePolicy` produced, minus closures. `permdock diff` compares these;
+ * a hosted document is authored against them.
+ */
+type CatalogGrant = {
+  readonly permission: string;
+  readonly effect: "allow" | "deny";
+  /** The role binding the grant came from; `null` for a top-level grant. */
+  readonly role: string | null;
+  /** The grantee selector, or an array for an intersection, in its JSON form. */
+  readonly to: unknown;
+  /** `global`, a declared scope name, or `{ resource }`. */
+  readonly scope: string | {
+    readonly resource: string;
+  };
+  /** Portable condition on the current row; absent on a non-portable grant. */
+  readonly where?: unknown;
+  /** Portable condition on the next row; absent on a non-portable grant. */
+  readonly check?: unknown;
+  readonly approval?: CatalogApproval;
+  readonly fields?: readonly string[];
+  readonly validity?: CatalogValidity;
+  readonly name?: string;
+  readonly purpose?: readonly string[];
+  readonly limit?: {
+    readonly count: number;
+    readonly per: string;
+    readonly mode?: "hard" | "soft";
+  };
+  /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
+  readonly portable?: false;
+};
+/** `permissions.catalog.json`, validated by `schemas/catalog-v1.json`. */
+type CatalogDocument = {
+  readonly $schema: string;
+  readonly version: 1;
+  readonly generatedAt: string;
+  readonly generator: string;
+  /** `catalogFingerprint` of this document; what hosted documents pin as `catalog`. */
+  readonly fingerprint?: string;
+  readonly resources: Readonly<Record<string, CatalogResource>>;
+  readonly permissions: readonly CatalogPermission[];
+  /** The policy's scopes in order; absent when it declares none. */
+  readonly scopes?: readonly CatalogScope[];
+  readonly roles?: readonly CatalogRole[];
+  readonly plans?: readonly {
+    readonly key: string;
+  }[];
+  /** Every code grant, canonically ordered; present when the catalog was built with the policy. */
+  readonly grants?: readonly CatalogGrant[];
+  /** The policy's standing delegations, canonically ordered; present when the policy declares any. */
+  readonly delegations?: readonly CatalogDelegation[];
+};
+/** One `definePolicy({ delegations })` entry: who hands over, to which actor, which permission keys, and when. */
+type CatalogDelegation = {
+  readonly from: unknown;
+  readonly to: {
+    readonly kind: string;
+    readonly id?: string;
+  };
+  readonly permissions: readonly string[];
+  readonly validity?: CatalogValidity;
+};
+//#endregion
+export { CatalogDocument as a, CatalogResource as c, CatalogSupportAccess as d, CatalogUsage as f, CatalogDelegation as i, CatalogRole as l, CatalogApproval as n, CatalogGrant as o, CatalogValidity as p, CatalogBreakGlass as r, CatalogPermission as s, CatalogActivation as t, CatalogScope as u };

package/dist/types-BvBk1wgn.d.ts

@@ -0,0 +1,118 @@
+import { C as Policy, Cn as ArazzoPlan, E as PolicyVocabulary, In as ExplainedDecision, Mn as Decision, Qt as PermDockOptions, Xt as DecideOptions, Zt as PermDock, en as SimulateOptions, hr as Subject, mr as Principal, pr as Membership, tn as WhereResult, wn as ArazzoSimulateInput } from "./policy-CInmNGkM.js";
+import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
+//#region src/pdp/types.d.ts
+type RemotePdpAuth = {
+  readonly bearer: string | (() => string | Promise<string>);
+};
+type RemotePdpMapping = {
+  readonly subject?: (subject: Subject) => {
+    readonly type?: string;
+    readonly id?: string;
+    readonly properties?: Readonly<Record<string, unknown>>;
+  };
+  readonly resource?: (permission: Permission, data: unknown) => {
+    readonly type?: string;
+    readonly id?: string;
+    readonly properties?: unknown;
+  };
+  readonly action?: (permission: Permission) => {
+    readonly name?: string;
+  };
+};
+type RemotePdpEndpoints = {
+  readonly evaluation?: string;
+  readonly evaluations?: string;
+  readonly searchResource?: string;
+};
+type RemotePdpCache = {
+  readonly ttl: number | `${number}s` | `${number}ms`;
+};
+type RemotePdpOptions = {
+  readonly url: string;
+  readonly auth?: RemotePdpAuth;
+  readonly permissions?: readonly (Permission | PermissionTree)[];
+  readonly mapping?: RemotePdpMapping;
+  readonly timeout?: number;
+  readonly cache?: RemotePdpCache;
+  readonly endpoints?: RemotePdpEndpoints;
+  readonly fetch?: typeof fetch;
+};
+/**
+ * One tuple callback per delegated permission. The callback receives the
+ * row for a check and `undefined` for a listing; returning `null` denies
+ * with `pdp-denied`, throwing denies with `pdp-invalid-response`.
+ */
+type RelationMap<T> = readonly (readonly [Permission, (subject: Subject, data: unknown) => T | null])[];
+type OpenFgaTuple = {
+  /** `user:anne`, `team:eng#member`. */
+  readonly user: string;
+  readonly relation: string;
+  readonly type: string;
+  /** Required for a check; ignored for `list-objects`. */
+  readonly id?: string;
+};
+type OpenFgaOptions = {
+  readonly url: string;
+  readonly storeId: string;
+  readonly authorizationModelId?: string;
+  readonly map: RelationMap<OpenFgaTuple>;
+  readonly auth?: RemotePdpAuth;
+  readonly timeout?: number;
+  readonly cache?: RemotePdpCache;
+  readonly fetch?: typeof fetch;
+};
+type SpiceDbCheck = {
+  readonly subject: {
+    readonly type: string;
+    readonly id: string;
+    readonly relation?: string;
+  };
+  readonly permission: string;
+  /** `id` is required for a check; ignored for `LookupResources`. */
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+};
+type SpiceDbOptions = {
+  /** The SpiceDB HTTP gateway origin. */
+  readonly url: string;
+  readonly token: RemotePdpAuth["bearer"];
+  readonly map: RelationMap<SpiceDbCheck>;
+  readonly consistency?: "minimize-latency" | "fully-consistent";
+  readonly timeout?: number;
+  readonly cache?: RemotePdpCache;
+  readonly fetch?: typeof fetch;
+};
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team"> & {
+  /**
+   * For a delegated permission whose provider lists ids, an `in` over them
+   * (AND the local condition when local grants exist); otherwise the local
+   * `where`, or an always-false `partial` result.
+   */
+  readonly where: (permission: Permission) => Promise<WhereResult>;
+  readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
+  readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
+  readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {
+    readonly outcome: "granted";
+  }>>;
+  /** `decide` with a trace of the local grants; a decision the remote PDP made carries an empty trace. */
+  readonly explain: (permission: Permission, data?: unknown, options?: Omit<DecideOptions, "explain">) => Promise<ExplainedDecision>;
+  readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
+  readonly simulate: {
+    (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Promise<readonly Decision[]>;
+    (plan: ArazzoSimulateInput): ArazzoPlan;
+    (preview: {
+      readonly roles?: readonly (string | {
+        readonly key: string;
+      })[];
+      readonly memberships?: readonly Membership[];
+      readonly tenant?: string;
+    }): PdpPermDock<V>;
+  };
+  readonly tenant: (id: string) => PdpPermDock<V>;
+  readonly team: (id: string) => PdpPermDock<V>;
+};
+type PdpFactory = <TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions) => Promise<PdpPermDock<V>>;
+//#endregion
+export { RelationMap as a, RemotePdpEndpoints as c, SpiceDbCheck as d, SpiceDbOptions as f, PdpPermDock as i, RemotePdpMapping as l, OpenFgaTuple as n, RemotePdpAuth as o, PdpFactory as r, RemotePdpCache as s, OpenFgaOptions as t, RemotePdpOptions as u };

package/dist/types-CxquUByI.d.ts

@@ -0,0 +1,9 @@
+import { d as Permission } from "./permissions-B4apnahQ.js";
+//#region src/agent/types.d.ts
+type ToolBinding = {
+  readonly permission: Permission;
+  readonly data?: (args: unknown) => unknown;
+};
+type ToolMap = Readonly<Record<string, ToolBinding>>;
+//#endregion
+export { ToolMap as t };

package/dist/types-D6Z6-rKJ.d.ts

@@ -0,0 +1,312 @@
+import { a as SqlMembershipSource } from "./sources-DOpW5Ila.js";
+//#region src/cli/types.d.ts
+type CollectConfig = {
+  readonly srcPath?: readonly string[];
+  readonly out?: string;
+  readonly barrel?: boolean | string;
+};
+type CatalogConfig = {
+  readonly out?: string;
+};
+type RlsDialect = "supabase" | "neon" | "guc";
+type RlsTarget = "sql" | "drizzle" | "prisma";
+type RlsMembershipTable = {
+  readonly table: string;
+  readonly user: string;
+  readonly role: string;
+  /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
+  readonly columns?: Readonly<Record<string, string>>;
+  /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
+  readonly tenant?: string;
+  /** Column of the second scope's id; shorthand for `columns[<second scope>]`. */
+  readonly team?: string;
+  readonly id?: string;
+  readonly expiresAt?: string;
+  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
+  readonly via?: string;
+};
+type RlsMemberships = {
+  /** The membership table of each named scope. */
+  readonly scopes?: Readonly<Record<string, RlsMembershipTable>>;
+  /** The first scope's table; shorthand for `scopes[<first scope>]`. */
+  readonly tenant?: RlsMembershipTable;
+  /** The second scope's table; shorthand for `scopes[<second scope>]`. */
+  readonly team?: RlsMembershipTable;
+  readonly resource?: Readonly<Record<string, RlsMembershipTable>>;
+};
+/** A table whose row says whether a user or a scope instance is active. A missing row counts as suspended. */
+type RlsActiveRow = {
+  readonly table: string;
+  /** Column holding the user id or the scope instance id. */
+  readonly id: string;
+  /** Nullable timestamp column; a row with a value is suspended. */
+  readonly disabledAt?: string;
+  /** Status column; only a row whose value is in `active` counts as active. */
+  readonly status?: string;
+  readonly active?: readonly string[];
+};
+type RlsSuspension = {
+  /** A suspended user holds no role and no membership. */
+  readonly users?: RlsActiveRow;
+  /** Per scope name: a suspended instance voids its memberships and every membership nested under it. */
+  readonly scopes?: Readonly<Record<string, RlsActiveRow>>;
+};
+type RlsFunctionMapping = {
+  readonly twin: unknown;
+  readonly args?: readonly string[];
+};
+type RlsConfig = {
+  readonly tables?: Readonly<Record<string, string>>;
+  readonly dialect?: RlsDialect;
+  readonly memberships?: RlsMemberships;
+  /**
+   * `database` mode: the `fromTable` / `fromJunction` sources the helpers
+   * read for every scope `memberships` maps no table for. Default
+   * `supabase.hook.memberships`, so the helpers and the token hook run the
+   * same SQL. Setting it selects `database` mode.
+   */
+  readonly membershipSources?: readonly SqlMembershipSource[];
+  /** Tables the helpers, `authorize()` and the token hook read to drop suspended users and scope instances. */
+  readonly suspension?: RlsSuspension;
+  readonly functions?: Readonly<Record<string, RlsFunctionMapping>>;
+  readonly inlineFunctions?: boolean;
+  /** Emit FORCE ROW LEVEL SECURITY so the table owner is subject to the policies. */
+  readonly force?: boolean;
+  readonly fixtures?: string;
+  readonly tenantClaim?: string;
+  /** Postgres type of tenant columns (`uuid` by default); the tenant claim and helper results are cast to it. */
+  readonly tenantType?: string;
+  /** Postgres type of team columns; defaults to `tenantType`. */
+  readonly teamType?: string;
+  /** Postgres type of each named scope's id column; overrides `tenantType` / `teamType`. */
+  readonly scopeTypes?: Readonly<Record<string, string>>;
+  readonly roleClaim?: string;
+  readonly gucPrefix?: string;
+  readonly out?: string;
+  /** `--target drizzle`: where each policy's `.link()` finds its table. */
+  readonly drizzle?: {
+    /** Module exporting the tables, as imported from `out`. Default `./schema`. */
+    readonly schema?: string;
+    /** Export name per table name; defaults to the camelCased table name. */
+    readonly exports?: Readonly<Record<string, string>>;
+  };
+  /** `--target prisma`: the model each table maps to. */
+  readonly prisma?: {
+    /** Model name per table name; defaults to the PascalCased table name. */
+    readonly models?: Readonly<Record<string, string>>;
+  };
+  /** Schema of `role_permissions` and the RLS helpers (`permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids`) (and the RBAC scaffold). Default `permdock`; keep it out of `[api] schemas`. */
+  readonly schema?: string;
+  /** Where the helpers read roles and memberships: `database` tables or `jwt` claims. */
+  readonly authorize?: "database" | "jwt";
+  /** One policy per role and permission instead of one per table and command. */
+  readonly policyPerRole?: boolean;
+  /**
+   * Resolve tenant-defined custom roles in the helpers: `custom_role_permissions` and
+   * `custom_role_includes` in `database` mode, the `memberships[].grants` claim in `jwt` mode,
+   * always intersected with the `permdock_ceiling` view. Off by default.
+   */
+  readonly customRoles?: boolean;
+  /**
+   * Let link capabilities reach resource-scoped grants: `anon` policies that call
+   * `permdock_capability_ids`, which reads the `capability` claim `exchangeCapability`
+   * mints. Off by default.
+   */
+  readonly capabilities?: boolean;
+  /**
+   * `'deny'` (Supabase only): a token with `is_anonymous: true` reaches no grant
+   * but those to `anyone()`. Supabase gives an anonymous sign-in the
+   * `authenticated` role, so without it the grants to roles and to
+   * `authenticated()` reach it. The subject mapper has to refuse it in process
+   * too. Off by default.
+   */
+  readonly anonymousSignIns?: "deny";
+  /**
+   * `'views'`: one `security_invoker` view `<table>_visible` per table with field-limited
+   * read grants, whose restricted columns are `case when <permitted> then col end`. Off by default.
+   */
+  readonly fields?: "views";
+  /**
+   * With `fields: 'views'`, grant `anon` and `authenticated` only the unrestricted columns of
+   * the base table, so restricted columns are read through the view. Breaks `select *`.
+   */
+  readonly revokeColumns?: boolean;
+  /** Policy name template: `{table}`, `{op}`, plus `{role}` and `{permission}` with `policyPerRole`. */
+  readonly policyName?: string;
+  /** `rls generate --rbac supabase` defaults; flags override. */
+  readonly rbac?: {
+    readonly schema?: string;
+    readonly authorize?: "database" | "jwt";
+  };
+  /** The global-roles table `permdock_has` reads in `database` mode. Default `<schema>.user_roles (user_id, role)`, which the helpers create. */
+  readonly roles?: GlobalRoles;
+  /**
+   * The SQL command each action verb compiles to, merged over the defaults
+   * (`read`, `list`, `get` → `select`; `create` → `insert`; `update`; `delete`).
+   * `'none'` compiles no policy. Every granted action is seeded into
+   * `role_permissions` either way, so `permdock_has` answers for it.
+   */
+  readonly actions?: RlsActions;
+  /** Emit only the helpers, their seeds and the scaffold; the table policies stay hand-written. */
+  readonly helpersOnly?: boolean;
+  /** `rls migrate`: how existing helper calls map onto the generated helpers. */
+  readonly migrate?: RlsMigrateConfig;
+  /**
+   * Emit a wrapper under each `migrate.helpers` name that answers from the
+   * generated helpers, for legacy SQL `rls migrate` leaves alone. `true` puts
+   * them in `public`. Off by default; `--shims` turns it on.
+   */
+  readonly shims?: boolean | RlsShimsConfig;
+};
+/** `rls.shims`: where the legacy-named wrappers go. */
+type RlsShimsConfig = {
+  /** Schema of the legacy helpers. Default `public`. */
+  readonly schema?: string;
+};
+/** An action verb's SQL command, or `'none'` for a verb that only `permdock_has` answers. */
+type RlsActions = Readonly<Record<string, "select" | "insert" | "update" | "delete" | "none">>;
+/**
+ * One existing SQL helper `rls migrate` rewrites. `form` names its arguments:
+ * `ids(key)` returns scope ids, `row(id, key)` and `membership(id)` test one id,
+ * `scoped(scope, id, key)` takes the scope as a literal, `global(key)` returns a boolean.
+ */
+type RlsMigrateHelper = {
+  readonly form: "ids" | "row" | "membership";
+  readonly scope: string;
+} | {
+  readonly form: "scoped";
+} | {
+  readonly form: "global";
+};
+type RlsMigrateConfig = {
+  /** By function name, without the schema. */
+  readonly helpers: Readonly<Record<string, RlsMigrateHelper>>;
+  /** Exact key renames, checked before `prefixes`. */
+  readonly keys?: Readonly<Record<string, string>>;
+  /** Key prefix renames, longest first: `{ 'organization.': '' }`. */
+  readonly prefixes?: Readonly<Record<string, string>>;
+  /** For `scoped` helpers, the scope literals that mean a global check, such as `system`. */
+  readonly globalScopes?: readonly string[];
+  /** For `scoped` helpers, a scope literal's PermDock scope when the names differ. */
+  readonly scopes?: Readonly<Record<string, string>>;
+};
+/**
+ * The role column of a global-roles table that holds a foreign key: the role
+ * key is `column` of `through`, joined on `on` (`{ role_id: 'id' }`).
+ */
+type RoleThrough = {
+  /** The roles table; unqualified, it is in the global-roles table's schema. */
+  readonly through: string;
+  /** One entry: the global-roles column to the roles table column it references. */
+  readonly on: Readonly<Record<string, string>>;
+  /** The roles table column that holds the role key. */
+  readonly column: string;
+};
+/** Where global roles live: `table (user, role)`. Defaults `user_id` and `role`. */
+type GlobalRoles = {
+  readonly table: string;
+  readonly user?: string;
+  readonly role?: string | RoleThrough;
+};
+/** `permdock supabase hook generate` input. */
+type SupabaseHookConfig = {
+  /** The same `fromTable` / `fromJunction` sources the app passes as `memberships`. */
+  readonly memberships: readonly SqlMembershipSource[];
+  /** Schema of the hook and the version table. Default `rls.schema`, else `permdock`. */
+  readonly schema?: string;
+  /** Global roles: `user_role` and `roles`. Default `rls.roles`, else the `<schema>.user_roles (user_id, role)` table; `false` for none. */
+  readonly roles?: GlobalRoles | false;
+  /**
+   * Where the active first-scope id comes from: `app_metadata.<key>` (default
+   * `app_metadata.active_<first scope>`), `<table>.<column>` joined on `id`, or
+   * `{ table, id, column }`.
+   */
+  readonly activeFrom?: string | {
+    readonly table: string;
+    readonly id?: string;
+    readonly column: string;
+  };
+  /**
+   * The `attrs` claim, for attribute conditions such as
+   * `principal.claims.attrs.region`: allow-listed columns of a server-owned
+   * table (`table`, joined on `id`), and `app_metadata.<key>` entries. Never
+   * `user_metadata`; the migration fails when clients can write a column.
+   */
+  readonly attrs?: {
+    readonly table?: string;
+    readonly id?: string;
+    readonly columns: readonly string[];
+  };
+  /**
+   * Claims other packages own, each `claim: '<schema>.<function>'`, for
+   * example `{ features: 'better_supabase.feature_claims' }`. The function
+   * takes the user id (`uuid`) and returns `jsonb`; `null` omits the claim.
+   * Reserved names are refused, the claims sit outside `budget`, and a
+   * suspended user gets none.
+   */
+  readonly claims?: Readonly<Record<string, string>>;
+  /** Bytes of JSON the `memberships` claim may use. Default `supabaseMembershipsBudget` (1024). */
+  readonly budget?: number;
+  /** Keep `permdock_authz_version` and write the `authz_ver` claim. Default `true`. */
+  readonly version?: boolean;
+  /** The `jwt_expiry` the printed `config.toml` block sets. Default 900. */
+  readonly jwtExpiry?: number;
+  /** Suspended users get empty claims. Default `rls.suspension`. */
+  readonly suspension?: RlsSuspension;
+  readonly out?: string;
+};
+type SupabaseConfig = {
+  readonly hook?: SupabaseHookConfig;
+};
+type DoctorConfig = {
+  readonly sensitiveActions?: readonly string[];
+  readonly memberships?: string;
+  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettings` input) for PD029. */
+  readonly credentials?: string;
+  /** Globs or directories whose files are client entries for PD001, for frameworks with no `'use client'` convention. */
+  readonly clientEntries?: readonly string[];
+  /** Globs or directories of SQL migrations PD022 scans for views; defaults to the usual migration folders. */
+  readonly migrations?: readonly string[];
+  /** A JSON array of sample decoded token claims; PD039 measures each `supabase.hook.claims` entry in it. */
+  readonly claims?: string;
+};
+type PermDockConfig = {
+  readonly permissions?: string;
+  readonly policy?: string;
+  readonly collect?: CollectConfig;
+  readonly catalog?: CatalogConfig;
+  readonly openapi?: {
+    readonly doc?: readonly string[];
+  };
+  readonly rls?: RlsConfig;
+  readonly supabase?: SupabaseConfig;
+  readonly doctor?: DoctorConfig;
+};
+type CliIo = {
+  readonly stdout: (text: string) => void;
+  readonly stderr: (text: string) => void;
+  readonly now?: () => Date;
+  readonly fetch?: typeof fetch;
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  /** Styled human output; `--no-color` turns it off. Unset is plain. */
+  readonly color?: boolean;
+  /** A person at a terminal: commands may prompt. Unset never prompts. */
+  readonly interactive?: boolean;
+};
+type RunResult = {
+  readonly code: 0 | 1 | 2;
+  readonly stdout: string;
+  readonly stderr: string;
+};
+type PermDockPluginOptions = {
+  readonly collect?: CollectConfig;
+  readonly onDrift?: "error" | "warn";
+  /**
+   * Unplugin only: compare instead of write in `buildStart`, failing the
+   * build on drift (as `permdock collect --check` does). The Next plugin
+   * checks in `phase-production-build` unless `PERMDOCK_COLLECT=write`.
+   */
+  readonly check?: boolean;
+};
+//#endregion
+export { PermDockPluginOptions as a, RlsDialect as c, RlsMemberships as d, RlsSuspension as f, PermDockConfig as i, RlsFunctionMapping as l, RunResult as m, CliIo as n, RlsActiveRow as o, RlsTarget as p, CollectConfig as r, RlsConfig as s, CatalogConfig as t, RlsMembershipTable as u };