permdock 0.0.0 → 0.2.0

package/dist/compile-CNnl6uIt.d.ts

@@ -0,0 +1,94 @@
+import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-CFZAr_Al.js";
+import { y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
+//#region src/conditions/compile.d.ts
+type MembershipTable = {
+  readonly table: string;
+  readonly user: string;
+  readonly role: string;
+  /** Per scope name, the column holding that scope's id (the row's own scope and its ancestors). */
+  readonly columns?: Readonly<Record<string, string>>;
+  /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
+  readonly tenant?: string;
+  /** Column of the second scope's id; shorthand for `columns[<second scope>]`. */
+  readonly team?: string;
+  readonly id?: string;
+  /** Column naming the membership's resource, when one table holds several kinds. */
+  readonly resource?: string;
+  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
+  readonly via?: string;
+  /** Unix seconds, like `Membership.expiresAt`; `null` never expires. */
+  readonly expiresAt?: string;
+};
+type MembershipsMapping = {
+  /** The membership table of each named scope. */
+  readonly scopes?: Readonly<Record<string, MembershipTable>>;
+  /** The first scope's table; shorthand for `scopes[<first scope>]`. */
+  readonly tenant?: MembershipTable;
+  /** The second scope's table; shorthand for `scopes[<second scope>]`. */
+  readonly team?: MembershipTable;
+  readonly resource?: Readonly<Record<string, MembershipTable>>;
+};
+type CompileWhereOptions = {
+  readonly subject?: Subject;
+  readonly memberships?: MembershipsMapping;
+  readonly now?: number;
+  /** The policy's scopes; `where()` results carry them. Defaults to the implicit `tenant` / `team` pair. */
+  readonly scopes?: readonly Scope[];
+  /** Where the relation graph lives; without it a `related` node is refused. */
+  readonly relations?: RelationsMapping;
+  /** The policy's resource graph; `where()` results carry it. */
+  readonly resources?: ReadonlyMap<string, ResourceNode>;
+};
+type CompiledCompare = {
+  readonly kind: "compare";
+  readonly op: "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "contains" | "in" | "notIn";
+  readonly field: string;
+  readonly value: unknown;
+};
+type CompiledExists = {
+  readonly kind: "exists";
+  readonly table: string;
+  readonly user: string;
+  readonly userValue: string;
+  readonly role: string;
+  /** Empty means any role. */
+  readonly roles: readonly string[];
+  readonly rowColumn: string;
+  readonly rowField: string;
+  readonly expiresAt?: string;
+  /** Unix seconds the `expiresAt` column is compared against. */
+  readonly now: number;
+  /** A membership row matches when this column is `null` or equals `tenantValue`. */
+  readonly tenantColumn?: string;
+  readonly tenantValue?: string;
+  readonly resourceColumn?: string;
+  readonly resourceValue?: string;
+};
+type CompiledWhere = {
+  readonly kind: "never";
+} | {
+  readonly kind: "always";
+} | CompiledCompare | {
+  readonly kind: "isNull";
+  readonly field: string;
+  readonly negated: boolean;
+} | {
+  readonly kind: "and" | "or";
+  readonly items: readonly CompiledWhere[];
+} | {
+  readonly kind: "not";
+  readonly item: CompiledWhere;
+} | CompiledExists | CompiledSql;
+/** A Postgres boolean over the row that is never NULL: a `related` node's subquery. */
+type CompiledSql = {
+  readonly kind: "sql";
+  readonly parts: GraphSql;
+  /** What a `{ subject: true }` part binds. */
+  readonly subject: string;
+};
+/** A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match literally. */
+declare function escapeLike(value: string): string;
+declare function compileWhere(input: Condition | WhereResult, options?: CompileWhereOptions): CompiledWhere;
+//#endregion
+export { CompiledWhere as a, compileWhere as c, CompiledSql as i, escapeLike as l, CompiledCompare as n, MembershipTable as o, CompiledExists as r, MembershipsMapping as s, CompileWhereOptions as t };

package/dist/config-BJiM-xAm.js

@@ -0,0 +1,157 @@
+import { t as CliError } from "./errors-CWfoNg9N.js";
+import { existsSync } from "node:fs";
+import { relative, resolve } from "node:path";
+//#region src/cli/config-schema.ts
+const SECTIONS = {
+	collect: {
+		srcPath: true,
+		out: true,
+		barrel: true
+	},
+	catalog: { out: true },
+	openapi: { doc: true },
+	rls: {
+		tables: true,
+		dialect: true,
+		memberships: true,
+		membershipSources: true,
+		suspension: true,
+		functions: true,
+		inlineFunctions: true,
+		force: true,
+		fixtures: true,
+		tenantClaim: true,
+		tenantType: true,
+		teamType: true,
+		scopeTypes: true,
+		roleClaim: true,
+		gucPrefix: true,
+		out: true,
+		drizzle: true,
+		prisma: true,
+		schema: true,
+		authorize: true,
+		policyPerRole: true,
+		customRoles: true,
+		capabilities: true,
+		anonymousSignIns: true,
+		fields: true,
+		revokeColumns: true,
+		policyName: true,
+		rbac: true,
+		roles: true,
+		actions: true,
+		helpersOnly: true,
+		rowHelpers: true,
+		treeValues: true,
+		trustedReaders: true,
+		migrate: true,
+		shims: true,
+		tenants: true,
+		customRoleWrites: true,
+		anonExecute: true,
+		assignments: true,
+		approvals: true,
+		jsonSchema: true,
+		ownershipTriggers: true,
+		readOnlyActors: true,
+		apiKeys: true,
+		realtime: true,
+		storage: true
+	},
+	supabase: { hook: true },
+	powersync: {
+		out: true,
+		resources: true,
+		action: true,
+		manifest: true
+	},
+	doctor: {
+		sensitiveActions: true,
+		memberships: true,
+		credentials: true,
+		clientEntries: true,
+		migrations: true,
+		claims: true,
+		srcPath: true
+	}
+};
+const TOP_LEVEL = /* @__PURE__ */ new Set([
+	"permissions",
+	"policy",
+	...Object.keys(SECTIONS)
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSection(key) {
+	return Object.hasOwn(SECTIONS, key);
+}
+/**
+* Checks the shape a command relies on before it reads the config: module
+* paths are strings and each section is an object. A key PermDock does not
+* read is a warning, so a config written for a newer version still loads.
+*/
+function parseConfig(value, file) {
+	if (value === void 0) return {
+		config: {},
+		warnings: []
+	};
+	if (!isRecord(value)) throw new CliError("usage", `PermDock CLI: ${file} must export a config object as default (use defineConfig)`);
+	const warnings = [];
+	const unknown = (path, known) => `${file}: unknown key ${path}; PermDock reads ${[...known].join(", ")}`;
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "permissions" || key === "policy") {
+			if (entry !== void 0 && typeof entry !== "string") throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be a module path string`);
+			continue;
+		}
+		if (!isSection(key)) {
+			warnings.push(unknown(key, TOP_LEVEL));
+			continue;
+		}
+		if (entry === void 0) continue;
+		if (!isRecord(entry)) throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be an object`);
+		const known = SECTIONS[key];
+		for (const child of Object.keys(entry)) if (!Object.hasOwn(known, child)) warnings.push(unknown(`${key}.${child}`, Object.keys(known)));
+	}
+	return {
+		config: value,
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/config.ts
+const CONFIG_FILES = [
+	"permdock.config.ts",
+	"permdock.config.mts",
+	"permdock.config.js",
+	"permdock.config.mjs"
+];
+function defineConfig(config) {
+	return config;
+}
+function isConfigFile(name) {
+	return CONFIG_FILES.some((file) => file === name);
+}
+async function readConfig(cwd, fromFlag, options) {
+	const path = fromFlag ? resolve(cwd, fromFlag) : CONFIG_FILES.map((name) => resolve(cwd, name)).find((file) => existsSync(file));
+	if (path === void 0) return {
+		config: {},
+		warnings: [],
+		file: void 0
+	};
+	if (!existsSync(path)) throw new Error(`PermDock CLI: config file not found: ${path}`);
+	const { loadModule, pickNamed } = await import("./load-DwJUafYN.js");
+	return {
+		...parseConfig(pickNamed(await loadModule(path, options), ["default"]), relative(cwd, path).replaceAll("\\", "/")),
+		file: path
+	};
+}
+async function loadConfig(cwd, fromFlag, options) {
+	return (await readConfig(cwd, fromFlag, options)).config;
+}
+function resolveCwd(cwd, fallback) {
+	return cwd === void 0 ? fallback : resolve(fallback, cwd);
+}
+//#endregion
+export { resolveCwd as a, readConfig as i, isConfigFile as n, loadConfig as r, defineConfig as t };

package/dist/config-Bn00Z3ks.js

@@ -0,0 +1,36 @@
+import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/config.ts
+function config(ctx) {
+	return defineCommand({
+		meta: {
+			name: "config",
+			description: COMMAND_DESCRIPTIONS.config
+		},
+		args: {
+			...globalArgs,
+			print: {
+				type: "boolean",
+				description: "Print the effective config as JSON: the file, as written, and each default"
+			},
+			strict: {
+				type: "boolean",
+				description: "Exit 1 on warnings"
+			}
+		},
+		async run({ args: parsed }) {
+			const { runConfig } = await import("./config-report-Dw_JcUqT.js");
+			ctx.report(runConfig({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				file: ctx.configPath,
+				warnings: ctx.configWarnings,
+				print: parsed.print === true,
+				json: ctx.json,
+				strict: parsed.strict === true
+			}));
+		}
+	});
+}
+//#endregion
+export { config };

package/dist/config-report-Dw_JcUqT.js

@@ -0,0 +1,44 @@
+import { n as CONFIG_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-DDDv_ESs.js";
+import "./sources-B0UvrJ21.js";
+import { r as MIGRATION_DIRS } from "./supabase-config-Bs44dare.js";
+import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-ByfYlNv1.js";
+//#region src/cli/config-report.ts
+function configReport(input) {
+	const { cwd, config } = input;
+	const srcPath = config.collect?.srcPath ?? defaultSrcPath();
+	const barrel = config.collect?.barrel;
+	return {
+		$schema: CONFIG_REPORT_SCHEMA,
+		file: input.file === void 0 ? null : rel(cwd, input.file),
+		config,
+		resolved: {
+			permissions: config.permissions ?? guessPermissions(cwd, srcPath) ?? null,
+			policy: config.policy ?? null,
+			srcPath,
+			catalog: rel(cwd, catalogPath(config, cwd)),
+			barrel: barrel === void 0 || barrel === false ? false : barrelFile(barrel),
+			migrations: config.doctor?.migrations ?? MIGRATION_DIRS,
+			sensitiveActions: config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS,
+			rlsSchema: config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock"
+		},
+		warnings: input.warnings
+	};
+}
+/** `permdock config`: the config's warnings, or with `--print` or `--json` the effective config. */
+function runConfig(input) {
+	const report = configReport(input);
+	const code = input.strict && report.warnings.length > 0 ? 1 : 0;
+	if (input.print || input.json) return {
+		code,
+		output: `${JSON.stringify(report, null, 2)}\n`
+	};
+	return {
+		code,
+		output: `${[report.file === null ? "no permdock.config file; every option takes its default" : `${report.file}: ${report.warnings.length === 0 ? "ok" : `${String(report.warnings.length)} warning${report.warnings.length === 1 ? "" : "s"}`}`, ...report.warnings.map((warning) => `  warn ${warning}`)].join("\n")}\n`
+	};
+}
+//#endregion
+export { runConfig };

package/dist/connection-CU8MQxRi.js

@@ -0,0 +1,194 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+//#region src/server/connection.ts
+/** `setTimeout` stores delays in a signed 32-bit integer. */
+const MAX_DELAY = 2147483647;
+const REVOKED = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "no-grant",
+		detail: "connection-revoked"
+	})]),
+	alternatives: Object.freeze([])
+});
+function principalId(permdock) {
+	return permdock.subject.principal?.id;
+}
+function nextMembershipExpiry(permdock, now) {
+	let next;
+	for (const membership of permdock.memberships()) {
+		const at = membership.expiresAt;
+		if (at !== void 0 && at > now && (next === void 0 || at < next)) next = at;
+	}
+	return next;
+}
+async function loadData(data) {
+	if (data === void 0) return {
+		ok: true,
+		value: void 0
+	};
+	if (typeof data !== "function") return {
+		ok: true,
+		value: data
+	};
+	const loaded = await data();
+	return loaded === null || loaded === void 0 ? {
+		ok: false,
+		value: void 0
+	} : {
+		ok: true,
+		value: loaded
+	};
+}
+function matches(event, permdock, tenant) {
+	if (event.principal !== principalId(permdock)) return false;
+	const session = permdock.subject.session;
+	if (event.session !== void 0 && session !== void 0 && event.session !== session) return false;
+	return !(event.kind === "changed" && event.tenant !== void 0 && tenant !== void 0 && event.tenant !== tenant);
+}
+/** Opens a long-lived connection. Never throws; a failure aborts. */
+async function openConnection(input) {
+	const controller = new AbortController();
+	const timers = /* @__PURE__ */ new Set();
+	const decideOptions = compact({
+		source: "adapter",
+		adapter: input.adapter
+	});
+	let unsubscribe;
+	let closed = false;
+	let current;
+	let chain = Promise.resolve();
+	const clear = () => {
+		for (const timer of timers) clearTimeout(timer);
+		timers.clear();
+		unsubscribe?.();
+		unsubscribe = void 0;
+	};
+	const abort = (code, decision) => {
+		if (controller.signal.aborted) return;
+		clear();
+		controller.abort(new PermDockRevokedError(compact({
+			code,
+			permission: input.options.permission?.key,
+			decision
+		})));
+	};
+	const after = (ms, run) => {
+		const timer = setTimeout(() => {
+			timers.delete(timer);
+			run();
+		}, Math.max(0, Math.min(ms, MAX_DELAY)));
+		timers.add(timer);
+	};
+	/** `true` when `permdock` still holds the opening permission. */
+	const admits = async (permdock) => {
+		const { permission } = input.options;
+		if (permission === void 0) return true;
+		const loaded = await loadData(input.options.data);
+		if (!loaded.ok) {
+			abort("denied");
+			return false;
+		}
+		const decision = permdock.decide(permission, loaded.value, decideOptions);
+		if (decision.outcome !== "granted") {
+			abort("denied", decision);
+			return false;
+		}
+		return true;
+	};
+	let schedule;
+	const revalidate = () => {
+		chain = chain.then(async () => {
+			if (controller.signal.aborted || closed) return;
+			let next;
+			try {
+				next = await input.rebuild();
+			} catch {
+				abort("subject-changed");
+				return;
+			}
+			const id = principalId(next);
+			if (id === void 0 || current === void 0 || id !== principalId(current)) {
+				abort("subject-changed");
+				return;
+			}
+			if (!await admits(next)) return;
+			current = next;
+			for (const timer of timers) clearTimeout(timer);
+			timers.clear();
+			schedule?.(next);
+		}).catch(() => {
+			abort("subject-changed");
+		});
+	};
+	schedule = (permdock) => {
+		const now = Date.now() / 1e3;
+		const expiresAt = permdock.subject.expiresAt;
+		if (expiresAt !== void 0) {
+			if (expiresAt <= now) {
+				abort("expired");
+				return;
+			}
+			const wait = (expiresAt - now) * 1e3;
+			after(wait, () => {
+				if (wait > MAX_DELAY) {
+					schedule?.(current ?? permdock);
+					return;
+				}
+				abort("expired");
+			});
+		}
+		const membership = nextMembershipExpiry(permdock, now);
+		if (membership !== void 0) after((membership - now) * 1e3, revalidate);
+		const every = input.options.revalidate;
+		if (every !== void 0 && Number.isFinite(every) && every > 0) after(every, revalidate);
+	};
+	try {
+		current = await input.open();
+	} catch {
+		abort("denied");
+	}
+	if (current !== void 0 && !controller.signal.aborted && await admits(current)) {
+		schedule(current);
+		if (input.feed !== void 0 && !controller.signal.aborted) try {
+			unsubscribe = input.feed.subscribe((event) => {
+				if (current === void 0 || !matches(event, current, input.tenant)) return;
+				if (event.kind === "session-revoked") abort("session-revoked");
+				else revalidate();
+			});
+		} catch {
+			abort("expired");
+		}
+	}
+	const live = () => controller.signal.aborted || closed ? void 0 : current;
+	return Object.freeze({
+		get permdock() {
+			if (current === void 0) throw new PermDockRevokedError({ code: "denied" });
+			return current;
+		},
+		signal: controller.signal,
+		check(permission, data, checkOptions) {
+			const permdock = live();
+			if (permdock === void 0) return REVOKED;
+			return permdock.decide(permission, data, checkOptions?.trusted === true ? {
+				...decideOptions,
+				trusted: true
+			} : {
+				...decideOptions,
+				trusted: false,
+				boundary: "manual"
+			});
+		},
+		filter(permission, items) {
+			const permdock = live();
+			return permdock === void 0 ? [] : permdock.filter(permission, items, decideOptions);
+		},
+		close() {
+			closed = true;
+			clear();
+		}
+	});
+}
+//#endregion
+export { openConnection };

package/dist/context-Ttp0ekMT.js

@@ -0,0 +1,82 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { i as isPromiseLike } from "./store-options-yO0V6gRn.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-DNyC1y48.js";
+import { getContext, onDestroy, setContext } from "svelte";
+import { toStore } from "svelte/store";
+//#region src/svelte/context.ts
+const permDockKey = Symbol("permdock");
+function isReadable(value) {
+	return typeof value === "object" && value !== null && "subscribe" in value && typeof value.subscribe === "function";
+}
+function reactiveSource(source) {
+	if (typeof source === "function") return toStore(source);
+	return isReadable(source) ? source : void 0;
+}
+/**
+* Builds the store; the returned `stop` ends the subscription to a reactive
+* snapshot source.
+*/
+function connectSvelteStore(options) {
+	const source = options.snapshot;
+	const promised = isPromiseLike(source);
+	const reactive = promised ? void 0 : reactiveSource(source);
+	let initial;
+	if (reactive !== void 0) reactive.subscribe((value) => {
+		initial = value;
+	})();
+	else if (!promised) initial = source;
+	const tenant = options.tenant;
+	const headers = options.headers;
+	const store = providerStore(compact({
+		endpoint: options.endpoint,
+		snapshotUrl: options.snapshotUrl,
+		approvals: options.approvals,
+		tenant: typeof tenant === "function" ? tenant() : tenant,
+		maxAge: options.maxAge
+	}), () => ({
+		headers: typeof headers === "function" ? headers() : headers,
+		fetch: options.fetch,
+		verifier: options.verifier
+	}), promised ? source : initial);
+	const stops = [];
+	if (reactive !== void 0) {
+		let current = initial;
+		stops.push(reactive.subscribe((value) => {
+			if (value !== current) {
+				current = value;
+				store.replace(value);
+			}
+		}));
+	}
+	if (typeof tenant === "function") {
+		let active = tenant();
+		stops.push(toStore(tenant).subscribe((next) => {
+			if (next !== void 0 && next !== active) {
+				active = next;
+				switchTenant(store, next);
+			}
+		}));
+	}
+	return {
+		store,
+		stop: () => {
+			for (const stop of stops) stop();
+		}
+	};
+}
+function providePermDock(options) {
+	const { store, stop } = connectSvelteStore(options);
+	onDestroy(() => {
+		stop();
+		store.dispose();
+	});
+	setContext(permDockKey, store);
+	return store;
+}
+function getStore() {
+	const store = getContext(permDockKey);
+	if (store === void 0) throw new Error("PermDock: stores require setPermDock.");
+	return store;
+}
+//#endregion
+export { providePermDock as n, getStore as t };

package/dist/convex/index.d.ts

@@ -0,0 +1,45 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DAqevpNk.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+//#region src/convex/types.d.ts
+type ConvexCtxLike = {
+  readonly auth?: {
+    readonly getUserIdentity?: () => Promise<unknown>;
+  };
+  readonly db?: unknown;
+};
+type ConvexPermDockCtx<TCtx, V extends PolicyVocabulary = PolicyVocabulary> = TCtx & {
+  readonly permdock: PermDock<V>;
+};
+type ConvexSubject<TCtx, TUser = unknown> = (ctx: TCtx) => TUser | Promise<TUser>;
+type ConvexQueryBuilder = (definition: {
+  readonly args: Record<string, never>;
+  readonly handler: (ctx: ConvexCtxLike, args: Record<string, never>) => unknown;
+}) => unknown;
+type ConvexPermDockOptions<TCtx, TUser = unknown> = InstanceOptions & {
+  readonly subject: ConvexSubject<TCtx, TUser>;
+  /** The active tenant: a fixed id or a function of the Convex context; a throw is no tenant. */
+  readonly tenant?: string | ((ctx: TCtx) => string | undefined | Promise<string | undefined>);
+  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  readonly actor?: (ctx: TCtx) => unknown;
+  readonly query?: ConvexQueryBuilder;
+};
+type ConvexHandler<TCtx, TArgs, TResult, V extends PolicyVocabulary = PolicyVocabulary> = (ctx: ConvexPermDockCtx<TCtx, V>, args: TArgs) => TResult | Promise<TResult>;
+type ConvexErrorData = ProblemDetails;
+type ConvexPermDock<TCtx, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly withPermDock: <TArgs, TResult>(handler: ConvexHandler<TCtx, TArgs, TResult, V>) => (ctx: TCtx, args: TArgs) => Promise<TResult>;
+  readonly snapshotQuery: (options?: {
+    readonly include?: readonly Permission[];
+  }) => unknown;
+};
+//#endregion
+//#region src/convex/create.d.ts
+export declare class ConvexError extends Error {
+  override readonly name = "ConvexError";
+  readonly data: ReturnType<PermDockDeniedError["toProblemDetails"]>;
+  constructor(data: ReturnType<PermDockDeniedError["toProblemDetails"]>);
+}
+export declare function createPermDock<TCtx, TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ConvexPermDockOptions<TCtx, TUser>): ConvexPermDock<TCtx, V>;
+//#endregion
+export type { ConvexCtxLike, ConvexErrorData, ConvexHandler, ConvexPermDock, ConvexPermDockCtx, ConvexPermDockOptions, ConvexQueryBuilder, ConvexSubject };