permdock 0.0.0 → 0.2.0

package/dist/sources-B0UvrJ21.js

@@ -0,0 +1,534 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
+//#region src/supabase/keep.ts
+/** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
+function keptKeys(row) {
+	const keep = row?.keep;
+	if (keep === void 0) return [];
+	const keys = Array.isArray(keep) ? keep.map((item) => typeof item === "string" ? item : item !== null && typeof item === "object" && "key" in item ? item.key : void 0) : [void 0];
+	const valid = keys.filter((key) => typeof key === "string" && key !== "");
+	if (valid.length !== keys.length) throw new TypeError("PermDock: a suspension keep is a list of permissions or permission keys");
+	return [...new Set(valid)].toSorted();
+}
+//#endregion
+//#region src/supabase/roles.ts
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/**
+* Resolves the role sources of `table` (`schema.table`, or `public`). An
+* unqualified `through` table is in `table`'s schema. `label` names the
+* option in the error for an `on` that is not exactly one column; `prefix`
+* starts every error. A row with several sources holds the union of their
+* non-null keys.
+*/
+function roleColumn(role, table, alias, options) {
+	if (!isRoleList(role)) return singleRole(role, table, alias, options);
+	const prefix = options.prefix ?? "PermDock";
+	const parts = role.map((part, index) => singleRole(part, table, alias, {
+		...options,
+		label: `${options.label}[${String(index)}]`
+	}));
+	const [first] = parts;
+	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
+	if (parts.length === 1) return first;
+	const rows = quoteSqlIdent(`${alias}r`, prefix);
+	const values = quoteSqlIdent(`${alias}v`, prefix);
+	const sql = `${rows}.permdock_role`;
+	return {
+		column: first.column,
+		sql,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
+		lookup: sql,
+		columns: [...new Set(parts.map((part) => part.column))],
+		throughs: parts.flatMap((part) => part.throughs),
+		lateral: true
+	};
+}
+function singleRole(role, table, alias, options) {
+	const prefix = options.prefix ?? "PermDock";
+	const q = (name) => quoteSqlIdent(name, prefix);
+	if (typeof role === "string") return {
+		column: role,
+		sql: `${alias}.${q(role)}::text`,
+		join: "",
+		lookup: `${alias}.${q(role)}::text`,
+		columns: [role],
+		throughs: [],
+		lateral: false
+	};
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
+	const [ref, id] = pair;
+	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
+	const keys = options.joined ?? `${alias}k`;
+	const target = quoteSqlTable(through, prefix);
+	const keyed = {
+		table: through,
+		id,
+		key: role.column,
+		ref
+	};
+	return {
+		column: ref,
+		sql: `${keys}.${q(role.column)}::text`,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
+		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		through: keyed,
+		columns: [ref],
+		throughs: [keyed],
+		lateral: false
+	};
+}
+/** The manifest entry of one role source: the column, and the roles table it references. */
+function sourceManifest(column, through) {
+	return through === void 0 ? { column } : {
+		column,
+		through: {
+			table: through.table,
+			id: through.id,
+			column: through.key
+		}
+	};
+}
+/** The manifest entry of a single-source column, such as a membership's user. */
+function columnManifest(role) {
+	return sourceManifest(role.column, role.through);
+}
+/** The manifest entry of a role column, or one entry per source of a row with several. */
+function roleManifest(role) {
+	if (!role.lateral) return sourceManifest(role.column, role.through);
+	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
+}
+//#endregion
+//#region src/supabase/sources.ts
+const ident = (name) => quoteSqlIdent(name);
+const literal = quoteSqlLiteral;
+function qualifiedName(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+function qualified(name) {
+	return quoteSqlTable(qualifiedName(name));
+}
+function col(name) {
+	return `m.${ident(name)}`;
+}
+function activeRow(row, id) {
+	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		const values = row.active ?? [];
+		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
+		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
+	return `exists (select 1 from ${qualified(row.table)} s where ${parts.join(" and ")})`;
+}
+function textArray(values) {
+	return `array[${values.map(literal).join(", ")}]::text[]`;
+}
+/**
+* The suspendable instances on the row's chain whose scope keeps
+* permissions: each one's active check and its kept keys.
+*/
+function keeping(shape) {
+	const scopes = Object.entries(shape.suspension?.scopes ?? {}).flatMap(([name, row]) => {
+		const id = shape.idOf(name);
+		const keep = keptKeys(row);
+		return id === void 0 || keep.length === 0 ? [] : [{
+			active: `(${id} is null or ${activeRow(row, id)})`,
+			keep
+		}];
+	});
+	const keep = keptKeys(shape.suspension?.memberships);
+	return shape.disabledAt === void 0 || keep.length === 0 ? scopes : [...scopes, {
+		active: enabled(shape.disabledAt),
+		keep
+	}];
+}
+function enabled(disabledAt) {
+	return `${col(disabledAt)} is null`;
+}
+function keepsDisabled(shape) {
+	return shape.disabledAt !== void 0 && keptKeys(shape.suspension?.memberships).length > 0;
+}
+/**
+* The keys a row on a suspended chain still grants, as a sorted `jsonb`
+* array: the keys every suspended instance on it keeps. `null` when nothing
+* is kept.
+*/
+function keptSql(shape) {
+	const list = keeping(shape);
+	if (list.length === 0) return;
+	const keys = [...new Set(list.flatMap((item) => item.keep))].toSorted();
+	const each = list.map((item) => `(${item.active} or k = any(${textArray(item.keep)}))`).join(" and ");
+	return `(select jsonb_agg(k order by k) from unnest(${textArray(keys)}) k where ${each})`;
+}
+function allActive(shape) {
+	return keeping(shape).map((item) => item.active).join(" and ");
+}
+function filters(shape, owner) {
+	const lines = [owner];
+	if (shape.expiresAt !== void 0) {
+		const expires = col(shape.expiresAt);
+		lines.push(`(${expires} is null or ${expires} > now())`);
+	}
+	if (shape.disabledAt !== void 0 && !keepsDisabled(shape)) lines.push(enabled(shape.disabledAt));
+	const users = shape.suspension?.users;
+	if (users !== void 0) lines.push(activeRow(users, shape.userSql));
+	for (const [name, row] of Object.entries(shape.suspension?.scopes ?? {})) {
+		const id = shape.idOf(name);
+		if (id !== void 0 && keptKeys(row).length === 0) lines.push(`(${id} is null or ${activeRow(row, id)})`);
+	}
+	const kept = keptSql(shape);
+	if (kept !== void 0) lines.push(`(${allActive(shape)} or ${kept} is not null)`);
+	return lines;
+}
+function keepColumn(shape) {
+	const kept = keptSql(shape);
+	return kept === void 0 ? "null::jsonb" : `(array_agg(case when ${allActive(shape)} then null else ${kept} end))[1]`;
+}
+function selectOf(shape, where, user, keep) {
+	const fields = [
+		...user ? [`${shape.userSql}::text as user_id`] : [],
+		`${shape.scope} as scope`,
+		`${shape.id} as id`,
+		`${shape.within} as within`,
+		`${shape.roles} as roles`,
+		`${shape.via} as via`,
+		`${shape.expiresAt === void 0 ? "null::bigint" : `floor(extract(epoch from ${col(shape.expiresAt)}))::bigint`} as expires_at`,
+		`${shape.grantedBy} as granted_by`,
+		`${shape.reason} as reason`,
+		`${shape.memberGroup} as member_group`,
+		`${shape.managed} as managed_by`,
+		`${shape.seats} as seats`,
+		...keep ? [`${keepColumn(shape)} as keep`] : []
+	];
+	const group = [
+		...user ? [shape.userSql] : [],
+		...shape.groupBy,
+		...keepsDisabled(shape) && shape.disabledAt !== void 0 ? [`(${enabled(shape.disabledAt)})`] : []
+	];
+	return `select ${fields.join(", ")}
+from ${qualified(shape.table)} m${shape.join}
+where ${where.join("\n  and ")}
+group by ${group.join(", ")}`;
+}
+function holdersOf(shape) {
+	const id = ident(shape.idColumn);
+	return {
+		idType: `${qualified(shape.table)}.${id}%type`,
+		id: (scope, row) => {
+			const filter = shape.holds(scope, row);
+			return filter === void 0 ? "null::text" : filter === "true" ? `${row}.${id}::text` : `case when ${filter} then ${row}.${id}::text end`;
+		},
+		rows: (scope, options = {}) => {
+			const where = [shape.holds(scope, "m") ?? "false"];
+			if (options.id !== void 0) where.push(`m.${id} = ${options.id}`);
+			const conditions = [...shape.expiresAt === void 0 ? [] : [`(${col(shape.expiresAt)} is null or ${col(shape.expiresAt)} > now())`], ...shape.disabledAt === void 0 ? [] : [enabled(shape.disabledAt)]];
+			const live = conditions.length === 0 ? "true" : conditions.length === 1 ? conditions.join("") : `(${conditions.join(" and ")})`;
+			const kept = where.filter((part) => part !== "true");
+			return `select m.${id}::text as id, ${shape.userSql}::text as user_id, ${shape.roleKey} as role, ${shape.via} as via, ${live} as live
+from ${options.from ?? qualified(shape.table)} m${shape.join}${shape.roleJoin}${kept.length === 0 ? "" : `\nwhere ${kept.join(" and ")}`}`;
+		}
+	};
+}
+function sqlOf(shape) {
+	const suspension = shape.suspension;
+	return compact({
+		holders: holdersOf(shape),
+		table: shape.table,
+		user: shape.user,
+		userThrough: shape.userThrough,
+		userType: shape.userThrough === void 0 ? `${qualified(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
+		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
+		managed: shape.managedColumn,
+		through: shape.through,
+		throughs: shape.throughs,
+		columns: [...new Set(shape.columns)],
+		manifest: {
+			table: qualifiedName(shape.table),
+			...shape.manifest,
+			columns: [...new Set(shape.columns)]
+		},
+		keeps: keptSql(shape) !== void 0,
+		select: (user, keep = keptSql(shape) !== void 0) => selectOf(shape, filters(shape, `${shape.userSql} = ${user}`), false, keep),
+		list: (keep = keptSql(shape) !== void 0) => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true, keep)
+	});
+}
+function isFixed(roles) {
+	return Array.isArray(roles);
+}
+/** A role column of the membership table, aliased `m`; a `through` column joins its roles table as `mk`. */
+function memberRole(role, table, label) {
+	return roleColumn(role, qualifiedName(table), "m", {
+		label,
+		indent: ""
+	});
+}
+/** The user of the membership table, aliased `m`; a `through` user joins its table as `mu`. */
+function memberUser(user, table, label) {
+	const column = roleColumn(user, qualifiedName(table), "m", {
+		label,
+		indent: "",
+		joined: "mu",
+		example: "{ contact_profile_id: 'id' }"
+	});
+	return {
+		column,
+		sql: column.through === void 0 ? col(column.column) : `mu.${ident(column.through.key)}`
+	};
+}
+function roleAgg(role) {
+	return `jsonb_agg(distinct ${role.sql} order by ${role.sql})`;
+}
+function rowsOf(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function membershipOf(row) {
+	const roles = strings(row["roles"]);
+	if (typeof row["scope"] !== "string" || typeof row["id"] !== "string") return;
+	if (roles.length === 0) return;
+	const within = row["within"] !== null && typeof row["within"] === "object" && !Array.isArray(row["within"]) ? Object.fromEntries(Object.entries(row["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const expires = typeof row["expires_at"] === "number" ? row["expires_at"] : typeof row["expires_at"] === "string" && row["expires_at"] !== "" ? Number(row["expires_at"]) : void 0;
+	const seats = strings(row["seats"]);
+	const keep = row["keep"];
+	if (keep !== null && keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
+	return compact({
+		scope: row["scope"],
+		id: row["id"],
+		within: within === void 0 || Object.keys(within).length === 0 ? void 0 : within,
+		roles: [...roles].toSorted(),
+		via: typeof row["via"] === "string" ? row["via"] : void 0,
+		expiresAt: Number.isFinite(expires) ? expires : void 0,
+		grantedBy: typeof row["granted_by"] === "string" && row["granted_by"] !== "" ? row["granted_by"] : void 0,
+		reason: typeof row["reason"] === "string" && row["reason"] !== "" ? row["reason"] : void 0,
+		member: typeof row["member_group"] === "string" && row["member_group"] !== "" ? { group: row["member_group"] } : void 0,
+		managedBy: row["managed_by"] === "idp" ? "idp" : void 0,
+		entitlements: seats.length === 0 ? void 0 : seats,
+		keep: keep === null || keep === void 0 ? void 0 : strings(keep)
+	});
+}
+function sourceOf(sql, query) {
+	const run = async (text, values) => {
+		if (query === void 0) throw new TypeError(`PermDock: the ${sql.table} membership source needs query to resolve memberships`);
+		return rowsOf(await query(text, values));
+	};
+	return {
+		sql,
+		async membershipsFor(principal) {
+			return (await run(sql.select("$1"), [principal.id])).flatMap((row) => {
+				const membership = membershipOf(row);
+				return membership === void 0 ? [] : [membership];
+			});
+		},
+		async list(scope) {
+			return (await run(sql.list(), [scope.scope, scope.id])).flatMap((row) => {
+				const membership = membershipOf(row);
+				return membership === void 0 || typeof row["user_id"] !== "string" ? [] : [{
+					principal: { id: row["user_id"] },
+					membership
+				}];
+			});
+		}
+	};
+}
+/**
+* `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
+* `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
+* `ctx.postgres` runs as the caller under RLS, so the membership tables must
+* be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
+*/
+function fromSupabasePostgres(postgres) {
+	return (text, values) => postgres.queryRaw(text, [...values]);
+}
+/**
+* Memberships from one table holding every scope: a row per user, scope,
+* instance and role (`user_id, scope, scope_id, role`), with optional
+* `within`, `via`, expiry, owner and seat columns. Rows of the same instance
+* merge into one membership.
+*/
+function fromTable(options) {
+	const c = options.columns ?? {};
+	const scope = `${col(c.scope ?? "scope")}::text`;
+	const id = `${col(c.id ?? "scope_id")}::text`;
+	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
+	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
+	const user = memberUser(c.user ?? "user_id", options.table, "fromTable columns.user");
+	const role = memberRole(c.role ?? "role", options.table, "fromTable columns.role");
+	return sourceOf(sqlOf({
+		table: options.table,
+		join: `${user.column.join}${role.join}`,
+		through: role.through,
+		throughs: role.throughs,
+		user: user.column.column,
+		userSql: user.sql,
+		userThrough: user.column.through,
+		scope,
+		id,
+		within,
+		roles: roleAgg(role),
+		via: optional(c.via, "text"),
+		expiresAt: c.expiresAt,
+		disabledAt: c.disabledAt,
+		grantedBy: optional(c.grantedBy, "text"),
+		reason: optional(c.reason, "text"),
+		memberGroup: optional(c.group, "text"),
+		managed: optional(c.managedBy, "text"),
+		managedColumn: c.managedBy,
+		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
+		idOf: (name) => `coalesce(case when ${scope} = ${literal(name)} then ${id} end${c.within === void 0 ? "" : `, ${within} ->> ${literal(name)}`})`,
+		idColumn: c.id ?? "scope_id",
+		holds: (name, alias) => `${alias}.${ident(c.scope ?? "scope")}::text = ${literal(name)}`,
+		roleKey: role.sql,
+		roleJoin: "",
+		groupBy: [
+			scope,
+			id,
+			...c.within === void 0 ? [] : [within],
+			...[
+				c.via,
+				c.expiresAt,
+				c.grantedBy,
+				c.reason,
+				c.group,
+				c.managedBy,
+				c.seats
+			].filter((name) => name !== void 0).map(col)
+		],
+		suspension: options.suspension,
+		columns: [
+			user.column.column,
+			c.scope ?? "scope",
+			c.id ?? "scope_id",
+			...role.columns,
+			...[
+				c.within,
+				c.via,
+				c.expiresAt,
+				c.disabledAt
+			].filter((name) => name !== void 0)
+		],
+		manifest: compact({
+			user: columnManifest(user.column),
+			scope: { column: c.scope ?? "scope" },
+			id: { column: c.id ?? "scope_id" },
+			role: roleManifest(role),
+			within: c.within === void 0 ? void 0 : { column: c.within },
+			via: c.via === void 0 ? void 0 : { column: c.via },
+			expiresAt: c.expiresAt === void 0 ? void 0 : { column: c.expiresAt },
+			disabledAt: c.disabledAt === void 0 ? void 0 : { column: c.disabledAt }
+		})
+	}), options.query);
+}
+/**
+* Memberships from a table of one scope (`customer_contacts`): every row is a
+* membership of `scope`, with roles from a column or fixed (`['contact']`), a
+* fixed `via`, and ancestor ids from `within` columns.
+*/
+function fromJunction(options) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
+	const idColumn = options.id ?? `${options.scope}_id`;
+	const withinEntries = Object.entries(options.within ?? {});
+	const roles = options.roles;
+	const fixed = isFixed(roles) ? roles : void 0;
+	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
+	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "fromJunction roles");
+	const user = memberUser(options.user ?? "user_id", options.table, "fromJunction user");
+	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
+	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
+	const shape = {
+		table: options.table,
+		join: `${user.column.join}${role?.join ?? ""}`,
+		through: role?.through,
+		throughs: role?.throughs ?? [],
+		user: user.column.column,
+		userSql: user.sql,
+		userThrough: user.column.through,
+		scope: `${literal(options.scope)}::text`,
+		id: `${col(idColumn)}::text`,
+		within: withinEntries.length === 0 ? "null::jsonb" : `jsonb_build_object(${withinEntries.map(([name, column]) => `${literal(name)}, ${col(column)}::text`).join(", ")})`,
+		roles: role === void 0 ? `jsonb_build_array(${(fixed ?? []).map(literal).join(", ")})` : roleAgg(role),
+		via: options.via === void 0 ? "null::text" : `${literal(options.via)}::text`,
+		expiresAt: options.expiresAt,
+		disabledAt: options.disabledAt,
+		grantedBy: options.grantedBy === void 0 ? "null::text" : `${col(options.grantedBy)}::text`,
+		reason: options.reason === void 0 ? "null::text" : `${col(options.reason)}::text`,
+		memberGroup: options.group === void 0 ? "null::text" : typeof options.group === "string" ? `${literal(options.group)}::text` : `${col(options.group.column)}::text`,
+		managed: managedColumn === void 0 ? "null::text" : managedColumn === "" ? `'idp'::text` : `${col(managedColumn)}::text`,
+		managedColumn,
+		seats: options.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(options.seats)})`,
+		idColumn,
+		holds: (name) => name === options.scope ? "true" : void 0,
+		roleKey: role === void 0 ? "mf.role" : role.sql,
+		roleJoin: role === void 0 ? ` cross join lateral unnest(array[${(fixed ?? []).map(literal).join(", ")}]::text[]) mf(role)` : "",
+		idOf: (name) => {
+			if (name === options.scope) return `${col(idColumn)}::text`;
+			const column = options.within?.[name];
+			return column === void 0 ? void 0 : `${col(column)}::text`;
+		},
+		groupBy: [
+			col(idColumn),
+			...withinEntries.map(([, column]) => col(column)),
+			...[
+				options.expiresAt,
+				options.grantedBy,
+				options.reason,
+				groupColumn,
+				managedColumn === "" ? void 0 : managedColumn,
+				options.seats
+			].filter((name) => name !== void 0).map(col)
+		],
+		suspension: options.suspension,
+		columns: [
+			user.column.column,
+			idColumn,
+			...withinEntries.map(([, column]) => column),
+			...role?.columns ?? [],
+			...[options.expiresAt, options.disabledAt].filter((name) => name !== void 0)
+		],
+		manifest: compact({
+			user: columnManifest(user.column),
+			scope: { value: options.scope },
+			id: { column: idColumn },
+			role: role === void 0 ? { value: [...fixed ?? []] } : roleManifest(role),
+			within: withinEntries.length === 0 ? void 0 : { columns: Object.fromEntries(withinEntries) },
+			via: options.via === void 0 ? void 0 : { value: options.via },
+			expiresAt: options.expiresAt === void 0 ? void 0 : { column: options.expiresAt },
+			disabledAt: options.disabledAt === void 0 ? void 0 : { column: options.disabledAt }
+		})
+	};
+	const sql = sqlOf(shape);
+	return sourceOf({
+		...sql,
+		scope: options.scope,
+		holds: [options.scope, ...withinEntries.map(([name]) => name)],
+		list: (keep = sql.keeps) => selectOf(shape, filters(shape, `$1::text = ${literal(options.scope)} and ${col(idColumn)}::text = $2::text`), true, keep)
+	}, options.query);
+}
+const AUTHZ_VERSION_TABLE = "permdock_authz_version";
+/**
+* The default schema of everything PermDock generates: helpers, seeds, the
+* RBAC scaffold, the hook and the version table. Keep it out of the Data
+* API's exposed schemas, so the `security definer` functions are not RPCs.
+*/
+const PERMDOCK_SCHEMA = "permdock";
+/**
+* Reads the authorization version `permdock supabase hook generate` keeps in
+* `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
+*/
+function authzVersion(options) {
+	const table = qualified(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
+	return async (principal) => {
+		const value = rowsOf(await options.query(`select version from ${table} where user_id = $1`, [principal.id]))[0]?.["version"];
+		const version = typeof value === "number" ? value : value === void 0 ? 0 : Number(value);
+		return Number.isFinite(version) ? version : void 0;
+	};
+}
+//#endregion
+export { fromSupabasePostgres as a, roleManifest as c, fromJunction as i, keptKeys as l, PERMDOCK_SCHEMA as n, fromTable as o, authzVersion as r, roleColumn as s, AUTHZ_VERSION_TABLE as t };