permdock 0.0.0 → 0.2.0

package/dist/stores-4_sqiOA1.js

@@ -0,0 +1,87 @@
+import { c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, t as approvalHandle } from "./views-Soe7bGSC.js";
+import { n as providePermDock, t as getStore } from "./context-Ttp0ekMT.js";
+import { readable, toStore } from "svelte/store";
+//#region src/svelte/stores.ts
+function fromStore(store, compute) {
+	return readable(compute(), (set) => {
+		const offStore = store.subscribe(() => {
+			set(compute());
+		});
+		const offRunes = toStore(compute).subscribe(set);
+		return () => {
+			offStore();
+			offRunes();
+		};
+	});
+}
+function sveltePermDock(store) {
+	return livePermDock(() => store.get());
+}
+function setPermDock(options) {
+	return sveltePermDock(providePermDock(options));
+}
+function getPermDock() {
+	return sveltePermDock(getStore());
+}
+function permission(reference, data) {
+	return permissionFor(getStore(), reference, data);
+}
+function permissionFor(store, reference, data) {
+	return fromStore(store, () => store.permissionState(reference, data?.()));
+}
+function permissions(references, data) {
+	return permissionsFor(getStore(), references, data);
+}
+function permissionsFor(store, references, data) {
+	return fromStore(store, () => permissionSet(store, references(), data?.()));
+}
+function filtered(reference, rows) {
+	return filteredFor(getStore(), reference, rows);
+}
+function filteredFor(store, reference, rows) {
+	return fromStore(store, () => filterResult(store.get(), reference, rows()));
+}
+function tenant() {
+	return tenantFor(getStore());
+}
+function tenantFor(store) {
+	return fromStore(store, () => tenantView(store.get()));
+}
+function memberships() {
+	return membershipsFor(getStore());
+}
+function membershipsFor(store) {
+	return fromStore(store, () => store.get().memberships());
+}
+function roles(options = () => ({})) {
+	return rolesFor(getStore(), options);
+}
+function rolesFor(store, options = () => ({})) {
+	return fromStore(store, () => rolesView(store.get(), options()));
+}
+function assignable() {
+	return assignableFor(getStore());
+}
+function assignableFor(store) {
+	return fromStore(store, () => store.get().assignableRoles());
+}
+function assignablePermissions(options = {}) {
+	return assignablePermissionsFor(getStore(), options);
+}
+function assignablePermissionsFor(store, options = {}) {
+	return fromStore(store, () => store.get().assignablePermissions(typeof options === "function" ? options() : options));
+}
+function subject() {
+	return subjectFor(getStore());
+}
+function subjectFor(store) {
+	return fromStore(store, () => subjectView(store.get()));
+}
+function approval(decision) {
+	return approvalFor(getStore(), decision);
+}
+function approvalFor(store, decision) {
+	return fromStore(store, () => approvalHandle(store, decision()));
+}
+//#endregion
+export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, assignablePermissions as r, permission as s, approval as t, setPermDock as u };

package/dist/stores-DVR5NHLE.d.ts

@@ -0,0 +1,52 @@
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { r as Role } from "./vocabulary-DA8a8zif.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
+import { Readable } from "svelte/store";
+//#region src/svelte/types.d.ts
+type PermDockSvelteOptions = {
+  /**
+   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
+   * store when it changes; a promise keeps the store `pending` until it
+   * settles (render the same promise with `{#await}`).
+   */
+  readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: string | (() => string | undefined);
+  readonly fetch?: typeof fetch;
+  /** A getter is read on every request, so a rotated token applies without a new store. */
+  readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+};
+//#endregion
+//#region src/svelte/stores.d.ts
+declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
+declare function getPermDock(): ClientPermDock;
+declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
+declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
+declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
+declare function tenant(): Readable<TenantView>;
+declare function memberships(): Readable<readonly Membership[]>;
+declare function roles(options?: () => UseRolesOptions): Readable<{
+  readonly roles: readonly Role[];
+}>;
+declare function assignable(): Readable<readonly Role[]>;
+type AssignableOptions = {
+  readonly tenant?: string;
+} | (() => {
+  readonly tenant?: string;
+});
+declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
+declare function subject(): Readable<SubjectView>;
+declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
+//#endregion
+export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, PermDockSvelteOptions as p, assignablePermissions as r, permission as s, approval as t, setPermDock as u };

package/dist/stream-DDpvynSB.js

@@ -0,0 +1,66 @@
+import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
+//#region src/server/stream.ts
+function isAsyncIterable(value) {
+	return value !== null && typeof value === "object" && typeof value[Symbol.asyncIterator] === "function";
+}
+/**
+* Yields `source` until `connection.signal` aborts, dropping items the
+* subscriber can no longer read. The connection closes when iteration ends.
+*/
+async function* guardIterable(source, connection, options) {
+	const iterator = source[Symbol.asyncIterator]();
+	const aborted = new Promise((_resolve, reject) => {
+		const fail = () => {
+			reject(connection.signal.reason instanceof PermDockRevokedError ? connection.signal.reason : new PermDockRevokedError({ code: "denied" }));
+		};
+		if (connection.signal.aborted) fail();
+		else connection.signal.addEventListener("abort", fail, { once: true });
+	});
+	aborted.catch(() => void 0);
+	try {
+		for (;;) {
+			const next = await Promise.race([iterator.next(), aborted]);
+			if (next.done === true) return next.value;
+			const row = options.unwrap === void 0 ? next.value : options.unwrap(next.value);
+			if (options.items === void 0 || connection.check(options.items, row).outcome === "granted") yield next.value;
+		}
+	} catch (error) {
+		if (error instanceof PermDockRevokedError) throw options.onRevoked(error);
+		throw error;
+	} finally {
+		connection.close();
+		const closing = iterator.return?.();
+		if (closing !== void 0) Promise.resolve(closing).catch(() => void 0);
+	}
+}
+/**
+* The connection loader for a stream `protect` already admitted: the first
+* read returns the row `protect` loaded, and each revalidation reloads it.
+*/
+function reloadAfter(loaded, load) {
+	let first = true;
+	return () => {
+		if (first) {
+			first = false;
+			return loaded;
+		}
+		return load();
+	};
+}
+/** WebSocket close code for a policy violation (RFC 6455 section 7.4.1). */
+const POLICY_VIOLATION = 1008;
+/** The Problem Details for an aborted connection signal. */
+function revokedProblem(signal) {
+	const reason = signal.reason;
+	return (reason instanceof PermDockRevokedError ? reason : new PermDockRevokedError({ code: "denied" })).toProblemDetails();
+}
+/** Runs `end` once when the connection aborts, or now if it already has. */
+function onRevoked(connection, end) {
+	const fire = () => {
+		end(revokedProblem(connection.signal));
+	};
+	if (connection.signal.aborted) fire();
+	else connection.signal.addEventListener("abort", fire, { once: true });
+}
+//#endregion
+export { reloadAfter as a, onRevoked as i, guardIterable as n, isAsyncIterable as r, POLICY_VIOLATION as t };

package/dist/stream-DlvG2hs-.d.ts

@@ -0,0 +1,12 @@
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { i as ProtectOptions } from "./create-BWyx3jua.js";
+//#region src/server/stream.d.ts
+type StreamProtectOptions = ProtectOptions & {
+  /**
+   * For a procedure that returns an async iterable: each outbound item is
+   * checked against this permission and dropped when the subscriber cannot read it.
+   */
+  readonly items?: Permission<string, unknown, "instance">;
+};
+//#endregion
+export { StreamProtectOptions as t };

package/dist/style-CTm1AXDT.js

@@ -0,0 +1,22 @@
+import { styleText } from "node:util";
+//#region src/cli/style.ts
+function createStyle(color) {
+	const paint = (format, text) => color ? styleText(format, text, { validateStream: false }) : text;
+	return {
+		color,
+		paint,
+		errorMark: color ? paint("red", "✖") : "error",
+		warnMark: color ? paint("yellow", "⚠") : "warn"
+	};
+}
+/**
+* Whether a stream takes colour. On a TTY `hasColors()` honours `NO_COLOR`,
+* `FORCE_COLOR` and `TERM`; a pipe colours only under a non-zero `FORCE_COLOR`.
+*/
+function streamHasColors(stream, env = process.env) {
+	if (stream.isTTY === true) return stream.hasColors(env);
+	const force = env["FORCE_COLOR"];
+	return force !== void 0 && force !== "0" && force !== "false";
+}
+//#endregion
+export { streamHasColors as n, createStyle as t };

package/dist/subject-C6dLxqHU.js

@@ -0,0 +1,24 @@
+//#region src/core/subject.ts
+function isPrincipal(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	if ("principal" in value && "context" in value) return false;
+	const record = value;
+	if (typeof record.id !== "string") return false;
+	return Array.isArray(record.roles) || Array.isArray(record.memberships) || record.kind === "user" || record.kind === "service" || record.kind === "workload" || record.kind === "link" || typeof record.issuer === "string";
+}
+function isSubject(value) {
+	return value !== null && typeof value === "object" && "principal" in value && "context" in value && typeof value.context === "object";
+}
+function isActor(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const record = value;
+	return typeof record.id === "string" && typeof record.kind === "string";
+}
+function anonymousSubject(context = {}) {
+	return Object.freeze({
+		principal: null,
+		context: Object.freeze({ ...context })
+	});
+}
+//#endregion
+export { isSubject as i, isActor as n, isPrincipal as r, anonymousSubject as t };

package/dist/subject-settings-BwBmCdTR.js

@@ -0,0 +1,128 @@
+//#region src/conditions/row-check.ts
+const MISSING = Object.freeze({ found: false });
+const GRANTED = Object.freeze({
+	found: true,
+	granted: true
+});
+const DENIED = Object.freeze({
+	found: true,
+	granted: false
+});
+function rowCheckOf(found, granted) {
+	return found ? granted ? GRANTED : DENIED : MISSING;
+}
+/** Reads `select <filter> as granted ... where <key> limit 2`; only a boolean `true` or `1` grants. */
+function rowCheckFrom(rows) {
+	if (rows.length > 1) throw new Error("PermDock: checkRow key matches more than one row");
+	const [row] = rows;
+	return rowCheckOf(row !== void 0, row?.granted === true || row?.granted === 1);
+}
+//#endregion
+//#region src/conditions/subject-settings.ts
+const NAME = /^[a-z_][a-z0-9_]*$/u;
+function settingName(name, what) {
+	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
+	return name;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+* The credential a principal acts through. Entries limited to `ids` are left
+* out of `scopes`: the claim has no per-row form, so the database allows less.
+*/
+function heldCredential(principal) {
+	const credential = Reflect.get(principal, "credential");
+	if (!isRecord(credential) || typeof credential["id"] !== "string" || credential["kind"] !== "user" && credential["kind"] !== "service" || !Array.isArray(credential["permissions"])) return;
+	const scopes = credential["permissions"].flatMap((entry) => isRecord(entry) && typeof entry["permission"] === "string" && entry["ids"] === void 0 ? [entry["permission"]] : []);
+	const tenant = credential["tenant"];
+	return {
+		id: credential["id"],
+		kind: credential["kind"],
+		tenant: typeof tenant === "string" && tenant !== "" ? tenant : void 0,
+		roles: strings(credential["roles"]),
+		scopes
+	};
+}
+function field(name, fallback) {
+	return settingName(name ?? fallback, "API-key claim field");
+}
+function apiKeyClaim(held, options = {}) {
+	const claim = {
+		id: held.id,
+		[field(options.scopes, "scopes")]: held.scopes
+	};
+	if (held.tenant !== void 0) claim[field(options.tenant, "tenant")] = held.tenant;
+	if (held.kind === "service") claim[field(options.roles, "roles")] = held.roles;
+	return [field(options.claim, "api_key"), claim];
+}
+function setConfigs(settings) {
+	if (settings.length === 0) return [];
+	const parts = [];
+	let open = "select ";
+	for (const [name] of settings) {
+		parts.push(`${open}set_config('${name}', `);
+		open = ", true), ";
+	}
+	parts.push(", true)");
+	return [{
+		strings: parts,
+		values: settings.map(([, value]) => value)
+	}];
+}
+/**
+* The transaction preamble that makes Postgres see `permdock.subject`: one `select set_config(…)`
+* that sets the role, then the claims the generated policies read. Runs inside the caller's
+* transaction, so every setting is local to it.
+*/
+function subjectStatements(permdock, options = {}) {
+	const principal = permdock.subject.principal;
+	const role = options.role ?? (principal === null ? "anon" : "authenticated");
+	if (role !== false && role !== "authenticated" && role !== "anon") throw new Error(`PermDock: withSubject sets role authenticated or anon, not '${String(role)}'`);
+	const tenantClaim = settingName(options.tenantClaim ?? "tenant_id", "tenant claim");
+	const claims = Object.fromEntries(Object.entries(options.claims ?? {}).filter(([name]) => name !== "sub" && name !== "role" && name !== tenantClaim));
+	if (principal !== null) {
+		const held = heldCredential(principal);
+		claims["sub"] = held?.kind === "service" ? "" : principal.id;
+		if (principal.tenant !== void 0) claims[tenantClaim] = principal.tenant;
+		if (held !== void 0) {
+			const [name, value] = apiKeyClaim(held, options.apiKeys);
+			claims[name] = value;
+		}
+	}
+	if (role !== false) claims["role"] = role;
+	const subjectId = typeof claims["sub"] === "string" ? claims["sub"] : "";
+	const settings = role === false ? [] : [["role", role]];
+	const dialect = options.dialect ?? "supabase";
+	switch (dialect) {
+		case "supabase":
+		case "neon":
+			settings.push(["request.jwt.claims", JSON.stringify(claims)]);
+			return setConfigs(settings);
+		case "guc": {
+			const prefix = settingName(options.gucPrefix ?? "app", "setting prefix");
+			settings.push([`${prefix}.user_id`, subjectId]);
+			for (const [name, value] of Object.entries(claims)) {
+				if (name === "sub") continue;
+				settings.push([`${prefix}.${settingName(name, "claim name")}`, typeof value === "string" ? value : JSON.stringify(value)]);
+			}
+			return setConfigs(settings);
+		}
+		default: return dialect;
+	}
+}
+/** A statement as text with `$1`, `$2` placeholders, for raw executors. */
+function statementText(statement) {
+	let text = "";
+	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
+	return text;
+}
+/** A statement as a template-strings array, for `sql` tags. */
+function statementTemplate(statement) {
+	return Object.assign([...statement.strings], { raw: [...statement.strings] });
+}
+//#endregion
+export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };

package/dist/supabase/index.d.ts

@@ -0,0 +1,183 @@
+import { C as Policy, Dr as CustomRole, Mr as Membership, Pr as Subject, gt as MembershipSource, mt as MemberEntry, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-yF5LmQVD.js";
+import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-uDS9y5de.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as fromSupabasePostgres, f as fromTable, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as fromJunction } from "../sources-BcJgw0lt.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
+//#region src/supabase/capability.d.ts
+type ExchangeCapabilityOptions = {
+  /**
+   * The key Supabase verifies with: a private JWK imported into the project's
+   * JWT signing keys (`ES256` or `RS256`, with its `kid`), or the legacy JWT
+   * secret (`HS256`).
+   */
+  readonly key: Record<string, unknown> | {
+    readonly secret: string;
+  };
+  /** Default `ES256`, Supabase's asymmetric signing key; the legacy secret needs `HS256` named. */
+  readonly alg?: "ES256" | "RS256" | "HS256";
+  readonly kid?: string;
+  readonly issuer?: string;
+  /** Lifetime in seconds, capped by the capability's own expiry. Default 300. */
+  readonly ttl?: number;
+  readonly now?: number;
+};
+/**
+ * Exchanges a verified link subject (from `subjectFromCapability`) for a
+ * short-lived Supabase access token with role `anon` and the capability in a
+ * `capability` claim, which `permdock rls generate --capabilities` policies
+ * read. `undefined` for any subject that is not a live link.
+ */
+export declare function exchangeCapability(subject: Subject, options: ExchangeCapabilityOptions): Promise<string | undefined>;
+//#endregion
+//#region src/supabase/postgrest.d.ts
+/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+type SupabaseRpcResult = {
+  readonly data: unknown;
+  readonly error: {
+    readonly message: string;
+  } | null;
+};
+/**
+ * The part of a supabase-js client `postgrestSources` calls:
+ * `client.schema(name).rpc(fn, args)`. Pass a client that may execute the
+ * function, such as a `service_role` client after the grant the docs show.
+ */
+type SupabaseRpcClient = {
+  schema(name: string): {
+    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type SupabaseRpcCaller = {
+  schema(name: never): {
+    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type PostgrestSourcesOptions = {
+  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  readonly schema?: string;
+  /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
+  readonly fn?: string;
+  readonly membersFn?: string;
+  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  readonly versionFn?: string;
+  /**
+   * The policy whose declared roles tell custom roles apart. With it,
+   * `customRoles` reads nothing while every role the subject holds is
+   * declared, and `memberships.version` reads the whole subject in one call
+   * when the token claims a custom role, which the custom roles need anyway.
+   */
+  readonly policy?: Policy;
+};
+/** One user as `subject_for(p_user)` returns it. */
+type SubjectRecord = {
+  readonly id: string;
+  /** `false` for a suspended user, who holds no roles or memberships. */
+  readonly active: boolean;
+  readonly roles: readonly string[];
+  readonly memberships: readonly Membership[];
+  readonly customRoles: readonly CustomRole[];
+  readonly authzVersion?: number;
+};
+type PostgrestSources = {
+  /**
+   * Memberships and the authorization version of any principal, and `list`,
+   * the live members of one scope instance through `members_of`, for
+   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
+   * the token was truncated.
+   */
+  readonly memberships: MembershipSource & {
+    list(query: {
+      readonly scope: string;
+      readonly id: string;
+    }): Promise<MemberEntry[]>;
+  };
+  /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
+  customRoles(principal: {
+    readonly id: string;
+  }): RoleSource;
+  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
+  subject(userId: string): Promise<Subject>;
+  /** The raw record, `undefined` for an unknown user. */
+  record(userId: string): Promise<SubjectRecord | undefined>;
+};
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+export declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
+/**
+ * Membership, custom-role and subject sources over the `subject_for(p_user)`,
+ * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+ * `permdock supabase hook generate` writes, for a backend that reaches
+ * Postgres only through PostgREST. `memberships.version` reads only the
+ * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+ * only for a stale token; when the version function is missing it falls back
+ * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * subject read in one `subject_for` call instead, and custom roles are read
+ * only for a subject that holds one. Each user and each instance is read once per
+ * `postgrestSources` call, so create it per request or per job.
+ */
+export declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
+//#endregion
+//#region src/supabase/approval-store.d.ts
+type SupabaseApprovalStoreOptions = {
+  /** Schema of the generated store functions (`rls.schema`). Default `permdock`. */
+  readonly schema?: string;
+  /** How long a request stays open when the caller sets no `ttl`, in milliseconds. */
+  readonly ttl?: number;
+  /**
+   * Runs once per stored request, after the call that stored it, with the
+   * stored request: notify the approvers, or cancel the requests this one
+   * replaces. A repeated ask that finds the request still open does not run
+   * it again. A throw fails the open, so the caller does not run the action.
+   */
+  readonly onOpen?: (request: ApprovalRequest) => void | Promise<void>;
+};
+/**
+ * An `ApprovalStore` over the table and functions `rls.approvals` generates,
+ * called through supabase-js (`client.schema(schema).rpc(...)`) with a
+ * client that may execute them, such as a `service_role` client. Each method
+ * is one atomic statement in the database: a repeated ask keeps the open
+ * request, two racing approvers both count towards a quorum, and two racing
+ * resumes never both consume an approval.
+ */
+export declare function supabaseApprovalStore(client: SupabaseRpcCaller, options?: SupabaseApprovalStoreOptions): ApprovalStore;
+//#endregion
+//#region src/supabase/rls.d.ts
+export declare function supabaseRls(options?: SupabaseRlsOptions): SupabaseRlsConfig;
+/**
+ * `authorize(requested_permission, requested_tenant text default null)` for Supabase's RBAC
+ * scaffold, over the `role_permissions (role, permission, grant_key, scope, effect)` table that
+ * `permdock rls generate` seeds. `database` reads `user_roles` (and the memberships table for a
+ * tenant) on every call; `jwt` reads the hook-injected `user_role` and `memberships` claims. A
+ * tenant request with no memberships source is denied, never answered from global roles. It
+ * answers "does a role hold this permission" without seeing a row: an allow with row conditions
+ * does not count, and a deny the user's tenant or global roles hold overrides every allow.
+ * Generated policies call the per-statement RLS helpers (`permdock_has`, `permitted_<scope>_ids`)
+ * instead. Only `authenticated` may execute it.
+ */
+export declare function authorizeSql(options?: AuthorizeSqlOptions): string;
+//#endregion
+//#region src/supabase/subject.d.ts
+/**
+ * Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
+ * actor; nested levels are prior actors, kept on `chain` for audit), else the
+ * OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
+ * none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
+ * user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
+ * `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
+ * with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
+ * is `{ ok: false }` and must deny.
+ */
+export declare function actorOf(claims: unknown): SupabaseActorResult;
+/**
+ * The OAuth `scope` claim (a space-separated string or a list) as `scopes`,
+ * without the OpenID Connect identity scopes; `undefined` when none is left.
+ */
+export declare function delegationOf(claims: unknown): SupabaseDelegation | undefined;
+export declare function subjectFromSupabase(claims: unknown, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
+/**
+ * A verified session object (`{ kind, claims }`) in, `Subject` out.
+ * Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+ */
+export declare function subjectFromSupabaseSession(session: SupabaseSessionLike | null | undefined, options?: SupabaseSubjectOptions): Subject<SupabasePrincipal>;
+//#endregion
+export { AUTHZ_VERSION_TABLE, type AuthorizeSqlOptions, type ExchangeCapabilityOptions, type MembershipHolders, type MembershipJunctionOptions, type MembershipSql, type MembershipTableOptions, type PostgrestSources, type PostgrestSourcesOptions, type RoleThrough, type SqlMembershipSource, type SqlQuery, type SubjectRecord, type SupabaseActClaim, type SupabaseActiveRow, type SupabaseActor, type SupabaseActorResult, type SupabaseApprovalStoreOptions, type SupabaseClaims, type SupabaseClaimsOptions, type SupabaseClaimsSchema, type SupabaseDelegation, type SupabaseHookClaim, type SupabaseHookManifest, type SupabaseInclude, type SupabaseManifestActiveRow, type SupabaseManifestColumn, type SupabaseManifestHelper, type SupabaseManifestMembership, type SupabaseManifestRequires, type SupabaseManifestRls, type SupabaseManifestRole, type SupabaseManifestThrough, type SupabaseManifestValue, type SupabaseMembershipClaim, type SupabaseMembershipTable, type SupabasePermDockClaims, type SupabasePermissionRef, type SupabasePostgres, type SupabasePrincipal, type SupabaseRealtime, type SupabaseRlsConfig, type SupabaseRlsOptions, type SupabaseRpcCaller, type SupabaseRpcClient, type SupabaseRpcResult, type SupabaseSessionLike, type SupabaseStorage, type SupabaseSubjectOptions, type SupabaseSuspendedMembership, type SupabaseSuspendedScope, type SupabaseSuspension, authzVersion, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, supabaseClaims, supabaseMembershipsBudget, supabaseTenantClaim };

package/dist/supabase/index.js

@@ -0,0 +1,5 @@
+import { a as readSubjectRecord, i as postgrestSources, n as supabaseRls, o as supabaseClaims, r as supabaseApprovalStore, s as exchangeCapability, t as authorizeSql } from "../supabase-DTBaC20O.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
+import { a as fromSupabasePostgres, i as fromJunction, o as fromTable, r as authzVersion, t as AUTHZ_VERSION_TABLE } from "../sources-B0UvrJ21.js";
+import { a as subjectFromSupabase, n as actorOf, o as subjectFromSupabaseSession, r as delegationOf, t as parseSupabaseManifest } from "../manifest-iaoBXHKc.js";
+export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, fromJunction, fromSupabasePostgres, fromTable, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabaseRls, supabaseTenantClaim };