permdock 0.1.0 → 0.2.0

package/dist/manifest-iaoBXHKc.js

@@ -0,0 +1,783 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { t as clientNameOf } from "./clients-DjU5ABMy.js";
+import "./budget-NbEtbJC_.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BsAflUGW.js";
+//#region src/supabase/subject.ts
+const REGISTERED = /* @__PURE__ */ new Set([
+	"sub",
+	"role",
+	"iss",
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"aal",
+	"amr",
+	"acr",
+	"session_id",
+	"email",
+	"phone",
+	"is_anonymous",
+	"app_metadata",
+	"user_metadata",
+	"act",
+	"client_id",
+	"scope"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+function readClaim(claims, name) {
+	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
+	if (top !== void 0 && top !== null) return top;
+	const meta = claims["app_metadata"];
+	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
+}
+function asRoles(value, declared) {
+	const raw = typeof value === "string" ? value === "" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+	if (declared === void 0) return raw;
+	const allowed = new Set(declared);
+	return raw.filter((role) => allowed.has(role));
+}
+/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+function readMemberships(value) {
+	if (!Array.isArray(value)) return {
+		memberships: [],
+		dropped: []
+	};
+	const out = [];
+	const dropped = [];
+	for (const [index, item] of value.entries()) {
+		const membership = asMembership(item);
+		if (membership === void 0) dropped.push(index);
+		else out.push(membership);
+	}
+	return {
+		memberships: out,
+		dropped
+	};
+}
+function asMembership(item) {
+	if (!isRecord(item) || !Array.isArray(item["roles"])) return;
+	const roles = item["roles"].filter((role) => typeof role === "string");
+	if (roles.length === 0) return;
+	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
+	const id = typeof item["id"] === "string" ? item["id"] : void 0;
+	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
+	const team = typeof item["team"] === "string" ? item["team"] : void 0;
+	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
+	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
+		resource: onRecord["resource"],
+		id: onRecord["id"]
+	} : void 0;
+	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
+	const keep = item["keep"];
+	if (keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
+	return compact({
+		roles,
+		scope,
+		id,
+		within,
+		tenant,
+		team,
+		on,
+		via: typeof item["via"] === "string" ? item["via"] : void 0,
+		expiresAt: typeof item["expiresAt"] === "number" ? item["expiresAt"] : void 0,
+		grantedBy: typeof item["grantedBy"] === "string" ? item["grantedBy"] : void 0,
+		reason: typeof item["reason"] === "string" ? item["reason"] : void 0,
+		member: memberOf(item["member"]),
+		managedBy: item["managedBy"] === "idp" ? "idp" : void 0,
+		entitlements: Array.isArray(item["entitlements"]) ? item["entitlements"].filter((seat) => typeof seat === "string") : void 0,
+		keep: keep === void 0 ? void 0 : asStrings(keep)
+	});
+}
+function memberOf(value) {
+	if (value === null || typeof value !== "object" || !Object.hasOwn(value, "group")) return;
+	const group = value.group;
+	return typeof group === "string" && group !== "" ? { group } : void 0;
+}
+function asStrings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+function plansFor(claims, name, tenant) {
+	if (name === void 0 || tenant === void 0) return [];
+	const byTenant = readClaim(claims, name);
+	if (!isRecord(byTenant) || !Object.hasOwn(byTenant, tenant)) return [];
+	return asStrings(byTenant[tenant]);
+}
+const INVALID_CHAIN = Object.freeze({
+	ok: false,
+	reason: "invalid-chain"
+});
+const NO_ACTOR = Object.freeze({ ok: true });
+/** Own entries of one `act` level, with the nested `act` copied the same way. */
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+/**
+* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
+* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
+* as the user. Any other `kind`, or a support level without `session_id`, is invalid.
+*/
+function actingParty(outer, id) {
+	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
+	const kind = marked === void 0 && Object.hasOwn(outer, "session_id") ? "support" : marked;
+	const chain = copyAct(outer);
+	const reason = typeof outer["reason"] === "string" ? outer["reason"] : void 0;
+	switch (kind) {
+		case void 0: return freezeDeep({
+			ok: true,
+			actor: {
+				id,
+				kind: "oauth-client",
+				chain
+			}
+		});
+		case "support": {
+			const session = outer["session_id"];
+			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : true;
+			if (typeof session !== "string" || session === "" || typeof readOnly !== "boolean") return INVALID_CHAIN;
+			return freezeDeep({
+				ok: true,
+				actor: compact({
+					id,
+					kind: "support",
+					sessionId: session,
+					readOnly,
+					reason,
+					chain
+				})
+			});
+		}
+		case "impersonation": return freezeDeep({
+			ok: true,
+			actor: compact({
+				id,
+				kind: "impersonation",
+				reason,
+				chain
+			})
+		});
+		default: return INVALID_CHAIN;
+	}
+}
+function readActor(claims) {
+	if (Object.hasOwn(claims, "act") && claims["act"] !== void 0) {
+		let current = claims["act"];
+		while (current !== void 0) {
+			const level = isRecord(current) ? current["sub"] : void 0;
+			if (!isRecord(current) || typeof level !== "string" || level === "") return INVALID_CHAIN;
+			current = Object.hasOwn(current, "act") ? current["act"] : void 0;
+		}
+		const outer = claims["act"];
+		const sub = isRecord(outer) ? outer["sub"] : void 0;
+		if (!isRecord(outer) || typeof sub !== "string") return INVALID_CHAIN;
+		return actingParty(outer, sub);
+	}
+	const client = Object.hasOwn(claims, "client_id") ? claims["client_id"] : void 0;
+	if (typeof client === "string" && client !== "") return freezeDeep({
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	});
+	return NO_ACTOR;
+}
+/**
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
+* actor; nested levels are prior actors, kept on `chain` for audit), else the
+* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
+* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
+* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
+* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
+* is `{ ok: false }` and must deny.
+*/
+function actorOf(claims) {
+	try {
+		return isRecord(claims) ? readActor(claims) : NO_ACTOR;
+	} catch {
+		return INVALID_CHAIN;
+	}
+}
+const IDENTITY_SCOPES = /* @__PURE__ */ new Set([
+	"openid",
+	"profile",
+	"email",
+	"address",
+	"phone",
+	"offline_access"
+]);
+/**
+* The OAuth `scope` claim (a space-separated string or a list) as `scopes`,
+* without the OpenID Connect identity scopes; `undefined` when none is left.
+*/
+function delegationOf(claims) {
+	try {
+		if (!isRecord(claims) || !Object.hasOwn(claims, "scope")) return;
+		const scope = claims["scope"];
+		const scopes = (typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : asStrings(scope)).filter((name) => !IDENTITY_SCOPES.has(name));
+		return scopes.length > 0 ? freezeDeep({ scopes }) : void 0;
+	} catch {
+		return;
+	}
+}
+function subjectDelegation(claims, chain) {
+	const delegation = compact({
+		scopes: delegationOf(claims)?.scopes,
+		chain
+	});
+	return Object.keys(delegation).length === 0 ? void 0 : delegation;
+}
+function emit(options, reason, cause) {
+	try {
+		options.onAuth?.({
+			reason,
+			cause,
+			source: "supabase"
+		});
+	} catch {}
+}
+function validateClaims(extra, schema) {
+	const result = schema["~standard"].validate(extra);
+	if (result instanceof Promise) {
+		ignoreRejection(result);
+		return;
+	}
+	if ("issues" in result && result.issues !== void 0) return;
+	const value = result.value;
+	return isRecord(value) ? value : void 0;
+}
+function extraClaims(claims) {
+	const extra = {};
+	const meta = claims["app_metadata"];
+	if (isRecord(meta)) for (const [key, value] of Object.entries(meta)) extra[key] = value;
+	for (const [key, value] of Object.entries(claims)) {
+		if (REGISTERED.has(key) || key === "user_metadata") continue;
+		extra[key] = value;
+	}
+	return extra;
+}
+function mapClaims(claims, options) {
+	const role = claims["role"];
+	if (role === "anon" || role === "service_role") return anonymousSubject();
+	const id = claims["sub"];
+	if (typeof id !== "string" || id === "") return anonymousSubject();
+	const act = readActor(claims);
+	if (!act.ok) {
+		emit(options, "invalid-token", act.reason);
+		return anonymousSubject();
+	}
+	if (options.anonymousSignIns === "deny" && claims["is_anonymous"] === true) return anonymousSubject();
+	const actor = act.actor === void 0 ? void 0 : act.actor.kind === "support" ? {
+		id: act.actor.id,
+		kind: act.actor.kind,
+		sessionId: act.actor.sessionId,
+		readOnly: act.actor.readOnly
+	} : compact({
+		id: act.actor.id,
+		kind: act.actor.kind,
+		client: act.actor.kind === "oauth-client" ? clientNameOf(options.clients, act.actor.id) : void 0
+	});
+	const roleClaim = options.roles ?? "user_role";
+	const tenantClaim = options.tenant ?? "tenant_id";
+	const membershipsClaim = options.memberships ?? "memberships";
+	let extra = extraClaims(claims);
+	if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
+	const include = new Set(options.include ?? []);
+	const tenantValue = readClaim(claims, tenantClaim);
+	const version = readClaim(claims, "authz_ver");
+	const tenant = typeof tenantValue === "string" ? tenantValue : void 0;
+	const { memberships, dropped } = readMemberships(readClaim(claims, membershipsClaim));
+	if (dropped.length > 0) emit(options, "schema", "membership-dropped");
+	const plans = plansFor(claims, options.plans, tenant);
+	const principal = compact({
+		id,
+		kind: "user",
+		roles: asRoles(readClaim(claims, roleClaim), options.declared),
+		tenant,
+		plans: plans.length > 0 ? plans : void 0,
+		memberships,
+		membershipsTruncated: readClaim(claims, "memberships_truncated") === true ? true : void 0,
+		authzVersion: typeof version === "number" && Number.isInteger(version) ? version : void 0,
+		issuer: typeof claims["iss"] === "string" ? claims["iss"] : void 0,
+		assurance: typeof claims["aal"] === "string" ? { acr: claims["aal"] } : void 0,
+		claims: Object.keys(extra).length === 0 ? void 0 : extra,
+		email: include.has("email") && typeof claims["email"] === "string" ? claims["email"] : void 0,
+		phone: include.has("phone") && typeof claims["phone"] === "string" ? claims["phone"] : void 0,
+		is_anonymous: include.has("is_anonymous") && typeof claims["is_anonymous"] === "boolean" ? claims["is_anonymous"] : void 0
+	});
+	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
+	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+	return freezeDeep(compact({
+		principal,
+		actor,
+		delegation: act.actor?.kind === "oauth-client" ? subjectDelegation(claims, act.actor.chain) : void 0,
+		context: {},
+		session,
+		expiresAt,
+		liveSession: options.liveSession === true && session !== void 0 ? true : void 0
+	}));
+}
+function subjectFromSupabase(claims, options = {}) {
+	try {
+		if (!isRecord(claims)) return anonymousSubject();
+		const rest = {};
+		for (const [key, value] of Object.entries(claims)) {
+			if (key === "user_metadata") continue;
+			rest[key] = value;
+		}
+		return mapClaims(rest, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+/**
+* A verified session object (`{ kind, claims }`) in, `Subject` out.
+* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+*/
+function subjectFromSupabaseSession(session, options = {}) {
+	try {
+		if (session === null || session === void 0 || session.kind !== "user") return anonymousSubject();
+		return subjectFromSupabase(session.claims, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+//#region src/supabase/manifest-schema.ts
+/** `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks against; a test keeps the two equal. */
+const supabaseManifestSchema = freezeDeep({
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/supabase-manifest-v1.json",
+	title: "PermDock Supabase hook manifest v1",
+	description: "What `permdock supabase inspect --json` prints and `--out` writes: the generated hook, the SQL helpers, the claims, the membership sources and the columns that decide them. Fields are only added within v1.",
+	type: "object",
+	required: [
+		"$schema",
+		"version",
+		"hook",
+		"helpers",
+		"tenantClaim",
+		"budget",
+		"claims",
+		"authzVersion",
+		"memberships",
+		"rls",
+		"decidingColumns",
+		"markers"
+	],
+	properties: {
+		$schema: { const: "https://permdock.com/schemas/supabase-manifest-v1.json" },
+		version: { const: 1 },
+		hook: {
+			type: "object",
+			required: [
+				"schema",
+				"function",
+				"out"
+			],
+			properties: {
+				schema: { $ref: "#/$defs/identifier" },
+				function: { const: "custom_access_token_hook" },
+				out: { type: "string" },
+				before: {
+					type: "array",
+					items: {
+						type: "string",
+						pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
+					}
+				}
+			}
+		},
+		helpers: {
+			type: "object",
+			required: ["schema", "functions"],
+			properties: {
+				schema: { $ref: "#/$defs/identifier" },
+				functions: {
+					type: "array",
+					items: { $ref: "#/$defs/helperName" }
+				}
+			}
+		},
+		tenantClaim: { $ref: "#/$defs/identifier" },
+		budget: {
+			type: "object",
+			required: ["bytes", "measure"],
+			properties: {
+				bytes: {
+					type: "integer",
+					minimum: 1
+				},
+				measure: { type: "string" }
+			}
+		},
+		claims: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"name",
+					"source",
+					"budget"
+				],
+				properties: {
+					name: { $ref: "#/$defs/identifier" },
+					source: {
+						type: "string",
+						pattern: "^(permdock|[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*)$"
+					},
+					budget: { type: "boolean" }
+				}
+			}
+		},
+		authzVersion: { type: "boolean" },
+		authzVersionBump: {
+			type: "object",
+			required: [
+				"schema",
+				"function",
+				"args"
+			],
+			properties: {
+				schema: { $ref: "#/$defs/identifier" },
+				function: { const: "permdock_bump_authz_version_for" },
+				args: { const: "p_users uuid[]" }
+			}
+		},
+		memberships: {
+			type: "array",
+			items: { $ref: "#/$defs/membership" }
+		},
+		rls: {
+			type: "object",
+			required: [
+				"schema",
+				"mode",
+				"tenantClaim",
+				"scopes",
+				"helpers",
+				"memberships"
+			],
+			properties: {
+				schema: { $ref: "#/$defs/identifier" },
+				mode: { enum: ["jwt", "database"] },
+				tenantClaim: { $ref: "#/$defs/identifier" },
+				scopes: {
+					type: "array",
+					items: {
+						type: "object",
+						required: ["name", "type"],
+						properties: {
+							name: {
+								type: "string",
+								pattern: "^[a-z][a-z0-9_]*$"
+							},
+							type: { type: "string" },
+							within: {
+								type: "string",
+								pattern: "^[a-z][a-z0-9_]*$"
+							}
+						}
+					}
+				},
+				helpers: {
+					type: "array",
+					items: {
+						type: "object",
+						required: [
+							"name",
+							"args",
+							"returns",
+							"execute"
+						],
+						properties: {
+							name: { $ref: "#/$defs/helperName" },
+							args: { type: "string" },
+							returns: { type: "string" },
+							execute: {
+								type: "array",
+								items: { enum: [
+									"anon",
+									"authenticated",
+									"supabase_auth_admin"
+								] }
+							}
+						}
+					}
+				},
+				memberships: {
+					type: "array",
+					items: { $ref: "#/$defs/membership" }
+				},
+				customRoles: { type: "boolean" },
+				roles: {
+					type: "object",
+					required: [
+						"table",
+						"user",
+						"role"
+					],
+					additionalProperties: false,
+					properties: {
+						table: { type: "string" },
+						user: { $ref: "#/$defs/column" },
+						role: { oneOf: [{ $ref: "#/$defs/role" }, {
+							type: "array",
+							minItems: 2,
+							items: { $ref: "#/$defs/role" }
+						}] }
+					}
+				},
+				suspension: {
+					type: "object",
+					additionalProperties: false,
+					properties: {
+						users: { $ref: "#/$defs/activeRow" },
+						scopes: {
+							type: "object",
+							additionalProperties: { $ref: "#/$defs/activeRow" }
+						},
+						memberships: {
+							type: "object",
+							required: ["keep"],
+							additionalProperties: false,
+							properties: { keep: {
+								description: "The permission keys a membership whose disabledAt column is set still holds.",
+								type: "array",
+								items: { type: "string" }
+							} }
+						}
+					}
+				},
+				assignments: {
+					type: "object",
+					required: ["tables"],
+					additionalProperties: false,
+					properties: { tables: {
+						type: "array",
+						items: { type: "string" }
+					} }
+				},
+				apiKeys: {
+					type: "object",
+					required: [
+						"claim",
+						"scopes",
+						"tenant",
+						"roles",
+						"serviceRoles"
+					],
+					additionalProperties: false,
+					properties: {
+						claim: { type: "string" },
+						scopes: { type: "string" },
+						tenant: { type: "string" },
+						roles: { type: "string" },
+						serviceRoles: {
+							type: "array",
+							items: { type: "string" }
+						}
+					}
+				}
+			}
+		},
+		decidingColumns: {
+			type: "array",
+			items: {
+				type: "string",
+				pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
+			}
+		},
+		markers: {
+			type: "object",
+			required: ["hook", "grants"],
+			properties: {
+				hook: { const: "v1" },
+				grants: { const: "v1" }
+			}
+		},
+		requires: {
+			description: "The supabase/sdk capability-matrix feature ids the hook, the helpers and subjectFromSupabase depend on, as of the matrix release tag.",
+			type: "object",
+			required: ["matrix", "capabilities"],
+			additionalProperties: false,
+			properties: {
+				matrix: {
+					type: "string",
+					pattern: "^capability-matrix-v1\\.[0-9]+\\.[0-9]+$"
+				},
+				capabilities: {
+					type: "array",
+					uniqueItems: true,
+					items: {
+						type: "string",
+						pattern: "^[a-z][a-z0-9_]*\\.[a-z0-9_]+\\.[a-z0-9_]+$"
+					}
+				}
+			}
+		}
+	},
+	$defs: {
+		membership: {
+			type: "object",
+			required: [
+				"table",
+				"user",
+				"scope",
+				"id",
+				"role",
+				"columns"
+			],
+			properties: {
+				table: {
+					type: "string",
+					pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
+				},
+				user: { $ref: "#/$defs/user" },
+				scope: { $ref: "#/$defs/value" },
+				id: { $ref: "#/$defs/column" },
+				role: { oneOf: [{ $ref: "#/$defs/role" }, {
+					type: "array",
+					minItems: 2,
+					items: { $ref: "#/$defs/role" }
+				}] },
+				within: { oneOf: [{ $ref: "#/$defs/column" }, {
+					type: "object",
+					required: ["columns"],
+					additionalProperties: false,
+					properties: { columns: {
+						type: "object",
+						additionalProperties: { $ref: "#/$defs/identifier" }
+					} }
+				}] },
+				via: { $ref: "#/$defs/value" },
+				expiresAt: { $ref: "#/$defs/column" },
+				disabledAt: { $ref: "#/$defs/column" },
+				columns: {
+					type: "array",
+					items: { $ref: "#/$defs/identifier" }
+				}
+			}
+		},
+		identifier: {
+			type: "string",
+			pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
+		},
+		activeRow: {
+			type: "object",
+			required: ["table", "id"],
+			additionalProperties: false,
+			properties: {
+				table: { type: "string" },
+				id: { $ref: "#/$defs/identifier" },
+				disabledAt: { $ref: "#/$defs/identifier" },
+				status: { $ref: "#/$defs/identifier" },
+				active: {
+					type: "array",
+					items: { type: "string" }
+				},
+				keep: {
+					description: "A scope only: the permission keys members of a suspended instance still hold.",
+					type: "array",
+					items: { type: "string" }
+				}
+			}
+		},
+		helperName: {
+			type: "string",
+			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_user_id)$"
+		},
+		column: {
+			type: "object",
+			required: ["column"],
+			additionalProperties: false,
+			properties: { column: { $ref: "#/$defs/identifier" } }
+		},
+		role: { oneOf: [{ $ref: "#/$defs/value" }, { $ref: "#/$defs/through" }] },
+		user: { oneOf: [{ $ref: "#/$defs/column" }, { $ref: "#/$defs/through" }] },
+		through: {
+			type: "object",
+			required: ["column", "through"],
+			additionalProperties: false,
+			properties: {
+				column: { $ref: "#/$defs/identifier" },
+				through: {
+					type: "object",
+					required: [
+						"table",
+						"id",
+						"column"
+					],
+					additionalProperties: false,
+					properties: {
+						table: {
+							type: "string",
+							pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
+						},
+						id: { $ref: "#/$defs/identifier" },
+						column: { $ref: "#/$defs/identifier" }
+					}
+				}
+			}
+		},
+		value: { oneOf: [{ $ref: "#/$defs/column" }, {
+			type: "object",
+			required: ["value"],
+			additionalProperties: false,
+			properties: { value: { oneOf: [{ type: "string" }, {
+				type: "array",
+				items: { type: "string" }
+			}] } }
+		}] }
+	}
+});
+//#endregion
+//#region src/supabase/manifest.ts
+/**
+* Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
+* validates it against `schemas/supabase-manifest-v1.json`. Returns a
+* deep-frozen copy built from own keys; throws `PermDockValidationError`
+* with every issue, so a manifest of another major is refused.
+*/
+function parseSupabaseManifest(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalidManifest([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	const copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	if (issues.length === 0) checkSchema(supabaseManifestSchema, copy, [], issues);
+	if (issues.length > 0) invalidManifest(issues);
+	return freezeDeep(copy);
+}
+function invalidManifest(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "supabase-manifest",
+		issues,
+		message: `PermDock: invalid Supabase manifest${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+//#endregion
+export { subjectFromSupabase as a, readMemberships as i, actorOf as n, subjectFromSupabaseSession as o, delegationOf as r, parseSupabaseManifest as t };