permdock 0.1.0 → 0.3.0

package/dist/types-CKNSyIf_.d.ts

@@ -0,0 +1,52 @@
+import { Cr as Actor, D as PolicyVocabulary, Nr as Principal, Yn as Decision, kr as Delegation, ln as PermDock } from "./policy-IB6yxpC3.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+//#region src/client/types.d.ts
+type ClientStatus = "ready" | "pending" | "stale" | "server-only";
+type PermissionState = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+};
+type PermissionSet = {
+  readonly granted: readonly Permission[];
+  get(permission: Permission): PermissionState | undefined;
+};
+type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
+  status(permission?: Permission, data?: unknown): ClientStatus;
+  invalidate(ref: Permission | {
+    readonly [key: string]: unknown;
+  }): void;
+  refresh(options?: {
+    readonly tenant?: string;
+  }): Promise<void>;
+  clear(): void;
+  subscribe(listener: () => void): () => void;
+};
+type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
+type ApprovalHandle = {
+  readonly state: ApprovalState;
+  readonly token: string | undefined;
+  readonly request: (note?: string) => Promise<void>;
+};
+type SubjectView = {
+  readonly principal: Principal | null;
+  readonly actor: Actor | undefined;
+  readonly delegation: Delegation | undefined;
+  readonly expiresAt: number | undefined;
+  readonly simulated: boolean;
+};
+type TenantView = {
+  readonly tenant: string | null;
+  readonly tenants: readonly string[];
+  readonly switchTo: (id: string) => Promise<void>;
+  readonly status: ClientStatus;
+};
+type FilterResult<T> = readonly T[] & {
+  readonly partial: boolean;
+};
+type UseRolesOptions = {
+  readonly tenant?: string;
+  readonly team?: string;
+};
+//#endregion
+export { FilterResult as a, SubjectView as c, ClientStatus as i, TenantView as l, ApprovalState as n, PermissionSet as o, ClientPermDock as r, PermissionState as s, ApprovalHandle as t, UseRolesOptions as u };

package/dist/types-Cq_H8N_X.d.ts

@@ -0,0 +1,197 @@
+import { Cr as Actor, Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, ct as JwtClaims, et as AuthEvent, gt as MembershipSource } from "./policy-IB6yxpC3.js";
+import { f as ApprovalStore } from "./types-aqOHTHcp.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/ssf/types.d.ts
+type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change";
+type SetSubject = {
+  readonly format: string;
+  readonly [key: string]: unknown;
+};
+type SsfSubject = {
+  readonly id: string;
+  readonly session?: string;
+  readonly issuer?: string;
+};
+type SsfSubjectMapper = (setSubject: SetSubject, meta?: {
+  readonly session?: string;
+  readonly issuer?: string;
+}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
+type SsfEventInput = {
+  readonly subject: SsfSubject;
+  readonly event: Readonly<Record<string, unknown>>;
+  readonly event_timestamp?: number;
+  readonly jti: string;
+  readonly type: string;
+};
+type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
+type SsfOnEvent = { readonly [K in CaepEventName]?: SsfEventHandler; } & {
+  readonly "*"?: SsfEventHandler;
+};
+/**
+ * Keys are opaque strings namespaced by issuer. A store that implements both
+ * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
+ * one with only `seen` and `remember` is checked and recorded non-atomically.
+ */
+type ReplayStore = {
+  seen(key: string): boolean | Promise<boolean>;
+  remember(key: string, expiresAt?: number): void | Promise<void>;
+  /** Records `key` and returns `true` only if it was not already recorded. */
+  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  /** Forgets a claimed `key` so a failed delivery can be retried. */
+  release?(key: string): void | Promise<void>;
+};
+type SsfAuditEvent = {
+  readonly type: string;
+  readonly subject?: SsfSubject;
+  readonly transmitter?: string;
+  readonly jti?: string;
+  readonly replayed?: true;
+  readonly cancelled?: number;
+  readonly unknown?: "event" | "subject";
+  readonly err?: string;
+  readonly cause?: TokenFailureCause;
+};
+type SsfEventListener = (event: SsfAuditEvent) => void;
+type PollOptions = {
+  readonly endpoint: string;
+  readonly every?: number | string;
+  readonly token?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+type PollHandle = {
+  readonly stop: () => void;
+};
+type PollResult = {
+  readonly acked: readonly string[];
+};
+type SsfPermDockOptions = {
+  readonly issuer?: string;
+  readonly audience: string | readonly string[];
+  readonly jwks?: JwtJwks | string;
+  readonly discovery?: DiscoveryInput;
+  readonly verifier?: TokenVerifier;
+  readonly subject: SsfSubjectMapper;
+  readonly onEvent?: SsfOnEvent;
+  readonly replay?: ReplayStore;
+  readonly approvals?: ApprovalStore;
+  /**
+   * Publishes `session-revoked` for a revoked session and `changed` for
+   * credential, assurance and claims changes, so open connections end or
+   * revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly clockTolerance?: number;
+};
+type SsfReceiver = {
+  push(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  poll(options: PollOptions): Promise<PollResult> | PollHandle;
+  on(event: "event", handler: SsfEventListener): () => void;
+};
+type SsfPermDock = {
+  readonly receiver: SsfReceiver;
+};
+//#endregion
+//#region src/jwt/types.d.ts
+type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
+type JwtProfile = "fapi2";
+type JsonWebKeySet = {
+  readonly keys: readonly Record<string, unknown>[];
+};
+type JwtJwks = URL | string | JsonWebKeySet | {
+  readonly secret: Uint8Array | string;
+};
+type DiscoveryInput = string | {
+  readonly issuer: string;
+  readonly metadata?: {
+    readonly issuer?: string;
+    readonly jwks_uri?: string;
+  };
+};
+type JwksCacheOptions = {
+  readonly minTtl?: number;
+  readonly maxTtl?: number;
+  readonly cooldown?: number;
+  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  readonly timeout?: number;
+};
+type JoseTokenVerifierOptions = {
+  readonly jwks?: JwtJwks;
+  readonly discovery?: DiscoveryInput;
+  readonly issuer?: string;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly typ?: string | readonly string[];
+  readonly audience?: string | readonly string[];
+  readonly clockTolerance?: number;
+  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
+  readonly decryptionAlgorithms?: readonly string[];
+  readonly profile?: JwtProfile;
+  readonly jwksCache?: JwksCacheOptions;
+  readonly fetch?: typeof fetch;
+};
+type JoseTokenSignerOptions = {
+  readonly key: Record<string, unknown> | Uint8Array;
+  readonly alg: JwtAlgorithm;
+  readonly kid: string;
+  readonly issuer?: string;
+};
+type JwtClaimPaths = {
+  readonly id?: string;
+  readonly roles?: string;
+  readonly groups?: string;
+  readonly entitlements?: string;
+  readonly plans?: string;
+  readonly tenant?: string;
+  readonly memberships?: string;
+  readonly kind?: string;
+  readonly assurance?: string | {
+    readonly acr?: string;
+    readonly amr?: string;
+    readonly authTime?: string;
+    /** OpenID Connect for Identity Assurance; default `verified_claims`. */
+    readonly verified?: string;
+  };
+  readonly session?: string;
+};
+type JwtDelegationPaths = {
+  readonly scopes?: string;
+  readonly authorizationDetails?: string;
+  readonly access?: string;
+};
+type JwtSubjectOptions = JoseTokenVerifierOptions & {
+  readonly accept?: "access-token" | "id-token";
+  readonly claims?: JwtClaimPaths;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly schema?: StandardSchemaV1;
+  readonly delegation?: JwtDelegationPaths;
+  readonly actor?: {
+    readonly from?: "act";
+    readonly kind?: string;
+    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    readonly clients?: ClientNames;
+  } | ((claims: JwtClaims) => Actor | undefined);
+  readonly sender?: "none" | "dpop" | "mtls";
+  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  readonly replay?: ReplayStore;
+  readonly memberships?: MembershipSource;
+  readonly verifier?: TokenVerifier;
+  readonly certificateThumbprint?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+type JwtPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type DpopProofResult = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: TokenFailureCause;
+};
+type MappedSubject = Subject<JwtPrincipal>;
+//#endregion
+export { SsfPermDock as C, SsfSubjectMapper as D, SsfSubject as E, SsfOnEvent as S, SsfReceiver as T, SetSubject as _, JsonWebKeySet as a, SsfEventInput as b, JwtJwks as c, MappedSubject as d, CaepEventName as f, ReplayStore as g, PollResult as h, JoseTokenVerifierOptions as i, JwtPrincipal as l, PollOptions as m, DpopProofResult as n, JwtAlgorithm as o, PollHandle as p, JoseTokenSignerOptions as r, JwtClaimPaths as s, DiscoveryInput as t, JwtSubjectOptions as u, SsfAuditEvent as v, SsfPermDockOptions as w, SsfEventListener as x, SsfEventHandler as y };

package/dist/{types-D6Z6-rKJ.d.ts → types-DbjRN55U.d.ts}

@@ -1,4 +1,5 @@
-import { a as SqlMembershipSource } from "./sources-DOpW5Ila.js";
+import { n as RoleThrough } from "./types-C97IskBw.js";
+import { o as SqlMembershipSource } from "./sources-BdOYLw9j.js";
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -13,7 +14,11 @@ type RlsTarget = "sql" | "drizzle" | "prisma";
 type RlsMembershipTable = {
   readonly table: string;
   readonly user: string;
-  readonly role: string;
+  /**
+   * The role key column, a reference to a roles table that holds the key, or
+   * several of them: the row holds every non-null key.
+   */
+  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
   /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
   readonly columns?: Readonly<Record<string, string>>;
   /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
@@ -22,8 +27,14 @@ type RlsMembershipTable = {
   readonly team?: string;
   readonly id?: string;
   readonly expiresAt?: string;
-  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
-  readonly via?: string;
+  readonly disabledAt?: string;
+  /**
+   * The membership kind (`Membership.via`) roles with `for` match: a column
+   * holding it, or `{ value }` when every row has the same kind.
+   */
+  readonly via?: string | {
+    readonly value: string;
+  };
 };
 type RlsMemberships = {
   /** The membership table of each named scope. */
@@ -45,11 +56,28 @@ type RlsActiveRow = {
   readonly status?: string;
   readonly active?: readonly string[];
 };
+/** A scope's active-row table, with the permissions its suspended instances keep. */
+type RlsSuspendedScope = RlsActiveRow & {
+  /**
+   * Permissions (references or keys) members of a suspended instance, and of
+   * every instance nested in it, still hold: restoring it, cancelling a
+   * scheduled deletion, exporting before a purge.
+   */
+  readonly keep?: readonly (string | {
+    readonly key: string;
+  })[];
+};
+type RlsSuspendedMembership = {
+  readonly keep?: readonly (string | {
+    readonly key: string;
+  })[];
+};
 type RlsSuspension = {
   /** A suspended user holds no role and no membership. */
   readonly users?: RlsActiveRow;
-  /** Per scope name: a suspended instance voids its memberships and every membership nested under it. */
-  readonly scopes?: Readonly<Record<string, RlsActiveRow>>;
+  /** Per scope name: a suspended instance voids its memberships and every membership nested under it, except for `keep`. */
+  readonly scopes?: Readonly<Record<string, RlsSuspendedScope>>;
+  readonly memberships?: RlsSuspendedMembership;
 };
 type RlsFunctionMapping = {
   readonly twin: unknown;
@@ -74,6 +102,14 @@ type RlsConfig = {
   readonly force?: boolean;
   readonly fixtures?: string;
   readonly tenantClaim?: string;
+  /**
+   * Which tenants the helpers and `memberOf` checks admit. `'active'`
+   * (default): when the token carries a non-empty `tenantClaim`, only that
+   * tenant; without one, every tenant the subject is a member of. `'all'`:
+   * every such tenant whatever the claim says, for apps whose tenant comes
+   * from the URL or the query.
+   */
+  readonly tenants?: "active" | "all";
   /** Postgres type of tenant columns (`uuid` by default); the tenant claim and helper results are cast to it. */
   readonly tenantType?: string;
   /** Postgres type of team columns; defaults to `tenantType`. */
@@ -87,12 +123,12 @@ type RlsConfig = {
   readonly drizzle?: {
     /** Module exporting the tables, as imported from `out`. Default `./schema`. */
     readonly schema?: string;
-    /** Export name per table name; defaults to the camelCased table name. */
+    /** Export name per table name; defaults to the camelCased table name without its schema. */
     readonly exports?: Readonly<Record<string, string>>;
   };
   /** `--target prisma`: the model each table maps to. */
   readonly prisma?: {
-    /** Model name per table name; defaults to the PascalCased table name. */
+    /** Model name per table name; defaults to the PascalCased table name without its schema. */
     readonly models?: Readonly<Record<string, string>>;
   };
   /** Schema of `role_permissions` and the RLS helpers (`permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids`) (and the RBAC scaffold). Default `permdock`; keep it out of `[api] schemas`. */
@@ -107,6 +143,25 @@ type RlsConfig = {
    * always intersected with the `permdock_ceiling` view. Off by default.
    */
   readonly customRoles?: boolean;
+  /** How the generated custom-role write functions check the caller (`database` mode with `customRoles`). */
+  readonly customRoleWrites?: {
+    /**
+     * Who may change custom roles at all, checked before the hand-out check:
+     * permission keys of which the caller must hold one in the tenant (or
+     * through a global role; only through a global role for a platform custom
+     * role), or `'manageRoles'` for any permission with `meta.manageRoles`.
+     * Unset, any member may write a role within what they may hand out.
+     */
+    readonly requires?: "manageRoles" | readonly string[];
+    /**
+     * The application's own roles table, one row per custom role. A trigger
+     * on it moves a role's grants and includes when the row's name, tenant,
+     * scope or instance changes, and deletes them with the row. A signed-in
+     * caller goes through the same checks as the write functions; a trusted
+     * path (a migration, a job, a nested trigger) moves the rows directly.
+     */
+    readonly roles?: RlsCustomRoleTable;
+  };
   /**
    * Let link capabilities reach resource-scoped grants: `anon` policies that call
    * `permdock_capability_ids`, which reads the `capability` claim `exchangeCapability`
@@ -121,6 +176,69 @@ type RlsConfig = {
    * too. Off by default.
    */
   readonly anonymousSignIns?: "deny";
+  /**
+   * Grant `anon` usage on the helper schema and `execute` on the helpers, for
+   * hand-written policies that apply to `public` or `anon` and call them. They
+   * find no subject for `anon` and return nothing. Off by default: a policy
+   * that calls a helper says `to authenticated`.
+   */
+  readonly anonExecute?: boolean;
+  /**
+   * Check role assignments in the database: a trigger on each scope's
+   * `rls.memberships` table, the global-roles table `rls.roles` and each
+   * table in `tables` (such as invitations) refuses a client write that
+   * assigns, changes or removes a role the caller may not assign there, by
+   * the policy's `assigns` graph or, for a custom role, by what the caller may
+   * hand out. Writes that do not run as a client role (the table owner, a
+   * `security definer` function, a backend role) are trusted. Needs a role
+   * that declares `assigns`.
+   */
+  readonly assignments?: true | {
+    readonly tables?: readonly RlsAssignmentTable[];
+    /**
+     * `'refuse'`: a client write to a row whose user is the caller is
+     * refused on every guarded table with a user column, whatever the
+     * role. A map refuses it on the tables it names (`schema.table` as
+     * configured). Unset, a caller may change their own row within what
+     * they may assign.
+     */
+    readonly ownRole?: "refuse" | Readonly<Record<string, "refuse">>;
+  };
+  /**
+   * Add the approval store `supabaseApprovalStore` reads and writes: the
+   * `approval_requests` table and one function per `ApprovalStore` method, in
+   * the helper schema, executable by no client role. Off by default. An
+   * object adopts a table the app already has instead.
+   */
+  readonly approvals?: boolean | RlsApprovalsAdopt;
+  /**
+   * A pg_jsonschema check constraint on generated `jsonb` columns: the
+   * approval store's `body` must match `approval-request-v1.json`. `true`
+   * installs the extension into `extensions`; `'auto'` adds the constraint
+   * only where `pg_available_extensions` lists it. Off by default.
+   */
+  readonly jsonSchema?: "auto" | boolean;
+  /**
+   * `false` leaves out the holder-count and transfer-only triggers `min`,
+   * `max` and `transferOnly` put on the membership tables; a map with
+   * `<scope>: false` leaves them out for those scopes only. Those rules are
+   * then checked by `decideRoleChange` alone. On by default.
+   */
+  readonly ownershipTriggers?: false | Readonly<Record<string, false>>;
+  /**
+   * Make a session acting for a user read-only in the database: one
+   * restrictive policy per table and write command the generated policies
+   * allow, refusing the write when the token's `act` claim names one of these
+   * actor kinds, unless `act.read_only` is `false`. `true` is
+   * `['support', 'impersonation']`; with `support`, an `act` with a
+   * `session_id` and no `kind` counts too. Off by default.
+   */
+  readonly readOnlyActors?: boolean | readonly string[];
+  readonly apiKeys?: true | RlsApiKeys;
+  /** Supabase Realtime: policies on `realtime.messages` for private channels. Supabase dialect only. */
+  readonly realtime?: RlsRealtime;
+  /** Supabase Storage: policies on `storage.objects` for buckets keyed by a scope folder. Supabase dialect only. */
+  readonly storage?: RlsStorage;
   /**
    * `'views'`: one `security_invoker` view `<table>_visible` per table with field-limited
    * read grants, whose restricted columns are `case when <permitted> then col end`. Off by default.
@@ -149,6 +267,14 @@ type RlsConfig = {
   readonly actions?: RlsActions;
   /** Emit only the helpers, their seeds and the scaffold; the table policies stay hand-written. */
   readonly helpersOnly?: boolean;
+  /**
+   * Emit `permitted_<resource>_rows(p_permission)` and its `_for` form for
+   * these resources, or for every resource a grant reaches with `true`: the
+   * row ids the caller may act on, as the generated policies decide them.
+   */
+  readonly rowHelpers?: true | readonly string[];
+  readonly trustedReaders?: readonly string[];
+  readonly treeValues?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
   /** `rls migrate`: how existing helper calls map onto the generated helpers. */
   readonly migrate?: RlsMigrateConfig;
   /**
@@ -158,6 +284,72 @@ type RlsConfig = {
    */
   readonly shims?: boolean | RlsShimsConfig;
 };
+/**
+ * `rls.approvals` on a table the app already has: the store functions keep
+ * each request's body in `body` and its token in `token` (both added when
+ * missing) and read every field from the body; `mirror` copies request
+ * fields into the app's own columns on each write, converted to their types.
+ */
+type RlsApprovalsAdopt = {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  /** A text column unique per request. Default `token`. */
+  readonly token?: string;
+  /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
+  readonly body?: string;
+  readonly open?: "insert" | "attach";
+  readonly schema?: string;
+  /** Request fields copied into the app's columns, field to column. */
+  readonly mirror?: {
+    readonly status?: string;
+    readonly permission?: string;
+    readonly tenant?: string;
+    readonly principalId?: string;
+    readonly actorId?: string;
+    readonly session?: string;
+    readonly approvals?: string;
+    readonly createdAt?: string;
+    readonly expiresAt?: string;
+    readonly resolvedAt?: string;
+    readonly resolvedBy?: string;
+    readonly consumedAt?: string;
+  };
+};
+type RlsApiKeys = {
+  readonly claim?: string;
+  readonly scopes?: string;
+  readonly tenant?: string;
+  readonly roles?: string;
+  readonly serviceRoles?: readonly string[];
+};
+/** One more table whose rows assign a role, such as invitations (`rls.assignments.tables`). */
+type RlsAssignmentTable = {
+  readonly table: string;
+  /** The declared scope the row assigns the role at. */
+  readonly scope: string;
+  /** The column holding the scope instance id. */
+  readonly id: string;
+  /** The tenant column for a scope below the first; defaults to `id` at the first scope. */
+  readonly tenant?: string;
+  /** The role key column, a reference to a roles table that holds the key, or several of them. */
+  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
+  /** The column holding the user the row assigns to, which `ownRole` compares with the caller. */
+  readonly user?: string;
+};
+/** `rls.customRoleWrites.roles`: the application's table of custom roles. */
+type RlsCustomRoleTable = {
+  readonly table: string;
+  /** The column holding the role name. */
+  readonly key: string;
+  /** The tenant column; a row with no tenant is a platform custom role (`scope: 'global'`). Without it every row is a platform role. */
+  readonly tenant?: string;
+  /** A text column holding the scope name; without it a row with a tenant lives at the first scope. */
+  readonly scope?: string;
+  /** A column pinning the role to one instance of its scope. */
+  readonly id?: string;
+  /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
+  readonly skip?: string;
+};
 /** `rls.shims`: where the legacy-named wrappers go. */
 type RlsShimsConfig = {
   /** Schema of the legacy helpers. Default `public`. */
@@ -190,24 +382,44 @@ type RlsMigrateConfig = {
   /** For `scoped` helpers, a scope literal's PermDock scope when the names differ. */
   readonly scopes?: Readonly<Record<string, string>>;
 };
-/**
- * The role column of a global-roles table that holds a foreign key: the role
- * key is `column` of `through`, joined on `on` (`{ role_id: 'id' }`).
- */
-type RoleThrough = {
-  /** The roles table; unqualified, it is in the global-roles table's schema. */
-  readonly through: string;
-  /** One entry: the global-roles column to the roles table column it references. */
-  readonly on: Readonly<Record<string, string>>;
-  /** The roles table column that holds the role key. */
-  readonly column: string;
-};
 /** Where global roles live: `table (user, role)`. Defaults `user_id` and `role`. */
 type GlobalRoles = {
   readonly table: string;
   readonly user?: string;
   readonly role?: string | RoleThrough;
 };
+/** A permission reference from the app's definitions; only its `key` is read. */
+type RlsPermissionRef = {
+  readonly key: string;
+};
+/**
+ * One private Realtime topic pattern, such as `org:{organization}:chat`:
+ * `:`-separated segments, one of them `{<scope>}`, which holds the id of a
+ * scope instance.
+ */
+type RlsRealtimeTopic = {
+  /** Receive broadcast and presence messages: `select` on `realtime.messages`. */
+  readonly read: RlsPermissionRef;
+  /** Send broadcast messages and track presence: `insert`. Absent: nobody may. */
+  readonly write?: RlsPermissionRef;
+};
+type RlsRealtime = {
+  readonly topics: Readonly<Record<string, RlsRealtimeTopic>>;
+};
+/** One Storage bucket whose object paths start with a scope instance id. */
+type RlsStorageBucket = {
+  readonly scope: string;
+  /** The 1-based `storage.foldername(name)` entry that holds the id. Default 1. */
+  readonly folder?: number;
+  /** Download and list: `select` on `storage.objects`. */
+  readonly read?: RlsPermissionRef;
+  /** Upload and overwrite: `insert` and `update`. */
+  readonly write?: RlsPermissionRef;
+  readonly delete?: RlsPermissionRef;
+};
+type RlsStorage = {
+  readonly buckets: Readonly<Record<string, RlsStorageBucket>>;
+};
 /** `permdock supabase hook generate` input. */
 type SupabaseHookConfig = {
   /** The same `fromTable` / `fromJunction` sources the app passes as `memberships`. */
@@ -239,16 +451,36 @@ type SupabaseHookConfig = {
   };
   /**
    * Claims other packages own, each `claim: '<schema>.<function>'`, for
-   * example `{ features: 'better_supabase.feature_claims' }`. The function
+   * example `{ features: 'public.feature_claims' }`. The function
    * takes the user id (`uuid`) and returns `jsonb`; `null` omits the claim.
    * Reserved names are refused, the claims sit outside `budget`, and a
    * suspended user gets none.
    */
   readonly claims?: Readonly<Record<string, string>>;
+  readonly before?: string | readonly string[];
+  /**
+   * Check the claims the hook wrote against `supabase-claims-v1.json` with
+   * pg_jsonschema, and drop them all on a mismatch so the user signs in with
+   * no PermDock access instead of an error. Needs the extension. Default `false`.
+   */
+  readonly validate?: boolean;
   /** Bytes of JSON the `memberships` claim may use. Default `supabaseMembershipsBudget` (1024). */
   readonly budget?: number;
   /** Keep `permdock_authz_version` and write the `authz_ver` claim. Default `true`. */
   readonly version?: boolean;
+  /**
+   * Write PostgREST wrappers for `subject_for`, `members_of` and
+   * `authz_version_for` into `schema` (default `public`), named
+   * `<prefix>subject_for` and so on (default prefix `permdock_`), for a
+   * backend that reaches Postgres through the Data API while the hook schema
+   * is not exposed. Each wrapper is `security definer`, revoked from
+   * `public`, `anon` and `authenticated`, and granted to `service_role`: the
+   * one place the hook grants to it. Pass the same setting to `postgrestSources`.
+   */
+  readonly api?: {
+    readonly schema?: string;
+    readonly prefix?: string;
+  };
   /** The `jwt_expiry` the printed `config.toml` block sets. Default 900. */
   readonly jwtExpiry?: number;
   /** Suspended users get empty claims. Default `rls.suspension`. */
@@ -259,6 +491,13 @@ type SupabaseConfig = {
   readonly hook?: SupabaseHookConfig;
 };
 type DoctorConfig = {
+  /**
+   * Directories or globs the source checks read (PD001, PD002, PD007 to
+   * PD015, PD044 and the other checks over files), default `collect.srcPath`.
+   * The catalog `collect` writes still comes from `collect.srcPath`, and PD004
+   * compares the catalog on disk with that one.
+   */
+  readonly srcPath?: readonly string[];
   readonly sensitiveActions?: readonly string[];
   readonly memberships?: string;
   /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettings` input) for PD029. */
@@ -280,8 +519,20 @@ type PermDockConfig = {
   };
   readonly rls?: RlsConfig;
   readonly supabase?: SupabaseConfig;
+  readonly powersync?: PowerSyncConfig;
   readonly doctor?: DoctorConfig;
 };
+/** `permdock powersync generate` and `verify` input. Tables and memberships come from `rls`. */
+type PowerSyncConfig = {
+  /** The Sync Streams file; default `sync-config.yaml`. */
+  readonly out?: string;
+  /** Resources that get a stream; default every resource with a grant of `action`. */
+  readonly resources?: readonly string[];
+  /** The action whose grants decide which rows sync; default `read`. */
+  readonly action?: string;
+  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powersyncSource`; none by default. */
+  readonly manifest?: string;
+};
 type CliIo = {
   readonly stdout: (text: string) => void;
   readonly stderr: (text: string) => void;
@@ -309,4 +560,4 @@ type PermDockPluginOptions = {
   readonly check?: boolean;
 };
 //#endregion
-export { PermDockPluginOptions as a, RlsDialect as c, RlsMemberships as d, RlsSuspension as f, PermDockConfig as i, RlsFunctionMapping as l, RunResult as m, CliIo as n, RlsActiveRow as o, RlsTarget as p, CollectConfig as r, RlsConfig as s, CatalogConfig as t, RlsMembershipTable as u };
+export { RunResult as _, PermDockPluginOptions as a, RlsConfig as c, RlsMembershipTable as d, RlsMemberships as f, RlsTarget as g, RlsSuspension as h, PermDockConfig as i, RlsDialect as l, RlsSuspendedScope as m, CliIo as n, RlsActiveRow as o, RlsSuspendedMembership as p, CollectConfig as r, RlsApiKeys as s, CatalogConfig as t, RlsFunctionMapping as u };