permdock 0.3.1 → 0.5.0

package/dist/manifest-iaoBXHKc.js

@@ -1,783 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
-import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
-import { t as clientNameOf } from "./clients-DjU5ABMy.js";
-import "./budget-NbEtbJC_.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-BsAflUGW.js";
-//#region src/supabase/subject.ts
-const REGISTERED = /* @__PURE__ */ new Set([
-	"sub",
-	"role",
-	"iss",
-	"aud",
-	"exp",
-	"iat",
-	"nbf",
-	"aal",
-	"amr",
-	"acr",
-	"session_id",
-	"email",
-	"phone",
-	"is_anonymous",
-	"app_metadata",
-	"user_metadata",
-	"act",
-	"client_id",
-	"scope"
-]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
-function readClaim(claims, name) {
-	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
-	if (top !== void 0 && top !== null) return top;
-	const meta = claims["app_metadata"];
-	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
-}
-function asRoles(value, declared) {
-	const raw = typeof value === "string" ? value === "" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-	if (declared === void 0) return raw;
-	const allowed = new Set(declared);
-	return raw.filter((role) => allowed.has(role));
-}
-/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
-function readMemberships(value) {
-	if (!Array.isArray(value)) return {
-		memberships: [],
-		dropped: []
-	};
-	const out = [];
-	const dropped = [];
-	for (const [index, item] of value.entries()) {
-		const membership = asMembership(item);
-		if (membership === void 0) dropped.push(index);
-		else out.push(membership);
-	}
-	return {
-		memberships: out,
-		dropped
-	};
-}
-function asMembership(item) {
-	if (!isRecord(item) || !Array.isArray(item["roles"])) return;
-	const roles = item["roles"].filter((role) => typeof role === "string");
-	if (roles.length === 0) return;
-	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
-	const id = typeof item["id"] === "string" ? item["id"] : void 0;
-	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
-	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
-	const team = typeof item["team"] === "string" ? item["team"] : void 0;
-	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
-	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
-		resource: onRecord["resource"],
-		id: onRecord["id"]
-	} : void 0;
-	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
-	const keep = item["keep"];
-	if (keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
-	return compact({
-		roles,
-		scope,
-		id,
-		within,
-		tenant,
-		team,
-		on,
-		via: typeof item["via"] === "string" ? item["via"] : void 0,
-		expiresAt: typeof item["expiresAt"] === "number" ? item["expiresAt"] : void 0,
-		grantedBy: typeof item["grantedBy"] === "string" ? item["grantedBy"] : void 0,
-		reason: typeof item["reason"] === "string" ? item["reason"] : void 0,
-		member: memberOf(item["member"]),
-		managedBy: item["managedBy"] === "idp" ? "idp" : void 0,
-		entitlements: Array.isArray(item["entitlements"]) ? item["entitlements"].filter((seat) => typeof seat === "string") : void 0,
-		keep: keep === void 0 ? void 0 : asStrings(keep)
-	});
-}
-function memberOf(value) {
-	if (value === null || typeof value !== "object" || !Object.hasOwn(value, "group")) return;
-	const group = value.group;
-	return typeof group === "string" && group !== "" ? { group } : void 0;
-}
-function asStrings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
-function plansFor(claims, name, tenant) {
-	if (name === void 0 || tenant === void 0) return [];
-	const byTenant = readClaim(claims, name);
-	if (!isRecord(byTenant) || !Object.hasOwn(byTenant, tenant)) return [];
-	return asStrings(byTenant[tenant]);
-}
-const INVALID_CHAIN = Object.freeze({
-	ok: false,
-	reason: "invalid-chain"
-});
-const NO_ACTOR = Object.freeze({ ok: true });
-/** Own entries of one `act` level, with the nested `act` copied the same way. */
-function copyAct(level) {
-	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
-	return Object.fromEntries(entries);
-}
-/**
-* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
-* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
-* as the user. Any other `kind`, or a support level without `session_id`, is invalid.
-*/
-function actingParty(outer, id) {
-	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
-	const kind = marked === void 0 && Object.hasOwn(outer, "session_id") ? "support" : marked;
-	const chain = copyAct(outer);
-	const reason = typeof outer["reason"] === "string" ? outer["reason"] : void 0;
-	switch (kind) {
-		case void 0: return freezeDeep({
-			ok: true,
-			actor: {
-				id,
-				kind: "oauth-client",
-				chain
-			}
-		});
-		case "support": {
-			const session = outer["session_id"];
-			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : true;
-			if (typeof session !== "string" || session === "" || typeof readOnly !== "boolean") return INVALID_CHAIN;
-			return freezeDeep({
-				ok: true,
-				actor: compact({
-					id,
-					kind: "support",
-					sessionId: session,
-					readOnly,
-					reason,
-					chain
-				})
-			});
-		}
-		case "impersonation": return freezeDeep({
-			ok: true,
-			actor: compact({
-				id,
-				kind: "impersonation",
-				reason,
-				chain
-			})
-		});
-		default: return INVALID_CHAIN;
-	}
-}
-function readActor(claims) {
-	if (Object.hasOwn(claims, "act") && claims["act"] !== void 0) {
-		let current = claims["act"];
-		while (current !== void 0) {
-			const level = isRecord(current) ? current["sub"] : void 0;
-			if (!isRecord(current) || typeof level !== "string" || level === "") return INVALID_CHAIN;
-			current = Object.hasOwn(current, "act") ? current["act"] : void 0;
-		}
-		const outer = claims["act"];
-		const sub = isRecord(outer) ? outer["sub"] : void 0;
-		if (!isRecord(outer) || typeof sub !== "string") return INVALID_CHAIN;
-		return actingParty(outer, sub);
-	}
-	const client = Object.hasOwn(claims, "client_id") ? claims["client_id"] : void 0;
-	if (typeof client === "string" && client !== "") return freezeDeep({
-		ok: true,
-		actor: {
-			id: client,
-			kind: "oauth-client"
-		}
-	});
-	return NO_ACTOR;
-}
-/**
-* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
-* actor; nested levels are prior actors, kept on `chain` for audit), else the
-* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
-* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
-* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
-* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
-* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
-* is `{ ok: false }` and must deny.
-*/
-function actorOf(claims) {
-	try {
-		return isRecord(claims) ? readActor(claims) : NO_ACTOR;
-	} catch {
-		return INVALID_CHAIN;
-	}
-}
-const IDENTITY_SCOPES = /* @__PURE__ */ new Set([
-	"openid",
-	"profile",
-	"email",
-	"address",
-	"phone",
-	"offline_access"
-]);
-/**
-* The OAuth `scope` claim (a space-separated string or a list) as `scopes`,
-* without the OpenID Connect identity scopes; `undefined` when none is left.
-*/
-function delegationOf(claims) {
-	try {
-		if (!isRecord(claims) || !Object.hasOwn(claims, "scope")) return;
-		const scope = claims["scope"];
-		const scopes = (typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : asStrings(scope)).filter((name) => !IDENTITY_SCOPES.has(name));
-		return scopes.length > 0 ? freezeDeep({ scopes }) : void 0;
-	} catch {
-		return;
-	}
-}
-function subjectDelegation(claims, chain) {
-	const delegation = compact({
-		scopes: delegationOf(claims)?.scopes,
-		chain
-	});
-	return Object.keys(delegation).length === 0 ? void 0 : delegation;
-}
-function emit(options, reason, cause) {
-	try {
-		options.onAuth?.({
-			reason,
-			cause,
-			source: "supabase"
-		});
-	} catch {}
-}
-function validateClaims(extra, schema) {
-	const result = schema["~standard"].validate(extra);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return;
-	}
-	if ("issues" in result && result.issues !== void 0) return;
-	const value = result.value;
-	return isRecord(value) ? value : void 0;
-}
-function extraClaims(claims) {
-	const extra = {};
-	const meta = claims["app_metadata"];
-	if (isRecord(meta)) for (const [key, value] of Object.entries(meta)) extra[key] = value;
-	for (const [key, value] of Object.entries(claims)) {
-		if (REGISTERED.has(key) || key === "user_metadata") continue;
-		extra[key] = value;
-	}
-	return extra;
-}
-function mapClaims(claims, options) {
-	const role = claims["role"];
-	if (role === "anon" || role === "service_role") return anonymousSubject();
-	const id = claims["sub"];
-	if (typeof id !== "string" || id === "") return anonymousSubject();
-	const act = readActor(claims);
-	if (!act.ok) {
-		emit(options, "invalid-token", act.reason);
-		return anonymousSubject();
-	}
-	if (options.anonymousSignIns === "deny" && claims["is_anonymous"] === true) return anonymousSubject();
-	const actor = act.actor === void 0 ? void 0 : act.actor.kind === "support" ? {
-		id: act.actor.id,
-		kind: act.actor.kind,
-		sessionId: act.actor.sessionId,
-		readOnly: act.actor.readOnly
-	} : compact({
-		id: act.actor.id,
-		kind: act.actor.kind,
-		client: act.actor.kind === "oauth-client" ? clientNameOf(options.clients, act.actor.id) : void 0
-	});
-	const roleClaim = options.roles ?? "user_role";
-	const tenantClaim = options.tenant ?? "tenant_id";
-	const membershipsClaim = options.memberships ?? "memberships";
-	let extra = extraClaims(claims);
-	if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
-	const include = new Set(options.include ?? []);
-	const tenantValue = readClaim(claims, tenantClaim);
-	const version = readClaim(claims, "authz_ver");
-	const tenant = typeof tenantValue === "string" ? tenantValue : void 0;
-	const { memberships, dropped } = readMemberships(readClaim(claims, membershipsClaim));
-	if (dropped.length > 0) emit(options, "schema", "membership-dropped");
-	const plans = plansFor(claims, options.plans, tenant);
-	const principal = compact({
-		id,
-		kind: "user",
-		roles: asRoles(readClaim(claims, roleClaim), options.declared),
-		tenant,
-		plans: plans.length > 0 ? plans : void 0,
-		memberships,
-		membershipsTruncated: readClaim(claims, "memberships_truncated") === true ? true : void 0,
-		authzVersion: typeof version === "number" && Number.isInteger(version) ? version : void 0,
-		issuer: typeof claims["iss"] === "string" ? claims["iss"] : void 0,
-		assurance: typeof claims["aal"] === "string" ? { acr: claims["aal"] } : void 0,
-		claims: Object.keys(extra).length === 0 ? void 0 : extra,
-		email: include.has("email") && typeof claims["email"] === "string" ? claims["email"] : void 0,
-		phone: include.has("phone") && typeof claims["phone"] === "string" ? claims["phone"] : void 0,
-		is_anonymous: include.has("is_anonymous") && typeof claims["is_anonymous"] === "boolean" ? claims["is_anonymous"] : void 0
-	});
-	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
-	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
-	return freezeDeep(compact({
-		principal,
-		actor,
-		delegation: act.actor?.kind === "oauth-client" ? subjectDelegation(claims, act.actor.chain) : void 0,
-		context: {},
-		session,
-		expiresAt,
-		liveSession: options.liveSession === true && session !== void 0 ? true : void 0
-	}));
-}
-function subjectFromSupabase(claims, options = {}) {
-	try {
-		if (!isRecord(claims)) return anonymousSubject();
-		const rest = {};
-		for (const [key, value] of Object.entries(claims)) {
-			if (key === "user_metadata") continue;
-			rest[key] = value;
-		}
-		return mapClaims(rest, options);
-	} catch {
-		return anonymousSubject();
-	}
-}
-/**
-* A verified session object (`{ kind, claims }`) in, `Subject` out.
-* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
-*/
-function subjectFromSupabaseSession(session, options = {}) {
-	try {
-		if (session === null || session === void 0 || session.kind !== "user") return anonymousSubject();
-		return subjectFromSupabase(session.claims, options);
-	} catch {
-		return anonymousSubject();
-	}
-}
-//#endregion
-//#region src/supabase/manifest-schema.ts
-/** `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks against; a test keeps the two equal. */
-const supabaseManifestSchema = freezeDeep({
-	$schema: "https://json-schema.org/draft/2020-12/schema",
-	$id: "https://permdock.com/schemas/supabase-manifest-v1.json",
-	title: "PermDock Supabase hook manifest v1",
-	description: "What `permdock supabase inspect --json` prints and `--out` writes: the generated hook, the SQL helpers, the claims, the membership sources and the columns that decide them. Fields are only added within v1.",
-	type: "object",
-	required: [
-		"$schema",
-		"version",
-		"hook",
-		"helpers",
-		"tenantClaim",
-		"budget",
-		"claims",
-		"authzVersion",
-		"memberships",
-		"rls",
-		"decidingColumns",
-		"markers"
-	],
-	properties: {
-		$schema: { const: "https://permdock.com/schemas/supabase-manifest-v1.json" },
-		version: { const: 1 },
-		hook: {
-			type: "object",
-			required: [
-				"schema",
-				"function",
-				"out"
-			],
-			properties: {
-				schema: { $ref: "#/$defs/identifier" },
-				function: { const: "custom_access_token_hook" },
-				out: { type: "string" },
-				before: {
-					type: "array",
-					items: {
-						type: "string",
-						pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
-					}
-				}
-			}
-		},
-		helpers: {
-			type: "object",
-			required: ["schema", "functions"],
-			properties: {
-				schema: { $ref: "#/$defs/identifier" },
-				functions: {
-					type: "array",
-					items: { $ref: "#/$defs/helperName" }
-				}
-			}
-		},
-		tenantClaim: { $ref: "#/$defs/identifier" },
-		budget: {
-			type: "object",
-			required: ["bytes", "measure"],
-			properties: {
-				bytes: {
-					type: "integer",
-					minimum: 1
-				},
-				measure: { type: "string" }
-			}
-		},
-		claims: {
-			type: "array",
-			items: {
-				type: "object",
-				required: [
-					"name",
-					"source",
-					"budget"
-				],
-				properties: {
-					name: { $ref: "#/$defs/identifier" },
-					source: {
-						type: "string",
-						pattern: "^(permdock|[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*)$"
-					},
-					budget: { type: "boolean" }
-				}
-			}
-		},
-		authzVersion: { type: "boolean" },
-		authzVersionBump: {
-			type: "object",
-			required: [
-				"schema",
-				"function",
-				"args"
-			],
-			properties: {
-				schema: { $ref: "#/$defs/identifier" },
-				function: { const: "permdock_bump_authz_version_for" },
-				args: { const: "p_users uuid[]" }
-			}
-		},
-		memberships: {
-			type: "array",
-			items: { $ref: "#/$defs/membership" }
-		},
-		rls: {
-			type: "object",
-			required: [
-				"schema",
-				"mode",
-				"tenantClaim",
-				"scopes",
-				"helpers",
-				"memberships"
-			],
-			properties: {
-				schema: { $ref: "#/$defs/identifier" },
-				mode: { enum: ["jwt", "database"] },
-				tenantClaim: { $ref: "#/$defs/identifier" },
-				scopes: {
-					type: "array",
-					items: {
-						type: "object",
-						required: ["name", "type"],
-						properties: {
-							name: {
-								type: "string",
-								pattern: "^[a-z][a-z0-9_]*$"
-							},
-							type: { type: "string" },
-							within: {
-								type: "string",
-								pattern: "^[a-z][a-z0-9_]*$"
-							}
-						}
-					}
-				},
-				helpers: {
-					type: "array",
-					items: {
-						type: "object",
-						required: [
-							"name",
-							"args",
-							"returns",
-							"execute"
-						],
-						properties: {
-							name: { $ref: "#/$defs/helperName" },
-							args: { type: "string" },
-							returns: { type: "string" },
-							execute: {
-								type: "array",
-								items: { enum: [
-									"anon",
-									"authenticated",
-									"supabase_auth_admin"
-								] }
-							}
-						}
-					}
-				},
-				memberships: {
-					type: "array",
-					items: { $ref: "#/$defs/membership" }
-				},
-				customRoles: { type: "boolean" },
-				roles: {
-					type: "object",
-					required: [
-						"table",
-						"user",
-						"role"
-					],
-					additionalProperties: false,
-					properties: {
-						table: { type: "string" },
-						user: { $ref: "#/$defs/column" },
-						role: { oneOf: [{ $ref: "#/$defs/role" }, {
-							type: "array",
-							minItems: 2,
-							items: { $ref: "#/$defs/role" }
-						}] }
-					}
-				},
-				suspension: {
-					type: "object",
-					additionalProperties: false,
-					properties: {
-						users: { $ref: "#/$defs/activeRow" },
-						scopes: {
-							type: "object",
-							additionalProperties: { $ref: "#/$defs/activeRow" }
-						},
-						memberships: {
-							type: "object",
-							required: ["keep"],
-							additionalProperties: false,
-							properties: { keep: {
-								description: "The permission keys a membership whose disabledAt column is set still holds.",
-								type: "array",
-								items: { type: "string" }
-							} }
-						}
-					}
-				},
-				assignments: {
-					type: "object",
-					required: ["tables"],
-					additionalProperties: false,
-					properties: { tables: {
-						type: "array",
-						items: { type: "string" }
-					} }
-				},
-				apiKeys: {
-					type: "object",
-					required: [
-						"claim",
-						"scopes",
-						"tenant",
-						"roles",
-						"serviceRoles"
-					],
-					additionalProperties: false,
-					properties: {
-						claim: { type: "string" },
-						scopes: { type: "string" },
-						tenant: { type: "string" },
-						roles: { type: "string" },
-						serviceRoles: {
-							type: "array",
-							items: { type: "string" }
-						}
-					}
-				}
-			}
-		},
-		decidingColumns: {
-			type: "array",
-			items: {
-				type: "string",
-				pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
-			}
-		},
-		markers: {
-			type: "object",
-			required: ["hook", "grants"],
-			properties: {
-				hook: { const: "v1" },
-				grants: { const: "v1" }
-			}
-		},
-		requires: {
-			description: "The supabase/sdk capability-matrix feature ids the hook, the helpers and subjectFromSupabase depend on, as of the matrix release tag.",
-			type: "object",
-			required: ["matrix", "capabilities"],
-			additionalProperties: false,
-			properties: {
-				matrix: {
-					type: "string",
-					pattern: "^capability-matrix-v1\\.[0-9]+\\.[0-9]+$"
-				},
-				capabilities: {
-					type: "array",
-					uniqueItems: true,
-					items: {
-						type: "string",
-						pattern: "^[a-z][a-z0-9_]*\\.[a-z0-9_]+\\.[a-z0-9_]+$"
-					}
-				}
-			}
-		}
-	},
-	$defs: {
-		membership: {
-			type: "object",
-			required: [
-				"table",
-				"user",
-				"scope",
-				"id",
-				"role",
-				"columns"
-			],
-			properties: {
-				table: {
-					type: "string",
-					pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
-				},
-				user: { $ref: "#/$defs/user" },
-				scope: { $ref: "#/$defs/value" },
-				id: { $ref: "#/$defs/column" },
-				role: { oneOf: [{ $ref: "#/$defs/role" }, {
-					type: "array",
-					minItems: 2,
-					items: { $ref: "#/$defs/role" }
-				}] },
-				within: { oneOf: [{ $ref: "#/$defs/column" }, {
-					type: "object",
-					required: ["columns"],
-					additionalProperties: false,
-					properties: { columns: {
-						type: "object",
-						additionalProperties: { $ref: "#/$defs/identifier" }
-					} }
-				}] },
-				via: { $ref: "#/$defs/value" },
-				expiresAt: { $ref: "#/$defs/column" },
-				disabledAt: { $ref: "#/$defs/column" },
-				columns: {
-					type: "array",
-					items: { $ref: "#/$defs/identifier" }
-				}
-			}
-		},
-		identifier: {
-			type: "string",
-			pattern: "^[A-Za-z_][A-Za-z0-9_]*$"
-		},
-		activeRow: {
-			type: "object",
-			required: ["table", "id"],
-			additionalProperties: false,
-			properties: {
-				table: { type: "string" },
-				id: { $ref: "#/$defs/identifier" },
-				disabledAt: { $ref: "#/$defs/identifier" },
-				status: { $ref: "#/$defs/identifier" },
-				active: {
-					type: "array",
-					items: { type: "string" }
-				},
-				keep: {
-					description: "A scope only: the permission keys members of a suspended instance still hold.",
-					type: "array",
-					items: { type: "string" }
-				}
-			}
-		},
-		helperName: {
-			type: "string",
-			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_user_id)$"
-		},
-		column: {
-			type: "object",
-			required: ["column"],
-			additionalProperties: false,
-			properties: { column: { $ref: "#/$defs/identifier" } }
-		},
-		role: { oneOf: [{ $ref: "#/$defs/value" }, { $ref: "#/$defs/through" }] },
-		user: { oneOf: [{ $ref: "#/$defs/column" }, { $ref: "#/$defs/through" }] },
-		through: {
-			type: "object",
-			required: ["column", "through"],
-			additionalProperties: false,
-			properties: {
-				column: { $ref: "#/$defs/identifier" },
-				through: {
-					type: "object",
-					required: [
-						"table",
-						"id",
-						"column"
-					],
-					additionalProperties: false,
-					properties: {
-						table: {
-							type: "string",
-							pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
-						},
-						id: { $ref: "#/$defs/identifier" },
-						column: { $ref: "#/$defs/identifier" }
-					}
-				}
-			}
-		},
-		value: { oneOf: [{ $ref: "#/$defs/column" }, {
-			type: "object",
-			required: ["value"],
-			additionalProperties: false,
-			properties: { value: { oneOf: [{ type: "string" }, {
-				type: "array",
-				items: { type: "string" }
-			}] } }
-		}] }
-	}
-});
-//#endregion
-//#region src/supabase/manifest.ts
-/**
-* Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
-* validates it against `schemas/supabase-manifest-v1.json`. Returns a
-* deep-frozen copy built from own keys; throws `PermDockValidationError`
-* with every issue, so a manifest of another major is refused.
-*/
-function parseSupabaseManifest(json) {
-	const issues = [];
-	let input = json;
-	if (typeof json === "string") try {
-		input = JSON.parse(json);
-	} catch (error) {
-		invalidManifest([{
-			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
-			path: []
-		}]);
-	}
-	const copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
-	if (issues.length === 0) checkSchema(supabaseManifestSchema, copy, [], issues);
-	if (issues.length > 0) invalidManifest(issues);
-	return freezeDeep(copy);
-}
-function invalidManifest(issues) {
-	const [first] = issues;
-	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
-	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
-	throw new PermDockValidationError({
-		code: "invalid-data",
-		permission: "",
-		resource: "",
-		boundary: "supabase-manifest",
-		issues,
-		message: `PermDock: invalid Supabase manifest${where}: ${first?.message ?? "unknown"}${more}`
-	});
-}
-//#endregion
-export { subjectFromSupabase as a, readMemberships as i, actorOf as n, subjectFromSupabaseSession as o, delegationOf as r, parseSupabaseManifest as t };