permdock 0.3.1 → 0.5.0

package/dist/{rls-import-4lLW_pbb.js → import-DMmOG27O.js}

@@ -1,15 +1,18 @@
-import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import { V as parseMembershipsFlag, r as HELPERS } from "./rls-shared-Cewd_-zI.js";
-import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-CZOMlwHl.js";
-import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-CD11nBbC.js";
+import { f as pgConnector } from "./policies-CO1oOymN.js";
+import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { deparse, parse } from "pgsql-parser";
-//#region src/cli/rls-import-ast.ts
+//#region src/cli/rls/import-nodes.ts
 function asNode$1(value) {
-	if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
+	return isRecord(value) ? value : void 0;
 }
 function stringVal(value) {
 	const node = asNode$1(value);
@@ -86,33 +89,50 @@ function selectFromTable(selectNode) {
 	const relname = asNode$1(asNode$1(from[0])?.["RangeVar"])?.["relname"];
 	return typeof relname === "string" ? relname : void 0;
 }
-function sublinkTable(value, kinds) {
+function sublinkSelect(value, kinds) {
 	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
 	if (sub === void 0) return;
 	const kind = sub["subLinkType"];
 	if (kind === void 0 || !kinds.has(kind)) return;
-	return selectFromTable(sub["subselect"]);
-}
-function membershipTable(value) {
-	const exists = sublinkTable(value, /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]));
-	if (exists !== void 0) return exists;
-	const anyDirect = sublinkTable(value, /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		2
-	]));
-	if (anyDirect !== void 0) return anyDirect;
-	const expr = asNode$1(asNode$1(unwrap(value))?.["A_Expr"]);
+	return selectFromTable(sub["subselect"]) === void 0 ? void 0 : sub["subselect"];
+}
+const EXISTS = /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]);
+const IN_OR_ANY = /* @__PURE__ */ new Set([
+	"ANY_SUBLINK",
+	"IN_SUBLINK",
+	2
+]);
+function subquery(select, field) {
+	const table = selectFromTable(select);
+	if (table === void 0) return;
+	return field === void 0 ? {
+		select,
+		table
+	} : {
+		select,
+		table,
+		field
+	};
+}
+function membershipSubquery(value) {
+	const node = asNode$1(unwrap(value));
+	const exists = sublinkSelect(value, EXISTS);
+	if (exists !== void 0) return subquery(exists, void 0);
+	const sub = asNode$1(node?.["SubLink"]);
+	const anyDirect = sublinkSelect(value, IN_OR_ANY);
+	if (anyDirect !== void 0) return subquery(anyDirect, columnName(sub?.["testexpr"]));
+	const expr = asNode$1(node?.["A_Expr"]);
 	if (expr === void 0) return;
-	const fromRight = sublinkTable(unwrap(expr["rexpr"]), /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		"EXISTS_SUBLINK",
-		0,
-		2
-	]));
-	if (fromRight !== void 0) return fromRight;
-	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return selectFromTable(expr["rexpr"][0]);
+	const right = unwrap(expr["rexpr"]);
+	const existsRight = sublinkSelect(right, EXISTS);
+	if (existsRight !== void 0) return subquery(existsRight, void 0);
+	const anyRight = sublinkSelect(right, IN_OR_ANY);
+	if (anyRight !== void 0) return subquery(anyRight, columnName(expr["lexpr"]));
+	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return subquery(expr["rexpr"][0], columnName(expr["lexpr"]));
+}
+/** The `where` clause of a `select` node. */
+function selectWhere(selectNode) {
+	return asNode$1(asNode$1(selectNode)?.["SelectStmt"])?.["whereClause"];
 }
 function operatorName(value) {
 	const names = asNode$1(asNode$1(unwrap(value))?.["A_Expr"])?.["name"];
@@ -158,6 +178,145 @@ async function fingerprintSql(sql) {
 		return createHash("sha256").update(sql.replaceAll(/\s+/g, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
 	}
 }
+function nodeStmt(first) {
+	const raw = asNode$1(first?.["RawStmt"]);
+	if (raw !== void 0) return raw["stmt"];
+	return first?.["stmt"];
+}
+function jwtClaim(value) {
+	const node = asNode$1(unwrap(value));
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0) return;
+	const name = operatorName(node);
+	if (name !== "->>" && name !== "->" || !isJwtCall(expr["lexpr"])) return;
+	const claim = constValue(expr["rexpr"]);
+	return typeof claim === "string" ? claim : void 0;
+}
+/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
+function isJwtCall(value) {
+	const inner = scalarSubselect(value);
+	if (inner !== void 0) return isJwtCall(inner);
+	const name = funcName(value);
+	return name === "auth.jwt" || name === "auth.session";
+}
+//#endregion
+//#region src/cli/rls/import-membership.ts
+/**
+* What the `where` of a membership subquery on `table` says, or `undefined`
+* when any part of it cannot be read as one. A subquery imports as
+* `memberOf` only when it binds the membership row to the signed-in user
+* and to the policy row, and filters roles with string literals at most:
+* a predicate left unread would widen the imported condition.
+*/
+function membershipRoles(subquery, table) {
+	const where = selectWhere(subquery.select);
+	if (where === void 0) return;
+	const scopeColumns = new Set([
+		...Object.values(table.columns ?? {}),
+		table.tenant,
+		table.team,
+		table.id
+	].filter((column) => column !== void 0));
+	if (subquery.field !== void 0 && !scopeColumns.has(selectTarget(subquery.select) ?? "")) return;
+	const roleColumn = typeof table.role === "string" ? table.role : void 0;
+	const roles = [];
+	let user = false;
+	let field = subquery.field;
+	for (const conjunct of conjuncts(where)) {
+		const read = readConjunct(conjunct, table, roleColumn, scopeColumns);
+		if (read === void 0) return;
+		if (read.kind === "user") user = true;
+		else if (read.kind === "row") {
+			if (field !== void 0 && field !== read.field) return;
+			field = read.field;
+		} else if (read.kind === "roles") roles.push(...read.roles);
+	}
+	return user && field !== void 0 ? {
+		field,
+		roles: [...new Set(roles)]
+	} : void 0;
+}
+/** The column a `select <column> from …` returns. */
+function selectTarget(select) {
+	const targets = asNode$1(asNode$1(select)?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets.length !== 1) return;
+	return columnName(asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"]);
+}
+function conjuncts(value) {
+	if (boolOp(value) !== "and") return [value];
+	const args = asNode$1(asNode$1(unwrap(value))?.["BoolExpr"])?.["args"];
+	return Array.isArray(args) ? args.flatMap((arg) => conjuncts(arg)) : [];
+}
+function readConjunct(value, table, roleColumn, scopeColumns) {
+	const node = asNode$1(unwrap(value));
+	const nullTest = asNode$1(node?.["NullTest"]);
+	if (nullTest !== void 0) {
+		const column = columnName(nullTest["arg"]);
+		return (nullTest["nulltesttype"] === "IS_NULL" || nullTest["nulltesttype"] === 0 || nullTest["nulltesttype"] === void 0) && column !== void 0 && (column === table.disabledAt || column === table.expiresAt) ? { kind: "active" } : void 0;
+	}
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0 || operatorName(node) !== "=") return;
+	const kind = expr["kind"];
+	const left = columnName(expr["lexpr"]);
+	if (kind === "AEXPR_OP_ANY" || kind === 2) {
+		const elements = asNode$1(asNode$1(unwrap(expr["rexpr"]))?.["A_ArrayExpr"])?.["elements"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(elements) || elements.length === 0) return;
+		const values = elements.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	if (kind === "AEXPR_IN" || kind === 7) {
+		const raw = expr["rexpr"];
+		const items = asNode$1(raw)?.["List"];
+		const list = Array.isArray(raw) ? raw : asNode$1(items)?.["items"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(list) || list.length === 0) return;
+		const values = list.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	const right = columnName(expr["rexpr"]);
+	for (const [column, other, otherColumn] of [[
+		left,
+		expr["rexpr"],
+		right
+	], [
+		right,
+		expr["lexpr"],
+		left
+	]]) {
+		if (column === void 0) continue;
+		if (column === table.user && (isAuthUid(other) || isCurrentSettingUserId(other))) return { kind: "user" };
+		if (column === roleColumn) {
+			const role = constValue(other);
+			return typeof role === "string" ? {
+				kind: "roles",
+				roles: [role]
+			} : void 0;
+		}
+		if (scopeColumns.has(column) && otherColumn !== void 0) return {
+			kind: "row",
+			field: otherColumn
+		};
+	}
+}
+/**
+* `condition` with every `memberOf` role read through `rls.roleValues`, so a
+* legacy role value imports as the PermDock role it stands for.
+*/
+function mapRoleValues(condition, roleValues) {
+	if (roleValues === void 0 || condition === null) return condition;
+	if (Array.isArray(condition)) return condition.map((item) => mapRoleValues(item, roleValues));
+	if (typeof condition !== "object") return condition;
+	const mapped = Object.fromEntries(Object.entries(condition).map(([key, value]) => [key, mapRoleValues(value, roleValues)]));
+	if (mapped["op"] === "memberOf" && Array.isArray(mapped["roles"])) mapped["roles"] = mapped["roles"].map((role) => typeof role === "string" && Object.hasOwn(roleValues, role) ? roleValues[role] : role);
+	return mapped;
+}
+//#endregion
+//#region src/cli/rls/import-ast.ts
 async function conditionFromAst(sql, memberships, functions, unmapped, joins = [], seeds = []) {
 	if (sql === void 0 || sql.trim() === "" || sql.trim() === "true") return {
 		op: "eq",
@@ -338,58 +497,6 @@ async function helperGrants(sql, memberships, functions, seeds) {
 	}
 	return grants;
 }
-const SEED_COLUMNS = [
-	"role",
-	"permission",
-	"grant_key",
-	"scope",
-	"effect"
-];
-function asScope(value) {
-	return typeof value === "string" && /^[a-z][a-z0-9_]*$/u.test(value) ? value : void 0;
-}
-function seedFromRow(row) {
-	const scope = asScope(row["scope"]);
-	if (typeof row["role"] !== "string" || typeof row["permission"] !== "string" || typeof row["grant_key"] !== "string" || scope === void 0) return;
-	return {
-		role: row["role"],
-		permission: row["permission"],
-		grantKey: row["grant_key"],
-		scope,
-		effect: row["effect"] === "deny" ? "deny" : "allow"
-	};
-}
-/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
-async function seedsFromSql(sql) {
-	let parsed;
-	try {
-		parsed = await parse(sql);
-	} catch {
-		return [];
-	}
-	const seeds = [];
-	for (const item of asStmts(parsed)) {
-		const insert = asNode$1(asNode$1(nodeStmt(asNode$1(item)))?.["InsertStmt"]);
-		if (asNode$1(insert?.["relation"])?.["relname"] !== "role_permissions") continue;
-		const cols = Array.isArray(insert?.["cols"]) ? insert["cols"].map((col) => asNode$1(asNode$1(col)?.["ResTarget"])?.["name"]) : [];
-		const values = asNode$1(asNode$1(insert?.["selectStmt"])?.["SelectStmt"])?.["valuesLists"];
-		if (!Array.isArray(values)) continue;
-		for (const list of values) {
-			const items = asNode$1(asNode$1(list)?.["List"])?.["items"];
-			if (!Array.isArray(items)) continue;
-			const row = {};
-			for (const [index, col] of cols.entries()) if (typeof col === "string" && SEED_COLUMNS.includes(col)) row[col] = constValue(items[index]);
-			const seed = seedFromRow(row);
-			if (seed !== void 0) seeds.push(seed);
-		}
-	}
-	return seeds;
-}
-function nodeStmt(first) {
-	const raw = asNode$1(first?.["RawStmt"]);
-	if (raw !== void 0) return raw["stmt"];
-	return first?.["stmt"];
-}
 function mapNode(value, ctx) {
 	if (value === void 0) return;
 	const node = asNode$1(unwrap(value));
@@ -433,29 +540,25 @@ function mapNode(value, ctx) {
 			conditions: children
 		};
 	}
-	const table = membershipTable(node);
-	if (table !== void 0) {
-		for (const [scope, mapped] of Object.entries(memberships?.scopes ?? {})) {
-			const column = mapped.columns?.[scope];
-			if (mapped.table === table && column !== void 0) return {
-				op: "memberOf",
-				scope,
-				field: column,
-				roles: []
-			};
+	const subquery = membershipSubquery(node);
+	if (subquery !== void 0) {
+		const { table } = subquery;
+		const mappedScopes = Object.entries(memberships?.scopes ?? {});
+		if (memberships?.tenant !== void 0) mappedScopes.push(["tenant", memberships.tenant]);
+		if (memberships?.team !== void 0) mappedScopes.push(["team", memberships.team]);
+		const matches = mappedScopes.filter(([, mapped]) => mapped.table === table);
+		if (matches.length > 0) {
+			for (const [scope, mapped] of matches) {
+				const read = membershipRoles(subquery, mapped);
+				if (read !== void 0) return {
+					op: "memberOf",
+					scope,
+					field: read.field,
+					roles: read.roles
+				};
+			}
+			return;
 		}
-		if (memberships?.tenant?.table === table) return {
-			op: "memberOf",
-			scope: "tenant",
-			field: memberships.tenant.tenant ?? "tenant_id",
-			roles: []
-		};
-		if (memberships?.team?.table === table) return {
-			op: "memberOf",
-			scope: "team",
-			field: memberships.team.team ?? "team_id",
-			roles: []
-		};
 		joins.push(table);
 		return;
 	}
@@ -505,26 +608,59 @@ function mapNode(value, ctx) {
 		};
 	}
 }
-function jwtClaim(value) {
-	const node = asNode$1(unwrap(value));
-	const expr = asNode$1(node?.["A_Expr"]);
-	if (expr === void 0) return;
-	const name = operatorName(node);
-	if (name !== "->>" && name !== "->" || !isJwtCall(expr["lexpr"])) return;
-	const claim = constValue(expr["rexpr"]);
-	return typeof claim === "string" ? claim : void 0;
+//#endregion
+//#region src/cli/rls/import-seeds.ts
+const SEED_COLUMNS = [
+	"role",
+	"permission",
+	"grant_key",
+	"scope",
+	"effect"
+];
+function asScope(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9_]*$/u.test(value) ? value : void 0;
 }
-/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
-function isJwtCall(value) {
-	const inner = scalarSubselect(value);
-	if (inner !== void 0) return isJwtCall(inner);
-	const name = funcName(value);
-	return name === "auth.jwt" || name === "auth.session";
+function seedFromRow(row) {
+	const scope = asScope(row["scope"]);
+	if (typeof row["role"] !== "string" || typeof row["permission"] !== "string" || typeof row["grant_key"] !== "string" || scope === void 0) return;
+	return {
+		role: row["role"],
+		permission: row["permission"],
+		grantKey: row["grant_key"],
+		scope,
+		effect: row["effect"] === "deny" ? "deny" : "allow"
+	};
+}
+/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
+async function seedsFromSql(sql) {
+	let parsed;
+	try {
+		parsed = await parse(sql);
+	} catch {
+		return [];
+	}
+	const seeds = [];
+	for (const item of asStmts(parsed)) {
+		const insert = asNode$1(asNode$1(nodeStmt(asNode$1(item)))?.["InsertStmt"]);
+		if (asNode$1(insert?.["relation"])?.["relname"] !== "role_permissions") continue;
+		const cols = Array.isArray(insert?.["cols"]) ? insert["cols"].map((col) => asNode$1(asNode$1(col)?.["ResTarget"])?.["name"]) : [];
+		const values = asNode$1(asNode$1(insert?.["selectStmt"])?.["SelectStmt"])?.["valuesLists"];
+		if (!Array.isArray(values)) continue;
+		for (const list of values) {
+			const items = asNode$1(asNode$1(list)?.["List"])?.["items"];
+			if (!Array.isArray(items)) continue;
+			const row = {};
+			for (const [index, col] of cols.entries()) if (typeof col === "string" && SEED_COLUMNS.includes(col)) row[col] = constValue(items[index]);
+			const seed = seedFromRow(row);
+			if (seed !== void 0) seeds.push(seed);
+		}
+	}
+	return seeds;
 }
 //#endregion
-//#region src/cli/rls-import-views.ts
+//#region src/cli/rls/import-views.ts
 function asNode(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	return isRecord(value) ? value : void 0;
 }
 function list(value) {
 	return Array.isArray(value) ? value : [];
@@ -708,7 +844,7 @@ async function viewsSqlFromDb(query) {
 	}).join("\n");
 }
 //#endregion
-//#region src/cli/rls-import.ts
+//#region src/cli/rls/import.ts
 const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/gi;
 function extractParenClause(sql, keyword) {
 	const match = new RegExp(`\\b${keyword}\\s*\\(`, "i").exec(sql);
@@ -795,7 +931,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 	});
 }
 function assertNoServiceRole(sql) {
-	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw new Error("PermDock CLI: imported SQL must never target service_role");
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
 }
 async function seedsFromDb(query) {
 	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
@@ -876,7 +1012,7 @@ async function runRlsImport(input) {
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
 	} else if (input.db !== void 0) try {
-		const fromDb = await policiesFromDb(input.db, input.connect ?? ((db) => connectPg(db, "permdock rls import --db")));
+		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db-url-stdin", input.cwd));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
 		seeds = fromDb.seeds;
@@ -886,16 +1022,24 @@ async function runRlsImport(input) {
 	}
 	else return {
 		code: 2,
-		output: "PermDock CLI: rls import needs --sql <file> or --db <url>"
+		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 	};
 	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
+	const roleValues = input.config.rls?.roleValues;
+	if (roleValues !== void 0) seeds = seeds.map((row) => {
+		const mapped = Object.hasOwn(roleValues, row.role) ? roleValues[row.role] : void 0;
+		return mapped === void 0 ? row : {
+			...row,
+			role: mapped
+		};
+	});
 	const functions = input.config.rls?.functions;
 	const unmapped = [];
 	const joins = [];
 	const catalog = [];
 	for (const item of policies) {
 		const sourceSql = item.using ?? item.check ?? "true";
-		const condition = await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds);
+		const condition = mapRoleValues(await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds), input.config.rls?.roleValues);
 		const grants = await helperGrants(item.using ?? item.check, memberships, functions, seeds);
 		catalog.push({
 			table: item.table,
@@ -911,8 +1055,7 @@ async function runRlsImport(input) {
 	const fieldViews = viewsSql === "" ? [] : await fieldViewsFromSql(viewsSql, memberships, functions, seeds);
 	const outRel = input.out ?? "src/permissions.generated.ts";
 	const outPath = resolve(input.cwd, outRel);
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, emitGenerated(catalog, fieldViews, input.schema));
+	writeFileEnsuringDir(outPath, emitGenerated(catalog, fieldViews, input.schema));
 	const hints = [
 		...uniqueHints([...new Set(unmapped)], bodies),
 		...[...new Set(joins)].map(membershipHint),

package/dist/index-BcHcPyIo.d.ts

@@ -0,0 +1,110 @@
+import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { t as Operation } from "./operations-CxybZErY.js";
+import { p as PrincipalSource, r as PermDock } from "./permdock-D7eeLJER.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-DX0LaKTb.js";
+import { l as WebhookSigner } from "./standard-webhooks-6lg8v_is.js";
+//#region src/delivery/audience.d.ts
+type Audience = {
+  /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
+  readonly principals: readonly string[];
+  /** `false` when `whoCan` could not list every holder: someone granted may be missing. */
+  readonly complete: boolean;
+};
+type AudienceOptions = {
+  /** Check only these principals instead of listing holders with `whoCan`. */
+  readonly candidates?: readonly string[];
+};
+/**
+ * Who may receive a delivery about `row`: the holders `whoCan` lists (or
+ * `candidates`), kept only where `decideFor` grants `permission` in the
+ * sender's active tenant. A collection permission has no holders to list,
+ * so it needs `candidates`; without them it is empty and incomplete.
+ */
+declare function audience(permdock: PermDock, permission: Permission, row: unknown, options?: AudienceOptions): Promise<Audience>;
+/** One event a subscriber may receive: the permission its row needs. */
+type SubscriberEvent = {
+  readonly permission: Permission;
+  readonly row?: unknown;
+};
+/**
+ * The subscribers whose principal `decideFor` grants the event's
+ * permission on its row, in their order: the per-event filter for webhook
+ * endpoints and realtime channels. A subscriber without a string
+ * `principal` is dropped.
+ */
+declare function subscribersFor<S extends {
+  readonly principal: string;
+}>(permdock: PermDock, event: SubscriberEvent, subscribers: readonly S[]): Promise<S[]>;
+//#endregion
+//#region src/delivery/memory-transport.d.ts
+type MemoryDelivery<C extends DeliveryChannel> = {
+  readonly target: DeliveryTarget<C>;
+  readonly message: TransportMessages[C];
+  readonly options: TransportOptions;
+};
+type MemoryDeliveryTransport<C extends DeliveryChannel> = DeliveryTransport<C> & {
+  /** Every delivery `respond` answered `sent` for, oldest first. */
+  readonly deliveries: readonly MemoryDelivery<C>[];
+};
+type MemoryDeliveryTransportOptions<C extends DeliveryChannel> = {
+  /** The result per delivery; defaults to `sent`. A throw propagates, as from a provider client. */
+  readonly respond?: (target: DeliveryTarget<C>, message: TransportMessages[C]) => DeliveryResult;
+};
+/** An in-process transport for tests and examples: it records what it would have sent. */
+declare function memoryDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: MemoryDeliveryTransportOptions<C>): MemoryDeliveryTransport<C>;
+//#endregion
+//#region src/delivery/router.d.ts
+type DeliveryPermDockOptions = {
+  readonly transports: DeliveryTransports;
+  /** Resolves `{ address }` recipients through `principalByIdentity`. */
+  readonly principals?: PrincipalSource;
+  /** Receives one `delivery` event per recipient. A throw is ignored. */
+  readonly sink?: DecisionSink;
+  /** The `from` of an email whose message sets none. */
+  readonly from?: string;
+  /** The event `source`; defaults to `permdock`. */
+  readonly source?: string;
+};
+type DeliveryPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /**
+   * Checks every recipient against `target`'s permission on `row` with
+   * `permdock.decideFor`, routes the granted ones to the transport of their
+   * channel, and writes one `delivery` event per recipient. Never rejects:
+   * a refused recipient or a transport error is a `failed` event.
+   */
+  readonly deliver: (permdock: PermDock<V>, target: Permission | Pick<Operation, "name" | "permission">, row: unknown, recipients: readonly Recipient[], messages: Partial<DeliveryMessages>, options?: DeliverOptions) => Promise<DeliveryReport>;
+};
+/** Routes checked recipients to channel transports and records a delivery event for each. */
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(_policy: Policy<TUser, TPrincipal, V>, options: DeliveryPermDockOptions): DeliveryPermDock<V>;
+//#endregion
+//#region src/delivery/target.d.ts
+/**
+ * Whether `value` is a target the router checked for `channel`: a non-empty
+ * address and a granted decision. A transport calls it first and refuses
+ * anything else, so a hand-built recipient never reaches a provider.
+ */
+declare function isDeliveryTarget<C extends DeliveryChannel>(value: unknown, channel: C): value is DeliveryTarget<C>;
+/**
+ * An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
+ * characters (RFC 5321 path limit). Quoted local parts, comments and
+ * domain literals are refused.
+ */
+declare function isAddrSpec(value: string): boolean;
+//#endregion
+//#region src/delivery/webhook-transport.d.ts
+type WebhookTransportOptions = {
+  /** Defaults to the global `fetch`. */
+  readonly fetch?: typeof fetch;
+  /** Milliseconds before a request is aborted as `unavailable`. Defaults to 10000. */
+  readonly timeout?: number;
+};
+/**
+ * Posts each CloudEvent to the target's https endpoint as
+ * `application/cloudevents+json`, signed with the Standard Webhooks
+ * headers. `webhook-id` is the idempotency key, so a retry repeats it and
+ * the receiver drops the duplicate. Redirects are not followed.
+ */
+declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
+//#endregion
+export { DeliveryPermDock as a, MemoryDelivery as c, memoryDeliveryTransport as d, Audience as f, subscribersFor as g, audience as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, SubscriberEvent as m, webhookTransport as n, DeliveryPermDockOptions as o, AudienceOptions as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u };

package/dist/index-CaxrMD1A.d.ts

@@ -0,0 +1 @@
+export {}