permdock 0.3.1 → 0.5.0

package/dist/testing/saas/index.d.ts

@@ -1,7 +1,8 @@
-import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-IB6yxpC3.js";
-import { f as Permission } from "../../permissions-DttnqqxC.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D2W7uv19.js";
+import { $n as Delegation, Q as LimitStore, Rt as Instant, Zn as CustomRole, ir as Subject, it as RelationSource, nr as Membership, qn as Actor, rr as Principal } from "../../policy-types-DzwivBgR.js";
+import { w as Permission } from "../../vocabulary-D6lPdb4Z.js";
+import { i as PermDockOptions } from "../../permdock-D7eeLJER.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Czo4n3Hs.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";
@@ -121,8 +122,8 @@ type SaasTokenOptions = {
   /** Claim memberships; `false` omits the claim (database mode). Defaults to the seed. */
   readonly memberships?: readonly Membership[] | false;
   readonly ttl?: number;
-  /** Epoch seconds used for `iat`. */
-  readonly now?: number;
+  /** The instant used for `iat`; defaults to the current time. */
+  readonly now?: Instant;
   readonly issuer?: string;
   readonly audience?: string;
   readonly claims?: Readonly<Record<string, unknown>>;
@@ -134,9 +135,9 @@ export declare function signSaasToken(sub: string, options?: SaasTokenOptions):
  * and returns its `sub`, or `null`; never throws. Identity only: memberships
  * and plans come from the seed, never from the token.
  */
-export declare function verifySaasToken(token: string | null | undefined, now?: number): Promise<string | null>;
+export declare function verifySaasToken(token: string | null | undefined, now?: Instant): Promise<string | null>;
 /** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
-export declare function verifySaasSession(token: string | null | undefined, now?: number): Promise<{
+export declare function verifySaasSession(token: string | null | undefined, at?: Instant): Promise<{
   readonly sub: string;
   readonly expiresAt: number;
 } | null>;

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DhpJjnBA.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CZKiUfFM.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-FO-Q8oj0.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1,2 +1 @@
-import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
-export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CZKiUfFM.js";

package/dist/text-BMFRfBqc.js

@@ -0,0 +1,8 @@
+//#region src/cli/shared/text.ts
+/** The text before the first `separator`, or all of it when there is none. */
+function beforeFirst(text, separator) {
+	const at = text.indexOf(separator);
+	return at === -1 ? text : text.slice(0, at);
+}
+//#endregion
+export { beforeFirst as t };

package/dist/{text-diff-BdkkYSbi.js → text-diff-BQcUapOb.js}

@@ -1,5 +1,5 @@
 import { createTwoFilesPatch } from "diff";
-//#region src/cli/text-diff.ts
+//#region src/cli/core/text-diff.ts
 const MAX_LINES = 40;
 /**
 * A unified diff from the file on disk to what the command would write,

package/dist/thenable-yD7SabqG.js

@@ -0,0 +1,31 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+//#region src/core/thenable.ts
+function isThenable(value) {
+	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+function ignoreRejection(value) {
+	Promise.resolve(value).then(void 0, () => void 0);
+}
+/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
+function validateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		return { ok: false };
+	}
+	return result.issues === void 0 ? {
+		ok: true,
+		value: result.value
+	} : {
+		ok: false,
+		issues: result.issues
+	};
+}
+/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
+function validateRecord(schema, value) {
+	const validated = validateSync(schema, value);
+	return validated.ok && isRecord(validated.value) ? validated.value : void 0;
+}
+//#endregion
+export { validateSync as i, isThenable as n, validateRecord as r, ignoreRejection as t };

package/dist/time-DkWjdL98.js

@@ -0,0 +1,71 @@
+//#region src/core/time.ts
+/** RFC 3339 `date-time` in UTC or with an offset; fractional seconds optional. */
+const RFC3339_PATTERN = "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$";
+const RFC3339 = /* @__PURE__ */ new RegExp(RFC3339_PATTERN, "u");
+function isRfc3339(value) {
+	return typeof value === "string" && RFC3339.test(value) && Number.isFinite(Date.parse(value));
+}
+/** Seconds since the epoch as RFC 3339 in UTC. */
+function rfc3339(seconds) {
+	return (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString();
+}
+/** Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a `RangeError` for a value outside the `Date` range. */
+function isoAt(millis) {
+	return new Date(millis).toISOString();
+}
+/** RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function isoNow(now) {
+	return dateAt(now).toISOString();
+}
+/** Whole seconds since the epoch of an RFC 3339 instant; `undefined` for anything else. */
+function secondsOf(value) {
+	return isRfc3339(value) ? Math.floor(Date.parse(value) / 1e3) : void 0;
+}
+/** Whole seconds since the epoch of an RFC 3339 string or an `Instant`; `undefined` for anything else, Unix seconds included. */
+function instantOf(value) {
+	if (typeof value === "string") return secondsOf(value);
+	if (typeof value === "object" && value !== null && "epochMilliseconds" in value && typeof value.epochMilliseconds === "number" && Number.isFinite(value.epochMilliseconds)) return Math.floor(value.epochMilliseconds / 1e3);
+}
+/** A duration: a whole number of seconds above zero, else `undefined`. */
+function durationOf(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
+/** Throws at definition time unless `value` is a whole number of seconds above zero. */
+function assertDuration(value, label) {
+	if (durationOf(value) === void 0) throw new Error(`PermDock: ${label} must be a whole number of seconds above 0, got ${JSON.stringify(value) ?? String(value)}`);
+}
+/** Whole seconds since the epoch of `now`, or of the clock when absent. */
+function nowSeconds(now) {
+	return Math.floor(nowMillis(now) / 1e3);
+}
+/** The `validation` denial detail for a `now` option that is not an `Instant`. */
+const INVALID_NOW = Object.freeze({
+	field: "now",
+	message: "now must be an Instant ({ epochMilliseconds }), such as a Temporal.Instant"
+});
+/** The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function dateAt(now) {
+	const millis = nowMillis(now);
+	if (!Number.isFinite(millis)) throw new RangeError(`PermDock: ${INVALID_NOW.message}`);
+	return new Date(millis);
+}
+/** Whole seconds since the epoch of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function secondsAt(now) {
+	return Math.floor(dateAt(now).getTime() / 1e3);
+}
+/** The instant `seconds` after the epoch. */
+function instantAt(seconds) {
+	return { epochMilliseconds: seconds * 1e3 };
+}
+/** Seconds since the epoch of `now`, fraction kept, or of the clock when absent. */
+function epochSeconds(now) {
+	return nowMillis(now) / 1e3;
+}
+/** Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for a `now` that is not an `Instant`. */
+function nowMillis(now) {
+	if (now === void 0) return Date.now();
+	const millis = typeof now === "object" && now !== null ? now.epochMilliseconds : void 0;
+	return typeof millis === "number" ? millis : NaN;
+}
+//#endregion
+export { durationOf as a, instantOf as c, isoNow as d, nowMillis as f, secondsOf as g, secondsAt as h, dateAt as i, isRfc3339 as l, rfc3339 as m, RFC3339_PATTERN as n, epochSeconds as o, nowSeconds as p, assertDuration as r, instantAt as s, INVALID_NOW as t, isoAt as u };

package/dist/{token-CIWxJOCh.js → token-BLZcjQgt.js}

@@ -1,5 +1,5 @@
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 //#region src/core/token.ts
 /**
 * Only stable identity goes into the token, so refreshing a session (new
@@ -22,7 +22,16 @@ function versionOf(row, field) {
 }
 /** The digest that binds a token to the call's data when no row id does. */
 function payloadDigest(data) {
-	return bytesToBase64Url(sha256(canonicalJson(data)));
+	return sha256Digest(canonicalJson(data));
+}
+/**
+* The payload a decision token binds: the call's `args` when the caller
+* passes them (an agent or MCP tool call, row or not), otherwise the data of
+* a call without a row id. `undefined` binds nothing beyond the row id.
+*/
+function tokenPayload(resourceId, data, args) {
+	if (args !== void 0) return payloadDigest(args);
+	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
 * `version` is set only for an approval that goes stale on a resource
@@ -32,7 +41,7 @@ function payloadDigest(data) {
 * others.
 */
 function decisionToken(input) {
-	const payload = JSON.stringify({
+	const payload = canonicalJson({
 		key: input.key,
 		resourceId: input.resourceId,
 		principal: principalIdentity(input.principal),
@@ -44,7 +53,7 @@ function decisionToken(input) {
 		...input.version === void 0 ? {} : { version: input.version },
 		...input.payload === void 0 ? {} : { payload: input.payload }
 	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+	return sha256Digest(payload);
 }
 //#endregion
-export { payloadDigest as n, versionOf as r, decisionToken as t };
+export { versionOf as i, payloadDigest as n, tokenPayload as r, decisionToken as t };

package/dist/tool-refusal-CMLN5xhn.js

@@ -0,0 +1,41 @@
+import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
+import { t as describe } from "./describe-BybMRY7A.js";
+//#region src/core/tool-refusal.ts
+function deniedToolRefusal(decision, permission, resource) {
+	const alternatives = decision.alternatives.map((leaf) => leaf.key);
+	return {
+		text: `Denied: ${resource.id === void 0 ? permission.key : `${permission.key} on ${resource.id}`}.${alternatives.length === 0 ? "" : ` You may: ${alternatives.join(", ")}.`}`,
+		structured: {
+			outcome: "denied",
+			permission: permission.key,
+			resource,
+			denials: wireDenials(decision.denials),
+			alternatives,
+			detail: describe(decision).detail
+		}
+	};
+}
+function approvalToolRefusal(decision, permission, resource) {
+	return {
+		text: describe(decision).detail,
+		structured: {
+			outcome: "approval-required",
+			permission: permission.key,
+			resource,
+			token: decision.token
+		}
+	};
+}
+/** An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read it. */
+function toolErrorResult(refusal) {
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: refusal.text
+		}],
+		structuredContent: refusal.structured
+	};
+}
+//#endregion
+export { deniedToolRefusal as n, toolErrorResult as r, approvalToolRefusal as t };

package/dist/trpc/index.d.ts

@@ -1,9 +1,10 @@
-import { C as Policy, Nr as Principal } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
-import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
+import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { t as StreamProtectOptions } from "../stream-7-xmnf3U.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
@@ -33,11 +34,13 @@ type TrpcOpenApiHooks = {
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type TrpcPermDock<TCtx = object> = {
-  readonly permdock: () => TrpcMiddleware;
-  readonly protect: (permission: Permission | null, loadData?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
+  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  readonly getPermDock: (opts: TrpcMiddlewareOpts<TCtx>) => Promise<PermDock>;
+  readonly middleware: () => TrpcMiddleware;
+  readonly protect: (permission: Permission | null, data?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
   /** A long-lived connection for the request behind `ctx`. */
   readonly connection: (opts: TrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly permdockHandler: () => (request: Request) => Promise<Response>;
   readonly openapi: TrpcOpenApiHooks;
   readonly errorFormatter: <TShape extends {
     readonly data: object;

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
-import { a as problemMessage } from "../http-SO7qGttf.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-CuzGytRf.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
+import { o as problemMessage } from "../http-BBoKefeS.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { n as attached } from "../bind-CZzhx-Vj.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-aPyNi6tA.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");
@@ -57,10 +57,11 @@ function errorFormatter(opts) {
 	};
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
-	const permdock = () => (async (opts) => {
+	const { kernel, bind, attach, scopeOf, connection, evaluate, guard: runGuard } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
+	const getPermDock = async (opts) => kernel.getPermDock(bind(opts), await scopeOf(opts));
+	const middleware = () => (async (opts) => {
 		const request = bind(opts);
-		const instance = await attached(async () => kernel.permdock(request, await scopeOf(opts)));
+		const instance = await attached(async () => kernel.getPermDock(request, await scopeOf(opts)));
 		if (!instance.ok) return throwTrpcError(instance.response);
 		const nextCtx = {
 			...opts.ctx,
@@ -70,19 +71,18 @@ function createPermDock(policy, options) {
 		return mapDownstream(await opts.next({ ctx: nextCtx }));
 	});
 	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
-	const guardSubscription = async (result, opts, permission, loadData, protectOptions) => {
+	const guardSubscription = async (result, opts, permission, data, protectOptions) => {
 		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
 		return {
 			...result,
-			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, {
+			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, data, protectOptions, {
 				unwrap: (item) => isTrackedEnvelope(item) ? item[1] : item,
 				onRevoked: trpcErrorFrom
 			})
 		};
 	};
-	const protect = (permission, loadData, protectOptions) => (async (opts) => {
-		const request = bind(opts);
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, await scopeOf(opts));
+	const protect = (permission, data, protectOptions) => (async (opts) => {
+		const { request, guard } = await runGuard(permission, data, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.ctx,
@@ -90,11 +90,11 @@ function createPermDock(policy, options) {
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions);
+			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, data === void 0 ? void 0 : reloadAfter(guard.data, () => data(opts)), protectOptions);
 		}
 		return throwTrpcError(guard.response);
 	});
-	const permdockHandler = (request) => {
+	const handler = (request) => {
 		return evaluate(request, {
 			ctx: { req: request },
 			path: "permdock",
@@ -104,10 +104,11 @@ function createPermDock(policy, options) {
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
-		permdockHandler,
+		permdockHandler: () => handler,
 		openapi: {
 			security: (permission) => ({ openapi: {
 				protect: true,

package/dist/{types-DbjRN55U.d.ts → types-5Ut_pbKy.d.ts}

@@ -1,5 +1,12 @@
-import { n as RoleThrough } from "./types-C97IskBw.js";
-import { o as SqlMembershipSource } from "./sources-BdOYLw9j.js";
+import { n as RoleThrough } from "./types-CdlxsYQh.js";
+import { o as SqlMembershipSource } from "./sources-BV9j0DeZ.js";
+//#region src/cli/core/errors.d.ts
+/**
+ * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT
+ * or a cancelled prompt), 143 terminated (SIGTERM).
+ */
+type ExitCode = 0 | 1 | 2 | 3 | 130 | 143;
+//#endregion
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -88,7 +95,7 @@ type RlsConfig = {
   readonly dialect?: RlsDialect;
   readonly memberships?: RlsMemberships;
   /**
-   * `database` mode: the `fromTable` / `fromJunction` sources the helpers
+   * `database` mode: the `tableMembershipSource` / `junctionMembershipSource` sources the helpers
    * read for every scope `memberships` maps no table for. Default
    * `supabase.hook.memberships`, so the helpers and the token hook run the
    * same SQL. Setting it selects `database` mode.
@@ -117,6 +124,13 @@ type RlsConfig = {
   /** Postgres type of each named scope's id column; overrides `tenantType` / `teamType`. */
   readonly scopeTypes?: Readonly<Record<string, string>>;
   readonly roleClaim?: string;
+  /**
+   * Role values the existing SQL compares against (a string literal or an
+   * enum label) and the PermDock role each one is. `rls import` writes the
+   * PermDock name for a mapped value; `rls migrate` filters a `role` helper by
+   * it. An unmapped value must already be a declared role.
+   */
+  readonly roleValues?: Readonly<Record<string, string>>;
   readonly gucPrefix?: string;
   readonly out?: string;
   /** `--target drizzle`: where each policy's `.link()` finds its table. */
@@ -140,9 +154,19 @@ type RlsConfig = {
   /**
    * Resolve tenant-defined custom roles in the helpers: `custom_role_permissions` and
    * `custom_role_includes` in `database` mode, the `memberships[].grants` claim in `jwt` mode,
-   * always intersected with the `permdock_ceiling` view. Off by default.
+   * always intersected with the `permdock_ceiling` view. Off by default. An
+   * object turns them on and names the application's existing role tables
+   * that `--backfill-out` copies from.
+   */
+  readonly customRoles?: boolean | RlsCustomRolesConfig;
+  /**
+   * Triggers the application owns on tables `generate` creates, by table
+   * name without the schema (`custom_role_permissions`): written after the
+   * tables, each as `drop trigger if exists` and `create trigger`.
    */
-  readonly customRoles?: boolean;
+  readonly triggers?: Readonly<Record<string, readonly RlsTrigger[]>>;
+  /** Register generated tables with an audit function, such as `better_supabase.audit`. */
+  readonly audit?: RlsAudit;
   /** How the generated custom-role write functions check the caller (`database` mode with `customRoles`). */
   readonly customRoleWrites?: {
     /**
@@ -208,7 +232,8 @@ type RlsConfig = {
    * Add the approval store `supabaseApprovalStore` reads and writes: the
    * `approval_requests` table and one function per `ApprovalStore` method, in
    * the helper schema, executable by no client role. Off by default. An
-   * object adopts a table the app already has instead.
+   * object with `table` adopts a table the app already has instead, and
+   * `delegations: true` adds the out-of-office covers.
    */
   readonly approvals?: boolean | RlsApprovalsAdopt;
   /**
@@ -291,8 +316,15 @@ type RlsConfig = {
  * fields into the app's own columns on each write, converted to their types.
  */
 type RlsApprovalsAdopt = {
-  /** `table` or `schema.table`. */
-  readonly table: string;
+  /** `table` or `schema.table`. Without it the store is the generated `approval_requests`. */
+  readonly table?: string;
+  /**
+   * Add `approval_delegations`, the out-of-office covers a user writes for
+   * themselves, and the four-argument `permdock_is_approver` that answers for
+   * a delegate inside an active cover. `tableApprovalDelegationSource` reads
+   * the same rows for `approvalsHandler`. Off by default.
+   */
+  readonly delegations?: boolean;
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -350,6 +382,63 @@ type RlsCustomRoleTable = {
   /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
   readonly skip?: string;
 };
+/** `rls.customRoles` as an object: custom roles on, plus where existing ones live. */
+type RlsCustomRolesConfig = {
+  /** The application's role tables `--backfill-out` copies into `custom_role_permissions` and `custom_role_includes`. */
+  readonly from?: RlsCustomRolesFrom;
+};
+/**
+ * Existing custom-role data. Each row's role is a row of
+ * `rls.customRoleWrites.roles`, which supplies its name, tenant, scope,
+ * instance and `skip` flag.
+ */
+type RlsCustomRolesFrom = {
+  readonly permissions: {
+    /** `table` or `schema.table`: one row per permission a role holds. */
+    readonly table: string;
+    /** The reference to the roles table: `{ through: 'roles', on: { role_id: 'id' }, column: 'key' }`. */
+    readonly role: RoleThrough;
+    /** The permission key column, or a reference to a permissions table that holds the key. */
+    readonly permission: string | RoleThrough;
+    /** A text column holding `allow` or `deny`. Without it every row allows. */
+    readonly effect?: string;
+    /** A text column holding the level of a leveled allow. */
+    readonly level?: string;
+  };
+  readonly includes?: {
+    readonly table: string;
+    /** The reference to the including role's row in the roles table. */
+    readonly role: RoleThrough;
+    /** The included role's key column, or a reference to the roles table. */
+    readonly include: string | RoleThrough;
+  };
+};
+/** One trigger the application owns on a generated table (`rls.triggers`). */
+type RlsTrigger = {
+  /** The trigger name; `permdock_` is reserved for generated triggers. */
+  readonly name: string;
+  readonly when: "before" | "after";
+  readonly events: readonly ("insert" | "update" | "delete" | "truncate")[];
+  /** Default `row`. */
+  readonly level?: "row" | "statement";
+  /** `schema.function`, a trigger function that already exists. */
+  readonly function: string;
+  /** String arguments passed to the trigger function. */
+  readonly args?: readonly string[];
+};
+/**
+ * `rls.audit`: one `select <function>('<schema>.<table>'::regclass, <args>)`
+ * per generated table, for an audit module that registers a table by
+ * creating its own trigger.
+ */
+type RlsAudit = {
+  /** `schema.function` taking the table as its first argument. */
+  readonly function: string;
+  /** Generated tables, without the schema. Default the custom-role tables and `user_roles`, those this run creates. */
+  readonly tables?: readonly string[];
+  /** Named text arguments: `{ tenant_column: 'tenant_id' }` passes `tenant_column => 'tenant_id'`. */
+  readonly args?: Readonly<Record<string, string>>;
+};
 /** `rls.shims`: where the legacy-named wrappers go. */
 type RlsShimsConfig = {
   /** Schema of the legacy helpers. Default `public`. */
@@ -365,6 +454,9 @@ type RlsActions = Readonly<Record<string, "select" | "insert" | "update" | "dele
 type RlsMigrateHelper = {
   readonly form: "ids" | "row" | "membership";
   readonly scope: string;
+} | {
+  readonly form: "role";
+  readonly scope: string;
 } | {
   readonly form: "scoped";
 } | {
@@ -381,6 +473,17 @@ type RlsMigrateConfig = {
   readonly globalScopes?: readonly string[];
   /** For `scoped` helpers, a scope literal's PermDock scope when the names differ. */
   readonly scopes?: Readonly<Record<string, string>>;
+  /**
+   * Materialised permission tables to retire, by `schema.table`: a table the
+   * application keeps in step with triggers and reads instead of the grants.
+   * `rls migrate --retire-out` drops it with its refresh triggers once
+   * nothing else reads it.
+   */
+  readonly tables?: Readonly<Record<string, RlsMigrateTable>>;
+};
+type RlsMigrateTable = {
+  /** The functions that keep the table in step. Default: every function in `--sql` whose body writes it, and every function that calls one. */
+  readonly refresh?: readonly string[];
 };
 /** Where global roles live: `table (user, role)`. Defaults `user_id` and `role`. */
 type GlobalRoles = {
@@ -422,7 +525,7 @@ type RlsStorage = {
 };
 /** `permdock supabase hook generate` input. */
 type SupabaseHookConfig = {
-  /** The same `fromTable` / `fromJunction` sources the app passes as `memberships`. */
+  /** The same `tableMembershipSource` / `junctionMembershipSource` sources the app passes as `memberships`. */
   readonly memberships: readonly SqlMembershipSource[];
   /** Schema of the hook and the version table. Default `rls.schema`, else `permdock`. */
   readonly schema?: string;
@@ -487,8 +590,21 @@ type SupabaseHookConfig = {
   readonly suspension?: RlsSuspension;
   readonly out?: string;
 };
+/**
+ * How the project turns SQL into Supabase migrations: `'pg-delta'`
+ * (Declarative Schemas 2.0, `supabase db schema declarative sync`),
+ * `'migra'` (declarative schemas on `supabase db diff`) or `'migrations'`
+ * (hand-written migrations, no declarative schemas).
+ */
+type SupabaseSchemas = "pg-delta" | "migra" | "migrations";
 type SupabaseConfig = {
   readonly hook?: SupabaseHookConfig;
+  /**
+   * The schema workflow `rls generate --split`, `supabase hook generate` and
+   * doctor follow. Default: `'migra'` when `supabase/config.toml` sets
+   * `[experimental.pgdelta] enabled = false`, else `'pg-delta'`.
+   */
+  readonly schemas?: SupabaseSchemas;
 };
 type DoctorConfig = {
   /**
@@ -500,7 +616,7 @@ type DoctorConfig = {
   readonly srcPath?: readonly string[];
   readonly sensitiveActions?: readonly string[];
   readonly memberships?: string;
-  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettings` input) for PD029. */
+  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettingsSource` input) for PD029. */
   readonly credentials?: string;
   /** Globs or directories whose files are client entries for PD001, for frameworks with no `'use client'` convention. */
   readonly clientEntries?: readonly string[];
@@ -512,6 +628,8 @@ type DoctorConfig = {
 type PermDockConfig = {
   readonly permissions?: string;
   readonly policy?: string;
+  /** A module exporting the `defineOperations` map as `operations` or default; `collect` writes it to the catalog's `operations`. */
+  readonly operations?: string;
   readonly collect?: CollectConfig;
   readonly catalog?: CatalogConfig;
   readonly openapi?: {
@@ -530,7 +648,7 @@ type PowerSyncConfig = {
   readonly resources?: readonly string[];
   /** The action whose grants decide which rows sync; default `read`. */
   readonly action?: string;
-  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powersyncSource`; none by default. */
+  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powerSyncSource`; none by default. */
   readonly manifest?: string;
 };
 type CliIo = {
@@ -539,13 +657,23 @@ type CliIo = {
   readonly now?: () => Date;
   readonly fetch?: typeof fetch;
   readonly env?: Readonly<Record<string, string | undefined>>;
-  /** Styled human output; `--no-color` turns it off. Unset is plain. */
+  /** Styled stdout; `--no-color` turns it off. Unset is plain. */
   readonly color?: boolean;
+  /** Styled stderr, decided for that stream on its own. Unset is plain. */
+  readonly errColor?: boolean;
   /** A person at a terminal: commands may prompt. Unset never prompts. */
   readonly interactive?: boolean;
+  /** stdout is a terminal; agent detection reads it. Unset is a pipe. */
+  readonly stdoutIsTty?: boolean;
+  /** stderr is a terminal: progress draws a spinner. Unset prints lines. */
+  readonly stderrIsTty?: boolean;
+  /** Reads all of stdin, for `--*-stdin` secrets. Unset reads nothing. */
+  readonly readStdin?: () => Promise<string>;
+  /** Aborted on SIGINT or SIGTERM. */
+  readonly signal?: AbortSignal;
 };
 type RunResult = {
-  readonly code: 0 | 1 | 2;
+  readonly code: ExitCode;
   readonly stdout: string;
   readonly stderr: string;
 };