permdock 0.4.0 → 0.5.0

package/dist/hosted-DBDX0M-P.d.ts

@@ -0,0 +1,78 @@
+import { T as Policy, a as ApprovalRequirement, bn as Grantee, lr as Condition } from "./policy-types-DzwivBgR.js";
+//#region src/core/hosted.d.ts
+/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
+type HostedGrant = {
+  readonly id: string;
+  readonly permission: string;
+  readonly effect?: "allow" | "deny";
+  readonly to: Grantee | readonly Grantee[];
+  readonly where?: Condition;
+  readonly check?: Condition;
+  readonly approval?: "human" | ApprovalRequirement;
+  readonly fields?: readonly string[];
+};
+/**
+ * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy`
+ * claim carries every field but `id` and `issuedAt`, which are the token's
+ * `jti` and `iat` (`policyDocumentFromClaims`).
+ */
+type PolicyDocument = {
+  readonly v: 1;
+  readonly id: string;
+  readonly fingerprint: string;
+  /** The catalog fingerprint the document was authored against. */
+  readonly catalog: string;
+  /** RFC 3339. */
+  readonly issuedAt: string;
+  readonly grants: readonly HostedGrant[];
+};
+/**
+ * The channel for hosted grants. `getPermDock` reads `current()` once;
+ * the application calls `refresh()` on its own schedule, never a check.
+ */
+type PolicySource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  current(): PolicyDocument | null;
+  refresh(): Promise<void>;
+};
+type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
+/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
+type HostedGrantDropped = {
+  readonly kind: "hosted-grant-dropped";
+  readonly document: string;
+  readonly grant: string;
+  readonly reason: HostedGrantDropReason;
+};
+declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
+/** Validates the document envelope; per-grant checks happen at merge time. */
+declare function parsePolicyDocument(json: unknown): PolicyDocument;
+/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+declare function isPortableCondition(value: unknown): value is Condition;
+/**
+ * The code policy plus the hosted grants that pass every rule. Hosted
+ * allows OR with code allows and any deny still wins, so a hosted grant can
+ * never override a code deny; one that fails a rule is dropped, not thrown.
+ */
+declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
+  readonly policy: Policy;
+  readonly dropped: readonly HostedGrantDropped[];
+};
+/**
+ * Hosted grants as an instance option: `policies: hostedPolicies(source)`.
+ * The merge code ships only with an app that imports this function.
+ * `source.current()` is read once per instance; a throw keeps the code
+ * policy and is reported as an error event.
+ */
+type HostedPolicies = {
+  readonly feature: "hosted-policies";
+  readonly apply: (policy: Policy) => {
+    readonly policy: Policy;
+    readonly errors: readonly unknown[];
+  };
+};
+declare function hostedPolicies(source: PolicySource): HostedPolicies;
+//#endregion
+export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };

package/dist/{http-DPuDaChb.d.ts → http-B_LphE5Y.d.ts}

@@ -7,7 +7,6 @@ type NodeRequest = IncomingMessage & {
 };
 declare function toRequest(req: NodeRequest, stream?: IncomingMessage | null): Request;
 declare function sendResponse(res: ServerResponse, response: Response): Promise<void>;
-declare const fromResponse: typeof sendResponse;
 declare function isServerResponse(value: unknown): value is ServerResponse;
 //#endregion
-export { toRequest as a, sendResponse as i, fromResponse as n, isServerResponse as r, NodeRequest as t };
+export { toRequest as i, isServerResponse as n, sendResponse as r, NodeRequest as t };

package/dist/http-DXJ37RDA.js

@@ -0,0 +1,46 @@
+import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
+import { s as cliVersion } from "./version-CEbQ5UeM.js";
+import "./device-BARQ8eYG.js";
+//#region src/cli/core/http.ts
+/** `permdock-cli/<version> node/<version> <platform>`, sent on every request the CLI makes. */
+function userAgent() {
+	return `permdock-cli/${cliVersion()} node/${process.versions.node} ${process.platform}`;
+}
+/**
+* Every outbound request: the user agent, a timeout joined to the run's
+* abort signal, and a `network_error` CLI error when nothing answers.
+*/
+async function httpRequest(io, request) {
+	const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+	try {
+		return await fetchImpl(request.url, {
+			method: request.method ?? "GET",
+			headers: {
+				"user-agent": userAgent(),
+				...request.headers
+			},
+			...request.body === void 0 ? {} : { body: request.body },
+			signal: timeoutSignal(request.timeoutMs ?? 1e4, io.signal)
+		});
+	} catch (error) {
+		throw new CliError("unavailable", `${request.service} unreachable: ${describeError(error)}`, {
+			code: "network_error",
+			cause: error
+		});
+	}
+}
+/**
+* A 401 or 403 as an `auth_required` action: the credential is missing,
+* expired or lacks a scope, and `next` says how to get one.
+*/
+function authFailure(response, message, next) {
+	if (response.status !== 401 && response.status !== 403) return;
+	return new CliError("action", `${message} (HTTP ${String(response.status)})`, {
+		code: "auth_required",
+		extensions: { status: response.status },
+		next
+	});
+}
+//#endregion
+export { httpRequest as n, authFailure as t };

package/dist/{http-BEbdMZ05.js → http-ujKm0JXE.js}

@@ -65,9 +65,8 @@ async function sendResponse(res, response) {
 	const body = Buffer.from(await response.arrayBuffer());
 	res.end(body);
 }
-const fromResponse = sendResponse;
 function isServerResponse(value) {
 	return typeof value === "object" && value !== null && "setHeader" in value && typeof value.setHeader === "function" && "end" in value;
 }
 //#endregion
-export { toRequest as i, isServerResponse as n, sendResponse as r, fromResponse as t };
+export { sendResponse as n, toRequest as r, isServerResponse as t };

package/dist/{import-UHk1N7vH.js → import-CNV7I2Dw.js}

@@ -1,10 +1,12 @@
-import { t as validateOpenapi } from "./schema-Bol6gqXA.js";
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as httpRequest } from "./http-DXJ37RDA.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { t as validateOpenapi } from "./schema-yLuBWWsh.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js
 const ALIAS = Symbol.for("yaml.alias");
 const DOC = Symbol.for("yaml.document");
@@ -5813,15 +5815,15 @@ function readMap(cwd, file) {
 	return map;
 }
 async function readSource(cwd, doc, io) {
-	if (/^https?:\/\//u.test(doc)) {
-		const fetcher = io.fetch ?? globalThis.fetch;
-		try {
-			const response = await fetcher(doc);
-			if (!response.ok) return `could not fetch ${doc}: HTTP ${response.status}`;
-			return { text: await response.text() };
-		} catch {
-			return `could not fetch ${doc}`;
-		}
+	if (/^https?:\/\//u.test(doc)) try {
+		const response = await httpRequest(io, {
+			url: doc,
+			service: doc
+		});
+		if (!response.ok) return `could not fetch ${doc}: HTTP ${response.status}`;
+		return { text: await response.text() };
+	} catch {
+		return `could not fetch ${doc}`;
 	}
 	const path = resolve(cwd, doc);
 	if (!existsSync(path)) return `document not found: ${doc}`;
@@ -5940,14 +5942,17 @@ async function runOpenapiImport(input) {
 		};
 		return input.schema === void 0 ? resource : Object.assign(resource, { schema: schemaExpression(input.schema, entry.schema ?? { type: "object" }, resolveRef) });
 	});
-	const outPath = resolve(input.cwd, input.out);
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, emitPermissionsModule({
-		generator: "openapi import",
-		schema: input.schema,
-		resources
-	}));
-	if (input.annotate && source.local !== void 0) writeFileSync(source.local, annotated(source.text, parsed.yaml, document, permissions));
+	applyFiles(input.cwd, [{
+		path: input.out,
+		text: emitPermissionsModule({
+			generator: "openapi import",
+			schema: input.schema,
+			resources
+		})
+	}, ...input.annotate && source.local !== void 0 ? [{
+		path: source.local,
+		text: annotated(source.text, parsed.yaml, document, permissions)
+	}] : []]);
 	const leaves = resources.reduce((total, item) => total + Object.keys(item.actions).length + Object.keys(item.collection).length, 0);
 	return {
 		code: 0,

package/dist/{import-BFIlhetD.js → import-DMmOG27O.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { n as escapeSqlIdent, o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-1uhI-e-b.js";
-import { Z as pgConnector } from "./permission-keys-B26jeyUv.js";
-import { t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-CD11nBbC.js";
+import { f as pgConnector } from "./policies-CO1oOymN.js";
+import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -89,33 +89,50 @@ function selectFromTable(selectNode) {
 	const relname = asNode$1(asNode$1(from[0])?.["RangeVar"])?.["relname"];
 	return typeof relname === "string" ? relname : void 0;
 }
-function sublinkTable(value, kinds) {
+function sublinkSelect(value, kinds) {
 	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
 	if (sub === void 0) return;
 	const kind = sub["subLinkType"];
 	if (kind === void 0 || !kinds.has(kind)) return;
-	return selectFromTable(sub["subselect"]);
-}
-function membershipTable(value) {
-	const exists = sublinkTable(value, /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]));
-	if (exists !== void 0) return exists;
-	const anyDirect = sublinkTable(value, /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		2
-	]));
-	if (anyDirect !== void 0) return anyDirect;
-	const expr = asNode$1(asNode$1(unwrap(value))?.["A_Expr"]);
+	return selectFromTable(sub["subselect"]) === void 0 ? void 0 : sub["subselect"];
+}
+const EXISTS = /* @__PURE__ */ new Set(["EXISTS_SUBLINK", 0]);
+const IN_OR_ANY = /* @__PURE__ */ new Set([
+	"ANY_SUBLINK",
+	"IN_SUBLINK",
+	2
+]);
+function subquery(select, field) {
+	const table = selectFromTable(select);
+	if (table === void 0) return;
+	return field === void 0 ? {
+		select,
+		table
+	} : {
+		select,
+		table,
+		field
+	};
+}
+function membershipSubquery(value) {
+	const node = asNode$1(unwrap(value));
+	const exists = sublinkSelect(value, EXISTS);
+	if (exists !== void 0) return subquery(exists, void 0);
+	const sub = asNode$1(node?.["SubLink"]);
+	const anyDirect = sublinkSelect(value, IN_OR_ANY);
+	if (anyDirect !== void 0) return subquery(anyDirect, columnName(sub?.["testexpr"]));
+	const expr = asNode$1(node?.["A_Expr"]);
 	if (expr === void 0) return;
-	const fromRight = sublinkTable(unwrap(expr["rexpr"]), /* @__PURE__ */ new Set([
-		"ANY_SUBLINK",
-		"IN_SUBLINK",
-		"EXISTS_SUBLINK",
-		0,
-		2
-	]));
-	if (fromRight !== void 0) return fromRight;
-	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return selectFromTable(expr["rexpr"][0]);
+	const right = unwrap(expr["rexpr"]);
+	const existsRight = sublinkSelect(right, EXISTS);
+	if (existsRight !== void 0) return subquery(existsRight, void 0);
+	const anyRight = sublinkSelect(right, IN_OR_ANY);
+	if (anyRight !== void 0) return subquery(anyRight, columnName(expr["lexpr"]));
+	if (Array.isArray(expr["rexpr"]) && expr["rexpr"][0] !== void 0) return subquery(expr["rexpr"][0], columnName(expr["lexpr"]));
+}
+/** The `where` clause of a `select` node. */
+function selectWhere(selectNode) {
+	return asNode$1(asNode$1(selectNode)?.["SelectStmt"])?.["whereClause"];
 }
 function operatorName(value) {
 	const names = asNode$1(asNode$1(unwrap(value))?.["A_Expr"])?.["name"];
@@ -183,6 +200,122 @@ function isJwtCall(value) {
 	return name === "auth.jwt" || name === "auth.session";
 }
 //#endregion
+//#region src/cli/rls/import-membership.ts
+/**
+* What the `where` of a membership subquery on `table` says, or `undefined`
+* when any part of it cannot be read as one. A subquery imports as
+* `memberOf` only when it binds the membership row to the signed-in user
+* and to the policy row, and filters roles with string literals at most:
+* a predicate left unread would widen the imported condition.
+*/
+function membershipRoles(subquery, table) {
+	const where = selectWhere(subquery.select);
+	if (where === void 0) return;
+	const scopeColumns = new Set([
+		...Object.values(table.columns ?? {}),
+		table.tenant,
+		table.team,
+		table.id
+	].filter((column) => column !== void 0));
+	if (subquery.field !== void 0 && !scopeColumns.has(selectTarget(subquery.select) ?? "")) return;
+	const roleColumn = typeof table.role === "string" ? table.role : void 0;
+	const roles = [];
+	let user = false;
+	let field = subquery.field;
+	for (const conjunct of conjuncts(where)) {
+		const read = readConjunct(conjunct, table, roleColumn, scopeColumns);
+		if (read === void 0) return;
+		if (read.kind === "user") user = true;
+		else if (read.kind === "row") {
+			if (field !== void 0 && field !== read.field) return;
+			field = read.field;
+		} else if (read.kind === "roles") roles.push(...read.roles);
+	}
+	return user && field !== void 0 ? {
+		field,
+		roles: [...new Set(roles)]
+	} : void 0;
+}
+/** The column a `select <column> from …` returns. */
+function selectTarget(select) {
+	const targets = asNode$1(asNode$1(select)?.["SelectStmt"])?.["targetList"];
+	if (!Array.isArray(targets) || targets.length !== 1) return;
+	return columnName(asNode$1(asNode$1(targets[0])?.["ResTarget"])?.["val"]);
+}
+function conjuncts(value) {
+	if (boolOp(value) !== "and") return [value];
+	const args = asNode$1(asNode$1(unwrap(value))?.["BoolExpr"])?.["args"];
+	return Array.isArray(args) ? args.flatMap((arg) => conjuncts(arg)) : [];
+}
+function readConjunct(value, table, roleColumn, scopeColumns) {
+	const node = asNode$1(unwrap(value));
+	const nullTest = asNode$1(node?.["NullTest"]);
+	if (nullTest !== void 0) {
+		const column = columnName(nullTest["arg"]);
+		return (nullTest["nulltesttype"] === "IS_NULL" || nullTest["nulltesttype"] === 0 || nullTest["nulltesttype"] === void 0) && column !== void 0 && (column === table.disabledAt || column === table.expiresAt) ? { kind: "active" } : void 0;
+	}
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0 || operatorName(node) !== "=") return;
+	const kind = expr["kind"];
+	const left = columnName(expr["lexpr"]);
+	if (kind === "AEXPR_OP_ANY" || kind === 2) {
+		const elements = asNode$1(asNode$1(unwrap(expr["rexpr"]))?.["A_ArrayExpr"])?.["elements"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(elements) || elements.length === 0) return;
+		const values = elements.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	if (kind === "AEXPR_IN" || kind === 7) {
+		const raw = expr["rexpr"];
+		const items = asNode$1(raw)?.["List"];
+		const list = Array.isArray(raw) ? raw : asNode$1(items)?.["items"];
+		if (left === void 0 || left !== roleColumn || !Array.isArray(list) || list.length === 0) return;
+		const values = list.map((item) => constValue(item));
+		return values.every((item) => typeof item === "string") ? {
+			kind: "roles",
+			roles: values
+		} : void 0;
+	}
+	const right = columnName(expr["rexpr"]);
+	for (const [column, other, otherColumn] of [[
+		left,
+		expr["rexpr"],
+		right
+	], [
+		right,
+		expr["lexpr"],
+		left
+	]]) {
+		if (column === void 0) continue;
+		if (column === table.user && (isAuthUid(other) || isCurrentSettingUserId(other))) return { kind: "user" };
+		if (column === roleColumn) {
+			const role = constValue(other);
+			return typeof role === "string" ? {
+				kind: "roles",
+				roles: [role]
+			} : void 0;
+		}
+		if (scopeColumns.has(column) && otherColumn !== void 0) return {
+			kind: "row",
+			field: otherColumn
+		};
+	}
+}
+/**
+* `condition` with every `memberOf` role read through `rls.roleValues`, so a
+* legacy role value imports as the PermDock role it stands for.
+*/
+function mapRoleValues(condition, roleValues) {
+	if (roleValues === void 0 || condition === null) return condition;
+	if (Array.isArray(condition)) return condition.map((item) => mapRoleValues(item, roleValues));
+	if (typeof condition !== "object") return condition;
+	const mapped = Object.fromEntries(Object.entries(condition).map(([key, value]) => [key, mapRoleValues(value, roleValues)]));
+	if (mapped["op"] === "memberOf" && Array.isArray(mapped["roles"])) mapped["roles"] = mapped["roles"].map((role) => typeof role === "string" && Object.hasOwn(roleValues, role) ? roleValues[role] : role);
+	return mapped;
+}
+//#endregion
 //#region src/cli/rls/import-ast.ts
 async function conditionFromAst(sql, memberships, functions, unmapped, joins = [], seeds = []) {
 	if (sql === void 0 || sql.trim() === "" || sql.trim() === "true") return {
@@ -407,29 +540,25 @@ function mapNode(value, ctx) {
 			conditions: children
 		};
 	}
-	const table = membershipTable(node);
-	if (table !== void 0) {
-		for (const [scope, mapped] of Object.entries(memberships?.scopes ?? {})) {
-			const column = mapped.columns?.[scope];
-			if (mapped.table === table && column !== void 0) return {
-				op: "memberOf",
-				scope,
-				field: column,
-				roles: []
-			};
+	const subquery = membershipSubquery(node);
+	if (subquery !== void 0) {
+		const { table } = subquery;
+		const mappedScopes = Object.entries(memberships?.scopes ?? {});
+		if (memberships?.tenant !== void 0) mappedScopes.push(["tenant", memberships.tenant]);
+		if (memberships?.team !== void 0) mappedScopes.push(["team", memberships.team]);
+		const matches = mappedScopes.filter(([, mapped]) => mapped.table === table);
+		if (matches.length > 0) {
+			for (const [scope, mapped] of matches) {
+				const read = membershipRoles(subquery, mapped);
+				if (read !== void 0) return {
+					op: "memberOf",
+					scope,
+					field: read.field,
+					roles: read.roles
+				};
+			}
+			return;
 		}
-		if (memberships?.tenant?.table === table) return {
-			op: "memberOf",
-			scope: "tenant",
-			field: memberships.tenant.tenant ?? "tenant_id",
-			roles: []
-		};
-		if (memberships?.team?.table === table) return {
-			op: "memberOf",
-			scope: "team",
-			field: memberships.team.team ?? "team_id",
-			roles: []
-		};
 		joins.push(table);
 		return;
 	}
@@ -802,7 +931,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 	});
 }
 function assertNoServiceRole(sql) {
-	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw new Error("PermDock CLI: imported SQL must never target service_role");
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
 }
 async function seedsFromDb(query) {
 	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
@@ -883,7 +1012,7 @@ async function runRlsImport(input) {
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
 	} else if (input.db !== void 0) try {
-		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db"));
+		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db-url-stdin", input.cwd));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
 		seeds = fromDb.seeds;
@@ -893,16 +1022,24 @@ async function runRlsImport(input) {
 	}
 	else return {
 		code: 2,
-		output: "PermDock CLI: rls import needs --sql <file> or --db <url>"
+		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
 	};
 	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
+	const roleValues = input.config.rls?.roleValues;
+	if (roleValues !== void 0) seeds = seeds.map((row) => {
+		const mapped = Object.hasOwn(roleValues, row.role) ? roleValues[row.role] : void 0;
+		return mapped === void 0 ? row : {
+			...row,
+			role: mapped
+		};
+	});
 	const functions = input.config.rls?.functions;
 	const unmapped = [];
 	const joins = [];
 	const catalog = [];
 	for (const item of policies) {
 		const sourceSql = item.using ?? item.check ?? "true";
-		const condition = await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds);
+		const condition = mapRoleValues(await conditionFromAst(item.using ?? item.check, memberships, functions, unmapped, joins, seeds), input.config.rls?.roleValues);
 		const grants = await helperGrants(item.using ?? item.check, memberships, functions, seeds);
 		catalog.push({
 			table: item.table,

package/dist/index-BcHcPyIo.d.ts

@@ -0,0 +1,110 @@
+import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { t as Operation } from "./operations-CxybZErY.js";
+import { p as PrincipalSource, r as PermDock } from "./permdock-D7eeLJER.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-DX0LaKTb.js";
+import { l as WebhookSigner } from "./standard-webhooks-6lg8v_is.js";
+//#region src/delivery/audience.d.ts
+type Audience = {
+  /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */
+  readonly principals: readonly string[];
+  /** `false` when `whoCan` could not list every holder: someone granted may be missing. */
+  readonly complete: boolean;
+};
+type AudienceOptions = {
+  /** Check only these principals instead of listing holders with `whoCan`. */
+  readonly candidates?: readonly string[];
+};
+/**
+ * Who may receive a delivery about `row`: the holders `whoCan` lists (or
+ * `candidates`), kept only where `decideFor` grants `permission` in the
+ * sender's active tenant. A collection permission has no holders to list,
+ * so it needs `candidates`; without them it is empty and incomplete.
+ */
+declare function audience(permdock: PermDock, permission: Permission, row: unknown, options?: AudienceOptions): Promise<Audience>;
+/** One event a subscriber may receive: the permission its row needs. */
+type SubscriberEvent = {
+  readonly permission: Permission;
+  readonly row?: unknown;
+};
+/**
+ * The subscribers whose principal `decideFor` grants the event's
+ * permission on its row, in their order: the per-event filter for webhook
+ * endpoints and realtime channels. A subscriber without a string
+ * `principal` is dropped.
+ */
+declare function subscribersFor<S extends {
+  readonly principal: string;
+}>(permdock: PermDock, event: SubscriberEvent, subscribers: readonly S[]): Promise<S[]>;
+//#endregion
+//#region src/delivery/memory-transport.d.ts
+type MemoryDelivery<C extends DeliveryChannel> = {
+  readonly target: DeliveryTarget<C>;
+  readonly message: TransportMessages[C];
+  readonly options: TransportOptions;
+};
+type MemoryDeliveryTransport<C extends DeliveryChannel> = DeliveryTransport<C> & {
+  /** Every delivery `respond` answered `sent` for, oldest first. */
+  readonly deliveries: readonly MemoryDelivery<C>[];
+};
+type MemoryDeliveryTransportOptions<C extends DeliveryChannel> = {
+  /** The result per delivery; defaults to `sent`. A throw propagates, as from a provider client. */
+  readonly respond?: (target: DeliveryTarget<C>, message: TransportMessages[C]) => DeliveryResult;
+};
+/** An in-process transport for tests and examples: it records what it would have sent. */
+declare function memoryDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: MemoryDeliveryTransportOptions<C>): MemoryDeliveryTransport<C>;
+//#endregion
+//#region src/delivery/router.d.ts
+type DeliveryPermDockOptions = {
+  readonly transports: DeliveryTransports;
+  /** Resolves `{ address }` recipients through `principalByIdentity`. */
+  readonly principals?: PrincipalSource;
+  /** Receives one `delivery` event per recipient. A throw is ignored. */
+  readonly sink?: DecisionSink;
+  /** The `from` of an email whose message sets none. */
+  readonly from?: string;
+  /** The event `source`; defaults to `permdock`. */
+  readonly source?: string;
+};
+type DeliveryPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /**
+   * Checks every recipient against `target`'s permission on `row` with
+   * `permdock.decideFor`, routes the granted ones to the transport of their
+   * channel, and writes one `delivery` event per recipient. Never rejects:
+   * a refused recipient or a transport error is a `failed` event.
+   */
+  readonly deliver: (permdock: PermDock<V>, target: Permission | Pick<Operation, "name" | "permission">, row: unknown, recipients: readonly Recipient[], messages: Partial<DeliveryMessages>, options?: DeliverOptions) => Promise<DeliveryReport>;
+};
+/** Routes checked recipients to channel transports and records a delivery event for each. */
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(_policy: Policy<TUser, TPrincipal, V>, options: DeliveryPermDockOptions): DeliveryPermDock<V>;
+//#endregion
+//#region src/delivery/target.d.ts
+/**
+ * Whether `value` is a target the router checked for `channel`: a non-empty
+ * address and a granted decision. A transport calls it first and refuses
+ * anything else, so a hand-built recipient never reaches a provider.
+ */
+declare function isDeliveryTarget<C extends DeliveryChannel>(value: unknown, channel: C): value is DeliveryTarget<C>;
+/**
+ * An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
+ * characters (RFC 5321 path limit). Quoted local parts, comments and
+ * domain literals are refused.
+ */
+declare function isAddrSpec(value: string): boolean;
+//#endregion
+//#region src/delivery/webhook-transport.d.ts
+type WebhookTransportOptions = {
+  /** Defaults to the global `fetch`. */
+  readonly fetch?: typeof fetch;
+  /** Milliseconds before a request is aborted as `unavailable`. Defaults to 10000. */
+  readonly timeout?: number;
+};
+/**
+ * Posts each CloudEvent to the target's https endpoint as
+ * `application/cloudevents+json`, signed with the Standard Webhooks
+ * headers. `webhook-id` is the idempotency key, so a retry repeats it and
+ * the receiver drops the duplicate. Redirects are not followed.
+ */
+declare function webhookTransport(signer: WebhookSigner, options?: WebhookTransportOptions): WebhookTransport;
+//#endregion
+export { DeliveryPermDock as a, MemoryDelivery as c, memoryDeliveryTransport as d, Audience as f, subscribersFor as g, audience as h, isDeliveryTarget as i, MemoryDeliveryTransport as l, SubscriberEvent as m, webhookTransport as n, DeliveryPermDockOptions as o, AudienceOptions as p, isAddrSpec as r, createPermDock as s, WebhookTransportOptions as t, MemoryDeliveryTransportOptions as u };

package/dist/index-CaxrMD1A.d.ts

@@ -0,0 +1 @@
+export {}