permdock 0.4.0 → 0.5.0

package/dist/postgrest-CW0IqC-U.js

@@ -0,0 +1,566 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { r as validateRecord } from "./thenable-yD7SabqG.js";
+import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
+import { t as clientNameOf } from "./clients-DjU5ABMy.js";
+import "./budget-NbEtbJC_.js";
+import { a as hookApiNames } from "./sources-vs5dGOsS.js";
+//#region src/supabase/subject.ts
+const REGISTERED = /* @__PURE__ */ new Set([
+	"sub",
+	"role",
+	"iss",
+	"aud",
+	"exp",
+	"iat",
+	"nbf",
+	"aal",
+	"amr",
+	"acr",
+	"session_id",
+	"email",
+	"phone",
+	"is_anonymous",
+	"app_metadata",
+	"user_metadata",
+	"act",
+	"client_id",
+	"scope"
+]);
+/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+function claimNamed(claims, name) {
+	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
+	if (top !== void 0 && top !== null) return top;
+	const meta = claims["app_metadata"];
+	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
+}
+/** A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a function over the claims. */
+function claimAt(claims, path) {
+	return typeof path === "string" ? claimNamed(claims, path) : readClaim(claims, path);
+}
+function asRoles(value, declared) {
+	const raw = typeof value === "string" ? value === "" ? [] : [value] : Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+	if (declared === void 0) return raw;
+	const allowed = new Set(declared);
+	return raw.filter((role) => allowed.has(role));
+}
+/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+function readMemberships(value) {
+	if (!Array.isArray(value)) return {
+		memberships: [],
+		dropped: []
+	};
+	const out = [];
+	const dropped = [];
+	for (const [index, item] of value.entries()) {
+		const membership = asMembership(item);
+		if (membership === void 0) dropped.push(index);
+		else out.push(membership);
+	}
+	return {
+		memberships: out,
+		dropped
+	};
+}
+function asMembership(item) {
+	if (!isRecord(item) || !Array.isArray(item["roles"])) return;
+	const roles = item["roles"].filter((role) => typeof role === "string");
+	if (roles.length === 0) return;
+	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
+	const id = typeof item["id"] === "string" ? item["id"] : void 0;
+	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
+	const team = typeof item["team"] === "string" ? item["team"] : void 0;
+	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
+	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
+		resource: onRecord["resource"],
+		id: onRecord["id"]
+	} : void 0;
+	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
+	const keep = item["keep"];
+	if (keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
+	return compact({
+		roles,
+		scope,
+		id,
+		within,
+		tenant,
+		team,
+		on,
+		via: typeof item["via"] === "string" ? item["via"] : void 0,
+		expiresAt: typeof item["expires_at"] === "number" ? item["expires_at"] : void 0,
+		grantedBy: typeof item["granted_by"] === "string" ? item["granted_by"] : void 0,
+		reason: typeof item["reason"] === "string" ? item["reason"] : void 0,
+		member: memberOf(item["member"]),
+		managedBy: item["managed_by"] === "idp" ? "idp" : void 0,
+		entitlements: Array.isArray(item["entitlements"]) ? item["entitlements"].filter((seat) => typeof seat === "string") : void 0,
+		keep: keep === void 0 ? void 0 : asStrings(keep)
+	});
+}
+function memberOf(value) {
+	if (value === null || typeof value !== "object" || !Object.hasOwn(value, "group")) return;
+	const group = value.group;
+	return typeof group === "string" && group !== "" ? { group } : void 0;
+}
+function asStrings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+function plansFor(claims, name, tenant) {
+	if (name === void 0 || tenant === void 0) return [];
+	const byTenant = claimAt(claims, name);
+	if (!isRecord(byTenant) || !Object.hasOwn(byTenant, tenant)) return [];
+	return asStrings(byTenant[tenant]);
+}
+const INVALID_CHAIN = Object.freeze({
+	ok: false,
+	reason: "invalid-chain"
+});
+const NO_ACTOR = Object.freeze({ ok: true });
+/** Own entries of one `act` level, with the nested `act` copied the same way. */
+function copyAct(level) {
+	const entries = Object.entries(level).map(([key, value]) => [key, key === "act" && isRecord(value) ? copyAct(value) : value]);
+	return Object.fromEntries(entries);
+}
+function isToolList(value) {
+	return Array.isArray(value) && value.every((tool) => typeof tool === "string" && tool !== "");
+}
+/**
+* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
+* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
+* as the user, `agent` an agent run with the `tools` it may call. Any other `kind`, a support level
+* without `session_id`, and an agent level with `session_id`, `tools` that are not non-empty
+* strings or a `read_only` that is not a boolean are invalid, as better-supabase reads them.
+*/
+function actingParty(outer, id) {
+	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
+	const kind = marked === void 0 && Object.hasOwn(outer, "session_id") ? "support" : marked;
+	const chain = copyAct(outer);
+	const reason = typeof outer["reason"] === "string" ? outer["reason"] : void 0;
+	switch (kind) {
+		case void 0: return freezeDeep({
+			ok: true,
+			actor: {
+				id,
+				kind: "oauth-client",
+				chain
+			}
+		});
+		case "support": {
+			const session = outer["session_id"];
+			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : true;
+			if (typeof session !== "string" || session === "" || typeof readOnly !== "boolean") return INVALID_CHAIN;
+			return freezeDeep({
+				ok: true,
+				actor: compact({
+					id,
+					kind: "support",
+					sessionId: session,
+					readOnly,
+					reason,
+					chain
+				})
+			});
+		}
+		case "impersonation": return freezeDeep({
+			ok: true,
+			actor: compact({
+				id,
+				kind: "impersonation",
+				reason,
+				chain
+			})
+		});
+		case "agent": {
+			const tools = Object.hasOwn(outer, "tools") ? outer["tools"] : void 0;
+			const readOnly = Object.hasOwn(outer, "read_only") ? outer["read_only"] : false;
+			if (Object.hasOwn(outer, "session_id") || tools !== void 0 && !isToolList(tools) || typeof readOnly !== "boolean") return INVALID_CHAIN;
+			return freezeDeep({
+				ok: true,
+				actor: compact({
+					id,
+					kind: "agent",
+					tools,
+					readOnly,
+					chain
+				})
+			});
+		}
+		default: return INVALID_CHAIN;
+	}
+}
+function readActor(claims) {
+	if (Object.hasOwn(claims, "act") && claims["act"] !== void 0) {
+		let current = claims["act"];
+		while (current !== void 0) {
+			const level = isRecord(current) ? current["sub"] : void 0;
+			if (!isRecord(current) || typeof level !== "string" || level === "") return INVALID_CHAIN;
+			current = Object.hasOwn(current, "act") ? current["act"] : void 0;
+		}
+		const outer = claims["act"];
+		const sub = isRecord(outer) ? outer["sub"] : void 0;
+		if (!isRecord(outer) || typeof sub !== "string") return INVALID_CHAIN;
+		return actingParty(outer, sub);
+	}
+	const client = Object.hasOwn(claims, "client_id") ? claims["client_id"] : void 0;
+	if (typeof client === "string" && client !== "") return freezeDeep({
+		ok: true,
+		actor: {
+			id: client,
+			kind: "oauth-client"
+		}
+	});
+	return NO_ACTOR;
+}
+/**
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
+* actor; nested levels are prior actors, kept on `chain` for audit), else the
+* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
+* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
+* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
+* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
+* is `{ ok: false }` and must deny.
+*/
+function actorOf(claims) {
+	try {
+		return isRecord(claims) ? readActor(claims) : NO_ACTOR;
+	} catch {
+		return INVALID_CHAIN;
+	}
+}
+const IDENTITY_SCOPES = /* @__PURE__ */ new Set([
+	"openid",
+	"profile",
+	"email",
+	"address",
+	"phone",
+	"offline_access"
+]);
+/**
+* The OAuth `scope` claim (a space-separated string or a list) as `scopes`,
+* without the OpenID Connect identity scopes; `undefined` when none is left.
+*/
+function delegationOf(claims) {
+	try {
+		if (!isRecord(claims) || !Object.hasOwn(claims, "scope")) return;
+		const scope = claims["scope"];
+		const scopes = (typeof scope === "string" ? scope.split(/\s+/u).filter(Boolean) : asStrings(scope)).filter((name) => !IDENTITY_SCOPES.has(name));
+		return scopes.length > 0 ? freezeDeep({ scopes }) : void 0;
+	} catch {
+		return;
+	}
+}
+function subjectDelegation(claims, chain) {
+	const delegation = compact({
+		scopes: delegationOf(claims)?.scopes,
+		chain
+	});
+	return Object.keys(delegation).length === 0 ? void 0 : delegation;
+}
+function emit(options, reason, cause) {
+	try {
+		options.onAuth?.({
+			reason,
+			cause,
+			source: "supabase"
+		});
+	} catch {}
+}
+function extraClaims(claims) {
+	const extra = {};
+	const meta = claims["app_metadata"];
+	if (isRecord(meta)) for (const [key, value] of Object.entries(meta)) extra[key] = value;
+	for (const [key, value] of Object.entries(claims)) {
+		if (REGISTERED.has(key) || key === "user_metadata") continue;
+		extra[key] = value;
+	}
+	return extra;
+}
+function subjectActor(actor, options) {
+	switch (actor.kind) {
+		case "support": return {
+			id: actor.id,
+			kind: actor.kind,
+			sessionId: actor.sessionId,
+			readOnly: actor.readOnly
+		};
+		case "oauth-client": return compact({
+			id: actor.id,
+			kind: actor.kind,
+			client: clientNameOf(options.clients, actor.id)
+		});
+		case "impersonation": return {
+			id: actor.id,
+			kind: actor.kind
+		};
+		case "agent": return compact({
+			id: actor.id,
+			kind: actor.kind,
+			tools: actor.tools,
+			readOnly: actor.readOnly
+		});
+		default: return actor;
+	}
+}
+function mapClaims(claims, options) {
+	const role = claims["role"];
+	if (role === "anon" || role === "service_role") return anonymousSubject();
+	const id = claims["sub"];
+	if (typeof id !== "string" || id === "") return anonymousSubject();
+	const act = readActor(claims);
+	if (!act.ok) {
+		emit(options, "invalid-token", act.reason);
+		return anonymousSubject();
+	}
+	if (options.anonymousSignIns === "deny" && claims["is_anonymous"] === true) return anonymousSubject();
+	const actor = act.actor === void 0 ? void 0 : subjectActor(act.actor, options);
+	const roleClaim = options.claims?.roles ?? "user_role";
+	const tenantClaim = options.claims?.tenant ?? "tenant_id";
+	const membershipsClaim = options.claims?.memberships ?? "memberships";
+	let extra = extraClaims(claims);
+	if (options.schema !== void 0) extra = validateRecord(options.schema, extra) ?? {};
+	const include = new Set(options.include ?? []);
+	const tenantValue = claimAt(claims, tenantClaim);
+	const version = claimAt(claims, "authz_ver");
+	const tenant = typeof tenantValue === "string" ? tenantValue : void 0;
+	const { memberships, dropped } = readMemberships(claimAt(claims, membershipsClaim));
+	if (dropped.length > 0) emit(options, "schema", "membership-dropped");
+	const plans = plansFor(claims, options.claims?.plans, tenant);
+	const principal = compact({
+		id,
+		kind: "user",
+		roles: asRoles(claimAt(claims, roleClaim), options.declared),
+		tenant,
+		plans: plans.length > 0 ? plans : void 0,
+		memberships,
+		membershipsTruncated: claimAt(claims, "memberships_truncated") === true ? true : void 0,
+		authzVersion: typeof version === "number" && Number.isInteger(version) ? version : void 0,
+		issuer: typeof claims["iss"] === "string" ? claims["iss"] : void 0,
+		assurance: typeof claims["aal"] === "string" ? { acr: claims["aal"] } : void 0,
+		claims: Object.keys(extra).length === 0 ? void 0 : extra,
+		email: include.has("email") && typeof claims["email"] === "string" ? claims["email"] : void 0,
+		phone: include.has("phone") && typeof claims["phone"] === "string" ? claims["phone"] : void 0,
+		is_anonymous: include.has("is_anonymous") && typeof claims["is_anonymous"] === "boolean" ? claims["is_anonymous"] : void 0
+	});
+	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
+	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+	return freezeDeep(compact({
+		principal,
+		actor,
+		delegation: act.actor?.kind === "oauth-client" || act.actor?.kind === "agent" ? subjectDelegation(claims, act.actor.chain) : void 0,
+		context: {},
+		session,
+		expiresAt,
+		liveSession: options.liveSession === true && session !== void 0 ? true : void 0
+	}));
+}
+function subjectFromSupabase(claims, options = {}) {
+	try {
+		if (!isRecord(claims)) return anonymousSubject();
+		const rest = {};
+		for (const [key, value] of Object.entries(claims)) {
+			if (key === "user_metadata") continue;
+			rest[key] = value;
+		}
+		return mapClaims(rest, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+/**
+* A verified session object (`{ kind, claims }`) in, `Subject` out.
+* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+*/
+function subjectFromSupabaseSession(session, options = {}) {
+	try {
+		if (session === null || session === void 0 || session.kind !== "user") return anonymousSubject();
+		return subjectFromSupabase(session.claims, options);
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+//#region src/supabase/postgrest.ts
+function callRpc(client, schema, fn, args) {
+	return client.schema(schema).rpc(fn, args);
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+function grantOf(value) {
+	if (!isRecord(value) || typeof value["permission"] !== "string") return;
+	return compact({
+		permission: value["permission"],
+		effect: value["effect"] === "deny" ? "deny" : "allow",
+		level: typeof value["level"] === "string" ? value["level"] : void 0
+	});
+}
+function customRoleOf(value) {
+	if (!isRecord(value) || typeof value["name"] !== "string") return;
+	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
+		const grant = grantOf(item);
+		return grant === void 0 ? [] : [grant];
+	}) : [];
+	const includes = strings(value["includes"]);
+	const body = {
+		name: value["name"],
+		grants,
+		...includes.length === 0 ? {} : { includes }
+	};
+	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
+		...body,
+		scope: "global"
+	} : void 0;
+	if (typeof value["tenant"] !== "string") return;
+	return compact({
+		...body,
+		tenant: value["tenant"],
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
+		id: typeof value["id"] === "string" ? value["id"] : void 0
+	});
+}
+function readMemberEntries(value) {
+	if (!Array.isArray(value)) return [];
+	return value.flatMap((item) => {
+		if (!isRecord(item) || !isRecord(item["principal"])) return [];
+		const id = item["principal"]["id"];
+		const [membership] = readMemberships([item["membership"]]).memberships;
+		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
+			principal: { id },
+			membership
+		}] : [];
+	});
+}
+function versionOf(value) {
+	const version = typeof value === "string" ? Number(value) : value;
+	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
+}
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+function readSubjectRecord(value) {
+	if (!isRecord(value) || typeof value["id"] !== "string") return;
+	if (value["active"] !== true) return {
+		id: value["id"],
+		active: false,
+		roles: [],
+		memberships: [],
+		customRoles: []
+	};
+	const version = value["authzVersion"];
+	return compact({
+		id: value["id"],
+		active: true,
+		roles: strings(value["roles"]),
+		memberships: readMemberships(value["memberships"]).memberships,
+		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
+			const role = customRoleOf(item);
+			return role === void 0 ? [] : [role];
+		}) : [],
+		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
+	});
+}
+/**
+* Membership, custom-role and subject sources over the `subject_for(p_user)`,
+* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+* `permdock supabase hook generate` writes, for a backend that reaches
+* Postgres only through PostgREST. `memberships.version` reads only the
+* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+* only for a stale token; when the version function is missing it falls back
+* to `subject_for`. With `policy`, a token that claims a custom role has its
+* subject read in one `subject_for` call instead, and custom roles are read
+* only for a subject that holds one. Each user and each instance is read once per
+* `postgrestSources` call, so create it per request or per job.
+*/
+function postgrestSources(client, options = {}) {
+	const api = options.api;
+	const names = api === void 0 ? void 0 : hookApiNames(api.prefix);
+	const schema = options.schema ?? (api === void 0 ? "permdock" : api.schema ?? "public");
+	const fn = options.fn ?? names?.subjectFor ?? "subject_for";
+	const membersFn = options.membersFn ?? names?.membersOf ?? "members_of";
+	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
+	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
+	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
+	const loaded = /* @__PURE__ */ new Map();
+	const versions = /* @__PURE__ */ new Map();
+	const listed = /* @__PURE__ */ new Map();
+	const list = (query) => {
+		const key = JSON.stringify([query.scope, query.id]);
+		const cached = listed.get(key);
+		if (cached !== void 0) return cached.then((entries) => [...entries]);
+		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
+			p_scope: query.scope,
+			p_id: query.id
+		})).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
+			return readMemberEntries(result.data);
+		});
+		listed.set(key, pending);
+		return pending.then((entries) => [...entries]);
+	};
+	const record = (userId) => {
+		const cached = loaded.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
+			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+			return readSubjectRecord(result.data);
+		});
+		loaded.set(userId, pending);
+		return pending;
+	};
+	const version = (userId) => {
+		const read = loaded.get(userId);
+		if (read !== void 0) return read.then((found) => found?.authzVersion);
+		const cached = versions.get(userId);
+		if (cached !== void 0) return cached;
+		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
+		versions.set(userId, pending);
+		return pending;
+	};
+	const live = async (userId) => {
+		const found = await record(userId);
+		return found?.active === true ? found : void 0;
+	};
+	return {
+		memberships: {
+			async membershipsFor(principal) {
+				return [...(await live(principal.id))?.memberships ?? []];
+			},
+			version(principal) {
+				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
+			},
+			list
+		},
+		customRoles(principal) {
+			return {
+				async rolesFor(tenant, context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
+				},
+				async globalRoles(context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
+				}
+			};
+		},
+		async subject(userId) {
+			const found = await live(userId);
+			if (found === void 0) return {
+				principal: null,
+				context: {}
+			};
+			return {
+				principal: compact({
+					id: found.id,
+					roles: found.roles,
+					memberships: found.memberships,
+					authzVersion: found.authzVersion
+				}),
+				context: {}
+			};
+		},
+		record
+	};
+}
+//#endregion
+export { delegationOf as a, subjectFromSupabaseSession as c, actorOf as i, postgrestSources as n, readMemberships as o, readSubjectRecord as r, subjectFromSupabase as s, callRpc as t };

package/dist/postgrest-NUqZT-RB.d.ts

@@ -0,0 +1,100 @@
+import { $ as MemberEntry, T as Policy, W as CustomRoleSource, Zn as CustomRole, et as MembershipSource, ir as Subject, nr as Membership } from "./policy-types-DzwivBgR.js";
+//#region src/supabase/postgrest.d.ts
+/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+type SupabaseRpcResult = {
+  readonly data: unknown;
+  readonly error: {
+    readonly message: string;
+  } | null;
+};
+/**
+ * The part of a supabase-js client `postgrestSources` calls:
+ * `client.schema(name).rpc(fn, args)`. Pass a client that may execute the
+ * function, such as a `service_role` client after the grant the docs show.
+ */
+type SupabaseRpcClient = {
+  schema(name: string): {
+    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type SupabaseRpcCaller = {
+  schema(name: never): {
+    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  };
+};
+type PostgrestSourcesOptions = {
+  /**
+   * The `supabase.hook.api` setting the hook file was generated with: the
+   * wrappers live in `schema` (default `public`) as `<prefix>subject_for`,
+   * `<prefix>members_of` and `<prefix>authz_version_for` (default prefix
+   * `permdock_`). It sets the defaults of `schema`, `fn`, `membersFn` and
+   * `versionFn`, which still override it.
+   */
+  readonly api?: {
+    readonly schema?: string;
+    readonly prefix?: string;
+  };
+  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  readonly schema?: string;
+  /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
+  readonly fn?: string;
+  readonly membersFn?: string;
+  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  readonly versionFn?: string;
+  /**
+   * The policy whose declared roles tell custom roles apart. With it,
+   * `customRoles` reads nothing while every role the subject holds is
+   * declared, and `memberships.version` reads the whole subject in one call
+   * when the token claims a custom role, which the custom roles need anyway.
+   */
+  readonly policy?: Policy;
+};
+/** One user as `subject_for(p_user)` returns it. */
+type SubjectRecord = {
+  readonly id: string;
+  /** `false` for a suspended user, who holds no roles or memberships. */
+  readonly active: boolean;
+  readonly roles: readonly string[];
+  readonly memberships: readonly Membership[];
+  readonly customRoles: readonly CustomRole[];
+  readonly authzVersion?: number;
+};
+type PostgrestSources = {
+  /**
+   * Memberships and the authorization version of any principal, and `list`,
+   * the live members of one scope instance through `members_of`, for
+   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
+   * the token was truncated.
+   */
+  readonly memberships: MembershipSource & {
+    list(query: {
+      readonly scope: string;
+      readonly id: string;
+    }): Promise<MemberEntry[]>;
+  };
+  /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
+  customRoles(principal: {
+    readonly id: string;
+  }): CustomRoleSource;
+  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
+  subject(userId: string): Promise<Subject>;
+  /** The raw record, `undefined` for an unknown user. */
+  record(userId: string): Promise<SubjectRecord | undefined>;
+};
+/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
+/**
+ * Membership, custom-role and subject sources over the `subject_for(p_user)`,
+ * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
+ * `permdock supabase hook generate` writes, for a backend that reaches
+ * Postgres only through PostgREST. `memberships.version` reads only the
+ * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
+ * only for a stale token; when the version function is missing it falls back
+ * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * subject read in one `subject_for` call instead, and custom roles are read
+ * only for a subject that holds one. Each user and each instance is read once per
+ * `postgrestSources` call, so create it per request or per job.
+ */
+declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
+//#endregion
+export { SupabaseRpcClient as a, readSubjectRecord as c, SupabaseRpcCaller as i, PostgrestSourcesOptions as n, SupabaseRpcResult as o, SubjectRecord as r, postgrestSources as s, PostgrestSources as t };