permdock 0.4.0 → 0.5.0

package/dist/testing/saas/index.d.ts

@@ -1,7 +1,8 @@
-import { Dr as Membership, Mt as PermDockOptions, Or as Principal, Sr as CustomRole, Y as LimitStore, kr as Subject, tt as RelationSource, vr as Actor, wr as Delegation } from "../../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../../permission-types-Dg39z9Kv.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-COH-KRgT.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-ur0BBK_e.js";
+import { $n as Delegation, Q as LimitStore, Rt as Instant, Zn as CustomRole, ir as Subject, it as RelationSource, nr as Membership, qn as Actor, rr as Principal } from "../../policy-types-DzwivBgR.js";
+import { w as Permission } from "../../vocabulary-D6lPdb4Z.js";
+import { i as PermDockOptions } from "../../permdock-D7eeLJER.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Czo4n3Hs.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";
@@ -121,8 +122,8 @@ type SaasTokenOptions = {
   /** Claim memberships; `false` omits the claim (database mode). Defaults to the seed. */
   readonly memberships?: readonly Membership[] | false;
   readonly ttl?: number;
-  /** Epoch seconds used for `iat`. */
-  readonly now?: number;
+  /** The instant used for `iat`; defaults to the current time. */
+  readonly now?: Instant;
   readonly issuer?: string;
   readonly audience?: string;
   readonly claims?: Readonly<Record<string, unknown>>;
@@ -134,9 +135,9 @@ export declare function signSaasToken(sub: string, options?: SaasTokenOptions):
  * and returns its `sub`, or `null`; never throws. Identity only: memberships
  * and plans come from the seed, never from the token.
  */
-export declare function verifySaasToken(token: string | null | undefined, now?: number): Promise<string | null>;
+export declare function verifySaasToken(token: string | null | undefined, now?: Instant): Promise<string | null>;
 /** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
-export declare function verifySaasSession(token: string | null | undefined, now?: number): Promise<{
+export declare function verifySaasSession(token: string | null | undefined, at?: Instant): Promise<{
   readonly sub: string;
   readonly expiresAt: number;
 } | null>;

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CCJ6lmxB.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DtaA4JuW.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CZKiUfFM.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-FO-Q8oj0.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-COH-KRgT.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1,2 +1 @@
-import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CCJ6lmxB.js";
-export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CZKiUfFM.js";

package/dist/text-BMFRfBqc.js

@@ -0,0 +1,8 @@
+//#region src/cli/shared/text.ts
+/** The text before the first `separator`, or all of it when there is none. */
+function beforeFirst(text, separator) {
+	const at = text.indexOf(separator);
+	return at === -1 ? text : text.slice(0, at);
+}
+//#endregion
+export { beforeFirst as t };

package/dist/{text-diff-BdkkYSbi.js → text-diff-BQcUapOb.js}

@@ -1,5 +1,5 @@
 import { createTwoFilesPatch } from "diff";
-//#region src/cli/text-diff.ts
+//#region src/cli/core/text-diff.ts
 const MAX_LINES = 40;
 /**
 * A unified diff from the file on disk to what the command would write,

package/dist/thenable-yD7SabqG.js

@@ -0,0 +1,31 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+//#region src/core/thenable.ts
+function isThenable(value) {
+	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+function ignoreRejection(value) {
+	Promise.resolve(value).then(void 0, () => void 0);
+}
+/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
+function validateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		return { ok: false };
+	}
+	return result.issues === void 0 ? {
+		ok: true,
+		value: result.value
+	} : {
+		ok: false,
+		issues: result.issues
+	};
+}
+/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
+function validateRecord(schema, value) {
+	const validated = validateSync(schema, value);
+	return validated.ok && isRecord(validated.value) ? validated.value : void 0;
+}
+//#endregion
+export { validateSync as i, isThenable as n, validateRecord as r, ignoreRejection as t };

package/dist/time-DkWjdL98.js

@@ -0,0 +1,71 @@
+//#region src/core/time.ts
+/** RFC 3339 `date-time` in UTC or with an offset; fractional seconds optional. */
+const RFC3339_PATTERN = "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d+)?(?:Z|[+-]\\d{2}:\\d{2})$";
+const RFC3339 = /* @__PURE__ */ new RegExp(RFC3339_PATTERN, "u");
+function isRfc3339(value) {
+	return typeof value === "string" && RFC3339.test(value) && Number.isFinite(Date.parse(value));
+}
+/** Seconds since the epoch as RFC 3339 in UTC. */
+function rfc3339(seconds) {
+	return (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString();
+}
+/** Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a `RangeError` for a value outside the `Date` range. */
+function isoAt(millis) {
+	return new Date(millis).toISOString();
+}
+/** RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function isoNow(now) {
+	return dateAt(now).toISOString();
+}
+/** Whole seconds since the epoch of an RFC 3339 instant; `undefined` for anything else. */
+function secondsOf(value) {
+	return isRfc3339(value) ? Math.floor(Date.parse(value) / 1e3) : void 0;
+}
+/** Whole seconds since the epoch of an RFC 3339 string or an `Instant`; `undefined` for anything else, Unix seconds included. */
+function instantOf(value) {
+	if (typeof value === "string") return secondsOf(value);
+	if (typeof value === "object" && value !== null && "epochMilliseconds" in value && typeof value.epochMilliseconds === "number" && Number.isFinite(value.epochMilliseconds)) return Math.floor(value.epochMilliseconds / 1e3);
+}
+/** A duration: a whole number of seconds above zero, else `undefined`. */
+function durationOf(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
+}
+/** Throws at definition time unless `value` is a whole number of seconds above zero. */
+function assertDuration(value, label) {
+	if (durationOf(value) === void 0) throw new Error(`PermDock: ${label} must be a whole number of seconds above 0, got ${JSON.stringify(value) ?? String(value)}`);
+}
+/** Whole seconds since the epoch of `now`, or of the clock when absent. */
+function nowSeconds(now) {
+	return Math.floor(nowMillis(now) / 1e3);
+}
+/** The `validation` denial detail for a `now` option that is not an `Instant`. */
+const INVALID_NOW = Object.freeze({
+	field: "now",
+	message: "now must be an Instant ({ epochMilliseconds }), such as a Temporal.Instant"
+});
+/** The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function dateAt(now) {
+	const millis = nowMillis(now);
+	if (!Number.isFinite(millis)) throw new RangeError(`PermDock: ${INVALID_NOW.message}`);
+	return new Date(millis);
+}
+/** Whole seconds since the epoch of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+function secondsAt(now) {
+	return Math.floor(dateAt(now).getTime() / 1e3);
+}
+/** The instant `seconds` after the epoch. */
+function instantAt(seconds) {
+	return { epochMilliseconds: seconds * 1e3 };
+}
+/** Seconds since the epoch of `now`, fraction kept, or of the clock when absent. */
+function epochSeconds(now) {
+	return nowMillis(now) / 1e3;
+}
+/** Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for a `now` that is not an `Instant`. */
+function nowMillis(now) {
+	if (now === void 0) return Date.now();
+	const millis = typeof now === "object" && now !== null ? now.epochMilliseconds : void 0;
+	return typeof millis === "number" ? millis : NaN;
+}
+//#endregion
+export { durationOf as a, instantOf as c, isoNow as d, nowMillis as f, secondsOf as g, secondsAt as h, dateAt as i, isRfc3339 as l, rfc3339 as m, RFC3339_PATTERN as n, epochSeconds as o, nowSeconds as p, assertDuration as r, instantAt as s, INVALID_NOW as t, isoAt as u };

package/dist/{token-Bx9qy30p.js → token-BLZcjQgt.js}

@@ -1,5 +1,5 @@
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 //#region src/core/token.ts
 /**
 * Only stable identity goes into the token, so refreshing a session (new
@@ -22,7 +22,16 @@ function versionOf(row, field) {
 }
 /** The digest that binds a token to the call's data when no row id does. */
 function payloadDigest(data) {
-	return bytesToBase64Url(sha256(canonicalJson(data)));
+	return sha256Digest(canonicalJson(data));
+}
+/**
+* The payload a decision token binds: the call's `args` when the caller
+* passes them (an agent or MCP tool call, row or not), otherwise the data of
+* a call without a row id. `undefined` binds nothing beyond the row id.
+*/
+function tokenPayload(resourceId, data, args) {
+	if (args !== void 0) return payloadDigest(args);
+	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
 * `version` is set only for an approval that goes stale on a resource
@@ -32,7 +41,7 @@ function payloadDigest(data) {
 * others.
 */
 function decisionToken(input) {
-	const payload = JSON.stringify({
+	const payload = canonicalJson({
 		key: input.key,
 		resourceId: input.resourceId,
 		principal: principalIdentity(input.principal),
@@ -44,7 +53,7 @@ function decisionToken(input) {
 		...input.version === void 0 ? {} : { version: input.version },
 		...input.payload === void 0 ? {} : { payload: input.payload }
 	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+	return sha256Digest(payload);
 }
 //#endregion
-export { payloadDigest as n, versionOf as r, decisionToken as t };
+export { versionOf as i, payloadDigest as n, tokenPayload as r, decisionToken as t };

package/dist/{tool-refusal-CQ7OEia9.js → tool-refusal-CMLN5xhn.js}

@@ -1,5 +1,5 @@
-import { a as wireDenials } from "./problem-details-DECUnXAn.js";
-import { t as describe } from "./describe-Cgkp7eP0.js";
+import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
+import { t as describe } from "./describe-BybMRY7A.js";
 //#region src/core/tool-refusal.ts
 function deniedToolRefusal(decision, permission, resource) {
 	const alternatives = decision.alternatives.map((leaf) => leaf.key);

package/dist/trpc/index.d.ts

@@ -1,9 +1,10 @@
-import { E as Policy, Or as Principal } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
-import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
-import { t as StreamProtectOptions } from "../stream-Dwsg6WwE.js";
+import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { t as StreamProtectOptions } from "../stream-7-xmnf3U.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
@@ -33,11 +34,13 @@ type TrpcOpenApiHooks = {
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type TrpcPermDock<TCtx = object> = {
-  readonly permdock: () => TrpcMiddleware;
-  readonly protect: (permission: Permission | null, loadData?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
+  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  readonly getPermDock: (opts: TrpcMiddlewareOpts<TCtx>) => Promise<PermDock>;
+  readonly middleware: () => TrpcMiddleware;
+  readonly protect: (permission: Permission | null, data?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;
   /** A long-lived connection for the request behind `ctx`. */
   readonly connection: (opts: TrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly permdockHandler: () => (request: Request) => Promise<Response>;
   readonly openapi: TrpcOpenApiHooks;
   readonly errorFormatter: <TShape extends {
     readonly data: object;

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-BE27PYkE.js";
-import { n as attached } from "../bind-kk-uyCwH.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-BMui98KK.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-nYC3cR_u.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { n as attached } from "../bind-CZzhx-Vj.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-aPyNi6tA.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");
@@ -58,9 +58,10 @@ function errorFormatter(opts) {
 }
 function createPermDock(policy, options) {
 	const { kernel, bind, attach, scopeOf, connection, evaluate, guard: runGuard } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
-	const permdock = () => (async (opts) => {
+	const getPermDock = async (opts) => kernel.getPermDock(bind(opts), await scopeOf(opts));
+	const middleware = () => (async (opts) => {
 		const request = bind(opts);
-		const instance = await attached(async () => kernel.permdock(request, await scopeOf(opts)));
+		const instance = await attached(async () => kernel.getPermDock(request, await scopeOf(opts)));
 		if (!instance.ok) return throwTrpcError(instance.response);
 		const nextCtx = {
 			...opts.ctx,
@@ -70,18 +71,18 @@ function createPermDock(policy, options) {
 		return mapDownstream(await opts.next({ ctx: nextCtx }));
 	});
 	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
-	const guardSubscription = async (result, opts, permission, loadData, protectOptions) => {
+	const guardSubscription = async (result, opts, permission, data, protectOptions) => {
 		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
 		return {
 			...result,
-			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, {
+			data: await guardStream(result.data, (connectionOptions) => connection(opts, connectionOptions), permission, data, protectOptions, {
 				unwrap: (item) => isTrackedEnvelope(item) ? item[1] : item,
 				onRevoked: trpcErrorFrom
 			})
 		};
 	};
-	const protect = (permission, loadData, protectOptions) => (async (opts) => {
-		const { request, guard } = await runGuard(permission, loadData, opts, protectOptions);
+	const protect = (permission, data, protectOptions) => (async (opts) => {
+		const { request, guard } = await runGuard(permission, data, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.ctx,
@@ -89,11 +90,11 @@ function createPermDock(policy, options) {
 				permdockData: guard.data
 			};
 			attach(nextCtx, request);
-			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions);
+			return guardSubscription(await mapDownstream(await opts.next({ ctx: nextCtx })), opts, permission, data === void 0 ? void 0 : reloadAfter(guard.data, () => data(opts)), protectOptions);
 		}
 		return throwTrpcError(guard.response);
 	});
-	const permdockHandler = (request) => {
+	const handler = (request) => {
 		return evaluate(request, {
 			ctx: { req: request },
 			path: "permdock",
@@ -103,10 +104,11 @@ function createPermDock(policy, options) {
 	};
 	const kernelOpenApi = kernel.openapi;
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
-		permdockHandler,
+		permdockHandler: () => handler,
 		openapi: {
 			security: (permission) => ({ openapi: {
 				protect: true,

package/dist/{types-7rJVLWe5.d.ts → types-5Ut_pbKy.d.ts}

@@ -1,5 +1,12 @@
-import { n as RoleThrough } from "./types-CqrjB9o6.js";
-import { o as SqlMembershipSource } from "./sources-Dljy06zL.js";
+import { n as RoleThrough } from "./types-CdlxsYQh.js";
+import { o as SqlMembershipSource } from "./sources-BV9j0DeZ.js";
+//#region src/cli/core/errors.d.ts
+/**
+ * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT
+ * or a cancelled prompt), 143 terminated (SIGTERM).
+ */
+type ExitCode = 0 | 1 | 2 | 3 | 130 | 143;
+//#endregion
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -88,7 +95,7 @@ type RlsConfig = {
   readonly dialect?: RlsDialect;
   readonly memberships?: RlsMemberships;
   /**
-   * `database` mode: the `fromTable` / `fromJunction` sources the helpers
+   * `database` mode: the `tableMembershipSource` / `junctionMembershipSource` sources the helpers
    * read for every scope `memberships` maps no table for. Default
    * `supabase.hook.memberships`, so the helpers and the token hook run the
    * same SQL. Setting it selects `database` mode.
@@ -117,6 +124,13 @@ type RlsConfig = {
   /** Postgres type of each named scope's id column; overrides `tenantType` / `teamType`. */
   readonly scopeTypes?: Readonly<Record<string, string>>;
   readonly roleClaim?: string;
+  /**
+   * Role values the existing SQL compares against (a string literal or an
+   * enum label) and the PermDock role each one is. `rls import` writes the
+   * PermDock name for a mapped value; `rls migrate` filters a `role` helper by
+   * it. An unmapped value must already be a declared role.
+   */
+  readonly roleValues?: Readonly<Record<string, string>>;
   readonly gucPrefix?: string;
   readonly out?: string;
   /** `--target drizzle`: where each policy's `.link()` finds its table. */
@@ -218,7 +232,8 @@ type RlsConfig = {
    * Add the approval store `supabaseApprovalStore` reads and writes: the
    * `approval_requests` table and one function per `ApprovalStore` method, in
    * the helper schema, executable by no client role. Off by default. An
-   * object adopts a table the app already has instead.
+   * object with `table` adopts a table the app already has instead, and
+   * `delegations: true` adds the out-of-office covers.
    */
   readonly approvals?: boolean | RlsApprovalsAdopt;
   /**
@@ -301,8 +316,15 @@ type RlsConfig = {
  * fields into the app's own columns on each write, converted to their types.
  */
 type RlsApprovalsAdopt = {
-  /** `table` or `schema.table`. */
-  readonly table: string;
+  /** `table` or `schema.table`. Without it the store is the generated `approval_requests`. */
+  readonly table?: string;
+  /**
+   * Add `approval_delegations`, the out-of-office covers a user writes for
+   * themselves, and the four-argument `permdock_is_approver` that answers for
+   * a delegate inside an active cover. `tableApprovalDelegationSource` reads
+   * the same rows for `approvalsHandler`. Off by default.
+   */
+  readonly delegations?: boolean;
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -432,6 +454,9 @@ type RlsActions = Readonly<Record<string, "select" | "insert" | "update" | "dele
 type RlsMigrateHelper = {
   readonly form: "ids" | "row" | "membership";
   readonly scope: string;
+} | {
+  readonly form: "role";
+  readonly scope: string;
 } | {
   readonly form: "scoped";
 } | {
@@ -500,7 +525,7 @@ type RlsStorage = {
 };
 /** `permdock supabase hook generate` input. */
 type SupabaseHookConfig = {
-  /** The same `fromTable` / `fromJunction` sources the app passes as `memberships`. */
+  /** The same `tableMembershipSource` / `junctionMembershipSource` sources the app passes as `memberships`. */
   readonly memberships: readonly SqlMembershipSource[];
   /** Schema of the hook and the version table. Default `rls.schema`, else `permdock`. */
   readonly schema?: string;
@@ -565,8 +590,21 @@ type SupabaseHookConfig = {
   readonly suspension?: RlsSuspension;
   readonly out?: string;
 };
+/**
+ * How the project turns SQL into Supabase migrations: `'pg-delta'`
+ * (Declarative Schemas 2.0, `supabase db schema declarative sync`),
+ * `'migra'` (declarative schemas on `supabase db diff`) or `'migrations'`
+ * (hand-written migrations, no declarative schemas).
+ */
+type SupabaseSchemas = "pg-delta" | "migra" | "migrations";
 type SupabaseConfig = {
   readonly hook?: SupabaseHookConfig;
+  /**
+   * The schema workflow `rls generate --split`, `supabase hook generate` and
+   * doctor follow. Default: `'migra'` when `supabase/config.toml` sets
+   * `[experimental.pgdelta] enabled = false`, else `'pg-delta'`.
+   */
+  readonly schemas?: SupabaseSchemas;
 };
 type DoctorConfig = {
   /**
@@ -578,7 +616,7 @@ type DoctorConfig = {
   readonly srcPath?: readonly string[];
   readonly sensitiveActions?: readonly string[];
   readonly memberships?: string;
-  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettings` input) for PD029. */
+  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettingsSource` input) for PD029. */
   readonly credentials?: string;
   /** Globs or directories whose files are client entries for PD001, for frameworks with no `'use client'` convention. */
   readonly clientEntries?: readonly string[];
@@ -590,6 +628,8 @@ type DoctorConfig = {
 type PermDockConfig = {
   readonly permissions?: string;
   readonly policy?: string;
+  /** A module exporting the `defineOperations` map as `operations` or default; `collect` writes it to the catalog's `operations`. */
+  readonly operations?: string;
   readonly collect?: CollectConfig;
   readonly catalog?: CatalogConfig;
   readonly openapi?: {
@@ -608,7 +648,7 @@ type PowerSyncConfig = {
   readonly resources?: readonly string[];
   /** The action whose grants decide which rows sync; default `read`. */
   readonly action?: string;
-  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powersyncSource`; none by default. */
+  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powerSyncSource`; none by default. */
   readonly manifest?: string;
 };
 type CliIo = {
@@ -617,13 +657,23 @@ type CliIo = {
   readonly now?: () => Date;
   readonly fetch?: typeof fetch;
   readonly env?: Readonly<Record<string, string | undefined>>;
-  /** Styled human output; `--no-color` turns it off. Unset is plain. */
+  /** Styled stdout; `--no-color` turns it off. Unset is plain. */
   readonly color?: boolean;
+  /** Styled stderr, decided for that stream on its own. Unset is plain. */
+  readonly errColor?: boolean;
   /** A person at a terminal: commands may prompt. Unset never prompts. */
   readonly interactive?: boolean;
+  /** stdout is a terminal; agent detection reads it. Unset is a pipe. */
+  readonly stdoutIsTty?: boolean;
+  /** stderr is a terminal: progress draws a spinner. Unset prints lines. */
+  readonly stderrIsTty?: boolean;
+  /** Reads all of stdin, for `--*-stdin` secrets. Unset reads nothing. */
+  readonly readStdin?: () => Promise<string>;
+  /** Aborted on SIGINT or SIGTERM. */
+  readonly signal?: AbortSignal;
 };
 type RunResult = {
-  readonly code: 0 | 1 | 2;
+  readonly code: ExitCode;
   readonly stdout: string;
   readonly stderr: string;
 };