permdock 0.7.0 → 0.8.0

package/dist/{postgres-store-BL9M_CA1.js → postgres-store-DcyrPS-r.js}

@@ -1,7 +1,7 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { o as quoteSqlIdent, u as sqlRows } from "./sql-B96movIM.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { o as quoteSqlIdent, u as sqlRows } from "./sql-0WjxIp9g.js";
 //#region src/scim/types.ts
 const SCIM_CONTENT_TYPE = "application/scim+json";
 const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -11,7 +11,10 @@ const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 /** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
 const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
+/**
+* The extension that carries the application's own data (`x`) on a User or a
+* Group.
+*/
 const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 var DirectoryUniquenessError = class extends Error {
 	name = "DirectoryUniquenessError";
@@ -30,11 +33,17 @@ var DirectoryNotFoundError = class extends Error {
 function isNamedError(error, name, code) {
 	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isDirectoryUniquenessError(error) {
 	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isDirectoryNotFoundError(error) {
 	return isNamedError(error, "DirectoryNotFoundError", "not-found");
 }
@@ -231,7 +240,10 @@ function matchCompare(actual, op, expected) {
 		default: return op;
 	}
 }
-/** RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an item. */
+/**
+* RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an
+* item.
+*/
 function present(value) {
 	if (Array.isArray(value)) return value.some(present);
 	return value !== void 0 && value !== null && value !== "";
@@ -537,13 +549,19 @@ function memoryDirectoryStore() {
 }
 //#endregion
 //#region src/scim/postgres-store.ts
-/** The tables `permdock scim generate` writes; their names are the contract this store reads. */
+/**
+* The tables `permdock scim generate` writes; their names are the contract this
+* store reads.
+*/
 const SCIM_TABLES = {
 	users: "scim_users",
 	groups: "scim_groups",
 	members: "scim_group_members"
 };
-/** The constraints whose violation is a SCIM `409 uniqueness`, by the attribute they cover. */
+/**
+* The constraints whose violation is a SCIM `409 uniqueness`, by the attribute
+* they cover.
+*/
 const SCIM_UNIQUE = {
 	userName: "scim_users_user_name_key",
 	userExternalId: "scim_users_external_id_key",
@@ -623,7 +641,10 @@ function storedGroup(value) {
 		})
 	};
 }
-/** A stored or IdP-sent `meta.created` the database can read; anything else is "now". */
+/**
+* A stored or IdP-sent `meta.created` the database can read; anything else is
+* "now".
+*/
 function createdParam(created) {
 	return created !== "" && !Number.isNaN(Date.parse(created)) ? created : null;
 }
@@ -653,7 +674,10 @@ function constraintOf(error) {
 	}
 	return "";
 }
-/** A unique violation (`23505`) as `DirectoryUniquenessError`; any other error is rethrown. */
+/**
+* A unique violation (`23505`) as `DirectoryUniquenessError`; any other error
+* is rethrown.
+*/
 function uniqueness(error, kind) {
 	if (isRecord(error) && error["code"] === "23505") {
 		const constraint = constraintOf(error);
@@ -779,7 +803,10 @@ function groupParams(tenant, group, createdOrRevision, now) {
 		uniqueMembers(group)
 	];
 }
-/** Reads the row, applies the operations and writes only if no other write landed in between; `write` answers `null` then. */
+/**
+* Reads the row, applies the operations and writes only if no other write
+* landed in between; `write` answers `null` then.
+*/
 async function patch(read, ops, step, write, label) {
 	for (let attempt = 0; attempt < PATCH_ATTEMPTS; attempt += 1) {
 		const current = await read();
@@ -880,10 +907,10 @@ function findSql(kind, tables, clause, page) {
 }
 /**
 * A `DirectoryStore` over the tables `permdock scim generate` writes, called
-* through a `SqlQuery` that may read and write them (the table owner, or a
-* role granted on them). Every method is one statement, so a pool needs no
-* transaction: a group and its members change together, and a PATCH that
-* races another write re-reads the row and applies its operations again.
+* through a `SqlQuery` that may read and write them (the table owner, or a role
+* granted on them). Every method is one statement, so a pool needs no
+* transaction: a group and its members change together, and a PATCH that races
+* another write re-reads the row and applies its operations again.
 */
 function postgresDirectoryStore(query, options = {}) {
 	const schema = quoteSqlIdent(options.schema ?? "permdock");

package/dist/{postgrest-r5faDIzD.js → postgrest-D4nuPXIQ.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as validateRecord } from "./thenable-yD7SabqG.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as validateRecord } from "./thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
-import { t as clientNameOf } from "./clients-DjU5ABMy.js";
-import "./budget-NbEtbJC_.js";
-import { a as hookApiNames } from "./sources-B-zYB4GS.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { t as clientNameOf } from "./clients-DYr3U86j.js";
+import "./budget-BELja5A9.js";
+import { a as hookApiNames } from "./sources-CMAM-2A3.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -28,14 +28,20 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"client_id",
 	"scope"
 ]);
-/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+/**
+* Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook
+* writes `null` for a user with no role row.
+*/
 function claimNamed(claims, name) {
 	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
 	if (top !== void 0 && top !== null) return top;
 	const meta = claims["app_metadata"];
 	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
 }
-/** A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a function over the claims. */
+/**
+* A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a
+* function over the claims.
+*/
 function claimAt(claims, path) {
 	return typeof path === "string" ? claimNamed(claims, path) : readClaim(claims, path);
 }
@@ -45,7 +51,10 @@ function asRoles(value, declared) {
 	const allowed = new Set(declared);
 	return raw.filter((role) => allowed.has(role));
 }
-/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+/**
+* Reads the `memberships` claim; an entry it cannot read is dropped and its
+* index reported.
+*/
 function readMemberships(value) {
 	if (!Array.isArray(value)) return {
 		memberships: [],
@@ -106,7 +115,10 @@ function memberOf(value) {
 function asStrings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+/**
+* `claims[plans][tenant]`: only the active tenant's entry, never another
+* tenant's.
+*/
 function plansFor(claims, name, tenant) {
 	if (name === void 0 || tenant === void 0) return [];
 	const byTenant = claimAt(claims, name);
@@ -127,11 +139,13 @@ function isToolList(value) {
 	return Array.isArray(value) && value.every((tool) => typeof tool === "string" && tool !== "");
 }
 /**
-* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
-* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
-* as the user, `agent` an agent run with the `tools` it may call. Any other `kind`, a support level
-* without `session_id`, and an agent level with `session_id`, `tools` that are not non-empty
-* strings or a `read_only` that is not a boolean are invalid, as better-supabase reads them.
+* The outer `act` level by its `kind`, the marker a support tool writes: none
+* is an OAuth client or agent chain, `support` a support session (with
+* `session_id`), `impersonation` an admin acting as the user, `agent` an agent
+* run with the `tools` it may call. Any other `kind`, a support level without
+* `session_id`, and an agent level with `session_id`, `tools` that are not
+* non-empty strings or a `read_only` that is not a boolean are invalid, as
+* better-supabase reads them.
 */
 function actingParty(outer, id) {
 	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
@@ -214,14 +228,15 @@ function readActor(claims) {
 	return NO_ACTOR;
 }
 /**
-* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
-* actor; nested levels are prior actors, kept on `chain` for audit), else the
-* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
-* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
-* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
-* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
-* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
-* is `{ ok: false }` and must deny.
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the
+* current actor; nested levels are prior actors, kept on `chain` for audit),
+* else the OAuth `client_id` of a third-party app. The outer level's `kind`
+* names the actor: none is `oauth-client`, `support` a support session,
+* `impersonation` an admin acting as the user. Reads only `act` and
+* `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a
+* chain of objects each with a non-empty `sub`, that names another `kind`, or a
+* support level without `session_id`, is `{ ok: false }` and must deny.
 */
 function actorOf(claims) {
 	try {
@@ -370,8 +385,9 @@ function subjectFromSupabase(claims, options = {}) {
 	}
 }
 /**
-* A verified session object (`{ kind, claims }`) in, `Subject` out.
-* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+* A verified session object (`{ kind, claims }`) in, `Subject` out. Only `kind:
+* 'user'` sessions map; `anon`, `service`, `invalid` and anything else are
+* anonymous.
 */
 function subjectFromSupabaseSession(session, options = {}) {
 	try {
@@ -442,7 +458,10 @@ function versionOf(value) {
 	const version = typeof value === "string" ? Number(value) : value;
 	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
 }
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+* Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+* malformed record is no record.
+*/
 function readSubjectRecord(value) {
 	if (!isRecord(value) || typeof value["id"] !== "string") return;
 	if (value["active"] !== true) return {
@@ -469,14 +488,14 @@ function readSubjectRecord(value) {
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
 * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
+* `permdock supabase hook generate` writes, for a backend that reaches Postgres
+* only through PostgREST. `memberships.version` reads only the version, so
+* `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+* stale token; when the version function is missing it falls back to
+* `subject_for`. With `policy`, a token that claims a custom role has its
 * subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
+* only for a subject that holds one. Each user and each instance is read once
+* per `postgrestSources` call, so create it per request or per job.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;

package/dist/{postgrest-CYacM_u7.d.ts → postgrest-DicQyqm-.d.ts}

@@ -1,6 +1,9 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-B-F-qAZk.js";
+import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-CCiDRZBH.js";
 //#region src/supabase/postgrest.d.ts
-/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+/**
+ * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
+ * message.
+ */
 type SupabaseRpcResult = {
   readonly data: unknown;
   readonly error: {
@@ -13,13 +16,13 @@ type SupabaseRpcResult = {
  * function, such as a `service_role` client after the grant the docs show.
  */
 type SupabaseRpcClient = {
-  schema(name: string): {
-    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  schema: (name: string) => {
+    rpc: (fn: string, args: Readonly<Record<string, unknown>>) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type SupabaseRpcCaller = {
-  schema(name: never): {
-    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  schema: (name: never) => {
+    rpc: (fn: never, args: never) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type PostgrestSourcesOptions = {
@@ -34,18 +37,24 @@ type PostgrestSourcesOptions = {
     readonly schema?: string;
     readonly prefix?: string;
   };
-  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  /**
+   * Schema of the functions. Default `permdock`, where the hook generates
+   * `subject_for` and `members_of`.
+   */
   readonly schema?: string;
   /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
   readonly fn?: string;
   readonly membersFn?: string;
-  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  /**
+   * The version-only function `memberships.version` calls. Default
+   * `authz_version_for`.
+   */
   readonly versionFn?: string;
   /**
    * The policy whose declared roles tell custom roles apart. With it,
-   * `customRoles` reads nothing while every role the subject holds is
-   * declared, and `memberships.version` reads the whole subject in one call
-   * when the token claims a custom role, which the custom roles need anyway.
+   * `customRoles` reads nothing while every role the subject holds is declared,
+   * and `memberships.version` reads the whole subject in one call when the
+   * token claims a custom role, which the custom roles need anyway.
    */
   readonly policy?: Policy;
 };
@@ -58,53 +67,63 @@ type SubjectRecord = {
   readonly memberships: readonly Membership[];
   readonly customRoles: readonly CustomRole[];
   readonly authzVersion?: number;
-  /** The token claims the hook adds besides the memberships: `team_ids` and each `supabase.hook.claims` entry. */
+  /**
+   * The token claims the hook adds besides the memberships: `team_ids` and each
+   * `supabase.hook.claims` entry.
+   */
   readonly claims?: Readonly<Record<string, unknown>>;
 };
 type PostgrestSources = {
   /**
-   * Memberships and the authorization version of any principal, and `list`,
-   * the live members of one scope instance through `members_of`, for
-   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
-   * the token was truncated.
+   * Memberships and the authorization version of any principal, and `list`, the
+   * live members of one scope instance through `members_of`, for `countHolders`
+   * and `whoCan`. Wrap it in `claimsFirst` to read only when the token was
+   * truncated.
    */
   readonly memberships: MembershipSource & {
-    list(query: {
+    list: (query: {
       readonly scope: string;
       readonly id: string;
-    }): Promise<MemberEntry[]>;
+    }) => Promise<MemberEntry[]>;
   };
   /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
-  customRoles(principal: {
+  customRoles: (principal: {
     readonly id: string;
-  }): CustomRoleSource;
-  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
-  subject(userId: string): Promise<Subject>;
+  }) => CustomRoleSource;
+  /**
+   * The subject the hook would mint for `userId`: anonymous when the user is
+   * unknown or suspended.
+   */
+  subject: (userId: string) => Promise<Subject>;
   /**
    * `subject` with its principal read again: roles, memberships and
    * authorization version come from the database, the token's other claims
-   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context
-   * are kept as they were, so a refreshed OAuth client keeps its ceiling. An
+   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context are
+   * kept as they were, so a refreshed OAuth client keeps its ceiling. An
    * unknown or suspended user becomes a subject with no principal that still
-   * carries the actor and delegation. A subject with no principal is returned as is.
+   * carries the actor and delegation. A subject with no principal is returned
+   * as is.
    */
-  refresh<P extends Principal>(subject: Subject<P>): Promise<Subject<P>>;
+  refresh: <P extends Principal>(subject: Subject<P>) => Promise<Subject<P>>;
   /** The raw record, `undefined` for an unknown user. */
-  record(userId: string): Promise<SubjectRecord | undefined>;
+  record: (userId: string) => Promise<SubjectRecord | undefined>;
 };
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+ * Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+ * malformed record is no record.
+ */
 declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
 /**
  * Membership, custom-role and subject sources over the `subject_for(p_user)`,
  * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
- * `permdock supabase hook generate` writes, for a backend that reaches
- * Postgres only through PostgREST. `memberships.version` reads only the
- * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
- * only for a stale token; when the version function is missing it falls back
- * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * `permdock supabase hook generate` writes, for a backend that reaches Postgres
+ * only through PostgREST. `memberships.version` reads only the version, so
+ * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+ * stale token; when the version function is missing it falls back to
+ * `subject_for`. With `policy`, a token that claims a custom role has its
  * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once per
- * `postgrestSources` call, so create it per request or per job.
+ * only for a subject that holds one. Each user and each instance is read once
+ * per `postgrestSources` call, so create it per request or per job.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion