permdock 0.8.0 → 0.10.0

package/dist/{types-ah9NlU6j.d.ts → sources-oB1Hg1Fm.d.ts}

@@ -1,6 +1,8 @@
-import { Zt as AuthEvent, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { nt as MembershipSource, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
+import { c as SupabaseManifestMembership } from "./manifest-B5yF3CIq.js";
+import { t as SqlQuery } from "./sql-B80DFdpG.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts
 /**
@@ -404,4 +406,316 @@ type SupabaseDelegation = {
   readonly scopes: readonly string[];
 };
 //#endregion
-export { SupabaseClaims as C, SupabasePermDockClaims as D, SupabaseMembershipClaim as E, supabaseClaims as O, SupabaseActClaim as S, SupabaseClaimsSchema as T, SupabaseStorage as _, SupabaseActor as a, SupabaseSuspendedScope as b, SupabaseInclude as c, SupabasePrincipal as d, SupabaseRealtime as f, SupabaseSessionLike as g, SupabaseRlsOptions as h, SupabaseActiveRow as i, SupabaseMembershipTable as l, SupabaseRlsMembershipTable as m, RoleMap as n, SupabaseActorResult as o, SupabaseRlsConfig as p, RoleThrough as r, SupabaseDelegation as s, AuthorizeSqlOptions as t, SupabasePermissionRef as u, SupabaseSubjectOptions as v, SupabaseClaimsOptions as w, SupabaseSuspension as x, SupabaseSuspendedMembership as y };
+//#region src/supabase/roles.d.ts
+/** A roles table a role column references, by `schema.table`. */
+type RoleKeys = {
+  readonly table: string;
+  /** The roles table column the reference points at. */
+  readonly id: string;
+  /** The roles table column holding the role key. */
+  readonly key: string;
+  /** The referencing table's column. */
+  readonly ref: string;
+  /**
+   * Every referencing column and the column of `table` it matches, `ref` and
+   * `id` first; more than one pair for a composite reference.
+   */
+  readonly match: readonly (readonly [ref: string, id: string])[];
+};
+/**
+ * One role source of a membership row: a key column, or a reference to a roles
+ * table.
+ */
+type RoleSource = string | RoleThrough | RoleMap;
+/** A role source, or several the row holds at once. */
+type RoleSpec = RoleSource | readonly RoleSource[];
+/**
+ * A roles table whose tenant rows are written by tenants. A role key read
+ * through it from a tenant row that is one of `declared` reads as null, so a
+ * tenant cannot claim the grants of a declared role by naming a role after it.
+ */
+type RoleGuard = {
+  /** `schema.table`, or `public`. */
+  readonly table: string;
+  /** The tenant column of the roles table. */
+  readonly tenant: string;
+  /**
+   * A tenant row with this column true is the application's own copy of a
+   * declared role.
+   */
+  readonly skip?: string | undefined;
+  readonly declared: readonly string[];
+};
+//#endregion
+//#region src/supabase/sources.d.ts
+type Common = {
+  readonly table: string;
+  /**
+   * Runs the lookups; without it the source only describes SQL (for `permdock
+   * supabase hook generate`).
+   */
+  readonly query?: SqlQuery;
+  /**
+   * Drop suspended users and memberships under suspended instances, like
+   * `rls.suspension`.
+   */
+  readonly suspension?: SupabaseSuspension;
+};
+type MembershipTableOptions = Common & {
+  /**
+   * Column names; `user`, `scope`, `id` and `role` default to `user_id`,
+   * `scope`, `scope_id`, `role`.
+   */
+  readonly columns?: {
+    /** The user id column, or a reference to a table that holds the user id. */
+    readonly user?: string | RoleThrough;
+    readonly scope?: string;
+    readonly id?: string;
+    /** A `jsonb` column of ancestor ids keyed by scope name. */
+    readonly within?: string;
+    /**
+     * The role key column, a reference to a roles table that holds the key, or
+     * several of them: the row holds every non-null key.
+     */
+    readonly role?: RoleSpec;
+    readonly via?: string;
+    readonly expiresAt?: string;
+    readonly disabledAt?: string;
+    /** The principal id that wrote the membership (`grantedBy`). */
+    readonly grantedBy?: string;
+    /** Free-text justification recorded on the membership (`reason`). */
+    readonly reason?: string;
+    /** A subgroup column filling `member.group`. */
+    readonly group?: string;
+    /**
+     * A text column; the value `idp` marks the row as owned by the identity
+     * provider.
+     */
+    readonly managedBy?: string;
+    /** A `text[]` column of seats. */
+    readonly seats?: string;
+    /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
+    readonly x?: string;
+  };
+};
+type MembershipJunctionOptions = Common & {
+  /** The declared scope every row is a membership of. */
+  readonly scope: string;
+  /**
+   * The user id column (default `user_id`), or a reference to a table that
+   * holds the user id.
+   */
+  readonly user?: string | RoleThrough;
+  /** The column holding the scope instance id. Default `<scope>_id`. */
+  readonly id?: string;
+  /** Ancestor id columns keyed by scope name. */
+  readonly within?: Readonly<Record<string, string>>;
+  /**
+   * A role column, a reference to a roles table that holds the key, fixed roles
+   * every row holds (a contact table with no role column), or `{ sources }`:
+   * several role columns whose non-null keys the row holds.
+   */
+  readonly roles: string | RoleThrough | RoleMap | readonly string[] | {
+    readonly sources: readonly RoleSource[];
+  };
+  /** The membership kind every row has (`contact`, `staff`, `partner`). */
+  readonly via?: string;
+  readonly expiresAt?: string;
+  readonly disabledAt?: string;
+  /** The principal id that wrote the membership (`grantedBy`). */
+  readonly grantedBy?: string;
+  /** Free-text justification recorded on the membership (`reason`). */
+  readonly reason?: string;
+  /** A subgroup filling `member.group`: a fixed name every row has, or a column. */
+  readonly group?: string | {
+    readonly column: string;
+  };
+  /**
+   * `idp` when the identity provider owns every row, or a text column holding
+   * `idp` per row.
+   */
+  readonly managedBy?: "idp" | {
+    readonly column: string;
+  };
+  /** A `text[]` column of seats. */
+  readonly seats?: string;
+  /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
+  readonly x?: string;
+};
+/**
+ * What `permdock supabase hook generate` compiles; the same SQL the source
+ * runs.
+ */
+type MembershipSql = {
+  readonly table: string;
+  /**
+   * The table's user column: the user id, or with `userThrough` the reference
+   * to the row holding it.
+   */
+  readonly user: string;
+  /**
+   * The table that holds the user id when `user` references it; a change of
+   * that id bumps the old and the new user.
+   */
+  readonly userThrough?: RoleKeys;
+  /**
+   * `<table>.<user>%type`: the PL/pgSQL type of the user id column, for a
+   * variable `select` compares with.
+   */
+  readonly userType: string;
+  /**
+   * The `select` of claim rows for one user, with every filter applied. `user`
+   * must have the column's type (a `userType` variable, or an untyped `$1`
+   * Postgres infers): the column is compared uncast so its index applies.
+   * `keep` adds the `keep` column; it defaults to `keeps`, and a `union` with a
+   * source that keeps passes `true`.
+   */
+  select: (user: string, keep?: boolean) => string;
+  /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
+  list: (keep?: boolean) => string;
+  /**
+   * A suspended scope on the source keeps permissions: rows of its suspended
+   * instances stay, with a `keep` column.
+   */
+  readonly keeps: boolean;
+  /**
+   * A text column holding `idp` for rows the identity provider owns; `''` when
+   * every row is owned.
+   */
+  readonly managed?: string;
+  /** Other tables the `select` reads (suspension tables). */
+  readonly reads: readonly string[];
+  /**
+   * The roles table the role column references; a key change bumps every
+   * holder's authorization version.
+   */
+  readonly through?: RoleKeys;
+  /** Every roles table the role columns reference, `through` first. */
+  readonly throughs: readonly RoleKeys[];
+  /**
+   * Every column that decides who holds which membership: user, scope, id,
+   * `within`, role, `via` and expiry.
+   */
+  readonly columns: readonly string[];
+  /**
+   * For a single-scope source: its scope and the scopes whose ids each row
+   * carries.
+   */
+  readonly scope?: string;
+  readonly holds?: readonly string[];
+  /** The source's entry in the hook manifest's `memberships`. */
+  readonly manifest: SupabaseManifestMembership;
+  /** What the ownership triggers count; absent on a source that is not a table. */
+  readonly holders?: MembershipHolders;
+  /**
+   * The rows as plain columns, for Sync Streams and `powerSyncSource`; a source
+   * without it does not sync.
+   */
+  readonly stream?: MembershipStream;
+};
+/**
+ * One membership source as columns a Sync Streams query can filter on. Tables
+ * are `schema.table`; a `through` table is qualified in the source's schema
+ * when it names none.
+ */
+type MembershipStream = {
+  readonly table: string;
+  /** The user id column, or the reference to the table that holds the user id. */
+  readonly user: string | RoleThrough;
+  /** The scope column, or the scope every row is a membership of. */
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly id: string;
+  /**
+   * The role sources (the row holds every non-null key), or the fixed roles
+   * every row holds.
+   */
+  readonly roles: RoleSpec | {
+    readonly value: readonly string[];
+  };
+  /** The membership kind column, or the kind every row has. */
+  readonly via?: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly expiresAt?: string;
+  readonly disabledAt?: string;
+  /**
+   * A row may hold no role key: such a row is no membership, and a reader drops
+   * it.
+   */
+  readonly nullableRoles: boolean;
+  /**
+   * The guard the source reads its roles table with: a tenant row named like a
+   * declared role is no role.
+   */
+  readonly guard?: RoleGuard;
+};
+/**
+ * The rows of a membership table, for the holder-count and transfer-only
+ * triggers `permdock rls generate` puts on it. No suspension filter: a
+ * suspended holder still holds the role.
+ */
+type MembershipHolders = {
+  /**
+   * `<table>.<id column>%type`: the type of a variable `rows` compares the id
+   * column with.
+   */
+  readonly idType: string;
+  /**
+   * The instance id of scope `scope` the PL/pgSQL record `row` holds, as text;
+   * null on a row of another scope.
+   */
+  id: (scope: string, row: string) => string;
+  /**
+   * `select id, user_id, role, via, live` over the rows of scope `scope` in
+   * `from` (default the table): one row per held role key, `live` false once
+   * expired. `id` is an expression of `idType` the id column must equal.
+   */
+  rows: (scope: string, options?: {
+    readonly id?: string;
+    readonly from?: string;
+  }) => string;
+};
+type SqlMembershipSource = MembershipSource & {
+  readonly sql: MembershipSql;
+  /**
+   * The same source with the role keys of tenant rows of `guard.table` named
+   * like a declared role read as null.
+   */
+  readonly guarded?: (guard: RoleGuard) => SqlMembershipSource;
+};
+/** The part of `@supabase/server`'s `PostgresApi` a `SqlQuery` needs. */
+type SupabasePostgres = {
+  readonly queryRaw: (text: string, params?: unknown[]) => Promise<readonly Record<string, unknown>[]>;
+};
+declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
+/**
+ * Memberships from one table holding every scope: a row per user, scope,
+ * instance and role (`user_id, scope, scope_id, role`), with optional `within`,
+ * `via`, expiry, owner and seat columns. Rows of the same instance merge into
+ * one membership.
+ */
+declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
+/**
+ * Memberships from a table of one scope (`customer_contacts`): every row is a
+ * membership of `scope`, with roles from a column or fixed (`['contact']`), a
+ * fixed `via`, and ancestor ids from `within` columns.
+ */
+declare function junctionMembershipSource(options: MembershipJunctionOptions): SqlMembershipSource;
+declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
+/**
+ * Reads the authorization version `permdock supabase hook generate` keeps in
+ * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version
+ * })`.
+ */
+declare function authzVersion(options: {
+  readonly query: SqlQuery;
+  readonly schema?: string;
+}): NonNullable<MembershipSource["version"]>;
+//#endregion
+export { SupabaseSubjectOptions as A, supabaseClaims as B, SupabasePrincipal as C, SupabaseRlsOptions as D, SupabaseRlsMembershipTable as E, SupabaseClaims as F, SupabaseClaimsOptions as I, SupabaseClaimsSchema as L, SupabaseSuspendedScope as M, SupabaseSuspension as N, SupabaseSessionLike as O, SupabaseActClaim as P, SupabaseMembershipClaim as R, SupabasePermissionRef as S, SupabaseRlsConfig as T, SupabaseActor as _, MembershipStream as a, SupabaseInclude as b, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, SupabaseActiveRow as g, RoleThrough as h, MembershipSql as i, SupabaseSuspendedMembership as j, SupabaseStorage as k, authzVersion as l, RoleMap as m, MembershipHolders as n, MembershipTableOptions as o, AuthorizeSqlOptions as p, MembershipJunctionOptions as r, SqlMembershipSource as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u, SupabaseActorResult as v, SupabaseRealtime as w, SupabaseMembershipTable as x, SupabaseDelegation as y, SupabasePermDockClaims as z };

package/dist/{src-DZ0l9UAg.js → src-C_pi2Rnh.js}

@@ -8,7 +8,7 @@ import { n as internalsOf } from "./internals-B3IgHrvo.js";
 import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
-import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
+import { a as durationOf, f as nowMillis, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
 import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
 import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
@@ -16,12 +16,12 @@ import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js"
 import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
 import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
 import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
-import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot--JWiTrvO.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-DuWf1cT3.js";
 import { n as relationId } from "./relations-BxvRvDHK.js";
 import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
-import { c as APP, r as resolveSubject } from "./permdock-L-_I_3zP.js";
+import { c as APP, r as resolveSubject } from "./permdock-BvjivVb9.js";
 import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
 import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
 //#region src/conditions/sql-function.ts
@@ -819,6 +819,107 @@ function signPolicyDocument(document, signer, options) {
 	});
 }
 //#endregion
+//#region src/core/version-cache.ts
+const MAX_STALE_CEILING_MS = 6e4;
+const DEFAULT_MAX_ENTRIES = 1e4;
+/**
+* An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+* resolved versions and shares reads in flight. Create it once at module
+* scope.
+*/
+function memoryVersionCache(options) {
+	const maxStaleMs = Math.min(Math.max(Math.floor(options.maxStaleMs), 0), MAX_STALE_CEILING_MS);
+	const maxEntries = Math.max(Math.floor(options.maxEntries ?? DEFAULT_MAX_ENTRIES), 1);
+	const entries = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const counts = {
+		reads: 0,
+		shared: 0,
+		hits: 0,
+		evictions: 0
+	};
+	const now = () => nowMillis(options.now?.());
+	const store = (id, entry) => {
+		entries.delete(id);
+		entries.set(id, entry);
+		if (entries.size > maxEntries) {
+			const oldest = entries.keys().next();
+			if (oldest.done !== true) entries.delete(oldest.value);
+		}
+	};
+	const observe = (principal, at) => {
+		const claimed = principal.authzVersion;
+		if (typeof claimed !== "number") return;
+		const issued = typeof principal.issuedAt === "number" ? principal.issuedAt * 1e3 : void 0;
+		const entry = entries.get(principal.id);
+		if (entry === void 0) {
+			if (issued !== void 0 && issued <= at && at - issued <= maxStaleMs) store(principal.id, {
+				version: claimed,
+				at: issued
+			});
+			return;
+		}
+		if (claimed > entry.version) store(principal.id, {
+			version: claimed,
+			at: issued === void 0 ? entry.at : Math.max(entry.at, issued)
+		});
+	};
+	const start = (id, read, at) => {
+		counts.reads += 1;
+		const keep = (version) => {
+			if (typeof version === "number" && Number.isFinite(version)) {
+				const entry = entries.get(id);
+				store(id, {
+					version: Math.max(version, entry?.version ?? version),
+					at
+				});
+			}
+			return version;
+		};
+		const answer = read();
+		if (!isThenable$1(answer)) return keep(answer);
+		const pending = Promise.resolve(answer).then((version) => inFlight.get(id) === pending ? keep(version) : version);
+		inFlight.set(id, pending);
+		const settle = () => {
+			if (inFlight.get(id) === pending) inFlight.delete(id);
+		};
+		pending.then(settle, settle);
+		return pending;
+	};
+	return Object.freeze({
+		name: "memory",
+		maxStaleMs,
+		current(principal, read, { live }) {
+			const at = now();
+			if (live) return start(principal.id, read, at);
+			observe(principal, at);
+			const entry = entries.get(principal.id);
+			if (entry !== void 0 && at - entry.at <= maxStaleMs) {
+				counts.hits += 1;
+				store(principal.id, entry);
+				return entry.version;
+			}
+			const pending = inFlight.get(principal.id);
+			if (pending !== void 0) {
+				counts.shared += 1;
+				return pending;
+			}
+			return start(principal.id, read, at);
+		},
+		evict(principal) {
+			counts.evictions += 1;
+			entries.delete(principal);
+			inFlight.delete(principal);
+		},
+		stats() {
+			return {
+				...counts,
+				size: entries.size
+			};
+		}
+	});
+}
+//#endregion
 //#region src/core/arazzo.ts
 const VERSION = /^1\.[01]\.\d+(?:-.+)?$/u;
 const STEP_TARGETS = [
@@ -2039,4 +2140,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { memoryCustomRoleSource as A, stripeEntitlementSource as C, validateApprovalPolicy as D, memoryApprovalPolicySource as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, defineOperations as O, memorySnapshotSource as P, memoryLimitStore as S, approvalPoliciesFor as T, arazzoFindings as _, normalizeMembership as a, memoryRelationSource as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, isOperationEffect as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, approvalPolicies as w, limits as x, signPolicyDocument as y };
+export { isOperationEffect as A, memoryLimitStore as C, memoryApprovalPolicySource as D, approvalPoliciesFor as E, memorySnapshotSource as F, sqlFunction as I, memoryEntitlementSource as M, memoryMembershipSource as N, validateApprovalPolicy as O, memorySettingsSource as P, limits as S, approvalPolicies as T, arazzoFindings as _, normalizeMembership as a, signPolicyDocument as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryCustomRoleSource as j, defineOperations as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, stripeEntitlementSource as w, memoryRelationSource as x, memoryVersionCache as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DjuMBNF9.js";
-import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BhxEUY9J.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DsHGPtkR.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BinlXeU-.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };

package/dist/{standard-webhooks-C-qX4mJW.d.ts → standard-webhooks-DOYEuOLx.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, ar as JsonWebKeyLike } from "./policy-types-CCiDRZBH.js";
-import { l as ReplayStore } from "./types-DjuMBNF9.js";
+import { Wt as Instant, dr as JsonWebKeyLike } from "./policy-types-DGIO_gxq.js";
+import { l as ReplayStore } from "./types-DsHGPtkR.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{stores-C0Kta5Ft.d.ts → stores-DZJvxFIZ.d.ts}

@@ -1,11 +1,11 @@
-import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-B6Sf4T_S.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
-import { n as ProtectedAction } from "./action-result-CL-QCITA.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B_d_g7T3.js";
-import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-djVzLlIV.js";
+import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
+import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-tQB2CEnY.js";
+import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-CEinc15V.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stream-ltuLdtTG.d.ts → stream-9y9qw51m.d.ts}

@@ -1,5 +1,5 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
+import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/supabase/index.d.ts

@@ -1,10 +1,9 @@
-import { Rt as Instant, lr as Subject } from "../policy-types-CCiDRZBH.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-B_tiYvk8.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-DicQyqm-.js";
-import { C as SupabaseClaims, D as SupabasePermDockClaims, E as SupabaseMembershipClaim, O as supabaseClaims, S as SupabaseActClaim, T as SupabaseClaimsSchema, _ as SupabaseStorage, a as SupabaseActor, b as SupabaseSuspendedScope, c as SupabaseInclude, d as SupabasePrincipal, f as SupabaseRealtime, g as SupabaseSessionLike, h as SupabaseRlsOptions, i as SupabaseActiveRow, l as SupabaseMembershipTable, m as SupabaseRlsMembershipTable, o as SupabaseActorResult, p as SupabaseRlsConfig, r as RoleThrough, s as SupabaseDelegation, t as AuthorizeSqlOptions, u as SupabasePermissionRef, v as SupabaseSubjectOptions, w as SupabaseClaimsOptions, x as SupabaseSuspension, y as SupabaseSuspendedMembership } from "../types-ah9NlU6j.js";
+import { Wt as Instant, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-DLvhVm1r.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-D5nUGm-c.js";
+import { A as SupabaseSubjectOptions, B as supabaseClaims, C as SupabasePrincipal, D as SupabaseRlsOptions, E as SupabaseRlsMembershipTable, F as SupabaseClaims, I as SupabaseClaimsOptions, L as SupabaseClaimsSchema, M as SupabaseSuspendedScope, N as SupabaseSuspension, O as SupabaseSessionLike, P as SupabaseActClaim, R as SupabaseMembershipClaim, S as SupabasePermissionRef, T as SupabaseRlsConfig, _ as SupabaseActor, a as MembershipStream, b as SupabaseInclude, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, g as SupabaseActiveRow, h as RoleThrough, i as MembershipSql, j as SupabaseSuspendedMembership, k as SupabaseStorage, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, p as AuthorizeSqlOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource, v as SupabaseActorResult, w as SupabaseRealtime, x as SupabaseMembershipTable, y as SupabaseDelegation, z as SupabasePermDockClaims } from "../sources-oB1Hg1Fm.js";
+import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-B5yF3CIq.js";
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-CzzWtnAb.js";
-import { a as MembershipStream, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-B1Os_YUu.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {

package/dist/supabase/index.js

@@ -1,6 +1,6 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-BL1qJzzY.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-B1EfuD47.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-CMAM-2A3.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-D4nuPXIQ.js";
-import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-wg8WkkpD.js";
+import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
 export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
-import { n as ServerAdapterServices } from "../bind-Cp2hBHzP.js";
+import { i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
+import { n as ServerAdapterServices } from "../bind-YYjvfpB9.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { t as composeWraps } from "../wrap-B2wziJI_.js";
 import { r as credentialSubject } from "../credential-CyyyvCsL.js";
 import { o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
-import { t as createPermDock$1 } from "../create-_noSrY1T.js";
-import { n as attached } from "../bind-D_sZSVA3.js";
+import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
+import { t as createPermDock$1 } from "../create-BLPKnJKa.js";
+import { n as attached } from "../bind-BNQA9JK9.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-BL1qJzzY.js → supabase-B1EfuD47.js}

@@ -7,8 +7,8 @@ import { a as parseCapability } from "./capability-BqX94r07.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
-import { d as keptKeys, l as roleColumn } from "./sources-CMAM-2A3.js";
-import { t as callRpc } from "./postgrest-D4nuPXIQ.js";
+import { d as keptKeys, l as roleColumn } from "./sources-C4vkzZJV.js";
+import { t as callRpc } from "./postgrest-DAxFltvO.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;

package/dist/{supabase-D39cuGPt.js → supabase-BaizG0n7.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
+		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-H-MtE9Wd.js");
+		const { runSupabase } = await import("./supabase-hook-CbvGAutK.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,