@cfast/permissions 0.4.0 → 0.5.0

package/dist/{client-D6goQV8b.d.ts → client-DpwiMpD0.d.ts}

@@ -75,6 +75,23 @@ type TableName<TTables extends SchemaMap> = Extract<keyof TTables, string> | Sql
  * - The literal `"all"` for grants that apply to every table.
  */
 type SubjectInput<TTables extends SchemaMap = SchemaMap> = DrizzleTable | TableName<TTables> | "all";
+/**
+ * Structural shape of a Drizzle table that exposes its column map.
+ * @internal
+ */
+type TableWithColumns = {
+    _: {
+        columns: Record<string, unknown>;
+    };
+};
+/**
+ * Resolves the column map for a grant subject.
+ *
+ * - **Drizzle table object** — extracts `T["_"]["columns"]`.
+ * - **JS-key string** (`keyof TTables`) — schema lookup to extract columns.
+ * - **SQL-name string** / **`"all"`** — falls back to `Record<string, unknown>`.
+ */
+type ColumnsOf<TSubject, TTables extends SchemaMap = SchemaMap> = TSubject extends "all" ? Record<string, unknown> : TSubject extends TableWithColumns ? TSubject["_"]["columns"] : TSubject extends Extract<keyof TTables, string> ? TTables[TSubject] extends TableWithColumns ? TTables[TSubject]["_"]["columns"] : Record<string, unknown> : Record<string, unknown>;
 /**
  * Extracts the table name string from a Drizzle table reference, or returns
  * a string subject as-is.
@@ -244,7 +261,7 @@ type Grant = {
  * @typeParam TTables - Optional schema map (e.g. `typeof schema`) used to
  *   constrain string subjects to known table-name literals.
  */
-type GrantFn<TUser, TTables extends SchemaMap = SchemaMap> = <TWith extends WithLookups<TUser> = WithLookups<TUser>>(action: PermissionAction, subject: SubjectInput<TTables>, options?: {
+type GrantFn<TUser, TTables extends SchemaMap = SchemaMap> = <TSubject extends SubjectInput<TTables>, TWith extends WithLookups<TUser> = WithLookups<TUser>>(action: PermissionAction, subject: TSubject, options?: {
     /**
      * Prerequisite lookups whose resolved values are passed to {@link where}
      * via its third argument. See {@link Grant.with}.
@@ -255,7 +272,7 @@ type GrantFn<TUser, TTables extends SchemaMap = SchemaMap> = <TWith extends With
      * {@link with}, keyed by the same names; pass an empty `with` map (or
      * omit it) when the filter does not need cross-table data.
      */
-    where?: (columns: Record<string, unknown>, user: TUser, lookups: {
+    where?: (columns: ColumnsOf<TSubject, TTables>, user: TUser, lookups: {
         [K in keyof TWith]: Awaited<ReturnType<TWith[K]>>;
     }) => DrizzleSQL | undefined;
 }) => Grant;
@@ -403,4 +420,4 @@ declare class PermissionRegistrationError extends Error {
     constructor(subject: string, availableTables: readonly string[]);
 }
 
-export { CRUD_ACTIONS as C, type DrizzleTable as D, ForbiddenError as F, type Grant as G, type LookupDb as L, type PermissionsConfig as P, type SchemaMap as S, type TableName as T, type WithLookups as W, type Permissions as a, type PermissionAction as b, type SubjectInput as c, type WhereClause as d, type PermissionDescriptor as e, type PermissionCheckResult as f, type CrudAction as g, type GrantFn as h, type LookupFn as i, PermissionRegistrationError as j, type SqlNameOf as k, getTableName as l };
+export { CRUD_ACTIONS as C, type DrizzleTable as D, ForbiddenError as F, type Grant as G, type LookupDb as L, type PermissionsConfig as P, type SchemaMap as S, type TableName as T, type WithLookups as W, type Permissions as a, type PermissionAction as b, type SubjectInput as c, type WhereClause as d, type PermissionDescriptor as e, type PermissionCheckResult as f, type ColumnsOf as g, type CrudAction as h, type GrantFn as i, type LookupFn as j, PermissionRegistrationError as k, type SqlNameOf as l, getTableName as m };

package/dist/client.d.ts

@@ -1 +1 @@
-export { g as CrudAction, F as ForbiddenError, b as PermissionAction, f as PermissionCheckResult, e as PermissionDescriptor } from './client-D6goQV8b.js';
+export { h as CrudAction, F as ForbiddenError, b as PermissionAction, f as PermissionCheckResult, e as PermissionDescriptor } from './client-DpwiMpD0.js';

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { P as PermissionsConfig, a as Permissions, S as SchemaMap, b as PermissionAction, c as SubjectInput, W as WithLookups, d as WhereClause, G as Grant, e as PermissionDescriptor, f as PermissionCheckResult } from './client-D6goQV8b.js';
-export { C as CRUD_ACTIONS, g as CrudAction, D as DrizzleTable, F as ForbiddenError, h as GrantFn, L as LookupDb, i as LookupFn, j as PermissionRegistrationError, k as SqlNameOf, T as TableName, l as getTableName } from './client-D6goQV8b.js';
+import { P as PermissionsConfig, a as Permissions, S as SchemaMap, b as PermissionAction, c as SubjectInput, W as WithLookups, d as WhereClause, G as Grant, e as PermissionDescriptor, f as PermissionCheckResult } from './client-DpwiMpD0.js';
+export { C as CRUD_ACTIONS, g as ColumnsOf, h as CrudAction, D as DrizzleTable, F as ForbiddenError, i as GrantFn, L as LookupDb, j as LookupFn, k as PermissionRegistrationError, l as SqlNameOf, T as TableName, m as getTableName } from './client-DpwiMpD0.js';
 
 /**
  * Creates a permission configuration that can be shared between server-side

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfast/permissions",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Isomorphic, composable permission system with Drizzle-native row-level access control",
   "keywords": [
     "cfast",