@kozou/svelte-ui 1.1.1 → 1.3.0

package/build/server/chunks/{error.svelte-B3vg3Q2F.js → error.svelte-u8Vsq8vF.js}

@@ -1,17 +1,17 @@
 import 'node:module';
 import { q as escape_html, x as getContext } from './dev-yFiAtg5l.js';
-import './client-DLR5dxwU.js';
+import './client-C004jkBy.js';
 import 'clsx';
-import './internal-BkKkeKsj.js';
+import './internal-fxcuSPWe.js';
 import './index-DBqjc0Yf.js';
 
 //#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/app/state/server.js
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/app/state/server.js
 function context() {
 	return getContext("__request__");
 }
 //#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/app/state/index.js
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/app/state/index.js
 /**
 * A read-only reactive object with information about the current page, serving several use cases:
 * - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))
@@ -57,7 +57,7 @@ var page = {
 		return context().page.status;
 	}};
 //#endregion
-//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte
+//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte
 function Error$1($$renderer, $$props) {
 	$$renderer.component(($$renderer) => {
 		$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);
@@ -65,4 +65,4 @@ function Error$1($$renderer, $$props) {
 }
 
 export { Error$1 as default };
-//# sourceMappingURL=error.svelte-B3vg3Q2F.js.map
+//# sourceMappingURL=error.svelte-u8Vsq8vF.js.map

package/build/server/chunks/{error.svelte-B3vg3Q2F.js.map → error.svelte-u8Vsq8vF.js.map}

@@ -1 +1 @@
-{"version":3,"file":"error.svelte-B3vg3Q2F.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import \"../../chunks/environment.js\";\nimport { H as escape_html, tt as getContext } from \"../../chunks/dev.js\";\nimport { c as navigating$1, s as stores } from \"../../chunks/client.js\";\nObject.defineProperty({\n\tget from() {\n\t\treturn navigating$1.current ? navigating$1.current.from : null;\n\t},\n\tget to() {\n\t\treturn navigating$1.current ? navigating$1.current.to : null;\n\t},\n\tget type() {\n\t\treturn navigating$1.current ? navigating$1.current.type : null;\n\t},\n\tget willUnload() {\n\t\treturn navigating$1.current ? navigating$1.current.willUnload : null;\n\t},\n\tget delta() {\n\t\treturn navigating$1.current ? navigating$1.current.delta : null;\n\t},\n\tget complete() {\n\t\treturn navigating$1.current ? navigating$1.current.complete : null;\n\t}\n}, \"current\", { get() {\n\tthrow new Error(\"Replace navigating.current.<prop> with navigating.<prop>\");\n} });\nstores.updated.check;\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/app/state/server.js\nfunction context() {\n\treturn getContext(\"__request__\");\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/app/state/index.js\n/**\n* A read-only reactive object with information about the current page, serving several use cases:\n* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))\n* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))\n* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))\n* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error\n*\n* ```svelte\n* <!--- file: +layout.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* <\\/script>\n*\n* <p>Currently at {page.url.pathname}</p>\n*\n* {#if page.error}\n* \t<span class=\"red\">Problem detected</span>\n* {:else}\n* \t<span class=\"small\">All systems operational</span>\n* {/if}\n* ```\n*\n* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)\n*\n* ```svelte\n* <!--- file: +page.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* \tconst id = $derived(page.params.id); // This will correctly update id for usage on this page\n* \t$: badId = page.params.id; // Do not use; will never update after initial load\n* <\\/script>\n* ```\n*\n* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.\n*\n* @type {import('@sveltejs/kit').Page}\n*/\nvar page = {\n\tget data() {\n\t\treturn context().page.data;\n\t},\n\tget error() {\n\t\treturn context().page.error;\n\t},\n\tget form() {\n\t\treturn context().page.form;\n\t},\n\tget params() {\n\t\treturn context().page.params;\n\t},\n\tget route() {\n\t\treturn context().page.route;\n\t},\n\tget state() {\n\t\treturn context().page.state;\n\t},\n\tget status() {\n\t\treturn context().page.status;\n\t},\n\tget url() {\n\t\treturn context().page.url;\n\t}\n};\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_692b2477997906027053802989c8d7b8/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error$1($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error$1 as default };\n"],"names":[],"mappings":";;;;;;;AA0BA;AACA;AACA,SAAS,OAAO,GAAG;AACnB,CAAC,OAAO,UAAU,CAAC,aAAa,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,IAAI,GAAG;AACX,CAGC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAYC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAID,CAAC;AACD;AACA;AACA,SAAS,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;AACtC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}
+{"version":3,"file":"error.svelte-u8Vsq8vF.js","sources":["../../../.svelte-kit/adapter-node/entries/fallbacks/error.svelte.js"],"sourcesContent":["import \"../../chunks/environment.js\";\nimport { H as escape_html, tt as getContext } from \"../../chunks/dev.js\";\nimport { c as navigating$1, s as stores } from \"../../chunks/client.js\";\nObject.defineProperty({\n\tget from() {\n\t\treturn navigating$1.current ? navigating$1.current.from : null;\n\t},\n\tget to() {\n\t\treturn navigating$1.current ? navigating$1.current.to : null;\n\t},\n\tget type() {\n\t\treturn navigating$1.current ? navigating$1.current.type : null;\n\t},\n\tget willUnload() {\n\t\treturn navigating$1.current ? navigating$1.current.willUnload : null;\n\t},\n\tget delta() {\n\t\treturn navigating$1.current ? navigating$1.current.delta : null;\n\t},\n\tget complete() {\n\t\treturn navigating$1.current ? navigating$1.current.complete : null;\n\t}\n}, \"current\", { get() {\n\tthrow new Error(\"Replace navigating.current.<prop> with navigating.<prop>\");\n} });\nstores.updated.check;\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/app/state/server.js\nfunction context() {\n\treturn getContext(\"__request__\");\n}\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/app/state/index.js\n/**\n* A read-only reactive object with information about the current page, serving several use cases:\n* - retrieving the combined `data` of all pages/layouts anywhere in your component tree (also see [loading data](https://svelte.dev/docs/kit/load))\n* - retrieving the current value of the `form` prop anywhere in your component tree (also see [form actions](https://svelte.dev/docs/kit/form-actions))\n* - retrieving the page state that was set through `goto`, `pushState` or `replaceState` (also see [goto](https://svelte.dev/docs/kit/$app-navigation#goto) and [shallow routing](https://svelte.dev/docs/kit/shallow-routing))\n* - retrieving metadata such as the URL you're on, the current route and its parameters, and whether or not there was an error\n*\n* ```svelte\n* <!--- file: +layout.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* <\\/script>\n*\n* <p>Currently at {page.url.pathname}</p>\n*\n* {#if page.error}\n* \t<span class=\"red\">Problem detected</span>\n* {:else}\n* \t<span class=\"small\">All systems operational</span>\n* {/if}\n* ```\n*\n* Changes to `page` are available exclusively with runes. (The legacy reactivity syntax will not reflect any changes)\n*\n* ```svelte\n* <!--- file: +page.svelte --->\n* <script>\n* \timport { page } from '$app/state';\n* \tconst id = $derived(page.params.id); // This will correctly update id for usage on this page\n* \t$: badId = page.params.id; // Do not use; will never update after initial load\n* <\\/script>\n* ```\n*\n* On the server, values can only be read during rendering (in other words _not_ in e.g. `load` functions). In the browser, the values can be read at any time.\n*\n* @type {import('@sveltejs/kit').Page}\n*/\nvar page = {\n\tget data() {\n\t\treturn context().page.data;\n\t},\n\tget error() {\n\t\treturn context().page.error;\n\t},\n\tget form() {\n\t\treturn context().page.form;\n\t},\n\tget params() {\n\t\treturn context().page.params;\n\t},\n\tget route() {\n\t\treturn context().page.route;\n\t},\n\tget state() {\n\t\treturn context().page.state;\n\t},\n\tget status() {\n\t\treturn context().page.status;\n\t},\n\tget url() {\n\t\treturn context().page.url;\n\t}\n};\n//#endregion\n//#region ../../node_modules/.pnpm/@sveltejs+kit@2.61.1_@sveltejs+vite-plugin-svelte@7.1.2_svelte@5.55.9_@typescript-eslin_31b35890553a27fb0d8f940d66156f76/node_modules/@sveltejs/kit/src/runtime/components/svelte-5/error.svelte\nfunction Error$1($$renderer, $$props) {\n\t$$renderer.component(($$renderer) => {\n\t\t$$renderer.push(`<h1>${escape_html(page.status)}</h1> <p>${escape_html(page.error?.message)}</p>`);\n\t});\n}\n//#endregion\nexport { Error$1 as default };\n"],"names":[],"mappings":";;;;;;;AA0BA;AACA;AACA,SAAS,OAAO,GAAG;AACnB,CAAC,OAAO,UAAU,CAAC,aAAa,CAAC;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,IAAI,GAAG;AACX,CAGC,IAAI,KAAK,GAAG;AACb,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK;AAC7B,CAAC,CAAC;AACF,CAYC,IAAI,MAAM,GAAG;AACd,EAAE,OAAO,OAAO,EAAE,CAAC,IAAI,CAAC,MAAM;AAC9B,CAAC,CAID,CAAC;AACD;AACA;AACA,SAAS,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE;AACtC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,UAAU,KAAK;AACtC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;AACpG,CAAC,CAAC,CAAC;AACH;;;;"}

package/build/server/chunks/{hooks.server-VuiVxiIQ.js → hooks.server-DtCXcOVD.js}

@@ -1,4 +1,4 @@
-import { _ as __commonJSMin, b as __require } from './internal-BkKkeKsj.js';
+import { _ as __commonJSMin, b as __require } from './internal-fxcuSPWe.js';
 import { e as encodeResourceId } from './resource-id-PDcQeAnc.js';
 import { z } from 'zod';
 import require$$0$3 from 'events';
@@ -6482,6 +6482,37 @@ var KNOWN_TAGS = new Set([
 ]);
 var TAG_RE = /^\s*@([a-zA-Z_][a-zA-Z0-9_]*)\s*:(.*)$/;
 var INDENT_RE = /^[ \t]/;
+var LINE_WS_RE = /\s/;
+function isIdentStart(code) {
+	return code >= 97 && code <= 122 || code >= 65 && code <= 90 || code === 95;
+}
+function isIdentChar(code) {
+	return isIdentStart(code) || code >= 48 && code <= 57;
+}
+function tagTokenAt(line, start) {
+	let i = start;
+	if (i >= line.length || !isIdentStart(line.charCodeAt(i))) return null;
+	i += 1;
+	while (i < line.length && isIdentChar(line.charCodeAt(i))) i += 1;
+	const token = line.slice(start, i);
+	while (i < line.length && LINE_WS_RE.test(line[i])) i += 1;
+	return i < line.length && line[i] === ":" ? token : null;
+}
+function midlineKnownTag(line) {
+	let seenContent = false;
+	for (let i = 0; i < line.length; i += 1) {
+		const ch = line[i];
+		if (ch === "@" && seenContent) {
+			const token = tagTokenAt(line, i + 1);
+			if (token !== null && KNOWN_TAGS.has(token.toLowerCase())) return `@${token}:`;
+		}
+		if (!seenContent && !LINE_WS_RE.test(ch)) seenContent = true;
+	}
+	return null;
+}
+function warnMidlineTag(token) {
+	console.warn(`[@kozou/core] parseCommentTags: mid-line "${token}" is not parsed (tags are recognized at line start only; the text stays in the description verbatim)`);
+}
 function isWidgetType(value) {
 	return KNOWN_WIDGETS.has(value);
 }
@@ -6518,12 +6549,16 @@ function parseCommentTags(comment) {
 					continue;
 				}
 			} else if (line.trim().length > 0 && INDENT_RE.test(line) && !TAG_RE.test(line)) {
+				const midline = midlineKnownTag(line);
+				if (midline !== null) warnMidlineTag(midline);
 				pending.lines.push(line.trim());
 				bodyLines.push(line);
 				continue;
 			}
 			flushPending();
 		}
+		const midline = midlineKnownTag(line);
+		if (midline !== null) warnMidlineTag(midline);
 		const match = TAG_RE.exec(line);
 		if (!match) {
 			bodyLines.push(line);
@@ -6708,6 +6743,9 @@ function buildColumn(input) {
 		commentBody: parsed.body
 	});
 	const label = hints?.label ?? deriveLabel(column.name);
+	const priv = column.privileges;
+	const insertable = priv === void 0 ? void 0 : priv.insert;
+	const updatable = priv === void 0 ? void 0 : priv.update;
 	return {
 		name: column.name,
 		dataType: column.dataType,
@@ -6721,7 +6759,9 @@ function buildColumn(input) {
 		policy: parsed.policy,
 		widget,
 		enumValues,
-		readonly: hints?.readonly ?? false
+		readonly: hints?.readonly ?? false,
+		...insertable === void 0 ? {} : { insertable },
+		...updatable === void 0 ? {} : { updatable }
 	};
 }
 function buildRelations(table, issues) {
@@ -6904,13 +6944,32 @@ async function buildSchemaContext(opts) {
 			message: `UIHints view "${viewName}" does not exist in raw.views`
 		});
 	}
-	const tables = raw.tables.map((t) => buildTableContext({
+	const hiddenNames = [];
+	const visibleRawTables = raw.tables.filter((t) => {
+		if (t.privileges?.select === false) {
+			hiddenNames.push(t.name);
+			return false;
+		}
+		return true;
+	});
+	const visibleRawViews = raw.views.filter((v) => {
+		if (v.privileges?.select === false) {
+			hiddenNames.push(v.name);
+			return false;
+		}
+		return true;
+	});
+	if (hiddenNames.length > 0) {
+		const role = raw.tables.find((t) => t.privileges !== void 0)?.privileges?.role ?? raw.views.find((v) => v.privileges !== void 0)?.privileges?.role ?? "the role";
+		console.warn(`[@kozou/core] privilege-aware introspection: hid ${hiddenNames.length} relation(s) that "${role}" cannot SELECT: ${hiddenNames.join(", ")}`);
+	}
+	const tables = visibleRawTables.map((t) => buildTableContext({
 		table: t,
 		hints: uiHints?.tables?.[t.name],
 		issues,
 		knownTables
 	}));
-	const views = raw.views.map((v) => buildViewContext({
+	const views = visibleRawViews.map((v) => buildViewContext({
 		view: v,
 		hints: uiHints?.views?.[v.name],
 		issues
@@ -6921,7 +6980,7 @@ async function buildSchemaContext(opts) {
 		values: e.values,
 		description: null
 	}));
-	const concepts = raw.views.map(buildConcept);
+	const concepts = visibleRawViews.map(buildConcept);
 	if (issues.length > 0) {
 		if (strict) throw new KozouBuildError(`buildSchemaContext: ${issues.length} validation issue(s) (strict=true)`, issues);
 		for (const issue of issues) console.warn(`[@kozou/core] ${issue.path}: ${issue.message}`);
@@ -13900,6 +13959,83 @@ async function fetchEnums(client, schemas) {
 	}));
 }
 //#endregion
+//#region ../introspect/dist/privileges.js
+var tableKey = (schema, name) => `${schema}.${name}`;
+/** Throw a clear error if the configured privilege role does not exist, rather
+*  than letting `has_table_privilege` fail mid-query with a terse pg message. */
+async function assertRoleExists(client, role) {
+	if ((await runQuery(client, "SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = $1) AS exists", [role], "fetchPrivileges (role check)"))[0]?.exists !== true) throw new KozouIntrospectError(`introspection.respectPrivileges is on but the role "${role}" does not exist. Set it to the role the Admin UI assumes (auth.ui.role / auth.defaultRole), or turn privilege-aware introspection off.`);
+}
+/**
+* Evaluate the privileges of `role` on every base table / view (and base-table
+* columns) in `schemas`, and attach them to the matching `RawTable` /
+* `RawColumn` / `RawView`. Mutates the inputs in place (mirrors
+* `mergeTableMetadata`). Call only when privilege-aware mode is on; otherwise
+* the privilege fields stay `undefined`.
+*/
+async function fetchAndAttachPrivileges(client, schemas, role, tables, views) {
+	if (schemas.length === 0 || tables.length === 0 && views.length === 0) return;
+	await assertRoleExists(client, role);
+	const tableRows = await runQuery(client, `SELECT
+       n.nspname AS schema,
+       c.relname AS name,
+       has_schema_privilege($2, n.nspname, 'USAGE') AS usage,
+       has_table_privilege($2, c.oid, 'SELECT') AS sel,
+       has_table_privilege($2, c.oid, 'INSERT') AS ins,
+       has_table_privilege($2, c.oid, 'UPDATE') AS upd,
+       has_table_privilege($2, c.oid, 'DELETE') AS del
+     FROM pg_class c
+     JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relkind IN ('r', 'v', 'm')
+       AND n.nspname = ANY($1)`, [schemas, role], "fetchPrivileges (relations)");
+	const columnRows = await runQuery(client, `SELECT
+       n.nspname AS schema,
+       c.relname AS table,
+       a.attname AS name,
+       has_schema_privilege($2, n.nspname, 'USAGE') AS usage,
+       has_column_privilege($2, c.oid, a.attname, 'INSERT') AS ins,
+       has_column_privilege($2, c.oid, a.attname, 'UPDATE') AS upd
+     FROM pg_attribute a
+     JOIN pg_class c ON c.oid = a.attrelid
+     JOIN pg_namespace n ON n.oid = c.relnamespace
+     WHERE c.relkind = 'r'
+       AND n.nspname = ANY($1)
+       AND a.attnum > 0
+       AND NOT a.attisdropped`, [schemas, role], "fetchPrivileges (columns)");
+	const tablePrivByKey = /* @__PURE__ */ new Map();
+	for (const row of tableRows) tablePrivByKey.set(tableKey(row.schema, row.name), row);
+	const columnPrivByKey = /* @__PURE__ */ new Map();
+	for (const row of columnRows) {
+		const key = tableKey(row.schema, row.table);
+		if (!columnPrivByKey.has(key)) columnPrivByKey.set(key, /* @__PURE__ */ new Map());
+		columnPrivByKey.get(key).set(row.name, row);
+	}
+	const gate = (tp) => ({
+		role,
+		select: tp.usage && tp.sel,
+		insert: tp.usage && tp.ins,
+		update: tp.usage && tp.upd,
+		delete: tp.usage && tp.del
+	});
+	for (const table of tables) {
+		const key = tableKey(table.schema, table.name);
+		const tp = tablePrivByKey.get(key);
+		if (tp !== void 0) table.privileges = gate(tp);
+		const cols = columnPrivByKey.get(key);
+		if (cols !== void 0) for (const column of table.columns) {
+			const cp = cols.get(column.name);
+			if (cp !== void 0) column.privileges = {
+				insert: cp.usage && cp.ins,
+				update: cp.usage && cp.upd
+			};
+		}
+	}
+	for (const view of views) {
+		const vp = tablePrivByKey.get(tableKey(view.schema, view.name));
+		if (vp !== void 0) view.privileges = gate(vp);
+	}
+}
+//#endregion
 //#region ../introspect/dist/filter.js
 function compilePattern(pattern) {
 	const qualified = pattern.includes(".") ? pattern : `*.${pattern}`;
@@ -13983,6 +14119,7 @@ async function introspect(opts) {
 		mergeTableMetadata(allTables, await fetchForeignKeys(client, validSchemas), await fetchChecks(client, validSchemas));
 		const allViews = await fetchViews(client, validSchemas);
 		const enums = await fetchEnums(client, validSchemas);
+		if (opts.privilegeRole !== void 0) await fetchAndAttachPrivileges(client, validSchemas, opts.privilegeRole, allTables, allViews);
 		const filterOpts = {
 			include: opts.include,
 			exclude: opts.exclude
@@ -14092,7 +14229,11 @@ var SchemaCache = class {
 var cache = new SchemaCache({ loader: async () => {
 	const connection = process.env.DATABASE_URL;
 	if (typeof connection !== "string" || connection.length === 0) throw new Error("hooks.server: DATABASE_URL is required to introspect the schema.");
-	return buildSchemaContext({ raw: await introspect({ connection }) });
+	const privilegeRole = process.env.KOZOU_INTROSPECTION_ROLE;
+	return buildSchemaContext({ raw: await introspect({
+		connection,
+		...typeof privilegeRole === "string" && privilegeRole.length > 0 ? { privilegeRole } : {}
+	}) });
 } });
 var fkRowCache = new FkRowCache();
 var handle = async ({ event, resolve }) => {
@@ -14102,4 +14243,4 @@ var handle = async ({ event, resolve }) => {
 };
 
 export { handle };
-//# sourceMappingURL=hooks.server-VuiVxiIQ.js.map
+//# sourceMappingURL=hooks.server-DtCXcOVD.js.map