@managemint-solutions/sdk 0.38.0 → 0.38.1

package/dist/permissions/index.d.ts

@@ -9,7 +9,7 @@ export type PermissionFlags = {
 } & Record<string, boolean>;
 /**
  * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
- * with the user — INSERT and DELETE are `false` for `authenticated` — so this resource only
+ * with the user - INSERT and DELETE are `false` for `authenticated` - so this resource only
  * reads and updates.
  */
 export declare class PermissionsResource {
@@ -18,8 +18,8 @@ export declare class PermissionsResource {
     private readonly table;
     constructor(supabase: TypedSupabaseClient, auth: AuditActor, audit: AuditResource);
     /**
-     * The whole permissions row. `*` rather than a select string — the alternative is naming the
-     * two role flags and all 78 permission flags — so the internal `id` is dropped on the way out.
+     * The whole permissions row. `*` rather than a select string - the alternative is naming the
+     * two role flags and all 78 permission flags - so the internal `id` is dropped on the way out.
      */
     getForUser(userId: string): Promise<PermissionsEntity>;
     /**
@@ -28,13 +28,13 @@ export declare class PermissionsResource {
      * guard treats as a denial.
      *
      * `flag` is interpolated into the select string, so it is checked against the shape a column
-     * name can take first — a flag never comes from a request, only from a route's own decorator,
+     * name can take first - a flag never comes from a request, only from a route's own decorator,
      * so anything else is a bug rather than a bad request.
      */
     flagsFor(userId: string, flag: string): Promise<PermissionFlags | null>;
-    /** Whether a user owns the organization — the guard behind "you cannot deactivate the owner". */
+    /** Whether a user owns the organization - the guard behind "you cannot deactivate the owner". */
     isOwner(userId: string): Promise<boolean>;
-    /** Who owns the organization. Null when there is no owner row yet — signup is mid-flight. */
+    /** Who owns the organization. Null when there is no owner row yet - signup is mid-flight. */
     ownerUserId(): Promise<string | null>;
     /**
      * Permissions are keyed by `user_id` on the wire but audited by the row's own `mms_id`, so

package/dist/permissions/index.js

@@ -25,7 +25,7 @@ const PERMISSIONS_TABLE = {
 };
 /**
  * The `permissions` table. Rows are created by the `on_auth_user_created` trigger and deleted
- * with the user — INSERT and DELETE are `false` for `authenticated` — so this resource only
+ * with the user - INSERT and DELETE are `false` for `authenticated` - so this resource only
  * reads and updates.
  */
 class PermissionsResource {
@@ -38,8 +38,8 @@ class PermissionsResource {
         this.table = (0, audit_1.auditedTable)(supabase, auth, audit, PERMISSIONS_TABLE);
     }
     /**
-     * The whole permissions row. `*` rather than a select string — the alternative is naming the
-     * two role flags and all 78 permission flags — so the internal `id` is dropped on the way out.
+     * The whole permissions row. `*` rather than a select string - the alternative is naming the
+     * two role flags and all 78 permission flags - so the internal `id` is dropped on the way out.
      */
     async getForUser(userId) {
         const { data, error } = await this.supabase
@@ -58,7 +58,7 @@ class PermissionsResource {
      * guard treats as a denial.
      *
      * `flag` is interpolated into the select string, so it is checked against the shape a column
-     * name can take first — a flag never comes from a request, only from a route's own decorator,
+     * name can take first - a flag never comes from a request, only from a route's own decorator,
      * so anything else is a bug rather than a bad request.
      */
     async flagsFor(userId, flag) {
@@ -79,7 +79,7 @@ class PermissionsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return (data ?? null);
     }
-    /** Whether a user owns the organization — the guard behind "you cannot deactivate the owner". */
+    /** Whether a user owns the organization - the guard behind "you cannot deactivate the owner". */
     async isOwner(userId) {
         const { data, error } = await this.supabase
             .from('permissions')
@@ -91,7 +91,7 @@ class PermissionsResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data?.is_owner === true;
     }
-    /** Who owns the organization. Null when there is no owner row yet — signup is mid-flight. */
+    /** Who owns the organization. Null when there is no owner row yet - signup is mid-flight. */
     async ownerUserId() {
         const { data, error } = await this.supabase
             .from('permissions')

package/dist/pricebooks/index.d.ts

@@ -2,7 +2,7 @@ import type { SupabaseClient as SupabaseJsClient } from '@supabase/supabase-js';
 import type { PricebookWithModules } from '@managemint-solutions/entities/modules';
 /**
  * The public price catalog. `pricebooks`, `pricebook_modules` and `billing_modules` are readable
- * by `anon` by design — unauthenticated signup prices against them — so this resource takes no
+ * by `anon` by design - unauthenticated signup prices against them - so this resource takes no
  * auth context and scopes by nothing.
  */
 export declare class PricebooksResource {
@@ -13,7 +13,7 @@ export declare class PricebooksResource {
 }
 /**
  * What the given modules cost per month, in minor units: every module's unit price summed and
- * multiplied by the seat count. A module the pricebook does not price is a 400 — the caller
+ * multiplied by the seat count. A module the pricebook does not price is a 400 - the caller
  * asked for something that cannot be billed.
  */
 export declare const monthlyTotalMinor: (pricebook: PricebookWithModules, moduleKeys: string[], seatCount: number) => number;

package/dist/pricebooks/index.js

@@ -19,7 +19,7 @@ const PRICEBOOK_SELECT = `
     )
   )
 `;
-// A pricebook_modules row whose catalog entry did not come back leaves `module_key` undefined —
+// A pricebook_modules row whose catalog entry did not come back leaves `module_key` undefined -
 // the cast keeps the mapping honest about that rather than inventing a key.
 const toPricebookWithModules = (row) => ({
     mms_id: row.mms_id,
@@ -35,7 +35,7 @@ const toPricebookWithModules = (row) => ({
 });
 /**
  * The public price catalog. `pricebooks`, `pricebook_modules` and `billing_modules` are readable
- * by `anon` by design — unauthenticated signup prices against them — so this resource takes no
+ * by `anon` by design - unauthenticated signup prices against them - so this resource takes no
  * auth context and scopes by nothing.
  */
 class PricebooksResource {
@@ -67,7 +67,7 @@ class PricebooksResource {
 exports.PricebooksResource = PricebooksResource;
 /**
  * What the given modules cost per month, in minor units: every module's unit price summed and
- * multiplied by the seat count. A module the pricebook does not price is a 400 — the caller
+ * multiplied by the seat count. A module the pricebook does not price is a 400 - the caller
  * asked for something that cannot be billed.
  */
 const monthlyTotalMinor = (pricebook, moduleKeys, seatCount) => {

package/dist/projects/dto.js

@@ -196,7 +196,7 @@ __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, validators_1.IsNullable)()
     // Still v4: a manager is a `users.mms_id`, and that column carries the GoTrue auth uid the
-    // signup trigger copies out of `auth.users.id` — the table's uuidv7 default never fires.
+    // signup trigger copies out of `auth.users.id` - the table's uuidv7 default never fires.
     ,
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid manager ID format' }),
     __metadata("design:type", Object)
@@ -256,7 +256,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, validators_1.IsNullable)()
-    // Still v4 — a manager is a `users.mms_id`, the GoTrue auth uid (see CreateProjectDto).
+    // Still v4 - a manager is a `users.mms_id`, the GoTrue auth uid (see CreateProjectDto).
     ,
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid manager ID format' }),
     __metadata("design:type", Object)

package/dist/projects/index.d.ts

@@ -17,6 +17,6 @@ export declare class ProjectsResource {
     archive(projectId: string): Promise<ProjectEntity>;
     unarchive(projectId: string): Promise<ProjectEntity>;
     restore(projectId: string): Promise<ProjectEntity>;
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     remove(projectId: string): Promise<void>;
 }

package/dist/projects/index.js

@@ -126,7 +126,7 @@ class ProjectsResource {
         }
         // Excluding statuses has to be spelled out as "no status OR not one of these": PostgREST can
         // only filter a parent row by an embedded column with `!inner`, which would drop projects that
-        // have no status at all — and a project with no status is not complete, so it belongs in the
+        // have no status at all - and a project with no status is not complete, so it belongs in the
         // default view. SQL's `NOT IN` drops nulls for the same reason, hence the explicit null arm.
         // The ids are `@IsUUID('7')`-validated by the DTO, so interpolating them is safe. Repeated
         // `or` params are ANDed by PostgREST, so this composes with the search filter above.
@@ -205,7 +205,7 @@ class ProjectsResource {
         await this.table.transition(projectId, enum_1.AuditTrailAction.RESTORE, (0, transforms_1.restoredPatch)(this.auth.mms_id));
         return this.getById(projectId);
     }
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     async remove(projectId) {
         await this.table.transition(projectId, enum_1.AuditTrailAction.DELETE, (0, transforms_1.deletedPatch)(this.auth.mms_id));
     }

package/dist/service-client/index.d.ts

@@ -13,14 +13,14 @@ import { UsersResource } from '../users';
 import { WebhookEventsResource } from '../webhook-events';
 export type SupabaseServiceClientConfig = {
     url: string;
-    /** Service-role key — every query bypasses RLS. */
+    /** Service-role key - every query bypasses RLS. */
     serviceRoleKey: string;
     /** Where a failed audit insert is reported. Defaults to `console.error`. */
     onAuditError?: AuditErrorHandler;
 };
 /**
  * The organization-scoped half of the service client. Everything here is attributed to one
- * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would — with
+ * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would - with
  * `mms_id: null` when the actor is the system (a webhook, a queue worker, provisioning).
  */
 export declare class SupabaseOrganizationScope {
@@ -36,7 +36,7 @@ export declare class SupabaseOrganizationScope {
     readonly users: UsersResource;
     constructor(supabase: TypedSupabaseClient, actor: AuditActor, onAuditError?: AuditErrorHandler);
     /**
-     * An audited table bound to this organization and actor — the shape the api hand-rolls today
+     * An audited table bound to this organization and actor - the shape the api hand-rolls today
      * as a local `auditedTables(client, organizationId)` factory in billing, provisioning,
      * subscriptions and both webhook handler services.
      */
@@ -46,7 +46,7 @@ export declare class SupabaseOrganizationScope {
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
  * signup, the website's feature-request intake, and the writes RLS reserves for the service role
- * outright — the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
+ * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
  * It decodes no JWT, because there is none. Cross-org lookups (find the organization behind a
@@ -64,7 +64,7 @@ export declare class SupabaseServiceClient {
     readonly resendEvents: WebhookEventsResource;
     constructor(config: SupabaseServiceClientConfig);
     /**
-     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work —
+     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -
      * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.
      */
     forOrganization(organizationId: string, actorMmsId?: string | null): SupabaseOrganizationScope;

package/dist/service-client/index.js

@@ -18,7 +18,7 @@ const users_1 = require("../users");
 const webhook_events_1 = require("../webhook-events");
 /**
  * The organization-scoped half of the service client. Everything here is attributed to one
- * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would — with
+ * `AuditActor`, so writes land in `audit_logs` the same way a caller's own would - with
  * `mms_id: null` when the actor is the system (a webhook, a queue worker, provisioning).
  */
 class SupabaseOrganizationScope {
@@ -45,7 +45,7 @@ class SupabaseOrganizationScope {
         this.users = new users_1.UsersResource(supabase, actor, this.audit);
     }
     /**
-     * An audited table bound to this organization and actor — the shape the api hand-rolls today
+     * An audited table bound to this organization and actor - the shape the api hand-rolls today
      * as a local `auditedTables(client, organizationId)` factory in billing, provisioning,
      * subscriptions and both webhook handler services.
      */
@@ -58,7 +58,7 @@ exports.SupabaseOrganizationScope = SupabaseOrganizationScope;
  * The client for work that has no caller and no RLS context to run under: inbound webhooks
  * (Paystack, Resend, the Supabase `send_email` hook), the notification queue worker, unauthenticated
  * signup, the website's feature-request intake, and the writes RLS reserves for the service role
- * outright — the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
+ * outright - the ledger, the outbox, the webhook event logs, `organizations` INSERT, `permissions`
  * INSERT/DELETE.
  *
  * It decodes no JWT, because there is none. Cross-org lookups (find the organization behind a
@@ -85,7 +85,7 @@ class SupabaseServiceClient {
         this.featureRequests = new feature_requests_1.FeatureRequestsResource(this.supabase);
         this.configs = new configs_1.ConfigsResource(this.supabase);
         this.signup = new organizations_1.OrganizationSignupResource(this.supabase, (organizationId) => this.forOrganization(organizationId).audit);
-        // The outbox spans organizations — the row it is about carries its own — so it takes a
+        // The outbox spans organizations - the row it is about carries its own - so it takes a
         // factory and scopes per write rather than being built inside one organization's scope.
         this.notifications = new notifications_1.NotificationsOutboxResource(this.supabase, (organizationId) => this.forOrganization(organizationId).table({
             table: 'notifications',
@@ -93,7 +93,7 @@ class SupabaseServiceClient {
         }));
     }
     /**
-     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work —
+     * Scope to one organization once it is known. `actorMmsId` stays `null` for system work -
      * `audit_logs.created_by` is nullable precisely so an unattributed write is still recorded.
      */
     forOrganization(organizationId, actorMmsId = null) {

package/dist/support/dto.js

@@ -18,7 +18,7 @@ const validators_1 = require("../validators");
 // wire contract cannot drift.
 /**
  * Whitespace on either side of a pasted value is not part of the answer. Trimming here rather
- * than in the api means the length rules below measure what will actually be sent — a name of
+ * than in the api means the length rules below measure what will actually be sent - a name of
  * three spaces is empty, not three characters long.
  */
 const Trim = () => (0, class_transformer_1.Transform)(({ value }) => (typeof value === 'string' ? value.trim() : value), {

package/dist/supporting-files/dto.js

@@ -14,7 +14,7 @@ const class_validator_1 = require("class-validator");
 const enum_1 = require("@managemint-solutions/entities/supporting-files/enum");
 // class-validator versions of the shared DTO types from @managemint-solutions/entities.
 // Each class `implements` its entities type so the wire contract cannot drift. There is no class
-// for the upload payload — it arrives as multipart and is not validated by class-validator.
+// for the upload payload - it arrives as multipart and is not validated by class-validator.
 class SupportingFileIdDto {
     supportingFileId;
 }

package/dist/supporting-files/index.js

@@ -33,7 +33,7 @@ const fileNameOf = (file) => file.extension ? `${file.name}.${file.extension}` :
 // casts at the returns declare the shape the select strings below produce (the columns are
 // defined in the api's supabase/migrations).
 //
-// Object keys are `organizationId/entityType/entityId/file` — the organization leads so a storage
+// Object keys are `organizationId/entityType/entityId/file` - the organization leads so a storage
 // policy can scope by tenant. A data migration renames the pre-existing objects, which have no
 // organization segment, into that prefix.
 class SupportingFilesResource {
@@ -87,13 +87,13 @@ class SupportingFilesResource {
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
         // Each client name is validated once here, and the object key, the duplicate check and the
-        // row are all built from that same split — so what is stored is what presign and remove
+        // row are all built from that same split - so what is stored is what presign and remove
         // rebuild later.
         const uploads = input.files.map((file) => ({
             file,
             ...(0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(file.name)),
         }));
-        // Every file is written to the bucket, duplicates included — an upsert refreshes the object.
+        // Every file is written to the bucket, duplicates included - an upsert refreshes the object.
         for (let index = 0; index < uploads.length; index += UPLOAD_BATCH_SIZE) {
             await Promise.all(uploads.slice(index, index + UPLOAD_BATCH_SIZE).map(async ({ file, name, extension }) => {
                 const { error } = await this.supabase.storage
@@ -104,7 +104,7 @@ class SupportingFilesResource {
                 }
             }));
         }
-        // Only files without an existing row get one — the rest were refreshed in place above.
+        // Only files without an existing row get one - the rest were refreshed in place above.
         const newFiles = uploads.filter((file) => !existingFileNames.includes(fileNameOf(file)));
         if (newFiles.length > 0) {
             await this.table.insertMany(newFiles.map(({ name, extension }) => ({
@@ -120,7 +120,7 @@ class SupportingFilesResource {
         return this.list(entity, entityId);
     }
     async remove(supportingFileId) {
-        // The row goes first — the helper's pre-read hands back what the object path is built from.
+        // The row goes first - the helper's pre-read hands back what the object path is built from.
         const data = await this.table.remove(supportingFileId);
         const { error: storageError } = await this.supabase.storage
             .from(BUCKET)

package/dist/supporting-files/paths.d.ts

@@ -2,13 +2,13 @@
  * The client-supplied file name, checked before it is allowed anywhere near an object key.
  *
  * The name is half of the key, so a separator or a `..` in it would let an upload escape its
- * entity's folder — and, now that the key starts with the organization, its tenant's folder.
+ * entity's folder - and, now that the key starts with the organization, its tenant's folder.
  * Anything that is not a plain file name is rejected outright rather than rewritten, so what the
  * `supporting_files` row records is exactly what was stored.
  */
 export declare const sanitizeFileName: (fileName: string) => string;
 /**
- * Splits an uploaded file name into the `name` / `extension` columns, on the *last* dot — so
+ * Splits an uploaded file name into the `name` / `extension` columns, on the *last* dot - so
  * `archive.tar.gz` is name `archive.tar`, extension `gz`, and `storagePath` rebuilds the key it
  * was stored under. A name with no dot has no extension.
  */
@@ -18,7 +18,7 @@ export declare const splitFileName: (fileName: string) => {
 };
 /**
  * Where an object lives in the `supporting-files` bucket. The organization leads the key so a
- * storage policy can scope objects by tenant — nothing below it is trusted for that.
+ * storage policy can scope objects by tenant - nothing below it is trusted for that.
  *
  * A data migration renames the existing objects (keyed `entity/entityId/file`) into their
  * organization's prefix; keys written from here already carry it.

package/dist/supporting-files/paths.js

@@ -4,14 +4,14 @@ exports.storagePath = exports.splitFileName = exports.sanitizeFileName = void 0;
 const errors_1 = require("../errors");
 /** Longest object-key segment a file name may become. */
 const MAX_FILE_NAME_LENGTH = 255;
-/** What a file name may be made of — no separators, no control characters, no leading dot. */
+/** What a file name may be made of - no separators, no control characters, no leading dot. */
 const SAFE_FILE_NAME = /^[A-Za-z0-9][A-Za-z0-9 ._()\-]*$/;
 const invalidFileName = () => new errors_1.SupabaseClientError({ status: 400, error: 'Storage Error', message: 'Invalid file name' });
 /**
  * The client-supplied file name, checked before it is allowed anywhere near an object key.
  *
  * The name is half of the key, so a separator or a `..` in it would let an upload escape its
- * entity's folder — and, now that the key starts with the organization, its tenant's folder.
+ * entity's folder - and, now that the key starts with the organization, its tenant's folder.
  * Anything that is not a plain file name is rejected outright rather than rewritten, so what the
  * `supporting_files` row records is exactly what was stored.
  */
@@ -31,7 +31,7 @@ const sanitizeFileName = (fileName) => {
 };
 exports.sanitizeFileName = sanitizeFileName;
 /**
- * Splits an uploaded file name into the `name` / `extension` columns, on the *last* dot — so
+ * Splits an uploaded file name into the `name` / `extension` columns, on the *last* dot - so
  * `archive.tar.gz` is name `archive.tar`, extension `gz`, and `storagePath` rebuilds the key it
  * was stored under. A name with no dot has no extension.
  */
@@ -44,7 +44,7 @@ const splitFileName = (fileName) => {
 exports.splitFileName = splitFileName;
 /**
  * Where an object lives in the `supporting-files` bucket. The organization leads the key so a
- * storage policy can scope objects by tenant — nothing below it is trusted for that.
+ * storage policy can scope objects by tenant - nothing below it is trusted for that.
  *
  * A data migration renames the existing objects (keyed `entity/entityId/file`) into their
  * organization's prefix; keys written from here already carry it.

package/dist/tasks/dto.js

@@ -21,7 +21,7 @@ class TaskIdDto {
 }
 exports.TaskIdDto = TaskIdDto;
 __decorate([
-    (0, class_validator_1.IsUUID)('7', { message: 'Invalid project ID format' }) // sic — the api's message, kept for parity
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid project ID format' }) // sic - the api's message, kept for parity
     ,
     __metadata("design:type", String)
 ], TaskIdDto.prototype, "taskId", void 0);
@@ -92,7 +92,7 @@ __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, validators_1.IsNullable)()
     // Still v4: the assignee is a `users.mms_id`, and that column carries the GoTrue auth uid the
-    // signup trigger copies out of `auth.users.id` — the table's uuidv7 default never fires.
+    // signup trigger copies out of `auth.users.id` - the table's uuidv7 default never fires.
     ,
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid assigned to ID format' }),
     __metadata("design:type", Object)
@@ -222,7 +222,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, validators_1.IsNullable)()
-    // Still v4 — an assignee is a `users.mms_id`, the GoTrue auth uid (see GetTasksDto).
+    // Still v4 - an assignee is a `users.mms_id`, the GoTrue auth uid (see GetTasksDto).
     ,
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid assigned to ID format' }),
     __metadata("design:type", Object)
@@ -295,7 +295,7 @@ __decorate([
 __decorate([
     (0, class_validator_1.IsOptional)(),
     (0, validators_1.IsNullable)()
-    // Still v4 — an assignee is a `users.mms_id`, the GoTrue auth uid (see GetTasksDto).
+    // Still v4 - an assignee is a `users.mms_id`, the GoTrue auth uid (see GetTasksDto).
     ,
     (0, class_validator_1.IsUUID)('4', { message: 'Invalid assigned to ID format' }),
     __metadata("design:type", Object)

package/dist/tasks/index.d.ts

@@ -17,6 +17,6 @@ export declare class TasksResource {
     archive(taskId: string): Promise<TaskEntity>;
     unarchive(taskId: string): Promise<TaskEntity>;
     restore(taskId: string): Promise<TaskEntity>;
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     remove(taskId: string): Promise<void>;
 }

package/dist/tasks/index.js

@@ -140,7 +140,7 @@ class TasksResource {
         }
         // Excluding statuses has to be spelled out as "no status OR not one of these": PostgREST can
         // only filter a parent row by an embedded column with `!inner`, which would drop tasks that
-        // have no status at all — and a task with no status is not complete, so it belongs in the
+        // have no status at all - and a task with no status is not complete, so it belongs in the
         // default view. SQL's `NOT IN` drops nulls for the same reason, hence the explicit null arm.
         // The ids are `@IsUUID('7')`-validated by the DTO, so interpolating them is safe. Repeated
         // `or` params are ANDed by PostgREST, so this composes with the search filter above.
@@ -197,7 +197,7 @@ class TasksResource {
         await this.table.transition(taskId, enum_1.AuditTrailAction.RESTORE, (0, transforms_1.restoredPatch)(this.auth.mms_id));
         return this.getById(taskId);
     }
-    /** Soft delete — the row stays, flagged `deleted`, and `restore()` brings it back. */
+    /** Soft delete - the row stays, flagged `deleted`, and `restore()` brings it back. */
     async remove(taskId) {
         await this.table.transition(taskId, enum_1.AuditTrailAction.DELETE, (0, transforms_1.deletedPatch)(this.auth.mms_id));
     }

package/dist/transforms.d.ts

@@ -2,24 +2,24 @@ import type { MmsList } from '@managemint-solutions/entities/common';
 /**
  * The `client_id` / `project_id` list filters accept either a plain UUID v7 or the base64-JSON
  * option value the portal's selects send (`{ mms_id }`, or `{ id }` as a fallback). Anything that
- * is not one of those — including a value that decodes to JSON without a UUID v7 — cannot filter
+ * is not one of those - including a value that decodes to JSON without a UUID v7 - cannot filter
  * anything, so it becomes `null` and the filter is skipped.
  */
 export declare const parseEntityIdFilter: (value: unknown) => string | null;
 /**
  * A `%value%` ilike pattern, double-quoted for PostgREST's `or=(...)` grammar so `,`, `(`, `)`,
  * `.`, `"` and `\` in the search stay literal instead of being read as more filters. Inside the
- * quotes only `"` and `\` need escaping, which is what PostgREST defines — the `\,` the list
+ * quotes only `"` and `\` need escaping, which is what PostgREST defines - the `\,` the list
  * endpoints used to emit was never an escape at all. LIKE's own wildcards `%` and `_` are left
  * alone and still match as wildcards; they only widen the caller's own search, never its scope.
  */
 export declare const ilikeContains: (value: string) => string;
-/** The `or=(...)` argument matching `search` against any of `columns` — `name.ilike."%x%",…`. */
+/** The `or=(...)` argument matching `search` against any of `columns` - `name.ilike."%x%",…`. */
 export declare const orIlike: (columns: readonly string[], search: string) => string;
 /**
  * `date` columns take an ISO string. The shared `CreateProjectDto`/`UpdateProjectDto` types
- * declare `Date`, but over the wire the value is the validated `@IsDateString` string — which
- * must reach Postgres byte-identical ('2026-04-22' is a plain date, not an instant) — so only a
+ * declare `Date`, but over the wire the value is the validated `@IsDateString` string - which
+ * must reach Postgres byte-identical ('2026-04-22' is a plain date, not an instant) - so only a
  * real `Date` (a portal caller) is serialized.
  */
 export declare const toDateInput: (value: Date | string | null | undefined) => string | null | undefined;
@@ -31,7 +31,7 @@ export declare const toDateInput: (value: Date | string | null | undefined) => s
 export declare const USER_PROFILE_EMBED: "(\n          mms_id,\n          name,\n          surname,\n          email,\n          profile_image\n        )";
 /**
  * The `MmsList` envelope every paginated read returns. `rows` is `unknown` because each select
- * string produces its own row shape — the caller's `T` is what declares it. `count` is
+ * string produces its own row shape - the caller's `T` is what declares it. `count` is
  * PostgREST's estimate, so an empty page reports 0 total pages rather than 1.
  */
 export declare const toMmsList: <T>(rows: unknown, page: number, pageSize: number, count: number | null) => MmsList<T>;

package/dist/transforms.js

@@ -3,7 +3,7 @@
 // select strings and their list results.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.restoredPatch = exports.deletedPatch = exports.unarchivedPatch = exports.archivedPatch = exports.toMmsList = exports.USER_PROFILE_EMBED = exports.toDateInput = exports.orIlike = exports.ilikeContains = exports.parseEntityIdFilter = void 0;
-// v7, to match the `mms_id` columns these filters compare against — `public.uuidv7()` is the
+// v7, to match the `mms_id` columns these filters compare against - `public.uuidv7()` is the
 // default on every table. This is the gate in front of `@IsUUID('7')`, so a stricter version
 // here would null the id out before validation ever saw it, and a looser one would let a value
 // through that the DTO then rejects.
@@ -11,7 +11,7 @@ const UUID_V7 = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f
 /**
  * The `client_id` / `project_id` list filters accept either a plain UUID v7 or the base64-JSON
  * option value the portal's selects send (`{ mms_id }`, or `{ id }` as a fallback). Anything that
- * is not one of those — including a value that decodes to JSON without a UUID v7 — cannot filter
+ * is not one of those - including a value that decodes to JSON without a UUID v7 - cannot filter
  * anything, so it becomes `null` and the filter is skipped.
  */
 const parseEntityIdFilter = (value) => {
@@ -35,19 +35,19 @@ exports.parseEntityIdFilter = parseEntityIdFilter;
 /**
  * A `%value%` ilike pattern, double-quoted for PostgREST's `or=(...)` grammar so `,`, `(`, `)`,
  * `.`, `"` and `\` in the search stay literal instead of being read as more filters. Inside the
- * quotes only `"` and `\` need escaping, which is what PostgREST defines — the `\,` the list
+ * quotes only `"` and `\` need escaping, which is what PostgREST defines - the `\,` the list
  * endpoints used to emit was never an escape at all. LIKE's own wildcards `%` and `_` are left
  * alone and still match as wildcards; they only widen the caller's own search, never its scope.
  */
 const ilikeContains = (value) => `"%${value.replace(/[\\"]/g, '\\$&')}%"`;
 exports.ilikeContains = ilikeContains;
-/** The `or=(...)` argument matching `search` against any of `columns` — `name.ilike."%x%",…`. */
+/** The `or=(...)` argument matching `search` against any of `columns` - `name.ilike."%x%",…`. */
 const orIlike = (columns, search) => columns.map((column) => `${column}.ilike.${(0, exports.ilikeContains)(search)}`).join(',');
 exports.orIlike = orIlike;
 /**
  * `date` columns take an ISO string. The shared `CreateProjectDto`/`UpdateProjectDto` types
- * declare `Date`, but over the wire the value is the validated `@IsDateString` string — which
- * must reach Postgres byte-identical ('2026-04-22' is a plain date, not an instant) — so only a
+ * declare `Date`, but over the wire the value is the validated `@IsDateString` string - which
+ * must reach Postgres byte-identical ('2026-04-22' is a plain date, not an instant) - so only a
  * real `Date` (a portal caller) is serialized.
  */
 const toDateInput = (value) => value instanceof Date ? value.toISOString() : value;
@@ -66,7 +66,7 @@ exports.USER_PROFILE_EMBED = `(
         )`;
 /**
  * The `MmsList` envelope every paginated read returns. `rows` is `unknown` because each select
- * string produces its own row shape — the caller's `T` is what declares it. `count` is
+ * string produces its own row shape - the caller's `T` is what declares it. `count` is
  * PostgREST's estimate, so an empty page reports 0 total pages rather than 1.
  */
 const toMmsList = (rows, page, pageSize, count) => {
@@ -85,7 +85,7 @@ const toMmsList = (rows, page, pageSize, count) => {
 exports.toMmsList = toMmsList;
 // The soft archive/delete patches projects, tasks and clients all write: the flag the transition
 // sets, plus the who/when stamps named after it. `unarchived`/`restored` clear the flag their
-// counterpart set and stamp their own columns — the earlier ones stay as the history.
+// counterpart set and stamp their own columns - the earlier ones stay as the history.
 const archivedPatch = (by) => ({
     archived: true,
     archived_at: new Date().toISOString(),

package/dist/users/dto.d.ts

@@ -16,7 +16,7 @@ export declare class AddUserDto implements CreateUserDtoType {
      * Optional: an internally created user - the owner at signup - has no client
      * request behind it, and one is generated for it.
      *
-     * Still v4: the key is not an `mms_id` — the column is `text` — and the api fills a missing
+     * Still v4: the key is not an `mms_id` - the column is `text` - and the api fills a missing
      * one with `randomUUID()`, which is v4.
      */
     readonly idempotency_key?: string;
@@ -50,13 +50,13 @@ export declare class UpdateUserDto implements UpdateUserDtoType {
     readonly emergency_contact_email?: string | null;
 }
 /**
- * `PATCH /users/me` — what a member may change about themselves.
+ * `PATCH /users/me` - what a member may change about themselves.
  *
  * Every field here also appears on UpdateUserDto with the same constraints; what makes
  * this a separate class is what it *omits*. The api's ValidationPipe runs
  * `whitelist + forbidNonWhitelisted`, so a self-service request carrying `job_title`,
  * `manager_id`, `employment_type`, `start_date`, `end_date` or `profile_image` is
- * rejected with a 400 rather than silently ignored — the narrowing is the guard.
+ * rejected with a 400 rather than silently ignored - the narrowing is the guard.
  */
 export declare class UpdateMyProfileDto implements UpdateMyProfileDtoType {
     readonly name: string;

package/dist/users/dto.js

@@ -38,7 +38,7 @@ class AddUserDto {
      * Optional: an internally created user - the owner at signup - has no client
      * request behind it, and one is generated for it.
      *
-     * Still v4: the key is not an `mms_id` — the column is `text` — and the api fills a missing
+     * Still v4: the key is not an `mms_id` - the column is `text` - and the api fills a missing
      * one with `randomUUID()`, which is v4.
      */
     idempotency_key;
@@ -87,7 +87,7 @@ __decorate([
     __metadata("design:type", String)
 ], AddUserDto.prototype, "idempotency_key", void 0);
 // `active_in` arrives as a CSV string and is transformed to booleans, so it is omitted from the
-// implemented contract — the same exception GetClientsDto makes for status_id_in.
+// implemented contract - the same exception GetClientsDto makes for status_id_in.
 class GetUsersQueryDto {
     search;
     page = 1;
@@ -284,13 +284,13 @@ __decorate([
     __metadata("design:type", Object)
 ], UpdateUserDto.prototype, "emergency_contact_email", void 0);
 /**
- * `PATCH /users/me` — what a member may change about themselves.
+ * `PATCH /users/me` - what a member may change about themselves.
  *
  * Every field here also appears on UpdateUserDto with the same constraints; what makes
  * this a separate class is what it *omits*. The api's ValidationPipe runs
  * `whitelist + forbidNonWhitelisted`, so a self-service request carrying `job_title`,
  * `manager_id`, `employment_type`, `start_date`, `end_date` or `profile_image` is
- * rejected with a 400 rather than silently ignored — the narrowing is the guard.
+ * rejected with a 400 rather than silently ignored - the narrowing is the guard.
  */
 class UpdateMyProfileDto {
     name;