permdock 0.3.1 → 0.5.0

package/dist/{sources-4p0-4xQm.js → sources-vs5dGOsS.js}

@@ -1,5 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
 //#region src/supabase/keep.ts
 /** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
 function keptKeys(row) {
@@ -11,123 +12,22 @@ function keptKeys(row) {
 	return [...new Set(valid)].toSorted();
 }
 //#endregion
-//#region src/supabase/roles.ts
-function isRoleList(role) {
-	return Array.isArray(role);
-}
-/**
-* Resolves the role sources of `table` (`schema.table`, or `public`). An
-* unqualified `through` table is in `table`'s schema. `label` names the
-* option in the error for an `on` that is not exactly one column; `prefix`
-* starts every error. A row with several sources holds the union of their
-* non-null keys.
-*/
-function roleColumn(role, table, alias, options) {
-	if (!isRoleList(role)) return singleRole(role, table, alias, options);
-	const prefix = options.prefix ?? "PermDock";
-	const parts = role.map((part, index) => singleRole(part, table, alias, {
-		...options,
-		label: `${options.label}[${String(index)}]`
-	}));
-	const [first] = parts;
-	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
-	if (parts.length === 1) return first;
-	const rows = quoteSqlIdent(`${alias}r`, prefix);
-	const values = quoteSqlIdent(`${alias}v`, prefix);
-	const sql = `${rows}.permdock_role`;
-	return {
-		column: first.column,
-		sql,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
-		lookup: sql,
-		columns: [...new Set(parts.map((part) => part.column))],
-		throughs: parts.flatMap((part) => part.throughs),
-		lateral: true
-	};
-}
-function singleRole(role, table, alias, options) {
-	const prefix = options.prefix ?? "PermDock";
-	const q = (name) => quoteSqlIdent(name, prefix);
-	if (typeof role === "string") return {
-		column: role,
-		sql: `${alias}.${q(role)}::text`,
-		join: "",
-		lookup: `${alias}.${q(role)}::text`,
-		columns: [role],
-		throughs: [],
-		lateral: false
-	};
-	const pairs = Object.entries(role.on);
-	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
-	const [ref, id] = pair;
-	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
-	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
-	const keys = options.joined ?? `${alias}k`;
-	const target = quoteSqlTable(through, prefix);
-	const keyed = {
-		table: through,
-		id,
-		key: role.column,
-		ref
-	};
-	return {
-		column: ref,
-		sql: `${keys}.${q(role.column)}::text`,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
-		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
-		through: keyed,
-		columns: [ref],
-		throughs: [keyed],
-		lateral: false
-	};
-}
-/** The manifest entry of one role source: the column, and the roles table it references. */
-function sourceManifest(column, through) {
-	return through === void 0 ? { column } : {
-		column,
-		through: {
-			table: through.table,
-			id: through.id,
-			column: through.key
-		}
-	};
-}
-/** The manifest entry of a single-source column, such as a membership's user. */
-function columnManifest(role) {
-	return sourceManifest(role.column, role.through);
-}
-/** The manifest entry of a role column, or one entry per source of a row with several. */
-function roleManifest(role) {
-	if (!role.lateral) return sourceManifest(role.column, role.through);
-	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
-}
-//#endregion
-//#region src/supabase/sources.ts
-const ident = (name) => quoteSqlIdent(name);
-const literal = quoteSqlLiteral;
-function qualifiedName(name) {
-	return name.includes(".") ? name : `public.${name}`;
-}
-function qualified(name) {
-	return quoteSqlTable(qualifiedName(name));
-}
+//#region src/supabase/membership-sql.ts
+const ident$1 = (name) => quoteSqlIdent(name);
+const literal$1 = quoteSqlLiteral;
 function col(name) {
-	return `m.${ident(name)}`;
+	return `m.${ident$1(name)}`;
 }
 function activeRow(row, id) {
-	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
-	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	const parts = [`s.${ident$1(row.id)}::text = (${id})::text`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident$1(row.disabledAt)} is null`);
 	if (row.status !== void 0) {
 		const values = row.active ?? [];
 		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
+		parts.push(`s.${ident$1(row.status)}::text = any(array[${values.map(literal$1).join(", ")}]::text[])`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
-	return `exists (select 1 from ${qualified(row.table)} s where ${parts.join(" and ")})`;
-}
-function textArray(values) {
-	return `array[${values.map(literal).join(", ")}]::text[]`;
+	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
 /**
 * The suspendable instances on the row's chain whose scope keeps
@@ -163,8 +63,8 @@ function keptSql(shape) {
 	const list = keeping(shape);
 	if (list.length === 0) return;
 	const keys = [...new Set(list.flatMap((item) => item.keep))].toSorted();
-	const each = list.map((item) => `(${item.active} or k = any(${textArray(item.keep)}))`).join(" and ");
-	return `(select jsonb_agg(k order by k) from unnest(${textArray(keys)}) k where ${each})`;
+	const each = list.map((item) => `(${item.active} or k = any(${sqlTextArray(item.keep)}))`).join(" and ");
+	return `(select jsonb_agg(k order by k) from unnest(${sqlTextArray(keys)}) k where ${each})`;
 }
 function allActive(shape) {
 	return keeping(shape).map((item) => item.active).join(" and ");
@@ -204,6 +104,7 @@ function selectOf(shape, where, user, keep) {
 		`${shape.memberGroup} as member_group`,
 		`${shape.managed} as managed_by`,
 		`${shape.seats} as seats`,
+		...shape.x === void 0 ? [] : [`${col(shape.x)} as x`],
 		...keep ? [`${keepColumn(shape)} as keep`] : []
 	];
 	const group = [
@@ -212,14 +113,14 @@ function selectOf(shape, where, user, keep) {
 		...keepsDisabled(shape) && shape.disabledAt !== void 0 ? [`(${enabled(shape.disabledAt)})`] : []
 	];
 	return `select ${fields.join(", ")}
-from ${qualified(shape.table)} m${shape.join}
+from ${quoteQualifiedTable(shape.table)} m${shape.join}
 where ${where.join("\n  and ")}
 group by ${group.join(", ")}`;
 }
 function holdersOf(shape) {
-	const id = ident(shape.idColumn);
+	const id = ident$1(shape.idColumn);
 	return {
-		idType: `${qualified(shape.table)}.${id}%type`,
+		idType: `${quoteQualifiedTable(shape.table)}.${id}%type`,
 		id: (scope, row) => {
 			const filter = shape.holds(scope, row);
 			return filter === void 0 ? "null::text" : filter === "true" ? `${row}.${id}::text` : `case when ${filter} then ${row}.${id}::text end`;
@@ -231,7 +132,7 @@ function holdersOf(shape) {
 			const live = conditions.length === 0 ? "true" : conditions.length === 1 ? conditions.join("") : `(${conditions.join(" and ")})`;
 			const kept = where.filter((part) => part !== "true");
 			return `select m.${id}::text as id, ${shape.userSql}::text as user_id, ${shape.roleKey} as role, ${shape.via} as via, ${live} as live
-from ${options.from ?? qualified(shape.table)} m${shape.join}${shape.roleJoin}${kept.length === 0 ? "" : `\nwhere ${kept.join(" and ")}`}`;
+from ${options.from ?? quoteQualifiedTable(shape.table)} m${shape.join}${shape.roleJoin}${kept.length === 0 ? "" : `\nwhere ${kept.join(" and ")}`}`;
 		}
 	};
 }
@@ -242,14 +143,14 @@ function sqlOf(shape) {
 		table: shape.table,
 		user: shape.user,
 		userThrough: shape.userThrough,
-		userType: shape.userThrough === void 0 ? `${qualified(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
+		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident$1(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident$1(shape.userThrough.key)}%type`,
 		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
 		managed: shape.managedColumn,
 		through: shape.through,
 		throughs: shape.throughs,
 		columns: [...new Set(shape.columns)],
 		manifest: {
-			table: qualifiedName(shape.table),
+			table: qualifySqlTable(shape.table),
 			...shape.manifest,
 			columns: [...new Set(shape.columns)]
 		},
@@ -258,19 +159,115 @@ function sqlOf(shape) {
 		list: (keep = keptSql(shape) !== void 0) => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true, keep)
 	});
 }
+//#endregion
+//#region src/supabase/roles.ts
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/**
+* Resolves the role sources of `table` (`schema.table`, or `public`). An
+* unqualified `through` table is in `table`'s schema. `label` names the
+* option in the error for an `on` that is not exactly one column; `prefix`
+* starts every error. A row with several sources holds the union of their
+* non-null keys.
+*/
+function roleColumn(role, table, alias, options) {
+	if (!isRoleList(role)) return singleRole(role, table, alias, options);
+	const prefix = options.prefix ?? "PermDock";
+	const parts = role.map((part, index) => singleRole(part, table, alias, {
+		...options,
+		label: `${options.label}[${String(index)}]`
+	}));
+	const [first] = parts;
+	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
+	if (parts.length === 1) return first;
+	const rows = quoteSqlIdent(`${alias}r`, prefix);
+	const values = quoteSqlIdent(`${alias}v`, prefix);
+	const sql = `${rows}.permdock_role`;
+	return {
+		column: first.column,
+		sql,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
+		lookup: sql,
+		columns: [...new Set(parts.map((part) => part.column))],
+		throughs: parts.flatMap((part) => part.throughs),
+		lateral: true
+	};
+}
+function singleRole(role, table, alias, options) {
+	const prefix = options.prefix ?? "PermDock";
+	const q = (name) => quoteSqlIdent(name, prefix);
+	if (typeof role === "string") return {
+		column: role,
+		sql: `${alias}.${q(role)}::text`,
+		join: "",
+		lookup: `${alias}.${q(role)}::text`,
+		columns: [role],
+		throughs: [],
+		lateral: false
+	};
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
+	const [ref, id] = pair;
+	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
+	const keys = options.joined ?? `${alias}k`;
+	const target = quoteSqlTable(through, prefix);
+	const keyed = {
+		table: through,
+		id,
+		key: role.column,
+		ref
+	};
+	return {
+		column: ref,
+		sql: `${keys}.${q(role.column)}::text`,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
+		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		through: keyed,
+		columns: [ref],
+		throughs: [keyed],
+		lateral: false
+	};
+}
+/** The manifest entry of one role source: the column, and the roles table it references. */
+function sourceManifest(column, through) {
+	return through === void 0 ? { column } : {
+		column,
+		through: {
+			table: through.table,
+			id: through.id,
+			column: through.key
+		}
+	};
+}
+/** The manifest entry of a single-source column, such as a membership's user. */
+function columnManifest(role) {
+	return sourceManifest(role.column, role.through);
+}
+/** The manifest entry of a role column, or one entry per source of a row with several. */
+function roleManifest(role) {
+	if (!role.lateral) return sourceManifest(role.column, role.through);
+	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
+}
+//#endregion
+//#region src/supabase/sources.ts
+const ident = (name) => quoteSqlIdent(name);
+const literal = quoteSqlLiteral;
 function isFixed(roles) {
 	return Array.isArray(roles);
 }
 /** A role column of the membership table, aliased `m`; a `through` column joins its roles table as `mk`. */
 function memberRole(role, table, label) {
-	return roleColumn(role, qualifiedName(table), "m", {
+	return roleColumn(role, qualifySqlTable(table), "m", {
 		label,
 		indent: ""
 	});
 }
 /** The user of the membership table, aliased `m`; a `through` user joins its table as `mu`. */
 function memberUser(user, table, label) {
-	const column = roleColumn(user, qualifiedName(table), "m", {
+	const column = roleColumn(user, qualifySqlTable(table), "m", {
 		label,
 		indent: "",
 		joined: "mu",
@@ -294,7 +291,8 @@ function membershipOf(row) {
 	const roles = strings(row["roles"]);
 	if (typeof row["scope"] !== "string" || typeof row["id"] !== "string") return;
 	if (roles.length === 0) return;
-	const within = row["within"] !== null && typeof row["within"] === "object" && !Array.isArray(row["within"]) ? Object.fromEntries(Object.entries(row["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const rawWithin = row["within"];
+	const within = isRecord(rawWithin) ? Object.fromEntries(Object.entries(rawWithin).filter((entry) => typeof entry[1] === "string")) : void 0;
 	const expires = typeof row["expires_at"] === "number" ? row["expires_at"] : typeof row["expires_at"] === "string" && row["expires_at"] !== "" ? Number(row["expires_at"]) : void 0;
 	const seats = strings(row["seats"]);
 	const keep = row["keep"];
@@ -311,7 +309,8 @@ function membershipOf(row) {
 		member: typeof row["member_group"] === "string" && row["member_group"] !== "" ? { group: row["member_group"] } : void 0,
 		managedBy: row["managed_by"] === "idp" ? "idp" : void 0,
 		entitlements: seats.length === 0 ? void 0 : seats,
-		keep: keep === null || keep === void 0 ? void 0 : strings(keep)
+		keep: keep === null || keep === void 0 ? void 0 : strings(keep),
+		x: row["x"] === null ? void 0 : readAppData(void 0, row["x"])
 	});
 }
 function sourceOf(sql, query) {
@@ -340,11 +339,14 @@ function sourceOf(sql, query) {
 }
 /**
 * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
-* `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
+* `SqlQuery` for `tableMembershipSource`, `junctionMembershipSource` and `supabaseApprovalStore`.
 * `ctx.postgres` runs as the caller under RLS, so the membership tables must
 * be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
 */
-function fromSupabasePostgres(postgres) {
+function optionalColumn(name, cast) {
+	return name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
+}
+function supabasePostgresQuery(postgres) {
 	return (text, values) => postgres.queryRaw(text, [...values]);
 }
 /**
@@ -353,14 +355,13 @@ function fromSupabasePostgres(postgres) {
 * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
 * merge into one membership.
 */
-function fromTable(options) {
+function tableMembershipSource(options) {
 	const c = options.columns ?? {};
 	const scope = `${col(c.scope ?? "scope")}::text`;
 	const id = `${col(c.id ?? "scope_id")}::text`;
 	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
-	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
-	const user = memberUser(c.user ?? "user_id", options.table, "fromTable columns.user");
-	const role = memberRole(c.role ?? "role", options.table, "fromTable columns.role");
+	const user = memberUser(c.user ?? "user_id", options.table, "tableMembershipSource columns.user");
+	const role = memberRole(c.role ?? "role", options.table, "tableMembershipSource columns.role");
 	return sourceOf(sqlOf({
 		table: options.table,
 		join: `${user.column.join}${role.join}`,
@@ -373,15 +374,16 @@ function fromTable(options) {
 		id,
 		within,
 		roles: roleAgg(role),
-		via: optional(c.via, "text"),
+		via: optionalColumn(c.via, "text"),
 		expiresAt: c.expiresAt,
 		disabledAt: c.disabledAt,
-		grantedBy: optional(c.grantedBy, "text"),
-		reason: optional(c.reason, "text"),
-		memberGroup: optional(c.group, "text"),
-		managed: optional(c.managedBy, "text"),
+		grantedBy: optionalColumn(c.grantedBy, "text"),
+		reason: optionalColumn(c.reason, "text"),
+		memberGroup: optionalColumn(c.group, "text"),
+		managed: optionalColumn(c.managedBy, "text"),
 		managedColumn: c.managedBy,
 		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
+		x: c.x,
 		idOf: (name) => `coalesce(case when ${scope} = ${literal(name)} then ${id} end${c.within === void 0 ? "" : `, ${within} ->> ${literal(name)}`})`,
 		idColumn: c.id ?? "scope_id",
 		holds: (name, alias) => `${alias}.${ident(c.scope ?? "scope")}::text = ${literal(name)}`,
@@ -398,7 +400,8 @@ function fromTable(options) {
 				c.reason,
 				c.group,
 				c.managedBy,
-				c.seats
+				c.seats,
+				c.x
 			].filter((name) => name !== void 0).map(col)
 		],
 		suspension: options.suspension,
@@ -431,15 +434,15 @@ function fromTable(options) {
 * membership of `scope`, with roles from a column or fixed (`['contact']`), a
 * fixed `via`, and ancestor ids from `within` columns.
 */
-function fromJunction(options) {
+function junctionMembershipSource(options) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
 	const idColumn = options.id ?? `${options.scope}_id`;
 	const withinEntries = Object.entries(options.within ?? {});
 	const roles = options.roles;
 	const fixed = isFixed(roles) ? roles : void 0;
-	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
-	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "fromJunction roles");
-	const user = memberUser(options.user ?? "user_id", options.table, "fromJunction user");
+	if (fixed?.length === 0) throw new TypeError("PermDock: junctionMembershipSource needs at least one role");
+	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "junctionMembershipSource roles");
+	const user = memberUser(options.user ?? "user_id", options.table, "junctionMembershipSource user");
 	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
 	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
 	const shape = {
@@ -463,6 +466,7 @@ function fromJunction(options) {
 		managed: managedColumn === void 0 ? "null::text" : managedColumn === "" ? `'idp'::text` : `${col(managedColumn)}::text`,
 		managedColumn,
 		seats: options.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(options.seats)})`,
+		x: options.x,
 		idColumn,
 		holds: (name) => name === options.scope ? "true" : void 0,
 		roleKey: role === void 0 ? "mf.role" : role.sql,
@@ -481,7 +485,8 @@ function fromJunction(options) {
 				options.reason,
 				groupColumn,
 				managedColumn === "" ? void 0 : managedColumn,
-				options.seats
+				options.seats,
+				options.x
 			].filter((name) => name !== void 0).map(col)
 		],
 		suspension: options.suspension,
@@ -534,7 +539,7 @@ function hookApiNames(prefix = HOOK_API_PREFIX) {
 * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
 */
 function authzVersion(options) {
-	const table = qualified(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
+	const table = quoteQualifiedTable(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
 	return async (principal) => {
 		const value = rowsOf(await options.query(`select version from ${table} where user_id = $1`, [principal.id]))[0]?.["version"];
 		const version = typeof value === "number" ? value : value === void 0 ? 0 : Number(value);
@@ -542,4 +547,4 @@ function authzVersion(options) {
 	};
 }
 //#endregion
-export { fromJunction as a, hookApiNames as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, fromSupabasePostgres as o, PERMDOCK_SCHEMA as r, fromTable as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };
+export { hookApiNames as a, tableMembershipSource as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, junctionMembershipSource as o, PERMDOCK_SCHEMA as r, supabasePostgresQuery as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };

package/dist/sql-B5T1IL83.js

@@ -0,0 +1,55 @@
+//#region src/core/sql.ts
+/** A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and `_`, not starting with a digit. */
+const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+/** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
+function quoteSqlIdent(name, prefix = "PermDock") {
+	return `"${assertSqlIdent(name, prefix)}"`;
+}
+/** A schema-qualified name, each part validated by `quoteSqlIdent`. */
+function quoteSqlTable(name, prefix = "PermDock") {
+	return name.split(".").map((part) => quoteSqlIdent(part, prefix)).join(".");
+}
+/** A single-quoted string literal with embedded quotes doubled. */
+function quoteSqlLiteral(value) {
+	return `'${value.replaceAll("'", "''")}'`;
+}
+/** A double-quoted identifier read back from a database, embedded quotes doubled rather than refused. */
+function escapeSqlIdent(name) {
+	return `"${name.replaceAll("\"", "\"\"")}"`;
+}
+const PLAIN_IDENT = /^[a-z_][a-z0-9_]*$/u;
+/** An identifier left bare when it is already lower snake case, otherwise quoted by `escapeSqlIdent`. */
+function sqlIdent(name) {
+	return PLAIN_IDENT.test(name) ? name : escapeSqlIdent(name);
+}
+/** The plain-identifier check behind `quoteSqlIdent`, returning the name unquoted. */
+function assertSqlIdent(name, prefix = "PermDock") {
+	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
+	return name;
+}
+/** `name` with `public.` added when it names no schema; generated functions run with `search_path = ''`. */
+function qualifySqlTable(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/** `qualifySqlTable`, then each part quoted by `quoteSqlIdent`. */
+function quoteQualifiedTable(name, prefix = "PermDock") {
+	return quoteSqlTable(qualifySqlTable(name), prefix);
+}
+/** A `text[]` literal of `values`, each quoted by `quoteSqlLiteral`. */
+function sqlTextArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteSqlLiteral).join(", ")}]::text[]`;
+}
+/** The SQL command a default verb runs: `read`, `list` and `get` select, `create` inserts, `update` and `delete` keep their name. */
+function defaultSqlCommand(action) {
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
+//#endregion
+export { quoteQualifiedTable as a, quoteSqlTable as c, qualifySqlTable as i, sqlIdent as l, defaultSqlCommand as n, quoteSqlIdent as o, escapeSqlIdent as r, quoteSqlLiteral as s, SQL_IDENT as t, sqlTextArray as u };