permdock 0.4.0 → 0.5.0

package/dist/solid/index.d.ts

@@ -1,11 +1,10 @@
-import { Dr as Membership, an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { r as Role } from "../vocabulary-hhEFLFoL.js";
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-C3ldA9os.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership, zn as GrantedDecision } from "../policy-types-DzwivBgR.js";
+import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult, u as ProviderOptionsBase } from "../store-9KO4BlkB.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
@@ -31,7 +30,7 @@ type PermDockProviderProps = ProviderOptionsBase & {
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: SolidChild;
-  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
+  readonly denied?: SolidChild | ((decision: Decision) => SolidChild);
   readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
 };
 type PermissionBoundaryProps = {
@@ -46,8 +45,8 @@ type ProtectedProps = {
   readonly data?: unknown;
   readonly tenant?: string;
   readonly pending?: SolidChild;
-  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: SolidChild | ((decision: Decision) => SolidChild);
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
   readonly children: SolidChild | ((decision: GrantedDecision) => SolidChild);
 };
@@ -59,7 +58,7 @@ export declare function usePermissions(permissions: Accessor<readonly Permission
 export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: Accessor<readonly T[]>): Accessor<FilterResult<T>>;
 export declare function useTenant(): Accessor<TenantView>;
 export declare function useMemberships(): Accessor<readonly Membership[]>;
-export declare function useRoles(options?: Accessor<UseRolesOptions>): Accessor<{
+export declare function useRoles(options?: Accessor<RolesOptions>): Accessor<{
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): Accessor<readonly Role[]>;
@@ -90,4 +89,4 @@ export declare function Protected(props: ProtectedProps): JSX.Element;
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans };

package/dist/solid/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-CbUHDoSe.js";
-import { a as permissionSet, c as scopedTenant, d as tenantView, i as livePermDock, l as slotContent, n as describeWith, o as protectedView, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "../views-CJsrBS1f.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-Ctt-81Ni.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
@@ -138,7 +138,7 @@ function Protected(props) {
 		const current = view();
 		switch (current.slot) {
 			case "pending": return slotContent("pending", props, ui.defaults) ?? null;
-			case "fallback": return content(slotContent("fallback", props, ui.defaults), current.decision);
+			case "denied": return content(slotContent("denied", props, ui.defaults), current.decision);
 			case "approval": return content(slotContent("approval", props, ui.defaults), current.decision);
 			case "default": return typeof props.children === "function" ? props.children(current.decision) : props.children;
 			default: return current;

package/dist/solid-start/index.d.ts

@@ -0,0 +1,52 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { APIEvent, FetchEvent } from "@solidjs/start/server";
+//#region src/solid-start/create.d.ts
+/** The h3 event under every SolidStart request; `subject` and `scope` read it. */
+type SolidStartNativeEvent = FetchEvent["nativeEvent"];
+/** An h3 middleware for `createMiddleware([...])` in `src/middleware.ts`. */
+type SolidStartMiddleware = (event: SolidStartNativeEvent, next: () => unknown) => Promise<unknown>;
+type SolidStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<SolidStartNativeEvent, TUser>;
+/** What the adapter sets on `event.locals`. */
+type SolidStartPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event a wrapped API route receives: its own `APIEvent` with typed `locals`. */
+type SolidStartPermDockEvent<TEvent extends FetchEvent = APIEvent, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TEvent & {
+  readonly locals: SolidStartPermDockLocals<TData, V>;
+};
+/** Wraps an API route handler. */
+type SolidStartGuarded<TData, V extends PolicyVocabulary = PolicyVocabulary> = <TEvent extends FetchEvent = APIEvent, R = Response>(handler: (event: SolidStartPermDockEvent<TEvent, TData, V>) => R | Promise<R>) => (event: TEvent) => Promise<R | Response>;
+type SolidStartProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<APIEvent, T | null | undefined>, protectOptions?: ProtectOptions): SolidStartGuarded<NonNullable<T>, V>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<APIEvent, OperationInput<TOperation>>, protectOptions?: ProtectOptions): SolidStartGuarded<unknown, V>;
+};
+/** The decision endpoint, one API route handler per method. */
+type SolidStartPermDockHandlers = {
+  readonly GET: (event: FetchEvent) => Promise<Response>;
+  readonly POST: (event: FetchEvent) => Promise<Response>;
+};
+type SolidStartPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Sets `event.context.permdock` on the h3 event; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => SolidStartMiddleware;
+  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  readonly protect: SolidStartProtect<V>;
+  /** Types `event.locals.permdock` for an API route and answers a thrown PermDock error with Problem Details. */
+  readonly withPermDock: SolidStartGuarded<unknown, V>;
+  /** The instance for an API route, or a server function through `getRequestEvent()`. */
+  readonly getPermDock: (event: FetchEvent) => Promise<PermDock<V>>;
+  /** The snapshot a route `query` returns for `permdock/solid`. */
+  readonly getSnapshot: (event: FetchEvent, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (event: FetchEvent, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `export const { GET, POST } = permdockHandler()` in `src/routes/api/permdock.ts`. */
+  readonly permdockHandler: () => SolidStartPermDockHandlers;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SolidStartPermDockOptions<TUser>): SolidStartPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type ProtectTarget, type SolidStartGuarded, type SolidStartMiddleware, type SolidStartNativeEvent, type SolidStartPermDock, type SolidStartPermDockEvent, type SolidStartPermDockHandlers, type SolidStartPermDockLocals, type SolidStartPermDockOptions, type SolidStartProtect, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/solid-start/index.js

@@ -0,0 +1,49 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { i as decorate } from "../bind-CZzhx-Vj.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+//#region src/solid-start/create.ts
+/**
+* `event.locals`. Its type, `App.RequestEventLocals`, is declared by
+* `@solidjs/start/env`, which only an app's own `tsconfig` loads.
+*/
+function localsOf(event) {
+	return Reflect.get(event, "locals");
+}
+const route = {
+	context: (event) => event.nativeEvent,
+	locals: localsOf
+};
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "solid-start", (event) => event.req);
+	const middleware = () => async (event, next) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, next);
+	};
+	const protect = ((target, data, protectOptions) => guardedRoute(adapter, route, target, data, protectOptions));
+	const withPermDock = (handler) => async (event) => {
+		const attached = await adapter.ensure(event.nativeEvent.context, event.nativeEvent);
+		if (!attached.ok) return attached.response;
+		decorate(localsOf(event), attached.permdock);
+		return adapter.mapErrors(event.nativeEvent, () => handler(event));
+	};
+	const handlers = () => {
+		const { GET, POST } = adapter.handlers();
+		return {
+			GET: (event) => GET(event.nativeEvent),
+			POST: (event) => POST(event.nativeEvent)
+		};
+	};
+	return {
+		middleware,
+		protect,
+		withPermDock,
+		getPermDock: (event) => adapter.getPermDock(event.nativeEvent),
+		getSnapshot: (event, query) => adapter.getSnapshot(event.nativeEvent, query),
+		connection: (event, connectionOptions) => adapter.connection(event.nativeEvent, connectionOptions),
+		permdockHandler: handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/{sources-Dljy06zL.d.ts → sources-BV9j0DeZ.d.ts}

@@ -1,6 +1,6 @@
-import { Z as MembershipSource } from "./policy-types-sp9P1iIV.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-CqrjB9o6.js";
-import { o as SupabaseManifestMembership } from "./manifest-uDS9y5de.js";
+import { et as MembershipSource } from "./policy-types-DzwivBgR.js";
+import { n as RoleThrough, y as SupabaseSuspension } from "./types-CdlxsYQh.js";
+import { o as SupabaseManifestMembership } from "./manifest-mx5ghSFM.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */
 type RoleKeys = {
@@ -163,26 +163,20 @@ type SqlMembershipSource = MembershipSource & {
 type SupabasePostgres = {
   readonly queryRaw: (text: string, params?: unknown[]) => Promise<readonly Record<string, unknown>[]>;
 };
-/**
- * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
- * `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
- * `ctx.postgres` runs as the caller under RLS, so the membership tables must
- * be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
- */
-declare function fromSupabasePostgres(postgres: SupabasePostgres): SqlQuery;
+declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
 /**
  * Memberships from one table holding every scope: a row per user, scope,
  * instance and role (`user_id, scope, scope_id, role`), with optional
  * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
  * merge into one membership.
  */
-declare function fromTable(options: MembershipTableOptions): SqlMembershipSource;
+declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
 /**
  * Memberships from a table of one scope (`customer_contacts`): every row is a
  * membership of `scope`, with roles from a column or fixed (`['contact']`), a
  * fixed `via`, and ancestor ids from `within` columns.
  */
-declare function fromJunction(options: MembershipJunctionOptions): SqlMembershipSource;
+declare function junctionMembershipSource(options: MembershipJunctionOptions): SqlMembershipSource;
 declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 /**
  * Reads the authorization version `permdock supabase hook generate` keeps in
@@ -193,4 +187,4 @@ declare function authzVersion(options: {
   readonly schema?: string;
 }): NonNullable<MembershipSource["version"]>;
 //#endregion
-export { MembershipTableOptions as a, SupabasePostgres as c, fromSupabasePostgres as d, fromTable as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, fromJunction as u };
+export { MembershipTableOptions as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };

package/dist/{sources-B1-b-R0t.js → sources-vs5dGOsS.js}

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { i as readAppData } from "./app-data-CV8pqqMi.js";
-import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
 //#region src/supabase/keep.ts
 /** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
 function keptKeys(row) {
@@ -12,111 +12,19 @@ function keptKeys(row) {
 	return [...new Set(valid)].toSorted();
 }
 //#endregion
-//#region src/supabase/roles.ts
-function isRoleList(role) {
-	return Array.isArray(role);
-}
-/**
-* Resolves the role sources of `table` (`schema.table`, or `public`). An
-* unqualified `through` table is in `table`'s schema. `label` names the
-* option in the error for an `on` that is not exactly one column; `prefix`
-* starts every error. A row with several sources holds the union of their
-* non-null keys.
-*/
-function roleColumn(role, table, alias, options) {
-	if (!isRoleList(role)) return singleRole(role, table, alias, options);
-	const prefix = options.prefix ?? "PermDock";
-	const parts = role.map((part, index) => singleRole(part, table, alias, {
-		...options,
-		label: `${options.label}[${String(index)}]`
-	}));
-	const [first] = parts;
-	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
-	if (parts.length === 1) return first;
-	const rows = quoteSqlIdent(`${alias}r`, prefix);
-	const values = quoteSqlIdent(`${alias}v`, prefix);
-	const sql = `${rows}.permdock_role`;
-	return {
-		column: first.column,
-		sql,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
-		lookup: sql,
-		columns: [...new Set(parts.map((part) => part.column))],
-		throughs: parts.flatMap((part) => part.throughs),
-		lateral: true
-	};
-}
-function singleRole(role, table, alias, options) {
-	const prefix = options.prefix ?? "PermDock";
-	const q = (name) => quoteSqlIdent(name, prefix);
-	if (typeof role === "string") return {
-		column: role,
-		sql: `${alias}.${q(role)}::text`,
-		join: "",
-		lookup: `${alias}.${q(role)}::text`,
-		columns: [role],
-		throughs: [],
-		lateral: false
-	};
-	const pairs = Object.entries(role.on);
-	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
-	const [ref, id] = pair;
-	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
-	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
-	const keys = options.joined ?? `${alias}k`;
-	const target = quoteSqlTable(through, prefix);
-	const keyed = {
-		table: through,
-		id,
-		key: role.column,
-		ref
-	};
-	return {
-		column: ref,
-		sql: `${keys}.${q(role.column)}::text`,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
-		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
-		through: keyed,
-		columns: [ref],
-		throughs: [keyed],
-		lateral: false
-	};
-}
-/** The manifest entry of one role source: the column, and the roles table it references. */
-function sourceManifest(column, through) {
-	return through === void 0 ? { column } : {
-		column,
-		through: {
-			table: through.table,
-			id: through.id,
-			column: through.key
-		}
-	};
-}
-/** The manifest entry of a single-source column, such as a membership's user. */
-function columnManifest(role) {
-	return sourceManifest(role.column, role.through);
-}
-/** The manifest entry of a role column, or one entry per source of a row with several. */
-function roleManifest(role) {
-	if (!role.lateral) return sourceManifest(role.column, role.through);
-	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
-}
-//#endregion
-//#region src/supabase/sources.ts
-const ident = (name) => quoteSqlIdent(name);
-const literal = quoteSqlLiteral;
+//#region src/supabase/membership-sql.ts
+const ident$1 = (name) => quoteSqlIdent(name);
+const literal$1 = quoteSqlLiteral;
 function col(name) {
-	return `m.${ident(name)}`;
+	return `m.${ident$1(name)}`;
 }
 function activeRow(row, id) {
-	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
-	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	const parts = [`s.${ident$1(row.id)}::text = (${id})::text`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident$1(row.disabledAt)} is null`);
 	if (row.status !== void 0) {
 		const values = row.active ?? [];
 		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
+		parts.push(`s.${ident$1(row.status)}::text = any(array[${values.map(literal$1).join(", ")}]::text[])`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
 	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
@@ -210,7 +118,7 @@ where ${where.join("\n  and ")}
 group by ${group.join(", ")}`;
 }
 function holdersOf(shape) {
-	const id = ident(shape.idColumn);
+	const id = ident$1(shape.idColumn);
 	return {
 		idType: `${quoteQualifiedTable(shape.table)}.${id}%type`,
 		id: (scope, row) => {
@@ -235,7 +143,7 @@ function sqlOf(shape) {
 		table: shape.table,
 		user: shape.user,
 		userThrough: shape.userThrough,
-		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
+		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident$1(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident$1(shape.userThrough.key)}%type`,
 		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
 		managed: shape.managedColumn,
 		through: shape.through,
@@ -251,6 +159,102 @@ function sqlOf(shape) {
 		list: (keep = keptSql(shape) !== void 0) => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true, keep)
 	});
 }
+//#endregion
+//#region src/supabase/roles.ts
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/**
+* Resolves the role sources of `table` (`schema.table`, or `public`). An
+* unqualified `through` table is in `table`'s schema. `label` names the
+* option in the error for an `on` that is not exactly one column; `prefix`
+* starts every error. A row with several sources holds the union of their
+* non-null keys.
+*/
+function roleColumn(role, table, alias, options) {
+	if (!isRoleList(role)) return singleRole(role, table, alias, options);
+	const prefix = options.prefix ?? "PermDock";
+	const parts = role.map((part, index) => singleRole(part, table, alias, {
+		...options,
+		label: `${options.label}[${String(index)}]`
+	}));
+	const [first] = parts;
+	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
+	if (parts.length === 1) return first;
+	const rows = quoteSqlIdent(`${alias}r`, prefix);
+	const values = quoteSqlIdent(`${alias}v`, prefix);
+	const sql = `${rows}.permdock_role`;
+	return {
+		column: first.column,
+		sql,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
+		lookup: sql,
+		columns: [...new Set(parts.map((part) => part.column))],
+		throughs: parts.flatMap((part) => part.throughs),
+		lateral: true
+	};
+}
+function singleRole(role, table, alias, options) {
+	const prefix = options.prefix ?? "PermDock";
+	const q = (name) => quoteSqlIdent(name, prefix);
+	if (typeof role === "string") return {
+		column: role,
+		sql: `${alias}.${q(role)}::text`,
+		join: "",
+		lookup: `${alias}.${q(role)}::text`,
+		columns: [role],
+		throughs: [],
+		lateral: false
+	};
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
+	const [ref, id] = pair;
+	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
+	const keys = options.joined ?? `${alias}k`;
+	const target = quoteSqlTable(through, prefix);
+	const keyed = {
+		table: through,
+		id,
+		key: role.column,
+		ref
+	};
+	return {
+		column: ref,
+		sql: `${keys}.${q(role.column)}::text`,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
+		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		through: keyed,
+		columns: [ref],
+		throughs: [keyed],
+		lateral: false
+	};
+}
+/** The manifest entry of one role source: the column, and the roles table it references. */
+function sourceManifest(column, through) {
+	return through === void 0 ? { column } : {
+		column,
+		through: {
+			table: through.table,
+			id: through.id,
+			column: through.key
+		}
+	};
+}
+/** The manifest entry of a single-source column, such as a membership's user. */
+function columnManifest(role) {
+	return sourceManifest(role.column, role.through);
+}
+/** The manifest entry of a role column, or one entry per source of a row with several. */
+function roleManifest(role) {
+	if (!role.lateral) return sourceManifest(role.column, role.through);
+	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
+}
+//#endregion
+//#region src/supabase/sources.ts
+const ident = (name) => quoteSqlIdent(name);
+const literal = quoteSqlLiteral;
 function isFixed(roles) {
 	return Array.isArray(roles);
 }
@@ -335,11 +339,14 @@ function sourceOf(sql, query) {
 }
 /**
 * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
-* `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
+* `SqlQuery` for `tableMembershipSource`, `junctionMembershipSource` and `supabaseApprovalStore`.
 * `ctx.postgres` runs as the caller under RLS, so the membership tables must
 * be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
 */
-function fromSupabasePostgres(postgres) {
+function optionalColumn(name, cast) {
+	return name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
+}
+function supabasePostgresQuery(postgres) {
 	return (text, values) => postgres.queryRaw(text, [...values]);
 }
 /**
@@ -348,14 +355,13 @@ function fromSupabasePostgres(postgres) {
 * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
 * merge into one membership.
 */
-function fromTable(options) {
+function tableMembershipSource(options) {
 	const c = options.columns ?? {};
 	const scope = `${col(c.scope ?? "scope")}::text`;
 	const id = `${col(c.id ?? "scope_id")}::text`;
 	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
-	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
-	const user = memberUser(c.user ?? "user_id", options.table, "fromTable columns.user");
-	const role = memberRole(c.role ?? "role", options.table, "fromTable columns.role");
+	const user = memberUser(c.user ?? "user_id", options.table, "tableMembershipSource columns.user");
+	const role = memberRole(c.role ?? "role", options.table, "tableMembershipSource columns.role");
 	return sourceOf(sqlOf({
 		table: options.table,
 		join: `${user.column.join}${role.join}`,
@@ -368,13 +374,13 @@ function fromTable(options) {
 		id,
 		within,
 		roles: roleAgg(role),
-		via: optional(c.via, "text"),
+		via: optionalColumn(c.via, "text"),
 		expiresAt: c.expiresAt,
 		disabledAt: c.disabledAt,
-		grantedBy: optional(c.grantedBy, "text"),
-		reason: optional(c.reason, "text"),
-		memberGroup: optional(c.group, "text"),
-		managed: optional(c.managedBy, "text"),
+		grantedBy: optionalColumn(c.grantedBy, "text"),
+		reason: optionalColumn(c.reason, "text"),
+		memberGroup: optionalColumn(c.group, "text"),
+		managed: optionalColumn(c.managedBy, "text"),
 		managedColumn: c.managedBy,
 		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
 		x: c.x,
@@ -428,15 +434,15 @@ function fromTable(options) {
 * membership of `scope`, with roles from a column or fixed (`['contact']`), a
 * fixed `via`, and ancestor ids from `within` columns.
 */
-function fromJunction(options) {
+function junctionMembershipSource(options) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
 	const idColumn = options.id ?? `${options.scope}_id`;
 	const withinEntries = Object.entries(options.within ?? {});
 	const roles = options.roles;
 	const fixed = isFixed(roles) ? roles : void 0;
-	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
-	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "fromJunction roles");
-	const user = memberUser(options.user ?? "user_id", options.table, "fromJunction user");
+	if (fixed?.length === 0) throw new TypeError("PermDock: junctionMembershipSource needs at least one role");
+	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "junctionMembershipSource roles");
+	const user = memberUser(options.user ?? "user_id", options.table, "junctionMembershipSource user");
 	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
 	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
 	const shape = {
@@ -541,4 +547,4 @@ function authzVersion(options) {
 	};
 }
 //#endregion
-export { fromJunction as a, hookApiNames as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, fromSupabasePostgres as o, PERMDOCK_SCHEMA as r, fromTable as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };
+export { hookApiNames as a, tableMembershipSource as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, junctionMembershipSource as o, PERMDOCK_SCHEMA as r, supabasePostgresQuery as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };

package/dist/{sql-t8teWOfo.js → sql-B5T1IL83.js}

@@ -39,5 +39,17 @@ function quoteQualifiedTable(name, prefix = "PermDock") {
 function sqlTextArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteSqlLiteral).join(", ")}]::text[]`;
 }
+/** The SQL command a default verb runs: `read`, `list` and `get` select, `create` inserts, `update` and `delete` keep their name. */
+function defaultSqlCommand(action) {
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
 //#endregion
-export { quoteSqlIdent as a, sqlIdent as c, quoteQualifiedTable as i, sqlTextArray as l, escapeSqlIdent as n, quoteSqlLiteral as o, qualifySqlTable as r, quoteSqlTable as s, SQL_IDENT as t };
+export { quoteQualifiedTable as a, quoteSqlTable as c, qualifySqlTable as i, sqlIdent as l, defaultSqlCommand as n, quoteSqlIdent as o, escapeSqlIdent as r, quoteSqlLiteral as s, SQL_IDENT as t, sqlTextArray as u };