permdock 0.4.0 → 0.6.0

package/dist/{sources-B1-b-R0t.js → sources-vs5dGOsS.js}

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { i as readAppData } from "./app-data-CV8pqqMi.js";
-import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
 //#region src/supabase/keep.ts
 /** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
 function keptKeys(row) {
@@ -12,111 +12,19 @@ function keptKeys(row) {
 	return [...new Set(valid)].toSorted();
 }
 //#endregion
-//#region src/supabase/roles.ts
-function isRoleList(role) {
-	return Array.isArray(role);
-}
-/**
-* Resolves the role sources of `table` (`schema.table`, or `public`). An
-* unqualified `through` table is in `table`'s schema. `label` names the
-* option in the error for an `on` that is not exactly one column; `prefix`
-* starts every error. A row with several sources holds the union of their
-* non-null keys.
-*/
-function roleColumn(role, table, alias, options) {
-	if (!isRoleList(role)) return singleRole(role, table, alias, options);
-	const prefix = options.prefix ?? "PermDock";
-	const parts = role.map((part, index) => singleRole(part, table, alias, {
-		...options,
-		label: `${options.label}[${String(index)}]`
-	}));
-	const [first] = parts;
-	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
-	if (parts.length === 1) return first;
-	const rows = quoteSqlIdent(`${alias}r`, prefix);
-	const values = quoteSqlIdent(`${alias}v`, prefix);
-	const sql = `${rows}.permdock_role`;
-	return {
-		column: first.column,
-		sql,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
-		lookup: sql,
-		columns: [...new Set(parts.map((part) => part.column))],
-		throughs: parts.flatMap((part) => part.throughs),
-		lateral: true
-	};
-}
-function singleRole(role, table, alias, options) {
-	const prefix = options.prefix ?? "PermDock";
-	const q = (name) => quoteSqlIdent(name, prefix);
-	if (typeof role === "string") return {
-		column: role,
-		sql: `${alias}.${q(role)}::text`,
-		join: "",
-		lookup: `${alias}.${q(role)}::text`,
-		columns: [role],
-		throughs: [],
-		lateral: false
-	};
-	const pairs = Object.entries(role.on);
-	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
-	const [ref, id] = pair;
-	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
-	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
-	const keys = options.joined ?? `${alias}k`;
-	const target = quoteSqlTable(through, prefix);
-	const keyed = {
-		table: through,
-		id,
-		key: role.column,
-		ref
-	};
-	return {
-		column: ref,
-		sql: `${keys}.${q(role.column)}::text`,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
-		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
-		through: keyed,
-		columns: [ref],
-		throughs: [keyed],
-		lateral: false
-	};
-}
-/** The manifest entry of one role source: the column, and the roles table it references. */
-function sourceManifest(column, through) {
-	return through === void 0 ? { column } : {
-		column,
-		through: {
-			table: through.table,
-			id: through.id,
-			column: through.key
-		}
-	};
-}
-/** The manifest entry of a single-source column, such as a membership's user. */
-function columnManifest(role) {
-	return sourceManifest(role.column, role.through);
-}
-/** The manifest entry of a role column, or one entry per source of a row with several. */
-function roleManifest(role) {
-	if (!role.lateral) return sourceManifest(role.column, role.through);
-	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
-}
-//#endregion
-//#region src/supabase/sources.ts
-const ident = (name) => quoteSqlIdent(name);
-const literal = quoteSqlLiteral;
+//#region src/supabase/membership-sql.ts
+const ident$1 = (name) => quoteSqlIdent(name);
+const literal$1 = quoteSqlLiteral;
 function col(name) {
-	return `m.${ident(name)}`;
+	return `m.${ident$1(name)}`;
 }
 function activeRow(row, id) {
-	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
-	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	const parts = [`s.${ident$1(row.id)}::text = (${id})::text`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident$1(row.disabledAt)} is null`);
 	if (row.status !== void 0) {
 		const values = row.active ?? [];
 		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
+		parts.push(`s.${ident$1(row.status)}::text = any(array[${values.map(literal$1).join(", ")}]::text[])`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
 	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
@@ -210,7 +118,7 @@ where ${where.join("\n  and ")}
 group by ${group.join(", ")}`;
 }
 function holdersOf(shape) {
-	const id = ident(shape.idColumn);
+	const id = ident$1(shape.idColumn);
 	return {
 		idType: `${quoteQualifiedTable(shape.table)}.${id}%type`,
 		id: (scope, row) => {
@@ -235,7 +143,7 @@ function sqlOf(shape) {
 		table: shape.table,
 		user: shape.user,
 		userThrough: shape.userThrough,
-		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
+		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident$1(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident$1(shape.userThrough.key)}%type`,
 		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
 		managed: shape.managedColumn,
 		through: shape.through,
@@ -251,6 +159,102 @@ function sqlOf(shape) {
 		list: (keep = keptSql(shape) !== void 0) => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true, keep)
 	});
 }
+//#endregion
+//#region src/supabase/roles.ts
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/**
+* Resolves the role sources of `table` (`schema.table`, or `public`). An
+* unqualified `through` table is in `table`'s schema. `label` names the
+* option in the error for an `on` that is not exactly one column; `prefix`
+* starts every error. A row with several sources holds the union of their
+* non-null keys.
+*/
+function roleColumn(role, table, alias, options) {
+	if (!isRoleList(role)) return singleRole(role, table, alias, options);
+	const prefix = options.prefix ?? "PermDock";
+	const parts = role.map((part, index) => singleRole(part, table, alias, {
+		...options,
+		label: `${options.label}[${String(index)}]`
+	}));
+	const [first] = parts;
+	if (first === void 0) throw new TypeError(`${prefix}: ${options.label} needs at least one role source`);
+	if (parts.length === 1) return first;
+	const rows = quoteSqlIdent(`${alias}r`, prefix);
+	const values = quoteSqlIdent(`${alias}v`, prefix);
+	const sql = `${rows}.permdock_role`;
+	return {
+		column: first.column,
+		sql,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}cross join lateral (select ${values}.role from (values ${parts.map((part) => `(${part.lookup})`).join(", ")}) ${values}(role) where ${values}.role is not null) ${rows}(permdock_role)`,
+		lookup: sql,
+		columns: [...new Set(parts.map((part) => part.column))],
+		throughs: parts.flatMap((part) => part.throughs),
+		lateral: true
+	};
+}
+function singleRole(role, table, alias, options) {
+	const prefix = options.prefix ?? "PermDock";
+	const q = (name) => quoteSqlIdent(name, prefix);
+	if (typeof role === "string") return {
+		column: role,
+		sql: `${alias}.${q(role)}::text`,
+		join: "",
+		lookup: `${alias}.${q(role)}::text`,
+		columns: [role],
+		throughs: [],
+		lateral: false
+	};
+	const pairs = Object.entries(role.on);
+	const [pair] = pairs;
+	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
+	const [ref, id] = pair;
+	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
+	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
+	const keys = options.joined ?? `${alias}k`;
+	const target = quoteSqlTable(through, prefix);
+	const keyed = {
+		table: through,
+		id,
+		key: role.column,
+		ref
+	};
+	return {
+		column: ref,
+		sql: `${keys}.${q(role.column)}::text`,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
+		lookup: `(select ${keys}.${q(role.column)}::text from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		through: keyed,
+		columns: [ref],
+		throughs: [keyed],
+		lateral: false
+	};
+}
+/** The manifest entry of one role source: the column, and the roles table it references. */
+function sourceManifest(column, through) {
+	return through === void 0 ? { column } : {
+		column,
+		through: {
+			table: through.table,
+			id: through.id,
+			column: through.key
+		}
+	};
+}
+/** The manifest entry of a single-source column, such as a membership's user. */
+function columnManifest(role) {
+	return sourceManifest(role.column, role.through);
+}
+/** The manifest entry of a role column, or one entry per source of a row with several. */
+function roleManifest(role) {
+	if (!role.lateral) return sourceManifest(role.column, role.through);
+	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
+}
+//#endregion
+//#region src/supabase/sources.ts
+const ident = (name) => quoteSqlIdent(name);
+const literal = quoteSqlLiteral;
 function isFixed(roles) {
 	return Array.isArray(roles);
 }
@@ -335,11 +339,14 @@ function sourceOf(sql, query) {
 }
 /**
 * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
-* `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
+* `SqlQuery` for `tableMembershipSource`, `junctionMembershipSource` and `supabaseApprovalStore`.
 * `ctx.postgres` runs as the caller under RLS, so the membership tables must
 * be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
 */
-function fromSupabasePostgres(postgres) {
+function optionalColumn(name, cast) {
+	return name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
+}
+function supabasePostgresQuery(postgres) {
 	return (text, values) => postgres.queryRaw(text, [...values]);
 }
 /**
@@ -348,14 +355,13 @@ function fromSupabasePostgres(postgres) {
 * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
 * merge into one membership.
 */
-function fromTable(options) {
+function tableMembershipSource(options) {
 	const c = options.columns ?? {};
 	const scope = `${col(c.scope ?? "scope")}::text`;
 	const id = `${col(c.id ?? "scope_id")}::text`;
 	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
-	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
-	const user = memberUser(c.user ?? "user_id", options.table, "fromTable columns.user");
-	const role = memberRole(c.role ?? "role", options.table, "fromTable columns.role");
+	const user = memberUser(c.user ?? "user_id", options.table, "tableMembershipSource columns.user");
+	const role = memberRole(c.role ?? "role", options.table, "tableMembershipSource columns.role");
 	return sourceOf(sqlOf({
 		table: options.table,
 		join: `${user.column.join}${role.join}`,
@@ -368,13 +374,13 @@ function fromTable(options) {
 		id,
 		within,
 		roles: roleAgg(role),
-		via: optional(c.via, "text"),
+		via: optionalColumn(c.via, "text"),
 		expiresAt: c.expiresAt,
 		disabledAt: c.disabledAt,
-		grantedBy: optional(c.grantedBy, "text"),
-		reason: optional(c.reason, "text"),
-		memberGroup: optional(c.group, "text"),
-		managed: optional(c.managedBy, "text"),
+		grantedBy: optionalColumn(c.grantedBy, "text"),
+		reason: optionalColumn(c.reason, "text"),
+		memberGroup: optionalColumn(c.group, "text"),
+		managed: optionalColumn(c.managedBy, "text"),
 		managedColumn: c.managedBy,
 		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
 		x: c.x,
@@ -428,15 +434,15 @@ function fromTable(options) {
 * membership of `scope`, with roles from a column or fixed (`['contact']`), a
 * fixed `via`, and ancestor ids from `within` columns.
 */
-function fromJunction(options) {
+function junctionMembershipSource(options) {
 	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
 	const idColumn = options.id ?? `${options.scope}_id`;
 	const withinEntries = Object.entries(options.within ?? {});
 	const roles = options.roles;
 	const fixed = isFixed(roles) ? roles : void 0;
-	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
-	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "fromJunction roles");
-	const user = memberUser(options.user ?? "user_id", options.table, "fromJunction user");
+	if (fixed?.length === 0) throw new TypeError("PermDock: junctionMembershipSource needs at least one role");
+	const role = isFixed(roles) ? void 0 : memberRole(typeof roles === "object" && "sources" in roles ? roles.sources : roles, options.table, "junctionMembershipSource roles");
+	const user = memberUser(options.user ?? "user_id", options.table, "junctionMembershipSource user");
 	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
 	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
 	const shape = {
@@ -541,4 +547,4 @@ function authzVersion(options) {
 	};
 }
 //#endregion
-export { fromJunction as a, hookApiNames as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, fromSupabasePostgres as o, PERMDOCK_SCHEMA as r, fromTable as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };
+export { hookApiNames as a, tableMembershipSource as c, keptKeys as d, authzVersion as i, roleColumn as l, HOOK_API_SCHEMA as n, junctionMembershipSource as o, PERMDOCK_SCHEMA as r, supabasePostgresQuery as s, AUTHZ_VERSION_TABLE as t, roleManifest as u };

package/dist/{sql-t8teWOfo.js → sql-B5T1IL83.js}

@@ -39,5 +39,17 @@ function quoteQualifiedTable(name, prefix = "PermDock") {
 function sqlTextArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteSqlLiteral).join(", ")}]::text[]`;
 }
+/** The SQL command a default verb runs: `read`, `list` and `get` select, `create` inserts, `update` and `delete` keep their name. */
+function defaultSqlCommand(action) {
+	switch (action) {
+		case "read":
+		case "list":
+		case "get": return "select";
+		case "create": return "insert";
+		case "update": return "update";
+		case "delete": return "delete";
+		default: return;
+	}
+}
 //#endregion
-export { quoteSqlIdent as a, sqlIdent as c, quoteQualifiedTable as i, sqlTextArray as l, escapeSqlIdent as n, quoteSqlLiteral as o, qualifySqlTable as r, quoteSqlTable as s, SQL_IDENT as t };
+export { quoteQualifiedTable as a, quoteSqlTable as c, qualifySqlTable as i, sqlIdent as l, defaultSqlCommand as n, quoteSqlIdent as o, escapeSqlIdent as r, quoteSqlLiteral as s, SQL_IDENT as t, sqlTextArray as u };