permdock 0.6.0 → 0.8.0

package/dist/{manifest-mx5ghSFM.d.ts → manifest-CzzWtnAb.d.ts}

@@ -2,9 +2,9 @@
 /**
  * What `permdock supabase inspect --json` prints and `--out` writes to
  * `permdock.manifest.json`: the contract between the generated hook and SQL
- * helpers and a package that writes policies or claims next to them.
- * `version` is the major of this shape; a field is only
- * ever added within it. `schemas/supabase-manifest-v1.json` is its JSON Schema.
+ * helpers and a package that writes policies or claims next to them. `version`
+ * is the major of this shape; a field is only ever added within it.
+ * `schemas/supabase-manifest-v1.json` is its JSON Schema.
  */
 type SupabaseHookManifest = {
   readonly $schema: "https://permdock.com/schemas/supabase-manifest-v1.json";
@@ -41,13 +41,23 @@ type SupabaseHookManifest = {
   /**
    * With `authzVersion`, the function that bumps the listed users' `authz_ver`,
    * for a membership source outside the hook. It is `security definer` and no
-   * client role may execute it: call it from a trigger owned by the table's owner.
+   * client role may execute it: call it from a trigger owned by the table's
+   * owner.
    */
   readonly authzVersionBump?: {
     readonly schema: string;
     readonly function: "permdock_bump_authz_version_for";
     readonly args: "p_users uuid[]";
   };
+  /**
+   * The Management API fields that make a hosted project call the hook;
+   * `permdock supabase inspect` adds them.
+   */
+  readonly managementApi?: {
+    readonly hook_custom_access_token_enabled: true;
+    readonly hook_custom_access_token_uri: string;
+    readonly jwt_exp: number;
+  };
   /** The `supabase.hook.memberships` sources, in the order the hook reads them. */
   readonly memberships: readonly SupabaseManifestMembership[];
   readonly rls: SupabaseManifestRls;
@@ -67,6 +77,51 @@ type SupabaseHookManifest = {
    * SDK that lacks one cannot serve this policy.
    */
   readonly requires?: SupabaseManifestRequires;
+  /**
+   * The SQL names the generated RLS exposes, as `resolveNames` gives them.
+   * Absent from a manifest written before 0.8.
+   */
+  readonly names?: SupabaseManifestNames;
+};
+/** The SQL helpers named after one scope, unqualified. */
+type SupabaseManifestScopeNames = {
+  readonly permittedIds: string;
+  readonly permittedIdsFor: string;
+  readonly memberIds: string;
+  readonly memberIdsFor: string;
+  /**
+   * Only on the team scope (`team` or `teams`), for better-supabase's
+   * `teamIdsOf`.
+   */
+  readonly memberIdsOf?: string;
+  readonly permittedUsers: string;
+};
+/** The SQL objects named after one resource, unqualified. */
+type SupabaseManifestResourceNames = {
+  /** The table `rls.tables` maps, as written there. */
+  readonly table?: string;
+  /** Graph resources only: `permitted_<resource>_ids` and its restriction check. */
+  readonly permittedIds?: string;
+  readonly restricted?: string;
+  /** With `rls.rowHelpers` naming the resource. */
+  readonly rows?: string;
+  readonly row?: string;
+  /** With `rls.fields` and a mapped table. */
+  readonly visible?: string;
+  readonly visibleFields?: string;
+  readonly mask?: string;
+};
+type SupabaseManifestNames = {
+  readonly schema: string;
+  readonly gucPrefix: string;
+  readonly claims: {
+    readonly tenant: string;
+    readonly role: string;
+  };
+  /** The scope better-supabase reads as its teams, when one is declared. */
+  readonly teamScope?: string;
+  readonly scopes: Readonly<Record<string, SupabaseManifestScopeNames>>;
+  readonly resources: Readonly<Record<string, SupabaseManifestResourceNames>>;
 };
 type SupabaseManifestRequires = {
   /** The capability-matrix release tag, `capability-matrix-v1.<minor>.<patch>`. */
@@ -88,30 +143,54 @@ type SupabaseManifestColumn = {
 type SupabaseManifestValue = SupabaseManifestColumn | {
   readonly value: string | readonly string[];
 };
-/** A column that references another table: the value (role key or user id) is `column` of `table`, matched on `id`. */
+/**
+ * A column that references another table: the value (role key or user id) is
+ * `column` of `table`, matched on `id`.
+ */
 type SupabaseManifestThrough = {
   readonly table: string;
   readonly id: string;
   readonly column: string;
 };
-/** A role column (with `through` when it references a roles table), or the fixed roles every row holds. */
+/**
+ * A role column (with `through` when it references a roles table), or the fixed
+ * roles every row holds.
+ */
 type SupabaseManifestRole = SupabaseManifestValue | (SupabaseManifestColumn & {
   readonly through: SupabaseManifestThrough;
+}) | (SupabaseManifestColumn & {
+  /**
+   * Each column value to the role key it stands for, or `null` for no role;
+   * an unlisted value is no role.
+   */
+  readonly map: Readonly<Record<string, string | null>>;
 });
 /** One `tableMembershipSource` or `junctionMembershipSource` source. */
 type SupabaseManifestMembership = {
   /** `schema.table`, `public` when the source names no schema. */
   readonly table: string;
-  /** The user id column, with `through` when it references the table that holds the user id. */
+  /**
+   * The user id column, with `through` when it references the table that holds
+   * the user id.
+   */
   readonly user: SupabaseManifestColumn | (SupabaseManifestColumn & {
     readonly through: SupabaseManifestThrough;
   });
-  /** A column for `tableMembershipSource`, the fixed scope for `junctionMembershipSource`. */
+  /**
+   * A column for `tableMembershipSource`, the fixed scope for
+   * `junctionMembershipSource`.
+   */
   readonly scope: SupabaseManifestValue;
   readonly id: SupabaseManifestColumn;
-  /** A role column, the fixed roles every row holds, or several role columns whose keys the row holds together. */
+  /**
+   * A role column, the fixed roles every row holds, or several role columns
+   * whose keys the row holds together.
+   */
   readonly role: SupabaseManifestRole | readonly SupabaseManifestRole[];
-  /** A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor scope. */
+  /**
+   * A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor
+   * scope.
+   */
   readonly within?: SupabaseManifestColumn | {
     readonly columns: Readonly<Record<string, string>>;
   };
@@ -126,10 +205,16 @@ type SupabaseManifestHelper = {
   /** The argument list, `p_grant text`, or `''` for none. */
   readonly args: string;
   readonly returns: string;
-  /** The roles granted `execute`; a field view `anon` reads adds `anon` to the `authenticated` ones. */
+  /**
+   * The roles granted `execute`; a field view `anon` reads adds `anon` to the
+   * `authenticated` ones.
+   */
   readonly execute: readonly string[];
 };
-/** A table whose row says whether a user or a scope instance is active (`rls.suspension`); a missing row counts as suspended. */
+/**
+ * A table whose row says whether a user or a scope instance is active
+ * (`rls.suspension`); a missing row counts as suspended.
+ */
 type SupabaseManifestActiveRow = {
   /** `schema.table`. */
   readonly table: string;
@@ -140,12 +225,18 @@ type SupabaseManifestActiveRow = {
   /** A status column; only a row whose value is in `active` is active. */
   readonly status?: string;
   readonly active?: readonly string[];
-  /** A scope only: the permission keys members of a suspended instance still hold. */
+  /**
+   * A scope only: the permission keys members of a suspended instance still
+   * hold.
+   */
   readonly keep?: readonly string[];
 };
 type SupabaseManifestRls = {
   readonly schema: string;
-  /** Where the helpers read roles and memberships: the claims (`jwt`) or the tables (`database`). */
+  /**
+   * Where the helpers read roles and memberships: the claims (`jwt`) or the
+   * tables (`database`).
+   */
   readonly mode: "jwt" | "database";
   readonly tenantClaim: string;
   /** The declared scopes, root first, with the Postgres type of their ids. */
@@ -155,13 +246,14 @@ type SupabaseManifestRls = {
     readonly within?: string;
   }[];
   /**
-   * Every function `rls generate` writes for policies and trusted SQL to
-   * call: `permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids` and
-   * `permdock_user_id`, the caller's user id; in `database` mode `permdock_has_for`, `permitted_<scope>_ids_for` and
+   * Every function `rls generate` writes for policies and trusted SQL to call:
+   * `permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids` and
+   * `permdock_user_id`, the caller's user id; in `database` mode
+   * `permdock_has_for`, `permitted_<scope>_ids_for` and
    * `member_<scope>_ids_for`; and when a role declares `assigns`,
    * `permdock_can_assign`, `permdock_can_assign_any` and, with custom roles,
-   * `permdock_can_assign_custom_role`, each with its `_for` form where one
-   * is written. A helper whose `execute` is empty is for trusted SQL only.
+   * `permdock_can_assign_custom_role`, each with its `_for` form where one is
+   * written. A helper whose `execute` is empty is for trusted SQL only.
    */
   readonly helpers: readonly SupabaseManifestHelper[];
   /**
@@ -170,7 +262,10 @@ type SupabaseManifestRls = {
    * `memberships`.
    */
   readonly memberships: readonly SupabaseManifestMembership[];
-  /** Whether custom roles live in the helpers' tables (`rls.customRoles` in `database` mode). */
+  /**
+   * Whether custom roles live in the helpers' tables (`rls.customRoles` in
+   * `database` mode).
+   */
   readonly customRoles?: boolean;
   /** The global-roles table the hook and the `database` mode helpers read. */
   readonly roles?: {
@@ -178,7 +273,10 @@ type SupabaseManifestRls = {
     readonly user: SupabaseManifestColumn;
     readonly role: SupabaseManifestRole | readonly SupabaseManifestRole[];
   };
-  /** `rls.suspension`: a suspended user, or a suspended scope instance, holds nothing but its scope's `keep`. */
+  /**
+   * `rls.suspension`: a suspended user, or a suspended scope instance, holds
+   * nothing but its scope's `keep`.
+   */
   readonly suspension?: {
     readonly users?: SupabaseManifestActiveRow;
     readonly scopes?: Readonly<Record<string, SupabaseManifestActiveRow>>;
@@ -187,13 +285,18 @@ type SupabaseManifestRls = {
     };
   };
   /**
-   * `rls.assignments`: the tables whose client writes the assignment
-   * triggers check against `permdock_can_assign_any`, so SQL writing rows
-   * there needs no role-ceiling check of its own.
+   * `rls.assignments`: the tables whose client writes the assignment triggers
+   * check against `permdock_can_assign_any`, so SQL writing rows there needs no
+   * role-ceiling check of its own.
    */
   readonly assignments?: {
     readonly tables: readonly string[];
   };
+  /**
+   * `rls.tokenScopes`: the helpers narrow a delegated token by its `scope`
+   * claim through `permdock_token_scope_allows`.
+   */
+  readonly tokenScopes?: boolean;
   readonly apiKeys?: {
     readonly claim: string;
     readonly scopes: string;
@@ -202,12 +305,25 @@ type SupabaseManifestRls = {
     readonly serviceRoles: readonly string[];
   };
 };
+/**
+ * The manifest of a project in `rls.authorize: 'database'` mode without
+ * `supabase.hook`: no token hook, so no `hook`, `budget`, `claims`,
+ * `authzVersion` or hook `memberships`.
+ */
+type SupabaseDatabaseManifest = Omit<SupabaseHookManifest, "authzVersion" | "authzVersionBump" | "budget" | "claims" | "hook" | "managementApi" | "memberships">;
+/**
+ * What `parseSupabaseManifest` returns: a manifest with or without the token
+ * hook.
+ */
+type SupabaseManifest = SupabaseDatabaseManifest | SupabaseHookManifest;
+/** Whether the manifest describes a token hook. */
+declare function hasTokenHook(manifest: SupabaseManifest): manifest is SupabaseHookManifest;
 /**
  * Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
  * validates it against `schemas/supabase-manifest-v1.json`. Returns a
- * deep-frozen copy built from own keys; throws `PermDockValidationError`
- * with every issue, so a manifest of another major is refused.
+ * deep-frozen copy built from own keys; throws `PermDockValidationError` with
+ * every issue, so a manifest of another major is refused.
  */
-declare function parseSupabaseManifest(json: unknown): SupabaseHookManifest;
+declare function parseSupabaseManifest(json: unknown): SupabaseManifest;
 //#endregion
-export { SupabaseManifestHelper as a, SupabaseManifestRls as c, SupabaseManifestValue as d, parseSupabaseManifest as f, SupabaseManifestColumn as i, SupabaseManifestRole as l, SupabaseHookManifest as n, SupabaseManifestMembership as o, SupabaseManifestActiveRow as r, SupabaseManifestRequires as s, SupabaseHookClaim as t, SupabaseManifestThrough as u };
+export { hasTokenHook as _, SupabaseManifestActiveRow as a, SupabaseManifestMembership as c, SupabaseManifestResourceNames as d, SupabaseManifestRls as f, SupabaseManifestValue as g, SupabaseManifestThrough as h, SupabaseManifest as i, SupabaseManifestNames as l, SupabaseManifestScopeNames as m, SupabaseHookClaim as n, SupabaseManifestColumn as o, SupabaseManifestRole as p, SupabaseHookManifest as r, SupabaseManifestHelper as s, SupabaseDatabaseManifest as t, SupabaseManifestRequires as u, parseSupabaseManifest as v };

package/dist/{manifest-schema-C0kK_8V0.js → manifest-schema-2r37XRhD.js}

@@ -1,6 +1,9 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 //#region src/supabase/manifest-schema.ts
-/** `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks against; a test keeps the two equal. */
+/**
+* `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks
+* against; a test keeps the two equal.
+*/
 const supabaseManifestSchema = freezeDeep({
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	$id: "https://permdock.com/schemas/supabase-manifest-v1.json",
@@ -10,13 +13,8 @@ const supabaseManifestSchema = freezeDeep({
 	required: [
 		"$schema",
 		"version",
-		"hook",
 		"helpers",
 		"tenantClaim",
-		"budget",
-		"claims",
-		"authzVersion",
-		"memberships",
 		"rls",
 		"decidingColumns",
 		"markers"
@@ -95,6 +93,24 @@ const supabaseManifestSchema = freezeDeep({
 			}
 		},
 		authzVersion: { type: "boolean" },
+		managementApi: {
+			description: "The Management API fields that make a hosted project call the generated hook, as `permdock supabase inspect` prints and `--out` writes them.",
+			type: "object",
+			required: [
+				"hook_custom_access_token_enabled",
+				"hook_custom_access_token_uri",
+				"jwt_exp"
+			],
+			properties: {
+				hook_custom_access_token_enabled: { const: true },
+				hook_custom_access_token_uri: { type: "string" },
+				jwt_exp: {
+					description: "The access token lifetime in seconds: `[auth] jwt_expiry` of `supabase/config.toml`, or 3600 when it is unset.",
+					type: "integer"
+				}
+			},
+			additionalProperties: false
+		},
 		authzVersionBump: {
 			type: "object",
 			required: [
@@ -222,6 +238,7 @@ const supabaseManifestSchema = freezeDeep({
 						items: { type: "string" }
 					} }
 				},
+				tokenScopes: { type: "boolean" },
 				apiKeys: {
 					type: "object",
 					required: [
@@ -260,6 +277,44 @@ const supabaseManifestSchema = freezeDeep({
 				grants: { const: "v1" }
 			}
 		},
+		names: {
+			description: "The SQL names the generated RLS exposes to application SQL, unqualified, in `schema`: per scope and per resource, as `resolveNames` gives them. Absent from a manifest written before 0.8.",
+			type: "object",
+			required: [
+				"schema",
+				"gucPrefix",
+				"claims",
+				"scopes",
+				"resources"
+			],
+			properties: {
+				schema: { type: "string" },
+				gucPrefix: { type: "string" },
+				claims: {
+					type: "object",
+					required: ["tenant", "role"],
+					properties: {
+						tenant: { type: "string" },
+						role: { type: "string" }
+					}
+				},
+				teamScope: { type: "string" },
+				scopes: {
+					type: "object",
+					additionalProperties: {
+						type: "object",
+						additionalProperties: { type: "string" }
+					}
+				},
+				resources: {
+					type: "object",
+					additionalProperties: {
+						type: "object",
+						additionalProperties: { type: "string" }
+					}
+				}
+			}
+		},
 		requires: {
 			description: "The supabase/sdk capability-matrix feature ids the hook, the helpers and subjectFromSupabase depend on, as of the matrix release tag.",
 			type: "object",
@@ -349,7 +404,7 @@ const supabaseManifestSchema = freezeDeep({
 		},
 		helperName: {
 			type: "string",
-			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
+			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for|_of)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
 		},
 		column: {
 			type: "object",
@@ -357,7 +412,23 @@ const supabaseManifestSchema = freezeDeep({
 			additionalProperties: false,
 			properties: { column: { $ref: "#/$defs/identifier" } }
 		},
-		role: { oneOf: [{ $ref: "#/$defs/value" }, { $ref: "#/$defs/through" }] },
+		role: { oneOf: [
+			{ $ref: "#/$defs/value" },
+			{ $ref: "#/$defs/through" },
+			{ $ref: "#/$defs/mapped" }
+		] },
+		mapped: {
+			type: "object",
+			required: ["column", "map"],
+			additionalProperties: false,
+			properties: {
+				column: { $ref: "#/$defs/identifier" },
+				map: {
+					type: "object",
+					additionalProperties: { type: ["string", "null"] }
+				}
+			}
+		},
 		user: { oneOf: [{ $ref: "#/$defs/column" }, { $ref: "#/$defs/through" }] },
 		through: {
 			type: "object",

package/dist/{manifest-C8IzW3Do.js → manifest-wg8WkkpD.js}

@@ -1,13 +1,17 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as supabaseManifestSchema } from "./manifest-schema-C0kK_8V0.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as supabaseManifestSchema } from "./manifest-schema-2r37XRhD.js";
 //#region src/supabase/manifest.ts
+/** Whether the manifest describes a token hook. */
+function hasTokenHook(manifest) {
+	return "hook" in manifest;
+}
 /**
 * Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
 * validates it against `schemas/supabase-manifest-v1.json`. Returns a
-* deep-frozen copy built from own keys; throws `PermDockValidationError`
-* with every issue, so a manifest of another major is refused.
+* deep-frozen copy built from own keys; throws `PermDockValidationError` with
+* every issue, so a manifest of another major is refused.
 */
 function parseSupabaseManifest(json) {
 	const issues = [];
@@ -39,4 +43,4 @@ function invalidManifest(issues) {
 	});
 }
 //#endregion
-export { parseSupabaseManifest as t };
+export { parseSupabaseManifest as n, hasTokenHook as t };

package/dist/{map-claims-D3oRmTk0.js → map-claims-BNWCJtmP.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey, o as readPath } from "./paths-DXSHAMIa.js";
-import { n as expirySeconds } from "./expiry-D4_YKRKD.js";
-import { r as validateRecord } from "./thenable-yD7SabqG.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey, o as readPath } from "./paths-CUvURzHp.js";
+import { n as expirySeconds } from "./expiry-6XByK0dm.js";
+import { r as validateRecord } from "./thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
-import { t as clientNameOf } from "./clients-DjU5ABMy.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { t as clientNameOf } from "./clients-DYr3U86j.js";
 //#region src/jwt/map-claims.ts
 /** OpenID Connect Core section 5.1: profile data the provider owns. */
 const PROFILE_CLAIMS = [
@@ -180,7 +180,10 @@ function membershipsFromClaim(value) {
 	});
 	return out;
 }
-/** Zitadel's `role -> { orgId: orgDomain }` form: string values and no `roles` key. */
+/**
+* Zitadel's `role -> { orgId: orgDomain }` form: string values and no `roles`
+* key.
+*/
 function isRoleToOrganisations(value) {
 	const entries = Object.entries(value);
 	return entries.length > 0 && !("roles" in value) && entries.every(([key, item]) => typeof item === "string" && !isForbiddenKey(key));
@@ -338,19 +341,25 @@ function mapClaimsToSubject(claims, options) {
 		invalidChain: false
 	};
 }
+/**
+* `true` when a verified token is not an OpenID Connect ID token for one of
+* `clients`.
+*/
+function idTokenMismatch(claims, headerTyp, clients) {
+	const typ = headerTyp?.toLowerCase();
+	if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
+	if (typeof claims.iat !== "number") return true;
+	const aud = claims.aud;
+	const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
+	const expected = clients === void 0 ? [] : typeof clients === "string" ? [clients] : clients;
+	const azp = claims["azp"];
+	if (azp === void 0) return audiences.length > 1;
+	return typeof azp !== "string" || !expected.includes(azp);
+}
 function acceptMismatch(claims, headerTyp, options, audience) {
 	const accept = options.accept ?? "access-token";
 	const typ = headerTyp?.toLowerCase();
-	if (accept === "id-token") {
-		if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
-		if (typeof claims.iat !== "number") return true;
-		const aud = claims.aud;
-		const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
-		const clients = audience === void 0 ? [] : typeof audience === "string" ? [audience] : audience;
-		const azp = claims["azp"];
-		if (azp === void 0) return audiences.length > 1;
-		return typeof azp !== "string" || !clients.includes(azp);
-	}
+	if (accept === "id-token") return idTokenMismatch(claims, headerTyp, audience);
 	if (options.profile === "fapi2" && typ !== "at+jwt") return true;
 	if (typeof claims["nonce"] === "string") return true;
 	if (audience !== void 0 && typeof claims.aud === "string") {
@@ -360,4 +369,4 @@ function acceptMismatch(claims, headerTyp, options, audience) {
 	return false;
 }
 //#endregion
-export { mapClaimsToSubject as n, validateCustomClaims as r, acceptMismatch as t };
+export { validateCustomClaims as i, idTokenMismatch as n, mapClaimsToSubject as r, acceptMismatch as t };

package/dist/{map-error-Dr70oA_3.js → map-error-pasIGqMT.js}

@@ -1,14 +1,14 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
-import { c as problemResponse, i as decisionResponse } from "./problem-CTviyH5L.js";
-import { u as InvalidSignatureError } from "./evaluations-beAooV0n.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
+import { a as decisionResponse, l as problemResponse } from "./problem-BVLHFK33.js";
+import { l as InvalidSignatureError } from "./evaluations-IBceAeKT.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the
-* status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
-* same decision. Returns `undefined` for anything else so the framework's own
-* error path takes over.
+* status, `WWW-Authenticate` and rate-limit fields `protect` sends for the same
+* decision. Returns `undefined` for anything else so the framework's own error
+* path takes over.
 */
 function problemFromError(error, options = {}) {
 	if (error instanceof InvalidSignatureError) return error.response;

package/dist/{markers-C6joDI3o.js → markers-BeHZ4x9Q.js}

@@ -3,13 +3,25 @@ import { t as beforeFirst } from "./text-BMFRfBqc.js";
 const HOOK_MARKER = "-- permdock:hook v1";
 /** The first line of a `--grants-out` file. */
 const GRANTS_MARKER = "-- permdock:grants v1";
-/** The first line of the `seeds` part: the `role_permissions` rows, a versioned migration. */
+/**
+* The first line of the `seeds` part: the `role_permissions` rows, a versioned
+* migration.
+*/
 const SEEDS_MARKER = "-- permdock:seeds v1";
-/** The first line of the `indexes` part: the indexes the policies and helpers read through. */
+/**
+* The first line of the `indexes` part: the indexes the policies and helpers
+* read through.
+*/
 const INDEXES_MARKER = "-- permdock:indexes v1";
-/** The first line of a `--backfill-out` migration: existing custom roles copied into the custom-role tables. */
+/**
+* The first line of a `--backfill-out` migration: existing custom roles copied
+* into the custom-role tables.
+*/
 const BACKFILL_MARKER = "-- permdock:backfill v1";
-/** The first line of a `rls migrate --retire-out` migration: a materialised permissions table and its refresh triggers dropped. */
+/**
+* The first line of a `rls migrate --retire-out` migration: a materialised
+* permissions table and its refresh triggers dropped.
+*/
 const RETIRE_MARKER = "-- permdock:retire v1";
 const HOOK_LINE = /^-- permdock:hook v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
 const GRANTS_LINE = /^-- permdock:grants v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
@@ -25,7 +37,10 @@ function pairs(rest) {
 	}
 	return fields;
 }
-/** The fields of a hook marker line, or undefined when `sql` does not start with one. */
+/**
+* The fields of a hook marker line, or undefined when `sql` does not start with
+* one.
+*/
 function hookMarkerFields(sql) {
 	const line = firstLine(sql);
 	return line.startsWith(`-- permdock:hook v1 `) ? pairs(line.slice(20)) : void 0;