permdock 0.6.0 → 0.8.0

package/dist/{powersync-DISt6SUe.js → powersync-DXqGuq9A.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-MMJ2mI2q.js");
+		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-MMJ2mI2q.js");
+		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-Djf-zCpB.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-DHNQX06W.js";

package/dist/preset/index.d.ts

@@ -1,9 +1,8 @@
 //#region src/preset/catalog.d.ts
 /**
- * The preset catalogue: every choice `/create` and `permdock init` offer.
- * Each list is append-only and its order is part of the preset code
- * (`codec.ts`): a new choice goes at the end, and a removed one keeps its
- * slot as `retired`.
+ * The preset catalogue: every choice `/create` and `permdock init` offer. Each
+ * list is append-only and its order is part of the preset code (`codec.ts`): a
+ * new choice goes at the end, and a removed one keeps its slot as `retired`.
  */
 type ArchetypeId = "b2b" | "agent" | "marketplace" | "api" | "internal" | "consumer";
 type FeatureId = "tenancy" | "custom-roles" | "approvals" | "operations" | "decision-log" | "limits" | "plans" | "ownership" | "api-keys" | "rls";
@@ -33,13 +32,16 @@ export declare const AUTH: readonly Choice<AuthId>[];
 export declare const BACKENDS: readonly Choice<BackendId>[];
 export declare const FRAMEWORKS: readonly Choice<FrameworkId>[];
 /**
- * Agent runtimes and UI recipes. The preset code keeps one bitset per
- * `kind`, each in this list's order, so a new entry goes after the last
- * one of its kind.
+ * Agent runtimes and UI recipes. The preset code keeps one bitset per `kind`,
+ * each in this list's order, so a new entry goes after the last one of its
+ * kind.
  */
 export declare const INTEGRATIONS: readonly Integration[];
 export declare const SERVICES: readonly Choice<ServiceId>[];
-/** A complete preset: every choice `/create` and `permdock init` offer, resolved. */
+/**
+ * A complete preset: every choice `/create` and `permdock init` offer,
+ * resolved.
+ */
 type Preset = {
   readonly archetype: ArchetypeId;
   readonly features: readonly FeatureId[];
@@ -49,7 +51,10 @@ type Preset = {
   readonly integrations: readonly IntegrationId[];
   readonly services: readonly ServiceId[];
 };
-/** What a person picks; `resolvePreset` fills in the rest from `PRESET_DEFAULTS`. */
+/**
+ * What a person picks; `resolvePreset` fills in the rest from
+ * `PRESET_DEFAULTS`.
+ */
 type PresetInput = Partial<Preset> & {
   readonly archetype: ArchetypeId;
 };
@@ -58,10 +63,9 @@ export declare const PRESET_DEFAULTS: Preset;
 /** The integrations of one `kind` in `preset`, in catalogue order. */
 export declare function integrationsOf(preset: Pick<Preset, "integrations">, kind: IntegrationKind): IntegrationId[];
 /**
- * The preset `input` describes, with every feature its archetype,
- * integrations and other features require turned on, and lists in
- * catalogue order. Features are only ever added, so resolving twice is a
- * no-op.
+ * The preset `input` describes, with every feature its archetype, integrations
+ * and other features require turned on, and lists in catalogue order. Features
+ * are only ever added, so resolving twice is a no-op.
  */
 export declare function resolvePreset(input: PresetInput): Preset;
 //#endregion
@@ -69,22 +73,25 @@ export declare function resolvePreset(input: PresetInput): Preset;
 /** The preset code for `preset`, such as `p1AQIDBAc`. */
 export declare function encodePreset(preset: Preset): string;
 /**
- * The preset a code stands for, resolved, or `undefined` for a code that
- * is not a version this package reads or does not decode.
+ * The preset a code stands for, resolved, or `undefined` for a code that is not
+ * a version this package reads or does not decode.
  */
 export declare function decodePreset(code: string): Preset | undefined;
 //#endregion
 //#region src/preset/flags.d.ts
-/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+/**
+ * One `permdock init` flag per preset key, with the catalogue it takes values
+ * from.
+ */
 export declare const PRESET_FLAGS: { readonly [K in keyof Preset]: {
   readonly flag: string;
   readonly choices: readonly Choice<string>[];
   readonly repeatable: boolean;
 }; };
 /**
- * The `permdock init` flags that select `preset`, leaving out defaults and
- * the features its archetype and integrations already turn on, so
- * `permdock init <flags>` resolves to the same preset.
+ * The `permdock init` flags that select `preset`, leaving out defaults and the
+ * features its archetype and integrations already turn on, so `permdock init
+ * <flags>` resolves to the same preset.
  */
 export declare function presetFlags(preset: Preset): string[];
 //#endregion
@@ -94,9 +101,9 @@ type GeneratedFile = {
   readonly path: string;
   readonly contents: string;
   /**
-   * `owned`: the application's own code, edited freely and never
-   * rewritten by an update. Every generated file is owned; rules, checks and
-   * verification stay in the `permdock` package, which these files only call.
+   * `owned`: the application's own code, edited freely and never rewritten by
+   * an update. Every generated file is owned; rules, checks and verification
+   * stay in the `permdock` package, which these files only call.
    */
   readonly kind: "owned";
 };
@@ -113,9 +120,9 @@ type GeneratedPreset = {
   readonly docs: readonly string[];
 };
 /**
- * The files, dependencies and recipes for `preset`. Pure: no file system
- * and no network, so the same function runs in the CLI, in a registry route
- * and in the browser preview on /create.
+ * The files, dependencies and recipes for `preset`. Pure: no file system and no
+ * network, so the same function runs in the CLI, in a registry route and in the
+ * browser preview on /create.
  */
 export declare function generatePreset(preset: Preset, options?: {
   readonly src?: string;
@@ -124,7 +131,10 @@ export declare function generatePreset(preset: Preset, options?: {
 //#region src/preset/matrix.d.ts
 /** How one role reaches one action under a preset. */
 type MatrixAccess = {
-  /** `allow`: always; `own`: on rows it owns; `pro`: on the pro plan; `none`: never. */
+  /**
+   * `allow`: always; `own`: on rows it owns; `pro`: on the pro plan; `none`:
+   * never.
+   */
   readonly access: "allow" | "own" | "pro" | "none";
   readonly approval: boolean;
   readonly limit: boolean;
@@ -138,8 +148,8 @@ type PresetMatrix = {
   }[];
 };
 /**
- * Who may do what under `preset`, from the same model the generated policy
- * is written from, for a page that shows the policy without running it.
+ * Who may do what under `preset`, from the same model the generated policy is
+ * written from, for a page that shows the policy without running it.
  */
 export declare function presetMatrix(preset: Preset): PresetMatrix;
 //#endregion

package/dist/preset/index.js

@@ -1 +1 @@
-export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-DZdU0tne.js";
+export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-BjLzeFpp.js";

package/dist/{preset-DZdU0tne.js → preset-BjLzeFpp.js}

@@ -178,9 +178,9 @@ const FRAMEWORKS = [
 	}
 ];
 /**
-* Agent runtimes and UI recipes. The preset code keeps one bitset per
-* `kind`, each in this list's order, so a new entry goes after the last
-* one of its kind.
+* Agent runtimes and UI recipes. The preset code keeps one bitset per `kind`,
+* each in this list's order, so a new entry goes after the last one of its
+* kind.
 */
 const INTEGRATIONS = [
 	{
@@ -250,10 +250,9 @@ function requiredBy(choices, picked) {
 	return choices.filter((choice) => picked.includes(choice.id)).flatMap((choice) => choice.requires ?? []);
 }
 /**
-* The preset `input` describes, with every feature its archetype,
-* integrations and other features require turned on, and lists in
-* catalogue order. Features are only ever added, so resolving twice is a
-* no-op.
+* The preset `input` describes, with every feature its archetype, integrations
+* and other features require turned on, and lists in catalogue order. Features
+* are only ever added, so resolving twice is a no-op.
 */
 function resolvePreset(input) {
 	const integrations = INTEGRATIONS.map((item) => item.id).filter((id) => (input.integrations ?? PRESET_DEFAULTS.integrations).includes(id));
@@ -282,12 +281,12 @@ function resolvePreset(input) {
 //#endregion
 //#region src/preset/codec.ts
 /**
-* Preset codes: `p1` followed by base64url bytes. Version 1 packs, in
-* order, one byte each for the archetype, auth, backend and framework
-* index, then a bitset per multi-select list (features, agent
-* integrations, UI integrations, services), each as many bytes as the list
-* needs. A list only grows at the end, so a code keeps its meaning as the
-* catalogue grows; a new layout gets a new version prefix.
+* Preset codes: `p1` followed by base64url bytes. Version 1 packs, in order,
+* one byte each for the archetype, auth, backend and framework index, then a
+* bitset per multi-select list (features, agent integrations, UI integrations,
+* services), each as many bytes as the list needs. A list only grows at the
+* end, so a code keeps its meaning as the catalogue grows; a new layout gets a
+* new version prefix.
 */
 const VERSION = "p1";
 const AGENT_INTEGRATIONS = INTEGRATIONS.filter((item) => item.kind === "agent");
@@ -349,8 +348,8 @@ function encodePreset(preset) {
 	]);
 }
 /**
-* The preset a code stands for, resolved, or `undefined` for a code that
-* is not a version this package reads or does not decode.
+* The preset a code stands for, resolved, or `undefined` for a code that is not
+* a version this package reads or does not decode.
 */
 function decodePreset(code) {
 	if (!code.startsWith(VERSION)) return;
@@ -384,7 +383,10 @@ function decodePreset(code) {
 }
 //#endregion
 //#region src/preset/flags.ts
-/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+/**
+* One `permdock init` flag per preset key, with the catalogue it takes values
+* from.
+*/
 const PRESET_FLAGS = {
 	archetype: {
 		flag: "archetype",
@@ -423,9 +425,9 @@ const PRESET_FLAGS = {
 	}
 };
 /**
-* The `permdock init` flags that select `preset`, leaving out defaults and
-* the features its archetype and integrations already turn on, so
-* `permdock init <flags>` resolves to the same preset.
+* The `permdock init` flags that select `preset`, leaving out defaults and the
+* features its archetype and integrations already turn on, so `permdock init
+* <flags>` resolves to the same preset.
 */
 function presetFlags(preset) {
 	const implied = resolvePreset({
@@ -867,9 +869,9 @@ function quote(value) {
 	return JSON.stringify(value);
 }
 /**
-* An environment read in the generated code. Built from parts so this
-* runtime chunk carries no `process.` token, which the WinterTC check reads
-* as a Node global; the generated file has it whole.
+* An environment read in the generated code. Built from parts so this runtime
+* chunk carries no `process.` token, which the WinterTC check reads as a Node
+* global; the generated file has it whole.
 */
 function env(name) {
 	return ["process", `env[${quote(name)}]`].join(".");
@@ -1224,7 +1226,10 @@ function backendFiles(ctx) {
 		default: return ctx.preset.backend;
 	}
 }
-/** What `permdock.ts` adds for the backend: imports, statements before `defineApp`, and its options. */
+/**
+* What `permdock.ts` adds for the backend: imports, statements before
+* `defineApp`, and its options.
+*/
 function backendApp(ctx) {
 	if (ctx.preset.backend !== "supabase") return {
 		imports: [],
@@ -1286,7 +1291,10 @@ ${entries.join("\n")}
 });
 `;
 }
-/** What a role's grant becomes under the preset's features; the matrix and the code read the same answer. */
+/**
+* What a role's grant becomes under the preset's features; the matrix and the
+* code read the same answer.
+*/
 function grantShape(preset, role, grant) {
 	const has = (feature) => preset.features.includes(feature);
 	const resource = DOMAINS[preset.archetype].resources.find((item) => item.name === grant.resource);
@@ -1378,7 +1386,7 @@ function appFile(ctx) {
 	const services = ctx.preset.services;
 	const cloudServices = services.length > 0;
 	if (cloudServices) preamble.push(`import { cloud } from "permdock/cloud";`);
-	if (services.includes("cloud-hosted-grants")) preamble.push(`import { cloudEndpoints } from "permdock/cloud";`, `import { joseTokenVerifier } from "permdock/jwt";`);
+	if (services.includes("cloud-hosted-grants")) preamble.push(`import { joseTokenVerifier } from "permdock/jwt";`);
 	if (ctx.has("decision-log")) {
 		if (services.includes("cloud-decision-log")) lines.push("  sink: permdockCloud.sink,");
 		else {
@@ -1397,7 +1405,7 @@ function appFile(ctx) {
 		valueImports.add("hostedPolicies");
 		lines.push("  policies: hostedPolicies(permdockCloud.policies),");
 	}
-	const cloudCall = services.includes("cloud-hosted-grants") ? `cloud({\n  verifier: joseTokenVerifier({ jwks: cloudEndpoints().jwks }),\n})` : "cloud()";
+	const cloudCall = services.includes("cloud-hosted-grants") ? `cloud({\n  verifier: ({ jwks }) => joseTokenVerifier({ jwks }),\n})` : "cloud()";
 	const snapshots = services.includes("cloud-snapshots") ? `\n/** A client's signed snapshot, served by PermDock Cloud for the caller's token. */\nexport const snapshotsFor = (token: string) => permdockCloud.snapshotsFor(token);\n` : "";
 	const cloudLine = cloudServices ? `\n// PERMDOCK_CLOUD_URL and PERMDOCK_CLOUD_KEY come from the environment.\nexport const permdockCloud = ${cloudCall};\n${snapshots}` : "";
 	const backend = backendApp(ctx);
@@ -1607,8 +1615,21 @@ export function decideReadKey(permdock: PermDock, id: string) {
 }
 function rlsOption(ctx) {
 	if (!ctx.has("rls")) return null;
-	const table = `{\n      table: "org_members",\n      tenant: "org_id",\n      user: "user_id",\n      role: "role",\n    }`;
-	return ctx.preset.backend === "supabase" ? `supabaseRls({${ctx.has("tenancy") ? `\n    memberships: ${table},\n  ` : ""}})` : `{\n    dialect: "guc",${ctx.has("tenancy") ? `\n    memberships: { tenant: ${table} },` : ""}\n  }`;
+	return ctx.preset.backend === "supabase" ? `supabaseRls({${ctx.has("tenancy") ? `\n    memberships: {
+      table: "org_members",
+      tenant: "org_id",
+      user: "user_id",
+      role: "role",
+    },\n  ` : ""}})` : `{\n    dialect: "guc",${ctx.has("tenancy") ? `\n    memberships: {
+      scopes: {
+        tenant: {
+          table: "org_members",
+          columns: { tenant: "org_id" },
+          user: "user_id",
+          role: "role",
+        },
+      },
+    },` : ""}\n  }`;
 }
 function configFile(ctx) {
 	const rls = rlsOption(ctx);
@@ -1626,7 +1647,10 @@ ${options.join("\n")}
 });
 `);
 }
-/** The `@permdock` registry recipes for the preset's UI; native has the gate and the upgrade prompt. */
+/**
+* The `@permdock` registry recipes for the preset's UI; native has the gate and
+* the upgrade prompt.
+*/
 function recipesFor(ctx) {
 	const web = ["gated-button"];
 	if (ctx.has("approvals")) web.push("approval-request-dialog");
@@ -1675,9 +1699,9 @@ function docsFor(ctx) {
 	return [...new Set(docs)];
 }
 /**
-* The files, dependencies and recipes for `preset`. Pure: no file system
-* and no network, so the same function runs in the CLI, in a registry route
-* and in the browser preview on /create.
+* The files, dependencies and recipes for `preset`. Pure: no file system and no
+* network, so the same function runs in the CLI, in a registry route and in the
+* browser preview on /create.
 */
 function generatePreset(preset, options = {}) {
 	const ctx = {
@@ -1713,8 +1737,8 @@ const NONE = {
 	limit: false
 };
 /**
-* Who may do what under `preset`, from the same model the generated policy
-* is written from, for a page that shows the policy without running it.
+* Who may do what under `preset`, from the same model the generated policy is
+* written from, for a page that shows the policy without running it.
 */
 function presetMatrix(preset) {
 	const domain = DOMAINS[preset.archetype];

package/dist/{principal-source-pHneukrx.js → principal-source-C6N60GtM.js}

@@ -1,13 +1,13 @@
-import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
 //#region src/core/principal-source.ts
 function nonEmpty(value) {
 	return typeof value === "string" && value.trim() !== "";
 }
 /**
 * A `PrincipalIdentity` in the form sources compare: an email trimmed and
-* lower-cased with no provider or workspace, a chat identity with a
-* provider. Anything else, inherited fields included, is `undefined`.
+* lower-cased with no provider or workspace, a chat identity with a provider.
+* Anything else, inherited fields included, is `undefined`.
 */
 function normalizeIdentity(value) {
 	const record = ownRecord(value);
@@ -55,9 +55,9 @@ async function loadPrincipal(source, id, tenant) {
 	}
 }
 /**
-* `source.principalByIdentity(identity)` over the normalised identity,
-* failing closed: no source or method, an invalid identity, `null`, a throw
-* or a rejection is `null`.
+* `source.principalByIdentity(identity)` over the normalised identity, failing
+* closed: no source or method, an invalid identity, `null`, a throw or a
+* rejection is `null`.
 */
 async function loadPrincipalByIdentity(source, identity) {
 	const normalized = normalizeIdentity(identity);
@@ -69,9 +69,9 @@ async function loadPrincipalByIdentity(source, identity) {
 	}
 }
 /**
-* In-process principals for tests and single-replica apps. `identities`
-* links an email or chat identity to a principal id; each answer is a fresh
-* frozen copy. `tenant` is not a filter, as for a database source.
+* In-process principals for tests and single-replica apps. `identities` links
+* an email or chat identity to a principal id; each answer is a fresh frozen
+* copy. `tenant` is not a filter, as for a database source.
 */
 function memoryPrincipalSource(input) {
 	const byId = /* @__PURE__ */ new Map();

package/dist/prisma/index.d.ts

@@ -1,14 +1,20 @@
-import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
-import { c as WhereResult } from "../permdock-SV8ZINYT.js";
-import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
+import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
+import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts
-/** A model's non-nullable scalar fields and its scalar list fields, by Prisma field name. */
+/**
+ * A model's non-nullable scalar fields and its scalar list fields, by Prisma
+ * field name.
+ */
 type PrismaModelFields = {
   readonly required: readonly string[];
   readonly lists: readonly string[];
 };
-/** The `datamodel` of Prisma's DMMF (`getDMMF`, or a generator's `options.dmmf.datamodel`). */
+/**
+ * The `datamodel` of Prisma's DMMF (`getDMMF`, or a generator's
+ * `options.dmmf.datamodel`).
+ */
 type PrismaDatamodel = {
   readonly models: readonly {
     readonly name: string;
@@ -21,8 +27,9 @@ type PrismaDatamodel = {
   }[];
 };
 /**
- * Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
- * the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+ * Reads a model's required and list fields from `schema.prisma` text or a DMMF
+ * datamodel, for the `model` option of `toWhere` and `toPredicate`. Relation
+ * fields are skipped.
  */
 export declare function prismaModelFields(datamodel: string | PrismaDatamodel, model: string): PrismaModelFields;
 //#endregion
@@ -30,11 +37,17 @@ export declare function prismaModelFields(datamodel: string | PrismaDatamodel, m
 type PrismaWhereOptions = {
   readonly fields?: Readonly<Record<string, string>>;
   readonly subject?: Subject;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
   readonly listFields?: readonly string[];
   readonly requiredFields?: readonly string[];
-  /** Required and list fields read from the schema by `prismaModelFields`; adds to `requiredFields` and `listFields`. */
+  /**
+   * Required and list fields read from the schema by `prismaModelFields`; adds
+   * to `requiredFields` and `listFields`.
+   */
   readonly model?: PrismaModelFields;
 };
 export declare function toWhere<T extends Record<string, unknown> = Record<string, unknown>>(input: Condition | WhereResult, options?: PrismaWhereOptions): T;
@@ -48,43 +61,45 @@ export declare function permdockExtension(): {
   };
 };
 type PrismaTransactionClient = {
-  $executeRawUnsafe(query: string, ...values: unknown[]): Promise<number>;
+  $executeRawUnsafe: (query: string, ...values: unknown[]) => Promise<number>;
 };
 type PrismaLike<Tx> = {
-  $transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+  $transaction: <T>(fn: (tx: Tx) => Promise<T>) => Promise<T>;
 };
 /**
- * Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
- * the generated RLS policies decide for the same subject as the in-process checks.
+ * Runs `fn` in an interactive transaction whose role and claims are
+ * `permdock.subject`'s, so the generated RLS policies decide for the same
+ * subject as the in-process checks.
  */
 export declare function withSubject<Tx extends PrismaTransactionClient, T>(prisma: PrismaLike<Tx>, permdock: {
   readonly subject: Subject;
 }, fn: (tx: Tx) => Promise<T>, options?: WithSubjectOptions): Promise<T>;
 type PrismaDelegate = {
-  findFirst(args: {
+  findFirst: (args: {
     readonly where: Record<string, unknown>;
-  }): Promise<unknown>;
+  }) => Promise<unknown>;
 };
 /**
- * Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
- * filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
- * filter keeps the row. One query when granted, two otherwise.
+ * Checks one row by its unique key, for `findUnique`, `update` and `delete`,
+ * which take no filter: `{ found: false }` when `unique` matches nothing,
+ * otherwise whether the permission filter keeps the row. One query when
+ * granted, two otherwise.
  */
 export declare function checkRow(delegate: PrismaDelegate, input: Condition | WhereResult, unique: Record<string, unknown>, options?: PrismaWhereOptions): Promise<RowCheck>;
 //#endregion
 //#region src/prisma/predicate.d.ts
 /** A Prisma 8 ORM field proxy: `u.email` inside `.where((u) => ...)`. */
 type PrismaFieldProxy = {
-  eq(value: unknown): unknown;
-  neq(value: unknown): unknown;
-  gt(value: unknown): unknown;
-  gte(value: unknown): unknown;
-  lt(value: unknown): unknown;
-  lte(value: unknown): unknown;
-  like(pattern: string): unknown;
-  in(values: readonly unknown[]): unknown;
-  isNull(): unknown;
-  isNotNull(): unknown;
+  eq: (value: unknown) => unknown;
+  neq: (value: unknown) => unknown;
+  gt: (value: unknown) => unknown;
+  gte: (value: unknown) => unknown;
+  lt: (value: unknown) => unknown;
+  lte: (value: unknown) => unknown;
+  like: (pattern: string) => unknown;
+  in: (values: readonly unknown[]) => unknown;
+  isNull: () => unknown;
+  isNotNull: () => unknown;
 };
 /** `import { and, or, not } from '@prisma/orm-postgres/orm-client'`. */
 type PrismaCombinators = {
@@ -95,12 +110,21 @@ type PrismaCombinators = {
 type PrismaPredicateOptions = {
   readonly fields?: Readonly<Record<string, string>>;
   readonly subject?: Subject;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
-  /** Required and list fields from `prismaModelFields`; `contains` on a list field is refused. */
+  /**
+   * Required and list fields from `prismaModelFields`; `contains` on a list
+   * field is refused.
+   */
   readonly model?: PrismaModelFields;
   readonly listFields?: readonly string[];
-  /** A non-null column (the primary key) that spells constant true and false. Default `id`. */
+  /**
+   * A non-null column (the primary key) that spells constant true and false.
+   * Default `id`.
+   */
   readonly key?: string;
   /** Loaded from `@prisma/orm-postgres/orm-client` by default. */
   readonly combinators?: PrismaCombinators;
@@ -108,16 +132,17 @@ type PrismaPredicateOptions = {
 type Model = Readonly<Record<string, PrismaFieldProxy>>;
 /**
  * Compiles a condition into a Prisma 8 ORM predicate: pass the result to
- * `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+ * `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that
+ * matches no row.
  */
 export declare function toPredicate<M = Model>(input: Condition | WhereResult, options?: PrismaPredicateOptions): (model: M) => unknown;
 //#endregion
 //#region src/conditions/resolve-related.d.ts
 type ResolveRelatedOptions = {
   /**
-   * Runs one Postgres query with `$1`-style placeholders and returns its
-   * rows; each row's `id` is an id the filtered field may hold. With Prisma:
-   * `({ sql, values }) => prisma.$queryRawUnsafe(sql, ...values)`.
+   * Runs one Postgres query with `$1`-style placeholders and returns its rows;
+   * each row's `id` is an id the filtered field may hold. With Prisma: `({ sql,
+   * values }) => prisma.$queryRawUnsafe(sql, ...values)`.
    */
   readonly run: (query: {
     readonly sql: string;
@@ -125,14 +150,17 @@ type ResolveRelatedOptions = {
   }) => Promise<readonly Readonly<Record<string, unknown>>[]>;
   /** Where the relation graph lives. */
   readonly relations?: RelationsMapping;
-  /** Turns an id (always text) into the field's type, e.g. `Number` for an integer key. */
+  /**
+   * Turns an id (always text) into the field's type, e.g. `Number` for an
+   * integer key.
+   */
   readonly parse?: (id: string, field: string) => unknown;
 };
 /**
- * `where` with every `related` node replaced by the ids it reaches, read in
- * one query per node, so an ORM without raw subqueries (Prisma) filters the
- * graph with a plain `in`. The ids are read now: run the filtered query right
- * after, in the same transaction when the graph may change in between.
+ * `where` with every `related` node replaced by the ids it reaches, read in one
+ * query per node, so an ORM without raw subqueries (Prisma) filters the graph
+ * with a plain `in`. The ids are read now: run the filtered query right after,
+ * in the same transaction when the graph may change in between.
  */
 export declare function resolveRelated(where: WhereResult, options: ResolveRelatedOptions): Promise<WhereResult>;
 //#endregion