permdock 0.6.0 → 0.8.0

package/dist/{refs-K6eWUJ0H.js → refs-C8BKxc_e.js}

@@ -1,5 +1,5 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-CUvURzHp.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;
@@ -68,6 +68,20 @@ function createRef(path) {
 }
 const principal = createRef("principal");
 const context = createRef("context");
+/**
+* `principal.claims.<path>` for a dot path such as `team_ids` or
+* `attrs.region`, typed `SubjectRef` under `noUncheckedIndexedAccess` and
+* `noPropertyAccessFromIndexSignature`.
+*/
+function claim(path) {
+	const segments = splitPath(path);
+	if (segments.length === 0) throw new Error("PermDock: claim() needs a claim path");
+	return createRef([
+		"principal",
+		"claims",
+		...segments
+	].join("."));
+}
 function isSubjectRef(value) {
 	if (value === null || typeof value !== "object" || !("ref" in value) || typeof value.ref !== "string") return false;
 	const ref = value.ref;
@@ -88,4 +102,4 @@ function resolveConditionRef(ref, resolved) {
 	}
 }
 //#endregion
-export { hasConditionOp as a, isConditionRef as c, resolveConditionRef as i, isSqlFunctionField as l, isSubjectRef as n, isCondition as o, principal as r, isConditionDate as s, context as t, parentHop as u };
+export { resolveConditionRef as a, isConditionDate as c, parentHop as d, principal as i, isConditionRef as l, context as n, hasConditionOp as o, isSubjectRef as r, isCondition as s, claim as t, isSqlFunctionField as u };

package/dist/{relation-walk-3OyDBF0S.js → relation-walk-DK_gkgL7.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { n as relationId } from "./relations-BnCWnJGI.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { n as relationId } from "./relations-BxvRvDHK.js";
 //#region src/core/relation-walk.ts
 /** Whether the holder's period covers `now`. */
 function activeNow(holder, now) {
@@ -53,7 +53,10 @@ function restrictedAbove(condition, row, reader) {
 	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
 	return false;
 }
-/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
+/**
+* The instances a graph relation reads: the start, then ancestors until a
+* restricted one or `depth`.
+*/
 function relationWalk(condition, row, reader) {
 	if (!isRecord(row)) return;
 	const first = relationId(ownGet(row, condition.field));
@@ -93,10 +96,10 @@ function relationWalk(condition, row, reader) {
 	};
 }
 /**
-* Whether the subject holds the relation on the row's instance or an
-* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
-* goes on past `depth` with no holder below it. Any read the instance could
-* not answer is `relation-unavailable` unless a holder was found elsewhere.
+* Whether the subject holds the relation on the row's instance or an ancestor
+* within `depth`. A cycle is `relation-depth`; so is a chain that goes on past
+* `depth` with no holder below it. Any read the instance could not answer is
+* `relation-unavailable` unless a holder was found elsewhere.
 */
 function resolveRelated(condition, row, subject, now, reader, permitted) {
 	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
@@ -148,8 +151,8 @@ function groupKey(group) {
 }
 /**
 * Whether the principal holds `at.relation` on one instance, directly or
-* through a group whose members hold it. Groups of `at`'s own resource nest
-* at most `budget` deep; a group of another resource gets a fresh budget
+* through a group whose members hold it. Groups of `at`'s own resource nest at
+* most `budget` deep; a group of another resource gets a fresh budget
 * (declarations rule out cycles across resources). A group met twice on one
 * path, or one past the budget, is `relation-depth`. `explored` holds the
 * budget each group was walked with across the whole walk: a group already

package/dist/{relations-BnCWnJGI.js → relations-BxvRvDHK.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as idText } from "./expiry-D4_YKRKD.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { a as expandRelation } from "./resource-relations-D_jw0BFx.js";
+import { i as idText } from "./expiry-6XByK0dm.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { a as expandRelation } from "./resource-relations-8-pCScBO.js";
 //#region src/core/relations.ts
 function isInstant(value) {
 	return value === void 0 || typeof value === "number" && Number.isFinite(value);

package/dist/{replay-Du1tJjG7.js → replay-BU09ad4L.js}

@@ -1,4 +1,4 @@
-import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { o as epochSeconds } from "./time-nR1JesoH.js";
 //#region src/ssf/replay.ts
 function memoryReplayStore() {
 	const seen = /* @__PURE__ */ new Map();

package/dist/{replay-Bkm-Ne4l.d.ts → replay-DNftIb_R.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-C791HFu9.js";
+import { l as ReplayStore } from "./types-DjuMBNF9.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-C81Pip9n.js → request-context-C25ilqiJ.js}

@@ -1,10 +1,10 @@
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
-import { t as buildInstance } from "./build-instance-Bu_eDqYw.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { t as buildInstance } from "./build-instance-CNWaYJyr.js";
 //#region src/core/request-context.ts
 /**
-* Errors an adapter raises around one instance (a `context` hook that threw,
-* an `onDenied` that failed), fed to the instance's `on('error')` handlers and
+* Errors an adapter raises around one instance (a `context` hook that threw, an
+* `onDenied` that failed), fed to the instance's `on('error')` handlers and
 * replayed to later ones, as core replays its own.
 */
 function deliver(handler, error) {
@@ -33,9 +33,9 @@ function errorChannel(queued) {
 	};
 }
 /**
-* `buildInstance` with an error channel: the instance's `on('error')`
-* replays `errors` raised while resolving the request, and `report` adds
-* more. Kept beside `errorChannel`, so adapters without one do not bundle it.
+* `buildInstance` with an error channel: the instance's `on('error')` replays
+* `errors` raised while resolving the request, and `report` adds more. Kept
+* beside `errorChannel`, so adapters without one do not bundle it.
 */
 async function buildReportingInstance(input) {
 	const channel = errorChannel(input.errors);

package/dist/{request-schema-CMreVuFM.js → request-schema-DhX7UbfQ.js}

@@ -1,5 +1,8 @@
 //#region src/approvals/request-schema.ts
-/** An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no `format`. */
+/**
+* An RFC 3339 instant as `Temporal.Instant` prints it; pg_jsonschema asserts no
+* `format`.
+*/
 const INSTANT = String.raw`^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$`;
 const STRINGS = {
 	type: "array",

package/dist/resend/index.d.ts

@@ -1,20 +1,23 @@
-import { q as DecisionSink } from "../policy-types-n0uRTsW8.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-BtHtcKMr.js";
-import { l as ReplayStore } from "../types-C791HFu9.js";
+import { q as DecisionSink } from "../policy-types-CCiDRZBH.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-yUuPR5Hy.js";
+import { l as ReplayStore } from "../types-DjuMBNF9.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
-  /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */
+  /**
+   * The app's approval page: a base the request id is appended to, or a
+   * function of the prompt. Must be https.
+   */
   readonly approvalUrl: ApprovalUrl;
   /** The product name in the footer line. */
   readonly product?: string;
 };
 /**
- * The default approval prompt email: an `approval`-category message whose
- * one link opens the app's approval page for the request. It carries no
- * approve or reject link; the signed-in approver decides on that page.
- * Throws a `TypeError` for an approval page that is not https. Replace it
- * with a React Email template by building the same `EmailMessage`.
+ * The default approval prompt email: an `approval`-category message whose one
+ * link opens the app's approval page for the request. It carries no approve or
+ * reject link; the signed-in approver decides on that page. Throws a
+ * `TypeError` for an approval page that is not https. Replace it with a React
+ * Email template by building the same `EmailMessage`.
  */
 export declare function approvalEmail(prompt: ApprovalPrompt, options: ApprovalEmailOptions): EmailMessage;
 //#endregion
@@ -48,16 +51,16 @@ type ResendResult<T> = {
 /** The part of a `Resend` client the transport calls; a `new Resend(key)` fits. */
 type ResendClient = {
   readonly emails: {
-    send(payload: ResendEmailPayload, options?: {
+    send: (payload: ResendEmailPayload, options?: {
       readonly idempotencyKey?: string;
-    }): Promise<ResendResult<{
+    }) => Promise<ResendResult<{
       readonly id: string;
     }>>;
   };
   readonly batch?: {
-    send(payloads: ResendEmailPayload[], options?: {
+    send: (payloads: ResendEmailPayload[], options?: {
       readonly idempotencyKey?: string;
-    }): Promise<ResendResult<{
+    }) => Promise<ResendResult<{
       readonly data: readonly {
         readonly id: string;
       }[];
@@ -69,22 +72,25 @@ type ResendTransportOptions = {
   readonly from?: string;
   /** The `replyTo` of an email whose message sets none. */
   readonly replyTo?: string;
-  /** Tags added to every email; names and values are ASCII letters, digits, `_` and `-`. */
+  /**
+   * Tags added to every email; names and values are ASCII letters, digits, `_`
+   * and `-`.
+   */
   readonly tags?: Readonly<Record<string, string>>;
 };
 /**
- * The failure a Resend error name means. Rate limits, quotas and server
- * errors are retryable with the same idempotency key; a key, sender or
- * validation error is final. An unknown name is retryable only for a 5xx or
- * a missing status.
+ * The failure a Resend error name means. Rate limits, quotas and server errors
+ * are retryable with the same idempotency key; a key, sender or validation
+ * error is final. An unknown name is retryable only for a 5xx or a missing
+ * status.
  */
 export declare function resendFailure(error: ResendError): DeliveryResult;
 /**
  * Sends the email channel of `permdock/delivery` through Resend. The
  * idempotency key is Resend's `idempotencyKey`. The delivery id, key and
- * category travel as tags, so `resendWebhook` can join provider events to
- * the delivery. Two or more recipients go out through `batch.send`, up to
- * 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+ * category travel as tags, so `resendWebhook` can join provider events to the
+ * delivery. Two or more recipients go out through `batch.send`, up to 100 per
+ * call. Throws a `TypeError` for a tag outside Resend's charset.
  */
 export declare function resendTransport(resend: ResendClient, options?: ResendTransportOptions): EmailTransport;
 //#endregion
@@ -92,7 +98,7 @@ export declare function resendTransport(resend: ResendClient, options?: ResendTr
 /** The part of a `Resend` client the webhook calls; a `new Resend(key)` fits. */
 type ResendWebhookClient = {
   readonly webhooks: {
-    verify(input: {
+    verify: (input: {
       readonly payload: string;
       readonly headers: {
         readonly id: string;
@@ -100,7 +106,7 @@ type ResendWebhookClient = {
         readonly signature: string;
       };
       readonly webhookSecret: string;
-    }): unknown;
+    }) => unknown;
   };
 };
 type ResendWebhookOptions = {
@@ -116,10 +122,10 @@ type ResendWebhookOptions = {
 /**
  * A fetch handler for Resend webhooks. It verifies the Standard Webhooks
  * signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
- * header names both work), claims the message id, and writes one delivery
- * event for `email.delivered`, `email.bounced`, `email.complained`,
- * `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
- * failure releases the claim and answers `503`, so Resend retries.
+ * header names both work), claims the message id, and writes one delivery event
+ * for `email.delivered`, `email.bounced`, `email.complained`, `email.failed`
+ * and `email.suppressed`. A bad signature is a `401`; a sink failure releases
+ * the claim and answers `503`, so Resend retries.
  */
 export declare function resendWebhook(options: ResendWebhookOptions): (request: Request) => Promise<Response>;
 //#endregion

package/dist/resend/index.js

@@ -1,14 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { a as ownRecord } from "../paths-DXSHAMIa.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { l as isRfc3339, p as nowSeconds } from "../time-DkWjdL98.js";
-import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
-import { t as deliveryEvent } from "../delivery-event-xX4obB8F.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { a as methodNotAllowed, c as problemResponse } from "../problem-CTviyH5L.js";
-import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
-import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { a as ownRecord } from "../paths-CUvURzHp.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { l as isRfc3339, p as nowSeconds } from "../time-nR1JesoH.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
+import { t as deliveryEvent } from "../delivery-event-JioK5YbS.js";
+import { n as readBodyText } from "../body-text-DQhcmqdY.js";
+import { l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
+import { t as bodyTooLarge } from "../body-CJQwYVa8.js";
+import { n as approvalUrlFor } from "../approval-prompt-B8hQY69x.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 //#region src/resend/approval-email.ts
 const HTML_ESCAPES = {
 	"&": "&",
@@ -29,11 +29,11 @@ function requesterLine(prompt) {
 	return actor === void 0 ? `Requested by ${principal}` : `Requested by ${principal} through ${actor.kind} ${actor.id}`;
 }
 /**
-* The default approval prompt email: an `approval`-category message whose
-* one link opens the app's approval page for the request. It carries no
-* approve or reject link; the signed-in approver decides on that page.
-* Throws a `TypeError` for an approval page that is not https. Replace it
-* with a React Email template by building the same `EmailMessage`.
+* The default approval prompt email: an `approval`-category message whose one
+* link opens the app's approval page for the request. It carries no approve or
+* reject link; the signed-in approver decides on that page. Throws a
+* `TypeError` for an approval page that is not https. Replace it with a React
+* Email template by building the same `EmailMessage`.
 */
 function approvalEmail(prompt, options) {
 	const url = approvalUrlFor(prompt, options.approvalUrl);
@@ -95,10 +95,10 @@ const FINAL = {
 	validation_error: "rejected"
 };
 /**
-* The failure a Resend error name means. Rate limits, quotas and server
-* errors are retryable with the same idempotency key; a key, sender or
-* validation error is final. An unknown name is retryable only for a 5xx or
-* a missing status.
+* The failure a Resend error name means. Rate limits, quotas and server errors
+* are retryable with the same idempotency key; a key, sender or validation
+* error is final. An unknown name is retryable only for a 5xx or a missing
+* status.
 */
 function resendFailure(error) {
 	const name = error.name;
@@ -183,9 +183,9 @@ async function sendBatch(resend, items, payloadOf) {
 /**
 * Sends the email channel of `permdock/delivery` through Resend. The
 * idempotency key is Resend's `idempotencyKey`. The delivery id, key and
-* category travel as tags, so `resendWebhook` can join provider events to
-* the delivery. Two or more recipients go out through `batch.send`, up to
-* 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+* category travel as tags, so `resendWebhook` can join provider events to the
+* delivery. Two or more recipients go out through `batch.send`, up to 100 per
+* call. Throws a `TypeError` for a tag outside Resend's charset.
 */
 function resendTransport(resend, options = {}) {
 	const tags = checkTags(options.tags ?? {});
@@ -285,9 +285,9 @@ function outcomeOf(type, data) {
 	}
 }
 /**
-* The delivery event a verified Resend payload stands for, or `null` for
-* one that is not about a PermDock delivery: opens and clicks (tracking,
-* not delivery), sends, contact and domain events, and mail without the
+* The delivery event a verified Resend payload stands for, or `null` for one
+* that is not about a PermDock delivery: opens and clicks (tracking, not
+* delivery), sends, contact and domain events, and mail without the
 * `permdock_delivery` and `permdock_key` tags.
 */
 function eventOf(payload, source) {
@@ -333,10 +333,10 @@ async function claim(replay, key) {
 /**
 * A fetch handler for Resend webhooks. It verifies the Standard Webhooks
 * signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
-* header names both work), claims the message id, and writes one delivery
-* event for `email.delivered`, `email.bounced`, `email.complained`,
-* `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
-* failure releases the claim and answers `503`, so Resend retries.
+* header names both work), claims the message id, and writes one delivery event
+* for `email.delivered`, `email.bounced`, `email.complained`, `email.failed`
+* and `email.suppressed`. A bad signature is a `401`; a sink failure releases
+* the claim and answers `503`, so Resend retries.
 */
 function resendWebhook(options) {
 	const source = options.source ?? "permdock";

package/dist/resolve-names-CF7xXLSG.js

@@ -0,0 +1,201 @@
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import "./budget-BELja5A9.js";
+import "./sources-CMAM-2A3.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-Afctg7B0.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DeMNEy6V.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+//#region src/cli/rls/permission-holders.ts
+/**
+* `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL
+* contract.
+*/
+function permittedUsersHelper(scope) {
+	return checkName(`permitted_${scope}_users`);
+}
+/**
+* The users with a membership row on the instance `p_id`, or `undefined` when
+* the scope's memberships are not all in tables.
+*/
+function candidatesSql(ctx, scope, user) {
+	const mapped = scopeTable(ctx, scope);
+	if (mapped !== void 0) return {
+		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
+    from ${quoteQualified(mapped.table.table)} m
+    where m.${quoteIdent(mapped.column)} = p_id`,
+		keys: []
+	};
+	const sources = holderSources(ctx, scope);
+	if (sources === void 0 || sources === "not-tables") return;
+	return {
+		sql: sources.map((source, index) => `    select h.user_id::${user}
+    from (
+${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
+    ) h`).join("\n    union\n"),
+		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
+	};
+}
+/**
+* `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a
+* `%type` variable.
+*/
+function functionBody(keys, query) {
+	if (keys.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${query}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${keys.map((key) => `  ${key} := p_id;`).join("\n")}
+begin
+  return query
+${query.replaceAll(/^/gmu, "  ")};
+end
+$$;`;
+}
+/**
+* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
+* mode: the users who hold a permission key on one instance, read from the
+* scope's membership rows and the global-roles table and kept when
+* `permitted_<scope>_ids_by_permission_for` lists the instance or
+* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
+* suspension apply as for the user. It names other users, so no client role may
+* execute it, and a backend role needs its own grant.
+*/
+function permissionHoldersSql(ctx) {
+	if (ctx.authorize !== "database") return "";
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const global = globalRoleRows(ctx);
+	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
+	return `${ctx.scopes.map(({ name }) => {
+		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
+		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
+		const fn = qualified(ctx, permittedUsersHelper(name));
+		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
+		const type = scopeTypeOf(ctx, name);
+		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
+create or replace function ${fn}(p_permission text, p_id ${type})
+returns setof ${user}
+${functionBody(candidates.keys, `  select c.user_id
+  from (
+${candidates.sql}
+    union
+    select ${global.userSql}::${user}
+    from ${global.from}
+  ) c(user_id)
+  where c.user_id is not null
+    and (
+      p_id in (select ${ids}(c.user_id, p_permission))
+      or ${hasFor}(c.user_id, p_permission)
+    )
+  order by 1`)}
+revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
+	}).join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/sql/resolve-names.ts
+/** Postgres truncates a longer identifier, so two helpers could share one name. */
+const MAX_IDENTIFIER_BYTES = 63;
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/u;
+function scopeNames(name) {
+	return {
+		permittedIds: permittedIdsHelper(name),
+		permittedIdsFor: permittedForHelper(name),
+		memberIds: memberIdsHelper(name),
+		memberIdsFor: memberForHelper(name),
+		...isTeamScope(name) ? { memberIdsOf: memberOfHelper(name) } : {},
+		permittedUsers: permittedUsersHelper(name)
+	};
+}
+function rowHelperSet(setting, resources) {
+	if (setting === void 0) return /* @__PURE__ */ new Set();
+	return new Set(setting === true ? resources : setting);
+}
+function baseName(table) {
+	return table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
+}
+function resourceNames(resource, input) {
+	const sql = graphSqlName(resource);
+	const { table } = input;
+	return {
+		...table === void 0 ? {} : { table },
+		...input.graph && sql !== void 0 ? {
+			permittedIds: graphHelper(resource),
+			restricted: restrictedHelper(resource)
+		} : {},
+		...input.rows && sql !== void 0 ? {
+			rows: inheritedRowsHelper(resource),
+			row: `permitted_${sql}_row`
+		} : {},
+		...input.fields && table !== void 0 ? {
+			visible: `${table}${FIELD_VIEWS.view}`,
+			visibleFields: `${baseName(table)}${FIELD_VIEWS.companion}`,
+			mask: `${baseName(table)}${FIELD_VIEWS.mask}`
+		} : {}
+	};
+}
+/**
+* Rejects a helper that is not a lowercase SQL identifier or is longer than
+* Postgres keeps, and two sources that resolve to the same helper.
+*/
+function checkNames(names) {
+	const owners = /* @__PURE__ */ new Map();
+	const claim = (name, owner) => {
+		if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${owner} names the SQL helper '${name}', which is not a lowercase SQL identifier`);
+		if (new TextEncoder().encode(name).length > MAX_IDENTIFIER_BYTES) throw configError(`PermDock CLI: ${owner} names the SQL helper '${name}', longer than the ${String(MAX_IDENTIFIER_BYTES)} bytes Postgres keeps; shorten the name`);
+		const other = owners.get(name);
+		if (other !== void 0 && other !== owner) throw configError(`PermDock CLI: ${other} and ${owner} both name the SQL helper '${name}'; rename one of them`);
+		owners.set(name, owner);
+	};
+	for (const [scope, helpers] of Object.entries(names.scopes)) for (const name of Object.values(helpers)) claim(name, `scope '${scope}'`);
+	for (const [resource, helpers] of Object.entries(names.resources)) {
+		const { table: _table, visible: _visible, ...functions } = helpers;
+		for (const name of Object.values(functions)) claim(name, `resource '${resource}'`);
+	}
+}
+/**
+* The SQL names `policy` and `config` give the generated RLS, frozen. Throws
+* `config_invalid` for a helper name Postgres cannot hold or two sources
+* sharing one.
+*/
+function resolveNames(policy, config, options = {}) {
+	const rls = config.rls;
+	const scopes = scopeList(policy.scopes);
+	const resources = [.../* @__PURE__ */ new Set([...listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.resource), ...policy.resources.keys()])];
+	const graph = graphPlan(policy);
+	const tables = tableNames(rls?.tables) ?? {};
+	const rows = rowHelperSet(rls?.rowHelpers, resources);
+	const team = scopes.find((scope) => isTeamScope(scope.name));
+	const names = {
+		schema: options.schema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock",
+		gucPrefix: options.gucPrefix ?? rls?.gucPrefix ?? "app",
+		claims: {
+			tenant: options.tenantClaim ?? rls?.tenantClaim ?? "tenant_id",
+			role: rls?.roleClaim ?? "user_role"
+		},
+		...team === void 0 ? {} : { teamScope: team.name },
+		scopes: Object.fromEntries(scopes.map((scope) => [scope.name, scopeNames(scope.name)])),
+		resources: Object.fromEntries(resources.flatMap((resource) => {
+			const entry = resourceNames(resource, {
+				table: tables[resource],
+				graph: graph.has(resource),
+				rows: rows.has(resource),
+				fields: rls?.fields !== void 0
+			});
+			return Object.keys(entry).length === 0 ? [] : [[resource, entry]];
+		}))
+	};
+	checkNames(names);
+	return freezeDeep(names);
+}
+//#endregion
+export { permissionHoldersSql as n, permittedUsersHelper as r, resolveNames as t };

package/dist/{resource-relations-D_jw0BFx.js → resource-relations-8-pCScBO.js}

@@ -1,4 +1,4 @@
-import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { t as assertSafeKey } from "./paths-CUvURzHp.js";
 //#region src/core/resource-relations.ts
 /** The edge's group resources with their relation and id column. */
 function groupEntries(spec) {
@@ -35,8 +35,8 @@ function isComputedRelation(relation) {
 	return relation !== void 0 && !("field" in relation) && !("edge" in relation) && !("principal" in relation);
 }
 /**
-* The relations whose holders hold `name` on `node`: `name` itself when it
-* has a source, then everything it includes, transitively, each once.
+* The relations whose holders hold `name` on `node`: `name` itself when it has
+* a source, then everything it includes, transitively, each once.
 * `definePermissions` rejects cycles and unknown names, so this terminates.
 */
 function expandRelation(node, name) {
@@ -53,12 +53,18 @@ function expandRelation(node, name) {
 	visit(name);
 	return out;
 }
-/** Whether `node` names itself as its parent (nested folders, sub-teams, reporting lines). */
+/**
+* Whether `node` names itself as its parent (nested folders, sub-teams,
+* reporting lines).
+*/
 function isSelfParented(node) {
 	return node?.parent !== void 0 && node.parent.resource === node.name;
 }
 const RESOURCE_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/u;
-/** Level names ride claims and grant keys (`key@level`), so they stay SQL- and claim-safe. */
+/**
+* Level names ride claims and grant keys (`key@level`), so they stay SQL- and
+* claim-safe.
+*/
 const LEVEL_NAME = /^[a-z][a-z0-9_]*$/u;
 const EDGE_TABLE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/u;
 function restrictedStopsOf(name, option, parent, links) {
@@ -143,7 +149,7 @@ function normaliseMatch(label, match) {
 	for (const column of columns) {
 		assertSafeKey(column, "edge match column");
 		const value = match[column];
-		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new Error(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
+		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new TypeError(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
 		out[column] = value;
 	}
 	return out;
@@ -183,7 +189,10 @@ function normaliseGroups(label, groups) {
 		...groups.direct === void 0 ? {} : { direct: groups.direct }
 	};
 }
-/** An included relation must exist on the same resource, be tenancy-free and never include itself back. */
+/**
+* An included relation must exist on the same resource, be tenancy-free and
+* never include itself back.
+*/
 function assertIncludes(node) {
 	const state = /* @__PURE__ */ new Map();
 	const visit = (name, path) => {
@@ -210,8 +219,8 @@ function assertGroupTarget(registry, node, relationName, spec, target, targetRel
 /**
 * Links and group targets name declared resources and relations. Groups may
 * nest within one resource (teams in teams) through the same relation, which
-* then includes nothing, so SQL can walk it with one bounded recursive query;
-* a group cycle across resources is rejected.
+* then includes nothing, so SQL can walk it with one bounded recursive query; a
+* group cycle across resources is rejected.
 */
 function assertGraphTargets(registry) {
 	const edges = /* @__PURE__ */ new Map();