permdock 0.7.0 → 0.9.0

package/dist/{codemod-i4N2BhDc.js → codemod-D9Aiii1r.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { i as dryRunFlag } from "./flags-aaeRAdiD.js";
+import { i as dryRunFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/codemod.ts
 const codemod = defineLeaf({
 	positionals: [{
@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-BP6n8N9L.js")).codemodVersions();
+			return (await import("./codemod-Bv5i-Mzo.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,8 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		const { runCodemod } = await import("./codemod-BP6n8N9L.js");
-		return runCodemod({
+		return (await import("./codemod-Bv5i-Mzo.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{collect-DNm3oKOk.js → collect-B80GYEot.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { o as fileOut, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { o as fileOut, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/collect.ts
 const collect = defineLeaf({
 	flags: {
@@ -29,10 +29,9 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			const { watchCollect } = await import("./watch-Bd9mx3rd.js");
-			return watchCollect(ctx, overrides);
+			return (await import("./watch-ClLuO2TL.js")).watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-k_Dulxr5.js")).runCollect({
+		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,

package/dist/collect-D-eroIfV.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-WCl8cJQV.js";

package/dist/{collect-BaWeMjwV.js → collect-WCl8cJQV.js}

@@ -1,65 +1,18 @@
-import { r as isRecord } from "./compact-CAf557ZB.js";
-import { k as isOperationEffect } from "./src-DLFrtrrC.js";
-import { o as isPermission } from "./permission-registry-DpPtSKNZ.js";
-import { r as isOperationRisk } from "./permissions-CyH2MV_B.js";
-import { a as describeError, i as configError } from "./errors-DpP_U6Bf.js";
-import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
+import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-BSjrtIHw.js";
+import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { t as shortDiff } from "./text-diff-DhITNCnD.js";
+import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { Visitor, parseSync, visitorKeys } from "oxc-parser";
-//#region src/cli/catalog-operations.ts
-function metaOf(name, value) {
-	const fail = (field) => {
-		throw configError(`PermDock CLI: operations.${name}.meta${field} is invalid`);
-	};
-	if (!isRecord(value)) return fail("");
-	const { risk, effects, title } = value;
-	if (risk !== void 0 && !isOperationRisk(risk)) return fail(".risk");
-	if (effects !== void 0 && (!Array.isArray(effects) || !effects.every(isOperationEffect))) return fail(".effects");
-	if (title !== void 0 && typeof title !== "string") return fail(".title");
-	return {
-		...risk === void 0 ? {} : { risk },
-		...effects === void 0 ? {} : { effects },
-		...title === void 0 ? {} : { title }
-	};
-}
+//#region src/cli/scan.ts
 /**
-* The catalog entries of a `defineOperations` map, in definition order.
-* Throws for a value that is not one, such as a module that exports the
-* definitions object instead of the map.
+* oxc reports recoverable problems as `Warning` or `Advice`; only `Error`
+* leaves the program incomplete.
 */
-function catalogOperations(value) {
-	if (!isRecord(value)) throw configError("PermDock CLI: operations export is not an operation map");
-	const out = [];
-	for (const name of Object.keys(value)) {
-		const operation = value[name];
-		if (!isRecord(operation) || operation["name"] !== name || !isPermission(operation["permission"])) throw configError(`PermDock CLI: operations.${name} is not an operation; export the defineOperations result`);
-		const results = operation["results"];
-		if (results !== void 0 && !isPermission(results)) throw configError(`PermDock CLI: operations.${name}.results is not a permission`);
-		out.push({
-			name,
-			permission: operation["permission"].key,
-			...results === void 0 ? {} : { results: results.key },
-			meta: metaOf(name, operation["meta"])
-		});
-	}
-	return out;
-}
-/** The configured operations module's catalog entries; `undefined` without one. Throws when it is missing or does not load. */
-async function loadConfiguredOperations(cwd, path, options) {
-	if (path === void 0) return;
-	const abs = resolve(cwd, path);
-	if (!existsSync(abs)) throw configError(`PermDock CLI: operations module not found: ${rel(cwd, abs)}`);
-	const mod = await loadModule(abs, options);
-	return catalogOperations(pickNamed(mod, ["operations"]));
-}
-//#endregion
-//#region src/cli/scan.ts
-/** oxc reports recoverable problems as `Warning` or `Advice`; only `Error` leaves the program incomplete. */
 const PARSE_ERRORS = /* @__PURE__ */ new Set(["Error"]);
 const CHECK_CALLS = /* @__PURE__ */ new Set([
 	"can",
@@ -72,6 +25,7 @@ const CHECK_CALLS = /* @__PURE__ */ new Set([
 	"usePermission",
 	"getPermission",
 	"requirePermission",
+	"protectAction",
 	"protect",
 	"allow",
 	"deny",
@@ -159,7 +113,7 @@ function scanSources(cwd, files, knownKeys) {
 function includeOf(options, isRoot) {
 	if (options?.type !== "ObjectExpression") return options === void 0 ? void 0 : null;
 	const property = options.properties?.find((item) => item.key?.name === "include");
-	if (property === void 0) return options.properties?.some((item) => item.type === "SpreadElement") ? null : void 0;
+	if (property === void 0) return options.properties?.some((item) => item.type === "SpreadElement") === true ? null : void 0;
 	const list = property.value;
 	if (list?.type !== "ArrayExpression") return null;
 	const keys = [];
@@ -179,7 +133,10 @@ function recordImport(node, roots, definitions) {
 function isDefinePermissions(node) {
 	return node?.type === "CallExpression" && calleeName(node.callee) === "definePermissions";
 }
-/** An import binding of a permission tree: by its imported name, or a default import named `permissions`. */
+/**
+* An import binding of a permission tree: by its imported name, or a default
+* import named `permissions`.
+*/
 function importsRoot(spec, definitions) {
 	if (spec.type === "ImportSpecifier") {
 		const value = spec.imported?.value;
@@ -234,7 +191,10 @@ const FUNCTION_SCOPES = /* @__PURE__ */ new Set([
 	"FunctionExpression",
 	"ArrowFunctionExpression"
 ]);
-/** The names a scope node declares, each with whether it is a permission tree; `undefined` for a node that opens no scope. */
+/**
+* The names a scope node declares, each with whether it is a permission tree;
+* `undefined` for a node that opens no scope.
+*/
 function bindingsOf(node, definitions) {
 	const bindings = /* @__PURE__ */ new Map();
 	const type = node.type;
@@ -420,7 +380,10 @@ function collectObjectKeys(node, into) {
 		if (typeof key?.value === "string") into.add(key.value);
 	}
 }
-/** Every node in source order, with its parent: Oxc nodes carry none, so enter and exit keep a stack. */
+/**
+* Every node in source order, with its parent: Oxc nodes carry none, so enter
+* and exit keep a stack.
+*/
 function walk(program, visit) {
 	const stack = [];
 	const handlers = {};
@@ -553,14 +516,14 @@ function guessPermissions(cwd, srcPath) {
 	return [
 		"src/permissions.ts",
 		"permissions.ts",
-		...srcPath.map((entry) => `${entry.replace(/\/$/, "")}/permissions.ts`)
+		...srcPath.map((entry) => `${entry.replace(/\/$/u, "")}/permissions.ts`)
 	].find((file) => existsSync(resolve(cwd, file)));
 }
 function barrelFile(barrel) {
 	return barrel === true ? "src/permissions.generated.ts" : barrel;
 }
 function writeBarrel(abs, permissionsAbs) {
-	const specifier = relative(dirname(abs), permissionsAbs).replace(/\\/gu, "/").replace(/\.tsx?$/u, ".js");
+	const specifier = relative(dirname(abs), permissionsAbs).replaceAll("\\", "/").replace(/\.tsx?$/u, ".js");
 	const body = `// @generated by permdock — do not edit
 import { mergePermissions } from 'permdock'
 import { permissions as collected } from '${specifier.startsWith(".") ? specifier : `./${specifier}`}'
@@ -570,4 +533,4 @@ export const permissions = mergePermissions(collected)
 	writeFileEnsuringDir(abs, body);
 }
 //#endregion
-export { loadConfiguredOperations as a, scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };
+export { scanSources as i, guessPermissions as n, runCollect as r, barrelFile as t };

package/dist/{compare-pfyVnBjE.js → compare-DTfyUunF.js}

@@ -1,7 +1,7 @@
 //#region src/core/compare.ts
 /**
-* Orders strings by UTF-16 code unit, the same in every locale and runtime,
-* so sorted output is byte-stable where `localeCompare` would follow the ICU
+* Orders strings by UTF-16 code unit, the same in every locale and runtime, so
+* sorted output is byte-stable where `localeCompare` would follow the ICU
 * build.
 */
 function byCodePoint(a, b) {

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
-import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-COM2VKuN.js";
+import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-BwFC4Qjs.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BEklRUYo.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/compile/index.js

@@ -1 +1 @@
-export { t as compileWhere, n as escapeLike } from "../compile-BAEO5bOk.js";
+export { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";

package/dist/{compile-COM2VKuN.d.ts → compile-BEklRUYo.d.ts}

@@ -1,22 +1,31 @@
-import { Rt as Instant, fn as Scope, lr as Subject, mr as Condition } from "./policy-types-B-F-qAZk.js";
-import { b as ResourceNode } from "./permission-types-DhNEmoRG.js";
-import { u as WhereResult } from "./permdock-Dco6dyCK.js";
-import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
+import { Wt as Instant, br as Condition, hr as Subject, vn as Scope } from "./policy-types-DGIO_gxq.js";
+import { b as ResourceNode } from "./permission-types-CAY-GU7e.js";
+import { f as WhereResult } from "./permdock-CprAPN3w.js";
+import { r as RelationsMapping, t as GraphSql } from "./graph-sql-BwFC4Qjs.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {
   readonly table: string;
   readonly user: string;
   readonly role: string;
-  /** Per scope name, the column holding that scope's id (the row's own scope and its ancestors). */
+  /**
+   * Per scope name, the column holding that scope's id (the row's own scope and
+   * its ancestors).
+   */
   readonly columns?: Readonly<Record<string, string>>;
   /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
   readonly tenant?: string;
   /** Column of the second scope's id; shorthand for `columns[<second scope>]`. */
   readonly team?: string;
   readonly id?: string;
-  /** Column naming the membership's resource, when one table holds several kinds. */
+  /**
+   * Column naming the membership's resource, when one table holds several
+   * kinds.
+   */
   readonly resource?: string;
-  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
+  /**
+   * Column holding the membership kind (`Membership.via`); roles with `for`
+   * need it.
+   */
   readonly via?: string;
   /** Unix seconds, like `Membership.expiresAt`; `null` never expires. */
   readonly expiresAt?: string;
@@ -33,9 +42,15 @@ type MembershipsMapping = {
 type CompileWhereOptions = {
   readonly subject?: Subject;
   readonly memberships?: MembershipsMapping;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
-  /** The policy's scopes; `where()` results carry them. Defaults to the implicit `tenant` / `team` pair. */
+  /**
+   * The policy's scopes; `where()` results carry them. Defaults to the implicit
+   * `tenant` / `team` pair.
+   */
   readonly scopes?: readonly Scope[];
   /** Where the relation graph lives; without it a `related` node is refused. */
   readonly relations?: RelationsMapping;
@@ -61,7 +76,10 @@ type CompiledExists = {
   readonly expiresAt?: string;
   /** Unix seconds the `expiresAt` column is compared against. */
   readonly now: number;
-  /** A membership row matches when this column is `null` or equals `tenantValue`. */
+  /**
+   * A membership row matches when this column is `null` or equals
+   * `tenantValue`.
+   */
   readonly tenantColumn?: string;
   readonly tenantValue?: string;
   readonly resourceColumn?: string;
@@ -82,14 +100,20 @@ type CompiledWhere = {
   readonly kind: "not";
   readonly item: CompiledWhere;
 } | CompiledExists | CompiledSql;
-/** A Postgres boolean over the row that is never NULL: a `related` node's subquery. */
+/**
+ * A Postgres boolean over the row that is never NULL: a `related` node's
+ * subquery.
+ */
 type CompiledSql = {
   readonly kind: "sql";
   readonly parts: GraphSql;
   /** What a `{ subject: true }` part binds. */
   readonly subject: string;
 };
-/** A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match literally. */
+/**
+ * A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match
+ * literally.
+ */
 declare function escapeLike(value: string): string;
 declare function compileWhere(input: Condition | WhereResult, options?: CompileWhereOptions): CompiledWhere;
 //#endregion

package/dist/{compile-BAEO5bOk.js → compile-EzEMB-7v.js}

@@ -1,12 +1,12 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-CNJBiTFo.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { f as scopeList, h as tenantOf, l as rootScope, m as subjectMemberships, s as resolveScope, u as scopeChain } from "./scopes-BHsc-wp-.js";
-import { t as isoInstant } from "./instant-BluqDvyS.js";
+import { t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-C8BKxc_e.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { t as expiredAt } from "./expiry-6XByK0dm.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { o as epochSeconds, t as INVALID_NOW } from "./time-nR1JesoH.js";
+import { f as scopeList, h as tenantOf, l as rootScope, m as subjectMemberships, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { t as isoInstant } from "./instant-DK3Iz83e.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */
 function quoteSqlName(name) {
@@ -49,7 +49,10 @@ function edgeRowFilter(spec, alias) {
 function groupHolders(build, resource, relation) {
 	return build.options.holders?.(resource, relation) ?? holderIds(build, resource, relation);
 }
-/** Who a row of the edge names, when it is not a group of the edge's own resource. */
+/**
+* Who a row of the edge names, when it is not a group of the edge's own
+* resource.
+*/
 function edgeHolderFilter(build, node, spec, alias) {
 	const holder = col(alias, spec.subject ?? "user_id");
 	const groups = spec.groups;
@@ -79,14 +82,17 @@ function edgeHolderFilter(build, node, spec, alias) {
 	parts.push(text(")"));
 	return parts;
 }
-/** The nested-group step of an edge whose groups include its own resource: the row names a group of `node`. */
+/**
+* The nested-group step of an edge whose groups include its own resource: the
+* row names a group of `node`.
+*/
 function selfGroupWhere(spec, node, subject, alias) {
 	const column = spec.groups?.column;
 	return column === void 0 ? [text(`${subject} is not null`)] : [text(`${col(alias, column)} = `), { value: node.name }];
 }
 /**
-* One concrete relation's arm: `select <id>::text as id ...` for every
-* instance of `node` the subject holds `relation` on, through groups too.
+* One concrete relation's arm: `select <id>::text as id ...` for every instance
+* of `node` the subject holds `relation` on, through groups too.
 */
 function relationArm(build, node, relation) {
 	const spec = node.relations[relation];
@@ -142,7 +148,10 @@ function holderIds(build, resource, relation) {
 	}
 	return out;
 }
-/** One concrete relation's arm, for helpers that guard each arm by the relation asked for. */
+/**
+* One concrete relation's arm, for helpers that guard each arm by the relation
+* asked for.
+*/
 function relationArmSql(resource, relation, options) {
 	const build = {
 		options,
@@ -163,7 +172,10 @@ function heldIds(build, condition) {
 	parts.push(text(") as v(id)"));
 	return parts;
 }
-/** Instances of the condition's resource at or below the held ones, within its depth and never through a restricted child. */
+/**
+* Instances of the condition's resource at or below the held ones, within its
+* depth and never through a restricted child.
+*/
 function reached(build, condition) {
 	const held = heldIds(build, condition);
 	if (condition.depth === 0) return held;
@@ -192,7 +204,10 @@ function reached(build, condition) {
 		text(`) h union select ${col(t, node.id)}::text, ${d}.level + 1 from ${tableOf(build, node.name)} ${t} join ${d} on ${col(t, node.parent.field)}::text = ${d}.id where ${d}.level < ${String(condition.depth)}${restricted}) select ${d}.id from ${d}) ${d}`)
 	];
 }
-/** Ids the row's `field` may hold: the reached instances, carried back over each link hop. */
+/**
+* Ids the row's `field` may hold: the reached instances, carried back over each
+* link hop.
+*/
 function targets(build, condition) {
 	let set = reached(build, condition);
 	const hops = condition.hops ?? [];
@@ -219,7 +234,10 @@ function targets(build, condition) {
 	}
 	return set;
 }
-/** The ids the row's field may hold for `condition` to match, as one text column `id`. */
+/**
+* The ids the row's field may hold for `condition` to match, as one text column
+* `id`.
+*/
 function relatedTargetsSql(condition, options) {
 	return targets({
 		options,
@@ -258,15 +276,18 @@ function restrictedRowsSql(above, options) {
 		alias: 0
 	}, above);
 }
-/** Whether the row's restricted column keeps it out of `condition` whatever the graph says. */
+/**
+* Whether the row's restricted column keeps it out of `condition` whatever the
+* graph says.
+*/
 function relatedRowGuard(condition) {
 	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
 	return (condition.parent === true || hopped) && condition.restricted !== void 0 ? condition.restricted : void 0;
 }
 /**
-* `condition` as a boolean over the filtered row that is never NULL: the
-* row's field is among the reached ids, and with `parent` or `hops` the row
-* is not restricted.
+* `condition` as a boolean over the filtered row that is never NULL: the row's
+* field is among the reached ids, and with `parent` or `hops` the row is not
+* restricted.
 */
 function relatedSql(condition, options) {
 	const build = {
@@ -290,9 +311,8 @@ function relatedSql(condition, options) {
 	return out;
 }
 /**
-* Renders parts to one SQL string: `placeholder(n)` names the n-th bound
-* value (from 1), `column` names a row column, and the subject id binds as
-* a value.
+* Renders parts to one SQL string: `placeholder(n)` names the n-th bound value
+* (from 1), `column` names a row column, and the subject id binds as a value.
 */
 function renderGraphSql(parts, render) {
 	let sql = "";
@@ -310,16 +330,37 @@ function renderGraphSql(parts, render) {
 }
 //#endregion
 //#region src/conditions/compile.ts
-/** The membership table mapped for scope `name`, through the `tenant` / `team` shorthands. */
+/** The alias scope `name` answers to by position: `tenant` first, `team` second. */
+function aliasOf(scopes, name) {
+	if (name === scopes[0]?.name) return "tenant";
+	return name === scopes[1]?.name ? "team" : void 0;
+}
+/**
+* The entry of a per-scope record for scope `name`: its own key, else the
+* `tenant` / `team` alias of its position.
+*/
+function byScope(record, scopes, name) {
+	if (record === void 0) return;
+	if (Object.hasOwn(record, name)) return record[name];
+	const alias = aliasOf(scopes, name);
+	return alias !== void 0 && Object.hasOwn(record, alias) ? record[alias] : void 0;
+}
+/**
+* The membership table mapped for scope `name`, through the `tenant` / `team`
+* aliases and shorthands.
+*/
 function scopeMembershipTable(mapping, scopes, name) {
-	const table = mapping?.scopes?.[name];
+	const table = byScope(mapping?.scopes, scopes, name);
 	if (table !== void 0) return table;
 	if (name === scopes[0]?.name) return mapping?.tenant;
 	if (name === scopes[1]?.name) return mapping?.team;
 }
-/** The column of `table` holding scope `name`'s id, through the `tenant` / `team` shorthands. */
+/**
+* The column of `table` holding scope `name`'s id, through the `tenant` /
+* `team` aliases and shorthands.
+*/
 function scopeColumn(table, scopes, name) {
-	const column = table.columns?.[name];
+	const column = byScope(table.columns, scopes, name);
 	if (column !== void 0) return column;
 	if (name === scopes[0]?.name) return table.tenant;
 	if (name === scopes[1]?.name) return table.team;
@@ -361,7 +402,10 @@ function asPortableCondition(input) {
 	if ("condition" in input && !("op" in input)) return input.condition;
 	return input;
 }
-/** A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match literally. */
+/**
+* A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match
+* literally.
+*/
 function escapeLike(value) {
 	return value.replaceAll(/[\\%_]/gu, (char) => `\\${char}`);
 }
@@ -384,10 +428,10 @@ function anyOf(items) {
 	};
 }
 /**
-* Negation normal form. In memory a comparison against a NULL field is
-* false, so its negation is true; SQL's `NOT (NULL)` stays NULL. Every
-* negated comparison therefore also admits the NULL field explicitly, and
-* `not` only ever wraps a comparison or an `exists`.
+* Negation normal form. In memory a comparison against a NULL field is false,
+* so its negation is true; SQL's `NOT (NULL)` stays NULL. Every negated
+* comparison therefore also admits the NULL field explicitly, and `not` only
+* ever wraps a comparison or an `exists`.
 */
 function negate(node) {
 	switch (node.kind) {
@@ -614,4 +658,4 @@ function compileWhere(input, options = {}) {
 	}));
 }
 //#endregion
-export { relatedRowGuard as a, relationArmSql as c, scopeMembershipTable as i, renderGraphSql as l, escapeLike as n, relatedSql as o, scopeColumn as r, relatedTargetsSql as s, compileWhere as t, restrictedRowsSql as u };
+export { scopeMembershipTable as a, relatedTargetsSql as c, restrictedRowsSql as d, scopeColumn as i, relationArmSql as l, compileWhere as n, relatedRowGuard as o, escapeLike as r, relatedSql as s, byScope as t, renderGraphSql as u };

package/dist/{completion-BNdVf7X2.js → completion-_bc0OUQ-.js}

@@ -1,6 +1,6 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
-import { a as suggestion, o as GLOBAL_FLAGS } from "./args-CC3OwyHW.js";
-import { a as resolve } from "./manifest-Dv6q4i5s.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
+import { a as resolve } from "./manifest-B2QPh19C.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [
@@ -11,13 +11,19 @@ const SHELLS = [
 function flagNames(flags) {
 	return Object.entries(flags).filter(([, flag]) => flag.hidden !== true).map(([name]) => `--${name}`);
 }
-/** The flag `token` names when it waits for a separate value, as `--only` does and `--only=x` does not. */
+/**
+* The flag `token` names when it waits for a separate value, as `--only` does
+* and `--only=x` does not.
+*/
 function valueFlag(flags, token) {
 	if (token === void 0 || !token.startsWith("--") || token.includes("=")) return;
 	const flag = flags[token.slice(2)];
 	return flag === void 0 || flag.type === "boolean" ? void 0 : flag;
 }
-/** The positional the next bare word fills, after the words already typed past the leaf's path. */
+/**
+* The positional the next bare word fills, after the words already typed past
+* the leaf's path.
+*/
 function positionalAt(leaf, typed) {
 	let index = 0;
 	for (let i = 0; i < typed.length; i += 1) {
@@ -36,7 +42,10 @@ function positionalAt(leaf, typed) {
 	const last = positionals.at(-1);
 	return positionals[index] ?? (last?.variadic === true ? last : void 0);
 }
-/** Values from `complete`, matched against what follows the last comma when the value is a list. */
+/**
+* Values from `complete`, matched against what follows the last comma when the
+* value is a list.
+*/
 async function valuesFor(complete, partial, list) {
 	const cut = list ? partial.lastIndexOf(",") + 1 : 0;
 	const head = partial.slice(0, cut);
@@ -45,8 +54,8 @@ async function valuesFor(complete, partial, list) {
 	return (await complete()).filter((value) => value.startsWith(tail) && !taken.includes(value)).map((value) => head + value);
 }
 /**
-* Candidates for the last word of `words`, the tokens typed after
-* `permdock`. An empty list leaves the shell to complete file names.
+* Candidates for the last word of `words`, the tokens typed after `permdock`.
+* An empty list leaves the shell to complete file names.
 */
 async function candidates(words) {
 	const partial = words.at(-1) ?? "";