permdock 0.7.0 → 0.9.0

package/dist/{manifest-Dv6q4i5s.js → manifest-B2QPh19C.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-5TXNji88.js")).init
+				load: async () => (await import("./init-txYTuW9u.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-5TXNji88.js")).presetDecode
+				load: async () => (await import("./init-txYTuW9u.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-5TXNji88.js")).presetUrl
+				load: async () => (await import("./init-txYTuW9u.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-g_3BS9NC.js")).install
+					load: async () => (await import("./skills-C9uKfSF5.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-g_3BS9NC.js")).update
+					load: async () => (await import("./skills-C9uKfSF5.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-g_3BS9NC.js")).list
+					load: async () => (await import("./skills-C9uKfSF5.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-BoK_y0KO.js")).doctor
+				load: async () => (await import("./doctor-LPMYjSqO.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-BNdVf7X2.js")).completion
+				load: async () => (await import("./completion-_bc0OUQ-.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,25 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-DNm3oKOk.js")).collect
+				load: async () => (await import("./collect-B80GYEot.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-BaMQfQ6Y.js")).catalog
+				load: async () => (await import("./catalog-amPDr0JQ.js")).catalog
+			}),
+			leaf("gen", "Write typed constants, schemas, factories, hooks and messages from the policy", {
+				examples: [
+					"permdock gen",
+					"permdock gen --kind zod --kind factories",
+					"permdock gen --check"
+				],
+				docs: "gen",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./gen-BFfzZSLH.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -121,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-CDaLXCfL.js")).usage
+				load: async () => (await import("./usage-CBzgwfIs.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-Btr1c1Ow.js")).diff
+				load: async () => (await import("./diff-BwR1JdP2.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -136,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-DGZzMV1B.js")).config
+				load: async () => (await import("./config-D5XrLWpk.js")).config
 			})
 		]
 	},
@@ -153,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-Ck_PocSp.js")).generate
+					load: async () => (await import("./rls-Ba9wN0SP.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ck_PocSp.js")).importPolicies
+					load: async () => (await import("./rls-Ba9wN0SP.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -172,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-Ck_PocSp.js")).verify
+					load: async () => (await import("./rls-Ba9wN0SP.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-Ck_PocSp.js")).migrate
+					load: async () => (await import("./rls-Ba9wN0SP.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ck_PocSp.js")).explain
+					load: async () => (await import("./rls-Ba9wN0SP.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -194,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-Bqp7iIY2.js")).hookGenerate
+				load: async () => (await import("./supabase-SBs3MYUE.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-Bqp7iIY2.js")).inspect
+				load: async () => (await import("./supabase-SBs3MYUE.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-13odBwiM.js")).generate
+				load: async () => (await import("./powersync-Bg8u-JcR.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-13odBwiM.js")).verify
+				load: async () => (await import("./powersync-Bg8u-JcR.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -224,7 +235,7 @@ const SECTIONS = [
 				docs: "scim",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./scim-C7JYhySg.js")).generate
+				load: async () => (await import("./scim-D8YupzX1.js")).generate
 			})])
 		]
 	},
@@ -236,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-DMocl1bh.js")).emit
+				load: async () => (await import("./openapi-BIpw3Mb7.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-DMocl1bh.js")).importDocument
+				load: async () => (await import("./openapi-BIpw3Mb7.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -250,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-ClrF3PVb.js")).check
+				load: async () => (await import("./arazzo-BpS7LnV0.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -258,21 +269,21 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-DSljDE1Y.js")).scan
+				load: async () => (await import("./scan-CRTj6fke.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
 				docs: "casl",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casl-CmJlgziS.js")).caslImport
+				load: async () => (await import("./casl-C4OINZHI.js")).caslImport
 			})]),
 			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
 				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-BHijLuHY.js")).casbinImport
+				load: async () => (await import("./casbin-B7_yS-oo.js")).casbinImport
 			})])
 		]
 	},
@@ -284,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-ClSJh5t5.js")).login
+				load: async () => (await import("./login-CfImTJGb.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-ClSJh5t5.js")).logout
+				load: async () => (await import("./login-CfImTJGb.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-ClSJh5t5.js")).whoami
+				load: async () => (await import("./login-CfImTJGb.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-CO8pYtwr.js")).push
+				load: async () => (await import("./cloud-3kWfjnYy.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-CO8pYtwr.js")).pull
+				load: async () => (await import("./cloud-3kWfjnYy.js")).pull
 			})])
 		]
 	},
@@ -322,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-i4N2BhDc.js")).codemod
+			load: async () => (await import("./codemod-D9Aiii1r.js")).codemod
 		})]
 	}
 ];
@@ -334,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-BNdVf7X2.js")).complete
+	load: async () => (await import("./completion-_bc0OUQ-.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */
@@ -345,8 +356,8 @@ function leaves(entry = ROOT, path = []) {
 	}] : leaves(child, [...path, child.name]));
 }
 /**
-* Walks positional tokens down the tree until a leaf. Flags may sit
-* anywhere; only bare words name a child.
+* Walks positional tokens down the tree until a leaf. Flags may sit anywhere;
+* only bare words name a child.
 */
 function resolve(argv) {
 	let node = ROOT;

package/dist/{manifest-BVhExYhw.d.ts → manifest-CzzWtnAb.d.ts}

@@ -2,9 +2,9 @@
 /**
  * What `permdock supabase inspect --json` prints and `--out` writes to
  * `permdock.manifest.json`: the contract between the generated hook and SQL
- * helpers and a package that writes policies or claims next to them.
- * `version` is the major of this shape; a field is only
- * ever added within it. `schemas/supabase-manifest-v1.json` is its JSON Schema.
+ * helpers and a package that writes policies or claims next to them. `version`
+ * is the major of this shape; a field is only ever added within it.
+ * `schemas/supabase-manifest-v1.json` is its JSON Schema.
  */
 type SupabaseHookManifest = {
   readonly $schema: "https://permdock.com/schemas/supabase-manifest-v1.json";
@@ -41,14 +41,18 @@ type SupabaseHookManifest = {
   /**
    * With `authzVersion`, the function that bumps the listed users' `authz_ver`,
    * for a membership source outside the hook. It is `security definer` and no
-   * client role may execute it: call it from a trigger owned by the table's owner.
+   * client role may execute it: call it from a trigger owned by the table's
+   * owner.
    */
   readonly authzVersionBump?: {
     readonly schema: string;
     readonly function: "permdock_bump_authz_version_for";
     readonly args: "p_users uuid[]";
   };
-  /** The Management API fields that make a hosted project call the hook; `permdock supabase inspect` adds them. */
+  /**
+   * The Management API fields that make a hosted project call the hook;
+   * `permdock supabase inspect` adds them.
+   */
   readonly managementApi?: {
     readonly hook_custom_access_token_enabled: true;
     readonly hook_custom_access_token_uri: string;
@@ -73,6 +77,51 @@ type SupabaseHookManifest = {
    * SDK that lacks one cannot serve this policy.
    */
   readonly requires?: SupabaseManifestRequires;
+  /**
+   * The SQL names the generated RLS exposes, as `resolveNames` gives them.
+   * Absent from a manifest written before 0.8.
+   */
+  readonly names?: SupabaseManifestNames;
+};
+/** The SQL helpers named after one scope, unqualified. */
+type SupabaseManifestScopeNames = {
+  readonly permittedIds: string;
+  readonly permittedIdsFor: string;
+  readonly memberIds: string;
+  readonly memberIdsFor: string;
+  /**
+   * Only on the team scope (`team` or `teams`), for better-supabase's
+   * `teamIdsOf`.
+   */
+  readonly memberIdsOf?: string;
+  readonly permittedUsers: string;
+};
+/** The SQL objects named after one resource, unqualified. */
+type SupabaseManifestResourceNames = {
+  /** The table `rls.tables` maps, as written there. */
+  readonly table?: string;
+  /** Graph resources only: `permitted_<resource>_ids` and its restriction check. */
+  readonly permittedIds?: string;
+  readonly restricted?: string;
+  /** With `rls.rowHelpers` naming the resource. */
+  readonly rows?: string;
+  readonly row?: string;
+  /** With `rls.fields` and a mapped table. */
+  readonly visible?: string;
+  readonly visibleFields?: string;
+  readonly mask?: string;
+};
+type SupabaseManifestNames = {
+  readonly schema: string;
+  readonly gucPrefix: string;
+  readonly claims: {
+    readonly tenant: string;
+    readonly role: string;
+  };
+  /** The scope better-supabase reads as its teams, when one is declared. */
+  readonly teamScope?: string;
+  readonly scopes: Readonly<Record<string, SupabaseManifestScopeNames>>;
+  readonly resources: Readonly<Record<string, SupabaseManifestResourceNames>>;
 };
 type SupabaseManifestRequires = {
   /** The capability-matrix release tag, `capability-matrix-v1.<minor>.<patch>`. */
@@ -94,33 +143,54 @@ type SupabaseManifestColumn = {
 type SupabaseManifestValue = SupabaseManifestColumn | {
   readonly value: string | readonly string[];
 };
-/** A column that references another table: the value (role key or user id) is `column` of `table`, matched on `id`. */
+/**
+ * A column that references another table: the value (role key or user id) is
+ * `column` of `table`, matched on `id`.
+ */
 type SupabaseManifestThrough = {
   readonly table: string;
   readonly id: string;
   readonly column: string;
 };
-/** A role column (with `through` when it references a roles table), or the fixed roles every row holds. */
+/**
+ * A role column (with `through` when it references a roles table), or the fixed
+ * roles every row holds.
+ */
 type SupabaseManifestRole = SupabaseManifestValue | (SupabaseManifestColumn & {
   readonly through: SupabaseManifestThrough;
 }) | (SupabaseManifestColumn & {
-  /** Each column value to the role key it stands for, or `null` for no role; an unlisted value is no role. */
+  /**
+   * Each column value to the role key it stands for, or `null` for no role;
+   * an unlisted value is no role.
+   */
   readonly map: Readonly<Record<string, string | null>>;
 });
 /** One `tableMembershipSource` or `junctionMembershipSource` source. */
 type SupabaseManifestMembership = {
   /** `schema.table`, `public` when the source names no schema. */
   readonly table: string;
-  /** The user id column, with `through` when it references the table that holds the user id. */
+  /**
+   * The user id column, with `through` when it references the table that holds
+   * the user id.
+   */
   readonly user: SupabaseManifestColumn | (SupabaseManifestColumn & {
     readonly through: SupabaseManifestThrough;
   });
-  /** A column for `tableMembershipSource`, the fixed scope for `junctionMembershipSource`. */
+  /**
+   * A column for `tableMembershipSource`, the fixed scope for
+   * `junctionMembershipSource`.
+   */
   readonly scope: SupabaseManifestValue;
   readonly id: SupabaseManifestColumn;
-  /** A role column, the fixed roles every row holds, or several role columns whose keys the row holds together. */
+  /**
+   * A role column, the fixed roles every row holds, or several role columns
+   * whose keys the row holds together.
+   */
   readonly role: SupabaseManifestRole | readonly SupabaseManifestRole[];
-  /** A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor scope. */
+  /**
+   * A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor
+   * scope.
+   */
   readonly within?: SupabaseManifestColumn | {
     readonly columns: Readonly<Record<string, string>>;
   };
@@ -135,10 +205,16 @@ type SupabaseManifestHelper = {
   /** The argument list, `p_grant text`, or `''` for none. */
   readonly args: string;
   readonly returns: string;
-  /** The roles granted `execute`; a field view `anon` reads adds `anon` to the `authenticated` ones. */
+  /**
+   * The roles granted `execute`; a field view `anon` reads adds `anon` to the
+   * `authenticated` ones.
+   */
   readonly execute: readonly string[];
 };
-/** A table whose row says whether a user or a scope instance is active (`rls.suspension`); a missing row counts as suspended. */
+/**
+ * A table whose row says whether a user or a scope instance is active
+ * (`rls.suspension`); a missing row counts as suspended.
+ */
 type SupabaseManifestActiveRow = {
   /** `schema.table`. */
   readonly table: string;
@@ -149,12 +225,18 @@ type SupabaseManifestActiveRow = {
   /** A status column; only a row whose value is in `active` is active. */
   readonly status?: string;
   readonly active?: readonly string[];
-  /** A scope only: the permission keys members of a suspended instance still hold. */
+  /**
+   * A scope only: the permission keys members of a suspended instance still
+   * hold.
+   */
   readonly keep?: readonly string[];
 };
 type SupabaseManifestRls = {
   readonly schema: string;
-  /** Where the helpers read roles and memberships: the claims (`jwt`) or the tables (`database`). */
+  /**
+   * Where the helpers read roles and memberships: the claims (`jwt`) or the
+   * tables (`database`).
+   */
   readonly mode: "jwt" | "database";
   readonly tenantClaim: string;
   /** The declared scopes, root first, with the Postgres type of their ids. */
@@ -164,13 +246,14 @@ type SupabaseManifestRls = {
     readonly within?: string;
   }[];
   /**
-   * Every function `rls generate` writes for policies and trusted SQL to
-   * call: `permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids` and
-   * `permdock_user_id`, the caller's user id; in `database` mode `permdock_has_for`, `permitted_<scope>_ids_for` and
+   * Every function `rls generate` writes for policies and trusted SQL to call:
+   * `permdock_has`, `permitted_<scope>_ids`, `member_<scope>_ids` and
+   * `permdock_user_id`, the caller's user id; in `database` mode
+   * `permdock_has_for`, `permitted_<scope>_ids_for` and
    * `member_<scope>_ids_for`; and when a role declares `assigns`,
    * `permdock_can_assign`, `permdock_can_assign_any` and, with custom roles,
-   * `permdock_can_assign_custom_role`, each with its `_for` form where one
-   * is written. A helper whose `execute` is empty is for trusted SQL only.
+   * `permdock_can_assign_custom_role`, each with its `_for` form where one is
+   * written. A helper whose `execute` is empty is for trusted SQL only.
    */
   readonly helpers: readonly SupabaseManifestHelper[];
   /**
@@ -179,7 +262,10 @@ type SupabaseManifestRls = {
    * `memberships`.
    */
   readonly memberships: readonly SupabaseManifestMembership[];
-  /** Whether custom roles live in the helpers' tables (`rls.customRoles` in `database` mode). */
+  /**
+   * Whether custom roles live in the helpers' tables (`rls.customRoles` in
+   * `database` mode).
+   */
   readonly customRoles?: boolean;
   /** The global-roles table the hook and the `database` mode helpers read. */
   readonly roles?: {
@@ -187,7 +273,10 @@ type SupabaseManifestRls = {
     readonly user: SupabaseManifestColumn;
     readonly role: SupabaseManifestRole | readonly SupabaseManifestRole[];
   };
-  /** `rls.suspension`: a suspended user, or a suspended scope instance, holds nothing but its scope's `keep`. */
+  /**
+   * `rls.suspension`: a suspended user, or a suspended scope instance, holds
+   * nothing but its scope's `keep`.
+   */
   readonly suspension?: {
     readonly users?: SupabaseManifestActiveRow;
     readonly scopes?: Readonly<Record<string, SupabaseManifestActiveRow>>;
@@ -196,14 +285,17 @@ type SupabaseManifestRls = {
     };
   };
   /**
-   * `rls.assignments`: the tables whose client writes the assignment
-   * triggers check against `permdock_can_assign_any`, so SQL writing rows
-   * there needs no role-ceiling check of its own.
+   * `rls.assignments`: the tables whose client writes the assignment triggers
+   * check against `permdock_can_assign_any`, so SQL writing rows there needs no
+   * role-ceiling check of its own.
    */
   readonly assignments?: {
     readonly tables: readonly string[];
   };
-  /** `rls.tokenScopes`: the helpers narrow a delegated token by its `scope` claim through `permdock_token_scope_allows`. */
+  /**
+   * `rls.tokenScopes`: the helpers narrow a delegated token by its `scope`
+   * claim through `permdock_token_scope_allows`.
+   */
   readonly tokenScopes?: boolean;
   readonly apiKeys?: {
     readonly claim: string;
@@ -219,16 +311,19 @@ type SupabaseManifestRls = {
  * `authzVersion` or hook `memberships`.
  */
 type SupabaseDatabaseManifest = Omit<SupabaseHookManifest, "authzVersion" | "authzVersionBump" | "budget" | "claims" | "hook" | "managementApi" | "memberships">;
-/** What `parseSupabaseManifest` returns: a manifest with or without the token hook. */
+/**
+ * What `parseSupabaseManifest` returns: a manifest with or without the token
+ * hook.
+ */
 type SupabaseManifest = SupabaseDatabaseManifest | SupabaseHookManifest;
 /** Whether the manifest describes a token hook. */
 declare function hasTokenHook(manifest: SupabaseManifest): manifest is SupabaseHookManifest;
 /**
  * Reads a `permdock.manifest.json` document (parsed, or the JSON text) and
  * validates it against `schemas/supabase-manifest-v1.json`. Returns a
- * deep-frozen copy built from own keys; throws `PermDockValidationError`
- * with every issue, so a manifest of another major is refused.
+ * deep-frozen copy built from own keys; throws `PermDockValidationError` with
+ * every issue, so a manifest of another major is refused.
  */
 declare function parseSupabaseManifest(json: unknown): SupabaseManifest;
 //#endregion
-export { SupabaseManifestActiveRow as a, SupabaseManifestMembership as c, SupabaseManifestRole as d, SupabaseManifestThrough as f, parseSupabaseManifest as h, SupabaseManifest as i, SupabaseManifestRequires as l, hasTokenHook as m, SupabaseHookClaim as n, SupabaseManifestColumn as o, SupabaseManifestValue as p, SupabaseHookManifest as r, SupabaseManifestHelper as s, SupabaseDatabaseManifest as t, SupabaseManifestRls as u };
+export { hasTokenHook as _, SupabaseManifestActiveRow as a, SupabaseManifestMembership as c, SupabaseManifestResourceNames as d, SupabaseManifestRls as f, SupabaseManifestValue as g, SupabaseManifestThrough as h, SupabaseManifest as i, SupabaseManifestNames as l, SupabaseManifestScopeNames as m, SupabaseHookClaim as n, SupabaseManifestColumn as o, SupabaseManifestRole as p, SupabaseHookManifest as r, SupabaseManifestHelper as s, SupabaseDatabaseManifest as t, SupabaseManifestRequires as u, parseSupabaseManifest as v };

package/dist/{manifest-schema-Cv492Qev.js → manifest-schema-2r37XRhD.js}

@@ -1,6 +1,9 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 //#region src/supabase/manifest-schema.ts
-/** `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks against; a test keeps the two equal. */
+/**
+* `schemas/supabase-manifest-v1.json`, which `parseSupabaseManifest` checks
+* against; a test keeps the two equal.
+*/
 const supabaseManifestSchema = freezeDeep({
 	$schema: "https://json-schema.org/draft/2020-12/schema",
 	$id: "https://permdock.com/schemas/supabase-manifest-v1.json",
@@ -274,6 +277,44 @@ const supabaseManifestSchema = freezeDeep({
 				grants: { const: "v1" }
 			}
 		},
+		names: {
+			description: "The SQL names the generated RLS exposes to application SQL, unqualified, in `schema`: per scope and per resource, as `resolveNames` gives them. Absent from a manifest written before 0.8.",
+			type: "object",
+			required: [
+				"schema",
+				"gucPrefix",
+				"claims",
+				"scopes",
+				"resources"
+			],
+			properties: {
+				schema: { type: "string" },
+				gucPrefix: { type: "string" },
+				claims: {
+					type: "object",
+					required: ["tenant", "role"],
+					properties: {
+						tenant: { type: "string" },
+						role: { type: "string" }
+					}
+				},
+				teamScope: { type: "string" },
+				scopes: {
+					type: "object",
+					additionalProperties: {
+						type: "object",
+						additionalProperties: { type: "string" }
+					}
+				},
+				resources: {
+					type: "object",
+					additionalProperties: {
+						type: "object",
+						additionalProperties: { type: "string" }
+					}
+				}
+			}
+		},
 		requires: {
 			description: "The supabase/sdk capability-matrix feature ids the hook, the helpers and subjectFromSupabase depend on, as of the matrix release tag.",
 			type: "object",
@@ -363,7 +404,7 @@ const supabaseManifestSchema = freezeDeep({
 		},
 		helperName: {
 			type: "string",
-			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
+			pattern: "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for|_of)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
 		},
 		column: {
 			type: "object",