permdock 0.7.0 → 0.9.0

package/dist/resend/index.d.ts

@@ -1,20 +1,23 @@
-import { q as DecisionSink } from "../policy-types-B-F-qAZk.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-g7Oy6Zg4.js";
-import { l as ReplayStore } from "../types-cTos-H7p.js";
+import { J as DecisionSink } from "../policy-types-DGIO_gxq.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CN0LsqbK.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
-  /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */
+  /**
+   * The app's approval page: a base the request id is appended to, or a
+   * function of the prompt. Must be https.
+   */
   readonly approvalUrl: ApprovalUrl;
   /** The product name in the footer line. */
   readonly product?: string;
 };
 /**
- * The default approval prompt email: an `approval`-category message whose
- * one link opens the app's approval page for the request. It carries no
- * approve or reject link; the signed-in approver decides on that page.
- * Throws a `TypeError` for an approval page that is not https. Replace it
- * with a React Email template by building the same `EmailMessage`.
+ * The default approval prompt email: an `approval`-category message whose one
+ * link opens the app's approval page for the request. It carries no approve or
+ * reject link; the signed-in approver decides on that page. Throws a
+ * `TypeError` for an approval page that is not https. Replace it with a React
+ * Email template by building the same `EmailMessage`.
  */
 export declare function approvalEmail(prompt: ApprovalPrompt, options: ApprovalEmailOptions): EmailMessage;
 //#endregion
@@ -48,16 +51,16 @@ type ResendResult<T> = {
 /** The part of a `Resend` client the transport calls; a `new Resend(key)` fits. */
 type ResendClient = {
   readonly emails: {
-    send(payload: ResendEmailPayload, options?: {
+    send: (payload: ResendEmailPayload, options?: {
       readonly idempotencyKey?: string;
-    }): Promise<ResendResult<{
+    }) => Promise<ResendResult<{
       readonly id: string;
     }>>;
   };
   readonly batch?: {
-    send(payloads: ResendEmailPayload[], options?: {
+    send: (payloads: ResendEmailPayload[], options?: {
       readonly idempotencyKey?: string;
-    }): Promise<ResendResult<{
+    }) => Promise<ResendResult<{
       readonly data: readonly {
         readonly id: string;
       }[];
@@ -69,22 +72,25 @@ type ResendTransportOptions = {
   readonly from?: string;
   /** The `replyTo` of an email whose message sets none. */
   readonly replyTo?: string;
-  /** Tags added to every email; names and values are ASCII letters, digits, `_` and `-`. */
+  /**
+   * Tags added to every email; names and values are ASCII letters, digits, `_`
+   * and `-`.
+   */
   readonly tags?: Readonly<Record<string, string>>;
 };
 /**
- * The failure a Resend error name means. Rate limits, quotas and server
- * errors are retryable with the same idempotency key; a key, sender or
- * validation error is final. An unknown name is retryable only for a 5xx or
- * a missing status.
+ * The failure a Resend error name means. Rate limits, quotas and server errors
+ * are retryable with the same idempotency key; a key, sender or validation
+ * error is final. An unknown name is retryable only for a 5xx or a missing
+ * status.
  */
 export declare function resendFailure(error: ResendError): DeliveryResult;
 /**
  * Sends the email channel of `permdock/delivery` through Resend. The
  * idempotency key is Resend's `idempotencyKey`. The delivery id, key and
- * category travel as tags, so `resendWebhook` can join provider events to
- * the delivery. Two or more recipients go out through `batch.send`, up to
- * 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+ * category travel as tags, so `resendWebhook` can join provider events to the
+ * delivery. Two or more recipients go out through `batch.send`, up to 100 per
+ * call. Throws a `TypeError` for a tag outside Resend's charset.
  */
 export declare function resendTransport(resend: ResendClient, options?: ResendTransportOptions): EmailTransport;
 //#endregion
@@ -92,7 +98,7 @@ export declare function resendTransport(resend: ResendClient, options?: ResendTr
 /** The part of a `Resend` client the webhook calls; a `new Resend(key)` fits. */
 type ResendWebhookClient = {
   readonly webhooks: {
-    verify(input: {
+    verify: (input: {
       readonly payload: string;
       readonly headers: {
         readonly id: string;
@@ -100,7 +106,7 @@ type ResendWebhookClient = {
         readonly signature: string;
       };
       readonly webhookSecret: string;
-    }): unknown;
+    }) => unknown;
   };
 };
 type ResendWebhookOptions = {
@@ -116,10 +122,10 @@ type ResendWebhookOptions = {
 /**
  * A fetch handler for Resend webhooks. It verifies the Standard Webhooks
  * signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
- * header names both work), claims the message id, and writes one delivery
- * event for `email.delivered`, `email.bounced`, `email.complained`,
- * `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
- * failure releases the claim and answers `503`, so Resend retries.
+ * header names both work), claims the message id, and writes one delivery event
+ * for `email.delivered`, `email.bounced`, `email.complained`, `email.failed`
+ * and `email.suppressed`. A bad signature is a `401`; a sink failure releases
+ * the claim and answers `503`, so Resend retries.
  */
 export declare function resendWebhook(options: ResendWebhookOptions): (request: Request) => Promise<Response>;
 //#endregion

package/dist/resend/index.js

@@ -1,14 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { a as ownRecord } from "../paths-DXSHAMIa.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { l as isRfc3339, p as nowSeconds } from "../time-DkWjdL98.js";
-import { n as sha256, t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
-import { t as deliveryEvent } from "../delivery-event-xX4obB8F.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { a as methodNotAllowed, c as problemResponse } from "../problem-CTviyH5L.js";
-import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
-import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { a as ownRecord } from "../paths-CUvURzHp.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { l as isRfc3339, p as nowSeconds } from "../time-nR1JesoH.js";
+import { n as sha256, t as bytesToBase64Url } from "../sha256-C-4WXKIu.js";
+import { t as deliveryEvent } from "../delivery-event-JioK5YbS.js";
+import { n as readBodyText } from "../body-text-DQhcmqdY.js";
+import { l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
+import { t as bodyTooLarge } from "../body-CJQwYVa8.js";
+import { n as approvalUrlFor } from "../approval-prompt-B8hQY69x.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 //#region src/resend/approval-email.ts
 const HTML_ESCAPES = {
 	"&": "&",
@@ -29,11 +29,11 @@ function requesterLine(prompt) {
 	return actor === void 0 ? `Requested by ${principal}` : `Requested by ${principal} through ${actor.kind} ${actor.id}`;
 }
 /**
-* The default approval prompt email: an `approval`-category message whose
-* one link opens the app's approval page for the request. It carries no
-* approve or reject link; the signed-in approver decides on that page.
-* Throws a `TypeError` for an approval page that is not https. Replace it
-* with a React Email template by building the same `EmailMessage`.
+* The default approval prompt email: an `approval`-category message whose one
+* link opens the app's approval page for the request. It carries no approve or
+* reject link; the signed-in approver decides on that page. Throws a
+* `TypeError` for an approval page that is not https. Replace it with a React
+* Email template by building the same `EmailMessage`.
 */
 function approvalEmail(prompt, options) {
 	const url = approvalUrlFor(prompt, options.approvalUrl);
@@ -95,10 +95,10 @@ const FINAL = {
 	validation_error: "rejected"
 };
 /**
-* The failure a Resend error name means. Rate limits, quotas and server
-* errors are retryable with the same idempotency key; a key, sender or
-* validation error is final. An unknown name is retryable only for a 5xx or
-* a missing status.
+* The failure a Resend error name means. Rate limits, quotas and server errors
+* are retryable with the same idempotency key; a key, sender or validation
+* error is final. An unknown name is retryable only for a 5xx or a missing
+* status.
 */
 function resendFailure(error) {
 	const name = error.name;
@@ -183,9 +183,9 @@ async function sendBatch(resend, items, payloadOf) {
 /**
 * Sends the email channel of `permdock/delivery` through Resend. The
 * idempotency key is Resend's `idempotencyKey`. The delivery id, key and
-* category travel as tags, so `resendWebhook` can join provider events to
-* the delivery. Two or more recipients go out through `batch.send`, up to
-* 100 per call. Throws a `TypeError` for a tag outside Resend's charset.
+* category travel as tags, so `resendWebhook` can join provider events to the
+* delivery. Two or more recipients go out through `batch.send`, up to 100 per
+* call. Throws a `TypeError` for a tag outside Resend's charset.
 */
 function resendTransport(resend, options = {}) {
 	const tags = checkTags(options.tags ?? {});
@@ -285,9 +285,9 @@ function outcomeOf(type, data) {
 	}
 }
 /**
-* The delivery event a verified Resend payload stands for, or `null` for
-* one that is not about a PermDock delivery: opens and clicks (tracking,
-* not delivery), sends, contact and domain events, and mail without the
+* The delivery event a verified Resend payload stands for, or `null` for one
+* that is not about a PermDock delivery: opens and clicks (tracking, not
+* delivery), sends, contact and domain events, and mail without the
 * `permdock_delivery` and `permdock_key` tags.
 */
 function eventOf(payload, source) {
@@ -333,10 +333,10 @@ async function claim(replay, key) {
 /**
 * A fetch handler for Resend webhooks. It verifies the Standard Webhooks
 * signature through `resend.webhooks.verify` (the `svix-*` and `webhook-*`
-* header names both work), claims the message id, and writes one delivery
-* event for `email.delivered`, `email.bounced`, `email.complained`,
-* `email.failed` and `email.suppressed`. A bad signature is a `401`; a sink
-* failure releases the claim and answers `503`, so Resend retries.
+* header names both work), claims the message id, and writes one delivery event
+* for `email.delivered`, `email.bounced`, `email.complained`, `email.failed`
+* and `email.suppressed`. A bad signature is a `401`; a sink failure releases
+* the claim and answers `503`, so Resend retries.
 */
 function resendWebhook(options) {
 	const source = options.source ?? "permdock";

package/dist/resolve-names-ConCSj1y.js

@@ -0,0 +1,201 @@
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import "./budget-BELja5A9.js";
+import "./sources-CMAM-2A3.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-Afctg7B0.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BqrxBCir.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+//#region src/cli/rls/permission-holders.ts
+/**
+* `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL
+* contract.
+*/
+function permittedUsersHelper(scope) {
+	return checkName(`permitted_${scope}_users`);
+}
+/**
+* The users with a membership row on the instance `p_id`, or `undefined` when
+* the scope's memberships are not all in tables.
+*/
+function candidatesSql(ctx, scope, user) {
+	const mapped = scopeTable(ctx, scope);
+	if (mapped !== void 0) return {
+		sql: `    select m.${quoteIdent(mapped.table.user)}::${user}
+    from ${quoteQualified(mapped.table.table)} m
+    where m.${quoteIdent(mapped.column)} = p_id`,
+		keys: []
+	};
+	const sources = holderSources(ctx, scope);
+	if (sources === void 0 || sources === "not-tables") return;
+	return {
+		sql: sources.map((source, index) => `    select h.user_id::${user}
+    from (
+${source.holders.rows(scope, { id: `v_key_${String(index)}` }).replaceAll(/^/gmu, "      ")}
+    ) h`).join("\n    union\n"),
+		keys: sources.map((source, index) => `v_key_${String(index)} ${source.holders.idType}`)
+	};
+}
+/**
+* `language sql`, or PL/pgSQL when a source's id column needs `p_id` in a
+* `%type` variable.
+*/
+function functionBody(keys, query) {
+	if (keys.length === 0) return `language sql
+stable
+security definer
+set search_path = ''
+as $$
+${query}
+$$;`;
+	return `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${keys.map((key) => `  ${key} := p_id;`).join("\n")}
+begin
+  return query
+${query.replaceAll(/^/gmu, "  ")};
+end
+$$;`;
+}
+/**
+* One `permitted_<scope>_users(p_permission, p_id)` per scope in `database`
+* mode: the users who hold a permission key on one instance, read from the
+* scope's membership rows and the global-roles table and kept when
+* `permitted_<scope>_ids_by_permission_for` lists the instance or
+* `permdock_has_permission_for` answers, so denies, custom roles, expiry and
+* suspension apply as for the user. It names other users, so no client role may
+* execute it, and a backend role needs its own grant.
+*/
+function permissionHoldersSql(ctx) {
+	if (ctx.authorize !== "database") return "";
+	const user = ctx.dialect === "supabase" ? "uuid" : "text";
+	const global = globalRoleRows(ctx);
+	const hasFor = qualified(ctx, PERMISSION_HELPERS.hasFor);
+	return `${ctx.scopes.map(({ name }) => {
+		const candidates = hasPermittedUsers(ctx, name) ? candidatesSql(ctx, name, user) : void 0;
+		if (candidates === void 0) return `-- ${name}: no memberships table or table source, so permitted_${name}_users is not written`;
+		const fn = qualified(ctx, permittedUsersHelper(name));
+		const ids = qualified(ctx, checkName(`${permittedByPermissionHelper(name)}_for`));
+		const type = scopeTypeOf(ctx, name);
+		return `-- the users who hold a permission on one ${name}: its members and the global-role holders for whom the _for helpers answer; no client role may execute it
+create or replace function ${fn}(p_permission text, p_id ${type})
+returns setof ${user}
+${functionBody(candidates.keys, `  select c.user_id
+  from (
+${candidates.sql}
+    union
+    select ${global.userSql}::${user}
+    from ${global.from}
+  ) c(user_id)
+  where c.user_id is not null
+    and (
+      p_id in (select ${ids}(c.user_id, p_permission))
+      or ${hasFor}(c.user_id, p_permission)
+    )
+  order by 1`)}
+revoke execute on function ${fn}(text, ${type}) from public, anon, authenticated;`;
+	}).join("\n\n")}\n`;
+}
+//#endregion
+//#region src/cli/sql/resolve-names.ts
+/** Postgres truncates a longer identifier, so two helpers could share one name. */
+const MAX_IDENTIFIER_BYTES = 63;
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/u;
+function scopeNames(name) {
+	return {
+		permittedIds: permittedIdsHelper(name),
+		permittedIdsFor: permittedForHelper(name),
+		memberIds: memberIdsHelper(name),
+		memberIdsFor: memberForHelper(name),
+		...isTeamScope(name) ? { memberIdsOf: memberOfHelper(name) } : {},
+		permittedUsers: permittedUsersHelper(name)
+	};
+}
+function rowHelperSet(setting, resources) {
+	if (setting === void 0) return /* @__PURE__ */ new Set();
+	return new Set(setting === true ? resources : setting);
+}
+function baseName(table) {
+	return table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
+}
+function resourceNames(resource, input) {
+	const sql = graphSqlName(resource);
+	const { table } = input;
+	return {
+		...table === void 0 ? {} : { table },
+		...input.graph && sql !== void 0 ? {
+			permittedIds: graphHelper(resource),
+			restricted: restrictedHelper(resource)
+		} : {},
+		...input.rows && sql !== void 0 ? {
+			rows: inheritedRowsHelper(resource),
+			row: `permitted_${sql}_row`
+		} : {},
+		...input.fields && table !== void 0 ? {
+			visible: `${table}${FIELD_VIEWS.view}`,
+			visibleFields: `${baseName(table)}${FIELD_VIEWS.companion}`,
+			mask: `${baseName(table)}${FIELD_VIEWS.mask}`
+		} : {}
+	};
+}
+/**
+* Rejects a helper that is not a lowercase SQL identifier or is longer than
+* Postgres keeps, and two sources that resolve to the same helper.
+*/
+function checkNames(names) {
+	const owners = /* @__PURE__ */ new Map();
+	const claim = (name, owner) => {
+		if (!IDENTIFIER.test(name)) throw configError(`PermDock CLI: ${owner} names the SQL helper '${name}', which is not a lowercase SQL identifier`);
+		if (new TextEncoder().encode(name).length > MAX_IDENTIFIER_BYTES) throw configError(`PermDock CLI: ${owner} names the SQL helper '${name}', longer than the ${String(MAX_IDENTIFIER_BYTES)} bytes Postgres keeps; shorten the name`);
+		const other = owners.get(name);
+		if (other !== void 0 && other !== owner) throw configError(`PermDock CLI: ${other} and ${owner} both name the SQL helper '${name}'; rename one of them`);
+		owners.set(name, owner);
+	};
+	for (const [scope, helpers] of Object.entries(names.scopes)) for (const name of Object.values(helpers)) claim(name, `scope '${scope}'`);
+	for (const [resource, helpers] of Object.entries(names.resources)) {
+		const { table: _table, visible: _visible, ...functions } = helpers;
+		for (const name of Object.values(functions)) claim(name, `resource '${resource}'`);
+	}
+}
+/**
+* The SQL names `policy` and `config` give the generated RLS, frozen. Throws
+* `config_invalid` for a helper name Postgres cannot hold or two sources
+* sharing one.
+*/
+function resolveNames(policy, config, options = {}) {
+	const rls = config.rls;
+	const scopes = scopeList(policy.scopes);
+	const resources = [.../* @__PURE__ */ new Set([...listPermissions(policy.vocabulary.permissions).map((leaf) => leaf.resource), ...policy.resources.keys()])];
+	const graph = graphPlan(policy);
+	const tables = tableNames(rls?.tables) ?? {};
+	const rows = rowHelperSet(rls?.rowHelpers, resources);
+	const team = scopes.find((scope) => isTeamScope(scope.name));
+	const names = {
+		schema: options.schema ?? rls?.schema ?? rls?.rbac?.schema ?? "permdock",
+		gucPrefix: options.gucPrefix ?? rls?.gucPrefix ?? "app",
+		claims: {
+			tenant: options.tenantClaim ?? rls?.tenantClaim ?? "tenant_id",
+			role: rls?.roleClaim ?? "user_role"
+		},
+		...team === void 0 ? {} : { teamScope: team.name },
+		scopes: Object.fromEntries(scopes.map((scope) => [scope.name, scopeNames(scope.name)])),
+		resources: Object.fromEntries(resources.flatMap((resource) => {
+			const entry = resourceNames(resource, {
+				table: tables[resource],
+				graph: graph.has(resource),
+				rows: rows.has(resource),
+				fields: rls?.fields !== void 0
+			});
+			return Object.keys(entry).length === 0 ? [] : [[resource, entry]];
+		}))
+	};
+	checkNames(names);
+	return freezeDeep(names);
+}
+//#endregion
+export { permissionHoldersSql as n, permittedUsersHelper as r, resolveNames as t };

package/dist/{resource-relations-D_jw0BFx.js → resource-relations-8-pCScBO.js}

@@ -1,4 +1,4 @@
-import { t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { t as assertSafeKey } from "./paths-CUvURzHp.js";
 //#region src/core/resource-relations.ts
 /** The edge's group resources with their relation and id column. */
 function groupEntries(spec) {
@@ -35,8 +35,8 @@ function isComputedRelation(relation) {
 	return relation !== void 0 && !("field" in relation) && !("edge" in relation) && !("principal" in relation);
 }
 /**
-* The relations whose holders hold `name` on `node`: `name` itself when it
-* has a source, then everything it includes, transitively, each once.
+* The relations whose holders hold `name` on `node`: `name` itself when it has
+* a source, then everything it includes, transitively, each once.
 * `definePermissions` rejects cycles and unknown names, so this terminates.
 */
 function expandRelation(node, name) {
@@ -53,12 +53,18 @@ function expandRelation(node, name) {
 	visit(name);
 	return out;
 }
-/** Whether `node` names itself as its parent (nested folders, sub-teams, reporting lines). */
+/**
+* Whether `node` names itself as its parent (nested folders, sub-teams,
+* reporting lines).
+*/
 function isSelfParented(node) {
 	return node?.parent !== void 0 && node.parent.resource === node.name;
 }
 const RESOURCE_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/u;
-/** Level names ride claims and grant keys (`key@level`), so they stay SQL- and claim-safe. */
+/**
+* Level names ride claims and grant keys (`key@level`), so they stay SQL- and
+* claim-safe.
+*/
 const LEVEL_NAME = /^[a-z][a-z0-9_]*$/u;
 const EDGE_TABLE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/u;
 function restrictedStopsOf(name, option, parent, links) {
@@ -143,7 +149,7 @@ function normaliseMatch(label, match) {
 	for (const column of columns) {
 		assertSafeKey(column, "edge match column");
 		const value = match[column];
-		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new Error(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
+		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new TypeError(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
 		out[column] = value;
 	}
 	return out;
@@ -183,7 +189,10 @@ function normaliseGroups(label, groups) {
 		...groups.direct === void 0 ? {} : { direct: groups.direct }
 	};
 }
-/** An included relation must exist on the same resource, be tenancy-free and never include itself back. */
+/**
+* An included relation must exist on the same resource, be tenancy-free and
+* never include itself back.
+*/
 function assertIncludes(node) {
 	const state = /* @__PURE__ */ new Map();
 	const visit = (name, path) => {
@@ -210,8 +219,8 @@ function assertGroupTarget(registry, node, relationName, spec, target, targetRel
 /**
 * Links and group targets name declared resources and relations. Groups may
 * nest within one resource (teams in teams) through the same relation, which
-* then includes nothing, so SQL can walk it with one bounded recursive query;
-* a group cycle across resources is rejected.
+* then includes nothing, so SQL can walk it with one bounded recursive query; a
+* group cycle across resources is rejected.
 */
 function assertGraphTargets(registry) {
 	const edges = /* @__PURE__ */ new Map();

package/dist/{retire-Wj6dkyDE.js → retire-B2xffQgY.js}

@@ -1,6 +1,6 @@
-import { r as escapeSqlIdent } from "./sql-B96movIM.js";
-import { a as RETIRE_MARKER } from "./markers-C6joDI3o.js";
-import { r as tableKey } from "./deciding-columns-DRo2QM6E.js";
+import { r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
+import { a as RETIRE_MARKER } from "./markers-BeHZ4x9Q.js";
+import { r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 //#region src/cli/rls/retire.ts
 const IDENT = String.raw`(?:"[^"]+"|[A-Za-z_][\w$]*)`;
 const NAME = String.raw`(${IDENT}(?:\s*\.\s*${IDENT})?)`;
@@ -139,7 +139,10 @@ function replay(statements) {
 	}
 	return schema;
 }
-/** Functions that write `table`, the configured `refresh` ones, and every function that calls one. */
+/**
+* Functions that write `table`, the configured `refresh` ones, and every
+* function that calls one.
+*/
 function refreshFunctions(schema, table, configured) {
 	const writes = writesPattern(table);
 	const found = new Set(configured.map(key));
@@ -155,7 +158,10 @@ function refreshFunctions(schema, table, configured) {
 	}
 	return found;
 }
-/** Calls of a legacy helper outside its own definition, grants and drops (PD056). */
+/**
+* Calls of a legacy helper outside its own definition, grants and drops
+* (PD056).
+*/
 function legacyHelperCalls(statements, name) {
 	const own = new RegExp(String.raw`^\s*(?:create\s+(?:or\s+replace\s+)?function|drop\s+function|revoke|grant|alter\s+function|comment\s+on\s+function)\b[^(]*?(?:^|[\s."])${name}"?\s*\(`, "iu");
 	const call = new RegExp(String.raw`(?<![\w$])(?:(?:"[^"]+"|\w+)\s*\.\s*)?"?${name}"?\s*\(`, "giu");
@@ -224,7 +230,10 @@ function retirePlan(statements, config) {
 function escapeQualifiedName(name) {
 	return name.split(".").map((part) => escapeSqlIdent(part)).join(".");
 }
-/** The retire migration: each present table without readers, its refresh triggers and functions, and the uncalled helpers. */
+/**
+* The retire migration: each present table without readers, its refresh
+* triggers and functions, and the uncalled helpers.
+*/
 function retireSql(plan) {
 	const tables = plan.tables.filter((table) => table.present && table.readers.length === 0);
 	if (tables.length === 0) return;

package/dist/{revocations-R07lFBnX.d.ts → revocations-BaUXHM1N.d.ts}

@@ -3,7 +3,10 @@ type RevocationEvent = {
   readonly principal: string;
   readonly session?: string;
   readonly tenant?: string;
-  /** `session-revoked` ends a connection; `changed` makes it re-resolve its subject. */
+  /**
+   * `session-revoked` ends a connection; `changed` makes it re-resolve its
+   * subject.
+   */
   readonly kind: "session-revoked" | "changed";
 };
 type RevocationListener = (event: RevocationEvent) => void;
@@ -14,8 +17,8 @@ type RevocationListener = (event: RevocationEvent) => void;
 type RevocationFeed = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  subscribe(listener: RevocationListener): () => void;
-  revoke(event: RevocationEvent): void | Promise<void>;
+  subscribe: (listener: RevocationListener) => () => void;
+  revoke: (event: RevocationEvent) => void | Promise<void>;
 };
 /** In-process feed; a multi-replica app bridges `revoke` to its own pub/sub. */
 declare function memoryRevocationFeed(): RevocationFeed;

package/dist/{rls-Ck_PocSp.js → rls-Ba9wN0SP.js}

@@ -1,13 +1,16 @@
-import { c as missingInput } from "./errors-DpP_U6Bf.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/rls.ts
 const membershipsFlag = { memberships: {
 	type: "string",
 	description: "Membership table as <table>:tenant,user,role",
 	valueHint: "table"
 } };
-/** The flags that shape the generated SQL; verify --introspect and migrate take them too. */
+/**
+* The flags that shape the generated SQL; verify --introspect and migrate take
+* them too.
+*/
 const shapeFlags = {
 	target: {
 		type: "enum",
@@ -141,7 +144,10 @@ const SHAPE_DEFAULTS = {
 	schemas: void 0,
 	"db-url-stdin": false
 };
-/** Every RlsRunInput field at its "not given" value, with the shape flags applied. */
+/**
+* Every RlsRunInput field at its "not given" value, with the shape flags
+* applied.
+*/
 async function rlsInput(ctx, verb, shape, options) {
 	return {
 		cwd: ctx.cwd,
@@ -186,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-CxBZb4rZ.js")).runRls(input);
+	return (await import("./rls-Cx0dtsB7.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {
@@ -209,7 +215,8 @@ const generate = defineLeaf({
 			valueHint: "parts",
 			list: true,
 			async complete() {
-				return (await import("./output-files-DPAY7-GX.js")).SPLIT_PARTS;
+				const { SPLIT_PARTS } = await import("./output-files-BHOIlrfD.js");
+				return SPLIT_PARTS;
 			}
 		},
 		"grants-out": {