permdock 0.7.0 → 0.9.0

package/dist/{sources-B-zYB4GS.js → sources-CMAM-2A3.js}

@@ -1,8 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlRows } from "./sql-B96movIM.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlRows } from "./sql-0WjxIp9g.js";
 //#region src/supabase/keep.ts
-/** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
+/**
+* The permission keys of a suspended scope's `keep`, references read by `key`,
+* sorted and unique.
+*/
 function keptKeys(row) {
 	const keep = row?.keep;
 	if (keep === void 0) return [];
@@ -30,8 +33,8 @@ function activeRow(row, id) {
 	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
 /**
-* The suspendable instances on the row's chain whose scope keeps
-* permissions: each one's active check and its kept keys.
+* The suspendable instances on the row's chain whose scope keeps permissions:
+* each one's active check and its kept keys.
 */
 function keeping(shape) {
 	const scopes = Object.entries(shape.suspension?.scopes ?? {}).flatMap(([name, row]) => {
@@ -55,9 +58,8 @@ function keepsDisabled(shape) {
 	return shape.disabledAt !== void 0 && keptKeys(shape.suspension?.memberships).length > 0;
 }
 /**
-* The keys a row on a suspended chain still grants, as a sorted `jsonb`
-* array: the keys every suspended instance on it keeps. `null` when nothing
-* is kept.
+* The keys a row on a suspended chain still grants, as a sorted `jsonb` array:
+* the keys every suspended instance on it keeps. `null` when nothing is kept.
 */
 function keptSql(shape) {
 	const list = keeping(shape);
@@ -167,10 +169,10 @@ function isRoleList(role) {
 }
 /**
 * Resolves the role sources of `table` (`schema.table`, or `public`). An
-* unqualified `through` table is in `table`'s schema. `label` names the
-* option in the error for an `on` that is not exactly one column; `prefix`
-* starts every error. A row with several sources holds the union of their
-* non-null keys.
+* unqualified `through` table is in `table`'s schema. `label` names the option
+* in the error for an `on` that is not exactly one column; `prefix` starts
+* every error. A row with several sources holds the union of their non-null
+* keys.
 */
 function roleColumn(role, table, alias, options) {
 	if (!isRoleList(role)) return singleRole(role, table, alias, options);
@@ -253,7 +255,10 @@ function singleRole(role, table, alias, options) {
 		nullable: false
 	};
 }
-/** The manifest entry of one role source: the column, and the roles table it references. */
+/**
+* The manifest entry of one role source: the column, and the roles table it
+* references.
+*/
 function sourceManifest(column, through, map) {
 	if (map !== void 0) return {
 		column,
@@ -272,7 +277,10 @@ function sourceManifest(column, through, map) {
 function columnManifest(role) {
 	return sourceManifest(role.column, role.through);
 }
-/** The manifest entry of a role column, or one entry per source of a row with several. */
+/**
+* The manifest entry of a role column, or one entry per source of a row with
+* several.
+*/
 function roleManifest(role) {
 	if (!role.lateral) return sourceManifest(role.column, role.through, role.map);
 	return role.columns.map((column) => sourceManifest(column, role.throughs.find((through) => through.ref === column)));
@@ -284,7 +292,10 @@ const literal = quoteSqlLiteral;
 function isFixed(roles) {
 	return Array.isArray(roles);
 }
-/** A role column of the membership table, aliased `m`; a `through` column joins its roles table as `mk`. */
+/**
+* A role column of the membership table, aliased `m`; a `through` column joins
+* its roles table as `mk`.
+*/
 function memberRole(role, table, label, guard) {
 	return roleColumn(role, qualifySqlTable(table), "m", {
 		label,
@@ -292,7 +303,10 @@ function memberRole(role, table, label, guard) {
 		...guard === void 0 ? {} : { guard }
 	});
 }
-/** The user of the membership table, aliased `m`; a `through` user joins its table as `mu`. */
+/**
+* The user of the membership table, aliased `m`; a `through` user joins its
+* table as `mu`.
+*/
 function memberUser(user, table, label) {
 	const column = roleColumn(user, qualifySqlTable(table), "m", {
 		label,
@@ -384,9 +398,10 @@ function sourceOf(sql, query) {
 }
 /**
 * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
-* `SqlQuery` for `tableMembershipSource`, `junctionMembershipSource` and `supabaseApprovalStore`.
-* `ctx.postgres` runs as the caller under RLS, so the membership tables must
-* be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
+* `SqlQuery` for `tableMembershipSource`, `junctionMembershipSource` and
+* `supabaseApprovalStore`. `ctx.postgres` runs as the caller under RLS, so the
+* membership tables must be readable by `authenticated`; `ctx.postgresAdmin`
+* bypasses RLS.
 */
 function optionalColumn(name, cast) {
 	return name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
@@ -396,9 +411,9 @@ function supabasePostgresQuery(postgres) {
 }
 /**
 * Memberships from one table holding every scope: a row per user, scope,
-* instance and role (`user_id, scope, scope_id, role`), with optional
-* `within`, `via`, expiry, owner and seat columns. Rows of the same instance
-* merge into one membership.
+* instance and role (`user_id, scope, scope_id, role`), with optional `within`,
+* `via`, expiry, owner and seat columns. Rows of the same instance merge into
+* one membership.
 */
 function tableMembershipSource(options) {
 	return tableSource(options, void 0);
@@ -604,12 +619,15 @@ function junctionSource(options, guard) {
 }
 const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 /**
-* The default schema of everything PermDock generates: helpers, seeds, the
-* RBAC scaffold, the hook and the version table. Keep it out of the Data
-* API's exposed schemas, so the `security definer` functions are not RPCs.
+* The default schema of everything PermDock generates: helpers, seeds, the RBAC
+* scaffold, the hook and the version table. Keep it out of the Data API's
+* exposed schemas, so the `security definer` functions are not RPCs.
 */
 const PERMDOCK_SCHEMA = "permdock";
-/** Where `supabase.hook.api` puts the PostgREST wrappers, and the prefix of their names. */
+/**
+* Where `supabase.hook.api` puts the PostgREST wrappers, and the prefix of
+* their names.
+*/
 const HOOK_API_SCHEMA = "public";
 const HOOK_API_PREFIX = "permdock_";
 /** The wrapper function names of `supabase.hook.api` for `prefix`. */
@@ -622,7 +640,8 @@ function hookApiNames(prefix = HOOK_API_PREFIX) {
 }
 /**
 * Reads the authorization version `permdock supabase hook generate` keeps in
-* `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
+* `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version
+* })`.
 */
 function authzVersion(options) {
 	const table = quoteQualifiedTable(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);

package/dist/{sources-DEEuGb8S.d.ts → sources-CWG32C0G.d.ts}

@@ -1,7 +1,7 @@
-import { et as MembershipSource } from "./policy-types-B-F-qAZk.js";
-import { b as SupabaseSuspension, n as RoleMap, r as RoleThrough } from "./types-BfVmNJO5.js";
-import { t as SqlQuery } from "./sql-CDEPCA0g.js";
-import { c as SupabaseManifestMembership } from "./manifest-BVhExYhw.js";
+import { nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
+import { n as RoleMap, r as RoleThrough, x as SupabaseSuspension } from "./types-BMVDHvI0.js";
+import { t as SqlQuery } from "./sql-B80DFdpG.js";
+import { c as SupabaseManifestMembership } from "./manifest-CzzWtnAb.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */
 type RoleKeys = {
@@ -13,7 +13,10 @@ type RoleKeys = {
   /** The referencing table's column. */
   readonly ref: string;
 };
-/** One role source of a membership row: a key column, or a reference to a roles table. */
+/**
+ * One role source of a membership row: a key column, or a reference to a roles
+ * table.
+ */
 type RoleSource = string | RoleThrough | RoleMap;
 /** A role source, or several the row holds at once. */
 type RoleSpec = RoleSource | readonly RoleSource[];
@@ -27,7 +30,10 @@ type RoleGuard = {
   readonly table: string;
   /** The tenant column of the roles table. */
   readonly tenant: string;
-  /** A tenant row with this column true is the application's own copy of a declared role. */
+  /**
+   * A tenant row with this column true is the application's own copy of a
+   * declared role.
+   */
   readonly skip?: string | undefined;
   readonly declared: readonly string[];
 };
@@ -35,13 +41,22 @@ type RoleGuard = {
 //#region src/supabase/sources.d.ts
 type Common = {
   readonly table: string;
-  /** Runs the lookups; without it the source only describes SQL (for `permdock supabase hook generate`). */
+  /**
+   * Runs the lookups; without it the source only describes SQL (for `permdock
+   * supabase hook generate`).
+   */
   readonly query?: SqlQuery;
-  /** Drop suspended users and memberships under suspended instances, like `rls.suspension`. */
+  /**
+   * Drop suspended users and memberships under suspended instances, like
+   * `rls.suspension`.
+   */
   readonly suspension?: SupabaseSuspension;
 };
 type MembershipTableOptions = Common & {
-  /** Column names; `user`, `scope`, `id` and `role` default to `user_id`, `scope`, `scope_id`, `role`. */
+  /**
+   * Column names; `user`, `scope`, `id` and `role` default to `user_id`,
+   * `scope`, `scope_id`, `role`.
+   */
   readonly columns?: {
     /** The user id column, or a reference to a table that holds the user id. */
     readonly user?: string | RoleThrough;
@@ -50,8 +65,8 @@ type MembershipTableOptions = Common & {
     /** A `jsonb` column of ancestor ids keyed by scope name. */
     readonly within?: string;
     /**
-     * The role key column, a reference to a roles table that holds the key,
-     * or several of them: the row holds every non-null key.
+     * The role key column, a reference to a roles table that holds the key, or
+     * several of them: the row holds every non-null key.
      */
     readonly role?: RoleSpec;
     readonly via?: string;
@@ -63,7 +78,10 @@ type MembershipTableOptions = Common & {
     readonly reason?: string;
     /** A subgroup column filling `member.group`. */
     readonly group?: string;
-    /** A text column; the value `idp` marks the row as owned by the identity provider. */
+    /**
+     * A text column; the value `idp` marks the row as owned by the identity
+     * provider.
+     */
     readonly managedBy?: string;
     /** A `text[]` column of seats. */
     readonly seats?: string;
@@ -74,16 +92,19 @@ type MembershipTableOptions = Common & {
 type MembershipJunctionOptions = Common & {
   /** The declared scope every row is a membership of. */
   readonly scope: string;
-  /** The user id column (default `user_id`), or a reference to a table that holds the user id. */
+  /**
+   * The user id column (default `user_id`), or a reference to a table that
+   * holds the user id.
+   */
   readonly user?: string | RoleThrough;
   /** The column holding the scope instance id. Default `<scope>_id`. */
   readonly id?: string;
   /** Ancestor id columns keyed by scope name. */
   readonly within?: Readonly<Record<string, string>>;
   /**
-   * A role column, a reference to a roles table that holds the key, fixed
-   * roles every row holds (a contact table with no role column), or
-   * `{ sources }`: several role columns whose non-null keys the row holds.
+   * A role column, a reference to a roles table that holds the key, fixed roles
+   * every row holds (a contact table with no role column), or `{ sources }`:
+   * several role columns whose non-null keys the row holds.
    */
   readonly roles: string | RoleThrough | RoleMap | readonly string[] | {
     readonly sources: readonly RoleSource[];
@@ -100,7 +121,10 @@ type MembershipJunctionOptions = Common & {
   readonly group?: string | {
     readonly column: string;
   };
-  /** `idp` when the identity provider owns every row, or a text column holding `idp` per row. */
+  /**
+   * `idp` when the identity provider owns every row, or a text column holding
+   * `idp` per row.
+   */
   readonly managedBy?: "idp" | {
     readonly column: string;
   };
@@ -109,51 +133,81 @@ type MembershipJunctionOptions = Common & {
   /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
   readonly x?: string;
 };
-/** What `permdock supabase hook generate` compiles; the same SQL the source runs. */
+/**
+ * What `permdock supabase hook generate` compiles; the same SQL the source
+ * runs.
+ */
 type MembershipSql = {
   readonly table: string;
-  /** The table's user column: the user id, or with `userThrough` the reference to the row holding it. */
+  /**
+   * The table's user column: the user id, or with `userThrough` the reference
+   * to the row holding it.
+   */
   readonly user: string;
-  /** The table that holds the user id when `user` references it; a change of that id bumps the old and the new user. */
+  /**
+   * The table that holds the user id when `user` references it; a change of
+   * that id bumps the old and the new user.
+   */
   readonly userThrough?: RoleKeys;
-  /** `<table>.<user>%type`: the PL/pgSQL type of the user id column, for a variable `select` compares with. */
+  /**
+   * `<table>.<user>%type`: the PL/pgSQL type of the user id column, for a
+   * variable `select` compares with.
+   */
   readonly userType: string;
   /**
-   * The `select` of claim rows for one user, with every filter applied.
-   * `user` must have the column's type (a `userType` variable, or an untyped
-   * `$1` Postgres infers): the column is compared uncast so its index applies.
-   * `keep` adds the `keep` column; it defaults to `keeps`, and a `union`
-   * with a source that keeps passes `true`.
+   * The `select` of claim rows for one user, with every filter applied. `user`
+   * must have the column's type (a `userType` variable, or an untyped `$1`
+   * Postgres infers): the column is compared uncast so its index applies.
+   * `keep` adds the `keep` column; it defaults to `keeps`, and a `union` with a
+   * source that keeps passes `true`.
    */
-  select(user: string, keep?: boolean): string;
+  select: (user: string, keep?: boolean) => string;
   /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
-  list(keep?: boolean): string;
-  /** A suspended scope on the source keeps permissions: rows of its suspended instances stay, with a `keep` column. */
+  list: (keep?: boolean) => string;
+  /**
+   * A suspended scope on the source keeps permissions: rows of its suspended
+   * instances stay, with a `keep` column.
+   */
   readonly keeps: boolean;
-  /** A text column holding `idp` for rows the identity provider owns; `''` when every row is owned. */
+  /**
+   * A text column holding `idp` for rows the identity provider owns; `''` when
+   * every row is owned.
+   */
   readonly managed?: string;
   /** Other tables the `select` reads (suspension tables). */
   readonly reads: readonly string[];
-  /** The roles table the role column references; a key change bumps every holder's authorization version. */
+  /**
+   * The roles table the role column references; a key change bumps every
+   * holder's authorization version.
+   */
   readonly through?: RoleKeys;
   /** Every roles table the role columns reference, `through` first. */
   readonly throughs: readonly RoleKeys[];
-  /** Every column that decides who holds which membership: user, scope, id, `within`, role, `via` and expiry. */
+  /**
+   * Every column that decides who holds which membership: user, scope, id,
+   * `within`, role, `via` and expiry.
+   */
   readonly columns: readonly string[];
-  /** For a single-scope source: its scope and the scopes whose ids each row carries. */
+  /**
+   * For a single-scope source: its scope and the scopes whose ids each row
+   * carries.
+   */
   readonly scope?: string;
   readonly holds?: readonly string[];
   /** The source's entry in the hook manifest's `memberships`. */
   readonly manifest: SupabaseManifestMembership;
   /** What the ownership triggers count; absent on a source that is not a table. */
   readonly holders?: MembershipHolders;
-  /** The rows as plain columns, for Sync Streams and `powerSyncSource`; a source without it does not sync. */
+  /**
+   * The rows as plain columns, for Sync Streams and `powerSyncSource`; a source
+   * without it does not sync.
+   */
   readonly stream?: MembershipStream;
 };
 /**
- * One membership source as columns a Sync Streams query can filter on.
- * Tables are `schema.table`; a `through` table is qualified in the source's
- * schema when it names none.
+ * One membership source as columns a Sync Streams query can filter on. Tables
+ * are `schema.table`; a `through` table is qualified in the source's schema
+ * when it names none.
  */
 type MembershipStream = {
   readonly table: string;
@@ -166,7 +220,10 @@ type MembershipStream = {
     readonly value: string;
   };
   readonly id: string;
-  /** The role sources (the row holds every non-null key), or the fixed roles every row holds. */
+  /**
+   * The role sources (the row holds every non-null key), or the fixed roles
+   * every row holds.
+   */
   readonly roles: RoleSpec | {
     readonly value: readonly string[];
   };
@@ -178,9 +235,15 @@ type MembershipStream = {
   };
   readonly expiresAt?: string;
   readonly disabledAt?: string;
-  /** A row may hold no role key: such a row is no membership, and a reader drops it. */
+  /**
+   * A row may hold no role key: such a row is no membership, and a reader drops
+   * it.
+   */
   readonly nullableRoles: boolean;
-  /** The guard the source reads its roles table with: a tenant row named like a declared role is no role. */
+  /**
+   * The guard the source reads its roles table with: a tenant row named like a
+   * declared role is no role.
+   */
   readonly guard?: RoleGuard;
 };
 /**
@@ -189,23 +252,32 @@ type MembershipStream = {
  * suspended holder still holds the role.
  */
 type MembershipHolders = {
-  /** `<table>.<id column>%type`: the type of a variable `rows` compares the id column with. */
+  /**
+   * `<table>.<id column>%type`: the type of a variable `rows` compares the id
+   * column with.
+   */
   readonly idType: string;
-  /** The instance id of scope `scope` the PL/pgSQL record `row` holds, as text; null on a row of another scope. */
-  id(scope: string, row: string): string;
   /**
-   * `select id, user_id, role, via, live` over the rows of scope `scope`
-   * in `from` (default the table): one row per held role key, `live` false
-   * once expired. `id` is an expression of `idType` the id column must equal.
+   * The instance id of scope `scope` the PL/pgSQL record `row` holds, as text;
+   * null on a row of another scope.
+   */
+  id: (scope: string, row: string) => string;
+  /**
+   * `select id, user_id, role, via, live` over the rows of scope `scope` in
+   * `from` (default the table): one row per held role key, `live` false once
+   * expired. `id` is an expression of `idType` the id column must equal.
    */
-  rows(scope: string, options?: {
+  rows: (scope: string, options?: {
     readonly id?: string;
     readonly from?: string;
-  }): string;
+  }) => string;
 };
 type SqlMembershipSource = MembershipSource & {
   readonly sql: MembershipSql;
-  /** The same source with the role keys of tenant rows of `guard.table` named like a declared role read as null. */
+  /**
+   * The same source with the role keys of tenant rows of `guard.table` named
+   * like a declared role read as null.
+   */
   readonly guarded?: (guard: RoleGuard) => SqlMembershipSource;
 };
 /** The part of `@supabase/server`'s `PostgresApi` a `SqlQuery` needs. */
@@ -215,9 +287,9 @@ type SupabasePostgres = {
 declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
 /**
  * Memberships from one table holding every scope: a row per user, scope,
- * instance and role (`user_id, scope, scope_id, role`), with optional
- * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
- * merge into one membership.
+ * instance and role (`user_id, scope, scope_id, role`), with optional `within`,
+ * `via`, expiry, owner and seat columns. Rows of the same instance merge into
+ * one membership.
  */
 declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
 /**
@@ -229,7 +301,8 @@ declare function junctionMembershipSource(options: MembershipJunctionOptions): S
 declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 /**
  * Reads the authorization version `permdock supabase hook generate` keeps in
- * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
+ * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version
+ * })`.
  */
 declare function authzVersion(options: {
   readonly query: SqlQuery;

package/dist/{sql-B96movIM.js → sql-0WjxIp9g.js}

@@ -1,9 +1,15 @@
 //#region src/core/sql.ts
-/** The rows of a `SqlQuery` result, whichever of its two shapes the driver resolved. */
+/**
+* The rows of a `SqlQuery` result, whichever of its two shapes the driver
+* resolved.
+*/
 function sqlRows(result) {
 	return Array.isArray(result) ? result : result.rows;
 }
-/** A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and `_`, not starting with a digit. */
+/**
+* A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and
+* `_`, not starting with a digit.
+*/
 const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 /** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
 function quoteSqlIdent(name, prefix = "PermDock") {
@@ -17,21 +23,33 @@ function quoteSqlTable(name, prefix = "PermDock") {
 function quoteSqlLiteral(value) {
 	return `'${value.replaceAll("'", "''")}'`;
 }
-/** A double-quoted identifier read back from a database, embedded quotes doubled rather than refused. */
+/**
+* A double-quoted identifier read back from a database, embedded quotes doubled
+* rather than refused.
+*/
 function escapeSqlIdent(name) {
 	return `"${name.replaceAll("\"", "\"\"")}"`;
 }
 const PLAIN_IDENT = /^[a-z_][a-z0-9_]*$/u;
-/** An identifier left bare when it is already lower snake case, otherwise quoted by `escapeSqlIdent`. */
+/**
+* An identifier left bare when it is already lower snake case, otherwise quoted
+* by `escapeSqlIdent`.
+*/
 function sqlIdent(name) {
 	return PLAIN_IDENT.test(name) ? name : escapeSqlIdent(name);
 }
-/** The plain-identifier check behind `quoteSqlIdent`, returning the name unquoted. */
+/**
+* The plain-identifier check behind `quoteSqlIdent`, returning the name
+* unquoted.
+*/
 function assertSqlIdent(name, prefix = "PermDock") {
 	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
 	return name;
 }
-/** `name` with `public.` added when it names no schema; generated functions run with `search_path = ''`. */
+/**
+* `name` with `public.` added when it names no schema; generated functions run
+* with `search_path = ''`.
+*/
 function qualifySqlTable(name) {
 	return name.includes(".") ? name : `public.${name}`;
 }
@@ -43,7 +61,10 @@ function quoteQualifiedTable(name, prefix = "PermDock") {
 function sqlTextArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteSqlLiteral).join(", ")}]::text[]`;
 }
-/** The SQL command a default verb runs: `read`, `list` and `get` select, `create` inserts, `update` and `delete` keep their name. */
+/**
+* The SQL command a default verb runs: `read`, `list` and `get` select,
+* `create` inserts, `update` and `delete` keep their name.
+*/
 function defaultSqlCommand(action) {
 	switch (action) {
 		case "read":

package/dist/{sql-CDEPCA0g.d.ts → sql-B80DFdpG.d.ts}

@@ -1,7 +1,7 @@
 //#region src/core/sql.d.ts
 /**
- * Runs one parameterised statement: `pg`'s `client.query` (which resolves
- * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
+ * Runs one parameterised statement: `pg`'s `client.query` (which resolves `{
+ * rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
  */
 type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
   readonly rows: readonly Record<string, unknown>[];