permdock 0.1.0 → 0.2.0

package/dist/powersync-C7kLglqX.js

@@ -0,0 +1,540 @@
+import { i as findPermission } from "./permissions-DVoF6dMt.js";
+import { c as isConditionRef, s as isConditionDate } from "./refs-KYb4ntaz.js";
+import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-CSbUiozF.js";
+import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
+import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
+import "./sources-B0UvrJ21.js";
+import { W as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-aOQ4hGTO.js";
+import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-BMasREhR.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
+import { a as ownershipRules } from "./rls-ownership-B5Lkq62W.js";
+import { t as canFixture } from "./rls-verify-D8B7dOTh.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/powersync-streams.ts
+function ident(name) {
+	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
+	return name;
+}
+const POWERSYNC = {
+	user: "auth.user_id()",
+	claim: (name) => `auth.parameter(${quoteSqlLiteral(name)})`,
+	claims: (name) => `(SELECT value FROM json_each(auth.parameter(${quoteSqlLiteral(name)})))`,
+	column: (table, name) => `${table}.${ident(name)}`,
+	literal: (value) => typeof value === "string" ? quoteSqlLiteral(value) : String(value)
+};
+const POSTGRES = {
+	user: "$1::text",
+	claim: (name) => `($2::jsonb ->> ${quoteSqlLiteral(name)})`,
+	claims: (name) => `(select jsonb_array_elements_text(case jsonb_typeof($2::jsonb -> ${quoteSqlLiteral(name)}) when 'array' then $2::jsonb -> ${quoteSqlLiteral(name)} else '[]'::jsonb end))`,
+	column: (table, name, numeric) => `${table}.${ident(name)}${numeric === true ? "" : "::text"}`,
+	literal: (value) => typeof value === "number" ? String(value) : quoteSqlLiteral(String(value))
+};
+/** At most this many queries per stream; a wider `or` product is left out rather than truncated. */
+const MAX_QUERIES = 32;
+/** Every combination of one clause list from each input, ANDed. */
+function product(lists) {
+	let out = [[]];
+	for (const list of lists) out = out.flatMap((left) => list.map((right) => left.concat(right)));
+	return out;
+}
+function every(parts) {
+	const out = [];
+	for (const part of parts) {
+		if (part === void 0) return;
+		out.push(part);
+	}
+	return out;
+}
+/** The table as a stream query names it: unqualified in `public`, `schema.table` otherwise. */
+function bare(table) {
+	return (table.startsWith("public.") ? table.slice(7) : table).split(".").map(ident).join(".");
+}
+/** A row value: a literal, or a principal ref the token carries. `undefined` when neither. */
+function valueSql(value, ctx) {
+	if (isConditionRef(value)) {
+		if (value.ref === "principal.id") return ctx.dialect.user;
+		const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(value.ref)?.[1];
+		return claim === void 0 ? void 0 : ctx.dialect.claim(claim);
+	}
+	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return ctx.dialect.literal(value);
+}
+const COMPARE = {
+	eq: "=",
+	ne: "!=",
+	gt: ">",
+	gte: ">=",
+	lt: "<",
+	lte: "<="
+};
+/**
+* A row condition as alternatives of ANDed clauses over `table`. `undefined`
+* when part of it has no Sync Streams form, so the grant syncs nothing.
+*/
+function conditionSql(condition, table, ctx) {
+	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
+	switch (condition.op) {
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const left = typeof condition.value === "number" && SQL_IDENT.test(condition.field) ? ctx.dialect.column(table, condition.field, true) : column(condition.field);
+			if (condition.value === null && left !== void 0) return condition.op === "eq" ? [[`${left} IS NULL`]] : condition.op === "ne" ? [[`${left} IS NOT NULL`]] : void 0;
+			const right = valueSql(condition.value, ctx);
+			return left === void 0 || right === void 0 ? void 0 : [[`${left} ${COMPARE[condition.op]} ${right}`]];
+		}
+		case "isNull": {
+			const left = column(condition.field);
+			return left === void 0 ? void 0 : [[`${left} IS ${condition.value ? "" : "NOT "}NULL`]];
+		}
+		case "in":
+		case "notIn": {
+			const left = column(condition.field);
+			if (left === void 0) return;
+			const negate = condition.op === "notIn" ? "NOT " : "";
+			if (isConditionRef(condition.value)) {
+				const claim = /^principal\.claims\.([A-Za-z_][A-Za-z0-9_]*)$/u.exec(condition.value.ref)?.[1];
+				return claim === void 0 || negate !== "" ? void 0 : [[`${left} IN ${ctx.dialect.claims(claim)}`]];
+			}
+			const values = condition.value.map((value) => isConditionRef(value) || isConditionDate(value) || Array.isArray(value) ? void 0 : value === null ? void 0 : valueSql(value, ctx));
+			if (values.some((value) => value === void 0)) return;
+			return values.length === 0 ? negate === "" ? [] : [[]] : [[`${left} ${negate}IN (${values.join(", ")})`]];
+		}
+		case "and":
+		case "or": {
+			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
+			if (parts === void 0) return;
+			return condition.op === "and" ? product(parts) : parts.flat();
+		}
+		case "memberOf": {
+			if (condition.scope === "resource" || condition.parents !== void 0) return;
+			const scope = resolveScope(ctx.scopes, condition.scope);
+			const left = column(condition.field);
+			if (scope === void 0 || left === void 0) return;
+			return membershipSql(scope, left, condition.roles, ctx);
+		}
+		case "not":
+		case "contains":
+		case "related":
+		case "opaque":
+		case "sqlFunction":
+		case "liveSession": return;
+		default: return condition;
+	}
+}
+/** One `IN (SELECT …)` per role source of the membership table: the row's `left` is an instance the user holds `roles` in. */
+function membershipIn(table, idColumn, left, roles, ctx) {
+	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
+	const name = bare(table.table);
+	const sources = Array.isArray(table.role) ? table.role : [table.role];
+	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
+	const restricted = roles.some((role) => ctx.kinds[role] !== void 0);
+	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
+	const via = table.via;
+	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
+	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
+	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
+	return sources.map((source) => {
+		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
+		const [pair] = Object.entries(source.on);
+		const keys = bare(source.through);
+		const [ref, id] = pair ?? ["", ""];
+		return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${name} INNER JOIN ${keys} ON ${ctx.dialect.column(keys, id)} = ${ctx.dialect.column(name, ref)} WHERE ${[...filters, `${ctx.dialect.column(keys, source.column)} IN (${list})`].join(" AND ")})`];
+	});
+}
+function membershipSql(scope, left, roles, ctx) {
+	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
+	const idColumn = table === void 0 ? void 0 : scopeColumn(table, ctx.scopes, scope);
+	return table === void 0 || idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
+}
+/** Who the grant reaches, as alternatives of clauses; `undefined` when Sync Streams cannot express it. */
+function accessSql(item, table, ctx) {
+	const { access } = item;
+	switch (access.kind) {
+		case "anyone":
+		case "authenticated": return [[]];
+		case "role": {
+			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
+			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
+			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
+			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role} for scope ${access.scope}`;
+		}
+		case "resource": {
+			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
+			const node = ctx.policy.resources.get(item.grant.permission.resource);
+			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
+			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
+			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
+		}
+		case "actor": return "actor grantees are not in the sync token";
+		default: return access;
+	}
+}
+/** `permdock_<table>`, with a schema joined by `_`; a table in the `permdock` schema keeps one prefix. */
+function subjectStreamName(table) {
+	const name = table.replaceAll(".", "_");
+	return name.startsWith("permdock_") ? name : `permdock_${name}`;
+}
+function roleThroughs(role) {
+	return (Array.isArray(role) ? role : [role]).filter((item) => typeof item === "object" && item !== null);
+}
+/**
+* Streams of the rows a device builds the user's snapshot from: the user's
+* own membership and global-role rows, the roles tables they reference, and
+* the custom roles of the user's tenants. Each query starts from the user's
+* own rows.
+*/
+function subjectStreams(ctx) {
+	const rls = ctx.config.rls;
+	const { dialect } = ctx;
+	const tables = /* @__PURE__ */ new Map();
+	const add = (table, query, user) => {
+		const entry = tables.get(table) ?? {
+			user: void 0,
+			queries: /* @__PURE__ */ new Set()
+		};
+		if (entry.queries.size === 0) entry.user = user;
+		else if (entry.user !== user) entry.user = void 0;
+		entry.queries.add(query);
+		tables.set(table, entry);
+	};
+	const own = (table, user, role) => {
+		const name = bare(table);
+		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
+		add(name, `SELECT * FROM ${name} WHERE ${mine}`, user);
+		for (const through of roleThroughs(role)) {
+			const keys = bare(through.through);
+			const [pair] = Object.entries(through.on);
+			if (pair === void 0) continue;
+			const [ref, id] = pair;
+			add(keys, `SELECT * FROM ${keys} WHERE ${dialect.column(keys, id)} IN (SELECT ${dialect.column(name, ref)} FROM ${name} WHERE ${mine})`);
+		}
+	};
+	const memberships = rls?.memberships;
+	for (const table of [
+		...Object.values(memberships?.scopes ?? {}),
+		...memberships?.tenant === void 0 ? [] : [memberships.tenant],
+		...memberships?.team === void 0 ? [] : [memberships.team],
+		...Object.values(memberships?.resource ?? {})
+	]) own(table.table, table.user, table.role);
+	const schema = rls?.schema ?? "permdock";
+	const database = rls?.authorize === "database";
+	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
+	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
+	if (database && rls?.customRoles === true) {
+		const root = ctx.scopes[0]?.name;
+		const tenants = root === void 0 ? void 0 : scopeMembershipTable(memberships, ctx.scopes, root);
+		const column = tenants === void 0 || root === void 0 ? void 0 : scopeColumn(tenants, ctx.scopes, root);
+		for (const name of [CUSTOM_ROLES.permissions, CUSTOM_ROLES.includes]) {
+			const table = bare(`${schema}.${name}`);
+			const tenant = dialect.column(table, "tenant_id");
+			add(table, `SELECT * FROM ${table} WHERE ${tenant} IS NULL`);
+			if (tenants !== void 0 && column !== void 0) {
+				const members = bare(tenants.table);
+				add(table, `SELECT * FROM ${table} WHERE ${tenant} IN (SELECT ${dialect.column(members, column)} FROM ${members} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user})`);
+			}
+		}
+	}
+	const out = [];
+	for (const [table, entry] of tables) {
+		const name = subjectStreamName(table);
+		const queries = [...entry.queries];
+		out.push(entry.user === void 0 ? {
+			name,
+			table,
+			queries
+		} : {
+			name,
+			table,
+			user: entry.user,
+			queries
+		});
+	}
+	return out;
+}
+/** Why a grant cannot become a stream query, before its conditions are compiled. */
+function unsupported(item) {
+	const { grant } = item;
+	if (grant.breakGlass !== void 0) return "break-glass";
+	if (grant.closure !== void 0 || grant.portable === false) return "not portable";
+	if (requiresApproval(grant.approval)) return "needs approval";
+	if (grant.validity !== void 0) return "time-bounded";
+	const context = contextRefs(item.where);
+	return context.length > 0 ? `reads ${context.join(", ")}` : void 0;
+}
+/**
+* Sync Streams for each synced resource: the union of the rows its read
+* permission's allow grants reach. A grant with any part Sync Streams cannot
+* express syncs nothing, and a resource with a deny grant gets no stream, so
+* a stream never holds a row the policy denies.
+*/
+function powersyncPlan(policy, config, dialect = POWERSYNC) {
+	const scopes = scopeList(policy.scopes);
+	const ctx = {
+		policy,
+		config,
+		scopes,
+		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
+		dialect
+	};
+	const action = config.powersync?.action ?? "read";
+	const grants = collectGrants(policy);
+	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
+	const streams = [];
+	const omitted = [];
+	const warnings = [];
+	for (const resource of resources) {
+		const node = policy.resources.get(resource);
+		const key = `${resource}.${action}`;
+		const items = grants.filter((item) => item.grant.permission.key === key);
+		if (node === void 0 || items.length === 0) {
+			omitted.push({
+				resource,
+				reason: `no grant of ${key}`
+			});
+			continue;
+		}
+		if (items.some((item) => item.grant.effect === "deny")) {
+			omitted.push({
+				resource,
+				reason: `${key} has a deny grant, which Sync Streams cannot subtract`
+			});
+			continue;
+		}
+		const table = bare(tableFor(resource, config.rls?.tables));
+		const { id } = node;
+		const queries = /* @__PURE__ */ new Set();
+		for (const item of items) {
+			const label = `${item.label}/${key}`;
+			const access = unsupported(item) ?? accessSql(item, table, ctx);
+			if (typeof access === "string") {
+				warnings.push(`${label} does not sync: ${access}`);
+				continue;
+			}
+			const where = item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+			if (where === void 0) {
+				warnings.push(`${label} does not sync: its condition has no Sync Streams form`);
+				continue;
+			}
+			const columns = item.grant.fields === void 0 ? "*" : [.../* @__PURE__ */ new Set([id, ...item.grant.fields])].map((field) => ctx.dialect.column(table, field)).join(", ");
+			for (const clauses of product([access, where])) queries.add(`SELECT ${columns} FROM ${table}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
+		}
+		if (queries.size === 0) omitted.push({
+			resource,
+			reason: `no grant of ${key} compiles`
+		});
+		else if (queries.size > MAX_QUERIES) omitted.push({
+			resource,
+			reason: `${String(queries.size)} queries, over the limit of ${String(MAX_QUERIES)}`
+		});
+		else streams.push({
+			name: resource,
+			resource,
+			table,
+			id,
+			queries: [...queries]
+		});
+	}
+	return {
+		streams,
+		subject: subjectStreams(ctx),
+		omitted,
+		warnings
+	};
+}
+/** `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per synced resource. */
+function powersyncYaml(plan) {
+	const lines = [
+		"# Generated by permdock powersync generate from the policy. Do not edit.",
+		"config:",
+		"  edition: 3",
+		"",
+		"streams:"
+	];
+	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
+	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${JSON.stringify(query)}`));
+	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+//#region src/cli/powersync.ts
+const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
+permdock powersync verify [--db <url>] [--fixtures rls.fixtures.json]`;
+const DEFAULT_OUT = "sync-config.yaml";
+function powersyncOut(config, out) {
+	return out ?? config.powersync?.out ?? DEFAULT_OUT;
+}
+async function loadPolicy(cwd, config, from) {
+	const path = from ?? config.policy;
+	if (path === void 0) throw new Error("PermDock CLI: powersync needs policy in the config or --from");
+	return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
+}
+function sameJson(current, expected) {
+	try {
+		return JSON.stringify(JSON.parse(current)) === JSON.stringify(JSON.parse(expected));
+	} catch {
+		return false;
+	}
+}
+/**
+* The files the policy compiles to: the Sync Streams file and, with
+* `powersync.manifest`, the local-snapshot manifest. `warnings` lists the
+* grants that do not sync.
+*/
+function powersyncFiles(policy, config, out) {
+	const plan = powersyncPlan(policy, config);
+	const files = [{
+		path: powersyncOut(config, out),
+		text: powersyncYaml(plan)
+	}];
+	const manifest = config.powersync?.manifest;
+	if (manifest !== void 0) files.push({
+		path: manifest,
+		json: true,
+		text: `${JSON.stringify(localSnapshotManifest(policy), null, 2)}\n`
+	});
+	return {
+		files,
+		warnings: plan.warnings
+	};
+}
+/** The files whose content on disk is not what the policy compiles to, with `missing` for an absent one. */
+function staleFiles(cwd, files) {
+	const stale = [];
+	for (const file of files) {
+		const path = resolve(cwd, file.path);
+		const current = existsSync(path) ? readFileSync(path, "utf8") : void 0;
+		if (!(current !== void 0 && (file.json === true ? sameJson(current, file.text) : current === file.text))) stale.push({
+			path: file.path,
+			missing: current === void 0
+		});
+	}
+	return stale;
+}
+function rowValue(row, key) {
+	const value = key !== void 0 && row !== null && typeof row === "object" && !Array.isArray(row) ? Object.entries(row).find(([name]) => name === key)?.[1] : void 0;
+	return value === void 0 || value === null ? void 0 : String(value);
+}
+function claimsJson(fixture) {
+	return JSON.stringify(fixture.subject.claims ?? {});
+}
+/** Whether a stream of the user's own rows holds a row of another user. */
+async function leaks(query, stream, user, fixture) {
+	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(user)}::text is distinct from $1::text and $2::jsonb is not null limit 1`, [fixture.subject.id, claimsJson(fixture)])).length > 0) return true;
+	return false;
+}
+/** Whether the stream holds the fixture's row for its subject. */
+async function synced(query, stream, fixture) {
+	const value = rowValue(fixture.row, stream.id);
+	if (value === void 0) return false;
+	for (const text of stream.queries) if ((await query(`select 1 from (${text}) q where q.${quoteIdent(stream.id)}::text = $3::text and $1::text is not null and $2::jsonb is not null limit 1`, [
+		fixture.subject.id,
+		claimsJson(fixture),
+		value
+	])).length > 0) return true;
+	return false;
+}
+async function verifyStreams(input) {
+	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
+	const mismatches = [];
+	const notes = [];
+	const client = await input.connect(input.db);
+	const query = async (sql, values) => (await client.query(sql, values)).rows;
+	const root = input.policy.scopes.find((scope) => scope.within === void 0)?.key;
+	try {
+		const checked = /* @__PURE__ */ new Set();
+		for (const fixture of input.fixtures) {
+			if (checked.has(fixture.subject.id)) continue;
+			checked.add(fixture.subject.id);
+			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
+		}
+		for (const fixture of input.fixtures) {
+			const permission = findPermission(input.policy.permissions, fixture.action);
+			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
+			if (permission === void 0 || stream === void 0) continue;
+			const tenant = rowValue(fixture.row, root);
+			const permdock = await createPermDock(input.policy, fixtureSubject({
+				...fixture.subject,
+				...tenant === void 0 ? {} : { tenant }
+			}), { customRoles: memoryRoleSource(input.customRoles) });
+			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
+			const holds = await synced(query, stream, fixture);
+			if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
+			else if (granted && !holds) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
+		}
+	} finally {
+		await client.end();
+	}
+	return {
+		mismatches,
+		notes
+	};
+}
+async function runPowerSync(input) {
+	const [verb] = input.rest;
+	if (verb !== "generate" && verb !== "verify") return {
+		code: 2,
+		output: POWERSYNC_HELP
+	};
+	let policy;
+	let compiled;
+	try {
+		policy = await loadPolicy(input.cwd, input.config, input.from);
+		compiled = powersyncFiles(policy, input.config, input.out);
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	const { files, warnings } = compiled;
+	const out = powersyncOut(input.config, input.out);
+	const stale = staleFiles(input.cwd, files);
+	if (verb === "generate") {
+		if (input.check) return stale.length === 0 ? {
+			code: 0,
+			output: files.map((file) => `${file.path} is current`).join("\n")
+		} : {
+			code: 1,
+			output: stale.map((file) => `${file.path} is stale: run permdock powersync generate`).join("\n")
+		};
+		for (const file of files) writeFileSync(resolve(input.cwd, file.path), file.text);
+		return {
+			code: 0,
+			output: [...files.map((file) => `wrote ${file.path}`), ...warnings].join("\n")
+		};
+	}
+	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
+	const notes = [...warnings];
+	if (input.db !== void 0) try {
+		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
+		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
+		const database = await verifyStreams({
+			policy,
+			config: input.config,
+			fixtures,
+			customRoles,
+			db: input.db,
+			connect: input.connect ?? ((db) => connectPg(db, "permdock powersync verify --db"))
+		});
+		mismatches.push(...database.mismatches);
+		notes.push(...database.notes);
+	} catch (cause) {
+		return usageResult(cause);
+	}
+	if (mismatches.length > 0) return {
+		code: 1,
+		output: [...mismatches, ...notes].join("\n")
+	};
+	const verified = input.db === void 0 ? `${out} matches the policy` : `${out} matches the policy; no stream syncs a row the fixtures deny`;
+	return {
+		code: 0,
+		output: notes.length === 0 ? verified : `${verified}\n${notes.join("\n")}`
+	};
+}
+//#endregion
+export { runPowerSync as n, staleFiles as r, powersyncFiles as t };

package/dist/powersync-yW1UUFzp.js

@@ -0,0 +1,62 @@
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/powersync.ts
+function powersync(ctx) {
+	return defineCommand({
+		meta: {
+			name: "powersync",
+			description: COMMAND_DESCRIPTIONS.powersync
+		},
+		args: {
+			...globalArgs,
+			verb: {
+				type: "positional",
+				required: false,
+				description: "generate or verify"
+			},
+			out: {
+				type: "string",
+				description: "The Sync Streams file (default sync-config.yaml)",
+				valueHint: "file"
+			},
+			check: {
+				type: "boolean",
+				description: "generate: exit 1 when the file on disk is stale; write nothing"
+			},
+			db: {
+				type: "string",
+				description: "verify: Postgres connection string to run the fixtures against",
+				valueHint: "url"
+			},
+			fixtures: {
+				type: "string",
+				description: "verify: fixtures file (default rls.fixtures.json)",
+				valueHint: "file"
+			},
+			from: {
+				type: "string",
+				description: "Module exporting policy (default: policy in the config)",
+				valueHint: "file"
+			}
+		},
+		async run({ args: parsed }) {
+			const out = stringArg(parsed.out);
+			const db = stringArg(parsed.db);
+			const fixtures = stringArg(parsed.fixtures);
+			const from = stringArg(parsed.from);
+			const { runPowerSync } = await import("./powersync-A8x_Yyvh.js");
+			ctx.report(await runPowerSync({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				rest: parsed._,
+				check: parsed.check === true,
+				...out === void 0 ? {} : { out },
+				...db === void 0 ? {} : { db },
+				...fixtures === void 0 ? {} : { fixtures },
+				...from === void 0 ? {} : { from }
+			}));
+		}
+	});
+}
+//#endregion
+export { powersync };

package/dist/prisma/index.d.ts

@@ -1,5 +1,6 @@
-import { _r as Condition, hr as Subject, tn as WhereResult } from "../policy-CInmNGkM.js";
-import { n as WithSubjectOptions, r as RelationsMapping, t as RowCheck } from "../row-check-BajTgQZ-.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
+import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/prisma/model-fields.d.ts
 /** A model's non-nullable scalar fields and its scalar list fields, by Prisma field name. */
 type PrismaModelFields = {