permdock 0.3.1 → 0.5.0

package/dist/credentials-DPyHmYz5.js

@@ -0,0 +1,74 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+//#region src/cli/core/io.ts
+const FRAMES = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const FRAME_MS = 80;
+/**
+* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI
+* output stay readable. `done` replaces the spinner with a final line.
+*/
+function progressReporter(input) {
+	return (message) => {
+		if (!input.tty) {
+			input.write(`${message}\n`);
+			return { done: (final) => {
+				if (final !== void 0) input.write(`${final}\n`);
+			} };
+		}
+		let frame = 0;
+		const draw = () => {
+			input.write(`\r${input.style.paint("cyan", FRAMES[frame % FRAMES.length] ?? "")} ${message}`);
+			frame += 1;
+		};
+		draw();
+		const timer = setInterval(draw, FRAME_MS);
+		timer.unref();
+		return { done: (final) => {
+			clearInterval(timer);
+			input.write(`\r\u001B[2K${final === void 0 ? "" : `${input.style.okMark} ${final}\n`}`);
+		} };
+	};
+}
+/** The value of a `--*-stdin` secret: stdin up to the first newline, trimmed. */
+async function readSecret(readStdin) {
+	if (readStdin === void 0) return;
+	const text = (await readStdin()).split(/\r?\n/u, 1)[0]?.trim() ?? "";
+	return text === "" ? void 0 : text;
+}
+//#endregion
+//#region src/cli/core/credentials.ts
+const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]+)@/giu;
+/** `text` with every registered secret and every URL password masked. */
+function redact(text, secrets) {
+	let out = text.replace(URL_PASSWORD, "$1***@");
+	for (const secret of secrets) if (secret.length >= 4) out = out.replaceAll(secret, "***");
+	return out;
+}
+/**
+* The secret piped in for `--<flag>-stdin`, when it was passed, registered
+* for redaction.
+*/
+async function secretInput(ctx, input) {
+	let value;
+	if (input.stdin) {
+		value = await readSecret(ctx.io.readStdin);
+		if (value === void 0) throw new CliError("usage", `${ctx.command}: --${input.flag}-stdin read nothing from stdin`, {
+			code: "missing_value",
+			extensions: { flag: `--${input.flag}-stdin` }
+		});
+	}
+	if (value !== void 0) ctx.addSecret(value);
+	return value;
+}
+//#endregion
+export { secretInput as n, progressReporter as r, redact as t };

package/dist/deciding-columns-Sq12mEA6.js

@@ -0,0 +1,123 @@
+//#region src/cli/sql/statements.ts
+function blankComments(sql) {
+	return sql.replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+}
+/** Split on `;` outside string literals and dollar-quoted bodies. */
+function sqlStatements(sql) {
+	const text = blankComments(sql);
+	const statements = [];
+	const push = (start, end) => {
+		const body = text.slice(start, end);
+		const lead = body.length - body.trimStart().length;
+		const trimmed = body.trim();
+		if (trimmed !== "") statements.push({
+			line: text.slice(0, start + lead).split("\n").length,
+			text: trimmed
+		});
+	};
+	let start = 0;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === "'") {
+			const end = text.indexOf("'", index + 1);
+			index = end === -1 ? text.length : end + 1;
+			continue;
+		}
+		if (char === "$") {
+			const tag = /^\$[A-Za-z_]*\$/u.exec(text.slice(index, index + 64));
+			if (tag !== null) {
+				const end = text.indexOf(tag[0], index + tag[0].length);
+				index = end === -1 ? text.length : end + tag[0].length;
+				continue;
+			}
+		}
+		if (char === ";") {
+			push(start, index);
+			start = index + 1;
+		}
+		index += 1;
+	}
+	push(start, text.length);
+	return statements;
+}
+/** Capture group `index` of a match, or '' when an optional group took no part. */
+function group(match, index) {
+	return match[index] ?? "";
+}
+const VIEW = /^create\s+(?:or\s+replace\s+)?view\s+(?<name>\S+?)(?:\s+with\s*\((?<options>[^)]*)\))?\s+as\b/iu;
+const PRIVILEGE = /^(?:grant|revoke)\s[\s\S]*?\son\s+(?<target>[\s\S]+?)\s+(?:to|from)\s/iu;
+const UNDIFFED_TARGET = /^(?:schema|function|procedure|routine|all\s+(?:functions|procedures|routines)\s+in\s+schema)\s/iu;
+function privilegeTable(target) {
+	return target.replace(/^table\s+/iu, "").trim();
+}
+function splitUndiffed(sql) {
+	const statements = sqlStatements(sql);
+	const views = /* @__PURE__ */ new Set();
+	const moved = [];
+	let kept = sql;
+	for (const { text } of statements) {
+		const view = VIEW.exec(text)?.groups;
+		if (view !== void 0) {
+			views.add(view["name"] ?? "");
+			if (view["options"] !== void 0) moved.push(`alter view ${view["name"] ?? ""} set (${view["options"]});`);
+			continue;
+		}
+		const target = PRIVILEGE.exec(text)?.groups?.["target"];
+		if (target !== void 0 && (UNDIFFED_TARGET.test(target) || views.has(privilegeTable(target)))) {
+			moved.push(`${text};`);
+			kept = kept.replace(`${text};\n`, "");
+		}
+	}
+	return {
+		kept,
+		moved
+	};
+}
+//#endregion
+//#region src/cli/sql/deciding-columns.ts
+/** `schema.table`, unquoted and lower case; `public` when unqualified. */
+function tableKey(name) {
+	const parts = name.split(".").map((part) => part.replaceAll("\"", ""));
+	return (parts.length === 1 ? ["public", ...parts] : parts).join(".").toLowerCase();
+}
+/**
+* The columns of each membership source's table that decide who holds which
+* membership (user, scope, id, `within`, role, `via`, expiry), and the id and
+* value columns of a table a role or user column references, keyed by
+* {@link tableKey}. A client that can write one can give itself a membership.
+*/
+function membershipColumns(config) {
+	const sources = config.supabase?.hook?.memberships ?? config.rls?.membershipSources ?? [];
+	const byTable = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		const table = tableKey(source.sql.table);
+		const columns = byTable.get(table) ?? /* @__PURE__ */ new Set();
+		for (const column of source.sql.columns) columns.add(column);
+		byTable.set(table, columns);
+		for (const through of [...source.sql.throughs, ...source.sql.userThrough === void 0 ? [] : [source.sql.userThrough]]) {
+			const keys = tableKey(through.table);
+			byTable.set(keys, /* @__PURE__ */ new Set([
+				...byTable.get(keys) ?? [],
+				through.id,
+				through.key
+			]));
+		}
+	}
+	return byTable;
+}
+/**
+* Every `schema.table.column` a claim or a membership is computed from: the
+* membership columns and the `attrs` table columns. Sorted.
+*/
+function decidingColumns(config, attrs) {
+	const entries = /* @__PURE__ */ new Set();
+	for (const [table, columns] of membershipColumns(config)) for (const column of columns) entries.add(`${table}.${column}`);
+	if (attrs?.table !== void 0) {
+		const table = tableKey(attrs.table);
+		for (const column of attrs.columns) entries.add(`${table}.${column}`);
+	}
+	return [...entries].toSorted();
+}
+//#endregion
+export { splitUndiffed as a, group as i, membershipColumns as n, sqlStatements as o, tableKey as r, decidingColumns as t };

package/dist/delegation-DaXVdDhM.js

@@ -0,0 +1,286 @@
+import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { t as isoInstant } from "./instant-BluqDvyS.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { t as isActive } from "./validity-CZ7-y0Cj.js";
+import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+//#region src/conditions/evaluate.ts
+function resolveRef(ref, subject) {
+	return resolveConditionRef(ref, subject);
+}
+function unwrap(value, subject) {
+	if (isConditionRef(value)) return resolveRef(value.ref, subject);
+	if (isConditionDate(value)) return new Date(isoInstant(value.date) ?? NaN);
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+function instantOf(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") return isoInstant(value);
+}
+function comparablePair(left, right) {
+	if (left instanceof Date || right instanceof Date) {
+		const a = instantOf(left);
+		const b = instantOf(right);
+		return a === void 0 || b === void 0 ? void 0 : [a, b];
+	}
+	const kind = typeof left;
+	if (kind === typeof right && (kind === "string" || kind === "number" || kind === "boolean")) return [left, right];
+}
+function compare(op, left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	const comparable = comparablePair(left, right);
+	if (comparable === void 0) return false;
+	const [a, b] = comparable;
+	switch (op) {
+		case "eq": return a === b;
+		case "ne": return a !== b;
+		case "gt": return a > b;
+		case "gte": return a >= b;
+		case "lt": return a < b;
+		case "lte": return a <= b;
+		default: return op;
+	}
+}
+function contains(left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	if (typeof left === "string" && typeof right === "string") return left.includes(right);
+	if (Array.isArray(left)) return left.includes(right);
+	return false;
+}
+function inList(left, right) {
+	if (left === void 0 || left === null || !Array.isArray(right)) return false;
+	return right.includes(left);
+}
+function matchesParentHop(data, parents, on) {
+	for (const parent of parents ?? []) {
+		const hop = parentHop(parent);
+		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
+		if (sameId(ownGet(data, hop.field), on.id)) return true;
+	}
+	return false;
+}
+function evaluateMemberOf(condition, data, subject, now, scopes) {
+	if (data === null || typeof data !== "object") return false;
+	const rowValue = ownGet(data, condition.field);
+	if (rowValue === void 0 || rowValue === null) return false;
+	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return false;
+	for (const membership of memberships) {
+		if (expiredAt(membership, now)) continue;
+		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
+		if (scope !== void 0) {
+			if (membership.scope !== scope || !sameId(membership.id, rowValue)) continue;
+			const tenant = tenantOf(membership, scopes);
+			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
+			return true;
+		}
+		if (membership.on === void 0) continue;
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) {
+			if (matchesParentHop(data, condition.parents, membership.on)) return true;
+			continue;
+		}
+		if (sameId(membership.on.id, rowValue)) return true;
+		if (matchesParentHop(data, condition.parents, membership.on)) return true;
+	}
+	return false;
+}
+function evaluateCondition(condition, data, subject, now = epochSeconds(), scopes = scopeList(void 0), related, onOpaque) {
+	switch (condition.op) {
+		case "and": return condition.conditions.every((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "or": return condition.conditions.some((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "not": return !evaluateCondition(condition.condition, data, subject, now, scopes, related, onOpaque);
+		case "isNull": {
+			if (data === null || typeof data !== "object") return false;
+			const value = ownGet(data, condition.field);
+			const isNull = value === null || value === void 0;
+			return condition.value ? isNull : !isNull;
+		}
+		case "in":
+		case "notIn": {
+			if (data === null || typeof data !== "object") return false;
+			const left = ownGet(data, condition.field);
+			const matched = inList(left, unwrap(condition.value, subject));
+			return condition.op === "in" ? matched : !matched && left !== void 0 && left !== null;
+		}
+		case "contains":
+			if (data === null || typeof data !== "object") return false;
+			return contains(ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (condition.field === "_" && condition.op === "eq") return condition.value === true;
+			if (data === null || typeof data !== "object") return false;
+			return compare(condition.op, ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "memberOf": return evaluateMemberOf(condition, data, subject, now, scopes);
+		case "related": return related?.(condition, data) === true;
+		case "sqlFunction": return evaluateCondition(condition.twin, data, subject, now, scopes, related, onOpaque);
+		case "opaque":
+			onOpaque?.();
+			return false;
+		case "liveSession": return subject.liveSession === true;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/core/row-pair.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+/**
+* The row a `where` reads and the row a `check` reads. An instance check
+* takes a `{ current, next }` pair or one row for both; a collection check
+* has no current row, only the input it creates.
+*/
+function rowValues(permission, data) {
+	if (permission.kind === "collection") return {
+		current: void 0,
+		next: data
+	};
+	if (permission.kind === "instance" && isRowPair(data)) return {
+		current: data.current,
+		next: data.next
+	};
+	return {
+		current: data,
+		next: data
+	};
+}
+/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+function rowIdOf(row, field = "id") {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
+	const id = Reflect.get(row, field);
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+}
+//#endregion
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+/** A `readOnly` actor never uses a permission without `readOnlyHint`, delegated or not. */
+function readOnlyActorRefuses(actor, permission) {
+	return actor?.readOnly === true && !annotationsFor(permission).readOnlyHint;
+}
+/**
+* Whether an `agent` actor may call the tool `name`: its `tools` list names it.
+* An agent without a `tools` list and any other actor kind are not restricted
+* here; a `tools` value that is not a list of strings refuses every tool.
+*/
+function actorMayCallTool(actor, name) {
+	if (actor?.kind !== "agent" || !Object.hasOwn(actor, "tools")) return true;
+	const tools = actor["tools"];
+	return Array.isArray(tools) && tools.some((tool) => typeof tool === "string" && tool === name);
+}
+function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
+	return (requires ?? []).every((key) => {
+		const leaf = findPermission(tree, key);
+		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
+	});
+}
+function requiresStandIn(grant) {
+	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
+export { readOnlyActorRefuses as a, rowIdOf as c, delegatedPermissions as i, rowValues as l, coveredByDelegation as n, requiresStandIn as o, coversRequirements as r, isRowPair as s, actorMayCallTool as t, evaluateCondition as u };

package/dist/delegation-input-FTxMK3ji.js

@@ -0,0 +1,19 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+//#region src/core/delegation-input.ts
+/**
+* RFC 9396 entries a token verifier put in `extra`, under
+* `authorizationDetails` or the claim's own `authorization_details`.
+*/
+function authorizationDetailsOf(extra) {
+	const details = extra?.["authorizationDetails"] ?? extra?.["authorization_details"];
+	return Array.isArray(details) ? details : void 0;
+}
+/** The delegation a verified token's scopes and `extra` carry. */
+function delegationFrom(scopes, extra) {
+	return compact({
+		scopes,
+		authorizationDetails: authorizationDetailsOf(extra)
+	});
+}
+//#endregion
+export { delegationFrom as t };

package/dist/delivery/index.d.ts

@@ -0,0 +1,5 @@
+import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-DzwivBgR.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-DX0LaKTb.js";
+import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-BcHcPyIo.js";
+export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, type ChatMessage, type ChatTransport, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type Recipient, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -0,0 +1,5 @@
+import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+import { n as subscribersFor, t as audience } from "../audience-Dg8XsRaO.js";
+import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
+import { n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-DCAgNyCn.js";
+export { approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };