permdock 0.3.1 → 0.5.0

package/dist/powersync-BHfuehf3.js

@@ -0,0 +1,62 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/powersync.ts
+const generate = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "The Sync Streams file (default sync-config.yaml)",
+			valueHint: "file"
+		},
+		...checkFlag,
+		...policyFlag
+	},
+	async run(ctx, { flags }) {
+		const out = fileOut("powersync", flags.out);
+		const from = given(flags.policy);
+		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		return runPowerSync({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["generate"],
+			check: flags.check,
+			...out === void 0 ? {} : { out },
+			...from === void 0 ? {} : { from }
+		});
+	}
+});
+const verify = defineLeaf({
+	flags: {
+		out: {
+			type: "string",
+			description: "The Sync Streams file to verify (default sync-config.yaml)",
+			valueHint: "file"
+		},
+		...dbUrlFlags,
+		fixtures: {
+			type: "string",
+			description: "Fixtures file (default rls.fixtures.json)",
+			valueHint: "file"
+		},
+		...policyFlag
+	},
+	async run(ctx, { flags }) {
+		const out = fileOut("powersync", flags.out);
+		const db = await dbUrl(ctx, flags, { required: true });
+		const fixtures = given(flags.fixtures);
+		const from = given(flags.policy);
+		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		return runPowerSync({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			rest: ["verify"],
+			check: false,
+			...out === void 0 ? {} : { out },
+			...db === void 0 ? {} : { db },
+			...fixtures === void 0 ? {} : { fixtures },
+			...from === void 0 ? {} : { from }
+		});
+	}
+});
+//#endregion
+export { generate, verify };

package/dist/powersync-CbzkqL_M.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-bYUDLOAO.js";

package/dist/{powersync-Dv1_aWF7.js → powersync-bYUDLOAO.js}

@@ -1,22 +1,23 @@
-import { i as findPermission } from "./permissions-DVoF6dMt.js";
-import { c as isConditionRef, s as isConditionDate } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-BDwEZWrZ.js";
-import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { c as isConditionRef, s as isConditionDate } from "./refs-K6eWUJ0H.js";
+import { E as memoryCustomRoleSource, f as localSnapshotManifest } from "./src-DLfUWFAI.js";
+import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as createPermDock } from "./permdock-CbgvLnuo.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
-import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import "./sources-4p0-4xQm.js";
-import { G as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-Cewd_-zI.js";
-import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-CZOMlwHl.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { a as ownershipRules } from "./rls-ownership-DcYlZ09B.js";
-import { t as canFixture } from "./rls-verify-CMv9H3wV.js";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { u as usageResult } from "./errors-CWTY6uih.js";
+import { c as requirePolicy } from "./load-DFS_ry0W.js";
+import { i as scopeMembershipTable, r as scopeColumn } from "./compile-CMqMx_IN.js";
+import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
+import "./sources-vs5dGOsS.js";
+import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { i as fileDrift } from "./output-files-DhRBBE4n.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
+import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-CD11nBbC.js";
+import { f as pgConnector } from "./policies-CO1oOymN.js";
+import { M as contextRefs, k as collectGrants, t as ownershipRules } from "./ownership-BatFgAA4.js";
+import { m as tableFor, t as canFixture } from "./verify-DbCL9bnB.js";
 import { resolve } from "node:path";
-//#region src/cli/powersync-streams.ts
+//#region src/cli/powersync/streams.ts
 function ident(name) {
 	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
 	return name;
@@ -228,7 +229,7 @@ function subjectStreams(ctx) {
 	const database = rls?.authorize === "database";
 	const globalRoles = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
 	if (globalRoles !== void 0) own(globalRoles.table, globalRoles.user ?? "user_id", globalRoles.role ?? "role");
-	if (database && rls?.customRoles === true) {
+	if (database && customRolesOn(rls)) {
 		const root = ctx.scopes[0]?.name;
 		const tenants = root === void 0 ? void 0 : scopeMembershipTable(memberships, ctx.scopes, root);
 		const column = tenants === void 0 || root === void 0 ? void 0 : scopeColumn(tenants, ctx.scopes, root);
@@ -364,17 +365,15 @@ function powersyncYaml(plan) {
 	return `${lines.join("\n")}\n`;
 }
 //#endregion
-//#region src/cli/powersync.ts
+//#region src/cli/powersync/powersync.ts
 const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
-permdock powersync verify [--db <url>] [--fixtures rls.fixtures.json]`;
+permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
 const DEFAULT_OUT = "sync-config.yaml";
 function powersyncOut(config, out) {
 	return out ?? config.powersync?.out ?? DEFAULT_OUT;
 }
-async function loadPolicy(cwd, config, from) {
-	const path = from ?? config.policy;
-	if (path === void 0) throw new Error("PermDock CLI: powersync needs policy in the config or --from");
-	return asPolicy(pickNamed(await loadModule(resolve(cwd, path)), ["policy"]));
+function loadPolicy(cwd, config, from) {
+	return requirePolicy(cwd, from ?? config.policy, "powersync needs policy in the config or --policy");
 }
 function sameJson(current, expected) {
 	try {
@@ -409,11 +408,10 @@ function powersyncFiles(policy, config, out) {
 function staleFiles(cwd, files) {
 	const stale = [];
 	for (const file of files) {
-		const path = resolve(cwd, file.path);
-		const current = existsSync(path) ? readFileSync(path, "utf8") : void 0;
-		if (!(current !== void 0 && (file.json === true ? sameJson(current, file.text) : current === file.text))) stale.push({
+		const found = fileDrift(resolve(cwd, file.path), file.text, file.json === true ? sameJson : void 0);
+		if (found !== void 0) stale.push({
 			path: file.path,
-			missing: current === void 0
+			missing: found.kind === "missing"
 		});
 	}
 	return stale;
@@ -460,10 +458,10 @@ async function verifyStreams(input) {
 			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
 			if (permission === void 0 || stream === void 0) continue;
 			const tenant = rowValue(fixture.row, root);
-			const permdock = await createPermDock(input.policy, fixtureSubject({
+			const permdock = await getPermDock(input.policy, fixtureSubject({
 				...fixture.subject,
 				...tenant === void 0 ? {} : { tenant }
-			}), { customRoles: memoryRoleSource(input.customRoles) });
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
 			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 			const holds = await synced(query, stream, fixture);
 			if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
@@ -502,7 +500,7 @@ async function runPowerSync(input) {
 			code: 1,
 			output: stale.map((file) => `${file.path} is stale: run permdock powersync generate`).join("\n")
 		};
-		for (const file of files) writeFileSync(resolve(input.cwd, file.path), file.text);
+		applyFiles(input.cwd, files);
 		return {
 			code: 0,
 			output: [...files.map((file) => `wrote ${file.path}`), ...warnings].join("\n")
@@ -519,7 +517,7 @@ async function runPowerSync(input) {
 			fixtures,
 			customRoles,
 			db: input.db,
-			connect: input.connect ?? ((db) => connectPg(db, "permdock powersync verify --db"))
+			connect: input.connect ?? pgConnector("permdock powersync verify --db-url-stdin", input.cwd)
 		});
 		mismatches.push(...database.mismatches);
 		notes.push(...database.notes);

package/dist/preset/index.d.ts

@@ -0,0 +1,146 @@
+//#region src/preset/catalog.d.ts
+/**
+ * The preset catalogue: every choice `/create` and `permdock init` offer.
+ * Each list is append-only and its order is part of the preset code
+ * (`codec.ts`): a new choice goes at the end, and a removed one keeps its
+ * slot as `retired`.
+ */
+type ArchetypeId = "b2b" | "agent" | "marketplace" | "api" | "internal" | "consumer";
+type FeatureId = "tenancy" | "custom-roles" | "approvals" | "operations" | "decision-log" | "limits" | "plans" | "ownership" | "api-keys" | "rls";
+type AuthId = "custom" | "supabase" | "better-auth" | "clerk" | "jwt";
+type BackendId = "memory" | "supabase" | "drizzle" | "prisma";
+type FrameworkId = "next" | "hono" | "express" | "none";
+type IntegrationId = "ai-sdk" | "mcp" | "shadcn" | "react-native";
+/** `agent`: an agent runtime adapter; `ui`: `@permdock` registry recipes. */
+type IntegrationKind = "agent" | "ui";
+type ServiceId = "cloud-decision-log" | "cloud-approvals" | "cloud-snapshots" | "cloud-hosted-grants";
+type Choice<Id extends string> = {
+  readonly id: Id;
+  readonly title: string;
+  readonly description: string;
+  /** Features this choice turns on when it is picked. */
+  readonly requires?: readonly FeatureId[];
+  /** A choice kept only so older preset codes still decode. */
+  readonly retired?: true;
+};
+/** An integration choice: an agent runtime adapter or a set of UI recipes. */
+type Integration = Choice<IntegrationId> & {
+  readonly kind: IntegrationKind;
+};
+export declare const ARCHETYPES: readonly Choice<ArchetypeId>[];
+export declare const FEATURES: readonly Choice<FeatureId>[];
+export declare const AUTH: readonly Choice<AuthId>[];
+export declare const BACKENDS: readonly Choice<BackendId>[];
+export declare const FRAMEWORKS: readonly Choice<FrameworkId>[];
+/**
+ * Agent runtimes and UI recipes. The preset code keeps one bitset per
+ * `kind`, each in this list's order, so a new entry goes after the last
+ * one of its kind.
+ */
+export declare const INTEGRATIONS: readonly Integration[];
+export declare const SERVICES: readonly Choice<ServiceId>[];
+/** A complete preset: every choice `/create` and `permdock init` offer, resolved. */
+type Preset = {
+  readonly archetype: ArchetypeId;
+  readonly features: readonly FeatureId[];
+  readonly auth: AuthId;
+  readonly backend: BackendId;
+  readonly framework: FrameworkId;
+  readonly integrations: readonly IntegrationId[];
+  readonly services: readonly ServiceId[];
+};
+/** What a person picks; `resolvePreset` fills in the rest from `PRESET_DEFAULTS`. */
+type PresetInput = Partial<Preset> & {
+  readonly archetype: ArchetypeId;
+};
+/** The choices a preset starts from, in `/create` and in `permdock init`. */
+export declare const PRESET_DEFAULTS: Preset;
+/** The integrations of one `kind` in `preset`, in catalogue order. */
+export declare function integrationsOf(preset: Pick<Preset, "integrations">, kind: IntegrationKind): IntegrationId[];
+/**
+ * The preset `input` describes, with every feature its archetype,
+ * integrations and other features require turned on, and lists in
+ * catalogue order. Features are only ever added, so resolving twice is a
+ * no-op.
+ */
+export declare function resolvePreset(input: PresetInput): Preset;
+//#endregion
+//#region src/preset/codec.d.ts
+/** The preset code for `preset`, such as `p1AQIDBAc`. */
+export declare function encodePreset(preset: Preset): string;
+/**
+ * The preset a code stands for, resolved, or `undefined` for a code that
+ * is not a version this package reads or does not decode.
+ */
+export declare function decodePreset(code: string): Preset | undefined;
+//#endregion
+//#region src/preset/flags.d.ts
+/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+export declare const PRESET_FLAGS: { readonly [K in keyof Preset]: {
+  readonly flag: string;
+  readonly choices: readonly Choice<string>[];
+  readonly repeatable: boolean;
+}; };
+/**
+ * The `permdock init` flags that select `preset`, leaving out defaults and
+ * the features its archetype and integrations already turn on, so
+ * `permdock init <flags>` resolves to the same preset.
+ */
+export declare function presetFlags(preset: Preset): string[];
+//#endregion
+//#region src/preset/generate-shared.d.ts
+/** One file the preset writes into the application, relative to its root. */
+type GeneratedFile = {
+  readonly path: string;
+  readonly contents: string;
+  /**
+   * `owned`: the application's own code, edited freely and never
+   * rewritten by an update. Every generated file is owned; rules, checks and
+   * verification stay in the `permdock` package, which these files only call.
+   */
+  readonly kind: "owned";
+};
+//#endregion
+//#region src/preset/generate.d.ts
+type GeneratedPreset = {
+  readonly code: string;
+  readonly files: readonly GeneratedFile[];
+  /** Packages to add with the application's package manager. */
+  readonly dependencies: readonly string[];
+  /** `@permdock` registry items to add with `npx shadcn@latest add`. */
+  readonly recipes: readonly string[];
+  /** Pages to read next, as `/docs` paths. */
+  readonly docs: readonly string[];
+};
+/**
+ * The files, dependencies and recipes for `preset`. Pure: no file system
+ * and no network, so the same function runs in the CLI, in a registry route
+ * and in the browser preview on /create.
+ */
+export declare function generatePreset(preset: Preset, options?: {
+  readonly src?: string;
+}): GeneratedPreset;
+//#endregion
+//#region src/preset/matrix.d.ts
+/** How one role reaches one action under a preset. */
+type MatrixAccess = {
+  /** `allow`: always; `own`: on rows it owns; `pro`: on the pro plan; `none`: never. */
+  readonly access: "allow" | "own" | "pro" | "none";
+  readonly approval: boolean;
+  readonly limit: boolean;
+};
+type PresetMatrix = {
+  readonly roles: readonly string[];
+  readonly rows: readonly {
+    readonly resource: string;
+    readonly action: string;
+    readonly cells: Readonly<Record<string, MatrixAccess>>;
+  }[];
+};
+/**
+ * Who may do what under `preset`, from the same model the generated policy
+ * is written from, for a page that shows the policy without running it.
+ */
+export declare function presetMatrix(preset: Preset): PresetMatrix;
+//#endregion
+export type { ArchetypeId, AuthId, BackendId, Choice, FeatureId, FrameworkId, GeneratedFile, GeneratedPreset, Integration, IntegrationId, IntegrationKind, MatrixAccess, Preset, PresetInput, PresetMatrix, ServiceId };

package/dist/preset/index.js

@@ -0,0 +1 @@
+export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-DZdU0tne.js";