permdock 0.4.0 → 0.5.0

package/dist/powersync-BFSbSElQ.js

@@ -1,62 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/powersync.ts
-function powersync(ctx) {
-	return defineCommand({
-		meta: {
-			name: "powersync",
-			description: COMMAND_DESCRIPTIONS.powersync
-		},
-		args: {
-			...globalArgs,
-			verb: {
-				type: "positional",
-				required: false,
-				description: "generate or verify"
-			},
-			out: {
-				type: "string",
-				description: "The Sync Streams file (default sync-config.yaml)",
-				valueHint: "file"
-			},
-			check: {
-				type: "boolean",
-				description: "generate: exit 1 when the file on disk is stale; write nothing"
-			},
-			db: {
-				type: "string",
-				description: "verify: Postgres connection string to run the fixtures against",
-				valueHint: "url"
-			},
-			fixtures: {
-				type: "string",
-				description: "verify: fixtures file (default rls.fixtures.json)",
-				valueHint: "file"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting policy (default: policy in the config)",
-				valueHint: "file"
-			}
-		},
-		async run({ args: parsed }) {
-			const out = stringArg(parsed.out);
-			const db = stringArg(parsed.db);
-			const fixtures = stringArg(parsed.fixtures);
-			const from = stringArg(parsed.from);
-			const { runPowerSync } = await import("./powersync-DCDgZgfZ.js");
-			ctx.report(await runPowerSync({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				check: parsed.check === true,
-				...out === void 0 ? {} : { out },
-				...db === void 0 ? {} : { db },
-				...fixtures === void 0 ? {} : { fixtures },
-				...from === void 0 ? {} : { from }
-			}));
-		}
-	});
-}
-//#endregion
-export { powersync };

package/dist/powersync-DCDgZgfZ.js

@@ -1,2 +0,0 @@
-import { n as runPowerSync } from "./powersync-cZe4kzhL.js";
-export { runPowerSync };

package/dist/rls-55DQTuf5.js

@@ -1,250 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/rls.ts
-function rls(ctx) {
-	return defineCommand({
-		meta: {
-			name: "rls",
-			description: COMMAND_DESCRIPTIONS.rls
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "generate, import, verify or migrate"
-			},
-			target: {
-				type: "enum",
-				options: [
-					"sql",
-					"drizzle",
-					"prisma"
-				],
-				description: "generate: output form"
-			},
-			dialect: {
-				type: "enum",
-				options: [
-					"supabase",
-					"neon",
-					"guc"
-				],
-				description: "How the database reads the subject (default rls.dialect)"
-			},
-			out: {
-				type: "string",
-				description: "File to write",
-				valueHint: "file"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the policy, instead of the config",
-				valueHint: "module"
-			},
-			sql: {
-				type: "string",
-				description: "import / migrate: SQL file or folder to read",
-				valueHint: "path"
-			},
-			db: {
-				type: "string",
-				description: "Postgres connection string",
-				valueHint: "url"
-			},
-			fixtures: {
-				type: "string",
-				description: "verify: fixtures file",
-				valueHint: "file"
-			},
-			schema: {
-				type: "string",
-				description: "import: schema library, or the helper schema",
-				valueHint: "name"
-			},
-			memberships: {
-				type: "string",
-				description: "import: membership table",
-				valueHint: "table"
-			},
-			format: {
-				type: "string",
-				description: "verify: node or pgtap",
-				valueHint: "format"
-			},
-			emit: {
-				type: "string",
-				description: "Alias of --format",
-				valueHint: "format"
-			},
-			rbac: {
-				type: "enum",
-				options: ["supabase"],
-				description: "generate: scaffold the role tables for this provider"
-			},
-			"rbac-scaffold": {
-				type: "boolean",
-				description: "generate: scaffold the role tables"
-			},
-			"rbac-schema": {
-				type: "string",
-				description: "Schema for the scaffolded role tables",
-				valueHint: "name"
-			},
-			authorize: {
-				type: "string",
-				description: "Where roles are read: 'jwt' or 'database'",
-				valueHint: "mode"
-			},
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the files on disk are stale; write nothing"
-			},
-			"skip-closures": {
-				type: "boolean",
-				description: "Skip grants with closures instead of failing"
-			},
-			"inline-functions": {
-				type: "boolean",
-				description: "Inline helper calls into the policies"
-			},
-			force: {
-				type: "boolean",
-				description: "Overwrite an existing file"
-			},
-			"guc-prefix": {
-				type: "string",
-				description: "guc dialect: setting prefix",
-				valueHint: "prefix"
-			},
-			"policy-per-role": {
-				type: "boolean",
-				description: "One policy per role instead of one per command"
-			},
-			"policy-name": {
-				type: "string",
-				description: "Policy name template",
-				valueHint: "template"
-			},
-			"tenant-type": {
-				type: "string",
-				description: "Postgres type of the tenant column",
-				valueHint: "type"
-			},
-			"custom-roles": {
-				type: "boolean",
-				description: "Emit the custom role tables and helpers"
-			},
-			capabilities: {
-				type: "boolean",
-				description: "Emit the link capability helpers"
-			},
-			fields: {
-				type: "string",
-				description: "Field security: 'views'",
-				valueHint: "mode"
-			},
-			"revoke-columns": {
-				type: "boolean",
-				description: "Revoke restricted columns on the table"
-			},
-			tree: {
-				type: "boolean",
-				description: "verify: check the relationship closure"
-			},
-			introspect: {
-				type: "boolean",
-				description: "verify: compare against the live database"
-			},
-			advisors: {
-				type: "boolean",
-				description: "verify: run the Supabase security advisors"
-			},
-			split: {
-				type: "string",
-				description: "Write helpers, seeds, policies and hook as separate parts",
-				valueHint: "parts"
-			},
-			"grants-out": {
-				type: "string",
-				description: "File for the helper and hook privileges db diff drops",
-				valueHint: "file"
-			},
-			"seeds-out": {
-				type: "string",
-				description: "File for the role_permissions seeds",
-				valueHint: "file"
-			},
-			"backfill-out": {
-				type: "string",
-				description: "File for the rls.customRoles.from copy",
-				valueHint: "file"
-			},
-			"retire-out": {
-				type: "string",
-				description: "migrate: file dropping the rls.migrate.tables",
-				valueHint: "file"
-			},
-			"helpers-only": {
-				type: "boolean",
-				description: "Write the helpers and keep the policies hand-written"
-			},
-			shims: {
-				type: "boolean",
-				description: "Wrap each rls.migrate helper under its legacy name"
-			},
-			write: {
-				type: "boolean",
-				description: "migrate: rewrite the files instead of a dry run"
-			}
-		},
-		async run({ args: parsed }) {
-			const result = await (await import("./rls-BEktUaqg.js")).runRls({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				target: parsed.target,
-				dialect: parsed.dialect,
-				out: stringArg(parsed.out),
-				from: stringArg(parsed.from),
-				sql: stringArg(parsed.sql),
-				db: stringArg(parsed.db),
-				fixtures: stringArg(parsed.fixtures),
-				schema: stringArg(parsed.schema),
-				memberships: stringArg(parsed.memberships),
-				format: stringArg(parsed.format) ?? stringArg(parsed.emit),
-				rbac: parsed["rbac-scaffold"] === true || parsed.rbac === "supabase",
-				rbacSchema: stringArg(parsed["rbac-schema"]),
-				authorize: stringArg(parsed.authorize),
-				check: parsed.check === true,
-				skipClosures: parsed["skip-closures"] === true,
-				inlineFunctions: parsed["inline-functions"] === true,
-				force: parsed.force === true,
-				gucPrefix: stringArg(parsed["guc-prefix"]),
-				policyPerRole: parsed["policy-per-role"] === true,
-				policyName: stringArg(parsed["policy-name"]),
-				tenantType: stringArg(parsed["tenant-type"]),
-				customRoles: parsed["custom-roles"] === true,
-				capabilities: parsed.capabilities === true,
-				fields: stringArg(parsed.fields),
-				revokeColumns: parsed["revoke-columns"] === true,
-				tree: parsed.tree === true,
-				introspect: parsed.introspect === true,
-				advisors: parsed.advisors === true,
-				split: stringArg(parsed.split),
-				grantsOut: stringArg(parsed["grants-out"]),
-				seedsOut: stringArg(parsed["seeds-out"]),
-				backfillOut: stringArg(parsed["backfill-out"]),
-				retireOut: stringArg(parsed["retire-out"]),
-				helpersOnly: parsed["helpers-only"] === true,
-				shims: parsed.shims === true,
-				write: parsed.write === true,
-				json: ctx.json,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { rls };

package/dist/run-DMcNW_8T.js

@@ -1,174 +0,0 @@
-import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
-import { o as cliVersion } from "./version-BEogC-rB.js";
-import { a as resolveCwd, i as readConfig } from "./config-BIjREpyE.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { stripVTControlCharacters } from "node:util";
-import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
-//#region src/cli/run.ts
-const NAMES = Object.keys(commands).filter(isCommand);
-const NO_CONFIG = {
-	config: {},
-	warnings: [],
-	file: void 0
-};
-async function run(argv, options) {
-	const stdoutChunks = [];
-	const stderrChunks = [];
-	const io = options?.io ?? {
-		stdout: (text) => {
-			stdoutChunks.push(text);
-		},
-		stderr: (text) => {
-			stderrChunks.push(text);
-		}
-	};
-	const writeOut = (text) => {
-		const line = lined(text);
-		io.stdout(line);
-		if (options?.io !== void 0) stdoutChunks.push(line);
-	};
-	const writeErr = (text) => {
-		const line = lined(text);
-		io.stderr(line);
-		if (options?.io !== void 0) stderrChunks.push(line);
-	};
-	const done = (code) => ({
-		code,
-		stdout: stdoutChunks.join(""),
-		stderr: stderrChunks.join("")
-	});
-	const flags = beforeSeparator(argv);
-	const globals = parseArgs([...flags], globalArgs);
-	const json = globals.json === true;
-	const color = io.color === true && globals.color !== false;
-	const plain = (text) => color ? text : stripVTControlCharacters(text);
-	const askedHelp = flags.includes("--help") || flags.includes("-h");
-	const first = globals._[0];
-	const name = first === "help" ? globals._[1] : first;
-	let result;
-	const configFile = stringArg(globals.config);
-	const contextFor = (cwd, loaded = NO_CONFIG) => ({
-		cwd,
-		config: loaded.config,
-		...configFile === void 0 ? {} : { configFile },
-		...loaded.file === void 0 ? {} : { configPath: loaded.file },
-		configWarnings: loaded.warnings,
-		io,
-		now: io.now?.() ?? /* @__PURE__ */ new Date(),
-		json,
-		color,
-		interactive: io.interactive === true && !json && globals.yes !== true,
-		report: (outcome) => {
-			result = outcome;
-		}
-	});
-	/** A failed run: text on stderr, or Problem Details on stdout under `--json`. */
-	const fail = (kind, message, command) => {
-		if (json) writeOut(JSON.stringify(cliProblem(kind, message, command), null, 2));
-		else writeErr(message);
-		return done(exitCodeOf(kind));
-	};
-	if (name !== void 0 && !isCommand(name)) return fail("usage", `unknown command '${name}'. Use ${new Intl.ListFormat("en-GB", { type: "disjunction" }).format(NAMES)}.`);
-	if (name === void 0 && (flags.includes("--version") || flags.includes("-v"))) {
-		writeOut(cliVersion());
-		return done(0);
-	}
-	if (askedHelp || first === "help" || name === void 0) {
-		const root = rootCommand();
-		const usage = name === void 0 ? await renderUsage(root) : await renderUsage(await load(name, contextFor(options?.cwd ?? process.cwd())), root);
-		if (name === void 0 && !askedHelp && first !== "help") {
-			writeErr(plain(usage));
-			return done(2);
-		}
-		writeOut(plain(usage));
-		return done(0);
-	}
-	const cwd = resolveCwd(stringArg(globals.cwd), options?.cwd ?? process.cwd());
-	let loaded;
-	try {
-		loaded = await readConfig(cwd, configFile);
-	} catch (error) {
-		return fail(cliErrorKind(error), describeError(error));
-	}
-	if (name !== "config") for (const warning of loaded.warnings) writeErr(`permdock: warning: ${warning}`);
-	try {
-		const command = await load(name, contextFor(cwd, loaded));
-		const rawArgs = withoutCommand(argv, name);
-		await runCommand(command, { rawArgs: normaliseValues(rawArgs, await resolveArgs(command)) });
-	} catch (error) {
-		if (!(error instanceof Error)) return fail("usage", String(error), name);
-		if (error.name === "CLIError") return fail("usage", `${name}: ${stripVTControlCharacters(error.message)}`, name);
-		return fail(cliErrorKind(error), error.message, name);
-	}
-	if (result === void 0) return done(0);
-	if (json && result.code !== 0 && !isJson(result.output)) return fail(result.code === 2 ? "usage" : "failed", result.output, name);
-	writeOut(result.output);
-	return done(result.code);
-}
-/** The root help lists commands from a static table, so it loads none of them. */
-function rootCommand() {
-	return defineCommand({
-		meta: {
-			name: "permdock",
-			description: "Collect, export, diff and check the permissions a PermDock policy declares"
-		},
-		args: {
-			...globalArgs,
-			version: {
-				type: "boolean",
-				alias: "v",
-				description: "Print the permdock version"
-			}
-		},
-		subCommands: Object.fromEntries(NAMES.map((name) => [name, defineCommand({ meta: {
-			name,
-			description: COMMAND_DESCRIPTIONS[name]
-		} })]))
-	});
-}
-async function load(name, ctx) {
-	return (await commands[name]())(ctx);
-}
-function isJson(text) {
-	try {
-		JSON.parse(text);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function lined(text) {
-	return text.endsWith("\n") ? text : `${text}\n`;
-}
-function beforeSeparator(argv) {
-	const end = argv.indexOf("--");
-	return end === -1 ? argv : argv.slice(0, end);
-}
-/** argv with the command name removed, wherever the global flags put it. */
-function withoutCommand(argv, name) {
-	const index = argv.findIndex((token, i) => token === name && argv[i - 1] !== "--cwd" && argv[i - 1] !== "--config");
-	return argv.filter((_, i) => i !== index);
-}
-/**
-* A value never starts with `-` (bar `-` itself): `--out --check` is a bare
-* `--out` and `--check`, as it was before citty, which would take `--check`
-* as the value. A bare string flag reads as `''`; a bare enum flag keeps its
-* default.
-*/
-function normaliseValues(rawArgs, def) {
-	const out = [];
-	for (const [i, token] of rawArgs.entries()) {
-		if (token === "--") {
-			out.push(...rawArgs.slice(i));
-			break;
-		}
-		const arg = token.startsWith("--") ? def[token.slice(2)] : void 0;
-		const next = rawArgs[i + 1];
-		const bare = next === void 0 || next !== "-" && next.startsWith("-");
-		if (arg?.type === "enum" && bare) continue;
-		out.push(arg?.type === "string" && bare ? `${token}=` : token);
-	}
-	return out;
-}
-//#endregion
-export { run as t };