permdock 0.4.0 → 0.6.0

package/dist/manifest-dvL2XEe1.js

@@ -0,0 +1,370 @@
+//#region src/cli/core/manifest.ts
+const DOCS_BASE = "https://permdock.com/docs/cli";
+function leaf(name, summary, options) {
+	return {
+		kind: "leaf",
+		name,
+		summary,
+		...options
+	};
+}
+function group(name, summary, docs, children) {
+	return {
+		kind: "group",
+		name,
+		summary,
+		docs,
+		children
+	};
+}
+const SECTIONS = [
+	{
+		title: "Get started",
+		entries: [
+			leaf("init", "Write a preset's permissions, policy, app and wiring into the project", {
+				examples: [
+					"permdock init --preset p1AQIDBAc",
+					"permdock init --archetype b2b --framework hono --integration mcp",
+					"permdock init --archetype api --auth supabase --backend drizzle --service cloud-decision-log"
+				],
+				docs: "init",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).init
+			}),
+			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
+				examples: ["permdock preset decode p1AQIDBAc"],
+				docs: "preset",
+				effects: [],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).presetDecode
+			}), leaf("url", "Print the permdock.com/create link that opens a code", {
+				examples: ["permdock preset url p1AQIDBAc"],
+				docs: "preset",
+				effects: [],
+				config: false,
+				load: async () => (await import("./init-GG6Jh8HD.js")).presetUrl
+			})]),
+			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
+				leaf("install", "Copy the Agent Skills into the agent folders", {
+					examples: [
+						"permdock skills install",
+						"permdock skills install --for cursor --for claude",
+						"permdock skills install --check"
+					],
+					docs: "skills",
+					effects: ["files"],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).install
+				}),
+				leaf("update", "Replace installed skills with this version's", {
+					examples: ["permdock skills update"],
+					docs: "skills",
+					effects: ["files"],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).update
+				}),
+				leaf("list", "List the skills and where each is installed", {
+					examples: ["permdock skills list"],
+					docs: "skills",
+					effects: [],
+					config: false,
+					load: async () => (await import("./skills-CTYwkl44.js")).list
+				})
+			]),
+			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
+				examples: [
+					"permdock doctor",
+					"permdock doctor --only imports,references",
+					"permdock doctor --format github"
+				],
+				docs: "doctor",
+				effects: ["files"],
+				config: true,
+				findings: true,
+				load: async () => (await import("./doctor-3ZqNHX_G.js")).doctor
+			}),
+			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
+				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
+				docs: "completion",
+				effects: [],
+				config: false,
+				shellOutput: true,
+				load: async () => (await import("./completion-BTFrHZhX.js")).completion
+			})
+		]
+	},
+	{
+		title: "Permissions",
+		entries: [
+			leaf("collect", "Scan the sources for definePermissions() and references; write the catalog and barrel", {
+				examples: [
+					"permdock collect",
+					"permdock collect --check",
+					"permdock collect --watch"
+				],
+				docs: "collect",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./collect-Ci6akVwH.js")).collect
+			}),
+			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
+				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
+				docs: "catalog",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./catalog-DZVbrF-z.js")).catalog
+			}),
+			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
+				examples: ["permdock usage", "permdock usage --fail-on warning"],
+				docs: "usage",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./usage-CRVl9V3t.js")).usage
+			}),
+			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
+				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
+				docs: "diff",
+				effects: [],
+				config: true,
+				load: async () => (await import("./diff-CmuSD3vc.js")).diff
+			}),
+			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
+				examples: ["permdock config", "permdock config --print"],
+				docs: "config",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./config-Bj2Ixq3d.js")).config
+			})
+		]
+	},
+	{
+		title: "Database",
+		entries: [
+			group("rls", "Generate, import, verify or migrate Postgres RLS policies", "rls", [
+				leaf("generate", "Compile the policy into RLS policies and helpers", {
+					examples: ["permdock rls generate --target sql --out supabase/schemas/permdock.sql", "permdock rls generate --check"],
+					docs: "rls",
+					effects: [
+						"files",
+						"database:read",
+						"network"
+					],
+					config: true,
+					load: async () => (await import("./rls-BAqP4q66.js")).generate
+				}),
+				leaf("import", "Turn existing RLS policies into a generated definition", {
+					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
+					docs: "rls",
+					effects: ["files", "database:read"],
+					config: true,
+					load: async () => (await import("./rls-BAqP4q66.js")).importPolicies
+				}),
+				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
+					examples: [
+						"permdock rls verify",
+						"permdock rls verify --kind pgtap",
+						"permdock rls verify --introspect --db-url-stdin"
+					],
+					docs: "rls",
+					effects: ["database:read"],
+					config: true,
+					load: async () => (await import("./rls-BAqP4q66.js")).verify
+				}),
+				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
+					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
+					docs: "rls",
+					effects: ["rewrite", "files"],
+					config: true,
+					load: async () => (await import("./rls-BAqP4q66.js")).migrate
+				})
+			]),
+			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
+				examples: ["permdock supabase hook generate --out supabase/schemas/permdock_hook.sql", "permdock supabase hook generate --check"],
+				docs: "supabase",
+				effects: ["files", "database:read"],
+				config: true,
+				load: async () => (await import("./supabase-By_frk3U.js")).hookGenerate
+			})]), leaf("inspect", "Print or write the hook and helper manifest", {
+				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
+				docs: "supabase",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./supabase-By_frk3U.js")).inspect
+			})]),
+			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
+				examples: ["permdock powersync generate", "permdock powersync generate --check"],
+				docs: "powersync",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./powersync-DISt6SUe.js")).generate
+			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
+				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
+				docs: "powersync",
+				effects: ["database:read"],
+				config: true,
+				load: async () => (await import("./powersync-DISt6SUe.js")).verify
+			})])
+		]
+	},
+	{
+		title: "Interop",
+		entries: [
+			group("openapi", "Emit security into an OpenAPI document, or import one into a definition", "openapi", [leaf("emit", "Write security and securitySchemes into an OpenAPI document", {
+				examples: ["permdock openapi emit --doc openapi.json --out openapi.secured.json", "permdock openapi emit --doc openapi.json --kind overlay --out overlay.json"],
+				docs: "openapi",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./openapi-C4dDTVEd.js")).emit
+			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
+				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
+				docs: "openapi",
+				effects: ["files", "network"],
+				config: false,
+				load: async () => (await import("./openapi-C4dDTVEd.js")).importDocument
+			})]),
+			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
+				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
+				docs: "arazzo",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./arazzo-41WuzHou.js")).check
+			})]),
+			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
+				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
+				docs: "scan",
+				effects: [],
+				config: true,
+				findings: true,
+				load: async () => (await import("./scan-qvOe0hS3.js")).scan
+			}),
+			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
+				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
+				docs: "casl",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./casl-64gpT-8x.js")).caslImport
+			})]),
+			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
+				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
+				docs: "casbin",
+				effects: ["files"],
+				config: false,
+				load: async () => (await import("./casbin-Cr7RLtA3.js")).casbinImport
+			})])
+		]
+	},
+	{
+		title: "Account and Cloud",
+		entries: [
+			leaf("login", "Log in to PermDock Cloud with the device flow (RFC 8628) or a loopback redirect (RFC 8252)", {
+				examples: ["permdock login", "permdock login --scope catalog:write"],
+				docs: "login",
+				effects: ["network", "files"],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).login
+			}),
+			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
+				examples: ["permdock logout"],
+				docs: "login",
+				effects: ["network", "files"],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).logout
+			}),
+			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
+				examples: ["permdock whoami", "permdock whoami --json"],
+				docs: "login",
+				effects: [],
+				config: false,
+				load: async () => (await import("./login-Dfe5RlYk.js")).whoami
+			}),
+			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
+				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
+				docs: "cloud",
+				effects: ["network", "cloud:write"],
+				config: true,
+				load: async () => (await import("./cloud-ytQ3uviA.js")).push
+			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
+				examples: ["permdock cloud pull --project prj_123"],
+				docs: "cloud",
+				effects: ["network", "files"],
+				config: true,
+				load: async () => (await import("./cloud-ytQ3uviA.js")).pull
+			})])
+		]
+	},
+	{
+		title: "Upgrade",
+		entries: [leaf("codemod", "Apply a release's renames to files that import permdock; list call sites to edit by hand", {
+			examples: ["permdock codemod 0.5 --dry-run", "permdock codemod 0.5 src"],
+			docs: "codemod",
+			effects: ["rewrite"],
+			config: false,
+			load: async () => (await import("./codemod-5mpSpnUY.js")).codemod
+		})]
+	}
+];
+/** The hidden leaf shells call for dynamic completion candidates. */
+const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a partial command line", {
+	examples: [],
+	docs: "completion",
+	effects: [],
+	config: false,
+	shellOutput: true,
+	hidden: true,
+	load: async () => (await import("./completion-BTFrHZhX.js")).complete
+});
+const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
+/** Each leaf with its path from the root, in manifest order. */
+function leaves(entry = ROOT, path = []) {
+	return entry.children.flatMap((child) => child.kind === "leaf" ? [{
+		path: [...path, child.name],
+		entry: child
+	}] : leaves(child, [...path, child.name]));
+}
+/**
+* Walks positional tokens down the tree until a leaf. Flags may sit
+* anywhere; only bare words name a child.
+*/
+function resolve(argv) {
+	let node = ROOT;
+	const path = [];
+	const rest = [];
+	for (const [i, token] of argv.entries()) {
+		if (token === "--") {
+			rest.push(...argv.slice(i));
+			break;
+		}
+		if (token.startsWith("-") && token !== "-") {
+			rest.push(token);
+			continue;
+		}
+		const child = node.children.find((item) => item.name === token);
+		if (child === void 0) return {
+			kind: "group",
+			path,
+			entry: node,
+			unknown: token,
+			rest: [...rest, ...argv.slice(i + 1)]
+		};
+		path.push(child.name);
+		if (child.kind === "leaf") return {
+			kind: "leaf",
+			path,
+			entry: child,
+			rest: [...rest, ...argv.slice(i + 1)]
+		};
+		node = child;
+	}
+	return {
+		kind: "group",
+		path,
+		entry: node,
+		rest
+	};
+}
+//#endregion
+export { resolve as a, leaves as i, ROOT as n, SECTIONS as r, DOCS_BASE as t };

package/dist/manifest-json-CAGzls-C.js

@@ -0,0 +1,9 @@
+//#region src/cli/manifest-json.ts
+/** Where `permdock supabase inspect --out` writes the manifest by default. */
+const MANIFEST_FILE = "permdock.manifest.json";
+/** The bytes `permdock supabase inspect --out` and `permdock cloud pull` write. */
+function formatManifestJson(manifest) {
+	return `${JSON.stringify(manifest, null, 2)}\n`;
+}
+//#endregion
+export { formatManifestJson as n, MANIFEST_FILE as t };

package/dist/{manifest-uDS9y5de.d.ts → manifest-mx5ghSFM.d.ts}

@@ -13,6 +13,13 @@ type SupabaseHookManifest = {
     readonly schema: string;
     readonly function: "custom_access_token_hook";
     readonly out: string;
+    /**
+     * How the project turns SQL into migrations: `pg-delta` (`supabase db
+     * schema declarative sync`, which keeps the hook's grants in `out`),
+     * `migra` (`supabase db diff`, which drops them) or `migrations`
+     * (hand-written). Absent means `pg-delta`.
+     */
+    readonly schemas?: "pg-delta" | "migra" | "migrations";
     readonly before?: readonly string[];
   };
   readonly helpers: {
@@ -91,7 +98,7 @@ type SupabaseManifestThrough = {
 type SupabaseManifestRole = SupabaseManifestValue | (SupabaseManifestColumn & {
   readonly through: SupabaseManifestThrough;
 });
-/** One `fromTable` or `fromJunction` source. */
+/** One `tableMembershipSource` or `junctionMembershipSource` source. */
 type SupabaseManifestMembership = {
   /** `schema.table`, `public` when the source names no schema. */
   readonly table: string;
@@ -99,7 +106,7 @@ type SupabaseManifestMembership = {
   readonly user: SupabaseManifestColumn | (SupabaseManifestColumn & {
     readonly through: SupabaseManifestThrough;
   });
-  /** A column for `fromTable`, the fixed scope for `fromJunction`. */
+  /** A column for `tableMembershipSource`, the fixed scope for `junctionMembershipSource`. */
   readonly scope: SupabaseManifestValue;
   readonly id: SupabaseManifestColumn;
   /** A role column, the fixed roles every row holds, or several role columns whose keys the row holds together. */